@homeflare/alchemy 0.47.1 → 0.48.0

package/src/talos/cluster-adapter-secrecy.test.ts

@@ -0,0 +1,243 @@
+/**
+ * `talos-openbao` secrecy and identity, through the real adapter and provider paths. Fake `bao`
+ * only. Asserts the persisted Connection is `{ kind, uid }` (so a vault-key rename cannot make
+ * upstream answer `replace` and delete same-named objects), and that no PEM marker, base64 key
+ * body or kubeconfig byte reaches attributes, error fields, disk or logs.
+ */
+import fs, { existsSync } from 'node:fs';
+import { expect, mock, spyOn, test } from 'bun:test';
+import { ClusterAdapter } from 'alchemy/Kubernetes/ClusterAdapter';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import * as Logger from 'effect/Logger';
+import * as References from 'effect/References';
+import * as ChildProcessSpawner from 'effect/process/ChildProcessSpawner';
+import {
+  TalosOpenBaoAdapter,
+  TalosVaultKeyMissing,
+  connectTalosOpenBao,
+  talosOpenBaoConnection,
+} from './cluster-adapter.ts';
+import { fakeApiServer } from './fake-apiserver.ts';
+import { readKvValue } from './credentials.ts';
+import { type FakeCall, type FakeHandler, fakeSpawner } from './fake-process.ts';
+import { buildAttrs } from './kubeconfig-attrs.ts';
+import { tmpdir } from 'node:os';
+
+const b64 = (text: string) => Buffer.from(text).toString('base64');
+const begin = (label: string) => `-----${'BEGIN'} ${label}-----`;
+const certBody = b64('not-a-cert');
+const keyBody = b64('not-a-key');
+const pemCert = `${begin('CERTIFICATE')}\n${certBody}\n`;
+const pemKey = `${begin('PRIVATE KEY')}\n${keyBody}\n`;
+const yaml = `apiVersion: v1
+kind: Config
+clusters:
+  - name: hf-c1
+    cluster: { server: 'https://192.0.2.50:6443', certificate-authority-data: ${b64(pemCert)} }
+contexts:
+  - name: admin@hf-c1
+    context: { cluster: hf-c1, user: admin@hf-c1 }
+users:
+  - name: admin@hf-c1
+    user: { client-certificate-data: ${b64(pemCert)}, client-key-data: ${b64(pemKey)} }
+`;
+const config = {
+  c1: { context: 'admin@hf-c1', key: 'kubeconfig', mount: 'talos-c1', uid: 'uid-c1' },
+};
+const vault: FakeHandler = () => ({
+  stdout: JSON.stringify({ data: { data: { kubeconfig: yaml } } }),
+});
+const spawner = (handler: FakeHandler, calls: FakeCall[] = []) =>
+  Layer.succeed(ChildProcessSpawner.ChildProcessSpawner, fakeSpawner(handler, calls));
+const provide = <A, E>(
+  effect: Effect.Effect<A, E, ChildProcessSpawner.ChildProcessSpawner>,
+  handler: FakeHandler,
+  calls: FakeCall[] = [],
+) => Effect.runPromise(Effect.provide(effect, spawner(handler, calls)));
+// ⚠️ EVERY ENCODING THE FIXTURE STORES, not just the PEM text: the kubeconfig carries
+//   `client-key-data: b64(pemKey)` and the PEM body is itself base64, so the stored field is b64 of
+//   a base64-wrapped body. Needles: the PEM markers and bodies, b64 of each PEM and of each body,
+//   and the raw YAML field values and whole document (an echoed document or field cannot slip by).
+const fieldValues = [b64(pemCert), b64(pemKey)];
+const needles = [
+  begin('CERTIFICATE'),
+  begin('PRIVATE KEY'),
+  certBody,
+  keyBody,
+  b64(certBody),
+  b64(keyBody),
+  b64(begin('PRIVATE KEY')),
+  ...fieldValues,
+  yaml,
+];
+const leaks = (text: string) => needles.filter((needle) => text.includes(needle));
+
+test('the persisted Connection is { kind, uid } and carries no vault path', () => {
+  // ★ buildAttrs persists no connection at all (kubeconfig-attrs.ts): only the identity resource
+  //   does, and its connection is a function of the cluster name and uid, never mount/key/context.
