@homeflare/alchemy 0.47.1 → 0.48.0

package/src/talos/talosctl.test.ts

@@ -0,0 +1,110 @@
+/**
+ * talosctl binary override. Fake spawner only — the named path is never executed (it only has to
+ * exist and be a trusted file; the fake answers `version --client` with the pinned version).
+ */
+import { chmodSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import * as ChildProcessSpawner from 'effect/process/ChildProcessSpawner';
+import { type FakeCall, fakeSpawner } from './fake-process.ts';
+import { trustBoundaryForTests } from './trust-boundary.seam.ts';
+import { TALOSCTL_BINARY_ENV, talosctl } from './talosctl.ts';
+
+// ⚠️ A real, vetted file in a private directory: the system `sh` or `bun` may be a symlink or live
+//   in a writable directory, which the vetting (correctly) refuses.
+const dir = mkdtempSync(join(tmpdir(), 'hf-talosctl-'));
+chmodSync(dir, 0o755);
+trustBoundaryForTests(dir);
+const fixture = join(dir, 'talosctl');
+writeFileSync(fixture, '#!/bin/sh\n', { mode: 0o755 });
+chmodSync(fixture, 0o755);
+afterAll(() => rmSync(dir, { force: true, recursive: true }));
+
+const run = (binary: string | undefined, calls: FakeCall[]) =>
+  Effect.runPromise(
+    Effect.provideService(
+      talosctl(['version'], {
+        talosconfigPath: 'unused-talosconfig.yaml',
+        ...(binary === undefined ? {} : { binary }),
+      }),
+      ChildProcessSpawner.ChildProcessSpawner,
+      fakeSpawner(() => ({ stdout: 'Client: Tag: v1.14.2' }), calls),
+    ),
+  );
+
+const withEnv = async (value: string | undefined, body: () => Promise<void>) => {
+  const saved = process.env[TALOSCTL_BINARY_ENV];
+  if (value === undefined) delete process.env[TALOSCTL_BINARY_ENV];
+  else process.env[TALOSCTL_BINARY_ENV] = value;
+  try {
+    await body();
+  } finally {
+    if (saved === undefined) delete process.env[TALOSCTL_BINARY_ENV];
+    else process.env[TALOSCTL_BINARY_ENV] = saved;
+  }
+};
+
+test('the binary option wins over HF_TALOSCTL', async () => {
+  await withEnv('/definitely/not/here/talosctl', async () => {
+    const calls: FakeCall[] = [];
+    await run(fixture, calls);
+    expect(calls[0]?.command).toBe(fixture);
+  });
+});
+
+test('HF_TALOSCTL selects the binary when the option is omitted', async () => {
+  await withEnv(fixture, async () => {
+    const calls: FakeCall[] = [];
+    await run(undefined, calls);
+    expect(calls[0]?.command).toBe(fixture);
+  });
+});
+
+const withPath = async (value: string, body: () => Promise<void>) => {
+  const saved = process.env['PATH'];
+  process.env['PATH'] = value;
+  try {
+    await body();
+  } finally {
+    if (saved === undefined) delete process.env['PATH'];
+    else process.env['PATH'] = saved;
+  }
+};
+
+test('the default talosctl is resolved on PATH, vetted and version-checked by absolute path', async () => {
+  await withEnv(undefined, () =>
+    withPath(dir, async () => {
+      const calls: FakeCall[] = [];
+      await run(undefined, calls);
+      expect(calls.map((call) => call.command)).toEqual([fixture, fixture]);
+    }),
+  );
+});
+
+test('the default talosctl on PATH is refused when it reports another version', async () => {
+  await withEnv(undefined, () =>
+    withPath(dir, async () => {
+      const outcome = await Effect.runPromise(
+        Effect.provideService(
+          talosctl(['version'], { talosconfigPath: 'unused.yaml' }),
+          ChildProcessSpawner.ChildProcessSpawner,
+          fakeSpawner(() => ({ stdout: 'Client: Tag: v1.13.8' })),
+        ),
+      ).catch((e: unknown) => String(e));
+      expect(outcome).toContain('is not talosctl v1.14.2');
+    }),
+  );
+});
+
+test('a default talosctl that is not on PATH is refused, never run by bare name', async () => {
+  await withEnv(undefined, () =>
+    withPath(join(dir, 'empty'), async () => {
+      const calls: FakeCall[] = [];
+      const outcome = await run(undefined, calls).catch((e: unknown) => String(e));
+      expect(outcome).toContain('not found on PATH');
+      expect(calls).toEqual([]);
+    }),
+  );
+});

