@homeflare/alchemy 0.47.0 → 0.48.0

package/README.md

@@ -2,18 +2,9 @@
 
 Custom [Alchemy](https://alchemy.run) providers for gaps the vendor SDK leaves.
 
-```sh
-bun add @homeflare/alchemy alchemy@2.0.0-beta.81 effect@4.0.1 \
-        @effect/platform-node@4.0.1 mime@4.1.0 \
-        @distilled.cloud/cloudflare@1.0.0-rc.13 @distilled.cloud/forgejo@1.0.0-rc.13 \
-        @distilled.cloud/discord@1.0.0-rc.13 @distilled.cloud/google-workspace@1.0.0-rc.13 \
-        @distilled.cloud/argocd@1.0.0-rc.13 \
-        @effect/sql-pg@4.0.1
-```
-
-⛔ **Every one of those is required, and you also need an `overrides` block** — see
-[Peers](#peers--and-one-override-you-need) below. The install succeeds without them and
-the import throws.
+⛔ **Every peer on the install line is required, and you also need an `overrides` block**
+— see [docs/peers.md](./docs/peers.md). The install succeeds without them and the import
+throws.
 
 ★ **Why a custom provider at all.** When Alchemy has no property for something, the
 alternative is a runbook step a human runs once — and a plan can never show a missing
@@ -390,26 +381,9 @@ subpath reads its credential, and why an empty one fails closed: [docs/credentia
 
 ## Peers — and one override you need
 
-⚠️ Peers, not dependencies: Alchemy's resource registry and Effect's context both break if
-two copies load in one process.
-
-⛔ **Add this to your `package.json`, or the install works and the import throws:**
-
-```json
-{
-  "overrides": {
-    "effect": "4.0.1",
-    "@effect/platform-node": "4.0.1",
-    "@effect/platform-node-shared": "4.0.1",
-    "@effect/platform-bun": "4.0.1",
-    "rolldown": "1.2.8",
-    "redis": "6.3.0"
-  }
-}
-```
-
-Why each peer is required and each pin exists — the measurements, and the error a missing one
-produces: [docs/peers.md](./docs/peers.md).
+The install command, the required `overrides` block, why each pin exists, and the
+`homeflare.consumer` machine-readable source of truth are all in
+[docs/peers.md](./docs/peers.md).
 
 ## License
 

package/dist/talos/bao-env.d.ts

@@ -0,0 +1,7 @@
+/**
+ * ⛔ THE CHILD GETS A MINIMAL ENV, NOT `process.env`: `PATH` to find `bao`, the vault address and
+ *   token, and the optional namespace / CA. `undefined` when BAO_ADDR or BAO_TOKEN is missing —
+ *   `bao` would then read a cached `~/.vault-token` login and act as whoever last logged in.
+ */
+export declare const baoEnv: () => Record<string, string> | undefined;
+//# sourceMappingURL=bao-env.d.ts.map

package/dist/talos/bao-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bao-env.d.ts","sourceRoot":"","sources":["../../src/talos/bao-env.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,MAAM,QAAO,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAUlD,CAAC"}

