@homeflare/alchemy 0.47.1 → 0.48.0

package/dist/talos/index.js

@@ -1,40 +1,254 @@
-// src/talos/kubeconfig.ts
-import { chmodSync } from "node:fs";
-import { Resource } from "alchemy";
-import { isResolved } from "alchemy/Diff";
-import * as Provider from "alchemy/Provider";
-import * as Effect4 from "effect/Effect";
+// src/talos/cluster-adapter.ts
+import {
+  ClusterAdapter,
+  ClusterNotFoundError
+} from "alchemy/Kubernetes/ClusterAdapter";
+import * as Effect6 from "effect/Effect";
+import * as Layer from "effect/Layer";
 
-// src/talos/credentials.ts
-import { closeSync, openSync, writeFileSync } from "node:fs";
+// src/talos/cluster-adapter-errors.ts
+import * as Data from "effect/Data";
+
+class TalosOpenBaoUnknownCluster extends Data.TaggedError("TalosOpenBaoUnknownCluster") {
+  get message() {
+    return `talos-openbao adapter has no entry pinned to cluster uid ${this.uid} ` + `(configured uids: ${this.known.join(", ") || "none"}). Refused rather than reading ` + "another cluster's kubeconfig. If the cluster was retired, keep its entry with " + "`retired: true` and its uid until its rows are destroyed.";
+  }
+}
+
+class TalosOpenBaoAmbiguousUid extends Data.TaggedError("TalosOpenBaoAmbiguousUid") {
+  get message() {
+    return `talos-openbao adapter entries ${this.aliases.join(", ")} are all pinned to uid ` + `${this.uid}. Refused instead of picking one: a uid names exactly one entry.`;
+  }
+}
+
+class TalosOpenBaoLegacyAuth extends Data.TaggedError("TalosOpenBaoLegacyAuth") {
+  get message() {
+    return "talos-openbao connection carries a legacy `cluster` alias in its auth block. Refused " + "before any vault read or request, with no silent migration (old and new auth differ, so " + "upstream would PATCH then DELETE the same object). Remedy: edit the saved state ONCE so " + "each such row's `connection.auth` is `{ kind: 'talos-openbao', uid }` (drop `cluster`), " + "then redeploy.";
+  }
+}
+
+class TalosClusterMoved extends Data.TaggedError("TalosClusterMoved") {
+  get message() {
+    return `Talos.ClusterIdentity '${this.cluster}' published uid ${this.saved} but the vault key now ` + `answers as ${this.live}. Refused, not updated: an update cannot become a replace for the ` + "workloads downstream, so the new cluster would be force-applied and the old one orphaned. " + "A move is explicit: declare a NEW Talos.ClusterIdentity for the new cluster and leave this " + "one pointing at the old cluster until its workloads are destroyed.";
+  }
+}
+
+class TalosVaultKeyMissing extends Data.TaggedError("TalosVaultKeyMissing") {
+  get message() {
+    return `${this.mount}/${this.key}: OpenBao has no value at this key. Talos.Kubeconfig writes it ` + "once at bring-up. Connect refused instead of reading a kubeconfig from disk.";
+  }
+}
+
+class TalosKubeconfigUnreadable extends Data.TaggedError("TalosKubeconfigUnreadable") {
+  get message() {
+    return `${this.mount}/${this.key}: OpenBao kubeconfig does not parse for context ${this.context}. ` + "The document stayed in the vault. Connect wrote nothing to disk and nothing to state.";
+  }
+}
+
+class TalosOpenBaoAuthKind extends Data.TaggedError("TalosOpenBaoAuthKind") {
+  get message() {
+    return `talos-openbao adapter received auth kind '${this.kind}'. This adapter only connects ` + "`talos-openbao`.";
+  }
+}
+
+class TalosClusterIdentityMissing extends Data.TaggedError("TalosClusterIdentityMissing") {
+  get message() {
+    return "talos-openbao connection carries no uid, so it cannot say which physical cluster it " + "targets. Refused before any vault read or request: pin the uid " + "printed by `Talos.ClusterIdentity` as a literal in `TalosOpenBaoAdapter` and build " + "workloads from `talosOpenBaoConnection(<that literal>)`.";
+  }
+}
+
+class TalosClusterIdentityMismatch extends Data.TaggedError("TalosClusterIdentityMismatch") {
+  get message() {
+    return `talos-openbao cluster '${this.cluster}' answered as kube-system uid ${this.got}, but the ` + `saved connection expects ${this.expected}. Refused before any apply or delete: the name ` + "now resolves to a different physical cluster. If the original cluster is gone for good, " + "remove its rows from state deliberately.";
+  }
+}
+
+class TalosClusterIdentityUnreadable extends Data.TaggedError("TalosClusterIdentityUnreadable") {
+  get message() {
+    return `talos-openbao cluster '${this.cluster}': kube-system has no readable metadata.uid. ` + "Refused rather than assuming the cluster is the expected one.";
+  }
+}
+
+class TalosClusterIdentityTimeout extends Data.TaggedError("TalosClusterIdentityTimeout") {
+  get message() {
+    return `talos-openbao cluster '${this.cluster}': no answer to the kube-system uid read within ` + `${this.seconds}s. Refused (failed closed) rather than waiting on a silent apiserver.`;
+  }
+}
+
+class TalosOpenBaoConnectTimeout extends Data.TaggedError("TalosOpenBaoConnectTimeout") {
+  get message() {
+    return `talos-openbao cluster '${this.cluster}': vault read and identity check did not finish ` + `within ${this.seconds}s. Refused (failed closed); the bao child was killed.`;
+  }
+}
+
+class TalosUidNotLiteral extends Data.TaggedError("TalosUidNotLiteral") {
+  get message() {
+    return "talos-openbao connection uid must be a literal string taken from the adapter config, not " + "an Output (for example a Talos.ClusterIdentity attribute). An unresolved uid hides a " + "cluster change from the plan: upstream would plan an UPDATE and reconcile the old cluster's " + "objects on the new one. Pin the uid in `TalosOpenBaoAdapter` and take it from there.";
+  }
+}
+
+// src/talos/cluster-identity.ts
+import { readObject } from "alchemy/Kubernetes/internal/client";
+import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
+var KUBE_SYSTEM = { apiVersion: "v1", kind: "Namespace", name: "kube-system" };
+var UID_READ_TIMEOUT = Duration.seconds(5);
+var readClusterUid = (cluster, transport, timeout = UID_READ_TIMEOUT) => readObject({ object: KUBE_SYSTEM, transport }).pipe(Effect.timeoutOrElse({
+  duration: timeout,
+  orElse: () => Effect.fail(new TalosClusterIdentityTimeout({ cluster, seconds: Duration.toSeconds(timeout) }))
+}), Effect.flatMap((body) => {
+  const uid = body?.metadata?.uid;
+  return typeof uid === "string" && uid !== "" ? Effect.succeed(uid) : Effect.fail(new TalosClusterIdentityUnreadable({ cluster }));
+}));
+var assertClusterUid = (cluster, expected, transport) => readClusterUid(cluster, transport).pipe(Effect.flatMap((got) => got === expected ? Effect.void : Effect.fail(new TalosClusterIdentityMismatch({ cluster, expected, got }))));
+
+// src/talos/cluster-transport.ts
+import * as Duration3 from "effect/Duration";
+import * as Effect5 from "effect/Effect";
+
+// src/talos/credentials.ts
+import * as Duration2 from "effect/Duration";
+import * as Effect4 from "effect/Effect";
 import * as Stream from "effect/Stream";
 import * as ChildProcess from "effect/process/ChildProcess";
 import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
-var DEFAULT_TALOSCONFIG_KEY = "talosconfig";
-var DEFAULT_KUBECONFIG_KEY = "kubeconfig";
-var readKvValue = (mount, key, fields) => Effect.gen(function* () {
-  const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-  const result = yield* ChildProcess.make("bao", ["kv", "get", "-format=json", `${mount}/${key}`], { detached: false, extendEnv: true, stderr: "pipe", stdin: "ignore", stdout: "pipe" }).pipe(spawner.spawn, Effect.flatMap((child) => Effect.all({
-    exitCode: child.exitCode,
-    stderr: child.stderr.pipe(Stream.decodeText, Stream.mkString, Effect.map((text) => text.trim())),
-    stdout: child.stdout.pipe(Stream.decodeText, Stream.mkString, Effect.map((text) => text.trim()))
-  }, { concurrency: "unbounded" })), Effect.scoped);
-  if (result.exitCode !== 0) {
-    return yield* Effect.fail(new Error(`bao kv get ${mount}/${key} exited ${String(result.exitCode)}: ${result.stderr}`));
+
+// src/talos/bao-env.ts
+var baoEnv = () => {
+  const addr = process.env["BAO_ADDR"];
+  const token = process.env["BAO_TOKEN"];
+  if (addr === undefined || addr === "" || token === undefined || token === "")
+    return;
+  const env = { BAO_ADDR: addr, BAO_TOKEN: token };
+  for (const name of ["PATH", "BAO_NAMESPACE", "BAO_CACERT"]) {
+    const value = process.env[name];
+    if (value !== undefined && value !== "")
+      env[name] = value;
   }
-  const parsed = JSON.parse(result.stdout);
-  const data = parsed.data?.data;
-  for (const field of fields) {
-    const raw = data?.[field];
-    if (typeof raw === "string" && raw.trim() !== "")
-      return raw;
+  return env;
+};
+
+// src/talos/talosctl-binary.ts
+import { accessSync, constants, lstatSync, realpathSync as realpathSync2 } from "node:fs";
+import { basename, delimiter, dirname, isAbsolute, join } from "node:path";
+import * as Effect2 from "effect/Effect";
+
+// src/talos/trust-boundary.ts
+import { realpathSync } from "node:fs";
+var boundaries = new Set;
+var isTrustedBoundary = (dir) => {
+  try {
+    return boundaries.has(realpathSync(dir));
+  } catch {
+    return false;
+  }
+};
+var seamSpecifier = "./trust-boundary" + ".seam.ts";
+import(seamSpecifier).then((seam) => {
+  boundaries = seam.boundaries;
+}, () => {});
+
+// src/talos/talosctl-binary.ts
+var DEFAULT_TALOSCTL_BINARY = "talosctl";
+var TALOSCTL_BINARY_ENV = "HF_TALOSCTL";
+var DEFAULT_BAO_BINARY = "bao";
+var BAO_BINARY_ENV = "HF_BAO";
+
+class TalosBinaryRefused extends Error {
+  command;
+  binary;
+  constructor(command, detail, binary = DEFAULT_TALOSCTL_BINARY) {
+    super(`${binary} ${command} refused: ${detail}`);
+    this.name = "TalosBinaryRefused";
+    this.command = command;
+    this.binary = binary;
   }
-  return yield* Effect.fail(new Error(`${mount}/${key} returned no ${fields.join("/")} field. Never store the value itself in ` + "an Alchemy prop or attribute — fix the KV entry, not the caller."));
+}
+var resolveDefault = (binary) => Effect2.try({
+  try: () => {
+    for (const entry of (process.env["PATH"] ?? "").split(delimiter)) {
+      if (!isAbsolute(entry))
+        continue;
+      try {
+        const candidate = join(entry, binary);
+        accessSync(candidate, constants.X_OK);
+        return realpathSync2(candidate);
+      } catch {}
+    }
+    throw new Error("not found");
+  },
+  catch: () => new TalosBinaryRefused("binary check", `${binary} was not found on PATH`, binary)
 });
-var mintKvTempFile = (raw, label) => Effect.gen(function* () {
-  const path = `${Bun.env["TMPDIR"] ?? "/tmp"}/hf-talos-${label}-${Bun.randomUUIDv7()}.yaml`;
-  yield* Effect.acquireRelease(Effect.try({
+var untrustedAncestor = (file, uid) => {
+  let dir = realpathSync2(dirname(file));
+  for (;; ) {
+    const stat = lstatSync(dir);
+    const isBoundary = isTrustedBoundary(dir);
+    if (uid !== undefined && stat.uid !== uid && stat.uid !== 0) {
