@homeflare/alchemy 0.47.0 → 0.48.0

package/dist/talos/kubeconfig-attrs.d.ts

@@ -1,3 +1,17 @@
+/**
+ * `Talos.Kubeconfig`'s attribute builder — split out of kubeconfig.ts (LAND, 2026-09-26, C1/I2
+ * fixes) once fixing those findings pushed the file over the 250-line cap. Only `import type`
+ * comes back from kubeconfig.ts, so there is no runtime cycle.
+ *
+ * ⛔ NO `connection` HERE. A connection names the PHYSICAL cluster (`{ kind, uid }`,
+ *   cluster-adapter.ts's identity rule) and the uid is only knowable from the cluster, which does
+ *   not exist yet when this resource writes the vault key. Workloads get their connection from the
+ *   operator's pinned literal (`talosOpenBaoConnection(uid)`) or `Talos.ClusterHealth`'s
+ *   pass-through; `Talos.ClusterIdentity` publishes `{ uid }` only; a name-only connection
+ *   (`cluster` present) is refused by the adapter as legacy. Neither the
+ *   stock `kubeconfig` kind (an absent path falls back to `$KUBECONFIG`) nor `client-cert` (PEM on
+ *   every workload's attributes, `Connection.ts` v2.0.0-beta.79 lines 12-14) is ever used.
+ */
 import type { KubeconfigAttributes, KubeconfigProps } from './kubeconfig.ts';
 /** Parse `raw` kubeconfig YAML into public, persistable attributes, or `undefined` if it fails to. */
 export declare const buildAttrs: (raw: string, props: KubeconfigProps) => KubeconfigAttributes | undefined;

package/dist/talos/kubeconfig-attrs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kubeconfig-attrs.d.ts","sourceRoot":"","sources":["../../src/talos/kubeconfig-attrs.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AA+B7E,sGAAsG;AACtG,eAAO,MAAM,UAAU,QAChB,MAAM,SACJ,eAAe,KACrB,oBAAoB,GAAG,SAWzB,CAAC"}
+{"version":3,"file":"kubeconfig-attrs.d.ts","sourceRoot":"","sources":["../../src/talos/kubeconfig-attrs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAU7E,sGAAsG;AACtG,eAAO,MAAM,UAAU,QAChB,MAAM,SACJ,eAAe,KACrB,oBAAoB,GAAG,SAUzB,CAAC"}

package/dist/talos/kubeconfig-doc.d.ts

@@ -0,0 +1,23 @@
+/**
+ * In-memory kubeconfig parse for `talos-openbao` connect.
+ *
+ * ⛔ THE RESULT HOLDS PEM. Callers may put it on a `ClusterTransport` for one request.
+ *   They must not persist it, log it, or copy it onto a `Connection`. Alchemy stores
+ *   connection attributes in plaintext (`credentials.ts`'s own header).
+ * ★ YAML IS `yaml-parse.ts` (runtime-neutral: Bun.YAML does not exist under Node, where the
+ *   published dist runs). Nothing here touches a filesystem or OpenBao — the caller has already
+ *   read the bytes.
+ *
+ * Walked against alchemy 2.0.0-beta.79 `Kubernetes/internal/client.ts`: `certificateAuthorityData`
+ * stays base64 (the client decodes it) and `clientCert` is PEM. The document shape is the one
+ * `values.ts` parses from the Talos v1.13 kubeconfig reference. Not measured on a live cluster.
+ */
+import type { ClusterTransport } from 'alchemy/Kubernetes/ClusterAdapter';
+export type KubeconfigMaterial = Pick<ClusterTransport, 'certificateAuthorityData' | 'clientCert' | 'endpoint'>;
+/**
+ * Resolve `contextName` to endpoint, base64 CA, and PEM client cert/key.
+ * `undefined` for any shape that is not that context's admin kubeconfig — the caller
+ * fails closed without embedding the document in the error.
+ */
+export declare const kubeconfigTransport: (yamlText: string, contextName: string) => KubeconfigMaterial | undefined;
+//# sourceMappingURL=kubeconfig-doc.d.ts.map

package/dist/talos/kubeconfig-doc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubeconfig-doc.d.ts","sourceRoot":"","sources":["../../src/talos/kubeconfig-doc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAe1E,MAAM,MAAM,kBAAkB,GAAG,IAAI,CACnC,gBAAgB,EAChB,0BAA0B,GAAG,YAAY,GAAG,UAAU,CACvD,CAAC;AASF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,aACpB,MAAM,eACH,MAAM,KAClB,kBAAkB,GAAG,SAwBvB,CAAC"}

package/dist/talos/kubeconfig.d.ts

@@ -1,6 +1,5 @@
 import { Resource } from 'alchemy';
 import type { Input } from 'alchemy/Input';
-import type { Connection } from 'alchemy/Kubernetes/Connection';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
 import type { TalosRequirements, WithTarget } from './resource.ts';
@@ -20,17 +19,6 @@ export interface KubeconfigAttributes {
     clientCertificateFingerprint: string;
     /** Digest of endpoint+context+fingerprints — detects credential rotation without storing PEM. */
     credentialGeneration: string;
-    /**
-     * Serializable `Kubernetes.Connection` for downstream workloads.
-     *
-     * ★ auth.kind `kubeconfig` is the stock ClusterAdapter — provider-roadmap.md names this seam.
-     *   `path` is a sentinel that can never resolve (LAND red team I2, `kubeconfig-attrs.ts`'s own
-     *   `toConnection` header): the content lives in OpenBao, not at a fixed host path, and a real
-     *   `Kubernetes.ClusterAdapter` wiring is later work, so this must fail rather than silently
-     *   reach the operator's own kubeconfig. A consumer materializes its own scoped temp file via
-     *   `credentials.ts`'s `mintKubeconfig` in the meantime.
-     */
-    connection: Connection;
 }
 export interface TalosKubeconfig extends Resource<'Talos.Kubeconfig', KubeconfigProps, KubeconfigAttributes, never, TalosRequirements> {
 }