package/dist/talos/cluster-adapter-errors.d.ts

@@ -0,0 +1,134 @@
+declare const TalosOpenBaoUnknownCluster_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "TalosOpenBaoUnknownCluster";
+} & Readonly<A>;
+/** The connection's uid matches no adapter entry. Uids are public. */
+export declare class TalosOpenBaoUnknownCluster extends TalosOpenBaoUnknownCluster_base<{
+    readonly uid: string;
+    readonly known: readonly string[];
+}> {
+    get message(): string;
+}
+declare const TalosOpenBaoAmbiguousUid_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "TalosOpenBaoAmbiguousUid";
+} & Readonly<A>;
+/** Two adapter entries pin the same uid, so which vault key to read is ambiguous. */
+export declare class TalosOpenBaoAmbiguousUid extends TalosOpenBaoAmbiguousUid_base<{
+    readonly uid: string;
+    readonly aliases: readonly string[];
+}> {
+    get message(): string;
+}
+declare const TalosOpenBaoLegacyAuth_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "TalosOpenBaoLegacyAuth";
+} & Readonly<A>;
+/** The saved auth block still carries the alias an earlier build of this branch persisted. */
+export declare class TalosOpenBaoLegacyAuth extends TalosOpenBaoLegacyAuth_base<{
+    readonly _?: never;
+}> {
+    get message(): string;
+}
+declare const TalosClusterMoved_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "TalosClusterMoved";
+} & Readonly<A>;
+/** `Talos.ClusterIdentity` read a different uid than the one it published. Never an update. */
+export declare class TalosClusterMoved extends TalosClusterMoved_base<{
+    readonly cluster: string;
+    readonly saved: string;
+    readonly live: string;
+}> {
+    get message(): string;
+}
+declare const TalosVaultKeyMissing_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "TalosVaultKeyMissing";
+} & Readonly<A>;
+/** `bao kv get` reported the key unwritten. The message names `mount/key` and no document bytes. */
+export declare class TalosVaultKeyMissing extends TalosVaultKeyMissing_base<{
+    readonly mount: string;
+    readonly key: string;
+}> {
+    get message(): string;
+}
+declare const TalosKubeconfigUnreadable_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "TalosKubeconfigUnreadable";
+} & Readonly<A>;
+/** Vault bytes exist but are not a kubeconfig for the pinned context. The document is not echoed. */
+export declare class TalosKubeconfigUnreadable extends TalosKubeconfigUnreadable_base<{
+    readonly mount: string;
+    readonly key: string;
+    readonly context: string;
+}> {
+    get message(): string;
+}
+declare const TalosOpenBaoAuthKind_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "TalosOpenBaoAuthKind";
+} & Readonly<A>;
+/** The layer was asked to connect a different auth kind. */
+export declare class TalosOpenBaoAuthKind extends TalosOpenBaoAuthKind_base<{
+    readonly kind: string;
+}> {
+    get message(): string;
+}
+declare const TalosClusterIdentityMissing_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "TalosClusterIdentityMissing";
+} & Readonly<A>;
+/** The saved auth block carries no `uid`, so nothing says WHICH physical cluster it meant. */
+export declare class TalosClusterIdentityMissing extends TalosClusterIdentityMissing_base<{
+    readonly _?: never;
+}> {
+    get message(): string;
+}
+declare const TalosClusterIdentityMismatch_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "TalosClusterIdentityMismatch";
+} & Readonly<A>;
+/** The cluster that answered is not the one the saved auth block named. Uids are public. */
+export declare class TalosClusterIdentityMismatch extends TalosClusterIdentityMismatch_base<{
+    readonly cluster: string;
+    readonly expected: string;
+    readonly got: string;
+}> {
+    get message(): string;
+}
+declare const TalosClusterIdentityUnreadable_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "TalosClusterIdentityUnreadable";
+} & Readonly<A>;
+/** `GET /api/v1/namespaces/kube-system` answered without a usable `metadata.uid`. */
+export declare class TalosClusterIdentityUnreadable extends TalosClusterIdentityUnreadable_base<{
+    readonly cluster: string;
+}> {
+    get message(): string;
+}
+declare const TalosClusterIdentityTimeout_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "TalosClusterIdentityTimeout";
+} & Readonly<A>;
+/** The kube-system GET got no answer in time: a silent apiserver must not hang connect or plan. */
+export declare class TalosClusterIdentityTimeout extends TalosClusterIdentityTimeout_base<{
+    readonly cluster: string;
+    readonly seconds: number;
+}> {
+    get message(): string;
+}
+declare const TalosOpenBaoConnectTimeout_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "TalosOpenBaoConnectTimeout";
+} & Readonly<A>;
+/**
+ * The whole connect path (vault read, parse, kube-system uid read) did not finish in time. One
+ * deadline covers `bao` and the apiserver together: a hung `bao` or a silent apiserver must not
+ * hang connect or a plan. The `bao` child is killed when the deadline interrupts the read.
+ */
+export declare class TalosOpenBaoConnectTimeout extends TalosOpenBaoConnectTimeout_base<{
+    readonly cluster: string;
+    readonly seconds: number;
+}> {
+    get message(): string;
+}
+declare const TalosUidNotLiteral_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "TalosUidNotLiteral";
+} & Readonly<A>;
+/** A connection was built from a uid that is not a plain string known at plan time. */
+export declare class TalosUidNotLiteral extends TalosUidNotLiteral_base<{
+    readonly _?: never;
+}> {
+    get message(): string;
+}
+export {};
+//# sourceMappingURL=cluster-adapter-errors.d.ts.map

package/dist/talos/cluster-adapter-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cluster-adapter-errors.d.ts","sourceRoot":"","sources":["../../src/talos/cluster-adapter-errors.ts"],"names":[],"mappings":";;;AAMA,sEAAsE;AACtE,qBAAa,0BAA2B,SAAQ,gCAA+C;IAC7F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED,qFAAqF;AACrF,qBAAa,wBAAyB,SAAQ,8BAA6C;IACzF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,8FAA8F;AAC9F,qBAAa,sBAAuB,SAAQ,4BAA2C;IACrF,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;CACpB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAQ7B;CACF;;;;AAED,+FAA+F;AAC/F,qBAAa,iBAAkB,SAAQ,uBAAsC;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAQ7B;CACF;;;;AAED,oGAAoG;AACpG,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,qGAAqG;AACrG,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,4DAA4D;AAC5D,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,8FAA8F;AAC9F,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;CACpB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED,4FAA4F;AAC5F,qBAAa,4BAA6B,SAAQ,kCAAiD;IACjG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED,qFAAqF;AACrF,qBAAa,8BAA+B,SAAQ,oCAElD;IACA,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,mGAAmG;AACnG,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED;;;;GAIG;AACH,qBAAa,0BAA2B,SAAQ,gCAA+C;IAC7F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,uFAAuF;AACvF,qBAAa,kBAAmB,SAAQ,wBAAuC;IAC7E,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;CACpB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF"}