+  const attrs = buildAttrs(yaml, {
+    context: config.c1.context,
+    node: '198.51.100.10',
+    target: { cluster: 'c1', mount: config.c1.mount },
+  });
+  expect(Object.keys(attrs ?? {})).not.toContain('connection');
+  const a = JSON.stringify(talosOpenBaoConnection('uid-c1'));
+  expect(a).toBe('{"auth":{"kind":"talos-openbao","uid":"uid-c1"}}');
+  expect(a).not.toContain('kubeconfig');
+  expect(a).not.toContain('talos-c1');
+});
+
+test('connect through the layer leaves no PEM in tagged errors, temp files or logs', async () => {
+  // ★ Spies, not a before/after temp-dir listing: a write that is cleaned up again, or lands
+  //   outside tmpdir, still fails here. Anything carrying kubeconfig material is a leak.
+  const written: string[] = [];
+  const note = (data: unknown) => void written.push(String(data));
+  // ⚠️ credentials.ts and kubeconfig.ts use NAMED imports from node:fs, which a spy on the fs
+  //   default export never reaches (the earlier version of this test could not fail). So the module
+  //   itself is mocked, like fake-apiserver.ts does for node:https. mock.module is process-wide in
+  //   bun: only the three write entry points are replaced, and the real module goes back in finally.
+  const realFs = { ...fs };
+  const fakeFs = {
+    ...realFs,
+    openSync: () => {
+      throw new Error('openSync is not expected on the connect path');
+    },
+    writeFileSync: (_path: unknown, data: unknown) => note(data),
+  };
+  mock.module('node:fs', () => ({ ...fakeFs, default: fakeFs }));
+  const spies = [
+    spyOn(Bun, 'write').mockImplementation(((_d: unknown, data: unknown) => {
+      note(data);
+      return Promise.resolve(0);
+    }) as never),
+  ];
+  // ★ Effect.logDebug of raw bytes only shows when the level is "All" and a Logger captures it.
+  const logged: string[] = [];
+  const capture = Logger.layer([
+    Logger.make(({ message }) => void logged.push(JSON.stringify(message))),
+  ]);
+  const saved = { ...console };
+  for (const level of ['log', 'debug', 'info', 'warn', 'error'] as const) {
+    console[level] = (...args: unknown[]) => void logged.push(args.map(String).join(' '));
+  }
+  const api = fakeApiServer({ '192.0.2.50': 'uid-c1' });
+  try {
+    const run = (handler: FakeHandler) =>
+      Effect.runPromise(
+        Effect.gen(function* () {
+          const adapter = yield* ClusterAdapter('talos-openbao');
+          return yield* adapter.connect(talosOpenBaoConnection('uid-c1'));
+        }).pipe(
+          Effect.provide(TalosOpenBaoAdapter(config).pipe(Layer.provide(spawner(handler)))),
+          Effect.provide(capture),
+          Effect.provideService(References.MinimumLogLevel, 'All'),
+        ),
+      );
+    // ★ The success path also gets the whole document on stderr: a regression that logs or
+    //   surfaces bao's stderr on success shows up in `logged` below. The transport legitimately
+    //   holds the client key (inside `clientCert`, by contract), so the raw document is barred from
+    //   the whole transport and the PEM markers from everything but `clientCert`.
+    const transport = await run(() => ({ ...vault({} as FakeCall), stderr: yaml }));
+    const { clientCert, ...rest } = transport;
+    // ⚠️ JSON.stringify ESCAPES newlines, so the needle must be the escaped form: a raw-text needle
+    //   can never match a multi-line document and the assertion passes vacuously (measured
+    //   2026-10-06: a transport leaking the whole document in `clientCert` passed).
+    const escaped = (text: string) => JSON.stringify(text).slice(1, -1);
+    expect(JSON.stringify(transport)).not.toContain(escaped(yaml));
+    expect(JSON.stringify(transport)).not.toContain(escaped(yaml.split('\n')[0] ?? ''));
+    expect(JSON.stringify(transport)).not.toContain('apiVersion');
+    expect(JSON.stringify(rest)).not.toContain(begin('PRIVATE KEY'));
+    expect(JSON.stringify(rest)).not.toContain(begin('CERTIFICATE'));
+    expect(clientCert?.key).toContain(begin('PRIVATE KEY'));
+    const attempts = [
+      // ★ stdout carries the whole document on the failing exit: only stderr may surface.
