@homeflare/alchemy 0.46.1 → 0.47.1

package/dist/talos/index.js

@@ -9,8 +9,8 @@ import * as Effect4 from "effect/Effect";
 import { closeSync, openSync, writeFileSync } from "node:fs";
 import * as Effect from "effect/Effect";
 import * as Stream from "effect/Stream";
-import * as ChildProcess from "effect/unstable/process/ChildProcess";
-import * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";
+import * as ChildProcess from "effect/process/ChildProcess";
+import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
 var DEFAULT_TALOSCONFIG_KEY = "talosconfig";
 var DEFAULT_KUBECONFIG_KEY = "kubeconfig";
 var readKvValue = (mount, key, fields) => Effect.gen(function* () {
@@ -59,8 +59,8 @@ var mintTalosconfig = (target) => readKvValue(target.mount, target.talosconfigKe
 // src/talos/credentials-write.ts
 import * as Effect2 from "effect/Effect";
 import * as Stream2 from "effect/Stream";
-import * as ChildProcess2 from "effect/unstable/process/ChildProcess";
-import * as ChildProcessSpawner3 from "effect/unstable/process/ChildProcessSpawner";
+import * as ChildProcess2 from "effect/process/ChildProcess";
+import * as ChildProcessSpawner3 from "effect/process/ChildProcessSpawner";
 var reservedTempPath = (label) => Effect2.gen(function* () {
   const path = `${Bun.env["TMPDIR"] ?? "/tmp"}/hf-talos-${label}-${Bun.randomUUIDv7()}.yaml`;
   yield* Effect2.addFinalizer(() => Effect2.tryPromise({ try: () => Bun.file(path).delete(), catch: () => {
@@ -161,8 +161,8 @@ var buildAttrs = (raw, props) => {
 // src/talos/talosctl.ts
 import * as Effect3 from "effect/Effect";
 import * as Stream3 from "effect/Stream";
-import * as ChildProcess3 from "effect/unstable/process/ChildProcess";
-import * as ChildProcessSpawner5 from "effect/unstable/process/ChildProcessSpawner";
+import * as ChildProcess3 from "effect/process/ChildProcess";
+import * as ChildProcessSpawner5 from "effect/process/ChildProcessSpawner";
 
 class TalosError extends Error {
   command;
@@ -572,5 +572,5 @@ export {
   TalosMachineConfigProvider
 };
 
-//# debugId=D7E7AB43E3608FE064756E2164756E21
+//# debugId=33FF194E493FB6EF64756E2164756E21
 //# sourceMappingURL=index.js.map