+      return `lives under a directory owned by another user (${dir})`;
+    }
+    const sticky = (stat.mode & 512) !== 0;
+    if ((stat.mode & 18) !== 0 && !sticky) {
+      return `lives in a group- or world-writable directory (${dir})`;
+    }
+    const up = dirname(dir);
+    if (up === dir || isBoundary)
+      return;
+    dir = up;
+  }
+};
+var checkBinaryPath = (binary, source) => {
+  const refuse = (why) => Effect2.fail(new TalosBinaryRefused("binary check", `${source} ${why}`, binary));
+  if (!isAbsolute(binary))
+    return refuse("must be an absolute path");
+  return Effect2.try({
+    try: () => {
+      const canonical = join(realpathSync2(dirname(binary)), basename(binary));
+      const file = lstatSync(canonical);
+      const uid = process.getuid?.();
+      return { canonical, file, uid, ancestor: untrustedAncestor(canonical, uid) };
+    },
+    catch: () => new TalosBinaryRefused("binary check", `${source} is not a readable file`, binary)
+  }).pipe(Effect2.flatMap(({ canonical, file, uid, ancestor }) => {
+    if (file.isSymbolicLink())
+      return refuse("must not be a symlink");
+    if (!file.isFile())
+      return refuse("is not a regular file");
+    if (uid === undefined)
+      return refuse("cannot be vetted: no process uid to check ownership");
+    if (ancestor !== undefined)
+      return refuse(ancestor);
+    if (uid !== undefined && file.uid !== uid && file.uid !== 0) {
+      return refuse("must be owned by the current user or root");
+    }
+    if ((file.mode & 18) !== 0)
+      return refuse("is group- or world-writable");
+    try {
+      accessSync(canonical, constants.X_OK);
+    } catch {
+      return refuse("is not executable");
+    }
+    return Effect2.succeed(canonical);
+  }));
+};
+var resolveBao = () => {
+  const override = process.env[BAO_BINARY_ENV]?.trim();
+  const requested = override !== undefined && override !== "" ? override : DEFAULT_BAO_BINARY;
+  const source = requested === DEFAULT_BAO_BINARY ? "bao on PATH" : BAO_BINARY_ENV;
+  const resolved = requested === DEFAULT_BAO_BINARY ? resolveDefault(requested) : Effect2.succeed(requested);
+  return Effect2.flatMap(resolved, (path) => checkBinaryPath(path, source));
+};
+
+// src/talos/mint-temp-file.ts
+import { closeSync, openSync, writeFileSync } from "node:fs";
+import { unlink } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { tmpdir } from "node:os";
+import { join as join2 } from "node:path";
+import * as Effect3 from "effect/Effect";
+var mintKvTempFile = (raw, label) => Effect3.gen(function* () {
+  const path = join2(tmpdir(), `hf-talos-${label}-${randomUUID()}.yaml`);
+  yield* Effect3.acquireRelease(Effect3.try({
     try: () => {
       const fd = openSync(path, "wx", 384);
       try {
@@ -44,46 +258,226 @@ var mintKvTempFile = (raw, label) => Effect.gen(function* () {
       }
     },
     catch: (cause) => new Error(`writing ${label} temp file: ${String(cause)}`)
-  }), () => Effect.tryPromise({ try: () => Bun.file(path).delete(), catch: () => {
+  }), () => Effect3.tryPromise({ try: () => unlink(path), catch: () => {
     return;
-  } }).pipe(Effect.orElseSucceed(() => {
+  } }).pipe(Effect3.orElseSucceed(() => {
     return;
   })));
   return { path };
 });
+
+// src/talos/credentials.ts
+var DEFAULT_TALOSCONFIG_KEY = "talosconfig";
+var DEFAULT_KUBECONFIG_KEY = "kubeconfig";
+var readKvValue = (mount, key, fields) => Effect4.gen(function* () {
+  const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+  const bao = yield* resolveBao();
+  const env = baoEnv();
+  if (env === undefined) {
+    return yield* Effect4.fail(new Error(`bao kv get ${mount}/${key} refused: BAO_ADDR and BAO_TOKEN must both be set. ` + "Without them bao would fall back to a cached login in the operator's home."));
+  }
+  const result = yield* ChildProcess.make(bao, ["kv", "get", "-format=json", `${mount}/${key}`], {
+    env,
+    extendEnv: false,
+    forceKillAfter: Duration2.seconds(1),
+    stderr: "pipe",
+    stdin: "ignore",
+    stdout: "pipe"
+  }).pipe(spawner.spawn, Effect4.flatMap((child) => Effect4.all({
+    exitCode: child.exitCode,
+    stderr: child.stderr.pipe(Stream.decodeText, Stream.mkString, Effect4.map((text) => text.trim())),
+    stdout: child.stdout.pipe(Stream.decodeText, Stream.mkString, Effect4.map((text) => text.trim()))
+  }, { concurrency: "unbounded" })), Effect4.scoped);
+  if (result.exitCode !== 0) {
+    return yield* Effect4.fail(new Error(`bao kv get ${mount}/${key} exited ${String(result.exitCode)}: ${result.stderr}`));
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(result.stdout);
+  } catch {
+    return yield* Effect4.fail(new Error(`bao kv get ${mount}/${key} returned output that is not JSON (not echoed).`));
+  }
+  const data = parsed.data?.data;
+  for (const field of fields) {
+    const raw = data?.[field];
+    if (typeof raw === "string" && raw.trim() !== "")
+      return raw;
+  }
+  return yield* Effect4.fail(new Error(`${mount}/${key} returned no ${fields.join("/")} field. Never store the value itself in ` + "an Alchemy prop or attribute — fix the KV entry, not the caller."));
+});
+var isVaultKeyAbsent = (error) => error instanceof Error && /no value found at/i.test(error.message);
 var mintTalosconfig = (target) => readKvValue(target.mount, target.talosconfigKey ?? DEFAULT_TALOSCONFIG_KEY, [
   "talosconfig",
   "config"
-]).pipe(Effect.flatMap((raw) => mintKvTempFile(raw, `${target.cluster}-talosconfig`)), Effect.map(({ path }) => ({ talosconfigPath: path })));
+]).pipe(Effect4.flatMap((raw) => mintKvTempFile(raw, `${target.cluster}-talosconfig`)), Effect4.map(({ path }) => ({ talosconfigPath: path })));
+
+// src/talos/yaml-parse.ts
+import { YAMLParseError, parse } from "yaml";
+var parseYaml = (text) => {
+  try {
+    return parse(text, { logLevel: "error", prettyErrors: false });
+  } catch (error) {
+    if (error instanceof YAMLParseError)
+      return;
+    throw error;
+  }
+};
+
+// src/talos/kubeconfig-doc.ts
+var pem = (data) => {
+  if (data === undefined || data.trim() === "")
+    return;
+  const decoded = Buffer.from(data, "base64").toString("utf8");
+  return decoded.includes("BEGIN ") ? decoded : undefined;
+};
+var kubeconfigTransport = (yamlText, contextName) => {
+  const parsed = parseYaml(yamlText);
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+    return;
+  const doc = parsed;
+  const ctx = doc.contexts?.find((row) => row.name === contextName)?.context;
+  const clusterName = ctx?.cluster;
+  const userName = ctx?.user;
+  if (clusterName === undefined || userName === undefined)
+    return;
+  const cluster = doc.clusters?.find((row) => row.name === clusterName)?.cluster;
+  const user = doc.users?.find((row) => row.name === userName)?.user;
+  const endpoint = cluster?.server;
+  const certificateAuthorityData = cluster?.["certificate-authority-data"];
+  const certificate = pem(user?.["client-certificate-data"]);
+  const key = pem(user?.["client-key-data"]);
+  if (endpoint === undefined || certificateAuthorityData === undefined || pem(certificateAuthorityData) === undefined || certificate === undefined || key === undefined) {
+    return;
+  }
+  return { certificateAuthorityData, clientCert: { certificate, key }, endpoint };
+};
+
+// src/talos/cluster-transport.ts
+var talosVaultLocation = (props) => ({
+  context: props.context,
+  key: props.kubeconfigKey ?? DEFAULT_KUBECONFIG_KEY,
+  mount: props.target.mount
+});
+var talosOpenBaoCluster = (props, pin) => ({
+  ...talosVaultLocation(props),
+  uid: pin.uid,
+  ...pin.retired === true ? { retired: true } : {}
+});
+var CONNECT_TIMEOUT = Duration3.seconds(10);
+var withConnectDeadline = (cluster, effect, timeout = CONNECT_TIMEOUT) => effect.pipe(Effect5.timeoutOrElse({
+  duration: timeout,
+  orElse: () => Effect5.fail(new TalosOpenBaoConnectTimeout({ cluster, seconds: Duration3.toSeconds(timeout) }))
+}));
+var openTransport = (config) => Effect5.gen(function* () {
+  const { context, key, mount } = config;
+  const raw = yield* readKvValue(mount, key, ["kubeconfig", "config"]).pipe(Effect5.mapError((error) => isVaultKeyAbsent(error) ? new TalosVaultKeyMissing({ key, mount }) : error));
+  const material = yield* Effect5.sync(() => kubeconfigTransport(raw, context));
+  if (material === undefined) {
+    return yield* Effect5.fail(new TalosKubeconfigUnreadable({ context, key, mount }));
+  }
+  return { ...material, headers: Effect5.succeed({}) };
+});
+
+// src/talos/cluster-adapter.ts
+var talosOpenBaoConnection = (uid) => {
+  if (typeof uid !== "string" || uid === "")
+    throw new TalosUidNotLiteral({});
+  return { auth: { kind: "talos-openbao", uid } };
+};
+var connectTalosOpenBao = (configs, connection, timeout = CONNECT_TIMEOUT) => Effect6.gen(function* () {
+  if (connection === undefined || connection === null) {
+    return yield* Effect6.fail(new TalosClusterIdentityMissing({}));
+  }
+  const { auth } = connection;
+  if (auth === undefined || auth === null) {
+    return yield* Effect6.fail(new TalosClusterIdentityMissing({}));
+  }
+  if (auth.kind !== "talos-openbao") {
+    return yield* Effect6.fail(new TalosOpenBaoAuthKind({ kind: auth.kind }));
+  }
+  if (Object.hasOwn(auth, "cluster")) {
+    return yield* Effect6.fail(new TalosOpenBaoLegacyAuth({}));
+  }
+  const { uid } = auth;
+  if (typeof uid !== "string" || uid === "") {
+    return yield* Effect6.fail(new TalosClusterIdentityMissing({}));
+  }
+  const matches = Object.entries(configs).filter(([, entry]) => entry.uid === uid);
+  const [match] = matches;
+  if (match === undefined) {
+    return yield* Effect6.fail(new TalosOpenBaoUnknownCluster({
+      known: Object.values(configs).map((entry) => entry.uid),
+      uid
+    }));
+  }
+  if (matches.length > 1) {
+    return yield* Effect6.fail(new TalosOpenBaoAmbiguousUid({ aliases: matches.map(([alias2]) => alias2), uid }));
+  }
+  const [alias, config] = match;
+  if (config.retired === true) {
+    return yield* Effect6.fail(new ClusterNotFoundError({ message: `talos-openbao cluster '${alias}' is retired` }));
+  }
+  return yield* withConnectDeadline(alias, Effect6.gen(function* () {
+    const transport = yield* openTransport(config);
+    yield* assertClusterUid(alias, uid, transport);
+    return transport;
+  }), timeout);
+});
+var TalosOpenBaoAdapter = (config) => Layer.effect(ClusterAdapter("talos-openbao"), Effect6.gen(function* () {
+  const context2 = yield* Effect6.context();
+  const service = {
+    kind: "Kubernetes.ClusterAdapter",
+    connect: (connection) => connectTalosOpenBao(config, connection).pipe(Effect6.provideContext(context2))
+  };
+  return service;
+}));
+// src/talos/kubeconfig.ts
+import { readFile } from "node:fs/promises";
+import { chmodSync } from "node:fs";
+import { Resource } from "alchemy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Effect9 from "effect/Effect";
 