package/dist/talos/kubeconfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kubeconfig.d.ts","sourceRoot":"","sources":["../../src/talos/kubeconfig.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGnE,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,+BAA+B,EAAE,MAAM,CAAC;IACxC,4BAA4B,EAAE,MAAM,CAAC;IACrC,iGAAiG;IACjG,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;OASG;IACH,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,eAAgB,SAAQ,QAAQ,CAC/C,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,eAAe,kDAAgD,CAAC;AAmB7E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,UAAW,eAAe,6HAgBjD,CAAC;AAEL,eAAO,MAAM,cAAc,SACnB,KAAK,CAAC,eAAe,CAAC,UACpB,oBAAoB,GAAG,SAAS;qBAWnB,MAAM;;qBAER,QAAQ;uFACzB,CAAC;AAEL;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,UACvB,eAAe,UACd,oBAAoB,GAAG,SAAS,gKA2DvC,CAAC;AAsBJ,eAAO,MAAM,uBAAuB,iJACqD,CAAC"}
+{"version":3,"file":"kubeconfig.d.ts","sourceRoot":"","sources":["../../src/talos/kubeconfig.ts"],"names":[],"mappings":"AAiCA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AASxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGnE,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,+BAA+B,EAAE,MAAM,CAAC;IACxC,4BAA4B,EAAE,MAAM,CAAC;IACrC,iGAAiG;IACjG,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,eAAgB,SAAQ,QAAQ,CAC/C,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,eAAe,kDAAgD,CAAC;AAQ7E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,UAAW,eAAe,6HAgBjD,CAAC;AAEL,eAAO,MAAM,cAAc,SACnB,KAAK,CAAC,eAAe,CAAC,UACpB,oBAAoB,GAAG,SAAS;qBAenB,MAAM;;qBAER,QAAQ;uFACzB,CAAC;AAEL;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,UACvB,eAAe,UACd,oBAAoB,GAAG,SAAS,gKA2DvC,CAAC;AAsBJ,eAAO,MAAM,uBAAuB,iJACqD,CAAC"}

package/dist/talos/literal-connection.d.ts

@@ -0,0 +1,16 @@
+import { TalosUidNotLiteral } from './cluster-adapter-errors.ts';
+/**
+ * The typed refusal unless `connection` is `{ auth: { kind, uid: literal } }`, else `undefined`.
+ * ★ A value, never a throw: a throw inside `Effect.gen` would become a defect, not a failure.
+ */
+export declare const literalConnectionRefusal: (connection: unknown) => TalosUidNotLiteral | undefined;
+/**
+ * ⛔ THE `diff` GUARD ALONE IS NOT ENOUGH (round-4 review): alchemy skips `diff` for a FRESH
+ *   resource whose inputs are unresolved, and reconcile then copies the resolved string downstream
+ *   — an Output uid slips through on exactly the first deploy. So the same refusal runs when the
+ *   resource is DECLARED, before any input resolution, by wrapping its constructor.
+ * ★ A Proxy over the class (not a new function) keeps `.Provider`, `.Self`, `.ref` and the type.
+ *   Plain props fail the declaring Effect; a props Effect fails once it yields.
+ */
+export declare const withLiteralConnection: <C extends (...args: never[]) => unknown>(resource: C) => C;
+//# sourceMappingURL=literal-connection.d.ts.map

package/dist/talos/literal-connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"literal-connection.d.ts","sourceRoot":"","sources":["../../src/talos/literal-connection.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEjE;;;GAGG;AACH,eAAO,MAAM,wBAAwB,eAAgB,OAAO,KAAG,kBAAkB,GAAG,SAYnF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,GAAI,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,YAAY,CAAC,KAAG,CAkBzF,CAAC"}

package/dist/talos/machine-config-read.d.ts

@@ -13,7 +13,7 @@ import type { MachineConfigAttributes, MachineConfigProps } from './talos-machin
  *   talosconfig context's own endpoints, which may be a control-plane VIP that only comes up AFTER
  *   bootstrap; every pre-bootstrap call in this file targets the node directly instead.
  */
-export declare const liveSpecDigest: (props: MachineConfigProps, talosconfigPath: string) => Effect.Effect<string, Error | import("effect/PlatformError").PlatformError | import("./talosctl.ts").TalosError, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
+export declare const liveSpecDigest: (props: MachineConfigProps, talosconfigPath: string) => Effect.Effect<string, Error | import("effect/PlatformError").PlatformError | import("./talosctl-binary.ts").TalosBinaryRefused | import("./talosctl.ts").TalosError, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
 /**
  * ⛔ NO SWALLOWING. A transport failure here propagates as its own error (TalosError or the
  *   shape error above) — never as `converged: false`. A false only means "read succeeded, and

package/dist/talos/machine-config-read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"machine-config-read.d.ts","sourceRoot":"","sources":["../../src/talos/machine-config-read.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAI7F;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,UAAW,kBAAkB,mBAAmB,MAAM,uLAiB9E,CAAC;AAuBJ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,iBAAiB,UAAW,kBAAkB;;;;;sIAiBxD,CAAC;AAEJ,eAAO,MAAM,iBAAiB,SACtB,KAAK,CAAC,kBAAkB,CAAC,UACvB,uBAAuB,GAAG,SAAS;qBAK4B,MAAM;;qBAC1D,QAAQ;sIACzB,CAAC"}
+{"version":3,"file":"machine-config-read.d.ts","sourceRoot":"","sources":["../../src/talos/machine-config-read.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAI7F;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,UAAW,kBAAkB,mBAAmB,MAAM,2OAiB9E,CAAC;AAuBJ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,iBAAiB,UAAW,kBAAkB;;;;;sIAiBxD,CAAC;AAEJ,eAAO,MAAM,iBAAiB,SACtB,KAAK,CAAC,kBAAkB,CAAC,UACvB,uBAAuB,GAAG,SAAS;qBAK4B,MAAM;;qBAC1D,QAAQ;sIACzB,CAAC"}