package/dist/talos/index.js.map

@@ -3,11 +3,11 @@
   "sources": ["../src/talos/kubeconfig.ts", "../src/talos/credentials.ts", "../src/talos/credentials-write.ts", "../src/talos/values.ts", "../src/talos/kubeconfig-attrs.ts", "../src/talos/talosctl.ts", "../src/talos/talos-bootstrap.ts", "../src/talos/talos-bootstrap-etcd.ts", "../src/talos/talos-errors.ts", "../src/talos/talos-cluster-health.ts", "../src/talos/talos-machine-config.ts", "../src/talos/machine-config-read.ts", "../src/talos/machine-config-poll.ts"],
   "sourcesContent": [
     "/**\n * `Talos.Kubeconfig` — fetch admin kubeconfig so `Kubernetes.*` workloads can connect.\n *\n * ★ REASONED FROM talosctl kubeconfig (Talos v1.13 CLI reference): writes a kubeconfig file;\n *   `--merge=false` keeps it isolated; `-f/--force` overwrites an existing file.\n *\n * ⛔ THE KUBECONFIG FILE CONTAINS A CLIENT CERTIFICATE — IT MUST NOT BE AN ATTRIBUTE. Alchemy\n *   persists attributes unencrypted. This resource persists ONLY public metadata + fingerprints,\n *   never the file's own bytes.\n *\n * ⛔ LANDS IN OPENBAO, NOT A HOST `runtimePath` (K-talos-first-boot, 2026-09-26). The shipped shape\n *   wrote a cluster-admin kubeconfig to un-vaulted host disk and never removed it — the exact class\n *   of exposure `talos/credentials.ts`'s own header exists to prevent — and its own `read` depended\n *   on that file's continued presence, so verifying from any other host planned `update` forever\n *   (docs/plans/2026-09-26-talos-secrets-flow.md's \"Measured today\" section). Fixed:\n *     - CREATE (`output === undefined`) runs `talosctl kubeconfig` into a throwaway, unguessable\n *       temp path (this file's own `reservedTempPath`), reads it back, and writes its bytes into\n *       OpenBao at `target.mount`/`kubeconfigKey` via stdin (`credentials-write.ts`'s\n *       `writeKvValue` — ⛔ never argv) — never to any path a caller could depend on.\n *     - ⛔ WRITTEN ONCE, NOT RE-MINTED EVERY DEPLOY. `talosctl kubeconfig` always issues a FRESH\n *       admin client certificate; re-running it every reconcile would rotate credentials for no\n *       reason and violate O1's write-once-at-bring-up grant on this one key\n *       (docs/plans/2026-09-26-talos-secrets-flow.md, O1). Once `output` is defined, reconcile only\n *       reads the vault copy back to confirm it — the same \"once\" shape `talos-bootstrap.ts` uses\n *       for a boolean, here for a value.\n *     - The persisted `connection` carries no usable host path — a consumer materializes its own\n *       temp file via `credentials.ts`'s `mintKubeconfig`, the same pattern `mintTalosconfig`\n *       already established. Wiring `Kubernetes.ClusterAdapter` to call it is separate, later work\n *       (named, not built, in the secrets-flow doc); this only makes the vault-backed read+mint\n *       step exist for it to call. ⛔ Until that wiring lands, `connection.auth.path` is a sentinel\n *       that can never resolve to a real file (LAND red team I2, `kubeconfig-attrs.ts`'s own\n *       header) — an ABSENT path here would let the stock `Kubernetes.KubeConfigAdapter` silently\n *       fall back to `$KUBECONFIG`/`~/.kube/config` instead of failing loudly.\n */\nimport { chmodSync } from 'node:fs';\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport type { Connection } from 'alchemy/Kubernetes/Connection';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { DEFAULT_KUBECONFIG_KEY, mintTalosconfig, readKvValue } from './credentials.ts';\nimport { reservedTempPath, writeKvValue } from './credentials-write.ts';\nimport { buildAttrs } from './kubeconfig-attrs.ts';\nimport type { TalosRequirements, WithTarget } from './resource.ts';\nimport { talosctl } from './talosctl.ts';\n\nexport interface KubeconfigProps extends WithTarget {\n  /** Node that serves `talosctl kubeconfig`. */\n  node: string;\n  /** Context name inside the generated kubeconfig — not secret. */\n  context: string;\n  /** OpenBao KV path under `target.mount` for the written kubeconfig. Default `'kubeconfig'`. */\n  kubeconfigKey?: string;\n  after?: readonly unknown[];\n}\n\nexport interface KubeconfigAttributes {\n  context: string;\n  endpoint: string;\n  certificateAuthorityFingerprint: string;\n  clientCertificateFingerprint: string;\n  /** Digest of endpoint+context+fingerprints — detects credential rotation without storing PEM. */\n  credentialGeneration: string;\n  /**\n   * Serializable `Kubernetes.Connection` for downstream workloads.\n   *\n   * ★ auth.kind `kubeconfig` is the stock ClusterAdapter — provider-roadmap.md names this seam.\n   *   `path` is a sentinel that can never resolve (LAND red team I2, `kubeconfig-attrs.ts`'s own\n   *   `toConnection` header): the content lives in OpenBao, not at a fixed host path, and a real\n   *   `Kubernetes.ClusterAdapter` wiring is later work, so this must fail rather than silently\n   *   reach the operator's own kubeconfig. A consumer materializes its own scoped temp file via\n   *   `credentials.ts`'s `mintKubeconfig` in the meantime.\n   */\n  connection: Connection;\n}\n\nexport interface TalosKubeconfig extends Resource<\n  'Talos.Kubeconfig',\n  KubeconfigProps,\n  KubeconfigAttributes,\n  never,\n  TalosRequirements\n> {}\n\nexport const TalosKubeconfig = Resource<TalosKubeconfig>('Talos.Kubeconfig');\n\n/**\n * ★ MEASURED AGAINST OPENBAO v2.6.2 (C1 fix, LAND red team, 2026-09-26 — isolated in-memory dev\n *   server, `env -i`, scratch HOME, no estate credentials; server removed after): `bao kv get` on a\n *   genuinely unwritten KV-v2 key exits 2 with stderr exactly `No value found at <mount>/data/<key>`\n *   — `readKvValue`'s Error message embeds that text verbatim. This is the ONLY signal this file\n *   trusts as \"not written yet\"; every other failure (a wrong exit code, a different stderr such as\n *   a permission denial or a network failure) propagates as a real error instead of being read as\n *   absence.\n */\nconst isVaultKeyAbsent = (error: unknown): boolean =>\n  error instanceof Error && /no value found at/i.test(error.message);\n\nconst readVaultMeta = (props: KubeconfigProps, key: string) =>\n  readKvValue(props.target.mount, key, ['kubeconfig', 'config']).pipe(\n    Effect.catchIf(isVaultKeyAbsent, () => Effect.succeed(undefined)),\n  );\n\n/**\n * ★ EXPORTED for kubeconfig.test.ts — see talos-bootstrap.ts's own note on the pattern.\n *\n * ⛔ C1 FIX (LAND red team, 2026-09-26) — `undefined` NOW MEANS ONLY \"the key has never been\n *   written\", NEVER \"some read failed\". The shipped `Effect.orElseSucceed` folded EVERY failure —\n *   including a vault outage or wrong mount — into a defined, empty-fingerprint object. Alchemy's\n *   engine always adopts a defined cold-start `read` result and forces `update` (alchemy beta.79\n *   `Plan.ts:1303-1352`), so `reconcileKubeconfig`'s write-once branch (`output !== undefined`)\n *   then tried to CONFIRM a key that had never actually been written, and failed every time —\n *   `Talos.Kubeconfig` could never be created. Vault content that EXISTS but does not parse as a\n *   kubeconfig is a different, fail-closed case (below), never treated as absence.\n */\nexport const readKubeconfig = (props: KubeconfigProps) =>\n  Effect.gen(function* () {\n    const key = props.kubeconfigKey ?? DEFAULT_KUBECONFIG_KEY;\n    const raw = yield* readVaultMeta(props, key);\n    if (raw === undefined) return undefined;\n    const meta = buildAttrs(raw, props);\n    if (meta === undefined) {\n      return yield* Effect.fail(\n        new Error(\n          `${props.target.mount}/${key}: vault content exists but does not parse as a kubeconfig ` +\n            `for context ${props.context} — not a cold start. Fix the KV entry or the pinned ` +\n            'context rather than trusting an empty read.',\n        ),\n      );\n    }\n    return meta;\n  });\n\nexport const diffKubeconfig = (\n  news: Input<KubeconfigProps>,\n  output: KubeconfigAttributes | undefined,\n) =>\n  Effect.gen(function* () {\n    if (output === undefined || !isResolved(news)) return undefined;\n    const live = yield* readKubeconfig(news);\n    if (\n      live !== undefined &&\n      live.credentialGeneration === output.credentialGeneration &&\n      live.context === output.context &&\n      live.endpoint === output.endpoint\n    ) {\n      return { action: 'noop' } as const;\n    }\n    return { action: 'update' } as const;\n  });\n\n/**\n * ⛔ WRAPPED IN `Effect.scoped` — same C1-lifetime reasoning as every other Talos resource file:\n *   `mintTalosconfig` and `reservedTempPath` both contribute `Scope.Scope`, and this is the caller\n *   that owns their lifetime for the whole reconcile.\n * ⛔ WRITE-ONCE — see this file's own header. A bring-up already ran; this branch never spawns\n *   `talosctl kubeconfig` or writes to the vault again.\n * ⛔ GATED ON `credentialGeneration`, NOT JUST `output !== undefined` (C1 fix, LAND red team,\n *   belt-and-suspenders alongside the `read` fix above) — `output`'s own type still allows a\n *   defined-but-empty value (state persisted by a pre-fix build's `emptyAttrs()`, or any future\n *   caller that hands this function a stale row). Treat that exactly like `undefined` — mint and\n *   write once — rather than take the confirm-only branch and fail trying to read back a key that\n *   was never actually written.\n */\nexport const reconcileKubeconfig = (\n  props: KubeconfigProps,\n  output: KubeconfigAttributes | undefined,\n) =>\n  Effect.scoped(\n    Effect.gen(function* () {\n      const key = props.kubeconfigKey ?? DEFAULT_KUBECONFIG_KEY;\n\n      if (output !== undefined && output.credentialGeneration !== '') {\n        const raw = yield* readKvValue(props.target.mount, key, ['kubeconfig', 'config']);\n        const meta = buildAttrs(raw, props);\n        if (meta === undefined) {\n          return yield* Effect.die(\n            new Error(\n              `${props.target.mount}/${key}: vault content no longer parses as a kubeconfig for ` +\n                `context ${props.context}. Read back rather than trusting the write once.`,\n            ),\n          );\n        }\n        return meta;\n      }\n\n      const credential = yield* mintTalosconfig(props.target);\n      const { path: outPath } = yield* reservedTempPath(\n        `${props.target.cluster}-${props.node}-kubeconfig-out`,\n      );\n      yield* talosctl(\n        ['kubeconfig', outPath, '--merge=false', '--force', '--force-context-name', props.context],\n        { nodes: [props.node], talosconfigPath: credential.talosconfigPath },\n      );\n      const raw = yield* Effect.tryPromise({\n        catch: (cause) => new Error(`${outPath}: reading generated kubeconfig: ${String(cause)}`),\n        try: () => Bun.file(outPath).text(),\n      });\n      if (raw.trim() === '') {\n        return yield* Effect.die(\n          new Error(\n            `${props.node}: talosctl kubeconfig returned no error but wrote an empty file. Read ` +\n              'back rather than trusting the exit code alone.',\n          ),\n        );\n      }\n      // ⚠️ REASONED, not measured: talosctl's own writer likely already uses 0600 like most Go\n      //   credential writers, but this chmods defensively regardless — same posture as\n      //   credentials.ts's mintKvTempFile.\n      yield* Effect.try({\n        catch: (cause) => new Error(`${outPath}: chmod 0600: ${String(cause)}`),\n        try: () => chmodSync(outPath, 0o600),\n      });\n      const meta = buildAttrs(raw, props);\n      if (meta === undefined) {\n        return yield* Effect.die(\n          new Error(\n            `${props.node}: talosctl kubeconfig wrote a file that does not parse for context ` +\n              `${props.context}.`,\n          ),\n        );\n      }\n      yield* writeKvValue(props.target.mount, key, 'kubeconfig', raw);\n      return meta;\n    }),\n  );\n\nconst handlers = {\n  delete: () => Effect.void,\n  diff: ({\n    news,\n    output,\n  }: {\n    news: Input<KubeconfigProps>;\n    output: KubeconfigAttributes | undefined;\n  }) => diffKubeconfig(news, output),\n  list: () => Effect.succeed([]),\n  read: ({ olds }: { olds: KubeconfigProps }) => readKubeconfig(olds),\n  reconcile: ({\n    news,\n    output,\n  }: {\n    news: KubeconfigProps;\n    output: KubeconfigAttributes | undefined;\n  }) => reconcileKubeconfig(news, output),\n};\n\nexport const TalosKubeconfigProvider = () =>\n  Provider.effect(TalosKubeconfig, Effect.succeed(TalosKubeconfig.Provider.of(handlers)));\n",
-    "/**\n * Talos client material minted from OpenBao, written to a session-temp file whose lifetime the\n * CALLER owns — never this module.\n *\n * ⛔ TALOSCONFIG, MACHINE CONFIG AND secrets.yaml CAN ALL HOLD CLIENT CERTIFICATES AND CLUSTER CA\n *   PRIVATE KEYS. Alchemy persists resource attributes WITHOUT encryption — `StateEncoding.ts`\n *   tags a `Redacted` value as `{ __redacted__: <plaintext> }` (`REDACTED_MARKER`), it does not\n *   encrypt it — and this estate's state store is the shared Cloudflare HTTP state store, not a\n *   database anyone forgets is world-legible. None of these three may ever be a prop, an\n *   attribute or a log line; see docs/plans/2026-09-26-talos-secrets-flow.md for why the OLD\n *   header here (Postgres, `{\"@redacted\": …}`) was wrong on both counts — the RULE survives the\n *   correction either way.\n *\n * ★ MODELED ON proxmox/credentials.ts + proxmox/mint.ts: mint at call time, use the material, drop\n *   it when the scope ends. The difference is Talos wants a FILE (`--talosconfig` / `-f`), so\n *   minting here writes a temp path and registers its own delete finalizer instead of just\n *   building a header.\n *\n * ⛔ C1 FIX (2026-09-26, K-A3) — THE SHIPPED `mintTalosconfig` DELETED ITS OWN FILE BEFORE ANY\n *   CALLER COULD USE IT. It wrapped its whole body in `Effect.scoped(...)` and registered the\n *   delete finalizer inside that same scope, so the scope — and the file — closed the instant\n *   `mintTalosconfig` RETURNED, before the caller ever got to pass the path to `talosctl`. Fixed\n *   by `Effect.acquireRelease`: it still deletes on every exit path, but contributes `Scope.Scope`\n *   to this module's own return type instead of discharging it, so the file survives until\n *   whichever `Effect.scoped(...)` the CALLER wraps around its own use of the path (every\n *   talos-*.ts resource file wraps its `read`/`reconcile` bodies for exactly this reason now).\n *\n * ⚠️ REASONED FROM THE PUBLISHED TALOS WORKFLOW, NOT MEASURED ON THIS ESTATE. There is no Talos\n *   cluster here yet; KV paths below follow the `mount/<key>` shape O1 (the secrets-flow doc)\n *   assigns, and `bao kv get` inserts the KV-v2 `data/` API segment itself — a key already\n *   prefixed `data/` reads `<mount>/data/data/<key>`, which the OLD default did.\n */\nimport { closeSync, openSync, writeFileSync } from 'node:fs';\nimport * as Effect from 'effect/Effect';\nimport type * as Scope from 'effect/Scope';\nimport * as Stream from 'effect/Stream';\nimport * as ChildProcess from 'effect/unstable/process/ChildProcess';\nimport * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';\n\n/** Where credentials come from. HomeFlare-specific mount names live in the stack, not here. */\nexport type TalosTarget = {\n  /** OpenBao KV mount holding Talos material, e.g. `talos-c1`. */\n  readonly mount: string;\n  /** Logical cluster name — safe to persist and log. */\n  readonly cluster: string;\n  /**\n   * Path under the mount for the talosconfig YAML. Default `'talosconfig'` — FIXED 2026-09-26;\n   * the shipped default was `'data/talosconfig'`, which `bao kv get` turned into\n   * `<mount>/data/data/talosconfig` (see the ⚠️ above). It failed closed rather than reading an\n   * empty talosconfig, but it would have blocked the very first deploy.\n   */\n  readonly talosconfigKey?: string;\n};\n\nexport type TalosCredential = {\n  /** Absolute path to a temp talosconfig. ⛔ NEVER PERSIST, NEVER LOG CONTENTS. */\n  readonly talosconfigPath: string;\n};\n\nconst DEFAULT_TALOSCONFIG_KEY = 'talosconfig';\n\n/**\n * Default OpenBao KV path (under `target.mount`) for the admin kubeconfig `Talos.Kubeconfig`\n * writes once at cluster bring-up. See kubeconfig.ts's own header (K-talos-first-boot, 2026-09-26)\n * and docs/plans/2026-09-26-talos-secrets-flow.md's O1 key list.\n */\nexport const DEFAULT_KUBECONFIG_KEY = 'kubeconfig';\n\n/**\n * Read one OpenBao KV-v2 value and return the first of `fields` that is a non-empty string.\n *\n * ★ THE ONE PLACE THIS PACKAGE SHELLS TO `bao` — talosconfig, per-node machine config and any\n *   future KV-backed Talos material (secrets.yaml, ceph entity keys) all read through this,\n *   so there is exactly one spot that must never echo a KV value on failure.\n * ⛔ stderr ONLY ON FAILURE. stdout may hold the very secret this call exists to fetch.\n */\nexport const readKvValue = (\n  mount: string,\n  key: string,\n  fields: readonly string[],\n): Effect.Effect<string, Error, ChildProcessSpawner.ChildProcessSpawner> =>\n  Effect.gen(function* () {\n    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;\n    const result = yield* ChildProcess.make(\n      'bao',\n      ['kv', 'get', '-format=json', `${mount}/${key}`],\n      { detached: false, extendEnv: true, stderr: 'pipe', stdin: 'ignore', stdout: 'pipe' },\n    ).pipe(\n      spawner.spawn,\n      Effect.flatMap((child) =>\n        Effect.all(\n          {\n            exitCode: child.exitCode,\n            stderr: child.stderr.pipe(\n              Stream.decodeText,\n              Stream.mkString,\n              Effect.map((text) => text.trim()),\n            ),\n            stdout: child.stdout.pipe(\n              Stream.decodeText,\n              Stream.mkString,\n              Effect.map((text) => text.trim()),\n            ),\n          },\n          { concurrency: 'unbounded' },\n        ),\n      ),\n      Effect.scoped,\n    );\n\n    if (result.exitCode !== 0) {\n      return yield* Effect.fail(\n        new Error(`bao kv get ${mount}/${key} exited ${String(result.exitCode)}: ${result.stderr}`),\n      );\n    }\n\n    const parsed = JSON.parse(result.stdout) as { data?: { data?: Record<string, unknown> } };\n    const data = parsed.data?.data;\n    for (const field of fields) {\n      const raw = data?.[field];\n      if (typeof raw === 'string' && raw.trim() !== '') return raw;\n    }\n    return yield* Effect.fail(\n      new Error(\n        `${mount}/${key} returned no ${fields.join('/')} field. Never store the value itself in ` +\n          'an Alchemy prop or attribute — fix the KV entry, not the caller.',\n      ),\n    );\n  });\n\n/**\n * Write `raw` to a session-temp, 0600, exclusively-created file whose lifetime is the CALLER's\n * `Effect.scoped`, not this call's. See the ⛔ C1 FIX note at the top of this file.\n *\n * ⛔ 0600, CREATED EXCLUSIVELY, AND `Bun.write` CANNOT DO EITHER. This file can hold a cluster\n *   admin client certificate or a machine config's bootstrap token. `Bun.write` takes no mode, so\n *   it lands at the process umask — world-readable on this estate — for as long as the resource\n *   runs. The name is unguessable, and \"unguessable\" is not a permission.\n * ⚠️ `wx` IS THE OTHER HALF. `O_EXCL` means this cannot be made to write through a path an\n *   attacker pre-created (the classic /tmp symlink race), and with a UUIDv7 name a collision is a\n *   genuine error rather than something to paper over.\n * ⚠️ A HARD KILL (SIGKILL, power loss) skips the finalizer and leaves the file behind. 0600 is\n *   what makes that survivable rather than a disclosure.\n */\nexport const mintKvTempFile = (\n  raw: string,\n  label: string,\n): Effect.Effect<{ readonly path: string }, Error, Scope.Scope> =>\n  Effect.gen(function* () {\n    const path = `${Bun.env['TMPDIR'] ?? '/tmp'}/hf-talos-${label}-${Bun.randomUUIDv7()}.yaml`;\n    yield* Effect.acquireRelease(\n      Effect.try({\n        try: () => {\n          const fd = openSync(path, 'wx', 0o600);\n          try {\n            writeFileSync(fd, raw);\n          } finally {\n            closeSync(fd);\n          }\n        },\n        catch: (cause) => new Error(`writing ${label} temp file: ${String(cause)}`),\n      }),\n      () =>\n        Effect.tryPromise({ try: () => Bun.file(path).delete(), catch: () => undefined }).pipe(\n          Effect.orElseSucceed(() => undefined),\n        ),\n    );\n    return { path };\n  });\n\n/**\n * Mint one talosconfig file for `target`.\n *\n * ⛔ CALLERS MUST WRAP THEIR WHOLE USE OF `credential.talosconfigPath` — not just this call — in\n *   `Effect.scoped(...)`. This function's own `Scope.Scope` requirement is what makes that the\n *   caller's job instead of a lie this function tells itself; see the header above.\n */\nexport const mintTalosconfig = (\n  target: TalosTarget,\n): Effect.Effect<TalosCredential, Error, ChildProcessSpawner.ChildProcessSpawner | Scope.Scope> =>\n  readKvValue(target.mount, target.talosconfigKey ?? DEFAULT_TALOSCONFIG_KEY, [\n    'talosconfig',\n    'config',\n  ]).pipe(\n    Effect.flatMap((raw) => mintKvTempFile(raw, `${target.cluster}-talosconfig`)),\n    Effect.map(({ path }): TalosCredential => ({ talosconfigPath: path })),\n  );\n\n/**\n * Mint one temp kubeconfig file from the vault copy `Talos.Kubeconfig` writes at bring-up\n * (K-talos-first-boot, 2026-09-26) — the consumer-side counterpart to {@link mintTalosconfig},\n * named as the future seam for `Kubernetes.ClusterAdapter` in\n * docs/plans/2026-09-26-talos-secrets-flow.md (\"consumers mint it the way the talosconfig is\n * minted\"). Not yet wired to that adapter — this only makes the read+materialize step exist.\n */\nexport const mintKubeconfig = (\n  target: TalosTarget,\n  key = DEFAULT_KUBECONFIG_KEY,\n): Effect.Effect<\n  { readonly path: string },\n  Error,\n  ChildProcessSpawner.ChildProcessSpawner | Scope.Scope\n> =>\n  readKvValue(target.mount, key, ['kubeconfig', 'config']).pipe(\n    Effect.flatMap((raw) => mintKvTempFile(raw, `${target.cluster}-kubeconfig`)),\n  );\n",