 // src/talos/credentials-write.ts
-import * as Effect2 from "effect/Effect";
+import * as Effect7 from "effect/Effect";
+import * as Duration4 from "effect/Duration";
 import * as Stream2 from "effect/Stream";
+import { unlink as unlink2 } from "node:fs/promises";
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { tmpdir as tmpdir2 } from "node:os";
+import { join as join3 } from "node:path";
 import * as ChildProcess2 from "effect/process/ChildProcess";
 import * as ChildProcessSpawner3 from "effect/process/ChildProcessSpawner";
-var reservedTempPath = (label) => Effect2.gen(function* () {
-  const path = `${Bun.env["TMPDIR"] ?? "/tmp"}/hf-talos-${label}-${Bun.randomUUIDv7()}.yaml`;
-  yield* Effect2.addFinalizer(() => Effect2.tryPromise({ try: () => Bun.file(path).delete(), catch: () => {
+var reservedTempPath = (label) => Effect7.gen(function* () {
+  const path = join3(tmpdir2(), `hf-talos-${label}-${randomUUID2()}.yaml`);
+  yield* Effect7.addFinalizer(() => Effect7.tryPromise({ try: () => unlink2(path), catch: () => {
     return;
-  } }).pipe(Effect2.orElseSucceed(() => {
+  } }).pipe(Effect7.orElseSucceed(() => {
     return;
   })));
   return { path };
 });
-var writeKvValue = (mount, key, field, value) => Effect2.gen(function* () {
+var writeKvValue = (mount, key, field, value) => Effect7.gen(function* () {
   const spawner = yield* ChildProcessSpawner3.ChildProcessSpawner;
-  const result = yield* ChildProcess2.make("bao", ["kv", "put", `${mount}/${key}`, `${field}=-`], {
-    detached: false,
-    extendEnv: true,
+  const bao = yield* resolveBao();
+  const env = baoEnv();
+  if (env === undefined) {
+    return yield* Effect7.fail(new Error(`bao kv put ${mount}/${key} refused: BAO_ADDR and BAO_TOKEN must both be set. ` + "Without them bao would fall back to a cached login in the operator's home."));
+  }
+  const result = yield* ChildProcess2.make(bao, ["kv", "put", `${mount}/${key}`, `${field}=-`], {
+    env,
+    extendEnv: false,
+    forceKillAfter: Duration4.seconds(1),
     stderr: "pipe",
     stdin: Stream2.fromIterable([new TextEncoder().encode(value)]),
     stdout: "pipe"
-  }).pipe(spawner.spawn, Effect2.flatMap((child) => Effect2.all({
+  }).pipe(spawner.spawn, Effect7.flatMap((child) => Effect7.all({
     exitCode: child.exitCode,
-    stderr: child.stderr.pipe(Stream2.decodeText, Stream2.mkString, Effect2.map((text) => text.trim()))
-  }, { concurrency: "unbounded" })), Effect2.scoped);
+    stderr: child.stderr.pipe(Stream2.decodeText, Stream2.mkString, Effect7.map((text) => text.trim()))
+  }, { concurrency: "unbounded" })), Effect7.scoped);
   if (result.exitCode !== 0) {
-    return yield* Effect2.fail(new Error(`bao kv put ${mount}/${key} exited ${String(result.exitCode)}: ${result.stderr}`));
+    return yield* Effect7.fail(new Error(`bao kv put ${mount}/${key} exited ${String(result.exitCode)}: ${result.stderr}`));
   }
 });
 