package/dist/talos/mint-temp-file.d.ts

@@ -0,0 +1,20 @@
+import * as Effect from 'effect/Effect';
+import type * as Scope from 'effect/Scope';
+/**
+ * Write `raw` to a session-temp, 0600, exclusively-created file whose lifetime is the CALLER's
+ * `Effect.scoped`, not this call's. See the ⛔ C1 FIX note at the top of credentials.ts.
+ *
+ * ⛔ 0600, CREATED EXCLUSIVELY, AND `Bun.write` CANNOT DO EITHER. This file can hold a cluster
+ *   admin client certificate or a machine config's bootstrap token. `Bun.write` takes no mode, so
+ *   it lands at the process umask — world-readable on this estate — for as long as the resource
+ *   runs. The name is unguessable, and "unguessable" is not a permission.
+ * ⚠️ `wx` IS THE OTHER HALF. `O_EXCL` means this cannot be made to write through a path an
+ *   attacker pre-created (the classic /tmp symlink race), and with a UUID name a collision is a
+ *   genuine error rather than something to paper over.
+ * ⚠️ A HARD KILL (SIGKILL, power loss) skips the finalizer and leaves the file behind. 0600 is
+ *   what makes that survivable rather than a disclosure.
+ */
+export declare const mintKvTempFile: (raw: string, label: string) => Effect.Effect<{
+    readonly path: string;
+}, Error, Scope.Scope>;
+//# sourceMappingURL=mint-temp-file.d.ts.map

package/dist/talos/mint-temp-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mint-temp-file.d.ts","sourceRoot":"","sources":["../../src/talos/mint-temp-file.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAC;AAE3C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,QACpB,MAAM,SACJ,MAAM,KACZ,MAAM,CAAC,MAAM,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAyB1D,CAAC"}

package/dist/talos/node-temp.harness.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=node-temp.harness.d.ts.map

package/dist/talos/node-temp.harness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-temp.harness.d.ts","sourceRoot":"","sources":["../../src/talos/node-temp.harness.ts"],"names":[],"mappings":""}

package/dist/talos/talos-bootstrap-etcd.d.ts

@@ -15,7 +15,7 @@ import { TalosReBootstrapRefused } from './talos-errors.ts';
  *   failure here means (talos-bootstrap.ts's `read`/`reconcile`, and `assertNoLivePeers` below), so
  *   it is not decided here.
  */
-export declare const isBootstrapped: (props: BootstrapProps, talosconfigPath: string) => Effect.Effect<boolean, import("effect/PlatformError").PlatformError | import("./talosctl.ts").TalosError, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
+export declare const isBootstrapped: (props: BootstrapProps, talosconfigPath: string) => Effect.Effect<boolean, import("effect/PlatformError").PlatformError | import("./talosctl-binary.ts").TalosBinaryRefused | import("./talosctl.ts").TalosError, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
 /**
  * ⛔ I4 FIX (LAND red team, 2026-09-26) — THE CREATE PATH ONLY CHECKED THIS NODE. If the state row
  *   is lost (wrong `--stage`, an FQN rename, a wiped state store) while the cluster already lives on

package/dist/talos/talos-bootstrap-etcd.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"talos-bootstrap-etcd.d.ts","sourceRoot":"","sources":["../../src/talos/talos-bootstrap-etcd.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAG5D;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,UAAW,cAAc,mBAAmB,MAAM,gLAIM,CAAC;AAEpF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iBAAiB,UAAW,cAAc,mBAAmB,MAAM,mHA2B7E,CAAC"}
+{"version":3,"file":"talos-bootstrap-etcd.d.ts","sourceRoot":"","sources":["../../src/talos/talos-bootstrap-etcd.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAG5D;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,UAAW,cAAc,mBAAmB,MAAM,oOAIM,CAAC;AAEpF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iBAAiB,UAAW,cAAc,mBAAmB,MAAM,mHA2B7E,CAAC"}

package/dist/talos/talos-cluster-health.d.ts

@@ -22,11 +22,16 @@
  *   rollout would never learn the real problem was vault. Both `read` and `reconcile` now only
  *   catch `TalosError` (`talosctl health` itself ran and exited non-zero — the one case this
  *   family may honestly call "not healthy"); anything else propagates untouched.
+ * ★ `connection` IS A PASS-THROUGH so this resource is `ClusterLike`. Later rows take
+ *   `cluster: health`. The health check itself still uses `target` and `talosctl`; the field is
+ *   copied onto attributes and is not a credential. It is required: an optional field would not
+ *   satisfy `{ connection: Connection }`.
  */
 import { Resource } from 'alchemy';
 import type { Input } from 'alchemy/Input';
 import * as Provider from 'alchemy/Provider';
 import * as Effect from 'effect/Effect';
+import type { TalosOpenBaoConnection } from './cluster-adapter.ts';
 import type { TalosRequirements, WithTarget } from './resource.ts';
 export interface ClusterHealthProps extends WithTarget {
     /** Control-plane node IPs passed to `--control-plane-nodes`. */
@@ -45,34 +50,29 @@ export interface ClusterHealthProps extends WithTarget {
      * on kube-proxy and CoreDNS, both of which wait on a CNI that does not exist yet at bootstrap.
      */
     after?: readonly unknown[];
+    /**
+     * Kubernetes connection copied onto attributes so a later row can take `cluster: this`.
+     * Not read by the health check. Persist only a secret-free connection (`talos-openbao`).
+     */
+    connection: TalosOpenBaoConnection;
 }
 export interface ClusterHealthAttributes {
     healthy: boolean;
     controlPlaneNodes: string;
     workerNodes: string;
+    /** Same object as the prop. Makes these attributes `ClusterLike`. */
+    connection: TalosOpenBaoConnection;
 }
 export interface TalosClusterHealth extends Resource<'Talos.ClusterHealth', ClusterHealthProps, ClusterHealthAttributes, never, TalosRequirements> {
 }
 export declare const TalosClusterHealth: import("alchemy").ResourceClass<TalosClusterHealth>;
 /** ★ EXPORTED for talos-cluster-health.test.ts — see talos-bootstrap.ts's own note on the pattern. */
-export declare const readClusterHealth: (props: ClusterHealthProps) => Effect.Effect<{
-    controlPlaneNodes: string;
-    healthy: boolean;
-    workerNodes: string;
-} | {
-    controlPlaneNodes: string;
-    healthy: boolean;
-    workerNodes: string;
-}, Error | import("effect/PlatformError").PlatformError, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
+export declare const readClusterHealth: (props: ClusterHealthProps) => Effect.Effect<ClusterHealthAttributes, Error | import("effect/PlatformError").PlatformError, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
 export declare const diffClusterHealth: (news: Input<ClusterHealthProps>, output: ClusterHealthAttributes | undefined) => Effect.Effect<{
     readonly action: 'noop';
 } | {
     readonly action: 'update';
-} | undefined, Error | import("effect/PlatformError").PlatformError, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
-export declare const reconcileClusterHealth: (props: ClusterHealthProps) => Effect.Effect<{
-    controlPlaneNodes: string;
-    healthy: boolean;
-    workerNodes: string;
-}, Error | import("effect/PlatformError").PlatformError, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
+} | undefined, Error | import("effect/PlatformError").PlatformError | import("./cluster-adapter-errors.ts").TalosUidNotLiteral, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
+export declare const reconcileClusterHealth: (props: ClusterHealthProps) => Effect.Effect<ClusterHealthAttributes, Error | import("effect/PlatformError").PlatformError, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
 export declare const TalosClusterHealthProvider: () => import("effect/Layer").Layer<Provider.Provider<TalosClusterHealth>, never, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
 //# sourceMappingURL=talos-cluster-health.d.ts.map