-    "/**\n * The write half of Talos's OpenBao KV access — split out of credentials.ts (2026-09-26,\n * K-talos-first-boot) once it needed its own header, the same reason machine-config-read.ts,\n * machine-config-poll.ts and talos-errors.ts were split out of talos-machine-config.ts before it.\n * `credentials.ts` stays the read side (mint a talosconfig, read a KV value); this file is the one\n * place anything in this package ever writes TO OpenBao.\n *\n * ★ FIRST CALLER: `Talos.Kubeconfig` (kubeconfig.ts) writing the admin kubeconfig it generates at\n *   cluster bring-up into the vault instead of an un-vaulted host `runtimePath` — see that file's\n *   own header. `Ceph.AuthEntity` (K-A4, a separate design/PR) is expected to need the same shape\n *   for its own vault-written entity keys; this is not yet shared with it on purpose — two callers\n *   is the point at which sharing stops being speculative.\n */\nimport * as Effect from 'effect/Effect';\nimport type * as Scope from 'effect/Scope';\nimport * as Stream from 'effect/Stream';\nimport * as ChildProcess from 'effect/unstable/process/ChildProcess';\nimport * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';\n\n/**\n * A fresh, unguessable temp path for SOME OTHER PROCESS (talosctl) to create — unlike\n * `credentials.ts`'s `mintKvTempFile`, this does NOT pre-create the file with `wx`, because the\n * caller here is capturing a command's OWN output rather than writing known content itself. The\n * random UUIDv7 name is the only pre-fabrication guard (an attacker cannot pre-plant a symlink at a\n * path it cannot predict) — first used by `kubeconfig.ts` to capture `talosctl kubeconfig`'s\n * generated file before reading it back and writing it into the vault.\n */\nexport const reservedTempPath = (\n  label: string,\n): Effect.Effect<{ readonly path: string }, never, Scope.Scope> =>\n  Effect.gen(function* () {\n    const path = `${Bun.env['TMPDIR'] ?? '/tmp'}/hf-talos-${label}-${Bun.randomUUIDv7()}.yaml`;\n    yield* Effect.addFinalizer(() =>\n      Effect.tryPromise({ try: () => Bun.file(path).delete(), catch: () => undefined }).pipe(\n        Effect.orElseSucceed(() => undefined),\n      ),\n    );\n    return { path };\n  });\n\n/**\n * Write one field of an OpenBao KV-v2 value from `value` — never argv, the mirror image of\n * `credentials.ts`'s `readKvValue`.\n *\n * ⛔ C2 FIX (LAND red team, 2026-09-26) — `field=@-` IS WRONG AND WAS NEVER MEASURED. `@value` means\n *   \"read a file at this path\"; a literal path of `-` is not the stdin convention for `@` — it is\n *   just a file named `-`. MEASURED against the estate's OpenBao v2.6.2 binary (isolated in-memory\n *   dev server, `env -i`, scratch HOME, no estate credentials involved; server removed after):\n *   `field=@-` exits 1 with `invalid key/value pair \"field=@-\": error reading file: open -: no\n *   such file or directory`, and if a file literally named `-` exists in the working directory it\n *   silently stores THAT file's bytes instead. `field=-` (no `@`) is Vault/OpenBao's own stdin\n *   convention and was confirmed against the same binary to read the piped bytes correctly. Every\n *   `Talos.Kubeconfig` create failed here — AFTER `talosctl kubeconfig` had already issued a fresh\n *   admin client certificate, which cannot be revoked.\n * ⛔ stderr ONLY ON FAILURE — same rule as `readKvValue`: never echo what was being written, on\n *   success or failure.\n */\nexport const writeKvValue = (\n  mount: string,\n  key: string,\n  field: string,\n  value: string,\n): Effect.Effect<void, Error, ChildProcessSpawner.ChildProcessSpawner> =>\n  Effect.gen(function* () {\n    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;\n    const result = yield* ChildProcess.make('bao', ['kv', 'put', `${mount}/${key}`, `${field}=-`], {\n      detached: false,\n      extendEnv: true,\n      stderr: 'pipe',\n      stdin: Stream.fromIterable([new TextEncoder().encode(value)]),\n      stdout: 'pipe',\n    }).pipe(\n      spawner.spawn,\n      Effect.flatMap((child) =>\n        Effect.all(\n          {\n            exitCode: child.exitCode,\n            stderr: child.stderr.pipe(\n              Stream.decodeText,\n              Stream.mkString,\n              Effect.map((text) => text.trim()),\n            ),\n          },\n          { concurrency: 'unbounded' },\n        ),\n      ),\n      Effect.scoped,\n    );\n\n    if (result.exitCode !== 0) {\n      return yield* Effect.fail(\n        new Error(`bao kv put ${mount}/${key} exited ${String(result.exitCode)}: ${result.stderr}`),\n      );\n    }\n  });\n",
+    "/**\n * Talos client material minted from OpenBao, written to a session-temp file whose lifetime the\n * CALLER owns — never this module.\n *\n * ⛔ TALOSCONFIG, MACHINE CONFIG AND secrets.yaml CAN ALL HOLD CLIENT CERTIFICATES AND CLUSTER CA\n *   PRIVATE KEYS. Alchemy persists resource attributes WITHOUT encryption — `StateEncoding.ts`\n *   tags a `Redacted` value as `{ __redacted__: <plaintext> }` (`REDACTED_MARKER`), it does not\n *   encrypt it — and this estate's state store is the shared Cloudflare HTTP state store, not a\n *   database anyone forgets is world-legible. None of these three may ever be a prop, an\n *   attribute or a log line; see docs/plans/2026-09-26-talos-secrets-flow.md for why the OLD\n *   header here (Postgres, `{\"@redacted\": …}`) was wrong on both counts — the RULE survives the\n *   correction either way.\n *\n * ★ MODELED ON proxmox/credentials.ts + proxmox/mint.ts: mint at call time, use the material, drop\n *   it when the scope ends. The difference is Talos wants a FILE (`--talosconfig` / `-f`), so\n *   minting here writes a temp path and registers its own delete finalizer instead of just\n *   building a header.\n *\n * ⛔ C1 FIX (2026-09-26, K-A3) — THE SHIPPED `mintTalosconfig` DELETED ITS OWN FILE BEFORE ANY\n *   CALLER COULD USE IT. It wrapped its whole body in `Effect.scoped(...)` and registered the\n *   delete finalizer inside that same scope, so the scope — and the file — closed the instant\n *   `mintTalosconfig` RETURNED, before the caller ever got to pass the path to `talosctl`. Fixed\n *   by `Effect.acquireRelease`: it still deletes on every exit path, but contributes `Scope.Scope`\n *   to this module's own return type instead of discharging it, so the file survives until\n *   whichever `Effect.scoped(...)` the CALLER wraps around its own use of the path (every\n *   talos-*.ts resource file wraps its `read`/`reconcile` bodies for exactly this reason now).\n *\n * ⚠️ REASONED FROM THE PUBLISHED TALOS WORKFLOW, NOT MEASURED ON THIS ESTATE. There is no Talos\n *   cluster here yet; KV paths below follow the `mount/<key>` shape O1 (the secrets-flow doc)\n *   assigns, and `bao kv get` inserts the KV-v2 `data/` API segment itself — a key already\n *   prefixed `data/` reads `<mount>/data/data/<key>`, which the OLD default did.\n */\nimport { closeSync, openSync, writeFileSync } from 'node:fs';\nimport * as Effect from 'effect/Effect';\nimport type * as Scope from 'effect/Scope';\nimport * as Stream from 'effect/Stream';\nimport * as ChildProcess from 'effect/process/ChildProcess';\nimport * as ChildProcessSpawner from 'effect/process/ChildProcessSpawner';\n\n/** Where credentials come from. HomeFlare-specific mount names live in the stack, not here. */\nexport type TalosTarget = {\n  /** OpenBao KV mount holding Talos material, e.g. `talos-c1`. */\n  readonly mount: string;\n  /** Logical cluster name — safe to persist and log. */\n  readonly cluster: string;\n  /**\n   * Path under the mount for the talosconfig YAML. Default `'talosconfig'` — FIXED 2026-09-26;\n   * the shipped default was `'data/talosconfig'`, which `bao kv get` turned into\n   * `<mount>/data/data/talosconfig` (see the ⚠️ above). It failed closed rather than reading an\n   * empty talosconfig, but it would have blocked the very first deploy.\n   */\n  readonly talosconfigKey?: string;\n};\n\nexport type TalosCredential = {\n  /** Absolute path to a temp talosconfig. ⛔ NEVER PERSIST, NEVER LOG CONTENTS. */\n  readonly talosconfigPath: string;\n};\n\nconst DEFAULT_TALOSCONFIG_KEY = 'talosconfig';\n\n/**\n * Default OpenBao KV path (under `target.mount`) for the admin kubeconfig `Talos.Kubeconfig`\n * writes once at cluster bring-up. See kubeconfig.ts's own header (K-talos-first-boot, 2026-09-26)\n * and docs/plans/2026-09-26-talos-secrets-flow.md's O1 key list.\n */\nexport const DEFAULT_KUBECONFIG_KEY = 'kubeconfig';\n\n/**\n * Read one OpenBao KV-v2 value and return the first of `fields` that is a non-empty string.\n *\n * ★ THE ONE PLACE THIS PACKAGE SHELLS TO `bao` — talosconfig, per-node machine config and any\n *   future KV-backed Talos material (secrets.yaml, ceph entity keys) all read through this,\n *   so there is exactly one spot that must never echo a KV value on failure.\n * ⛔ stderr ONLY ON FAILURE. stdout may hold the very secret this call exists to fetch.\n */\nexport const readKvValue = (\n  mount: string,\n  key: string,\n  fields: readonly string[],\n): Effect.Effect<string, Error, ChildProcessSpawner.ChildProcessSpawner> =>\n  Effect.gen(function* () {\n    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;\n    const result = yield* ChildProcess.make(\n      'bao',\n      ['kv', 'get', '-format=json', `${mount}/${key}`],\n      { detached: false, extendEnv: true, stderr: 'pipe', stdin: 'ignore', stdout: 'pipe' },\n    ).pipe(\n      spawner.spawn,\n      Effect.flatMap((child) =>\n        Effect.all(\n          {\n            exitCode: child.exitCode,\n            stderr: child.stderr.pipe(\n              Stream.decodeText,\n              Stream.mkString,\n              Effect.map((text) => text.trim()),\n            ),\n            stdout: child.stdout.pipe(\n              Stream.decodeText,\n              Stream.mkString,\n              Effect.map((text) => text.trim()),\n            ),\n          },\n          { concurrency: 'unbounded' },\n        ),\n      ),\n      Effect.scoped,\n    );\n\n    if (result.exitCode !== 0) {\n      return yield* Effect.fail(\n        new Error(`bao kv get ${mount}/${key} exited ${String(result.exitCode)}: ${result.stderr}`),\n      );\n    }\n\n    const parsed = JSON.parse(result.stdout) as { data?: { data?: Record<string, unknown> } };\n    const data = parsed.data?.data;\n    for (const field of fields) {\n      const raw = data?.[field];\n      if (typeof raw === 'string' && raw.trim() !== '') return raw;\n    }\n    return yield* Effect.fail(\n      new Error(\n        `${mount}/${key} returned no ${fields.join('/')} field. Never store the value itself in ` +\n          'an Alchemy prop or attribute — fix the KV entry, not the caller.',\n      ),\n    );\n  });\n\n/**\n * Write `raw` to a session-temp, 0600, exclusively-created file whose lifetime is the CALLER's\n * `Effect.scoped`, not this call's. See the ⛔ C1 FIX note at the top of this file.\n *\n * ⛔ 0600, CREATED EXCLUSIVELY, AND `Bun.write` CANNOT DO EITHER. This file can hold a cluster\n *   admin client certificate or a machine config's bootstrap token. `Bun.write` takes no mode, so\n *   it lands at the process umask — world-readable on this estate — for as long as the resource\n *   runs. The name is unguessable, and \"unguessable\" is not a permission.\n * ⚠️ `wx` IS THE OTHER HALF. `O_EXCL` means this cannot be made to write through a path an\n *   attacker pre-created (the classic /tmp symlink race), and with a UUIDv7 name a collision is a\n *   genuine error rather than something to paper over.\n * ⚠️ A HARD KILL (SIGKILL, power loss) skips the finalizer and leaves the file behind. 0600 is\n *   what makes that survivable rather than a disclosure.\n */\nexport const mintKvTempFile = (\n  raw: string,\n  label: string,\n): Effect.Effect<{ readonly path: string }, Error, Scope.Scope> =>\n  Effect.gen(function* () {\n    const path = `${Bun.env['TMPDIR'] ?? '/tmp'}/hf-talos-${label}-${Bun.randomUUIDv7()}.yaml`;\n    yield* Effect.acquireRelease(\n      Effect.try({\n        try: () => {\n          const fd = openSync(path, 'wx', 0o600);\n          try {\n            writeFileSync(fd, raw);\n          } finally {\n            closeSync(fd);\n          }\n        },\n        catch: (cause) => new Error(`writing ${label} temp file: ${String(cause)}`),\n      }),\n      () =>\n        Effect.tryPromise({ try: () => Bun.file(path).delete(), catch: () => undefined }).pipe(\n          Effect.orElseSucceed(() => undefined),\n        ),\n    );\n    return { path };\n  });\n\n/**\n * Mint one talosconfig file for `target`.\n *\n * ⛔ CALLERS MUST WRAP THEIR WHOLE USE OF `credential.talosconfigPath` — not just this call — in\n *   `Effect.scoped(...)`. This function's own `Scope.Scope` requirement is what makes that the\n *   caller's job instead of a lie this function tells itself; see the header above.\n */\nexport const mintTalosconfig = (\n  target: TalosTarget,\n): Effect.Effect<TalosCredential, Error, ChildProcessSpawner.ChildProcessSpawner | Scope.Scope> =>\n  readKvValue(target.mount, target.talosconfigKey ?? DEFAULT_TALOSCONFIG_KEY, [\n    'talosconfig',\n    'config',\n  ]).pipe(\n    Effect.flatMap((raw) => mintKvTempFile(raw, `${target.cluster}-talosconfig`)),\n    Effect.map(({ path }): TalosCredential => ({ talosconfigPath: path })),\n  );\n\n/**\n * Mint one temp kubeconfig file from the vault copy `Talos.Kubeconfig` writes at bring-up\n * (K-talos-first-boot, 2026-09-26) — the consumer-side counterpart to {@link mintTalosconfig},\n * named as the future seam for `Kubernetes.ClusterAdapter` in\n * docs/plans/2026-09-26-talos-secrets-flow.md (\"consumers mint it the way the talosconfig is\n * minted\"). Not yet wired to that adapter — this only makes the read+materialize step exist.\n */\nexport const mintKubeconfig = (\n  target: TalosTarget,\n  key = DEFAULT_KUBECONFIG_KEY,\n): Effect.Effect<\n  { readonly path: string },\n  Error,\n  ChildProcessSpawner.ChildProcessSpawner | Scope.Scope\n> =>\n  readKvValue(target.mount, key, ['kubeconfig', 'config']).pipe(\n    Effect.flatMap((raw) => mintKvTempFile(raw, `${target.cluster}-kubeconfig`)),\n  );\n",