@@ -93,12 +487,7 @@ var canonicalText = (text) => text.trimEnd();
 var sha256 = (text) => createHash("sha256").update(canonicalText(text)).digest("hex");
 var configDigest = (text) => sha256(text);
 var extractMachineConfigSpec = (wrapperYaml) => {
-  let doc;
-  try {
-    doc = Bun.YAML.parse(wrapperYaml);
-  } catch {
-    return;
-  }
+  let doc = parseYaml(wrapperYaml);
   if (Array.isArray(doc)) {
     if (doc.length !== 1)
       return;
@@ -110,12 +499,10 @@ var extractMachineConfigSpec = (wrapperYaml) => {
   return typeof spec === "string" ? spec : undefined;
 };
 var kubeconfigMetadata = (yamlText, contextName) => {
-  let doc;
-  try {
-    doc = Bun.YAML.parse(yamlText);
-  } catch {
+  const parsed = parseYaml(yamlText);
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
     return;
-  }
+  const doc = parsed;
   const ctx = doc.contexts?.find((row) => row.name === contextName)?.context;
   const clusterName = ctx?.cluster;
   const userName = ctx?.user;
@@ -140,10 +527,6 @@ var generation = (meta) => sha256(`${meta.context}
 ${meta.endpoint}
 ${meta.caFingerprint}
 ${meta.clientFingerprint}`);
-var UNWIRED_KUBECONFIG_PATH = "/talos-first-boot-unwired/wire-Kubernetes.ClusterAdapter-to-mintKubeconfig";
-var toConnection = (props) => ({
-  auth: { context: props.context, kind: "kubeconfig", path: UNWIRED_KUBECONFIG_PATH }
-});
 var buildAttrs = (raw, props) => {
   const meta = kubeconfigMetadata(raw, props.context);
   if (meta === undefined)
@@ -151,7 +534,6 @@ var buildAttrs = (raw, props) => {
   return {
     certificateAuthorityFingerprint: meta.caFingerprint,
     clientCertificateFingerprint: meta.clientFingerprint,
-    connection: toConnection(props),
     context: props.context,
     credentialGeneration: generation({ ...meta, context: props.context }),
     endpoint: meta.endpoint
@@ -159,23 +541,64 @@ var buildAttrs = (raw, props) => {
 };
 
 // src/talos/talosctl.ts
-import * as Effect3 from "effect/Effect";
+import * as Duration5 from "effect/Duration";
+import * as Effect8 from "effect/Effect";
 import * as Stream3 from "effect/Stream";
 import * as ChildProcess3 from "effect/process/ChildProcess";
 import * as ChildProcessSpawner5 from "effect/process/ChildProcessSpawner";
-
 class TalosError extends Error {
   command;
   exitCode;
-  constructor(command, exitCode, detail) {
-    super(`talosctl ${command} -> ${String(exitCode)}: ${detail}`);
+  constructor(command, exitCode, detail, binary = DEFAULT_TALOSCTL_BINARY) {
+    super(`${binary} ${command} -> ${String(exitCode)}: ${detail}`);
     this.command = command;
     this.exitCode = exitCode;
     this.name = "TalosError";
   }
 }
-var talosctl = (args, options) => Effect3.gen(function* () {
+var TALOSCTL_PINNED_VERSION = "v1.14.2";
+var talosctlBinary = (override) => {
+  const fromOption = override?.trim();
+  if (fromOption !== undefined && fromOption !== "")
+    return fromOption;
+  const fromEnv = process.env[TALOSCTL_BINARY_ENV]?.trim();
+  if (fromEnv !== undefined && fromEnv !== "")
+    return fromEnv;
+  return DEFAULT_TALOSCTL_BINARY;
+};
+var talosctlEnv = () => {
+  const env = {};
+  for (const name of ["PATH", "HOME", "TMPDIR"]) {
+    const value = process.env[name];
+    if (value !== undefined && value !== "")
+      env[name] = value;
+  }
+  return env;
+};
+var capture = (binary, argv) => Effect8.gen(function* () {
   const spawner = yield* ChildProcessSpawner5.ChildProcessSpawner;
+  return yield* ChildProcess3.make(binary, argv, {
+    env: talosctlEnv(),
+    extendEnv: false,
+    forceKillAfter: Duration5.seconds(1),
+    stderr: "pipe",
+    stdin: "ignore",
+    stdout: "pipe"
+  }).pipe(spawner.spawn, Effect8.flatMap((child) => Effect8.all({
+    exitCode: child.exitCode,
+    stderr: child.stderr.pipe(Stream3.decodeText, Stream3.mkString, Effect8.map((text) => text.trim())),
+    stdout: child.stdout.pipe(Stream3.decodeText, Stream3.mkString, Effect8.map((text) => text.trim()))
+  }, { concurrency: "unbounded" })), Effect8.scoped);
+});
+var reportsPinnedVersion = (stdout) => stdout.split(/[^\w.+-]+/).includes(TALOSCTL_PINNED_VERSION);
+var checkOverrideVersion = (binary, source) => capture(binary, ["version", "--client"]).pipe(Effect8.flatMap((out) => out.exitCode === 0 && reportsPinnedVersion(out.stdout) ? Effect8.void : Effect8.fail(new TalosBinaryRefused("version --client", `${source} is not talosctl ${TALOSCTL_PINNED_VERSION} (exit ${String(out.exitCode)})`, binary))));
+var talosctl = (args, options) => Effect8.gen(function* () {
+  const requested = talosctlBinary(options.binary);
+  const resolved = requested === DEFAULT_TALOSCTL_BINARY ? yield* resolveDefault(requested) : requested;
+  const fromOption = options.binary?.trim();
+  const source = requested === DEFAULT_TALOSCTL_BINARY ? "talosctl on PATH" : fromOption !== undefined && fromOption !== "" ? "the `binary` option" : TALOSCTL_BINARY_ENV;
+  const binary = yield* checkBinaryPath(resolved, source);
+  yield* checkOverrideVersion(binary, source);
   const argv = [
     ...args,
     "--talosconfig",
@@ -184,119 +607,108 @@ var talosctl = (args, options) => Effect3.gen(function* () {
     ...options.endpoints === undefined ? [] : ["--endpoints", options.endpoints.join(",")],
     ...options.insecure === true ? ["--insecure"] : []
   ];
-  const result = yield* ChildProcess3.make("talosctl", argv, {
-    detached: false,
-    extendEnv: true,
-    stderr: "pipe",
-    stdin: "ignore",
-    stdout: "pipe"
-  }).pipe(spawner.spawn, Effect3.flatMap((child) => Effect3.all({
-    exitCode: child.exitCode,
-    stderr: child.stderr.pipe(Stream3.decodeText, Stream3.mkString, Effect3.map((text) => text.trim())),
-    stdout: child.stdout.pipe(Stream3.decodeText, Stream3.mkString, Effect3.map((text) => text.trim()))
-  }, { concurrency: "unbounded" })), Effect3.scoped);
+  const result = yield* capture(binary, argv);
   const command = args.join(" ");
   if (result.exitCode !== 0) {
-    return yield* Effect3.fail(new TalosError(command, result.exitCode, result.stderr.slice(0, 300)));
+    return yield* Effect8.fail(new TalosError(command, result.exitCode, result.stderr.slice(0, 300), binary));
   }
   return result.stdout;
 });
-var talosctlOrAlready = (args, options) => talosctl(args, options).pipe(Effect3.catchIf((cause) => cause instanceof TalosError && cause.exitCode !== 0 && /already|exists|bootstrapped/i.test(cause.message), () => Effect3.succeed("")));
+var talosctlOrAlready = (args, options) => talosctl(args, options).pipe(Effect8.catchIf((cause) => cause instanceof TalosError && cause.exitCode !== 0 && /already|exists|bootstrapped/i.test(cause.message), () => Effect8.succeed("")));
 