package/dist/talos/talos-cluster-health.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"talos-cluster-health.d.ts","sourceRoot":"","sources":["../../src/talos/talos-cluster-health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGnE,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,gEAAgE;IAChE,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,kDAAkD;IAClD,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,kBAAkB,qDAAsD,CAAC;AAgEtF,sGAAsG;AACtG,eAAO,MAAM,iBAAiB,UAAW,kBAAkB;;;;;;;;0HASxD,CAAC;AAEJ,eAAO,MAAM,iBAAiB,SACtB,KAAK,CAAC,kBAAkB,CAAC,UACvB,uBAAuB,GAAG,SAAS;qBAKN,MAAM;;qBACxB,QAAQ;sIACzB,CAAC;AAEL,eAAO,MAAM,sBAAsB,UAAW,kBAAkB;;;;0HAU7D,CAAC;AAgBJ,eAAO,MAAM,0BAA0B,oJACwD,CAAC"}
+{"version":3,"file":"talos-cluster-health.d.ts","sourceRoot":"","sources":["../../src/talos/talos-cluster-health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAGnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGnE,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,gEAAgE;IAChE,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,kDAAkD;IAClD,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC3B;;;OAGG;IACH,UAAU,EAAE,sBAAsB,CAAC;CACpC;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,UAAU,EAAE,sBAAsB,CAAC;CACpC;AAED,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAGJ,eAAO,MAAM,kBAAkB,qDAE9B,CAAC;AAgFF,sGAAsG;AACtG,eAAO,MAAM,iBAAiB,UAAW,kBAAkB,mKAGxD,CAAC;AAEJ,eAAO,MAAM,iBAAiB,SACtB,KAAK,CAAC,kBAAkB,CAAC,UACvB,uBAAuB,GAAG,SAAS;qBAUtB,MAAM;;qBAER,QAAQ;iMACzB,CAAC;AAEL,eAAO,MAAM,sBAAsB,UAAW,kBAAkB,mKAU7D,CAAC;AAgBJ,eAAO,MAAM,0BAA0B,oJACwD,CAAC"}

package/dist/talos/talos-cluster-identity.d.ts

@@ -0,0 +1,65 @@
+/**
+ * `Talos.ClusterIdentity` — a read-only resource that reports WHICH physical cluster a name means.
+ *
+ * ★ It reads the vault kubeconfig and GETs the kube-system Namespace once (`cluster-identity.ts`),
+ *   and publishes `{ uid }`. That is the BOOTSTRAP-THEN-PIN step (cluster-adapter.ts header): the
+ *   first deploy creates the cluster and this row with no workloads, the operator copies the
+ *   printed uid into the adapter config, and workloads take `talosOpenBaoConnection(<literal>)`.
+ *   ⛔ It publishes NO `connection`: an Output uid in a workload's auth is unresolved at plan time
+ *   and hides a cluster change from the plan (`talosOpenBaoConnection` explains the DELETE on B).
+ * ⛔ DRIFT REPAIR CANNOT LAUNDER A MOVE: `read` receives the persisted output and compares it, so
+ *   `Drift.repair` fails with `TalosClusterMoved` instead of reconciling B against B.
+ * ⛔ IT MUTATES NOTHING: no vault write, no cluster write, `delete` is a no-op. Its only effect is
+ *   the value it reports. `after` must reach past Cilium/CNI only if the apiserver needs it; the
+ *   kube-system namespace exists as soon as the apiserver answers.
+ * ⛔ A CHANGED UID IS REFUSED, NEVER AN UPDATE (`TalosClusterMoved`, in diff AND reconcile). This
+ *   resource declares no `stables`, so downstream the engine sees an unresolved Output, every
+ *   workload `diff` returns undefined and the engine plans an UPDATE, not a replace (Plan.ts
+ *   resourceExpr, `isResolved(news)` in Manifest.ts and HelmChart.ts). Reconcile would then
+ *   connect with the NEW uid and force-apply onto the new cluster while the old cluster's objects
+ *   are orphaned (an earlier comment here claimed a replace and a refusal at cleanup: it cannot
+ *   happen). A real move is a NEW identity resource per physical cluster.
+ */
+import { Resource } from 'alchemy';
+import type { Input } from 'alchemy/Input';
+import * as Provider from 'alchemy/Provider';
+import * as Effect from 'effect/Effect';
+import { TalosClusterMoved } from './cluster-adapter-errors.ts';
+import type { KubeconfigProps } from './kubeconfig.ts';
+import type { TalosRequirements } from './resource.ts';
+type KubeconfigSource = Pick<KubeconfigProps, 'context' | 'kubeconfigKey' | 'target'>;
+export interface ClusterIdentityProps extends KubeconfigSource {
+    /** Ordering edge: after `Talos.Kubeconfig` (the vault key must exist) and the apiserver is up. */
+    after?: readonly unknown[];
+}
+export interface ClusterIdentityAttributes {
+    /**
+     * The cluster's kube-system `metadata.uid`. Public. ⛔ NOT A `connection`: these attributes are
+     * deliberately not `ClusterLike`. Pin this value as a literal in `TalosOpenBaoAdapter` and build
+     * workloads' connection from that literal (bootstrap-then-pin, cluster-adapter.ts header).
+     */
+    uid: string;
+}
+export interface TalosClusterIdentity extends Resource<'Talos.ClusterIdentity', ClusterIdentityProps, ClusterIdentityAttributes, never, TalosRequirements> {
+}
+export declare const TalosClusterIdentity: import("alchemy").ResourceClass<TalosClusterIdentity>;
+/**
+ * ★ EXPORTED for talos-cluster-identity.test.ts — see talos-bootstrap.ts's note on the pattern.
+ * ⛔ A PERSISTED OUTPUT IS COMPARED HERE TOO, not only in reconcile: `Drift.repair` hands `read`
+ *   the persisted attributes, then reconciles `news: old.props, output: <what read returned>`.
+ *   A read that ignored the output returned the NEW uid, so the reconcile guard compared B with B
+ *   and saved it. Failing in read stops that path with `TalosClusterMoved`.
+ */
+export declare const readClusterIdentity: (props: ClusterIdentityProps, output?: ClusterIdentityAttributes) => Effect.Effect<{
+    uid: string;
+}, Error | import("alchemy/Kubernetes/internal/client").KubernetesApiError | import("./cluster-adapter-errors.ts").TalosClusterIdentityTimeout | import("./cluster-adapter-errors.ts").TalosClusterIdentityUnreadable | TalosClusterMoved | import("./cluster-adapter-errors.ts").TalosKubeconfigUnreadable | import("./cluster-adapter-errors.ts").TalosOpenBaoConnectTimeout | import("./cluster-adapter-errors.ts").TalosVaultKeyMissing, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
+/** ⛔ Fails closed when a saved uid exists and the live one differs. See the header. */
+export declare const reconcileClusterIdentity: (props: ClusterIdentityProps, output: ClusterIdentityAttributes | undefined) => Effect.Effect<{
+    uid: string;
+}, Error | import("alchemy/Kubernetes/internal/client").KubernetesApiError | import("./cluster-adapter-errors.ts").TalosClusterIdentityTimeout | import("./cluster-adapter-errors.ts").TalosClusterIdentityUnreadable | TalosClusterMoved | import("./cluster-adapter-errors.ts").TalosKubeconfigUnreadable | import("./cluster-adapter-errors.ts").TalosOpenBaoConnectTimeout | import("./cluster-adapter-errors.ts").TalosVaultKeyMissing, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
+export declare const diffClusterIdentity: (news: Input<ClusterIdentityProps>, output: ClusterIdentityAttributes | undefined) => Effect.Effect<{
+    readonly action: 'noop';
+} | undefined, Error | import("alchemy/Kubernetes/internal/client").KubernetesApiError | import("./cluster-adapter-errors.ts").TalosClusterIdentityTimeout | import("./cluster-adapter-errors.ts").TalosClusterIdentityUnreadable | TalosClusterMoved | import("./cluster-adapter-errors.ts").TalosKubeconfigUnreadable | import("./cluster-adapter-errors.ts").TalosOpenBaoConnectTimeout | import("./cluster-adapter-errors.ts").TalosVaultKeyMissing, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
+export declare const TalosClusterIdentityProvider: () => import("effect/Layer").Layer<Provider.Provider<TalosClusterIdentity>, never, import("effect/process/ChildProcessSpawner").ChildProcessSpawner>;
+export {};
+//# sourceMappingURL=talos-cluster-identity.d.ts.map