package/dist/talos/cluster-adapter.d.ts

@@ -0,0 +1,115 @@
+/**
+ * `Kubernetes.ClusterAdapter` kind `talos-openbao`.
+ *
+ * Reads `mount/key` from OpenBao at connect time (`credentials.ts`'s `readKvValue`, which
+ * shells to `bao` with BAO_ADDR/BAO_TOKEN) and returns a `ClusterTransport`.
+ * ⛔ NOTHING IS WRITTEN TO DISK. ⛔ THE PERSISTED CONNECTION IS `{ kind, uid }` ONLY.
+ *   alchemy `Kubernetes/Connection.ts` (v2.0.0-beta.79, lines 12-14) stores the Connection on
+ *   every workload's attributes, so the upstream `client-cert` kind would put the admin PEM in
+ *   the shared state store. The stock `kubeconfig` kind is also refused: an empty path falls
+ *   back to `$KUBECONFIG`.
+ * ⛔ mount/key/context LIVE IN THE ADAPTER'S CONFIGURATION, NOT IN THE AUTH BLOCK. Upstream
+ *   compares clusters by the auth block (`internal/workload.ts:91-96` `connectionIdentity`) and
+ *   HelmChart/Manifest answer `replace` when it changes (`HelmChart.ts:248-258`,
+ *   `Manifest.ts:194-209`); a replace creates first, then cleanup deletes the SAME-named objects.
+ *   Renaming a vault key would silently delete Cilium, External Secrets and Gatekeeper.
+ * ⛔ THE IDENTITY RULE: THE AUTH BLOCK NAMES THE PHYSICAL CLUSTER. `uid` is the kube-system
+ *   Namespace `metadata.uid` (public, stable across CA rotation). read/update/delete all
+ *   reconnect from the SAVED auth block (`Manifest.ts:214` and `:267`, `HelmChart.ts:322` and
+ *   `:335`, via `connectionOfOutput`, `internal/workload.ts:104-108`). A cluster NAME resolved
+ *   through today's MUTABLE config would let a repointed `c1` PATCH one cluster and DELETE on
+ *   another (reproduced through ManifestProvider). So the auth block carries the uid and NOTHING
+ *   else: the config entry is looked up BY uid (no probing walk), `connect` fails closed BEFORE
+ *   any vault read when the uid is absent or the row is legacy (`auth.cluster`), then GETs
+ *   kube-system and compares before returning a transport. Missing, unreadable, unknown or
+ *   different uid is a typed error — never `ClusterNotFoundError` (except a `retired` entry's
+ *   absent key), which upstream turns into a silent no-op. Cost: one extra GET per connect.
+ * ⛔ BOOTSTRAP-THEN-PIN. A brand-new cluster has no uid until it exists, and an Output uid is
+ *   forbidden (`talosOpenBaoConnection`). So: (1) the first deploy creates the cluster and
+ *   `Talos.ClusterIdentity` (which reads and outputs the uid) with NO workloads; (2) the operator
+ *   pins that printed uid literal in this adapter's config; (3) workloads deploy afterwards with
+ *   `talosOpenBaoConnection(<that literal>)`. A uid that is not pinned is refused at connect.
+ * ⚠️ A REAL MOVE IS NOT AN AUTOMATIC REPLACE. `Talos.ClusterIdentity` refuses a changed uid
+ *   (`TalosClusterMoved`); a move is a NEW identity resource per physical cluster, so the old
+ *   rows keep their old uid and their cleanup reaches only the old cluster.
+ * ⛔ ONE 10 s DEADLINE covers the vault read AND the uid GET (`withConnectDeadline`): a hung `bao`
+ *   or silent apiserver fails with `TalosOpenBaoConnectTimeout` and the `bao` child is killed.
+ *   ⚠️ The in-flight HTTPS GET is NOT aborted: upstream `readObject` takes no signal
+ *   (`internal/client.ts:75`), so the socket lives until the OS gives up. Left for the upstream ask.
+ *
+ * USAGE RULES (upstream behaviour this adapter cannot fix; full text in
+ * `docs/talos-openbao-adapter.md`):
+ *   1. Move a workload to another cluster ONLY by new logical IDs (destroy + create), never by
+ *      changing its connection in place.
+ *   2. Manage namespaces as separate `Manifest`s, never HelmChart `createNamespace`.
+ *   3. Never rename a HelmChart `releaseName` in place.
+ *
+ * Walked against alchemy 2.0.0-beta.79 `ClusterAdapter.ts` / `BuiltinAdapters.ts` and the OpenBao
+ * v2.6.2 absence string in `isVaultKeyAbsent`. Fake `bao` and fake apiserver only.
+ */
+import { type ClusterAdapterService, ClusterNotFoundError, type ClusterTransport } from 'alchemy/Kubernetes/ClusterAdapter';
+import type { Connection } from 'alchemy/Kubernetes/Connection';
+import type * as Duration from 'effect/Duration';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import type * as ChildProcessSpawner from 'effect/process/ChildProcessSpawner';
+import { type TalosClusterIdentityMismatch, TalosClusterIdentityMissing, type TalosClusterIdentityTimeout, type TalosClusterIdentityUnreadable, type TalosKubeconfigUnreadable, TalosOpenBaoAmbiguousUid, TalosOpenBaoAuthKind, type TalosOpenBaoConnectTimeout, TalosOpenBaoLegacyAuth, TalosOpenBaoUnknownCluster, type TalosVaultKeyMissing } from './cluster-adapter-errors.ts';
+import { type TalosOpenBaoCluster } from './cluster-transport.ts';
+export { TalosClusterIdentityMismatch, TalosClusterIdentityMissing, TalosClusterIdentityTimeout, TalosClusterIdentityUnreadable, TalosClusterMoved, TalosKubeconfigUnreadable, TalosOpenBaoAmbiguousUid, TalosOpenBaoAuthKind, TalosOpenBaoConnectTimeout, TalosOpenBaoLegacyAuth, TalosOpenBaoUnknownCluster, TalosUidNotLiteral, TalosVaultKeyMissing, } from './cluster-adapter-errors.ts';
+export { type TalosOpenBaoCluster, talosOpenBaoCluster } from './cluster-transport.ts';
+declare module 'alchemy/Kubernetes/Connection' {
+    interface AuthRegistry {
+        /**
+         * Admin kubeconfig in OpenBao KV, read when a workload connects. Contributed by
+         * {@link TalosOpenBaoAdapter}, which holds the mount, key and context.
+         */
+        'talos-openbao': {
+            /**
+             * The cluster's kube-system `metadata.uid`: the ONLY identity, a LITERAL string known at
+             * plan time (never an Output, see {@link talosOpenBaoConnection}). A row saved before it
+             * existed has none at runtime and is refused at connect.
+             */
+            uid: string;
+        };
+    }
+}
+/**
+ * ⛔ KEYED BY ALIAS, BUT THE ALIAS IS NEVER PERSISTED OR LOOKED UP BY. `connect` finds the entry
+ *   whose pinned `uid` equals the saved auth block's, so renaming an alias changes nothing upstream
+ *   hashes. Unknown uid is {@link TalosOpenBaoUnknownCluster}: refused, not another cluster's key.
+ */
+export type TalosOpenBaoConfig = Readonly<Record<string, TalosOpenBaoCluster>>;
+/** A `Connection` narrowed to this kind, so a PEM-bearing connection cannot be stored by type. */
+export type TalosOpenBaoConnection = Connection & {
+    readonly auth: {
+        readonly kind: 'talos-openbao';
+        readonly uid: string;
+    };
+};
+/**
+ * Serializable connection: kind and uid. No alias, vault path, endpoint, CA or cert.
+ * ⛔ THE UID MUST BE A LITERAL. An Output (a resource attribute such as `Talos.ClusterIdentity`'s)
+ *   is unresolved at plan time, so `isResolved(news)` is false, upstream plans an UPDATE (Plan.ts)
+ *   and reconcile replays the OLD cluster's `previousObjects` as deletes on the NEW cluster
+ *   (reproduced: DELETE on B). Take the uid from the pinned adapter entry: a changed literal is a
+ *   changed auth block, which upstream answers with `replace`. Anything else throws
+ *   {@link TalosUidNotLiteral} while the stack is being declared.
+ */
+export declare const talosOpenBaoConnection: (uid: string) => TalosOpenBaoConnection;
+/**
+ * Resolve one `talos-openbao` connection to a transport. Requires `ChildProcessSpawner`
+ * because the vault read shells to `bao`, and reaches the apiserver once for the identity check.
+ *
+ * ⚠️ A key the vault reports absent is `ClusterNotFoundError` ONLY for a cluster configured
+ *   `retired: true` (upstream `read`/`delete` treat that as "everything in-cluster is already
+ *   gone", so tearing down a destroyed cluster is not stuck). Otherwise it is the typed
+ *   `TalosVaultKeyMissing`. Neither message names document bytes.
+ */
+export declare const connectTalosOpenBao: (configs: TalosOpenBaoConfig, connection: Connection, timeout?: Duration.Duration) => Effect.Effect<ClusterTransport, TalosOpenBaoAuthKind | TalosOpenBaoUnknownCluster | TalosOpenBaoAmbiguousUid | TalosOpenBaoLegacyAuth | TalosClusterIdentityMissing | TalosClusterIdentityMismatch | TalosClusterIdentityUnreadable | TalosClusterIdentityTimeout | TalosOpenBaoConnectTimeout | TalosVaultKeyMissing | ClusterNotFoundError | TalosKubeconfigUnreadable | Error, ChildProcessSpawner.ChildProcessSpawner>;
+/**
+ * Register kind `talos-openbao`. Merge with `Kubernetes.providers()`:
+ * `Layer.mergeAll(Kubernetes.providers(), TalosOpenBaoAdapter({ c1: talosOpenBaoCluster(kc1) }))`
+ * where `kc1` is the props object handed to `Talos.Kubeconfig`.
+ */
+export declare const TalosOpenBaoAdapter: (config: TalosOpenBaoConfig) => Layer.Layer<ClusterAdapterService, never, ChildProcessSpawner.ChildProcessSpawner>;
+//# sourceMappingURL=cluster-adapter.d.ts.map