package/src/talos/talosctl.ts

@@ -10,24 +10,65 @@
  * ⛔ DO NOT LOG STDOUT ON FAILURE. `talosctl kubeconfig` and error paths have been observed in the
  *   wild to include credential material; stderr is the safe diagnostic channel.
  */
+import * as Duration from 'effect/Duration';
 import * as Effect from 'effect/Effect';
 import * as Stream from 'effect/Stream';
 import * as ChildProcess from 'effect/process/ChildProcess';
 import * as ChildProcessSpawner from 'effect/process/ChildProcessSpawner';
+import {
+  DEFAULT_TALOSCTL_BINARY,
+  TALOSCTL_BINARY_ENV,
+  TalosBinaryRefused,
+  checkBinaryPath,
+  resolveDefault,
+} from './talosctl-binary.ts';
+
+export { DEFAULT_TALOSCTL_BINARY, TALOSCTL_BINARY_ENV, TalosBinaryRefused };
 
 export class TalosError extends Error {
   constructor(
     readonly command: string,
     readonly exitCode: number,
     detail: string,
+    binary = DEFAULT_TALOSCTL_BINARY,
   ) {
-    super(`talosctl ${command} -> ${String(exitCode)}: ${detail}`);
+    super(`${binary} ${command} -> ${String(exitCode)}: ${detail}`);
     this.name = 'TalosError';
   }
 }
 
+/** The Talos client version this family is written against (`--client` of the pinned binary). */
+export const TALOSCTL_PINNED_VERSION = 'v1.14.2';
+
+const talosctlBinary = (override: string | undefined): string => {
+  const fromOption = override?.trim();
+  if (fromOption !== undefined && fromOption !== '') return fromOption;
+  const fromEnv = process.env[TALOSCTL_BINARY_ENV]?.trim();
+  if (fromEnv !== undefined && fromEnv !== '') return fromEnv;
+  return DEFAULT_TALOSCTL_BINARY;
+};
+
+/**
+ * ⛔ THE CHILD GETS A MINIMAL ENV, NOT `process.env`: BAO_TOKEN and every other credential in the
+ *   caller's environment stay out of an override that is only vetted by path and version. The
+ *   talosconfig travels as a file argument, so the binary needs nothing else but `PATH`/`HOME`.
+ */
+const talosctlEnv = (): Record<string, string> => {
+  const env: Record<string, string> = {};
+  for (const name of ['PATH', 'HOME', 'TMPDIR']) {
+    const value = process.env[name];
+    if (value !== undefined && value !== '') env[name] = value;
+  }
+  return env;
+};
+
 export type TalosRunOptions = {
   readonly talosconfigPath: string;
+  /**
+   * `talosctl` executable. Wins over {@link TALOSCTL_BINARY_ENV}.
+   * @default `talosctl` on `PATH`, or `HF_TALOSCTL` when that variable is set.
+   */
+  readonly binary?: string;
   readonly nodes?: readonly string[];
   readonly endpoints?: readonly string[];
   /**
@@ -39,21 +80,16 @@ export type TalosRunOptions = {
   readonly insecure?: boolean;
 };
 