+    "/**\n * The write half of Talos's OpenBao KV access — split out of credentials.ts (2026-09-26,\n * K-talos-first-boot) once it needed its own header, the same reason machine-config-read.ts,\n * machine-config-poll.ts and talos-errors.ts were split out of talos-machine-config.ts before it.\n * `credentials.ts` stays the read side (mint a talosconfig, read a KV value); this file is the one\n * place anything in this package ever writes TO OpenBao.\n *\n * ★ FIRST CALLER: `Talos.Kubeconfig` (kubeconfig.ts) writing the admin kubeconfig it generates at\n *   cluster bring-up into the vault instead of an un-vaulted host `runtimePath` — see that file's\n *   own header. `Ceph.AuthEntity` (K-A4, a separate design/PR) is expected to need the same shape\n *   for its own vault-written entity keys; this is not yet shared with it on purpose — two callers\n *   is the point at which sharing stops being speculative.\n */\nimport * as Effect from 'effect/Effect';\nimport type * as Scope from 'effect/Scope';\nimport * as Stream from 'effect/Stream';\nimport * as ChildProcess from 'effect/process/ChildProcess';\nimport * as ChildProcessSpawner from 'effect/process/ChildProcessSpawner';\n\n/**\n * A fresh, unguessable temp path for SOME OTHER PROCESS (talosctl) to create — unlike\n * `credentials.ts`'s `mintKvTempFile`, this does NOT pre-create the file with `wx`, because the\n * caller here is capturing a command's OWN output rather than writing known content itself. The\n * random UUIDv7 name is the only pre-fabrication guard (an attacker cannot pre-plant a symlink at a\n * path it cannot predict) — first used by `kubeconfig.ts` to capture `talosctl kubeconfig`'s\n * generated file before reading it back and writing it into the vault.\n */\nexport const reservedTempPath = (\n  label: string,\n): Effect.Effect<{ readonly path: string }, never, Scope.Scope> =>\n  Effect.gen(function* () {\n    const path = `${Bun.env['TMPDIR'] ?? '/tmp'}/hf-talos-${label}-${Bun.randomUUIDv7()}.yaml`;\n    yield* Effect.addFinalizer(() =>\n      Effect.tryPromise({ try: () => Bun.file(path).delete(), catch: () => undefined }).pipe(\n        Effect.orElseSucceed(() => undefined),\n      ),\n    );\n    return { path };\n  });\n\n/**\n * Write one field of an OpenBao KV-v2 value from `value` — never argv, the mirror image of\n * `credentials.ts`'s `readKvValue`.\n *\n * ⛔ C2 FIX (LAND red team, 2026-09-26) — `field=@-` IS WRONG AND WAS NEVER MEASURED. `@value` means\n *   \"read a file at this path\"; a literal path of `-` is not the stdin convention for `@` — it is\n *   just a file named `-`. MEASURED against the estate's OpenBao v2.6.2 binary (isolated in-memory\n *   dev server, `env -i`, scratch HOME, no estate credentials involved; server removed after):\n *   `field=@-` exits 1 with `invalid key/value pair \"field=@-\": error reading file: open -: no\n *   such file or directory`, and if a file literally named `-` exists in the working directory it\n *   silently stores THAT file's bytes instead. `field=-` (no `@`) is Vault/OpenBao's own stdin\n *   convention and was confirmed against the same binary to read the piped bytes correctly. Every\n *   `Talos.Kubeconfig` create failed here — AFTER `talosctl kubeconfig` had already issued a fresh\n *   admin client certificate, which cannot be revoked.\n * ⛔ stderr ONLY ON FAILURE — same rule as `readKvValue`: never echo what was being written, on\n *   success or failure.\n */\nexport const writeKvValue = (\n  mount: string,\n  key: string,\n  field: string,\n  value: string,\n): Effect.Effect<void, Error, ChildProcessSpawner.ChildProcessSpawner> =>\n  Effect.gen(function* () {\n    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;\n    const result = yield* ChildProcess.make('bao', ['kv', 'put', `${mount}/${key}`, `${field}=-`], {\n      detached: false,\n      extendEnv: true,\n      stderr: 'pipe',\n      stdin: Stream.fromIterable([new TextEncoder().encode(value)]),\n      stdout: 'pipe',\n    }).pipe(\n      spawner.spawn,\n      Effect.flatMap((child) =>\n        Effect.all(\n          {\n            exitCode: child.exitCode,\n            stderr: child.stderr.pipe(\n              Stream.decodeText,\n              Stream.mkString,\n              Effect.map((text) => text.trim()),\n            ),\n          },\n          { concurrency: 'unbounded' },\n        ),\n      ),\n      Effect.scoped,\n    );\n\n    if (result.exitCode !== 0) {\n      return yield* Effect.fail(\n        new Error(`bao kv put ${mount}/${key} exited ${String(result.exitCode)}: ${result.stderr}`),\n      );\n    }\n  });\n",
     "/**\n * Coercions and digests for Talos resources — every function here exists because a trap does.\n *\n * ⚠️ NOTHING IN THIS FILE TOUCHES A LIVE CLUSTER OR OpenBao. Digests are computed from KV content\n *   or talosctl output already fetched by the caller, and kubeconfig YAML already on disk at\n *   reconcile time; tests use fixtures only.\n */\nimport { createHash } from 'node:crypto';\n\n/** Trim trailing whitespace only — leading space in YAML is meaningful. */\nexport const canonicalText = (text: string) => text.trimEnd();\n\n/** SHA-256 hex digest of canonical text. Safe to persist — it is not reversible to the input. */\nexport const sha256 = (text: string) =>\n  createHash('sha256').update(canonicalText(text)).digest('hex');\n\n/** Digest of a machine config's canonical text. ⛔ Never persist the text itself. */\nexport const configDigest = (text: string) => sha256(text);\n\n/**\n * Extract the raw config text under `spec` from `talosctl get machineconfig -o yaml`'s wrapper.\n *\n * ⛔ THE WHOLE WRAPPER CAN NEVER MATCH THE PINNED DIGEST, AND HASHING IT WAS THE SHIPPED BUG.\n *   REASONED from talosctl source (`cmd/talosctl/.../output/yaml.go:63`,\n *   `resources/config/machine_config.go:40-50`): the resource envelope nests a `node:` line and\n *   resource metadata (version, timestamps) around the config, which is itself a raw YAML STRING\n *   under `spec`. Metadata changes on every observation, so `configDigest(wrapper)` never equals\n *   `configDigest(seededConfigText)` even when nothing changed — every reconcile would die, every\n *   diff would plan `update`, verify would never go quiet (all three MEASURED against the shipped\n *   code's shape, docs/plans/2026-09-26-talos-stack-first-boot.md).\n * ⚠️ Returns `undefined` for any shape without a string `spec`, so a caller cannot mistake\n *   \"unparsable wrapper\" for \"empty config\" — those must fail differently (the caller's job).\n * ⛔ MORE THAN ONE DOCUMENT IS REFUSED, NEVER `doc[0]` (fix-first #2, PR 307 red team). An unfiltered\n *   `get machineconfig` lists BOTH the `persistent` and `v1alpha1` resources, sorted by id\n *   (REASONED, cosi-project/runtime `inmem/collection.go:122-124`), so a bare `doc[0]` is always\n *   `persistent` — never the config this package applies. The caller (machine-config-read.ts) now\n *   always requests the single named resource (`get machineconfig v1alpha1`); a second document\n *   showing up here means that request shape changed without this guard changing with it, and\n *   silently picking one would repeat the exact shipped bug.\n */\nexport const extractMachineConfigSpec = (wrapperYaml: string): string | undefined => {\n  let doc: unknown;\n  try {\n    doc = Bun.YAML.parse(wrapperYaml);\n  } catch {\n    return undefined;\n  }\n  if (Array.isArray(doc)) {\n    if (doc.length !== 1) return undefined;\n    doc = doc[0];\n  }\n  if (doc === null || typeof doc !== 'object') return undefined;\n  const spec = (doc as { spec?: unknown }).spec;\n  return typeof spec === 'string' ? spec : undefined;\n};\n\ntype KubeconfigDoc = {\n  clusters?: {\n    cluster?: { server?: string; 'certificate-authority-data'?: string };\n    name?: string;\n  }[];\n  contexts?: { context?: { cluster?: string; user?: string }; name?: string }[];\n  users?: {\n    name?: string;\n    user?: { 'client-certificate-data'?: string; 'client-key-data'?: string };\n  }[];\n  'current-context'?: string;\n};\n\n/**\n * Public metadata extracted from a kubeconfig file on disk.\n *\n * ⛔ RETURNS FINGERPRINTS ONLY. The admin kubeconfig contains a client certificate; Alchemy state\n *   may hold the API server URL and CA/client cert digests, never the PEM bytes.\n */\nexport const kubeconfigMetadata = (\n  yamlText: string,\n  contextName: string,\n): { endpoint: string; caFingerprint: string; clientFingerprint: string } | undefined => {\n  let doc: KubeconfigDoc;\n  try {\n    doc = Bun.YAML.parse(yamlText) as KubeconfigDoc;\n  } catch {\n    return undefined;\n  }\n\n  const ctx = doc.contexts?.find((row) => row.name === contextName)?.context;\n  const clusterName = ctx?.cluster;\n  const userName = ctx?.user;\n  if (clusterName === undefined || userName === undefined) return undefined;\n\n  const cluster = doc.clusters?.find((row) => row.name === clusterName)?.cluster;\n  const user = doc.users?.find((row) => row.name === userName)?.user;\n  const endpoint = cluster?.server;\n  const ca = cluster?.['certificate-authority-data'];\n  const cert = user?.['client-certificate-data'] ?? user?.['client-key-data'];\n  if (endpoint === undefined || ca === undefined || cert === undefined) return undefined;\n\n  return {\n    caFingerprint: sha256(ca),\n    clientFingerprint: sha256(cert),\n    endpoint,\n  };\n};\n",
     "/**\n * `Talos.Kubeconfig`'s attribute builder and its `Kubernetes.Connection` — split out of\n * kubeconfig.ts (LAND, 2026-09-26, C1/I2 fixes) once fixing those findings pushed the file over the\n * 250-line cap, the same reason machine-config-read.ts/machine-config-poll.ts/talos-errors.ts were\n * split out of talos-machine-config.ts before it. Only `import type` comes back from kubeconfig.ts,\n * so there is no runtime cycle between the two files.\n */\nimport type { Connection } from 'alchemy/Kubernetes/Connection';\nimport type { KubeconfigAttributes, KubeconfigProps } from './kubeconfig.ts';\nimport { kubeconfigMetadata, sha256 } from './values.ts';\n\nconst generation = (meta: {\n  endpoint: string;\n  caFingerprint: string;\n  clientFingerprint: string;\n  context: string;\n}) => sha256(`${meta.context}\\n${meta.endpoint}\\n${meta.caFingerprint}\\n${meta.clientFingerprint}`);\n\n/**\n * ⛔ I2 FIX (LAND red team, 2026-09-26) — NEVER LEAVE `path` UNDEFINED. An undefined `path` here\n *   made the stock `Kubernetes.KubeConfigAdapter` fall back to `$KUBECONFIG`/`~/.kube/config`\n *   (alchemy `Kubernetes/internal/kubeconfig.ts`'s `resolveKubeConfigPath`, wired in\n *   `BuiltinAdapters.ts`) — exactly the un-vaulted, possibly-stale-context exposure this whole\n *   family exists to remove. A consumer wiring `Kubernetes.*` to `kube.connection` (this\n *   attribute's own doc invites exactly that) would silently connect through whatever\n *   `admin@<cluster>` context happens to be on the operator's machine. `Kubernetes.ClusterAdapter`\n *   is not yet wired to `mintKubeconfig` (kubeconfig.ts's own header) — no real path exists for\n *   this connection to use — so it must fail LOUDLY instead of silently succeeding against a\n *   stranger's cluster. A path that can never resolve does that: `resolveKubeContext` fails at\n *   `fs.readFileString` naming this exact sentinel, instead of reading whatever real file happens\n *   to be on `$KUBECONFIG`.\n */\nconst UNWIRED_KUBECONFIG_PATH =\n  '/talos-first-boot-unwired/wire-Kubernetes.ClusterAdapter-to-mintKubeconfig';\n\nconst toConnection = (props: KubeconfigProps): Connection => ({\n  auth: { context: props.context, kind: 'kubeconfig', path: UNWIRED_KUBECONFIG_PATH },\n});\n\n/** Parse `raw` kubeconfig YAML into public, persistable attributes, or `undefined` if it fails to. */\nexport const buildAttrs = (\n  raw: string,\n  props: KubeconfigProps,\n): KubeconfigAttributes | undefined => {\n  const meta = kubeconfigMetadata(raw, props.context);\n  if (meta === undefined) return undefined;\n  return {\n    certificateAuthorityFingerprint: meta.caFingerprint,\n    clientCertificateFingerprint: meta.clientFingerprint,\n    connection: toConnection(props),\n    context: props.context,\n    credentialGeneration: generation({ ...meta, context: props.context }),\n    endpoint: meta.endpoint,\n  };\n};\n",
-    "/**\n * One `talosctl` invocation — stdout/stderr captured, secrets never echoed.\n *\n * ★ SHELL OUT LIKE ALCHEMY'S DOCKER PROVIDER (ChildProcessSpawner), NOT A SECOND SDK. Talos speaks\n *   gRPC; the published, stable surface for operators is `talosctl`. No Talos npm package is added.\n *\n * ⚠️ REASONED FROM docs.siderolabs.com/talos/v1.13/reference/cli — nothing here was measured on a\n *   live cluster in this session.\n *\n * ⛔ DO NOT LOG STDOUT ON FAILURE. `talosctl kubeconfig` and error paths have been observed in the\n *   wild to include credential material; stderr is the safe diagnostic channel.\n */\nimport * as Effect from 'effect/Effect';\nimport * as Stream from 'effect/Stream';\nimport * as ChildProcess from 'effect/unstable/process/ChildProcess';\nimport * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';\n\nexport class TalosError extends Error {\n  constructor(\n    readonly command: string,\n    readonly exitCode: number,\n    detail: string,\n  ) {\n    super(`talosctl ${command} -> ${String(exitCode)}: ${detail}`);\n    this.name = 'TalosError';\n  }\n}\n\nexport type TalosRunOptions = {\n  readonly talosconfigPath: string;\n  readonly nodes?: readonly string[];\n  readonly endpoints?: readonly string[];\n  /**\n   * `-i/--insecure` — a maintenance-mode node has no established PKI yet. Used by the CREATE apply\n   * (resource.ts's own header) and by talos-machine-config.ts's maintenance-mode probe (fix-first\n   * #1, PR 307 red team): `--talosconfig` is still passed alongside it, matching the CREATE path,\n   * since insecure mode ignores the file's certs rather than requiring their absence.\n   */\n  readonly insecure?: boolean;\n};\n\n/** Run `talosctl <args…>`. Returns trimmed stdout, or '' when empty. */\nexport const talosctl = (args: readonly string[], options: TalosRunOptions) =>\n  Effect.gen(function* () {\n    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;\n    const argv = [\n      ...args,\n      '--talosconfig',\n      options.talosconfigPath,\n      ...(options.nodes === undefined ? [] : ['--nodes', options.nodes.join(',')]),\n      ...(options.endpoints === undefined ? [] : ['--endpoints', options.endpoints.join(',')]),\n      ...(options.insecure === true ? ['--insecure'] : []),\n    ];\n    const result = yield* ChildProcess.make('talosctl', argv, {\n      detached: false,\n      extendEnv: true,\n      stderr: 'pipe',\n      stdin: 'ignore',\n      stdout: 'pipe',\n    }).pipe(\n      spawner.spawn,\n      Effect.flatMap((child) =>\n        Effect.all(\n          {\n            exitCode: child.exitCode,\n            stderr: child.stderr.pipe(\n              Stream.decodeText,\n              Stream.mkString,\n              Effect.map((text) => text.trim()),\n            ),\n            stdout: child.stdout.pipe(\n              Stream.decodeText,\n              Stream.mkString,\n              Effect.map((text) => text.trim()),\n            ),\n          },\n          { concurrency: 'unbounded' },\n        ),\n      ),\n      Effect.scoped,\n    );\n\n    const command = args.join(' ');\n    if (result.exitCode !== 0) {\n      return yield* Effect.fail(\n        new TalosError(command, result.exitCode, result.stderr.slice(0, 300)),\n      );\n    }\n    return result.stdout;\n  });\n\n/** Like `talosctl`, but exit code 1 with \"already\" in stderr is treated as success. */\nexport const talosctlOrAlready = (args: readonly string[], options: TalosRunOptions) =>\n  talosctl(args, options).pipe(\n    Effect.catchIf(\n      (cause): cause is TalosError =>\n        cause instanceof TalosError &&\n        cause.exitCode !== 0 &&\n        /already|exists|bootstrapped/i.test(cause.message),\n      () => Effect.succeed(''),\n    ),\n  );\n",
+    "/**\n * One `talosctl` invocation — stdout/stderr captured, secrets never echoed.\n *\n * ★ SHELL OUT LIKE ALCHEMY'S DOCKER PROVIDER (ChildProcessSpawner), NOT A SECOND SDK. Talos speaks\n *   gRPC; the published, stable surface for operators is `talosctl`. No Talos npm package is added.\n *\n * ⚠️ REASONED FROM docs.siderolabs.com/talos/v1.13/reference/cli — nothing here was measured on a\n *   live cluster in this session.\n *\n * ⛔ DO NOT LOG STDOUT ON FAILURE. `talosctl kubeconfig` and error paths have been observed in the\n *   wild to include credential material; stderr is the safe diagnostic channel.\n */\nimport * as Effect from 'effect/Effect';\nimport * as Stream from 'effect/Stream';\nimport * as ChildProcess from 'effect/process/ChildProcess';\nimport * as ChildProcessSpawner from 'effect/process/ChildProcessSpawner';\n\nexport class TalosError extends Error {\n  constructor(\n    readonly command: string,\n    readonly exitCode: number,\n    detail: string,\n  ) {\n    super(`talosctl ${command} -> ${String(exitCode)}: ${detail}`);\n    this.name = 'TalosError';\n  }\n}\n\nexport type TalosRunOptions = {\n  readonly talosconfigPath: string;\n  readonly nodes?: readonly string[];\n  readonly endpoints?: readonly string[];\n  /**\n   * `-i/--insecure` — a maintenance-mode node has no established PKI yet. Used by the CREATE apply\n   * (resource.ts's own header) and by talos-machine-config.ts's maintenance-mode probe (fix-first\n   * #1, PR 307 red team): `--talosconfig` is still passed alongside it, matching the CREATE path,\n   * since insecure mode ignores the file's certs rather than requiring their absence.\n   */\n  readonly insecure?: boolean;\n};\n\n/** Run `talosctl <args…>`. Returns trimmed stdout, or '' when empty. */\nexport const talosctl = (args: readonly string[], options: TalosRunOptions) =>\n  Effect.gen(function* () {\n    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;\n    const argv = [\n      ...args,\n      '--talosconfig',\n      options.talosconfigPath,\n      ...(options.nodes === undefined ? [] : ['--nodes', options.nodes.join(',')]),\n      ...(options.endpoints === undefined ? [] : ['--endpoints', options.endpoints.join(',')]),\n      ...(options.insecure === true ? ['--insecure'] : []),\n    ];\n    const result = yield* ChildProcess.make('talosctl', argv, {\n      detached: false,\n      extendEnv: true,\n      stderr: 'pipe',\n      stdin: 'ignore',\n      stdout: 'pipe',\n    }).pipe(\n      spawner.spawn,\n      Effect.flatMap((child) =>\n        Effect.all(\n          {\n            exitCode: child.exitCode,\n            stderr: child.stderr.pipe(\n              Stream.decodeText,\n              Stream.mkString,\n              Effect.map((text) => text.trim()),\n            ),\n            stdout: child.stdout.pipe(\n              Stream.decodeText,\n              Stream.mkString,\n              Effect.map((text) => text.trim()),\n            ),\n          },\n          { concurrency: 'unbounded' },\n        ),\n      ),\n      Effect.scoped,\n    );\n\n    const command = args.join(' ');\n    if (result.exitCode !== 0) {\n      return yield* Effect.fail(\n        new TalosError(command, result.exitCode, result.stderr.slice(0, 300)),\n      );\n    }\n    return result.stdout;\n  });\n\n/** Like `talosctl`, but exit code 1 with \"already\" in stderr is treated as success. */\nexport const talosctlOrAlready = (args: readonly string[], options: TalosRunOptions) =>\n  talosctl(args, options).pipe(\n    Effect.catchIf(\n      (cause): cause is TalosError =>\n        cause instanceof TalosError &&\n        cause.exitCode !== 0 &&\n        /already|exists|bootstrapped/i.test(cause.message),\n      () => Effect.succeed(''),\n    ),\n  );\n",