 // src/talos/kubeconfig.ts
 var TalosKubeconfig = Resource("Talos.Kubeconfig");
-var isVaultKeyAbsent = (error) => error instanceof Error && /no value found at/i.test(error.message);
-var readVaultMeta = (props, key) => readKvValue(props.target.mount, key, ["kubeconfig", "config"]).pipe(Effect4.catchIf(isVaultKeyAbsent, () => Effect4.succeed(undefined)));
-var readKubeconfig = (props) => Effect4.gen(function* () {
+var readVaultMeta = (props, key) => readKvValue(props.target.mount, key, ["kubeconfig", "config"]).pipe(Effect9.catchIf(isVaultKeyAbsent, () => Effect9.succeed(undefined)));
+var readKubeconfig = (props) => Effect9.gen(function* () {
   const key = props.kubeconfigKey ?? DEFAULT_KUBECONFIG_KEY;
   const raw = yield* readVaultMeta(props, key);
   if (raw === undefined)
     return;
   const meta = buildAttrs(raw, props);
   if (meta === undefined) {
-    return yield* Effect4.fail(new Error(`${props.target.mount}/${key}: vault content exists but does not parse as a kubeconfig ` + `for context ${props.context} — not a cold start. Fix the KV entry or the pinned ` + "context rather than trusting an empty read."));
+    return yield* Effect9.fail(new Error(`${props.target.mount}/${key}: vault content exists but does not parse as a kubeconfig ` + `for context ${props.context} — not a cold start. Fix the KV entry or the pinned ` + "context rather than trusting an empty read."));
   }
   return meta;
 });
-var diffKubeconfig = (news, output) => Effect4.gen(function* () {
+var diffKubeconfig = (news, output) => Effect9.gen(function* () {
   if (output === undefined || !isResolved(news))
     return;
   const live = yield* readKubeconfig(news);
-  if (live !== undefined && live.credentialGeneration === output.credentialGeneration && live.context === output.context && live.endpoint === output.endpoint) {
+  if (live !== undefined && live.credentialGeneration === output.credentialGeneration && live.context === output.context && !("connection" in output) && live.endpoint === output.endpoint) {
     return { action: "noop" };
   }
   return { action: "update" };
 });
-var reconcileKubeconfig = (props, output) => Effect4.scoped(Effect4.gen(function* () {
+var reconcileKubeconfig = (props, output) => Effect9.scoped(Effect9.gen(function* () {
   const key = props.kubeconfigKey ?? DEFAULT_KUBECONFIG_KEY;
   if (output !== undefined && output.credentialGeneration !== "") {
     const raw2 = yield* readKvValue(props.target.mount, key, ["kubeconfig", "config"]);
     const meta2 = buildAttrs(raw2, props);
     if (meta2 === undefined) {
-      return yield* Effect4.die(new Error(`${props.target.mount}/${key}: vault content no longer parses as a kubeconfig for ` + `context ${props.context}. Read back rather than trusting the write once.`));
+      return yield* Effect9.die(new Error(`${props.target.mount}/${key}: vault content no longer parses as a kubeconfig for ` + `context ${props.context}. Read back rather than trusting the write once.`));
     }
     return meta2;
   }
   const credential = yield* mintTalosconfig(props.target);
   const { path: outPath } = yield* reservedTempPath(`${props.target.cluster}-${props.node}-kubeconfig-out`);
   yield* talosctl(["kubeconfig", outPath, "--merge=false", "--force", "--force-context-name", props.context], { nodes: [props.node], talosconfigPath: credential.talosconfigPath });
-  const raw = yield* Effect4.tryPromise({
+  const raw = yield* Effect9.tryPromise({
     catch: (cause) => new Error(`${outPath}: reading generated kubeconfig: ${String(cause)}`),
-    try: () => Bun.file(outPath).text()
+    try: () => readFile(outPath, "utf8")
   });
   if (raw.trim() === "") {
-    return yield* Effect4.die(new Error(`${props.node}: talosctl kubeconfig returned no error but wrote an empty file. Read ` + "back rather than trusting the exit code alone."));
+    return yield* Effect9.die(new Error(`${props.node}: talosctl kubeconfig returned no error but wrote an empty file. Read ` + "back rather than trusting the exit code alone."));
   }
-  yield* Effect4.try({
+  yield* Effect9.try({
     catch: (cause) => new Error(`${outPath}: chmod 0600: ${String(cause)}`),
     try: () => chmodSync(outPath, 384)
   });
   const meta = buildAttrs(raw, props);
   if (meta === undefined) {
-    return yield* Effect4.die(new Error(`${props.node}: talosctl kubeconfig wrote a file that does not parse for context ` + `${props.context}.`));
+    return yield* Effect9.die(new Error(`${props.node}: talosctl kubeconfig wrote a file that does not parse for context ` + `${props.context}.`));
   }
   yield* writeKvValue(props.target.mount, key, "kubeconfig", raw);
   return meta;
 }));
 var handlers = {
-  delete: () => Effect4.void,
+  delete: () => Effect9.void,
   diff: ({
     news,
     output
   }) => diffKubeconfig(news, output),
-  list: () => Effect4.succeed([]),
+  list: () => Effect9.succeed([]),
   read: ({ olds }) => readKubeconfig(olds),
   reconcile: ({
     news,
     output
   }) => reconcileKubeconfig(news, output)
 };
-var TalosKubeconfigProvider = () => Provider.effect(TalosKubeconfig, Effect4.succeed(TalosKubeconfig.Provider.of(handlers)));
+var TalosKubeconfigProvider = () => Provider.effect(TalosKubeconfig, Effect9.succeed(TalosKubeconfig.Provider.of(handlers)));
 // src/talos/talos-bootstrap.ts
 import { Resource as Resource2 } from "alchemy";
 import { isResolved as isResolved2 } from "alchemy/Diff";
 import * as Provider2 from "alchemy/Provider";
-import * as Effect6 from "effect/Effect";
+import * as Effect11 from "effect/Effect";
 