-/** Run `talosctl <args…>`. Returns trimmed stdout, or '' when empty. */
-export const talosctl = (args: readonly string[], options: TalosRunOptions) =>
+const capture = (binary: string, argv: readonly string[]) =>
   Effect.gen(function* () {
     const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-    const argv = [
-      ...args,
-      '--talosconfig',
-      options.talosconfigPath,
-      ...(options.nodes === undefined ? [] : ['--nodes', options.nodes.join(',')]),
-      ...(options.endpoints === undefined ? [] : ['--endpoints', options.endpoints.join(',')]),
-      ...(options.insecure === true ? ['--insecure'] : []),
-    ];
-    const result = yield* ChildProcess.make('talosctl', argv, {
-      detached: false,
-      extendEnv: true,
+    return yield* ChildProcess.make(binary, argv, {
+      // ⛔ No `detached: false`, plus `forceKillAfter`, as credentials.ts's bao spawn: the child
+      //   leads its own process group (killed whole on interrupt) and a SIGTERM-ignoring talosctl
+      //   is SIGKILLed 1 s later instead of blocking interruption.
+      env: talosctlEnv(),
+      extendEnv: false,
+      forceKillAfter: Duration.seconds(1),
       stderr: 'pipe',
       stdin: 'ignore',
       stdout: 'pipe',
@@ -79,11 +115,61 @@ export const talosctl = (args: readonly string[], options: TalosRunOptions) =>
       ),
       Effect.scoped,
     );
+  });
+
+/** ⚠️ EXACT TOKEN MATCH: `includes` would accept v1.14.20 for v1.14.2. */
+const reportsPinnedVersion = (stdout: string) =>
+  stdout.split(/[^\w.+-]+/).includes(TALOSCTL_PINNED_VERSION);
+
+/**
+ * ⛔ AN OVERRIDE MUST REPORT THE PINNED CLIENT VERSION (`version --client`, no talosconfig, so
+ *   nothing secret reaches an untrusted binary before it is vetted).
+ */
+const checkOverrideVersion = (binary: string, source: string) =>
+  capture(binary, ['version', '--client']).pipe(
+    Effect.flatMap((out) =>
+      out.exitCode === 0 && reportsPinnedVersion(out.stdout)
+        ? Effect.void
+        : Effect.fail(
+            new TalosBinaryRefused(
+              'version --client',
+              `${source} is not talosctl ${TALOSCTL_PINNED_VERSION} (exit ${String(out.exitCode)})`,
+              binary,
+            ),
+          ),
+    ),
+  );
+
+/** Run `talosctl <args…>`. Returns trimmed stdout, or '' when empty. */
+export const talosctl = (args: readonly string[], options: TalosRunOptions) =>
+  Effect.gen(function* () {
+    const requested = talosctlBinary(options.binary);
+    const resolved =
+      requested === DEFAULT_TALOSCTL_BINARY ? yield* resolveDefault(requested) : requested;
+    const fromOption = options.binary?.trim();
+    const source =
+      requested === DEFAULT_TALOSCTL_BINARY
+        ? 'talosctl on PATH'
+        : fromOption !== undefined && fromOption !== ''
+          ? 'the `binary` option'
+          : TALOSCTL_BINARY_ENV;
+    // ⛔ Launch exactly the vetted canonical path, for the probe and the credentialed call alike.
+    const binary = yield* checkBinaryPath(resolved, source);
+    yield* checkOverrideVersion(binary, source);
+    const argv = [
+      ...args,
+      '--talosconfig',
+      options.talosconfigPath,
+      ...(options.nodes === undefined ? [] : ['--nodes', options.nodes.join(',')]),
+      ...(options.endpoints === undefined ? [] : ['--endpoints', options.endpoints.join(',')]),
+      ...(options.insecure === true ? ['--insecure'] : []),
+    ];
+    const result = yield* capture(binary, argv);
 