     "/**\n * `Talos.Bootstrap` — initialize etcd once on ONE control-plane node.\n *\n * ★ REASONED FROM talosctl bootstrap (Talos v1.13 CLI reference): one node aborts the etcd join\n *   loop and forms the initial cluster; other control-plane nodes join after Kubernetes starts on\n *   the bootstrap node. This command must run exactly once per cluster.\n *\n * ⛔ NOT A FACTORY RESOURCE — bootstrap cannot be deleted or updated in place; `delete` is a no-op.\n *\n * ⛔ ONCE MEANS ONCE (K-talos-first-boot, 2026-09-26) — THE SHIPPED SHAPE COULD BOOTSTRAP A SECOND\n *   etcd CLUSTER. The original `isBootstrapped` turned every read failure into `false`\n *   (`Effect.orElseSucceed`), `diff` then planned `update`, and `reconcile` re-ran `talosctl\n *   bootstrap` — Talos's only server-side guard is a non-empty etcd data directory (REASONED,\n *   `v1alpha1_server.go:441`), so a reinstalled or reset bootstrap node re-bootstrapped a fresh,\n *   isolated single-member cluster: split brain. Fixed per\n *   docs/plans/2026-09-26-talos-stack-first-boot.md's \"Bootstrap — once means once\" section:\n *     - `read` now answers presence/absence correctly instead of always returning a defined\n *       object — `undefined` only from a SUCCESSFUL read that finds no members (cold-start\n *       absence); a failing read propagates its error instead of being reinterpreted as absence.\n *     - `diff` trusts `output.bootstrapped` once it is `true` and reports `noop` without touching\n *       the live cluster at all — confirmation is `reconcile`'s job now, not plan's.\n *     - `reconcile` checks `output?.bootstrapped` FIRST: once true, it NEVER calls `talosctl\n *       bootstrap` again, no matter what a live read says. A live read that fails OR comes back\n *       empty both raise the same `TalosReBootstrapRefused` — re-bootstrap is a human decision.\n */\nimport { Resource } from 'alchemy';\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { mintTalosconfig } from './credentials.ts';\nimport type { TalosRequirements, WithTarget } from './resource.ts';\nimport { assertNoLivePeers, isBootstrapped } from './talos-bootstrap-etcd.ts';\nimport { TalosReBootstrapRefused } from './talos-errors.ts';\nimport { talosctlOrAlready } from './talosctl.ts';\n\nexport interface BootstrapProps extends WithTarget {\n  /** The ONE control-plane node that receives `talosctl bootstrap`. */\n  node: string;\n  /**\n   * The OTHER declared control-plane nodes — never `node` itself. Optional, but a multi-control-\n   * plane cluster (decision 66: 3, one per TB4 node) SHOULD set it: `reconcileBootstrap`'s CREATE\n   * path (I4 fix, LAND red team, 2026-09-26) requires every one of these to show a successful,\n   * EMPTY etcd-members read before it will bootstrap `node` — the guard against re-bootstrapping a\n   * split-brain second cluster when this row's own state was lost. See talos-bootstrap-etcd.ts's\n   * `assertNoLivePeers`.\n   */\n  peers?: readonly string[];\n  /** Machine configs for this node (and peers) must be applied first. */\n  after?: readonly unknown[];\n}\n\nexport interface BootstrapAttributes {\n  node: string;\n  bootstrapped: boolean;\n}\n\nexport interface TalosBootstrap extends Resource<\n  'Talos.Bootstrap',\n  BootstrapProps,\n  BootstrapAttributes,\n  never,\n  TalosRequirements\n> {}\n\nexport const TalosBootstrap = Resource<TalosBootstrap>('Talos.Bootstrap', {\n  /** etcd data is irreplaceable — opt into destroy explicitly if Talos ever adds an undo. */\n  defaultRemovalPolicy: 'retain',\n});\n\n/**\n * ⛔ WRAPPED IN `Effect.scoped` (K-A3, 2026-09-26) — `mintTalosconfig` contributes `Scope.Scope`\n *   to its own return type rather than closing its scope internally (the C1 fix, credentials.ts's\n *   own header); this is the caller that owns the temp talosconfig's lifetime for the read.\n *\n * ⛔ ANSWERS PRESENCE/ABSENCE, NOT \"attrs-or-error\" (K-talos-first-boot, fixes the shipped shape).\n *   `undefined` only when a read SUCCEEDS and finds no members — the honest \"not created yet\"\n *   Alchemy's engine expects from a cold-start adoption probe. A failing read propagates instead\n *   of being reinterpreted as absence — this is the fix `isBootstrapped` no longer hides.\n *\n * ★ EXPORTED (like proxmox/ceph-daemon.ts's `reconcileDaemon`, machine-config-read.ts's\n *   `readMachineConfig`) so talos-bootstrap.test.ts calls it directly with a fake spawner instead\n *   of driving it through the full Alchemy engine.\n */\nexport const readBootstrap = (props: BootstrapProps) =>\n  Effect.scoped(\n    Effect.gen(function* () {\n      const credential = yield* mintTalosconfig(props.target);\n      const bootstrapped = yield* isBootstrapped(props, credential.talosconfigPath);\n      return bootstrapped ? ({ bootstrapped: true, node: props.node } as const) : undefined;\n    }),\n  );\n\n/**\n * ⛔ TRUSTS STATE, NEVER TOUCHES THE LIVE CLUSTER (K-talos-first-boot) — once `output.bootstrapped`\n *   is `true` this always reports `noop`, unconditionally, with zero live calls.\n *\n * ⛔ I3 CORRECTION (LAND red team, 2026-09-26) — THE OLD COMMENT HERE CLAIMED \"confirming the\n *   invariant against etcd is reconcile's job (every deploy calls it)\". THAT IS FALSE, VERIFIED\n *   against the pinned alchemy beta.79 source: Apply never reconciles a node whose diff came back\n *   `noop` (`Apply.ts`'s `noop` branch just refreshes row metadata and signals ready — it does not\n *   call `provider.reconcile` at all). This file's own `noop` above IS what skips it. So\n *   `reconcileBootstrap`'s re-confirm branch (the one that raises `TalosReBootstrapRefused` on a\n *   failed or empty read) never runs on an ordinary `plan`/`deploy` once `bootstrapped: true` is\n *   recorded — only `--force` reaches it, by forcing a reconcile regardless of the plan action.\n *   Safety still holds — `talosctl bootstrap` genuinely never re-runs while state exists — but a\n *   reset control-plane node (etcd wiped, VM replaced) stays silently invisible to `plan` and\n *   `deploy` alike until an operator runs `--force` or a verify pass.\n *   ⚠️ NOT FIXED BY HAVING `diff` READ HERE TOO (the finding's other offered fix) — that would touch\n *   the live cluster (and mint a talosconfig) on EVERY plan for an already-bootstrapped node, for a\n *   scenario (a reset node) that a `configDigest`-style pinned check can't distinguish from a merely\n *   slow/unreachable read; a single transient failure would then abort every future plan for a\n *   healthy node, for no benefit — the exact cost the original (correct) half of this comment\n *   already named. `MachineConfig`/`ClusterHealth`'s diffs DO mint and read live on every plan\n *   (D2 puts that on the admin/operator lane, not agent), so this isn't a lane-access limit; it is\n *   this resource's own choice to trust a `true` boolean forever rather than re-derive it from a\n *   live signal that cannot yet tell \"reset\" apart from \"briefly unreachable\". Recorded as an open\n *   gap for whoever builds the operator verify pass, not silently fixed here.\n */\nexport const diffBootstrap = (\n  news: Input<BootstrapProps>,\n  output: BootstrapAttributes | undefined,\n) =>\n  Effect.gen(function* () {\n    if (output === undefined || !isResolved(news)) return undefined;\n    if (output.bootstrapped) return { action: 'noop' } as const;\n    const live = yield* readBootstrap(news);\n    return live?.bootstrapped === true\n      ? ({ action: 'noop' } as const)\n      : ({ action: 'update' } as const);\n  });\n\n/**\n * ⛔ ONCE MEANS ONCE — see this file's own header. `output?.bootstrapped === true` is checked\n *   BEFORE anything else, and that branch never builds a `talosctl bootstrap` argv at all — the\n *   confirmation read below can fail, or succeed and say \"absent\", and EITHER way this raises\n *   `TalosReBootstrapRefused` rather than treating \"absent\" as licence to bootstrap again.\n */\nexport const reconcileBootstrap = (\n  props: BootstrapProps,\n  output: BootstrapAttributes | undefined,\n) =>\n  Effect.scoped(\n    Effect.gen(function* () {\n      const credential = yield* mintTalosconfig(props.target);\n\n      if (output?.bootstrapped === true) {\n        const stillBootstrapped = yield* isBootstrapped(props, credential.talosconfigPath).pipe(\n          Effect.catchIf(\n            (): boolean => true,\n            (cause) =>\n              Effect.fail(\n                new TalosReBootstrapRefused({\n                  detail: `live read failed: ${String(cause)}`,\n                  node: props.node,\n                }),\n              ),\n          ),\n        );\n        if (!stillBootstrapped) {\n          return yield* Effect.fail(\n            new TalosReBootstrapRefused({\n              detail: 'etcd members are absent on a live read against already-bootstrapped state',\n              node: props.node,\n            }),\n          );\n        }\n        return { bootstrapped: true, node: props.node };\n      }\n\n      const before = yield* isBootstrapped(props, credential.talosconfigPath);\n      if (!before) {\n        // ⛔ I4 FIX (LAND red team) — see BootstrapProps.peers's own doc and\n        // talos-bootstrap-etcd.ts's assertNoLivePeers header.\n        yield* assertNoLivePeers(props, credential.talosconfigPath);\n        yield* talosctlOrAlready(['bootstrap'], {\n          nodes: [props.node],\n          talosconfigPath: credential.talosconfigPath,\n        });\n      }\n      const after = yield* isBootstrapped(props, credential.talosconfigPath);\n      if (!after) {\n        return yield* Effect.die(\n          new Error(\n            `${props.node}: bootstrap returned no error but etcd members are still absent. ` +\n              'Read back rather than trusting the exit code alone.',\n          ),\n        );\n      }\n      return { bootstrapped: true, node: props.node };\n    }),\n  );\n\nconst handlers = {\n  delete: () => Effect.void,\n  diff: ({\n    news,\n    output,\n  }: {\n    news: Input<BootstrapProps>;\n    output: BootstrapAttributes | undefined;\n  }) => diffBootstrap(news, output),\n  list: () => Effect.succeed([]),\n  read: ({ olds }: { olds: BootstrapProps }) => readBootstrap(olds),\n  reconcile: ({\n    news,\n    output,\n  }: {\n    news: BootstrapProps;\n    output: BootstrapAttributes | undefined;\n  }) => reconcileBootstrap(news, output),\n};\n\nexport const TalosBootstrapProvider = () =>\n  Provider.effect(TalosBootstrap, Effect.succeed(TalosBootstrap.Provider.of(handlers)));\n",
     "/**\n * `Talos.Bootstrap`'s etcd-members probe and split-brain guard — split out of talos-bootstrap.ts\n * (LAND, 2026-09-26, I4 fix) once adding the guard pushed that file over the 250-line cap, the same\n * reason machine-config-read.ts was split out of talos-machine-config.ts before it. Only\n * `import type` comes back from talos-bootstrap.ts, so there is no runtime cycle between the files.\n */\nimport * as Effect from 'effect/Effect';\nimport type { BootstrapProps } from './talos-bootstrap.ts';\nimport { TalosReBootstrapRefused } from './talos-errors.ts';\nimport { talosctl } from './talosctl.ts';\n\n/**\n * REASONED: `talosctl get etcdmembers -o json` should list members after bootstrap.\n * ⚠️ NOT MEASURED — first live deploy confirms the resource type name.\n * ⛔ NO SWALLOWING (K-talos-first-boot) — a transport failure propagates as its own error; only a\n *   SUCCESSFUL read may conclude presence or absence. Every caller decides for itself what a\n *   failure here means (talos-bootstrap.ts's `read`/`reconcile`, and `assertNoLivePeers` below), so\n *   it is not decided here.\n */\nexport const isBootstrapped = (props: BootstrapProps, talosconfigPath: string) =>\n  talosctl(['get', 'etcdmembers', '-o', 'json'], {\n    nodes: [props.node],\n    talosconfigPath,\n  }).pipe(Effect.map((text) => text.includes('\"id\"') || text.includes('\"member\"')));\n\n/**\n * ⛔ I4 FIX (LAND red team, 2026-09-26) — THE CREATE PATH ONLY CHECKED THIS NODE. If the state row\n *   is lost (wrong `--stage`, an FQN rename, a wiped state store) while the cluster already lives on\n *   OTHER control-plane nodes, the cold-start adoption read on THIS node comes back empty, plan\n *   calls `create`, and `talosctl bootstrap` runs here too — a SECOND, isolated etcd cluster: split\n *   brain. Before bootstrapping, every OTHER declared control-plane node (`props.peers`) must show a\n *   successful, EMPTY etcd-members read — proof no cluster already exists anywhere this row knows\n *   about. A peer that already has members, or a peer whose read fails, refuses bootstrap exactly\n *   like an already-bootstrapped confirmation failure does (same typed error, same \"hand it to a\n *   human\" posture) — a genuinely fresh cluster has no peers with members yet, so this never blocks\n *   a real first boot.\n * ⚠️ `peers` IS OPTIONAL, SO THIS GUARD IS OPT-IN — an existing single-control-plane declaration\n *   keeps working unguarded; a consuming stack with more than one control-plane node (decision 66:\n *   3, one per TB4 node) SHOULD list the other two here to get the protection.\n * ★ `Effect.all` over a mapped array, not `Effect.forEach` — oxlint's unicorn/no-array-for-each\n *   matches the method NAME and cannot tell Effect's from Array's (same pattern as\n *   openbao/cloudflare-permission-groups.ts).\n */\nexport const assertNoLivePeers = (props: BootstrapProps, talosconfigPath: string) =>\n  Effect.all(\n    (props.peers ?? []).map((peer) =>\n      isBootstrapped({ ...props, node: peer }, talosconfigPath).pipe(\n        Effect.matchEffect({\n          onFailure: (cause) =>\n            Effect.fail(\n              new TalosReBootstrapRefused({\n                detail: `peer ${peer}: live read failed before bootstrap: ${String(cause)}`,\n                node: props.node,\n              }),\n            ),\n          onSuccess: (hasMembers) =>\n            hasMembers\n              ? Effect.fail(\n                  new TalosReBootstrapRefused({\n                    detail:\n                      `peer ${peer} already reports etcd members — a cluster may already exist; ` +\n                      'refusing to bootstrap a second one',\n                    node: props.node,\n                  }),\n                )\n              : Effect.void,\n        }),\n      ),\n    ),\n    { discard: true },\n  );\n",
     "/**\n * `Talos.MachineConfig`'s typed failures — split out of talos-machine-config.ts (2026-09-26,\n * K-A3) for the same reason proxmox/credential-errors.ts gives: keep a class's own header out of\n * the 250-line budget of the file that raises it.\n */\nimport * as Data from 'effect/Data';\nimport type { ApplyMode } from './resource.ts';\n\n/**\n * The OpenBao KV content at `mount/key` does not hash to the pinned `configDigest`.\n *\n * ★ FAIL CLOSED, NO SPAWN — docs/plans/2026-09-26-talos-secrets-flow.md's O-A: \"a poisoned or\n *   fat-fingered KV write cannot silently reach a node\". Raised BEFORE any talosctl process\n *   starts, so a mismatch never sends an unpinned config anywhere — see reconcile() in\n *   talos-machine-config.ts, which checks this ahead of minting the talosconfig credential too.\n * ⛔ NEITHER DIGEST IN THIS MESSAGE IS THE CONFIG. Both are sha256 hex digests — safe to log,\n *   safe to persist — never the KV content itself.\n */\nexport class TalosConfigDigestMismatch extends Data.TaggedError('TalosConfigDigestMismatch')<{\n  readonly mount: string;\n  readonly key: string;\n  readonly expected: string;\n  readonly got: string;\n}> {\n  override get message(): string {\n    return (\n      `${this.mount}/${this.key}: live content digest ${this.got} does not match the pinned ` +\n      `configDigest ${this.expected}. Fail closed — nothing was sent to talosctl. Either the KV ` +\n      'value was rewritten without a matching PR, or the pinned digest is stale; check which one ' +\n      'moved before re-pinning either side.'\n    );\n  }\n}\n\n/**\n * `apply-config` returned success but the live machineconfig digest never matched the pin within\n * the bounded poll (machine-config-poll.ts). See\n * docs/plans/2026-09-26-talos-stack-first-boot.md's \"Converged\" section.\n *\n * ⛔ THIS IS THE REPLACEMENT FOR A SILENT `converged: false`. The shipped code let a read\n *   failure during convergence checking disguise itself as \"not converged yet\" forever\n *   (`orElseSucceed`); this type makes cap expiry a refusal an operator sees, not a plan that\n *   quietly retries the same apply on every future run.\n */\nexport class TalosConvergenceTimeout extends Data.TaggedError('TalosConvergenceTimeout')<{\n  readonly node: string;\n  readonly mode: ApplyMode;\n  readonly attempts: number;\n}> {\n  override get message(): string {\n    return (\n      `${this.node}: apply-config (--mode ${this.mode}) was accepted but the live machineconfig ` +\n      `digest never matched the pin within ${this.attempts} bounded poll attempts. Refusing to ` +\n      'report converged — hand this node to the operator rather than silently pass.'\n    );\n  }\n}\n\n/**\n * `Talos.Bootstrap` reconcile found state already recording `bootstrapped: true`, and a live\n * check against etcd could not reconfirm it — either the read itself failed (`detail` carries the\n * propagated cause), or it succeeded and came back with no members.\n *\n * ★ K-talos-first-boot's \"once means once\" — docs/plans/2026-09-26-talos-stack-first-boot.md's own\n *   section of that name. EITHER cause raises this SAME typed error, and both ways `talosctl\n *   bootstrap` is never spawned a second time: re-running it against a node that lost its etcd\n *   data (a VM replace, a reset) forms a second, isolated single-member etcd cluster instead of\n *   rejoining the existing one (REASONED, `v1alpha1_server.go:441` — Talos's only server-side\n *   guard is a non-empty data directory, not \"did this cluster already bootstrap\"). That is split\n *   brain, and nothing here can tell a genuinely reset node (needs its own operator-run recovery)\n *   apart from a merely slow or unreachable read (needs a retry) — so both refuse alike and hand\n *   the node to a human instead of guessing.\n */\nexport class TalosReBootstrapRefused extends Data.TaggedError('TalosReBootstrapRefused')<{\n  readonly node: string;\n  readonly detail: string;\n}> {\n  override get message(): string {\n    return (\n      `${this.node}: state already recorded a successful bootstrap, and a live check could not ` +\n      `reconfirm it (${this.detail}). Refusing to run 'talosctl bootstrap' again — that risks a ` +\n      'second, isolated etcd cluster on a reset node. This needs an operator, not a reconcile.'\n    );\n  }\n}\n",
@@ -17,6 +17,6 @@
     "/**\n * Post-apply convergence for `Talos.MachineConfig` — split out of talos-machine-config.ts\n * (2026-09-26, K-A3) once the bounded-poll logic needed its own header. See\n * docs/plans/2026-09-26-talos-stack-first-boot.md, \"Converged\" and \"Bootstrap\" sections.\n *\n * ⛔ NO SILENT `converged: false` HERE. A single attempt's own transport failure is swallowed\n *   ONLY inside the bounded loop below — a rebooting node's API is legitimately unreachable for a\n *   while — but the loop AS A WHOLE never swallows: running out of attempts always raises\n *   `TalosConvergenceTimeout`, never a quiet `false`. That distinction is read()'s job, not\n *   reconcile's — see talos-machine-config.ts.\n * ⚠️ SHORT INTERVALS, A LOW CAP, NEVER ONE LONG SLEEP — the house timeout rule, and the specific\n *   reason talosctl's own `health` gate has a 20-minute `--wait-timeout`: a single blocking wait\n *   that long would hide whether THIS process is still alive from anything watching it.\n */\nimport * as Effect from 'effect/Effect';\nimport type { ApplyMode } from './resource.ts';\nimport { TalosConvergenceTimeout } from './talos-errors.ts';\n\n/**\n * Modes whose apply can trigger a full install + reboot. REASONED, Talos v1.13 CLI reference.\n * ⛔ `'staged'` is deliberately absent — resource.ts's own header explains why (fix-first #2).\n */\nconst isRebootish = (mode: ApplyMode) => mode === 'reboot' || mode === 'auto';\n\n/**\n * ★ TWO POLICIES, ONE PER MODE CLASS — REASONED, no live cluster to time this against yet.\n *   `no-reboot` never drops the API, so a handful of quick retries covers only ordinary\n *   config-propagation lag. `reboot`/`auto` can drop the API for a full boot cycle, so the cap is\n *   longer and the interval coarser. Both stay well inside the house rule above.\n */\nexport type PollPolicy = { readonly intervalMs: number; readonly maxAttempts: number };\n\nconst POLICY: { readonly immediate: PollPolicy; readonly rebootish: PollPolicy } = {\n  immediate: { intervalMs: 2_000, maxAttempts: 5 }, // ~10s cap\n  rebootish: { intervalMs: 5_000, maxAttempts: 24 }, // ~2m cap\n};\n\n/**\n * Run `check` until it reports `true` or `maxAttempts` is spent, sleeping `intervalMs` between\n * attempts. A per-attempt failure counts as \"not yet\" and does not end the loop early.\n */\nconst pollUntilMatch = <E, R>(\n  check: Effect.Effect<boolean, E, R>,\n  policy: { readonly intervalMs: number; readonly maxAttempts: number },\n): Effect.Effect<boolean, never, R> =>\n  Effect.gen(function* () {\n    for (let attempt = 1; attempt <= policy.maxAttempts; attempt++) {\n      const matched = yield* check.pipe(Effect.orElseSucceed(() => false));\n      if (matched) return true;\n      if (attempt < policy.maxAttempts) yield* Effect.sleep(policy.intervalMs);\n    }\n    return false;\n  });\n\n/**\n * Confirm convergence per `mode`'s policy, or fail with `TalosConvergenceTimeout`.\n *\n * Returns which CLAIM was proven, never a boolean — `'read-back'` for the immediate policy\n * (no-reboot), `'accepted'` for the reboot-tolerant one (reboot/auto): state records which kind of\n * confirmation actually happened, per the design doc's `converged` field.\n *\n * ⚠️ `policies` IS A TEST SEAM, NOT A PROP. `talos-machine-config.ts` never passes it, so\n *   production always runs the REASONED defaults above; tests pass tiny intervals so a bounded\n *   poll test finishes in milliseconds instead of the real ~10s/~2m caps.\n */\nexport const confirmConverged = <E, R>(\n  node: string,\n  mode: ApplyMode,\n  check: Effect.Effect<boolean, E, R>,\n  policies: { readonly immediate: PollPolicy; readonly rebootish: PollPolicy } = POLICY,\n): Effect.Effect<'read-back' | 'accepted', TalosConvergenceTimeout, R> =>\n  Effect.gen(function* () {\n    const rebootish = isRebootish(mode);\n    const policy = rebootish ? policies.rebootish : policies.immediate;\n    const matched = yield* pollUntilMatch(check, policy);\n    if (!matched) {\n      return yield* Effect.fail(\n        new TalosConvergenceTimeout({ attempts: policy.maxAttempts, mode, node }),\n      );\n    }\n    return rebootish ? 'accepted' : 'read-back';\n  });\n"