package/dist/talos/cluster-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cluster-adapter.d.ts","sourceRoot":"","sources":["../../src/talos/cluster-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,EAEL,KAAK,qBAAqB,EAC1B,oBAAoB,EACpB,KAAK,gBAAgB,EACtB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,KAAK,mBAAmB,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EACL,KAAK,4BAA4B,EACjC,2BAA2B,EAC3B,KAAK,2BAA2B,EAChC,KAAK,8BAA8B,EACnC,KAAK,yBAAyB,EAC9B,wBAAwB,EACxB,oBAAoB,EACpB,KAAK,0BAA0B,EAC/B,sBAAsB,EACtB,0BAA0B,EAE1B,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAEL,KAAK,mBAAmB,EAGzB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC3B,2BAA2B,EAC3B,8BAA8B,EAC9B,iBAAiB,EACjB,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,KAAK,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEvF,OAAO,QAAQ,+BAA+B,CAAC;IAC7C,UAAU,YAAY;QACpB;;;WAGG;QACH,eAAe,EAAE;YACf;;;;eAIG;YACH,GAAG,EAAE,MAAM,CAAC;SACb,CAAC;KACH;CACF;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAE/E,kGAAkG;AAClG,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG;IAChD,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CACzE,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,QAAS,MAAM,KAAG,sBAGpD,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,YACrB,kBAAkB,cACf,UAAU,YACb,QAAQ,CAAC,QAAQ,KACzB,MAAM,CAAC,MAAM,CACd,gBAAgB,EACd,oBAAoB,GACpB,0BAA0B,GAC1B,wBAAwB,GACxB,sBAAsB,GACtB,2BAA2B,GAC3B,4BAA4B,GAC5B,8BAA8B,GAC9B,2BAA2B,GAC3B,0BAA0B,GAC1B,oBAAoB,GACpB,oBAAoB,GACpB,yBAAyB,GACzB,KAAK,EACP,mBAAmB,CAAC,mBAAmB,CAyDrC,CAAC;AAEL;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,WACtB,kBAAkB,KACzB,KAAK,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,EAAE,mBAAmB,CAAC,mBAAmB,CAYjF,CAAC"}