+      run(() => ({
+        exitCode: 2,
+        stderr: 'No value found at talos-c1/data/kubeconfig',
+        stdout: yaml,
+      })),
+      run(() => ({ stdout: `${yaml} not json` })),
+      run(() => ({ stdout: JSON.stringify({ data: { data: { kubeconfig: pemKey } } }) })),
+    ];
+    const failures = await Promise.all(attempts.map((attempt) => attempt.catch((e: unknown) => e)));
+    expect(failures[0]).toBeInstanceOf(TalosVaultKeyMissing);
+    for (const failure of failures) {
+      const text = JSON.stringify(failure, Object.getOwnPropertyNames(failure as object));
+      expect(leaks(`${text}${String(failure)}`)).toEqual([]);
+    }
+  } finally {
+    Object.assign(console, saved);
+    api.restore();
+    for (const spy of spies) spy.mockRestore();
+    mock.module('node:fs', () => ({ ...realFs, default: realFs }));
+  }
+  expect(leaks(logged.join('\n'))).toEqual([]);
+  expect(written).toEqual([]);
+});
+
+test('Effect.logDebug of raw bytes is caught by the capturing logger (the probe can fail)', async () => {
+  const logged: string[] = [];
+  const capture = Logger.make(({ message }) => void logged.push(JSON.stringify(message)));
+  await Effect.runPromise(
+    Effect.logDebug(pemKey).pipe(
+      Effect.provide(Logger.layer([capture])),
+      Effect.provideService(References.MinimumLogLevel, 'All'),
+    ),
+  );
+  expect(leaks(logged.join('\n'))).not.toEqual([]);
+});
+
+test('bao is refused without BAO_ADDR and BAO_TOKEN, and gets a minimal env', async () => {
+  const saved = { addr: process.env['BAO_ADDR'], token: process.env['BAO_TOKEN'] };
+  process.env['HOME_SECRET_PROBE'] = 'x';
+  try {
+    delete process.env['BAO_TOKEN'];
+    const calls: FakeCall[] = [];
+    await expect(
+      provide(readKvValue('talos-c1', 'kubeconfig', ['kubeconfig']), vault, calls),
+    ).rejects.toThrow(/BAO_ADDR and BAO_TOKEN/);
+    expect(calls).toEqual([]);
+    process.env['BAO_TOKEN'] = saved.token ?? 'fake-test-token';
+    const cmds: Record<string, unknown>[] = [];
+    const layer = ChildProcessSpawner.make((cmd) => {
+      if (cmd._tag === 'StandardCommand') cmds.push({ ...cmd.options });
+      return fakeSpawner(vault).spawn(cmd);
+    });
+    await Effect.runPromise(
+      Effect.provideService(
+        readKvValue('talos-c1', 'kubeconfig', ['kubeconfig']),
+        ChildProcessSpawner.ChildProcessSpawner,
+        layer,
+      ),
+    );
+    const env = cmds[0]?.['env'] as Record<string, string>;
+    expect(cmds[0]?.['extendEnv']).toBe(false);
+    expect(Object.keys(env)).not.toContain('HOME_SECRET_PROBE');
+  } finally {
+    delete process.env['HOME_SECRET_PROBE'];
+    if (saved.token === undefined) delete process.env['BAO_TOKEN'];
+    else process.env['BAO_TOKEN'] = saved.token;
+  }
+});
+
+test('non-JSON bao output never quotes its bytes', async () => {
+  const error = await provide(readKvValue('talos-c1', 'kubeconfig', ['kubeconfig']), () => ({
+    stdout: `${pemKey}{`,
+  })).catch((e: unknown) => e);
+  const message = String((error as Error).message);
+  expect(message).toContain('not JSON');
+  expect(leaks(message)).toEqual([]);
+  expect(message).not.toContain('Unexpected');
+});
+
+test('connect fails with the typed adapter error when the kind mismatches', async () => {
+  const outcome = await provide(
+    connectTalosOpenBao(config, { auth: { kind: 'token', token: 'not-a-token' } }).pipe(
+      Effect.catchTag('TalosOpenBaoAuthKind', () => Effect.succeed('mismatch')),
+    ),
+    vault,
+  );
+  expect(outcome).toBe('mismatch');
+  expect(existsSync(`${tmpdir()}/talos-openbao`)).toBe(false);
+});

package/src/talos/cluster-adapter.fixtures.ts

@@ -0,0 +1,125 @@
+/**
+ * Shared fixtures for the `talos-openbao` adapter tests that go THROUGH the real upstream
+ * `ManifestProvider` / `HelmChartProvider`: a fake `bao` vault, per-cluster kubeconfigs, the
+ * uid-pinned adapter config and the provider runners. The fake apiserver is `fake-apiserver.ts`.