   ],
   "mappings": ";AAkCA;AACA;AACA;AAGA;AACA;;;ACRA;AACA;AAEA;AACA;AACA;AAsBA,IAAM,0BAA0B;AAOzB,IAAM,yBAAyB;AAU/B,IAAM,cAAc,CACzB,OACA,KACA,WAEO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,UAAU,OAA2B;AAAA,EAC3C,MAAM,SAAS,OAAoB,kBACjC,OACA,CAAC,MAAM,OAAO,gBAAgB,GAAG,SAAS,KAAK,GAC/C,EAAE,UAAU,OAAO,WAAW,MAAM,QAAQ,QAAQ,OAAO,UAAU,QAAQ,OAAO,CACtF,EAAE,KACA,QAAQ,OACD,eAAQ,CAAC,UACP,WACL;AAAA,IACE,UAAU,MAAM;AAAA,IAChB,QAAQ,MAAM,OAAO,KACZ,mBACA,iBACA,WAAI,CAAC,SAAS,KAAK,KAAK,CAAC,CAClC;AAAA,IACA,QAAQ,MAAM,OAAO,KACZ,mBACA,iBACA,WAAI,CAAC,SAAS,KAAK,KAAK,CAAC,CAClC;AAAA,EACF,GACA,EAAE,aAAa,YAAY,CAC7B,CACF,GACO,aACT;AAAA,EAEA,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,OAAO,OAAc,YACnB,IAAI,MAAM,cAAc,SAAS,cAAc,OAAO,OAAO,QAAQ,MAAM,OAAO,QAAQ,CAC5F;AAAA,EACF;AAAA,EAEA,MAAM,SAAS,KAAK,MAAM,OAAO,MAAM;AAAA,EACvC,MAAM,OAAO,OAAO,MAAM;AAAA,EAC1B,WAAW,SAAS,QAAQ;AAAA,IAC1B,MAAM,MAAM,OAAO;AAAA,IACnB,IAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,MAAM;AAAA,MAAI,OAAO;AAAA,EAC3D;AAAA,EACA,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,SAAS,mBAAmB,OAAO,KAAK,GAAG,8CAC5C,kEACJ,CACF;AAAA,CACD;AAgBI,IAAM,iBAAiB,CAC5B,KACA,UAEO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,GAAG,IAAI,IAAI,aAAa,mBAAmB,SAAS,IAAI,aAAa;AAAA,EAClF,OAAc,sBACL,WAAI;AAAA,IACT,KAAK,MAAM;AAAA,MACT,MAAM,KAAK,SAAS,MAAM,MAAM,GAAK;AAAA,MACrC,IAAI;AAAA,QACF,cAAc,IAAI,GAAG;AAAA,gBACrB;AAAA,QACA,UAAU,EAAE;AAAA;AAAA;AAAA,IAGhB,OAAO,CAAC,UAAU,IAAI,MAAM,WAAW,oBAAoB,OAAO,KAAK,GAAG;AAAA,EAC5E,CAAC,GACD,MACS,kBAAW,EAAE,KAAK,MAAM,IAAI,KAAK,IAAI,EAAE,OAAO,GAAG,OAAO,MAAG;AAAA,IAAG;AAAA,IAAU,CAAC,EAAE,KACzE,qBAAc,MAAG;AAAA,IAAG;AAAA,GAAS,CACtC,CACJ;AAAA,EACA,OAAO,EAAE,KAAK;AAAA,CACf;AASI,IAAM,kBAAkB,CAC7B,WAEA,YAAY,OAAO,OAAO,OAAO,kBAAkB,yBAAyB;AAAA,EAC1E;AAAA,EACA;AACF,CAAC,EAAE,KACM,eAAQ,CAAC,QAAQ,eAAe,KAAK,GAAG,OAAO,qBAAqB,CAAC,GACrE,WAAI,GAAG,YAA6B,EAAE,iBAAiB,KAAK,EAAE,CACvE;;;AC7KF;AAEA;AACA;AACA;AAUO,IAAM,mBAAmB,CAC9B,UAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,GAAG,IAAI,IAAI,aAAa,mBAAmB,SAAS,IAAI,aAAa;AAAA,EAClF,OAAc,qBAAa,MAClB,mBAAW,EAAE,KAAK,MAAM,IAAI,KAAK,IAAI,EAAE,OAAO,GAAG,OAAO,MAAG;AAAA,IAAG;AAAA,IAAU,CAAC,EAAE,KACzE,sBAAc,MAAG;AAAA,IAAG;AAAA,GAAS,CACtC,CACF;AAAA,EACA,OAAO,EAAE,KAAK;AAAA,CACf;AAmBI,IAAM,eAAe,CAC1B,OACA,KACA,OACA,UAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,UAAU,OAA2B;AAAA,EAC3C,MAAM,SAAS,OAAoB,mBAAK,OAAO,CAAC,MAAM,OAAO,GAAG,SAAS,OAAO,GAAG,SAAS,GAAG;AAAA,IAC7F,UAAU;AAAA,IACV,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,OAAc,qBAAa,CAAC,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC;AAAA,IAC5D,QAAQ;AAAA,EACV,CAAC,EAAE,KACD,QAAQ,OACD,gBAAQ,CAAC,UACP,YACL;AAAA,IACE,UAAU,MAAM;AAAA,IAChB,QAAQ,MAAM,OAAO,KACZ,oBACA,kBACA,YAAI,CAAC,SAAS,KAAK,KAAK,CAAC,CAClC;AAAA,EACF,GACA,EAAE,aAAa,YAAY,CAC7B,CACF,GACO,cACT;AAAA,EAEA,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,OAAO,OAAc,aACnB,IAAI,MAAM,cAAc,SAAS,cAAc,OAAO,OAAO,QAAQ,MAAM,OAAO,QAAQ,CAC5F;AAAA,EACF;AAAA,CACD;;;ACvFH;AAGO,IAAM,gBAAgB,CAAC,SAAiB,KAAK,QAAQ;AAGrD,IAAM,SAAS,CAAC,SACrB,WAAW,QAAQ,EAAE,OAAO,cAAc,IAAI,CAAC,EAAE,OAAO,KAAK;AAGxD,IAAM,eAAe,CAAC,SAAiB,OAAO,IAAI;AAuBlD,IAAM,2BAA2B,CAAC,gBAA4C;AAAA,EACnF,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,MAAM,IAAI,KAAK,MAAM,WAAW;AAAA,IAChC,MAAM;AAAA,IACN;AAAA;AAAA,EAEF,IAAI,MAAM,QAAQ,GAAG,GAAG;AAAA,IACtB,IAAI,IAAI,WAAW;AAAA,MAAG;AAAA,IACtB,MAAM,IAAI;AAAA,EACZ;AAAA,EACA,IAAI,QAAQ,QAAQ,OAAO,QAAQ;AAAA,IAAU;AAAA,EAC7C,MAAM,OAAQ,IAA2B;AAAA,EACzC,OAAO,OAAO,SAAS,WAAW,OAAO;AAAA;AAsBpC,IAAM,qBAAqB,CAChC,UACA,gBACuF;AAAA,EACvF,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,MAAM,IAAI,KAAK,MAAM,QAAQ;AAAA,IAC7B,MAAM;AAAA,IACN;AAAA;AAAA,EAGF,MAAM,MAAM,IAAI,UAAU,KAAK,CAAC,QAAQ,IAAI,SAAS,WAAW,GAAG;AAAA,EACnE,MAAM,cAAc,KAAK;AAAA,EACzB,MAAM,WAAW,KAAK;AAAA,EACtB,IAAI,gBAAgB,aAAa,aAAa;AAAA,IAAW;AAAA,EAEzD,MAAM,UAAU,IAAI,UAAU,KAAK,CAAC,QAAQ,IAAI,SAAS,WAAW,GAAG;AAAA,EACvE,MAAM,OAAO,IAAI,OAAO,KAAK,CAAC,QAAQ,IAAI,SAAS,QAAQ,GAAG;AAAA,EAC9D,MAAM,WAAW,SAAS;AAAA,EAC1B,MAAM,KAAK,UAAU;AAAA,EACrB,MAAM,OAAO,OAAO,8BAA8B,OAAO;AAAA,EACzD,IAAI,aAAa,aAAa,OAAO,aAAa,SAAS;AAAA,IAAW;AAAA,EAEtE,OAAO;AAAA,IACL,eAAe,OAAO,EAAE;AAAA,IACxB,mBAAmB,OAAO,IAAI;AAAA,IAC9B;AAAA,EACF;AAAA;;;AC3FF,IAAM,aAAa,CAAC,SAKd,OAAO,GAAG,KAAK;AAAA,EAAY,KAAK;AAAA,EAAa,KAAK;AAAA,EAAkB,KAAK,mBAAmB;AAgBlG,IAAM,0BACJ;AAEF,IAAM,eAAe,CAAC,WAAwC;AAAA,EAC5D,MAAM,EAAE,SAAS,MAAM,SAAS,MAAM,cAAc,MAAM,wBAAwB;AACpF;AAGO,IAAM,aAAa,CACxB,KACA,UACqC;AAAA,EACrC,MAAM,OAAO,mBAAmB,KAAK,MAAM,OAAO;AAAA,EAClD,IAAI,SAAS;AAAA,IAAW;AAAA,EACxB,OAAO;AAAA,IACL,iCAAiC,KAAK;AAAA,IACtC,8BAA8B,KAAK;AAAA,IACnC,YAAY,aAAa,KAAK;AAAA,IAC9B,SAAS,MAAM;AAAA,IACf,sBAAsB,WAAW,KAAK,MAAM,SAAS,MAAM,QAAQ,CAAC;AAAA,IACpE,UAAU,KAAK;AAAA,EACjB;AAAA;;;ACzCF;AACA;AACA;AACA;AAAA;AAEO,MAAM,mBAAmB,MAAM;AAAA,EAEzB;AAAA,EACA;AAAA,EAFX,WAAW,CACA,SACA,UACT,QACA;AAAA,IACA,MAAM,YAAY,cAAc,OAAO,QAAQ,MAAM,QAAQ;AAAA,IAJpD;AAAA,IACA;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAgBO,IAAM,WAAW,CAAC,MAAyB,YACzC,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,UAAU,OAA2B;AAAA,EAC3C,MAAM,OAAO;AAAA,IACX,GAAG;AAAA,IACH;AAAA,IACA,QAAQ;AAAA,IACR,GAAI,QAAQ,UAAU,YAAY,CAAC,IAAI,CAAC,WAAW,QAAQ,MAAM,KAAK,GAAG,CAAC;AAAA,IAC1E,GAAI,QAAQ,cAAc,YAAY,CAAC,IAAI,CAAC,eAAe,QAAQ,UAAU,KAAK,GAAG,CAAC;AAAA,IACtF,GAAI,QAAQ,aAAa,OAAO,CAAC,YAAY,IAAI,CAAC;AAAA,EACpD;AAAA,EACA,MAAM,SAAS,OAAoB,mBAAK,YAAY,MAAM;AAAA,IACxD,UAAU;AAAA,IACV,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,OAAO;AAAA,IACP,QAAQ;AAAA,EACV,CAAC,EAAE,KACD,QAAQ,OACD,gBAAQ,CAAC,UACP,YACL;AAAA,IACE,UAAU,MAAM;AAAA,IAChB,QAAQ,MAAM,OAAO,KACZ,oBACA,kBACA,YAAI,CAAC,SAAS,KAAK,KAAK,CAAC,CAClC;AAAA,IACA,QAAQ,MAAM,OAAO,KACZ,oBACA,kBACA,YAAI,CAAC,SAAS,KAAK,KAAK,CAAC,CAClC;AAAA,EACF,GACA,EAAE,aAAa,YAAY,CAC7B,CACF,GACO,cACT;AAAA,EAEA,MAAM,UAAU,KAAK,KAAK,GAAG;AAAA,EAC7B,IAAI,OAAO,aAAa,GAAG;AAAA,IACzB,OAAO,OAAc,aACnB,IAAI,WAAW,SAAS,OAAO,UAAU,OAAO,OAAO,MAAM,GAAG,GAAG,CAAC,CACtE;AAAA,EACF;AAAA,EACA,OAAO,OAAO;AAAA,CACf;AAGI,IAAM,oBAAoB,CAAC,MAAyB,YACzD,SAAS,MAAM,OAAO,EAAE,KACf,gBACL,CAAC,UACC,iBAAiB,cACjB,MAAM,aAAa,KACnB,+BAA+B,KAAK,MAAM,OAAO,GACnD,MAAa,gBAAQ,EAAE,CACzB,CACF;;;ALhBK,IAAM,kBAAkB,SAA0B,kBAAkB;AAW3E,IAAM,mBAAmB,CAAC,UACxB,iBAAiB,SAAS,qBAAqB,KAAK,MAAM,OAAO;AAEnE,IAAM,gBAAgB,CAAC,OAAwB,QAC7C,YAAY,MAAM,OAAO,OAAO,KAAK,CAAC,cAAc,QAAQ,CAAC,EAAE,KACtD,gBAAQ,kBAAkB,MAAa,gBAAQ,SAAS,CAAC,CAClE;AAcK,IAAM,iBAAiB,CAAC,UACtB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,MAAM,iBAAiB;AAAA,EACnC,MAAM,MAAM,OAAO,cAAc,OAAO,GAAG;AAAA,EAC3C,IAAI,QAAQ;AAAA,IAAW;AAAA,EACvB,MAAM,OAAO,WAAW,KAAK,KAAK;AAAA,EAClC,IAAI,SAAS,WAAW;AAAA,IACtB,OAAO,OAAc,aACnB,IAAI,MACF,GAAG,MAAM,OAAO,SAAS,kEACvB,eAAe,MAAM,gEACrB,6CACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA,CACR;AAEI,IAAM,iBAAiB,CAC5B,MACA,WAEO,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,WAAW,aAAa,CAAC,WAAW,IAAI;AAAA,IAAG;AAAA,EAC/C,MAAM,OAAO,OAAO,eAAe,IAAI;AAAA,EACvC,IACE,SAAS,aACT,KAAK,yBAAyB,OAAO,wBACrC,KAAK,YAAY,OAAO,WACxB,KAAK,aAAa,OAAO,UACzB;AAAA,IACA,OAAO,EAAE,QAAQ,OAAO;AAAA,EAC1B;AAAA,EACA,OAAO,EAAE,QAAQ,SAAS;AAAA,CAC3B;AAeI,IAAM,sBAAsB,CACjC,OACA,WAEO,eACE,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,MAAM,iBAAiB;AAAA,EAEnC,IAAI,WAAW,aAAa,OAAO,yBAAyB,IAAI;AAAA,IAC9D,MAAM,OAAM,OAAO,YAAY,MAAM,OAAO,OAAO,KAAK,CAAC,cAAc,QAAQ,CAAC;AAAA,IAChF,MAAM,QAAO,WAAW,MAAK,KAAK;AAAA,IAClC,IAAI,UAAS,WAAW;AAAA,MACtB,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,MAAM,OAAO,SAAS,6DACvB,WAAW,MAAM,yDACrB,CACF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,OAAO,gBAAgB,MAAM,MAAM;AAAA,EACtD,QAAQ,MAAM,YAAY,OAAO,iBAC/B,GAAG,MAAM,OAAO,WAAW,MAAM,qBACnC;AAAA,EACA,OAAO,SACL,CAAC,cAAc,SAAS,iBAAiB,WAAW,wBAAwB,MAAM,OAAO,GACzF,EAAE,OAAO,CAAC,MAAM,IAAI,GAAG,iBAAiB,WAAW,gBAAgB,CACrE;AAAA,EACA,MAAM,MAAM,OAAc,mBAAW;AAAA,IACnC,OAAO,CAAC,UAAU,IAAI,MAAM,GAAG,0CAA0C,OAAO,KAAK,GAAG;AAAA,IACxF,KAAK,MAAM,IAAI,KAAK,OAAO,EAAE,KAAK;AAAA,EACpC,CAAC;AAAA,EACD,IAAI,IAAI,KAAK,MAAM,IAAI;AAAA,IACrB,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,MAAM,+EACP,gDACJ,CACF;AAAA,EACF;AAAA,EAIA,OAAc,YAAI;AAAA,IAChB,OAAO,CAAC,UAAU,IAAI,MAAM,GAAG,wBAAwB,OAAO,KAAK,GAAG;AAAA,IACtE,KAAK,MAAM,UAAU,SAAS,GAAK;AAAA,EACrC,CAAC;AAAA,EACD,MAAM,OAAO,WAAW,KAAK,KAAK;AAAA,EAClC,IAAI,SAAS,WAAW;AAAA,IACtB,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,MAAM,4EACP,GAAG,MAAM,UACb,CACF;AAAA,EACF;AAAA,EACA,OAAO,aAAa,MAAM,OAAO,OAAO,KAAK,cAAc,GAAG;AAAA,EAC9D,OAAO;AAAA,CACR,CACH;AAEF,IAAM,WAAW;AAAA,EACf,QAAQ,MAAa;AAAA,EACrB,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,QAII,eAAe,MAAM,MAAM;AAAA,EACjC,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAsC,eAAe,IAAI;AAAA,EAClE,WAAW;AAAA,IACT;AAAA,IACA;AAAA,QAII,oBAAoB,MAAM,MAAM;AACxC;AAEO,IAAM,0BAA0B,MAC5B,gBAAO,iBAAwB,gBAAQ,gBAAgB,SAAS,GAAG,QAAQ,CAAC,CAAC;;AMhOxF,qBAAS;AACT,uBAAS;AAET;AACA;;;ACvBA;;;ACDA;AAAA;AAaO,MAAM,kCAAuC,iBAAY,2BAA2B,EAKxF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,GAAG,KAAK,SAAS,KAAK,4BAA4B,KAAK,mCACvD,gBAAgB,KAAK,yEACrB,+FACA;AAAA;AAGN;AAAA;AAYO,MAAM,gCAAqC,iBAAY,yBAAyB,EAIpF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,GAAG,KAAK,8BAA8B,KAAK,mDAC3C,uCAAuC,KAAK,iDAC5C;AAAA;AAGN;AAAA;AAiBO,MAAM,gCAAqC,iBAAY,yBAAyB,EAGpF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,GAAG,KAAK,qFACR,iBAAiB,KAAK,wEACtB;AAAA;AAGN;;;ADjEO,IAAM,iBAAiB,CAAC,OAAuB,oBACpD,SAAS,CAAC,OAAO,eAAe,MAAM,MAAM,GAAG;AAAA,EAC7C,OAAO,CAAC,MAAM,IAAI;AAAA,EAClB;AACF,CAAC,EAAE,KAAY,YAAI,CAAC,SAAS,KAAK,SAAS,MAAM,KAAK,KAAK,SAAS,UAAU,CAAC,CAAC;AAoB3E,IAAM,oBAAoB,CAAC,OAAuB,oBAChD,aACJ,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,SACvB,eAAe,KAAK,OAAO,MAAM,KAAK,GAAG,eAAe,EAAE,KACjD,oBAAY;AAAA,EACjB,WAAW,CAAC,UACH,aACL,IAAI,wBAAwB;AAAA,IAC1B,QAAQ,QAAQ,4CAA4C,OAAO,KAAK;AAAA,IACxE,MAAM,MAAM;AAAA,EACd,CAAC,CACH;AAAA,EACF,WAAW,CAAC,eACV,aACW,aACL,IAAI,wBAAwB;AAAA,IAC1B,QACE,QAAQ,sEACR;AAAA,IACF,MAAM,MAAM;AAAA,EACd,CAAC,CACH,IACO;AACf,CAAC,CACH,CACF,GACA,EAAE,SAAS,KAAK,CAClB;;;ADLK,IAAM,iBAAiB,UAAyB,mBAAmB;AAAA,EAExE,sBAAsB;AACxB,CAAC;AAgBM,IAAM,gBAAgB,CAAC,UACrB,eACE,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,gBAAgB,MAAM,MAAM;AAAA,EACtD,MAAM,eAAe,OAAO,eAAe,OAAO,WAAW,eAAe;AAAA,EAC5E,OAAO,eAAgB,EAAE,cAAc,MAAM,MAAM,MAAM,KAAK,IAAc;AAAA,CAC7E,CACH;AA4BK,IAAM,gBAAgB,CAC3B,MACA,WAEO,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,WAAW,aAAa,CAAC,YAAW,IAAI;AAAA,IAAG;AAAA,EAC/C,IAAI,OAAO;AAAA,IAAc,OAAO,EAAE,QAAQ,OAAO;AAAA,EACjD,MAAM,OAAO,OAAO,cAAc,IAAI;AAAA,EACtC,OAAO,MAAM,iBAAiB,OACzB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,CACzB;AAQI,IAAM,qBAAqB,CAChC,OACA,WAEO,eACE,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,gBAAgB,MAAM,MAAM;AAAA,EAEtD,IAAI,QAAQ,iBAAiB,MAAM;AAAA,IACjC,MAAM,oBAAoB,OAAO,eAAe,OAAO,WAAW,eAAe,EAAE,KAC1E,gBACL,MAAe,MACf,CAAC,UACQ,aACL,IAAI,wBAAwB;AAAA,MAC1B,QAAQ,qBAAqB,OAAO,KAAK;AAAA,MACzC,MAAM,MAAM;AAAA,IACd,CAAC,CACH,CACJ,CACF;AAAA,IACA,IAAI,CAAC,mBAAmB;AAAA,MACtB,OAAO,OAAc,aACnB,IAAI,wBAAwB;AAAA,QAC1B,QAAQ;AAAA,QACR,MAAM,MAAM;AAAA,MACd,CAAC,CACH;AAAA,IACF;AAAA,IACA,OAAO,EAAE,cAAc,MAAM,MAAM,MAAM,KAAK;AAAA,EAChD;AAAA,EAEA,MAAM,SAAS,OAAO,eAAe,OAAO,WAAW,eAAe;AAAA,EACtE,IAAI,CAAC,QAAQ;AAAA,IAGX,OAAO,kBAAkB,OAAO,WAAW,eAAe;AAAA,IAC1D,OAAO,kBAAkB,CAAC,WAAW,GAAG;AAAA,MACtC,OAAO,CAAC,MAAM,IAAI;AAAA,MAClB,iBAAiB,WAAW;AAAA,IAC9B,CAAC;AAAA,EACH;AAAA,EACA,MAAM,QAAQ,OAAO,eAAe,OAAO,WAAW,eAAe;AAAA,EACrE,IAAI,CAAC,OAAO;AAAA,IACV,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,MAAM,0EACP,qDACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO,EAAE,cAAc,MAAM,MAAM,MAAM,KAAK;AAAA,CAC/C,CACH;AAEF,IAAM,YAAW;AAAA,EACf,QAAQ,MAAa;AAAA,EACrB,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,QAII,cAAc,MAAM,MAAM;AAAA,EAChC,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAqC,cAAc,IAAI;AAAA,EAChE,WAAW;AAAA,IACT;AAAA,IACA;AAAA,QAII,mBAAmB,MAAM,MAAM;AACvC;AAEO,IAAM,yBAAyB,MAC3B,iBAAO,gBAAuB,gBAAQ,eAAe,SAAS,GAAG,SAAQ,CAAC,CAAC;;AG7LtF,qBAAS;AACT,uBAAS;AAET;AACA;AAsCO,IAAM,qBAAqB,UAA6B,qBAAqB;AAEpF,IAAM,UAAU,CAAC,UACf,UAAU,aAAa,MAAM,WAAW,IAAI,KAAK,MAAM,KAAK,GAAG;AAEjE,IAAM,aAAa,CAAC,OAA2B,gBAAwB;AAAA,EACrE,MAAM,OAAO,CAAC,UAAU,kBAAkB,WAAW;AAAA,EACrD,MAAM,KAAK,QAAQ,MAAM,iBAAiB;AAAA,EAC1C,MAAM,UAAU,QAAQ,MAAM,WAAW;AAAA,EACzC,IAAI,OAAO;AAAA,IAAI,KAAK,KAAK,yBAAyB,EAAE;AAAA,EACpD,IAAI,YAAY;AAAA,IAAI,KAAK,KAAK,kBAAkB,OAAO;AAAA,EACvD,OAAO;AAAA;AAmBT,IAAM,QAAQ,CAAC,OAA2B,gBACjC,eACE,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,gBAAgB,MAAM,MAAM;AAAA,EACtD,MAAM,UAAU,MAAM,kBAAkB;AAAA,EACxC,IAAI,YAAY,WAAW;AAAA,IACzB,OAAO,OAAc,aACnB,IAAI,MACF,uBAAuB,MAAM,OAAO,mDAClC,4BACJ,CACF;AAAA,EACF;AAAA,EACA,OAAO,SAAS,WAAW,OAAO,WAAW,GAAG;AAAA,IAC9C,WAAW,CAAC,OAAO;AAAA,IACnB,OAAO,CAAC,OAAO;AAAA,IACf,iBAAiB,WAAW;AAAA,EAC9B,CAAC;AAAA,EACD,OAAO;AAAA,IACL,mBAAmB,QAAQ,MAAM,iBAAiB;AAAA,IAClD,SAAS;AAAA,IACT,aAAa,QAAQ,MAAM,WAAW;AAAA,EACxC;AAAA,CACD,CACH;AAQF,IAAM,eAAe,CAAC,UAAwC,iBAAiB;AAGxE,IAAM,oBAAoB,CAAC,UAChC,MAAM,OAAO,IAAI,EAAE,KACV,gBAAQ,cAAc,MACpB,gBAAQ;AAAA,EACb,mBAAmB,QAAQ,MAAM,iBAAiB;AAAA,EAClD,SAAS;AAAA,EACT,aAAa,QAAQ,MAAM,WAAW;AACxC,CAAC,CACH,CACF;AAEK,IAAM,oBAAoB,CAC/B,MACA,WAEO,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,WAAW,aAAa,CAAC,YAAW,IAAI;AAAA,IAAG;AAAA,EAC/C,MAAM,OAAO,OAAO,kBAAkB,IAAI;AAAA,EAC1C,IAAI,KAAK;AAAA,IAAS,OAAO,EAAE,QAAQ,OAAO;AAAA,EAC1C,OAAO,EAAE,QAAQ,SAAS;AAAA,CAC3B;AAEI,IAAM,yBAAyB,CAAC,UACrC,MAAM,OAAO,MAAM,eAAe,OAAO,EAAE,KAClC,gBAAQ,cAAc,CAAC,UACrB,aACL,IAAI,MACF,uBAAuB,MAAM,OAAO,yCAClC,GAAG,MAAM,eAAe,aAAa,OAAO,KAAK,GACrD,CACF,CACF,CACF;AAEF,IAAM,YAAW;AAAA,EACf,QAAQ,MAAa;AAAA,EACrB,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,QAII,kBAAkB,MAAM,MAAM;AAAA,EACpC,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAyC,kBAAkB,IAAI;AAAA,EACxE,WAAW,GAAG,WAAyC,uBAAuB,IAAI;AACpF;AAEO,IAAM,6BAA6B,MAC/B,iBAAO,oBAA2B,gBAAQ,mBAAmB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AC/J9F,qBAAS;AAET;AACA;;;ACnBA;AACA,uBAAS;AAET;AACA;AAkBO,IAAM,iBAAiB,CAAC,OAA2B,oBACxD,SAAS,CAAC,OAAO,iBAAiB,YAAY,MAAM,MAAM,GAAG;AAAA,EAC3D,WAAW,CAAC,MAAM,IAAI;AAAA,EACtB,OAAO,CAAC,MAAM,IAAI;AAAA,EAClB;AACF,CAAC,EAAE,KACM,gBAAQ,CAAC,gBAAgB;AAAA,EAC9B,MAAM,OAAO,yBAAyB,WAAW;AAAA,EACjD,OAAO,SAAS,YACL,aACL,IAAI,MACF,GAAG,MAAM,4EACP,4DACJ,CACF,IACO,gBAAQ,aAAa,IAAI,CAAC;AAAA,CACtC,CACH;AAYF,IAAM,uBAAuB,CAAC,OAA2B,oBACvD,SAAS,CAAC,SAAS,GAAG;AAAA,EACpB,WAAW,CAAC,MAAM,IAAI;AAAA,EACtB,UAAU;AAAA,EACV,OAAO,CAAC,MAAM,IAAI;AAAA,EAClB;AACF,CAAC,EAAE,KACM,WAAG,IAAI,GACP,sBAAc,MAAM,KAAK,CAClC;AAuBK,IAAM,oBAAoB,CAAC,UACzB,eACE,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,gBAAgB,MAAM,MAAM;AAAA,EACtD,MAAM,UAAU,OAAc,eAAO,eAAe,OAAO,WAAW,eAAe,CAAC;AAAA,EACtF,IAAW,iBAAU,OAAO,GAAG;AAAA,IAC7B,MAAM,YAAY,OAAO,qBAAqB,OAAO,WAAW,eAAe;AAAA,IAC/E,OAAO,YAAY,YAAY,OAAc,aAAK,QAAQ,OAAO;AAAA,EACnE;AAAA,EACA,MAAM,QAAQ;AAAA,IACZ,cAAc,MAAM;AAAA,IACpB,WAAW,QAAQ,YAAY,MAAM,eAAgB,cAAwB;AAAA,IAC7E,MAAM,MAAM,QAAQ;AAAA,IACpB,MAAM,MAAM;AAAA,EACd;AAAA,EACA,OAAO,MAAM,cAAc,QAAQ,QAAQ,KAAK,IAAI;AAAA,CACrD,CACH;AAEK,IAAM,oBAAoB,CAC/B,MACA,WAEO,YAAI,UAAU,GAAG;AAAA,EACtB,IAAI,WAAW,aAAa,CAAC,YAAW,IAAI;AAAA,IAAG;AAAA,EAC/C,MAAM,OAAO,OAAO,kBAAkB,IAAI;AAAA,EAC1C,IAAI,SAAS,aAAa,KAAK,cAAc;AAAA,IAAO,OAAO,EAAE,QAAQ,OAAO;AAAA,EAC5E,OAAO,EAAE,QAAQ,SAAS;AAAA,CAC3B;;;ACvGH;AAQA,IAAM,cAAc,CAAC,SAAoB,SAAS,YAAY,SAAS;AAUvE,IAAM,SAA6E;AAAA,EACjF,WAAW,EAAE,YAAY,MAAO,aAAa,EAAE;AAAA,EAC/C,WAAW,EAAE,YAAY,MAAO,aAAa,GAAG;AAClD;AAMA,IAAM,iBAAiB,CACrB,QACA,WAEO,YAAI,UAAU,GAAG;AAAA,EACtB,SAAS,UAAU,EAAG,WAAW,OAAO,aAAa,WAAW;AAAA,IAC9D,MAAM,UAAU,OAAO,OAAM,KAAY,sBAAc,MAAM,KAAK,CAAC;AAAA,IACnE,IAAI;AAAA,MAAS,OAAO;AAAA,IACpB,IAAI,UAAU,OAAO;AAAA,MAAa,OAAc,cAAM,OAAO,UAAU;AAAA,EACzE;AAAA,EACA,OAAO;AAAA,CACR;AAaI,IAAM,mBAAmB,CAC9B,MACA,MACA,QACA,WAA+E,WAExE,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,YAAY,YAAY,IAAI;AAAA,EAClC,MAAM,SAAS,YAAY,SAAS,YAAY,SAAS;AAAA,EACzD,MAAM,UAAU,OAAO,eAAe,QAAO,MAAM;AAAA,EACnD,IAAI,CAAC,SAAS;AAAA,IACZ,OAAO,OAAc,aACnB,IAAI,wBAAwB,EAAE,UAAU,OAAO,aAAa,MAAM,KAAK,CAAC,CAC1E;AAAA,EACF;AAAA,EACA,OAAO,YAAY,aAAa;AAAA,CACjC;;;AFPI,IAAM,qBAAqB,UAA6B,qBAAqB;AAS7E,IAAM,yBAAyB,CACpC,OACA,QACA,iBAEO,gBACE,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,MAAM,QAAQ;AAAA,EAG3B,MAAM,MAAM,OAAO,YAAY,MAAM,OAAO,OAAO,MAAM,WAAW,CAAC,QAAQ,CAAC;AAAA,EAC9E,MAAM,YAAY,aAAa,GAAG;AAAA,EAClC,IAAI,cAAc,MAAM,cAAc;AAAA,IACpC,OAAO,OAAc,cACnB,IAAI,0BAA0B;AAAA,MAC5B,UAAU,MAAM;AAAA,MAChB,KAAK;AAAA,MACL,KAAK,MAAM;AAAA,MACX,OAAO,MAAM,OAAO;AAAA,IACtB,CAAC,CACH;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,OAAO,gBAAgB,MAAM,MAAM;AAAA,EACtD,QAAQ,SAAS,OAAO,eAAe,KAAK,GAAG,MAAM,OAAO,WAAW,MAAM,aAAa;AAAA,EAE1F,MAAM,WAAW,WAAW;AAAA,EAC5B,MAAM,OAAO;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,WAAW,CAAC,YAAY,IAAI,CAAC;AAAA,EACnC;AAAA,EACA,OAAO,SAAS,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,GAAG,iBAAiB,WAAW,gBAAgB,CAAC;AAAA,EAE1F,MAAM,YAAY,OAAO,iBACvB,MAAM,MACN,MACA,eAAe,OAAO,WAAW,eAAe,EAAE,KACzC,aAAI,CAAC,SAAS,SAAS,MAAM,YAAY,CAClD,GACA,YACF;AAAA,EAEA,OAAO;AAAA,IACL,cAAc,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA,MAAM,MAAM;AAAA,EACd;AAAA,CACD,CACH;AAEF,IAAM,YAAW;AAAA,EACf,QAAQ,MAAa;AAAA,EACrB,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,QAII,kBAAkB,MAAM,MAAM;AAAA,EACpC,MAAM,MAAa,iBAAQ,CAAC,CAAC;AAAA,EAC7B,MAAM,GAAG,WAAyC,kBAAkB,IAAI;AAAA,EACxE,WAAW;AAAA,IACT;AAAA,IACA;AAAA,QAII,uBAAuB,MAAM,MAAM;AAC3C;AAEO,IAAM,6BAA6B,MAC/B,iBAAO,oBAA2B,iBAAQ,mBAAmB,SAAS,GAAG,SAAQ,CAAC,CAAC;",
-  "debugId": "D7E7AB43E3608FE064756E2164756E21",
+  "debugId": "33FF194E493FB6EF64756E2164756E21",
   "names": []
 }