package/dist/talos/cluster-identity.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Which PHYSICAL cluster answers — the kube-system Namespace's `metadata.uid`.
+ *
+ * ★ WHY THE UID. It is public, assigned once at cluster creation and stable across CA and
+ *   admin-cert rotation (a CA fingerprint is not: rotation would read as "a different cluster").
+ *   Every cluster has the namespace, and the admin kubeconfig can read it.
+ * ★ The GET goes through alchemy's own `readObject` (`Kubernetes/internal/client.ts`, reached
+ *   through the package's `./*` export) so TLS, CA and client-cert handling stay upstream's.
+ */
+import type { ClusterTransport } from 'alchemy/Kubernetes/ClusterAdapter';
+import * as Duration from 'effect/Duration';
+import * as Effect from 'effect/Effect';
+import { TalosClusterIdentityMismatch, TalosClusterIdentityTimeout, TalosClusterIdentityUnreadable } from './cluster-adapter-errors.ts';
+/**
+ * ⛔ upstream `readObject` (`internal/client.ts`) sets no request timeout, so a silent apiserver
+ *   would hang connect and every plan. Bounded here; the failure is typed and closed.
+ * ⛔ SHORTER THAN `CONNECT_TIMEOUT` (10 s, cluster-transport.ts): the outer deadline wraps the vault
+ *   read AND this uid GET together, so an equal inner deadline could never fire first and
+ *   `TalosClusterIdentityTimeout` was unreachable through `connectTalosOpenBao` (red team, PR 355).
+ *   A silent apiserver now fails with the identity timeout while a slow `bao` still gets the full
+ *   outer budget.
+ */
+export declare const UID_READ_TIMEOUT: Duration.Duration;
+/** The cluster's kube-system uid. Request failures propagate: nothing here fails open. */
+export declare const readClusterUid: (cluster: string, transport: ClusterTransport, timeout?: Duration.Duration) => Effect.Effect<string, Error | import("alchemy/Kubernetes/internal/client").KubernetesApiError | TalosClusterIdentityTimeout | TalosClusterIdentityUnreadable, never>;
+/** Succeeds only when the answering cluster is the one `expected` names. */
+export declare const assertClusterUid: (cluster: string, expected: string, transport: ClusterTransport) => Effect.Effect<void, Error | import("alchemy/Kubernetes/internal/client").KubernetesApiError | TalosClusterIdentityMismatch | TalosClusterIdentityTimeout | TalosClusterIdentityUnreadable, never>;
+//# sourceMappingURL=cluster-identity.d.ts.map

package/dist/talos/cluster-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cluster-identity.d.ts","sourceRoot":"","sources":["../../src/talos/cluster-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAE1E,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC3B,8BAA8B,EAC/B,MAAM,6BAA6B,CAAC;AAIrC;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,mBAAsB,CAAC;AAEpD,0FAA0F;AAC1F,eAAO,MAAM,cAAc,YAChB,MAAM,aACJ,gBAAgB,YAClB,QAAQ,CAAC,QAAQ,yKAgBzB,CAAC;AAEJ,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB,YAAa,MAAM,YAAY,MAAM,aAAa,gBAAgB,sMAO5F,CAAC"}