package/dist/talos/talos-cluster-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"talos-cluster-identity.d.ts","sourceRoot":"","sources":["../../src/talos/talos-cluster-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD,KAAK,gBAAgB,GAAG,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,eAAe,GAAG,QAAQ,CAAC,CAAC;AAEtF,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;IAC5D,kGAAkG;IAClG,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,oBAAqB,SAAQ,QAAQ,CACpD,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,oBAAoB,uDAA0D,CAAC;AAE5F;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,UACvB,oBAAoB,WAClB,yBAAyB;;8eAgBhC,CAAC;AAEL,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,UAC5B,oBAAoB,UACnB,yBAAyB,GAAG,SAAS;;8eACR,CAAC;AAExC,eAAO,MAAM,mBAAmB,SACxB,KAAK,CAAC,oBAAoB,CAAC,UACzB,yBAAyB,GAAG,SAAS;qBAK1B,MAAM;0fACvB,CAAC;AA4BL,eAAO,MAAM,4BAA4B,sJAC0D,CAAC"}

package/dist/talos/talosctl-binary.d.ts

@@ -0,0 +1,43 @@
+import * as Effect from 'effect/Effect';
+/** `talosctl` on `PATH`. A lane pins another build with {@link TALOSCTL_BINARY_ENV} or `binary`. */
+export declare const DEFAULT_TALOSCTL_BINARY = "talosctl";
+/**
+ * Executable override, read at call time. The Mac PATH measured 2026-10-05 has v1.13.8; the
+ * cluster is v1.14.2. Set this to the v1.14.2 binary. A per-call `binary` option wins.
+ */
+export declare const TALOSCTL_BINARY_ENV = "HF_TALOSCTL";
+/** `bao` on `PATH` — the OpenBao CLI that fetches the cluster credentials at connect time. */
+export declare const DEFAULT_BAO_BINARY = "bao";
+/** `bao` executable override, read at call time and vetted exactly like {@link TALOSCTL_BINARY_ENV}. */
+export declare const BAO_BINARY_ENV = "HF_BAO";
+export declare class TalosBinaryRefused extends Error {
+    readonly command: string;
+    readonly binary: string;
+    constructor(command: string, detail: string, binary?: string);
+}
+/**
+ * ⛔ THE DEFAULT IS VETTED TOO (hunt round 5): a bare `talosctl` is resolved against `PATH` here
+ *   (not `Bun.which` — the published dist runs on Node, where that global is missing), symlinks are
+ *   followed, and the REAL file is vetted, version-checked and executed by absolute path.
+ */
+export declare const resolveDefault: (binary: string) => Effect.Effect<string, TalosBinaryRefused, never>;
+/**
+ * ⛔ THE BINARY GETS THE VAULT-MINTED TALOSCONFIG: absolute, owned, not writable, executable, trusted
+ *   path. ⛔ RETURNS THE CANONICAL PATH (round 7): the override's directory is resolved ONCE
+ *   (realpath), that path and every ancestor of it are vetted, and the caller must launch exactly
+ *   the returned path for the version probe AND the credential-bearing call. Vetting the given path
+ *   and executing it again let a symlinked ancestor be repointed between the two launches. The leaf
+ *   itself is still lstat'd, so a symlink leaf is refused rather than followed.
+ */
+export declare const checkBinaryPath: (binary: string, source: string) => Effect.Effect<string, TalosBinaryRefused, never>;
+/**
+ * Resolve and vet the `bao` binary: {@link BAO_BINARY_ENV} wins over `bao` on `PATH`, and either is
+ * checked exactly like talosctl (absolute, owned, not writable, executable, not a symlink, every
+ * ancestor trusted). Returns the canonical path to launch.
+ *
+ * ⛔ `bao` FETCHES THE CLUSTER CREDENTIALS (`readKvValue` / `writeKvValue`), so an un-vetted `bao`
+ *   on a group/world-writable PATH folder (umask 002, the round-10 incident) could answer with an
+ *   attacker's kubeconfig. The same walk that vets `talosctl` must gate every `bao` launch.
+ */
+export declare const resolveBao: () => Effect.Effect<string, TalosBinaryRefused>;
+//# sourceMappingURL=talosctl-binary.d.ts.map