     const command = args.join(' ');
     if (result.exitCode !== 0) {
       return yield* Effect.fail(
-        new TalosError(command, result.exitCode, result.stderr.slice(0, 300)),
+        new TalosError(command, result.exitCode, result.stderr.slice(0, 300), binary),
       );
     }
     return result.stdout;

package/src/talos/trust-boundary.test.ts

@@ -0,0 +1,17 @@
+/**
+ * The shipped trust-boundary surface. ⛔ The talosctl ancestor walk stops early above a
+ * registered directory, so anything that can register a directory can switch that vetting off —
+ * the module a consumer imports must therefore offer no way to register one. The register
+ * function lives in trust-boundary.seam.ts, which the published tarball excludes (package.json
+ * `files`, asserted by scripts/smoke.ts), so a non-test import of this module cannot reach it.
+ */
+import { expect, test } from 'bun:test';
+import * as shipped from './trust-boundary.ts';
+
+test('the shipped module exposes only the read-only boundary query', () => {
+  expect(Object.keys(shipped).sort()).toEqual(['isTrustedBoundary']);
+});
+
+test('isTrustedBoundary answers false for an unregistered directory', () => {
+  expect(shipped.isTrustedBoundary('/definitely/not/registered')).toBe(false);
+});

package/src/talos/trust-boundary.ts

@@ -0,0 +1,45 @@
+/**
+ * Which directories the talosctl ancestor walk (talosctl-binary.ts) may stop above.
+ *
+ * ⛔ READ-ONLY SHIPPED SURFACE, TEST-ONLY BY CONSTRUCTION. This is the only module the walk
+ *   consults, and its only export is the query below — the register function lives in
+ *   `trust-boundary.seam.ts`, which the published tarball does not contain (package.json `files`
+ *   excludes it; scripts/smoke.ts asserts that). A non-test import of this module therefore
+ *   cannot stop the walk early: `trustBoundaryForTests` is unreachable, the set it feeds is not
+ *   exported, and in a consumer install the dynamic pull below finds no seam, keeps the empty
+ *   set and every ancestor of a binary is vetted (fail closed). The seam is pulled with a
+ *   COMPUTED specifier so no bundler inlines it into the shipped module.
+ *
+ *   Plain syntax on purpose: fake-process.ts's graph is loaded under Node's strip-only
+ *   TypeScript (node-connect.harness.ts), which cannot load talosctl-binary.ts (parameter
+ *   properties). Not exported from the subpath index.
+ */
+import { realpathSync } from 'node:fs';
+
+let boundaries: ReadonlySet<string> = new Set<string>();
+
+/**
+ * Canonical compare: the walk hands over a real path, but the boundary is a security decision —
+ * resolving again makes it independent of what a caller (now or future) cached. ⛔ A directory
+ * that cannot be resolved is answered FALSE, never thrown: it is certainly not a registered
+ * boundary, and the walk must treat "no boundary" as "vet everything" (fail closed).
+ */
+export const isTrustedBoundary = (dir: string): boolean => {
+  try {
+    return boundaries.has(realpathSync(dir));
+  } catch {
+    return false;
+  }
+};
+
+const seamSpecifier = './trust-boundary' + '.seam.ts';
+void import(seamSpecifier).then(
+  (seam: { boundaries: ReadonlySet<string> }) => {
+    boundaries = seam.boundaries;
+  },
+  () => {
+    // Published package: no seam in the tarball — the set stays empty and the walk is never
+    // shortened. In-repo this only fires if the seam file was deleted; boundary-dependent tests
+    // then fail loudly instead of passing short-handed.
+  },
+);

package/src/talos/values.ts

@@ -6,6 +6,7 @@
  *   reconcile time; tests use fixtures only.
  */
 import { createHash } from 'node:crypto';
+import { parseYaml } from './yaml-parse.ts';
 