package/dist/talos/kubeconfig.d.ts

@@ -47,12 +47,12 @@ export declare const TalosKubeconfig: import("alchemy").ResourceClass<TalosKubec
  *   `Talos.Kubeconfig` could never be created. Vault content that EXISTS but does not parse as a
  *   kubeconfig is a different, fail-closed case (below), never treated as absence.
  */
-export declare const readKubeconfig: (props: KubeconfigProps) => Effect.Effect<KubeconfigAttributes | undefined, Error, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+export declare const readKubeconfig: (props: KubeconfigProps) => Effect.Effect<KubeconfigAttributes | undefined, Error, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
 export declare const diffKubeconfig: (news: Input<KubeconfigProps>, output: KubeconfigAttributes | undefined) => Effect.Effect<{
     readonly action: 'noop';
 } | {
     readonly action: 'update';
-} | undefined, Error, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+} | undefined, Error, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
 /**
  * ⛔ WRAPPED IN `Effect.scoped` — same C1-lifetime reasoning as every other Talos resource file:
  *   `mintTalosconfig` and `reservedTempPath` both contribute `Scope.Scope`, and this is the caller
@@ -66,6 +66,6 @@ export declare const diffKubeconfig: (news: Input<KubeconfigProps>, output: Kube
  *   write once — rather than take the confirm-only branch and fail trying to read back a key that
  *   was never actually written.
  */
-export declare const reconcileKubeconfig: (props: KubeconfigProps, output: KubeconfigAttributes | undefined) => Effect.Effect<KubeconfigAttributes, Error | import("effect/PlatformError").PlatformError, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
-export declare const TalosKubeconfigProvider: () => import("effect/Layer").Layer<Provider.Provider<TalosKubeconfig>, never, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+export declare const reconcileKubeconfig: (props: KubeconfigProps, output: KubeconfigAttributes | undefined) => Effect.Effect<KubeconfigAttributes, Error | import("effect/PlatformError").PlatformError, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
+export declare const TalosKubeconfigProvider: () => import("effect/Layer").Layer<Provider.Provider<TalosKubeconfig>, never, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
 //# sourceMappingURL=kubeconfig.d.ts.map

package/dist/talos/kubeconfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kubeconfig.d.ts","sourceRoot":"","sources":["../../src/talos/kubeconfig.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGnE,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,+BAA+B,EAAE,MAAM,CAAC;IACxC,4BAA4B,EAAE,MAAM,CAAC;IACrC,iGAAiG;IACjG,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;OASG;IACH,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,eAAgB,SAAQ,QAAQ,CAC/C,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,eAAe,kDAAgD,CAAC;AAmB7E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,UAAW,eAAe,sIAgBjD,CAAC;AAEL,eAAO,MAAM,cAAc,SACnB,KAAK,CAAC,eAAe,CAAC,UACpB,oBAAoB,GAAG,SAAS;qBAWnB,MAAM;;qBAER,QAAQ;gGACzB,CAAC;AAEL;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,UACvB,eAAe,UACd,oBAAoB,GAAG,SAAS,yKA2DvC,CAAC;AAsBJ,eAAO,MAAM,uBAAuB,0JACqD,CAAC"}
+{"version":3,"file":"kubeconfig.d.ts","sourceRoot":"","sources":["../../src/talos/kubeconfig.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGnE,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,+BAA+B,EAAE,MAAM,CAAC;IACxC,4BAA4B,EAAE,MAAM,CAAC;IACrC,iGAAiG;IACjG,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;OASG;IACH,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,eAAgB,SAAQ,QAAQ,CAC/C,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,eAAe,kDAAgD,CAAC;AAmB7E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,UAAW,eAAe,6HAgBjD,CAAC;AAEL,eAAO,MAAM,cAAc,SACnB,KAAK,CAAC,eAAe,CAAC,UACpB,oBAAoB,GAAG,SAAS;qBAWnB,MAAM;;qBAER,QAAQ;uFACzB,CAAC;AAEL;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,UACvB,eAAe,UACd,oBAAoB,GAAG,SAAS,gKA2DvC,CAAC;AAsBJ,eAAO,MAAM,uBAAuB,iJACqD,CAAC"}

package/dist/talos/machine-config-fixtures.d.ts

@@ -6,7 +6,7 @@
  *   Talos machine config, CA key or bootstrap token. No provider imports this file.
  */
 import * as Effect from 'effect/Effect';
-import * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';
+import * as ChildProcessSpawner from 'effect/process/ChildProcessSpawner';
 import { type FakeCall } from './fake-process.ts';
 import type { MachineConfigProps } from './talos-machine-config.ts';
 export declare const CONFIG_TEXT = "machine:\n  type: worker\n";

package/dist/talos/machine-config-fixtures.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"machine-config-fixtures.d.ts","sourceRoot":"","sources":["../../src/talos/machine-config-fixtures.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,mBAAmB,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,KAAK,QAAQ,EAAe,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAGpE,eAAO,MAAM,WAAW,+BAA+B,CAAC;AACxD,eAAO,MAAM,GAAG,QAA4B,CAAC;AAC7C,eAAO,MAAM,MAAM;IAAK,OAAO;IAAQ,KAAK;CAAc,CAAC;AAC3D,eAAO,MAAM,SAAS;IACpB,SAAS;QAAI,UAAU;QAAK,WAAW;;IACvC,SAAS;QAAI,UAAU;QAAK,WAAW;;CACxC,CAAC;AAEF,eAAO,MAAM,KAAK,eAAe,OAAO,CAAC,kBAAkB,CAAC,KAAQ,kBAMlE,CAAC;AAEH,+FAA+F;AAC/F,eAAO,MAAM,UAAU,aAAc,MAAM,6BAC6D,CAAC;AAEzG,8FAA8F;AAC9F,eAAO,MAAM,UAAU,SAAU;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,YAEe,QAAQ;aAXS,MAAM;eAAa,MAAM;;;;CAgCzD,CAAC;AAEF,eAAO,MAAM,GAAG,GAAI,CAAC,EAAE,CAAC,UACd,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,mBAAmB,CAAC,mBAAmB,CAAC,WAC3D,CAAC,CAAC,EAAE,QAAQ,KAAK;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,UAC1E,QAAQ,EAAE,eAQhB,CAAC;AAEJ,8EAA8E;AAC9E,eAAO,MAAM,MAAM,QAAS,MAAM,aAAa,OAAO,YACH,CAAC"}
+{"version":3,"file":"machine-config-fixtures.d.ts","sourceRoot":"","sources":["../../src/talos/machine-config-fixtures.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,mBAAmB,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,KAAK,QAAQ,EAAe,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAGpE,eAAO,MAAM,WAAW,+BAA+B,CAAC;AACxD,eAAO,MAAM,GAAG,QAA4B,CAAC;AAC7C,eAAO,MAAM,MAAM;IAAK,OAAO;IAAQ,KAAK;CAAc,CAAC;AAC3D,eAAO,MAAM,SAAS;IACpB,SAAS;QAAI,UAAU;QAAK,WAAW;;IACvC,SAAS;QAAI,UAAU;QAAK,WAAW;;CACxC,CAAC;AAEF,eAAO,MAAM,KAAK,eAAe,OAAO,CAAC,kBAAkB,CAAC,KAAQ,kBAMlE,CAAC;AAEH,+FAA+F;AAC/F,eAAO,MAAM,UAAU,aAAc,MAAM,6BAC6D,CAAC;AAEzG,8FAA8F;AAC9F,eAAO,MAAM,UAAU,SAAU;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,YAEe,QAAQ;aAXS,MAAM;eAAa,MAAM;;;;CAgCzD,CAAC;AAEF,eAAO,MAAM,GAAG,GAAI,CAAC,EAAE,CAAC,UACd,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,mBAAmB,CAAC,mBAAmB,CAAC,WAC3D,CAAC,CAAC,EAAE,QAAQ,KAAK;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,UAC1E,QAAQ,EAAE,eAQhB,CAAC;AAEJ,8EAA8E;AAC9E,eAAO,MAAM,MAAM,QAAS,MAAM,aAAa,OAAO,YACH,CAAC"}