package/dist/talos/cluster-transport.d.ts

@@ -0,0 +1,64 @@
+import * as Duration from 'effect/Duration';
+import * as Effect from 'effect/Effect';
+import { TalosKubeconfigUnreadable, TalosOpenBaoConnectTimeout, TalosVaultKeyMissing } from './cluster-adapter-errors.ts';
+import type { KubeconfigProps } from './kubeconfig.ts';
+/** Where one cluster's admin kubeconfig lives in the vault. Configuration; never persisted. */
+export type TalosVaultLocation = {
+    /** OpenBao KV mount, e.g. `talos-c1`. */
+    readonly mount: string;
+    /** Path under the mount. `Talos.Kubeconfig` writes `kubeconfig` unless `kubeconfigKey` is set. */
+    readonly key: string;
+    /** Context name inside the kubeconfig. Not secret. */
+    readonly context: string;
+};
+/**
+ * One adapter entry: a vault location PINNED to the physical cluster it must answer as.
+ * ⛔ `uid` is the kube-system `metadata.uid`. The persisted auth block carries only this, and
+ *   connect looks the entry up BY it, so renaming the alias, vault key, mount or context changes
+ *   nothing upstream hashes (`internal/workload.ts:91-96` `connectionIdentity`). Connect still
+ *   proves the answering cluster has this uid before it returns a transport.
+ */
+export type TalosOpenBaoCluster = TalosVaultLocation & {
+    readonly uid: string;
+    /**
+     * ⛔ ONLY `true` MAKES THIS UID MEAN "THE CLUSTER IS GONE": connect answers `ClusterNotFoundError`
+     *   (upstream read/delete treat it as "everything in-cluster is already gone") WITHOUT a vault
+     *   read, so destroying a dead cluster's rows completes. Otherwise an absent key is the loud
+     *   `TalosVaultKeyMissing`: a typo in mount/key must not make `destroy` a silent no-op.
+     */
+    readonly retired?: boolean;
+};
+/**
+ * ★ ONE SOURCE OF TRUTH FOR mount/key/context: build the location from the SAME props the
+ *   `Talos.Kubeconfig` resource writes with (`target.mount`, `kubeconfigKey`, `context`), so the
+ *   writer and the reader cannot disagree.
+ */
+export declare const talosVaultLocation: (props: Pick<KubeconfigProps, 'context' | 'kubeconfigKey' | 'target'>) => TalosVaultLocation;
+/** An adapter entry: {@link talosVaultLocation} plus the uid it is pinned to. */
+export declare const talosOpenBaoCluster: (props: Pick<KubeconfigProps, 'context' | 'kubeconfigKey' | 'target'>, pin: {
+    readonly uid: string;
+    readonly retired?: boolean;
+}) => TalosOpenBaoCluster;
+/**
+ * ⛔ ONE DEADLINE FOR THE WHOLE CONNECT PATH. `bao kv get` has no timeout of its own, and the
+ *   uid GET's bound (`cluster-identity.ts`) only starts after the vault read returns, so a hung
+ *   `bao` hung connect and every plan. Interrupting the effect closes the spawn scope, which
+ *   signals the child's process group (`NodeChildProcessSpawner` `terminateProcessGroup`).
+ */
+export declare const CONNECT_TIMEOUT: Duration.Duration;
+export declare const withConnectDeadline: <A, E, R>(cluster: string, effect: Effect.Effect<A, E, R>, timeout?: Duration.Duration) => Effect.Effect<A, E | TalosOpenBaoConnectTimeout, R>;
+/**
+ * Vault read and parse, in memory. ⛔ No identity check here: callers decide what to trust.
+ * ⚠️ Only a document that does not parse is `TalosKubeconfigUnreadable`; a parser or runtime
+ *   failure (a missing global, a broken import) is a defect and propagates as one.
+ */
+export declare const openTransport: (config: TalosVaultLocation) => Effect.Effect<{
+    endpoint: string;
+    certificateAuthorityData?: string;
+    clientCert?: {
+        certificate: string;
+        key: string;
+    };
+    headers: Effect.Effect<{}, never, never>;
+}, Error | TalosKubeconfigUnreadable | TalosVaultKeyMissing, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
+//# sourceMappingURL=cluster-transport.d.ts.map

package/dist/talos/cluster-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cluster-transport.d.ts","sourceRoot":"","sources":["../../src/talos/cluster-transport.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,oBAAoB,EACrB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,+FAA+F;AAC/F,MAAM,MAAM,kBAAkB,GAAG;IAC/B,yCAAyC;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kGAAkG;IAClG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG,kBAAkB,GAAG;IACrD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,UACtB,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,eAAe,GAAG,QAAQ,CAAC,KACnE,kBAID,CAAC;AAEH,iFAAiF;AACjF,eAAO,MAAM,mBAAmB,UACvB,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,eAAe,GAAG,QAAQ,CAAC,OAC/D;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,KACxD,mBAID,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,eAAe,mBAAuB,CAAC;AAEpD,eAAO,MAAM,mBAAmB,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,WAChC,MAAM,UACP,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,YACrB,QAAQ,CAAC,QAAQ,wDAUzB,CAAC;AAEJ;;;;GAIG;AACH,eAAO,MAAM,aAAa,WAAY,kBAAkB;;;;;;;;8HAapD,CAAC"}