 /** Trim trailing whitespace only — leading space in YAML is meaningful. */
 export const canonicalText = (text: string) => text.trimEnd();
@@ -39,12 +40,7 @@ export const configDigest = (text: string) => sha256(text);
  *   silently picking one would repeat the exact shipped bug.
  */
 export const extractMachineConfigSpec = (wrapperYaml: string): string | undefined => {
-  let doc: unknown;
-  try {
-    doc = Bun.YAML.parse(wrapperYaml);
-  } catch {
-    return undefined;
-  }
+  let doc = parseYaml(wrapperYaml);
   if (Array.isArray(doc)) {
     if (doc.length !== 1) return undefined;
     doc = doc[0];
@@ -77,12 +73,9 @@ export const kubeconfigMetadata = (
   yamlText: string,
   contextName: string,
 ): { endpoint: string; caFingerprint: string; clientFingerprint: string } | undefined => {
-  let doc: KubeconfigDoc;
-  try {
-    doc = Bun.YAML.parse(yamlText) as KubeconfigDoc;
-  } catch {
-    return undefined;
-  }
+  const parsed = parseYaml(yamlText);
+  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) return undefined;
+  const doc = parsed as KubeconfigDoc;
 
   const ctx = doc.contexts?.find((row) => row.name === contextName)?.context;
   const clusterName = ctx?.cluster;

package/src/talos/yaml-parse.test.ts

@@ -0,0 +1,41 @@
+/**
+ * `parseYaml` — a syntax error is "not a document"; nothing else is swallowed. And the adapter's
+ * kubeconfig reader no longer reports a parser/runtime fault as an unreadable kubeconfig.
+ */
+import { expect, spyOn, test } from 'bun:test';
+import { kubeconfigTransport } from './kubeconfig-doc.ts';
+import { parseYaml } from './yaml-parse.ts';
+
+test('valid YAML parses and a syntax error is undefined', () => {
+  expect(parseYaml('a: 1\nb: [x, y]\n')).toEqual({ a: 1, b: ['x', 'y'] });
+  expect(parseYaml('a: [unclosed\n')).toBeUndefined();
+});
+
+test('an unresolved tag beside key material emits no warning carrying the source', () => {
+  // ⛔ yaml's default logLevel is 'warn': process.emitWarning with the SOURCE TEXT. Reproduced in
+  //   hunt round 5: the whole client-key-data landed on stderr while parsing still succeeded.
+  // A fresh random needle per run: a fixed high-entropy literal here is exactly what the secret scan refuses.
+  const secret = Buffer.from(crypto.getRandomValues(new Uint8Array(32))).toString('base64');
+  const text = `users:\n  - user:\n      client-key-data: ${secret}\n      other: !nosuchtag value\n`;
+  const emitted: string[] = [];
+  const warn = spyOn(process, 'emitWarning').mockImplementation(((w: unknown) => {
+    emitted.push(String(w instanceof Error ? w.message : w));
+  }) as never);
+  const err = spyOn(process.stderr, 'write').mockImplementation(((c: unknown) => {
+    emitted.push(String(c));
+    return true;
+  }) as never);
+  try {
+    expect(parseYaml(text)).toBeDefined();
+  } finally {
+    warn.mockRestore();
+    err.mockRestore();
+  }
+  expect(emitted.join('\n')).not.toContain(secret);
+  expect(emitted).toEqual([]);
+});
+
+test('kubeconfigTransport returns undefined for a non-document, not for a fault', () => {
+  expect(kubeconfigTransport('a: [unclosed\n', 'admin@c1')).toBeUndefined();
+  expect(kubeconfigTransport('- just\n- a list\n', 'admin@c1')).toBeUndefined();
+});