 // src/talos/talos-bootstrap-etcd.ts
-import * as Effect5 from "effect/Effect";
+import * as Effect10 from "effect/Effect";
 
 // src/talos/talos-errors.ts
-import * as Data from "effect/Data";
+import * as Data2 from "effect/Data";
 
-class TalosConfigDigestMismatch extends Data.TaggedError("TalosConfigDigestMismatch") {
+class TalosConfigDigestMismatch extends Data2.TaggedError("TalosConfigDigestMismatch") {
   get message() {
     return `${this.mount}/${this.key}: live content digest ${this.got} does not match the pinned ` + `configDigest ${this.expected}. Fail closed — nothing was sent to talosctl. Either the KV ` + "value was rewritten without a matching PR, or the pinned digest is stale; check which one " + "moved before re-pinning either side.";
   }
 }
 
-class TalosConvergenceTimeout extends Data.TaggedError("TalosConvergenceTimeout") {
+class TalosConvergenceTimeout extends Data2.TaggedError("TalosConvergenceTimeout") {
   get message() {
     return `${this.node}: apply-config (--mode ${this.mode}) was accepted but the live machineconfig ` + `digest never matched the pin within ${this.attempts} bounded poll attempts. Refusing to ` + "report converged — hand this node to the operator rather than silently pass.";
   }
 }
 
-class TalosReBootstrapRefused extends Data.TaggedError("TalosReBootstrapRefused") {
+class TalosReBootstrapRefused extends Data2.TaggedError("TalosReBootstrapRefused") {
   get message() {
     return `${this.node}: state already recorded a successful bootstrap, and a live check could not ` + `reconfirm it (${this.detail}). Refusing to run 'talosctl bootstrap' again — that risks a ` + "second, isolated etcd cluster on a reset node. This needs an operator, not a reconcile.";
   }
@@ -306,28 +718,28 @@ class TalosReBootstrapRefused extends Data.TaggedError("TalosReBootstrapRefused"
 var isBootstrapped = (props, talosconfigPath) => talosctl(["get", "etcdmembers", "-o", "json"], {
   nodes: [props.node],
   talosconfigPath
-}).pipe(Effect5.map((text) => text.includes('"id"') || text.includes('"member"')));
-var assertNoLivePeers = (props, talosconfigPath) => Effect5.all((props.peers ?? []).map((peer) => isBootstrapped({ ...props, node: peer }, talosconfigPath).pipe(Effect5.matchEffect({
-  onFailure: (cause) => Effect5.fail(new TalosReBootstrapRefused({
+}).pipe(Effect10.map((text) => text.includes('"id"') || text.includes('"member"')));
+var assertNoLivePeers = (props, talosconfigPath) => Effect10.all((props.peers ?? []).map((peer) => isBootstrapped({ ...props, node: peer }, talosconfigPath).pipe(Effect10.matchEffect({
+  onFailure: (cause) => Effect10.fail(new TalosReBootstrapRefused({
     detail: `peer ${peer}: live read failed before bootstrap: ${String(cause)}`,
     node: props.node
   })),
-  onSuccess: (hasMembers) => hasMembers ? Effect5.fail(new TalosReBootstrapRefused({
+  onSuccess: (hasMembers) => hasMembers ? Effect10.fail(new TalosReBootstrapRefused({
     detail: `peer ${peer} already reports etcd members — a cluster may already exist; ` + "refusing to bootstrap a second one",
     node: props.node
-  })) : Effect5.void
+  })) : Effect10.void
 }))), { discard: true });
 