package/dist/talos/credentials-write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials-write.d.ts","sourceRoot":"","sources":["../../src/talos/credentials-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAC;AAG3C,OAAO,KAAK,mBAAmB,MAAM,oCAAoC,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,UACpB,MAAM,KACZ,MAAM,CAAC,MAAM,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAS1D,CAAC;AAEL;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,YAAY,UAChB,MAAM,OACR,MAAM,SACJ,MAAM,SACN,MAAM,KACZ,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAC,mBAAmB,CAgCjE,CAAC"}
+{"version":3,"file":"credentials-write.d.ts","sourceRoot":"","sources":["../../src/talos/credentials-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAC;AAQ3C,OAAO,KAAK,mBAAmB,MAAM,oCAAoC,CAAC;AAI1E;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,UACpB,MAAM,KACZ,MAAM,CAAC,MAAM,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAS1D,CAAC;AAEL;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,YAAY,UAChB,MAAM,OACR,MAAM,SACJ,MAAM,SACN,MAAM,KACZ,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAC,mBAAmB,CA+CjE,CAAC"}

package/dist/talos/credentials.d.ts

@@ -1,6 +1,7 @@
 import * as Effect from 'effect/Effect';
 import type * as Scope from 'effect/Scope';
 import * as ChildProcessSpawner from 'effect/process/ChildProcessSpawner';
+export { mintKvTempFile } from './mint-temp-file.ts';
 /** Where credentials come from. HomeFlare-specific mount names live in the stack, not here. */
 export type TalosTarget = {
     /** OpenBao KV mount holding Talos material, e.g. `talos-c1`. */
@@ -35,22 +36,12 @@ export declare const DEFAULT_KUBECONFIG_KEY = "kubeconfig";
  */
 export declare const readKvValue: (mount: string, key: string, fields: readonly string[]) => Effect.Effect<string, Error, ChildProcessSpawner.ChildProcessSpawner>;
 /**
- * Write `raw` to a session-temp, 0600, exclusively-created file whose lifetime is the CALLER's
- * `Effect.scoped`, not this call's. See the ⛔ C1 FIX note at the top of this file.
- *
- * ⛔ 0600, CREATED EXCLUSIVELY, AND `Bun.write` CANNOT DO EITHER. This file can hold a cluster
- *   admin client certificate or a machine config's bootstrap token. `Bun.write` takes no mode, so
- *   it lands at the process umask — world-readable on this estate — for as long as the resource
- *   runs. The name is unguessable, and "unguessable" is not a permission.
- * ⚠️ `wx` IS THE OTHER HALF. `O_EXCL` means this cannot be made to write through a path an
- *   attacker pre-created (the classic /tmp symlink race), and with a UUIDv7 name a collision is a
- *   genuine error rather than something to paper over.
- * ⚠️ A HARD KILL (SIGKILL, power loss) skips the finalizer and leaves the file behind. 0600 is
- *   what makes that survivable rather than a disclosure.
+ * ★ MEASURED AGAINST OPENBAO v2.6.2 (C1 fix, LAND red team, 2026-09-26 — isolated in-memory
+ *   dev server): `bao kv get` on an unwritten KV-v2 key exits 2 with stderr exactly
+ *   `No value found at <mount>/data/<key>`. `readKvValue`'s Error embeds that text. It is the
+ *   only signal treated as "not written yet"; a permission denial or a transport failure is not.
  */
-export declare const mintKvTempFile: (raw: string, label: string) => Effect.Effect<{
-    readonly path: string;
-}, Error, Scope.Scope>;
+export declare const isVaultKeyAbsent: (error: unknown) => boolean;
 /**
  * Mint one talosconfig file for `target`.
  *
@@ -61,10 +52,10 @@ export declare const mintKvTempFile: (raw: string, label: string) => Effect.Effe
 export declare const mintTalosconfig: (target: TalosTarget) => Effect.Effect<TalosCredential, Error, ChildProcessSpawner.ChildProcessSpawner | Scope.Scope>;
 /**
  * Mint one temp kubeconfig file from the vault copy `Talos.Kubeconfig` writes at bring-up
- * (K-talos-first-boot, 2026-09-26) — the consumer-side counterpart to {@link mintTalosconfig},
- * named as the future seam for `Kubernetes.ClusterAdapter` in
- * docs/plans/2026-09-26-talos-secrets-flow.md ("consumers mint it the way the talosconfig is
- * minted"). Not yet wired to that adapter — this only makes the read+materialize step exist.
+ * (K-talos-first-boot, 2026-09-26) — the file-shaped counterpart to {@link mintTalosconfig}.
+ * `Kubernetes.ClusterAdapter` `talos-openbao` does not use it: connect reads the bytes with
+ * {@link readKvValue} and keeps them in memory. This remains for a caller that must hand a
+ * path to a process.
  */
 export declare const mintKubeconfig: (target: TalosTarget, key?: string) => Effect.Effect<{
     readonly path: string;