package/dist/talos/machine-config-read.d.ts

@@ -13,7 +13,7 @@ import type { MachineConfigAttributes, MachineConfigProps } from './talos-machin
  *   talosconfig context's own endpoints, which may be a control-plane VIP that only comes up AFTER
  *   bootstrap; every pre-bootstrap call in this file targets the node directly instead.
  */
-export declare const liveSpecDigest: (props: MachineConfigProps, talosconfigPath: string) => Effect.Effect<string, Error | import("effect/PlatformError").PlatformError | import("./talosctl.ts").TalosError, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+export declare const liveSpecDigest: (props: MachineConfigProps, talosconfigPath: string) => Effect.Effect<string, Error | import("effect/PlatformError").PlatformError | import("./talosctl.ts").TalosError, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
 /**
  * ⛔ NO SWALLOWING. A transport failure here propagates as its own error (TalosError or the
  *   shape error above) — never as `converged: false`. A false only means "read succeeded, and
@@ -40,10 +40,10 @@ export declare const readMachineConfig: (props: MachineConfigProps) => Effect.Ef
     converged: "read-back" | false;
     mode: import("./resource.ts").ApplyMode;
     node: string;
-} | undefined, Error | import("effect/PlatformError").PlatformError, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+} | undefined, Error | import("effect/PlatformError").PlatformError, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
 export declare const diffMachineConfig: (news: Input<MachineConfigProps>, output: MachineConfigAttributes | undefined) => Effect.Effect<{
     readonly action: 'noop';
 } | {
     readonly action: 'update';
-} | undefined, Error | import("effect/PlatformError").PlatformError, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+} | undefined, Error | import("effect/PlatformError").PlatformError, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
 //# sourceMappingURL=machine-config-read.d.ts.map

package/dist/talos/machine-config-read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"machine-config-read.d.ts","sourceRoot":"","sources":["../../src/talos/machine-config-read.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAI7F;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,UAAW,kBAAkB,mBAAmB,MAAM,gMAiB9E,CAAC;AAuBJ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,iBAAiB,UAAW,kBAAkB;;;;;+IAiBxD,CAAC;AAEJ,eAAO,MAAM,iBAAiB,SACtB,KAAK,CAAC,kBAAkB,CAAC,UACvB,uBAAuB,GAAG,SAAS;qBAK4B,MAAM;;qBAC1D,QAAQ;+IACzB,CAAC"}
+{"version":3,"file":"machine-config-read.d.ts","sourceRoot":"","sources":["../../src/talos/machine-config-read.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAI7F;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,UAAW,kBAAkB,mBAAmB,MAAM,uLAiB9E,CAAC;AAuBJ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,iBAAiB,UAAW,kBAAkB;;;;;sIAiBxD,CAAC;AAEJ,eAAO,MAAM,iBAAiB,SACtB,KAAK,CAAC,kBAAkB,CAAC,UACvB,uBAAuB,GAAG,SAAS;qBAK4B,MAAM;;qBAC1D,QAAQ;sIACzB,CAAC"}

package/dist/talos/resource.d.ts

@@ -15,7 +15,7 @@
  * ⚠️ EVERY CLAIM ABOUT talosctl FLAGS IN THIS PACKAGE IS REASONED FROM THE PUBLISHED CLI REFERENCE
  *   (Talos v1.13 docs, fetched 2026-09-13 in this session). Nothing was measured on a live cluster.
  */
-import type * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';
+import type * as ChildProcessSpawner from 'effect/process/ChildProcessSpawner';
 import type { TalosTarget } from './credentials.ts';
 /**
  * ★ WHAT EVERY OPERATION HERE NEEDS FROM THE RUNTIME — ChildProcessSpawner only.

package/dist/talos/resource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/talos/resource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,KAAK,mBAAmB,MAAM,6CAA6C,CAAC;AACxF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,mBAAmB,CAAC;AAExE,kEAAkE;AAClE,MAAM,MAAM,UAAU,GAAG;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC;AAEjD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC"}
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/talos/resource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,KAAK,mBAAmB,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,mBAAmB,CAAC;AAExE,kEAAkE;AAClE,MAAM,MAAM,UAAU,GAAG;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC;AAEjD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC"}

package/dist/talos/talos-bootstrap-etcd.d.ts

@@ -15,7 +15,7 @@ import { TalosReBootstrapRefused } from './talos-errors.ts';
  *   failure here means (talos-bootstrap.ts's `read`/`reconcile`, and `assertNoLivePeers` below), so
  *   it is not decided here.
  */
-export declare const isBootstrapped: (props: BootstrapProps, talosconfigPath: string) => Effect.Effect<boolean, import("effect/PlatformError").PlatformError | import("./talosctl.ts").TalosError, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+export declare const isBootstrapped: (props: BootstrapProps, talosconfigPath: string) => Effect.Effect<boolean, import("effect/PlatformError").PlatformError | import("./talosctl.ts").TalosError, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
 /**
  * ⛔ I4 FIX (LAND red team, 2026-09-26) — THE CREATE PATH ONLY CHECKED THIS NODE. If the state row
  *   is lost (wrong `--stage`, an FQN rename, a wiped state store) while the cluster already lives on
@@ -34,5 +34,5 @@ export declare const isBootstrapped: (props: BootstrapProps, talosconfigPath: st
  *   matches the method NAME and cannot tell Effect's from Array's (same pattern as
  *   openbao/cloudflare-permission-groups.ts).
  */
-export declare const assertNoLivePeers: (props: BootstrapProps, talosconfigPath: string) => Effect.Effect<void, TalosReBootstrapRefused, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+export declare const assertNoLivePeers: (props: BootstrapProps, talosconfigPath: string) => Effect.Effect<void, TalosReBootstrapRefused, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
 //# sourceMappingURL=talos-bootstrap-etcd.d.ts.map

package/dist/talos/talos-bootstrap-etcd.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"talos-bootstrap-etcd.d.ts","sourceRoot":"","sources":["../../src/talos/talos-bootstrap-etcd.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAG5D;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,UAAW,cAAc,mBAAmB,MAAM,yLAIM,CAAC;AAEpF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iBAAiB,UAAW,cAAc,mBAAmB,MAAM,4HA2B7E,CAAC"}
+{"version":3,"file":"talos-bootstrap-etcd.d.ts","sourceRoot":"","sources":["../../src/talos/talos-bootstrap-etcd.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAG5D;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,UAAW,cAAc,mBAAmB,MAAM,gLAIM,CAAC;AAEpF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iBAAiB,UAAW,cAAc,mBAAmB,MAAM,mHA2B7E,CAAC"}

package/dist/talos/talos-bootstrap.d.ts

@@ -68,7 +68,7 @@ export declare const TalosBootstrap: import("alchemy").ResourceClass<TalosBootst
 export declare const readBootstrap: (props: BootstrapProps) => Effect.Effect<{
     readonly bootstrapped: true;
     readonly node: string;
-} | undefined, Error | import("effect/PlatformError").PlatformError, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+} | undefined, Error | import("effect/PlatformError").PlatformError, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
 /**
  * ⛔ TRUSTS STATE, NEVER TOUCHES THE LIVE CLUSTER (K-talos-first-boot) — once `output.bootstrapped`
  *   is `true` this always reports `noop`, unconditionally, with zero live calls.
@@ -99,7 +99,7 @@ export declare const diffBootstrap: (news: Input<BootstrapProps>, output: Bootst
     readonly action: 'noop';
 } | {
     readonly action: 'update';
-} | undefined, Error | import("effect/PlatformError").PlatformError, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+} | undefined, Error | import("effect/PlatformError").PlatformError, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
 /**
  * ⛔ ONCE MEANS ONCE — see this file's own header. `output?.bootstrapped === true` is checked
  *   BEFORE anything else, and that branch never builds a `talosctl bootstrap` argv at all — the
@@ -109,6 +109,6 @@ export declare const diffBootstrap: (news: Input<BootstrapProps>, output: Bootst
 export declare const reconcileBootstrap: (props: BootstrapProps, output: BootstrapAttributes | undefined) => Effect.Effect<{
     bootstrapped: boolean;
     node: string;
-}, Error | import("effect/PlatformError").PlatformError | TalosReBootstrapRefused, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
-export declare const TalosBootstrapProvider: () => import("effect/Layer").Layer<Provider.Provider<TalosBootstrap>, never, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+}, Error | import("effect/PlatformError").PlatformError | TalosReBootstrapRefused, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
+export declare const TalosBootstrapProvider: () => import("effect/Layer").Layer<Provider.Provider<TalosBootstrap>, never, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
 //# sourceMappingURL=talos-bootstrap.d.ts.map

package/dist/talos/talos-bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"talos-bootstrap.d.ts","sourceRoot":"","sources":["../../src/talos/talos-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAG5D,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,uEAAuE;IACvE,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAGzB,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,aAAa,UAAW,cAAc;;;+IAOhD,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,aAAa,SAClB,KAAK,CAAC,cAAc,CAAC,UACnB,mBAAmB,GAAG,SAAS;qBAIK,MAAM;;qBAIjC,QAAQ;+IACvB,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,UACtB,cAAc,UACb,mBAAmB,GAAG,SAAS;;;6JAmDtC,CAAC;AAsBJ,eAAO,MAAM,sBAAsB,yJACoD,CAAC"}
+{"version":3,"file":"talos-bootstrap.d.ts","sourceRoot":"","sources":["../../src/talos/talos-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAG5D,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,uEAAuE;IACvE,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAGzB,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,aAAa,UAAW,cAAc;;;sIAOhD,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,aAAa,SAClB,KAAK,CAAC,cAAc,CAAC,UACnB,mBAAmB,GAAG,SAAS;qBAIK,MAAM;;qBAIjC,QAAQ;sIACvB,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,UACtB,cAAc,UACb,mBAAmB,GAAG,SAAS;;;oJAmDtC,CAAC;AAsBJ,eAAO,MAAM,sBAAsB,gJACoD,CAAC"}

package/dist/talos/talos-cluster-health.d.ts

@@ -63,16 +63,16 @@ export declare const readClusterHealth: (props: ClusterHealthProps) => Effect.Ef
     controlPlaneNodes: string;
     healthy: boolean;
     workerNodes: string;
-}, Error | import("effect/PlatformError").PlatformError, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+}, Error | import("effect/PlatformError").PlatformError, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
 export declare const diffClusterHealth: (news: Input<ClusterHealthProps>, output: ClusterHealthAttributes | undefined) => Effect.Effect<{
     readonly action: 'noop';
 } | {
     readonly action: 'update';
-} | undefined, Error | import("effect/PlatformError").PlatformError, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+} | undefined, Error | import("effect/PlatformError").PlatformError, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
 export declare const reconcileClusterHealth: (props: ClusterHealthProps) => Effect.Effect<{
     controlPlaneNodes: string;
     healthy: boolean;
     workerNodes: string;
-}, Error | import("effect/PlatformError").PlatformError, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
-export declare const TalosClusterHealthProvider: () => import("effect/Layer").Layer<Provider.Provider<TalosClusterHealth>, never, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+}, Error | import("effect/PlatformError").PlatformError, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
+export declare const TalosClusterHealthProvider: () => import("effect/Layer").Layer<Provider.Provider<TalosClusterHealth>, never, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
 //# sourceMappingURL=talos-cluster-health.d.ts.map

package/dist/talos/talos-cluster-health.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"talos-cluster-health.d.ts","sourceRoot":"","sources":["../../src/talos/talos-cluster-health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGnE,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,gEAAgE;IAChE,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,kDAAkD;IAClD,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,kBAAkB,qDAAsD,CAAC;AAgEtF,sGAAsG;AACtG,eAAO,MAAM,iBAAiB,UAAW,kBAAkB;;;;;;;;mIASxD,CAAC;AAEJ,eAAO,MAAM,iBAAiB,SACtB,KAAK,CAAC,kBAAkB,CAAC,UACvB,uBAAuB,GAAG,SAAS;qBAKN,MAAM;;qBACxB,QAAQ;+IACzB,CAAC;AAEL,eAAO,MAAM,sBAAsB,UAAW,kBAAkB;;;;mIAU7D,CAAC;AAgBJ,eAAO,MAAM,0BAA0B,6JACwD,CAAC"}
+{"version":3,"file":"talos-cluster-health.d.ts","sourceRoot":"","sources":["../../src/talos/talos-cluster-health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGnE,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,gEAAgE;IAChE,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,kDAAkD;IAClD,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,kBAAkB,qDAAsD,CAAC;AAgEtF,sGAAsG;AACtG,eAAO,MAAM,iBAAiB,UAAW,kBAAkB;;;;;;;;0HASxD,CAAC;AAEJ,eAAO,MAAM,iBAAiB,SACtB,KAAK,CAAC,kBAAkB,CAAC,UACvB,uBAAuB,GAAG,SAAS;qBAKN,MAAM;;qBACxB,QAAQ;sIACzB,CAAC;AAEL,eAAO,MAAM,sBAAsB,UAAW,kBAAkB;;;;0HAU7D,CAAC;AAgBJ,eAAO,MAAM,0BAA0B,oJACwD,CAAC"}

package/dist/talos/talos-machine-config.d.ts

@@ -72,6 +72,6 @@ export declare const reconcileMachineConfig: (props: MachineConfigProps, output:
     converged: "accepted" | "read-back";
     mode: ApplyMode;
     node: string;
-}, Error | import("effect/PlatformError").PlatformError | TalosConfigDigestMismatch | import("./talos-errors.ts").TalosConvergenceTimeout, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
-export declare const TalosMachineConfigProvider: () => import("effect/Layer").Layer<Provider.Provider<TalosMachineConfig>, never, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
+}, Error | import("effect/PlatformError").PlatformError | TalosConfigDigestMismatch | import("./talos-errors.ts").TalosConvergenceTimeout, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
+export declare const TalosMachineConfigProvider: () => import("effect/Layer").Layer<Provider.Provider<TalosMachineConfig>, never, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
 //# sourceMappingURL=talos-machine-config.d.ts.map

package/dist/talos/talos-machine-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"talos-machine-config.d.ts","sourceRoot":"","sources":["../../src/talos/talos-machine-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,EAAE,KAAK,UAAU,EAAoB,MAAM,0BAA0B,CAAC;AAC7E,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAI9D,YAAY,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,oGAAoG;IACpG,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,gDAAgD;IAChD,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;OAKG;IACH,SAAS,EAAE,WAAW,GAAG,UAAU,GAAG,KAAK,CAAC;CAC7C;AAED,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,kBAAkB,qDAAsD,CAAC;AAEtF;;;;GAIG;AAEH,4FAA4F;AAC5F,eAAO,MAAM,sBAAsB,UAC1B,kBAAkB,UACjB,uBAAuB,GAAG,SAAS,iBAC5B;IAAE,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;CAAE;;;;;qNAkDhF,CAAC;AAsBJ,eAAO,MAAM,0BAA0B,6JACwD,CAAC"}
+{"version":3,"file":"talos-machine-config.d.ts","sourceRoot":"","sources":["../../src/talos/talos-machine-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,EAAE,KAAK,UAAU,EAAoB,MAAM,0BAA0B,CAAC;AAC7E,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAI9D,YAAY,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,oGAAoG;IACpG,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,gDAAgD;IAChD,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;OAKG;IACH,SAAS,EAAE,WAAW,GAAG,UAAU,GAAG,KAAK,CAAC;CAC7C;AAED,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,kBAAkB,qDAAsD,CAAC;AAEtF;;;;GAIG;AAEH,4FAA4F;AAC5F,eAAO,MAAM,sBAAsB,UAC1B,kBAAkB,UACjB,uBAAuB,GAAG,SAAS,iBAC5B;IAAE,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;CAAE;;;;;4MAkDhF,CAAC;AAsBJ,eAAO,MAAM,0BAA0B,oJACwD,CAAC"}

package/dist/talos/talosctl.d.ts

@@ -11,7 +11,7 @@
  *   wild to include credential material; stderr is the safe diagnostic channel.
  */
 import * as Effect from 'effect/Effect';
-import * as ChildProcessSpawner from 'effect/unstable/process/ChildProcessSpawner';
+import * as ChildProcessSpawner from 'effect/process/ChildProcessSpawner';
 export declare class TalosError extends Error {
     readonly command: string;
     readonly exitCode: number;

package/dist/talos/talosctl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"talosctl.d.ts","sourceRoot":"","sources":["../../src/talos/talosctl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,mBAAmB,MAAM,6CAA6C,CAAC;AAEnF,qBAAa,UAAW,SAAQ,KAAK;IAEjC,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAF3B,YACW,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EACzB,MAAM,EAAE,MAAM,EAIf;CACF;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,QAAQ,SAAU,SAAS,MAAM,EAAE,WAAW,eAAe,8HA+CtE,CAAC;AAEL,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,SAAU,SAAS,MAAM,EAAE,WAAW,eAAe,iHAShF,CAAC"}
+{"version":3,"file":"talosctl.d.ts","sourceRoot":"","sources":["../../src/talos/talosctl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,mBAAmB,MAAM,oCAAoC,CAAC;AAE1E,qBAAa,UAAW,SAAQ,KAAK;IAEjC,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAF3B,YACW,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EACzB,MAAM,EAAE,MAAM,EAIf;CACF;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,QAAQ,SAAU,SAAS,MAAM,EAAE,WAAW,eAAe,8HA+CtE,CAAC;AAEL,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,SAAU,SAAS,MAAM,EAAE,WAAW,eAAe,iHAShF,CAAC"}

package/dist/telemetry/index.js

@@ -4,13 +4,13 @@ import * as Layer2 from "effect/Layer";
 import * as Logger from "effect/Logger";
 import * as LogLevel from "effect/LogLevel";
 import * as Tracer from "effect/Tracer";
-import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
-import { OtlpExporter, OtlpLogger, OtlpMetrics, OtlpTracer } from "effect/unstable/observability";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import { OtlpExporter, OtlpLogger, OtlpMetrics, OtlpTracer } from "effect/observability";
 
 // src/telemetry/redact-serialization.ts
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import { OtlpSerialization } from "effect/unstable/observability";
+import { OtlpSerialization } from "effect/observability";
 
 // src/telemetry/redact.ts
 var REDACTED = "<redacted>";
@@ -219,5 +219,5 @@ export {
   wrapTracer
 };
 
-//# debugId=D5C073A7ECCA33DE64756E2164756E21
+//# debugId=C3F43808EA1FDEEB64756E2164756E21
 //# sourceMappingURL=index.js.map