package/dist/talos/talosctl-binary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"talosctl-binary.d.ts","sourceRoot":"","sources":["../../src/talos/talosctl-binary.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,oGAAoG;AACpG,eAAO,MAAM,uBAAuB,aAAa,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,gBAAgB,CAAC;AAEjD,8FAA8F;AAC9F,eAAO,MAAM,kBAAkB,QAAQ,CAAC;AAExC,wGAAwG;AACxG,eAAO,MAAM,cAAc,WAAW,CAAC;AAEvC,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,SAA0B,EAK5E;CACF;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,WAAY,MAAM,qDAgBzC,CAAC;AA6BL;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,WAAY,MAAM,UAAU,MAAM,qDAgC7D,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,QAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAOrE,CAAC"}

package/dist/talos/talosctl.d.ts

@@ -1,24 +1,21 @@
-/**
- * One `talosctl` invocation — stdout/stderr captured, secrets never echoed.
- *
- * ★ SHELL OUT LIKE ALCHEMY'S DOCKER PROVIDER (ChildProcessSpawner), NOT A SECOND SDK. Talos speaks
- *   gRPC; the published, stable surface for operators is `talosctl`. No Talos npm package is added.
- *
- * ⚠️ REASONED FROM docs.siderolabs.com/talos/v1.13/reference/cli — nothing here was measured on a
- *   live cluster in this session.
- *
- * ⛔ DO NOT LOG STDOUT ON FAILURE. `talosctl kubeconfig` and error paths have been observed in the
- *   wild to include credential material; stderr is the safe diagnostic channel.
- */
 import * as Effect from 'effect/Effect';
 import * as ChildProcessSpawner from 'effect/process/ChildProcessSpawner';
+import { DEFAULT_TALOSCTL_BINARY, TALOSCTL_BINARY_ENV, TalosBinaryRefused } from './talosctl-binary.ts';
+export { DEFAULT_TALOSCTL_BINARY, TALOSCTL_BINARY_ENV, TalosBinaryRefused };
 export declare class TalosError extends Error {
     readonly command: string;
     readonly exitCode: number;
-    constructor(command: string, exitCode: number, detail: string);
+    constructor(command: string, exitCode: number, detail: string, binary?: string);
 }
+/** The Talos client version this family is written against (`--client` of the pinned binary). */
+export declare const TALOSCTL_PINNED_VERSION = "v1.14.2";
 export type TalosRunOptions = {
     readonly talosconfigPath: string;
+    /**
+     * `talosctl` executable. Wins over {@link TALOSCTL_BINARY_ENV}.
+     * @default `talosctl` on `PATH`, or `HF_TALOSCTL` when that variable is set.
+     */
+    readonly binary?: string;
     readonly nodes?: readonly string[];
     readonly endpoints?: readonly string[];
     /**
@@ -30,7 +27,7 @@ export type TalosRunOptions = {
     readonly insecure?: boolean;
 };
 /** Run `talosctl <args…>`. Returns trimmed stdout, or '' when empty. */
-export declare const talosctl: (args: readonly string[], options: TalosRunOptions) => Effect.Effect<string, import("effect/PlatformError").PlatformError | TalosError, ChildProcessSpawner.ChildProcessSpawner>;
+export declare const talosctl: (args: readonly string[], options: TalosRunOptions) => Effect.Effect<string, import("effect/PlatformError").PlatformError | TalosBinaryRefused | TalosError, ChildProcessSpawner.ChildProcessSpawner>;
 /** Like `talosctl`, but exit code 1 with "already" in stderr is treated as success. */
-export declare const talosctlOrAlready: (args: readonly string[], options: TalosRunOptions) => Effect.Effect<string, import("effect/PlatformError").PlatformError, ChildProcessSpawner.ChildProcessSpawner>;
+export declare const talosctlOrAlready: (args: readonly string[], options: TalosRunOptions) => Effect.Effect<string, import("effect/PlatformError").PlatformError | TalosBinaryRefused, ChildProcessSpawner.ChildProcessSpawner>;
 //# sourceMappingURL=talosctl.d.ts.map

package/dist/talos/talosctl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"talosctl.d.ts","sourceRoot":"","sources":["../../src/talos/talosctl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,mBAAmB,MAAM,oCAAoC,CAAC;AAE1E,qBAAa,UAAW,SAAQ,KAAK;IAEjC,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAF3B,YACW,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EACzB,MAAM,EAAE,MAAM,EAIf;CACF;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,QAAQ,SAAU,SAAS,MAAM,EAAE,WAAW,eAAe,8HA+CtE,CAAC;AAEL,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,SAAU,SAAS,MAAM,EAAE,WAAW,eAAe,iHAShF,CAAC"}
+{"version":3,"file":"talosctl.d.ts","sourceRoot":"","sources":["../../src/talos/talosctl.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,KAAK,mBAAmB,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAGnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,CAAC;AAE5E,qBAAa,UAAW,SAAQ,KAAK;IAEjC,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAF3B,YACW,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EACzB,MAAM,EAAE,MAAM,EACd,MAAM,SAA0B,EAIjC;CACF;AAED,iGAAiG;AACjG,eAAO,MAAM,uBAAuB,YAAY,CAAC;AAwBjD,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AA8DF,wEAAwE;AACxE,eAAO,MAAM,QAAQ,SAAU,SAAS,MAAM,EAAE,WAAW,eAAe,mJAgCtE,CAAC;AAEL,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,SAAU,SAAS,MAAM,EAAE,WAAW,eAAe,sIAShF,CAAC"}