package/dist/talos/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/talos/credentials.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAC;AAG3C,OAAO,KAAK,mBAAmB,MAAM,oCAAoC,CAAC;AAE1E,+FAA+F;AAC/F,MAAM,MAAM,WAAW,GAAG;IACxB,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,CAAC;AAIF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,eAAe,CAAC;AAEnD;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,UACf,MAAM,OACR,MAAM,UACH,SAAS,MAAM,EAAE,KACxB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,mBAAmB,CAAC,mBAAmB,CAgDnE,CAAC;AAEL;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,QACpB,MAAM,SACJ,MAAM,KACZ,MAAM,CAAC,MAAM,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAqB1D,CAAC;AAEL;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,WAClB,WAAW,KAClB,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,mBAAmB,CAAC,mBAAmB,GAAG,KAAK,CAAC,KAAK,CAO3F,CAAC;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,WACjB,WAAW,mBAElB,MAAM,CAAC,MAAM,CACd;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACzB,KAAK,EACL,mBAAmB,CAAC,mBAAmB,GAAG,KAAK,CAAC,KAAK,CAIpD,CAAC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/talos/credentials.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAC;AAG3C,OAAO,KAAK,mBAAmB,MAAM,oCAAoC,CAAC;AAK1E,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,+FAA+F;AAC/F,MAAM,MAAM,WAAW,GAAG;IACxB,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,CAAC;AAIF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,eAAe,CAAC;AAEnD;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,UACf,MAAM,OACR,MAAM,UACH,SAAS,MAAM,EAAE,KACxB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,mBAAmB,CAAC,mBAAmB,CAgFnE,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,UAAW,OAAO,KAAG,OACkB,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,WAClB,WAAW,KAClB,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,mBAAmB,CAAC,mBAAmB,GAAG,KAAK,CAAC,KAAK,CAO3F,CAAC;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,WACjB,WAAW,mBAElB,MAAM,CAAC,MAAM,CACd;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACzB,KAAK,EACL,mBAAmB,CAAC,mBAAmB,GAAG,KAAK,CAAC,KAAK,CAIpD,CAAC"}

package/dist/talos/fake-apiserver.d.ts

@@ -0,0 +1,9 @@
+/**
+ * `uids` maps an apiserver hostname to the kube-system uid it reports; `hang` lists hostnames that
+ * accept the request and never answer.
+ */
+export declare const fakeApiServer: (uids: Readonly<Record<string, string>>, hang?: readonly string[]) => {
+    restore: () => void | Promise<void>;
+    seen: string[];
+};
+//# sourceMappingURL=fake-apiserver.d.ts.map

package/dist/talos/fake-apiserver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-apiserver.d.ts","sourceRoot":"","sources":["../../src/talos/fake-apiserver.ts"],"names":[],"mappings":"AAkBA;;;GAGG;AACH,eAAO,MAAM,aAAa,SAClB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,SAChC,SAAS,MAAM,EAAE;;;CA8BxB,CAAC"}

package/dist/talos/index.d.ts

@@ -18,13 +18,20 @@
  *   (talos-bootstrap.ts's own header) and kubeconfig landing in OpenBao, written once at bring-up
  *   (kubeconfig.ts's own header) — plus `Talos.ClusterHealth`'s error handling no longer conflates a
  *   vault/transport failure with "cluster not healthy yet" (talos-cluster-health.ts's own header).
+ * ★ `talos-openbao` (K-A5) is how `Kubernetes.*` reaches the cluster: `TalosOpenBaoAdapter`,
+ *   `talosOpenBaoConnection(<pinned uid literal>)` (or `cluster: health`) as the persisted
+ *   `{ kind, uid }` connection — `Talos.Kubeconfig` and `Talos.ClusterIdentity` persist none — and
+ *   `HF_TALOSCTL` to pin the talosctl binary.
  * ★ Anything unlisted is still reachable by path if you genuinely need it — that is a
  *   deliberate, visible act rather than an accident of barrelling.
  */
+export { TalosClusterIdentityMismatch, TalosClusterIdentityMissing, TalosClusterIdentityTimeout, TalosClusterIdentityUnreadable, TalosClusterMoved, TalosKubeconfigUnreadable, TalosOpenBaoAdapter, TalosOpenBaoAmbiguousUid, TalosOpenBaoLegacyAuth, TalosOpenBaoAuthKind, TalosOpenBaoConnectTimeout, type TalosOpenBaoCluster, type TalosOpenBaoConfig, TalosOpenBaoUnknownCluster, TalosUidNotLiteral, TalosVaultKeyMissing, connectTalosOpenBao, talosOpenBaoCluster, talosOpenBaoConnection, } from './cluster-adapter.ts';
 export type { TalosCredential, TalosTarget } from './credentials.ts';
 export { type KubeconfigAttributes, type KubeconfigProps, TalosKubeconfig, TalosKubeconfigProvider, } from './kubeconfig.ts';
 export type { ApplyMode, WithTarget } from './resource.ts';
 export { type BootstrapAttributes, type BootstrapProps, TalosBootstrap, TalosBootstrapProvider, } from './talos-bootstrap.ts';
+export { type ClusterIdentityAttributes, type ClusterIdentityProps, TalosClusterIdentity, TalosClusterIdentityProvider, } from './talos-cluster-identity.ts';
 export { type ClusterHealthAttributes, type ClusterHealthProps, TalosClusterHealth, TalosClusterHealthProvider, } from './talos-cluster-health.ts';
 export { type MachineConfigAttributes, type MachineConfigProps, TalosMachineConfig, TalosMachineConfigProvider, } from './talos-machine-config.ts';
+export { DEFAULT_TALOSCTL_BINARY, TALOSCTL_BINARY_ENV } from './talosctl.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/talos/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/talos/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,eAAe,EACf,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,cAAc,EACd,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/talos/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC3B,2BAA2B,EAC3B,8BAA8B,EAC9B,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,eAAe,EACf,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,cAAc,EACd,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC"}