package/src/talos/yaml-parse.ts

@@ -0,0 +1,28 @@
+/**
+ * The one YAML parser of the Talos family — runtime-neutral, so it runs under Bun AND Node.
+ *
+ * ⛔ NOT `Bun.YAML`. The published `dist/` runs on Node for consumers (AGENTS.md: Bun is the
+ *   toolchain, not the runtime). `Bun.YAML` is a missing global there: the old code swallowed that
+ *   ReferenceError and reported every kubeconfig as unreadable (reproduced on Node 22: the adapter
+ *   returned no transport). ★ `yaml` is the parser alchemy itself depends on (`yaml ^2.9.0`), so no
+ *   new package enters a consumer's tree.
+ * ⚠️ ONLY a YAML syntax error is `undefined` ("this is not a document"). Anything else — a broken
+ *   import, a runtime fault — propagates, so a parser/runtime defect is never dressed up as bad
+ *   vault content.
+ */
+import { YAMLParseError, parse } from 'yaml';
+
+/** Parse one YAML document, or `undefined` when the text is not valid YAML. */
+export const parseYaml = (text: string): unknown => {
+  try {
+    // ⛔ yaml reports unresolved tags etc. via process.emitWarning with the SOURCE TEXT in the
+    //   message (reproduced, hunt round 5: a kubeconfig with an unknown tag beside client-key-data
+    //   put the whole key on stderr). `logLevel: 'error'` silences warnings (yaml options.d.ts:
+    //   LogLevelId; doc.warnings are never emitted) and `prettyErrors: false` keeps source excerpts
+    //   out of any thrown error's message; syntax errors still throw YAMLParseError.
+    return parse(text, { logLevel: 'error', prettyErrors: false });
+  } catch (error) {
+    if (error instanceof YAMLParseError) return undefined;
+    throw error;
+  }
+};

package/src/verify/fake-engine.ts

@@ -143,6 +143,8 @@ export interface FakeEngine {
    * `verify.ts`'s `readWithState`, which already wraps that same call in `Effect.catchCause`.
    */
   readonly drift: (body: Body) => Promise<Record<string, DriftRow>>;
+  /** `alchemy drift --repair` (`Alchemy.Drift.repair`): read, then reconcile what drifted. */
+  readonly repair: (body: Body) => Promise<Record<string, DriftRow>>;
   /**
    * Every state row the store holds, as JSON — what a Postgres store would persist. ★ For tests
    * that must prove a value NEVER reaches state (proxmox/pbs-notification-target-state.test.ts).
@@ -173,6 +175,8 @@ export const engineOver = <ROut, E, RIn>(
     stage: string;
   }) => Effect.Effect<{ resources: Record<string, DriftRow> }, unknown>;
 
+  const repairDrift = Alchemy.Drift.repair as unknown as typeof detectDrift;
+
   const run = <A>(body: Body, next: (compiled: Compiled) => Effect.Effect<A, unknown, unknown>) =>
     Effect.runPromise(
       Effect.gen(function* () {
@@ -208,6 +212,12 @@ export const engineOver = <ROut, E, RIn>(
           Effect.map((detected) => detected.resources),
         ),
       ),
+    repair: (body) =>
+      run(body, (compiled) =>
+        repairDrift({ name: compiled.name, stage: compiled.stage }).pipe(
+          Effect.map((detected) => detected.resources),
+        ),
+      ),
   };
 };
 