package/dist/talos/trust-boundary.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Canonical compare: the walk hands over a real path, but the boundary is a security decision —
+ * resolving again makes it independent of what a caller (now or future) cached. ⛔ A directory
+ * that cannot be resolved is answered FALSE, never thrown: it is certainly not a registered
+ * boundary, and the walk must treat "no boundary" as "vet everything" (fail closed).
+ */
+export declare const isTrustedBoundary: (dir: string) => boolean;
+//# sourceMappingURL=trust-boundary.d.ts.map

package/dist/talos/trust-boundary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-boundary.d.ts","sourceRoot":"","sources":["../../src/talos/trust-boundary.ts"],"names":[],"mappings":"AAoBA;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,QAAS,MAAM,KAAG,OAM/C,CAAC"}

package/dist/talos/values.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../../src/talos/values.ts"],"names":[],"mappings":"AASA,2EAA2E;AAC3E,eAAO,MAAM,aAAa,SAAU,MAAM,WAAmB,CAAC;AAE9D,iGAAiG;AACjG,eAAO,MAAM,MAAM,SAAU,MAAM,WAC6B,CAAC;AAEjE,oFAAoF;AACpF,eAAO,MAAM,YAAY,SAAU,MAAM,WAAiB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,wBAAwB,gBAAiB,MAAM,KAAG,MAAM,GAAG,SAcvE,CAAC;AAeF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,aACnB,MAAM,eACH,MAAM,KAClB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,GAAG,SAyB3E,CAAC"}
+{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../../src/talos/values.ts"],"names":[],"mappings":"AAUA,2EAA2E;AAC3E,eAAO,MAAM,aAAa,SAAU,MAAM,WAAmB,CAAC;AAE9D,iGAAiG;AACjG,eAAO,MAAM,MAAM,SAAU,MAAM,WAC6B,CAAC;AAEjE,oFAAoF;AACpF,eAAO,MAAM,YAAY,SAAU,MAAM,WAAiB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,wBAAwB,gBAAiB,MAAM,KAAG,MAAM,GAAG,SASvE,CAAC;AAeF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,aACnB,MAAM,eACH,MAAM,KAClB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,GAAG,SAsB3E,CAAC"}

package/dist/talos/yaml-parse.d.ts

@@ -0,0 +1,3 @@
+/** Parse one YAML document, or `undefined` when the text is not valid YAML. */
+export declare const parseYaml: (text: string) => unknown;
+//# sourceMappingURL=yaml-parse.d.ts.map

package/dist/talos/yaml-parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yaml-parse.d.ts","sourceRoot":"","sources":["../../src/talos/yaml-parse.ts"],"names":[],"mappings":"AAcA,+EAA+E;AAC/E,eAAO,MAAM,SAAS,SAAU,MAAM,KAAG,OAYxC,CAAC"}

package/dist/verify/fake-engine.d.ts

@@ -67,6 +67,8 @@ export interface FakeEngine {
      * `verify.ts`'s `readWithState`, which already wraps that same call in `Effect.catchCause`.
      */
     readonly drift: (body: Body) => Promise<Record<string, DriftRow>>;
+    /** `alchemy drift --repair` (`Alchemy.Drift.repair`): read, then reconcile what drifted. */
+    readonly repair: (body: Body) => Promise<Record<string, DriftRow>>;
     /**
      * Every state row the store holds, as JSON — what a Postgres store would persist. ★ For tests
      * that must prove a value NEVER reaches state (proxmox/pbs-notification-target-state.test.ts).

package/dist/verify/fake-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-engine.d.ts","sourceRoot":"","sources":["../../src/verify/fake-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAKnC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,aAAa,EAAiB,MAAM,aAAa,CAAC;AAElF,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AACD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,KAAM,SAAQ,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,CAAC;CAAG;AAC7F,eAAO,MAAM,KAAK,8BAAwC,CAAC;AAE3D,4EAA4E;AAC5E,MAAM,WAAW,KAAM,SAAQ,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,CAAC;CAAG;AAC7F,eAAO,MAAM,KAAK,8BAAwC,CAAC;AAE3D;;;;GAIG;AACH,MAAM,WAAW,QAAS,SAAQ,OAAO,CAAC,QAAQ,CAAC,eAAe,EAAE,UAAU,EAAE,eAAe,CAAC;CAAG;AACnG,eAAO,MAAM,QAAQ,iCAA8C,CAAC;AAEpE,gGAAgG;AAChG,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,eAAO,MAAM,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAQ,KAI1D,CAAC;AAEH,8CAA8C;AAC9C,eAAO,MAAM,QAAQ,UAAW,KAAK,KAAG,MAAM,EAC2C,CAAC;AAyB1F,4FAA4F;AAC5F,eAAO,MAAM,cAAc,UAAW,KAAK,8GAmCxC,CAAC;AAEJ,oFAAoF;AACpF,MAAM,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAK5D,gGAAgG;AAChG,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,MAAM,WAAW,UAAU;IACzB,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/E;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAClE;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,eAAO,MAAM,UAAU,GAAI,IAAI,EAAE,CAAC,EAAE,GAAG,SAC9B,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,YACvB;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,KACpC,UAmDF,CAAC;AAEF,oCAAoC;AACpC,eAAO,MAAM,UAAU,UAAW,KAAK,KAAG,UAA+C,CAAC"}
+{"version":3,"file":"fake-engine.d.ts","sourceRoot":"","sources":["../../src/verify/fake-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAKnC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,aAAa,EAAiB,MAAM,aAAa,CAAC;AAElF,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AACD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,KAAM,SAAQ,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,CAAC;CAAG;AAC7F,eAAO,MAAM,KAAK,8BAAwC,CAAC;AAE3D,4EAA4E;AAC5E,MAAM,WAAW,KAAM,SAAQ,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,CAAC;CAAG;AAC7F,eAAO,MAAM,KAAK,8BAAwC,CAAC;AAE3D;;;;GAIG;AACH,MAAM,WAAW,QAAS,SAAQ,OAAO,CAAC,QAAQ,CAAC,eAAe,EAAE,UAAU,EAAE,eAAe,CAAC;CAAG;AACnG,eAAO,MAAM,QAAQ,iCAA8C,CAAC;AAEpE,gGAAgG;AAChG,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,eAAO,MAAM,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAQ,KAI1D,CAAC;AAEH,8CAA8C;AAC9C,eAAO,MAAM,QAAQ,UAAW,KAAK,KAAG,MAAM,EAC2C,CAAC;AAyB1F,4FAA4F;AAC5F,eAAO,MAAM,cAAc,UAAW,KAAK,8GAmCxC,CAAC;AAEJ,oFAAoF;AACpF,MAAM,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAK5D,gGAAgG;AAChG,MAAM,MAAM,QAAQ,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,MAAM,WAAW,UAAU;IACzB,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/E;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAClE,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnE;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,eAAO,MAAM,UAAU,GAAI,IAAI,EAAE,CAAC,EAAE,GAAG,SAC9B,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,YACvB;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,KACpC,UA2DF,CAAC;AAEF,oCAAoC;AACpC,eAAO,MAAM,UAAU,UAAW,KAAK,KAAG,UAA+C,CAAC"}