+ */
+import { HelmChart, HelmChartProvider } from 'alchemy/Kubernetes/HelmChart';
+import { Manifest, ManifestProvider } from 'alchemy/Kubernetes/Manifest';
+import * as Provider from 'alchemy/Provider';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import * as ChildProcessSpawner from 'effect/process/ChildProcessSpawner';
+import { TalosOpenBaoAdapter } from './cluster-adapter.ts';
+import { type FakeCall, type FakeHandler, fakeSpawner } from './fake-process.ts';
+
+const b64 = (text: string) => Buffer.from(text).toString('base64');
+const pem = (label: string) => `-----${'BEGIN'} ${label}-----\n${b64(label)}\n`;
+const kubeconfig = (name: string, server: string) => `apiVersion: v1
+kind: Config
+clusters:
+  - name: ${name}
+    cluster: { server: '${server}', certificate-authority-data: ${b64(pem('CERTIFICATE'))} }
+contexts:
+  - name: admin@${name}
+    context: { cluster: ${name}, user: admin@${name} }
+users:
+  - name: admin@${name}
+    user: { client-certificate-data: ${b64(pem('CERTIFICATE'))}, client-key-data: ${b64(pem('PRIVATE KEY'))} }
+`;
+
+/** Fake `bao kv get`: `talos-<name>` answers a kubeconfig for `<name>.cluster.invalid`. */
+export const vault: FakeHandler = (call: FakeCall) => {
+  const path = call.args.at(-1) ?? '';
+  const [mount] = path.split('/');
+  if (mount === 'talos-gone') {
+    return { exitCode: 2, stderr: 'No value found at talos-gone/data/kubeconfig' };
+  }
+  const name = mount?.replace('talos-', '') ?? '';
+  return {
+    stdout: JSON.stringify({
+      data: { data: { kubeconfig: kubeconfig(name, `https://${name}.cluster.invalid:6443`) } },
+    }),
+  };
+};
+
+type Entry = {
+  readonly context: string;
+  readonly key: string;
+  readonly mount: string;
+  readonly uid: string;
+  readonly retired?: boolean;
+};
+export type Config = Readonly<Record<string, Entry>>;
+
+export const config = {
+  c1: { context: 'admin@c1', key: 'kubeconfig', mount: 'talos-c1', uid: 'uid-c1' },
+  c2: { context: 'admin@c2', key: 'kubeconfig', mount: 'talos-c2', uid: 'uid-c2' },
+  gone: {
+    context: 'admin@gone',
+    key: 'kubeconfig',
+    mount: 'talos-gone',
+    retired: true,
+    uid: 'uid-gone',
+  },
+} satisfies Config;
+/** Each physical cluster's kube-system uid, by apiserver host. */
+export const UIDS = { 'c1.cluster.invalid': 'uid-c1', 'c2.cluster.invalid': 'uid-c2' };
+
+const layer = (adapterConfig: Config) =>
+  Layer.mergeAll(
+    ManifestProvider(),
+    HelmChartProvider(),
+    TalosOpenBaoAdapter(adapterConfig).pipe(
+      Layer.provide(Layer.succeed(ChildProcessSpawner.ChildProcessSpawner, fakeSpawner(vault))),
+    ),
+  );
+
+/** The layer an engine-level test provides: upstream providers plus the adapter. */
+export const providerLayer = layer;
+
+const withProvider = (
+  resource: { Type: string },
+  body: (service: never) => Effect.Effect<unknown, unknown, never>,
+  adapterConfig: Config,
+) =>
+  Effect.runPromise(
+    Effect.gen(function* () {
+      const service = yield* Provider.Provider<never>(resource.Type as never);
+      return yield* body(service as never);
+    }).pipe(Effect.provide(layer(adapterConfig))) as unknown as Effect.Effect<unknown, unknown>,