package/dist/talos/fake-process.d.ts

@@ -1,56 +0,0 @@
-/**
- * A fake `ChildProcessSpawner` for offline Talos tests — no real `bao` or `talosctl` process ever
- * starts. Shared by credentials.test.ts and talos-machine-config.test.ts (2026-09-26, K-A3);
- * this package had NO process-level test fake before this file — every Talos resource file spawns
- * a real binary in production and none of that was previously exercised offline.
- *
- * ★ A FULL FAKE SERVICE, NOT A REAL SPAWN WITH A FIXTURE EXECUTABLE ON `PATH`. The alternative —
- *   a tiny fake `bao`/`talosctl` script and a mutated `process.env.PATH` — spawns a REAL OS
- *   process and mutates process-global state for the test's duration, which is exactly the kind
- *   of cross-test interference the house rules ask tests to avoid. `ChildProcessSpawner.make`
- *   takes just a `spawn` function and derives everything else, so a fake `spawn` is the whole cost.
- */
-import * as Effect from 'effect/Effect';
-import * as Stream from 'effect/Stream';
-import type { Command } from 'effect/process/ChildProcess';
-import * as ChildProcessSpawner from 'effect/process/ChildProcessSpawner';
-export type FakeResult = {
-    readonly stdout?: string;
-    readonly stderr?: string;
-    readonly exitCode?: number;
-};
-export type FakeCall = {
-    readonly command: string;
-    readonly args: readonly string[];
-    /**
-     * Decoded stdin text, present only when the real caller piped a `Stream` in (K-talos-first-boot,
-     * `credentials-write.ts`'s `writeKvValue`) — the whole reason this fake exists is to prove a
-     * value went in via stdin and never via argv, so a test needs to see it.
-     */
-    readonly stdin?: string;
-};
-export type FakeHandler = (call: FakeCall) => FakeResult;
-/**
- * Build a fake `ChildProcessSpawner.Service` from `handler`, which sees every command's
- * executable + argv (+ decoded stdin, when piped) and returns canned stdout/stderr/exitCode.
- * `credentials.ts` and `talosctl.ts` only ever build `StandardCommand`s (never a piped command),
- * so that is the only shape this fake accepts — a `PipedCommand` is a test-authoring mistake, not
- * something to fake.
- */
-export declare const fakeSpawner: (handler: FakeHandler, calls?: FakeCall[]) => {
-    spawn(command: Command): Effect.Effect<ChildProcessSpawner.ChildProcessHandle, import("effect/PlatformError").PlatformError, import("effect/Scope").Scope>;
-    exitCode(command: Command): Effect.Effect<ChildProcessSpawner.ExitCode, import("effect/PlatformError").PlatformError>;
-    streamString(command: Command, options?: {
-        readonly includeStderr?: boolean | undefined;
-    }): Stream.Stream<string, import("effect/PlatformError").PlatformError>;
-    streamLines(command: Command, options?: {
-        readonly includeStderr?: boolean | undefined;
-    }): Stream.Stream<string, import("effect/PlatformError").PlatformError>;
-    lines(command: Command, options?: {
-        readonly includeStderr?: boolean | undefined;
-    }): Effect.Effect<Array<string>, import("effect/PlatformError").PlatformError>;
-    string(command: Command, options?: {
-        readonly includeStderr?: boolean | undefined;
-    }): Effect.Effect<string, import("effect/PlatformError").PlatformError>;
-};
-//# sourceMappingURL=fake-process.d.ts.map

package/dist/talos/fake-process.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"fake-process.d.ts","sourceRoot":"","sources":["../../src/talos/fake-process.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,KAAK,mBAAmB,MAAM,oCAAoC,CAAC;AAE1E,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AACF,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,QAAQ,KAAK,UAAU,CAAC;AAsCzD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,YAAa,WAAW,UAAS,QAAQ,EAAE;;;;;;;;;;;;;;;CAehE,CAAC"}