 // src/talos/talos-bootstrap.ts
 var TalosBootstrap = Resource2("Talos.Bootstrap", {
   defaultRemovalPolicy: "retain"
 });
-var readBootstrap = (props) => Effect6.scoped(Effect6.gen(function* () {
+var readBootstrap = (props) => Effect11.scoped(Effect11.gen(function* () {
   const credential = yield* mintTalosconfig(props.target);
   const bootstrapped = yield* isBootstrapped(props, credential.talosconfigPath);
   return bootstrapped ? { bootstrapped: true, node: props.node } : undefined;
 }));
-var diffBootstrap = (news, output) => Effect6.gen(function* () {
+var diffBootstrap = (news, output) => Effect11.gen(function* () {
   if (output === undefined || !isResolved2(news))
     return;
   if (output.bootstrapped)
@@ -335,15 +747,15 @@ var diffBootstrap = (news, output) => Effect6.gen(function* () {
   const live = yield* readBootstrap(news);
   return live?.bootstrapped === true ? { action: "noop" } : { action: "update" };
 });
-var reconcileBootstrap = (props, output) => Effect6.scoped(Effect6.gen(function* () {
+var reconcileBootstrap = (props, output) => Effect11.scoped(Effect11.gen(function* () {
   const credential = yield* mintTalosconfig(props.target);
   if (output?.bootstrapped === true) {
-    const stillBootstrapped = yield* isBootstrapped(props, credential.talosconfigPath).pipe(Effect6.catchIf(() => true, (cause) => Effect6.fail(new TalosReBootstrapRefused({
+    const stillBootstrapped = yield* isBootstrapped(props, credential.talosconfigPath).pipe(Effect11.catchIf(() => true, (cause) => Effect11.fail(new TalosReBootstrapRefused({
       detail: `live read failed: ${String(cause)}`,
       node: props.node
     }))));
     if (!stillBootstrapped) {
-      return yield* Effect6.fail(new TalosReBootstrapRefused({
+      return yield* Effect11.fail(new TalosReBootstrapRefused({
         detail: "etcd members are absent on a live read against already-bootstrapped state",
         node: props.node
       }));
@@ -360,31 +772,104 @@ var reconcileBootstrap = (props, output) => Effect6.scoped(Effect6.gen(function*
   }
   const after = yield* isBootstrapped(props, credential.talosconfigPath);
   if (!after) {
-    return yield* Effect6.die(new Error(`${props.node}: bootstrap returned no error but etcd members are still absent. ` + "Read back rather than trusting the exit code alone."));
+    return yield* Effect11.die(new Error(`${props.node}: bootstrap returned no error but etcd members are still absent. ` + "Read back rather than trusting the exit code alone."));
   }
   return { bootstrapped: true, node: props.node };
 }));
 var handlers2 = {
-  delete: () => Effect6.void,
+  delete: () => Effect11.void,
   diff: ({
     news,
     output
   }) => diffBootstrap(news, output),
-  list: () => Effect6.succeed([]),
+  list: () => Effect11.succeed([]),
   read: ({ olds }) => readBootstrap(olds),
   reconcile: ({
     news,
     output
   }) => reconcileBootstrap(news, output)
 };
-var TalosBootstrapProvider = () => Provider2.effect(TalosBootstrap, Effect6.succeed(TalosBootstrap.Provider.of(handlers2)));
-// src/talos/talos-cluster-health.ts
+var TalosBootstrapProvider = () => Provider2.effect(TalosBootstrap, Effect11.succeed(TalosBootstrap.Provider.of(handlers2)));
+// src/talos/talos-cluster-identity.ts
 import { Resource as Resource3 } from "alchemy";
 import { isResolved as isResolved3 } from "alchemy/Diff";
 import * as Provider3 from "alchemy/Provider";
-import * as Effect7 from "effect/Effect";
-var TalosClusterHealth = Resource3("Talos.ClusterHealth");
+import * as Effect12 from "effect/Effect";
+var TalosClusterIdentity = Resource3("Talos.ClusterIdentity");
+var readClusterIdentity = (props, output) => Effect12.gen(function* () {
+  const cluster = props.target.cluster;
+  const uid = yield* withConnectDeadline(cluster, Effect12.gen(function* () {
+    const transport = yield* openTransport(talosVaultLocation(props));
+    return yield* readClusterUid(cluster, transport);
+  }));
+  if (output !== undefined && uid !== output.uid) {
+    return yield* Effect12.fail(new TalosClusterMoved({ cluster, live: uid, saved: output.uid }));
+  }
+  return { uid };
+});
+var reconcileClusterIdentity = (props, output) => readClusterIdentity(props, output);
+var diffClusterIdentity = (news, output) => Effect12.gen(function* () {
+  if (output === undefined || !isResolved3(news))
+    return;
+  yield* reconcileClusterIdentity(news, output);
+  return { action: "noop" };
+});
+var handlers3 = {
+  delete: () => Effect12.void,
+  diff: ({
+    news,
+    output
+  }) => diffClusterIdentity(news, output),
+  list: () => Effect12.succeed([]),
+  read: ({
+    olds,
+    output
+  }) => readClusterIdentity(olds, output),
+  reconcile: ({
+    news,
+    output
+  }) => reconcileClusterIdentity(news, output)
+};
+var TalosClusterIdentityProvider = () => Provider3.effect(TalosClusterIdentity, Effect12.succeed(TalosClusterIdentity.Provider.of(handlers3)));
+// src/talos/talos-cluster-health.ts
+import { Resource as Resource4 } from "alchemy";
+import { isResolved as isResolved4 } from "alchemy/Diff";
+import * as Provider4 from "alchemy/Provider";
+import * as Effect14 from "effect/Effect";
+
+// src/talos/literal-connection.ts
+import { hasUnresolvedInputs } from "alchemy/Diff";
+import * as Effect13 from "effect/Effect";
+var literalConnectionRefusal = (connection) => {
+  const auth = connection?.auth;
+  return hasUnresolvedInputs(connection) || auth?.kind !== "talos-openbao" || typeof auth?.uid !== "string" || auth.uid === "" ? new TalosUidNotLiteral({}) : undefined;
+};
+var withLiteralConnection = (resource) => new Proxy(resource, {
+  apply: (target, thisArg, args) => {
+    const refusal = (given) => literalConnectionRefusal(given?.connection);
+    const props = args[1];
+    if (Effect13.isEffect(props)) {
+      const checked = props.pipe(Effect13.flatMap((resolved) => {
+        const refused2 = refusal(resolved);
+        return refused2 === undefined ? Effect13.succeed(resolved) : Effect13.fail(refused2);
+      }));
+      return Reflect.apply(target, thisArg, [args[0], checked, ...args.slice(2)]);
+    }
+    const refused = refusal(props);
+    return refused === undefined ? Reflect.apply(target, thisArg, args) : Effect13.fail(refused);
+  }
+});
+
+// src/talos/talos-cluster-health.ts
+var TalosClusterHealth = withLiteralConnection(Resource4("Talos.ClusterHealth"));
 var nodeCsv = (nodes) => nodes === undefined || nodes.length === 0 ? "" : nodes.join(",");
+var attributes = (props, healthy) => ({
+  connection: props.connection,
+  controlPlaneNodes: nodeCsv(props.controlPlaneNodes),
+  healthy,
+  workerNodes: nodeCsv(props.workerNodes)
+});
+var sameConnection = (left, right) => right?.auth?.kind === left.auth.kind && right.auth.uid === left.auth.uid && !Object.hasOwn(right.auth, "cluster");
 var healthArgs = (props, waitTimeout) => {
   const args = ["health", "--wait-timeout", waitTimeout];
   const cp = nodeCsv(props.controlPlaneNodes);
@@ -395,79 +880,75 @@ var healthArgs = (props, waitTimeout) => {
     args.push("--worker-nodes", workers);
   return args;
 };
-var check = (props, waitTimeout) => Effect7.scoped(Effect7.gen(function* () {
+var check = (props, waitTimeout) => Effect14.scoped(Effect14.gen(function* () {
   const credential = yield* mintTalosconfig(props.target);
   const contact = props.controlPlaneNodes[0];
   if (contact === undefined) {
-    return yield* Effect7.fail(new Error(`Talos.ClusterHealth ${props.target.cluster}: controlPlaneNodes is empty — need at ` + "least one node to contact."));
+    return yield* Effect14.fail(new Error(`Talos.ClusterHealth ${props.target.cluster}: controlPlaneNodes is empty — need at ` + "least one node to contact."));
   }
   yield* talosctl(healthArgs(props, waitTimeout), {
     endpoints: [contact],
     nodes: [contact],
     talosconfigPath: credential.talosconfigPath
   });
-  return {
-    controlPlaneNodes: nodeCsv(props.controlPlaneNodes),
-    healthy: true,
-    workerNodes: nodeCsv(props.workerNodes)
-  };
+  return attributes(props, true);
 }));
 var isTalosError = (cause) => cause instanceof TalosError;
-var readClusterHealth = (props) => check(props, "5s").pipe(Effect7.catchIf(isTalosError, () => Effect7.succeed({
-  controlPlaneNodes: nodeCsv(props.controlPlaneNodes),
-  healthy: false,
-  workerNodes: nodeCsv(props.workerNodes)
-})));
-var diffClusterHealth = (news, output) => Effect7.gen(function* () {
-  if (output === undefined || !isResolved3(news))
+var readClusterHealth = (props) => check(props, "5s").pipe(Effect14.catchIf(isTalosError, () => Effect14.succeed(attributes(props, false))));
+var diffClusterHealth = (news, output) => Effect14.gen(function* () {
+  const refused = literalConnectionRefusal(news.connection);
+  if (refused !== undefined)
+    return yield* Effect14.fail(refused);
+  if (output === undefined || !isResolved4(news))
     return;
   const live = yield* readClusterHealth(news);
-  if (live.healthy)
+  if (live.healthy && sameConnection(live.connection, output.connection)) {
     return { action: "noop" };
+  }
   return { action: "update" };
 });
-var reconcileClusterHealth = (props) => check(props, props.waitTimeout ?? "20m0s").pipe(Effect7.catchIf(isTalosError, (cause) => Effect7.fail(new Error(`Talos.ClusterHealth ${props.target.cluster}: cluster not healthy within ` + `${props.waitTimeout ?? "20m0s"} — ${String(cause)}`))));
-var handlers3 = {
-  delete: () => Effect7.void,
+var reconcileClusterHealth = (props) => check(props, props.waitTimeout ?? "20m0s").pipe(Effect14.catchIf(isTalosError, (cause) => Effect14.fail(new Error(`Talos.ClusterHealth ${props.target.cluster}: cluster not healthy within ` + `${props.waitTimeout ?? "20m0s"} — ${String(cause)}`))));
+var handlers4 = {
+  delete: () => Effect14.void,
   diff: ({
     news,
     output
   }) => diffClusterHealth(news, output),
-  list: () => Effect7.succeed([]),
+  list: () => Effect14.succeed([]),
   read: ({ olds }) => readClusterHealth(olds),
   reconcile: ({ news }) => reconcileClusterHealth(news)
 };
-var TalosClusterHealthProvider = () => Provider3.effect(TalosClusterHealth, Effect7.succeed(TalosClusterHealth.Provider.of(handlers3)));
+var TalosClusterHealthProvider = () => Provider4.effect(TalosClusterHealth, Effect14.succeed(TalosClusterHealth.Provider.of(handlers4)));
 // src/talos/talos-machine-config.ts
-import { Resource as Resource4 } from "alchemy";
-import * as Provider4 from "alchemy/Provider";
-import * as Effect10 from "effect/Effect";
+import { Resource as Resource5 } from "alchemy";
+import * as Provider5 from "alchemy/Provider";
+import * as Effect17 from "effect/Effect";
 