package/docs/peers.md

@@ -1,16 +1,43 @@
-# Peers — and why each pin exists
-
-The install line for `@homeflare/alchemy`, and why every peer on it and every entry in the
-`overrides` block is required. The block itself, which every consumer copies, is in the
-[README](../README.md#peers--and-one-override-you-need).
+# Peers — and one override you need
 
 ```sh
 bun add @homeflare/alchemy alchemy@2.0.0-beta.81 effect@4.0.1 \
         @effect/platform-node@4.0.1 mime@4.1.0 \
         @distilled.cloud/cloudflare@1.0.0-rc.13 @distilled.cloud/forgejo@1.0.0-rc.13 \
+        @distilled.cloud/discord@1.0.0-rc.13 @distilled.cloud/google-workspace@1.0.0-rc.13 \
+        @distilled.cloud/argocd@1.0.0-rc.13 \
         @effect/sql-pg@4.0.1
 ```
 
+⛔ **Every one of those is required, and you also need an `overrides` block** — see
+below. The install succeeds without them and the import throws.
+
+★ **The machine-readable source of truth** lives in this package's `package.json` under the
+`homeflare.consumer` field. It carries the exact pins, the overrides below, and the import
+moves for `effect/unstable/*` as an ordered **array of `{"from", "to"}` pairs** — not an
+object keyed by the old path. Order is load-bearing: the most specific path comes first
+(`httpapi` before its parent `http`), because consumers apply the moves in published order.
+The install line, the overrides block in this doc, and the smoke test install are all
+asserted against that field; change the field first, then copy its `overrides` block here.
+
+⛔ **Add this to your `package.json`, or the install works and the import throws:**
+
+```json
+{
+  "overrides": {
+    "effect": "4.0.1",
+    "@effect/platform-node": "4.0.1",
+    "@effect/platform-node-shared": "4.0.1",
+    "@effect/platform-bun": "4.0.1",
+    "rolldown": "1.2.8",
+    "redis": "6.3.0"
+  }
+}
+```
+
+Why each peer is required and each pin exists — the measurements, and the error a missing one
+produces — is below.
+
 🔴 **Why, measured 2026-09-16 on 0.1.0 and re-checked 2026-09-17 against Alchemy 78.**
 Effect's `rc` line is not semver-compatible with itself. Alchemy 78's peer is
 `effect >= 4.0.0-rc.115`; an unlocked `@effect/platform-node-shared` still floats to the

package/docs/talos-openbao-adapter.md

@@ -0,0 +1,44 @@
+# `Kubernetes.ClusterAdapter` kind `talos-openbao`
+
+Reads the cluster admin kubeconfig from OpenBao KV (`bao kv get`, in memory, nothing on disk)
+when a `Kubernetes.Manifest` / `HelmChart` connects, and proves the answering cluster is the
+pinned one by its kube-system `metadata.uid`. The persisted connection is `{ kind, uid }` only.
+The design, the identity rule and the failure modes are in the header of
+`src/talos/cluster-adapter.ts`; this page is what an operator must do differently.
+
+## Connect deadline
+
+Vault read and uid GET share one 10 s deadline. A hung `bao` or a silent apiserver fails closed
+with `TalosOpenBaoConnectTimeout` (the `bao` child is killed with its process group). The HTTPS
+GET itself cannot be cancelled: upstream `readObject` takes no abort signal, so the request may
+linger until the OS gives up. That is an upstream ask, not something to re-implement here.
+
+## Literal connections only
+
+`talosOpenBaoConnection(uid)` throws `TalosUidNotLiteral` for an Output, and
+`Talos.ClusterHealth` refuses an Output connection in `diff` for the same reason: `cluster: health`
+passes that connection to workloads, and an unresolved connection hides a cluster change from the
+plan.
+
+## Usage rules
+
+Upstream Alchemy behaviour the adapter cannot fix. Follow these or risk deleting objects on the
+wrong cluster.
+
+1. **Move a workload to another cluster only by new logical IDs** (destroy the old, create the new).
+   Never change a live workload's `connection` in place: upstream skips the identity comparison
+   when any input is unresolved (`HelmChart.ts:246`), so the old generation's cleanup can run
+   against the new cluster.
+2. **Manage namespaces as separate `Manifest`s**, never `HelmChart` `createNamespace`. A replacement
+   cleanup deletes a shared `createNamespace` namespace (`HelmChart.ts:257`, `:344`) and everything
+   else in it.
+3. **Never rename a `HelmChart` `releaseName` in place.** It is replaced, and cleanup removes the
+   release the new one just took over.
+
+## Upstream asks (alchemy 2.0.0-beta.79)
+
+- `HelmChart`/`Manifest` diff skips identity comparison when any input is unresolved.
+- Replacement cleanup deletes a shared `createNamespace` namespace.
+- `readObject` cannot be cancelled (`internal/client.ts:75`).
+- `deleteObject` has no uid precondition.
+- Refresh replaces the saved uids.