package/dist/talos/machine-config-fixtures.d.ts

@@ -1,60 +0,0 @@
-/**
- * Shared fixtures for talos-machine-config.test.ts and machine-config-poll.test.ts — split out
- * so neither test file needs to duplicate the fake `bao`/`talosctl` dispatcher (2026-09-26, K-A3).
- *
- * ⚠️ FIXTURES ONLY. `CONFIG_TEXT` is a plain marker string, never anything resembling a real
- *   Talos machine config, CA key or bootstrap token. No provider imports this file.
- */
-import * as Effect from 'effect/Effect';
-import * as ChildProcessSpawner from 'effect/process/ChildProcessSpawner';
-import { type FakeCall } from './fake-process.ts';
-import type { MachineConfigProps } from './talos-machine-config.ts';
-export declare const CONFIG_TEXT = "machine:\n  type: worker\n";
-export declare const PIN: string;
-export declare const TARGET: {
-    cluster: string;
-    mount: string;
-};
-export declare const FAST_POLL: {
-    immediate: {
-        intervalMs: number;
-        maxAttempts: number;
-    };
-    rebootish: {
-        intervalMs: number;
-        maxAttempts: number;
-    };
-};
-export declare const props: (overrides?: Partial<MachineConfigProps>) => MachineConfigProps;
-/** Shape REASONED from talosctl's `get machineconfig -o yaml` — see values.ts's own header. */
-export declare const wrapperFor: (specText: string, version?: string) => string;
-/** Routes fake `bao kv get` (config + talosconfig keys) and `talosctl` calls in one place. */
-export declare const dispatcher: (opts: {
-    configText?: string;
-    liveWrapper?: () => {
-        stdout?: string;
-        exitCode?: number;
-    };
-    applyExitCode?: number;
-    /**
-     * Controls the fix-first #1 maintenance-mode probe (`talosctl version --insecure`), reached only
-     * when the authenticated `get machineconfig` above fails. Defaults to `false` so a bare failing
-     * `liveWrapper` (most tests) still exercises the "both reads fail → propagate" path rather than
-     * silently succeeding at the probe.
-     */
-    maintenanceReachable?: boolean;
-}) => (call: FakeCall) => {
-    stdout?: string;
-    exitCode?: number;
-} | {
-    exitCode: number;
-    stderr: string;
-};
-export declare const run: <A, E>(effect: Effect.Effect<A, E, ChildProcessSpawner.ChildProcessSpawner>, handler: (c: FakeCall) => {
-    stdout?: string;
-    stderr?: string;
-    exitCode?: number;
-}, calls?: FakeCall[]) => Promise<A>;
-/** `Data.TaggedError` stamps `_tag`, not `.message` — see talos-errors.ts. */
-export declare const hasTag: (tag: string) => (error: unknown) => boolean;
-//# sourceMappingURL=machine-config-fixtures.d.ts.map

package/dist/talos/machine-config-fixtures.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"machine-config-fixtures.d.ts","sourceRoot":"","sources":["../../src/talos/machine-config-fixtures.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,mBAAmB,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,KAAK,QAAQ,EAAe,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAGpE,eAAO,MAAM,WAAW,+BAA+B,CAAC;AACxD,eAAO,MAAM,GAAG,QAA4B,CAAC;AAC7C,eAAO,MAAM,MAAM;IAAK,OAAO;IAAQ,KAAK;CAAc,CAAC;AAC3D,eAAO,MAAM,SAAS;IACpB,SAAS;QAAI,UAAU;QAAK,WAAW;;IACvC,SAAS;QAAI,UAAU;QAAK,WAAW;;CACxC,CAAC;AAEF,eAAO,MAAM,KAAK,eAAe,OAAO,CAAC,kBAAkB,CAAC,KAAQ,kBAMlE,CAAC;AAEH,+FAA+F;AAC/F,eAAO,MAAM,UAAU,aAAc,MAAM,6BAC6D,CAAC;AAEzG,8FAA8F;AAC9F,eAAO,MAAM,UAAU,SAAU;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,YAEe,QAAQ;aAXS,MAAM;eAAa,MAAM;;;;CAgCzD,CAAC;AAEF,eAAO,MAAM,GAAG,GAAI,CAAC,EAAE,CAAC,UACd,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,mBAAmB,CAAC,mBAAmB,CAAC,WAC3D,CAAC,CAAC,EAAE,QAAQ,KAAK;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,UAC1E,QAAQ,EAAE,eAQhB,CAAC;AAEJ,8EAA8E;AAC9E,eAAO,MAAM,MAAM,QAAS,MAAM,aAAa,OAAO,YACH,CAAC"}