 // src/talos/machine-config-read.ts
 import { Unowned } from "alchemy/AdoptPolicy";
-import { isResolved as isResolved4 } from "alchemy/Diff";
-import * as Effect8 from "effect/Effect";
+import { isResolved as isResolved5 } from "alchemy/Diff";
+import * as Effect15 from "effect/Effect";
 import * as Result from "effect/Result";
 var liveSpecDigest = (props, talosconfigPath) => talosctl(["get", "machineconfig", "v1alpha1", "-o", "yaml"], {
   endpoints: [props.node],
   nodes: [props.node],
   talosconfigPath
-}).pipe(Effect8.flatMap((wrapperYaml) => {
+}).pipe(Effect15.flatMap((wrapperYaml) => {
   const spec = extractMachineConfigSpec(wrapperYaml);
-  return spec === undefined ? Effect8.fail(new Error(`${props.node}: get machineconfig v1alpha1 returned no string 'spec' field — see ` + "values.ts extractMachineConfigSpec for the expected shape.")) : Effect8.succeed(configDigest(spec));
+  return spec === undefined ? Effect15.fail(new Error(`${props.node}: get machineconfig v1alpha1 returned no string 'spec' field — see ` + "values.ts extractMachineConfigSpec for the expected shape.")) : Effect15.succeed(configDigest(spec));
 }));
 var probeMaintenanceMode = (props, talosconfigPath) => talosctl(["version"], {
   endpoints: [props.node],
   insecure: true,
   nodes: [props.node],
   talosconfigPath
-}).pipe(Effect8.as(true), Effect8.orElseSucceed(() => false));
-var readMachineConfig = (props) => Effect8.scoped(Effect8.gen(function* () {
+}).pipe(Effect15.as(true), Effect15.orElseSucceed(() => false));
+var readMachineConfig = (props) => Effect15.scoped(Effect15.gen(function* () {
   const credential = yield* mintTalosconfig(props.target);
-  const outcome = yield* Effect8.result(liveSpecDigest(props, credential.talosconfigPath));
+  const outcome = yield* Effect15.result(liveSpecDigest(props, credential.talosconfigPath));
   if (Result.isFailure(outcome)) {
     const reachable = yield* probeMaintenanceMode(props, credential.talosconfigPath);
-    return reachable ? undefined : yield* Effect8.fail(outcome.failure);
+    return reachable ? undefined : yield* Effect15.fail(outcome.failure);
   }
   const attrs = {
     configDigest: props.configDigest,
@@ -477,8 +958,8 @@ var readMachineConfig = (props) => Effect8.scoped(Effect8.gen(function* () {
   };
   return attrs.converged === false ? Unowned(attrs) : attrs;
 }));
-var diffMachineConfig = (news, output) => Effect8.gen(function* () {
-  if (output === undefined || !isResolved4(news))
+var diffMachineConfig = (news, output) => Effect15.gen(function* () {
+  if (output === undefined || !isResolved5(news))
     return;
   const live = yield* readMachineConfig(news);
   if (live !== undefined && live.converged !== false)
@@ -487,40 +968,40 @@ var diffMachineConfig = (news, output) => Effect8.gen(function* () {
 });
 
 // src/talos/machine-config-poll.ts
-import * as Effect9 from "effect/Effect";
+import * as Effect16 from "effect/Effect";
 var isRebootish = (mode) => mode === "reboot" || mode === "auto";
 var POLICY = {
   immediate: { intervalMs: 2000, maxAttempts: 5 },
   rebootish: { intervalMs: 5000, maxAttempts: 24 }
 };
-var pollUntilMatch = (check2, policy) => Effect9.gen(function* () {
+var pollUntilMatch = (check2, policy) => Effect16.gen(function* () {
   for (let attempt = 1;attempt <= policy.maxAttempts; attempt++) {
-    const matched = yield* check2.pipe(Effect9.orElseSucceed(() => false));
+    const matched = yield* check2.pipe(Effect16.orElseSucceed(() => false));
     if (matched)
       return true;
     if (attempt < policy.maxAttempts)
-      yield* Effect9.sleep(policy.intervalMs);
+      yield* Effect16.sleep(policy.intervalMs);
   }
   return false;
 });
-var confirmConverged = (node, mode, check2, policies = POLICY) => Effect9.gen(function* () {
+var confirmConverged = (node, mode, check2, policies = POLICY) => Effect16.gen(function* () {
   const rebootish = isRebootish(mode);
   const policy = rebootish ? policies.rebootish : policies.immediate;
   const matched = yield* pollUntilMatch(check2, policy);
   if (!matched) {
-    return yield* Effect9.fail(new TalosConvergenceTimeout({ attempts: policy.maxAttempts, mode, node }));
+    return yield* Effect16.fail(new TalosConvergenceTimeout({ attempts: policy.maxAttempts, mode, node }));
   }
   return rebootish ? "accepted" : "read-back";
 });
 
 // src/talos/talos-machine-config.ts
-var TalosMachineConfig = Resource4("Talos.MachineConfig");
-var reconcileMachineConfig = (props, output, pollPolicies) => Effect10.scoped(Effect10.gen(function* () {
+var TalosMachineConfig = Resource5("Talos.MachineConfig");
+var reconcileMachineConfig = (props, output, pollPolicies) => Effect17.scoped(Effect17.gen(function* () {
   const mode = props.mode ?? "auto";
   const raw = yield* readKvValue(props.target.mount, props.configKey, ["config"]);
   const gotDigest = configDigest(raw);
   if (gotDigest !== props.configDigest) {
-    return yield* Effect10.fail(new TalosConfigDigestMismatch({
+    return yield* Effect17.fail(new TalosConfigDigestMismatch({
       expected: props.configDigest,
       got: gotDigest,
       key: props.configKey,
@@ -539,7 +1020,7 @@ var reconcileMachineConfig = (props, output, pollPolicies) => Effect10.scoped(Ef
     ...isCreate ? ["--insecure"] : []
   ];
   yield* talosctl(args, { nodes: [props.node], talosconfigPath: credential.talosconfigPath });
-  const converged = yield* confirmConverged(props.node, mode, liveSpecDigest(props, credential.talosconfigPath).pipe(Effect10.map((live) => live === props.configDigest)), pollPolicies);
+  const converged = yield* confirmConverged(props.node, mode, liveSpecDigest(props, credential.talosconfigPath).pipe(Effect17.map((live) => live === props.configDigest)), pollPolicies);
   return {
     configDigest: props.configDigest,
     converged,
@@ -547,30 +1028,51 @@ var reconcileMachineConfig = (props, output, pollPolicies) => Effect10.scoped(Ef
     node: props.node
   };
 }));
-var handlers4 = {
-  delete: () => Effect10.void,
+var handlers5 = {
+  delete: () => Effect17.void,
   diff: ({
     news,
     output
   }) => diffMachineConfig(news, output),
-  list: () => Effect10.succeed([]),
+  list: () => Effect17.succeed([]),
   read: ({ olds }) => readMachineConfig(olds),
   reconcile: ({
     news,
     output
   }) => reconcileMachineConfig(news, output)
 };
-var TalosMachineConfigProvider = () => Provider4.effect(TalosMachineConfig, Effect10.succeed(TalosMachineConfig.Provider.of(handlers4)));
+var TalosMachineConfigProvider = () => Provider5.effect(TalosMachineConfig, Effect17.succeed(TalosMachineConfig.Provider.of(handlers5)));
 export {
+  DEFAULT_TALOSCTL_BINARY,
+  TALOSCTL_BINARY_ENV,
   TalosBootstrap,
   TalosBootstrapProvider,
   TalosClusterHealth,
   TalosClusterHealthProvider,
+  TalosClusterIdentity,
+  TalosClusterIdentityMismatch,
+  TalosClusterIdentityMissing,
+  TalosClusterIdentityProvider,
+  TalosClusterIdentityTimeout,
+  TalosClusterIdentityUnreadable,
+  TalosClusterMoved,
   TalosKubeconfig,
   TalosKubeconfigProvider,
+  TalosKubeconfigUnreadable,
   TalosMachineConfig,
-  TalosMachineConfigProvider
+  TalosMachineConfigProvider,
+  TalosOpenBaoAdapter,
+  TalosOpenBaoAmbiguousUid,
+  TalosOpenBaoAuthKind,
+  TalosOpenBaoConnectTimeout,
+  TalosOpenBaoLegacyAuth,
+  TalosOpenBaoUnknownCluster,
+  TalosUidNotLiteral,
+  TalosVaultKeyMissing,
+  connectTalosOpenBao,
+  talosOpenBaoCluster,
+  talosOpenBaoConnection
 };
 
-//# debugId=33FF194E493FB6EF64756E2164756E21
+//# debugId=0069C805BB1B149764756E2164756E21
 //# sourceMappingURL=index.js.map