+  );
+
+type Body<R extends Manifest | HelmChart> = (
+  s: Provider.ProviderService<R>,
+) => Effect.Effect<unknown, unknown, never>;
+export const manifestApi = (body: Body<Manifest>, adapterConfig: Config = config) =>
+  withProvider(Manifest, body as never, adapterConfig) as Promise<unknown>;
+export const helmApi = (body: Body<HelmChart>, adapterConfig: Config = config) =>
+  withProvider(HelmChart, body as never, adapterConfig) as Promise<unknown>;
+
+export const session = { note: () => Effect.void } as never;
+
+export const manifestRow = (auth: { cluster?: string; uid?: string }, name = 'ns-c1') => ({
+  apiVersion: 'v1',
+  connection: { auth: { kind: 'talos-openbao', ...auth } },
+  kind: 'Namespace',
+  name,
+  namespace: undefined,
+  ref: { apiVersion: 'v1', kind: 'Namespace', name },
+  uid: 'u1',
+});
+export const helmRow = (auth: { uid?: string }) => ({
+  chart: 'oci://example.invalid/chart',
+  code: { hash: 'h' },
+  connection: { auth: { kind: 'talos-openbao', ...auth } },
+  namespace: 'default',
+  objects: [{ apiVersion: 'v1', kind: 'Namespace', name: 'ns-c1' }],
+  releaseName: 'r',
+  version: '1',
+});
+
+export const failure = (run: () => Promise<unknown>) =>
+  run().then(
+    () => 'resolved',
+    (error: unknown) => String(error),
+  );

package/src/talos/cluster-adapter.test.ts

@@ -0,0 +1,240 @@
+/**
+ * `talos-openbao` connect, offline. Fake `bao` only — no vault, no cluster, no kubeconfig on disk.
+ */
+import type { ClusterLike, Connection } from 'alchemy/Kubernetes/Connection';
+import { ClusterAdapter, ClusterNotFoundError } from 'alchemy/Kubernetes/ClusterAdapter';
+import { type HelmChart } from 'alchemy/Kubernetes/HelmChart';
+import { type Manifest } from 'alchemy/Kubernetes/Manifest';
+import { expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+import * as ChildProcessSpawner from 'effect/process/ChildProcessSpawner';
+import {
+  TalosOpenBaoAdapter,
+  connectTalosOpenBao,
+  talosOpenBaoConnection,
+} from './cluster-adapter.ts';
+import { fakeApiServer } from './fake-apiserver.ts';
+import { type FakeCall, type FakeHandler, fakeSpawner } from './fake-process.ts';
+import { buildAttrs } from './kubeconfig-attrs.ts';
+import type { ClusterHealthAttributes } from './talos-cluster-health.ts';
+
+type HealthIsClusterLike = ClusterHealthAttributes extends ClusterLike ? true : never;
+const healthIsClusterLike: HealthIsClusterLike = true;
+
+const beginLine = (label: string) => `-----${'BEGIN'} ${label}-----`;
+const armor = (label: string, body: string) =>
+  `${beginLine(label)}\n${body}\n-----${'END'} ${label}-----\n`;
+const b64 = (text: string) => Buffer.from(text).toString('base64');
+// Fake bodies computed at runtime (base64 of fixed words) so no literal looks like a credential to gitleaks.
+const pemCert = armor('CERTIFICATE', b64('not-a-cert'));
+const pemKey = armor('PRIVATE KEY', b64('not-a-key'));
+
+/** The raw document contains the PEM markers (comments) and their base64 payloads. */
+const kubeconfigYaml = `# ${beginLine('CERTIFICATE')}
+# ${beginLine('PRIVATE KEY')}
+apiVersion: v1
+kind: Config
+clusters:
+  - name: hf-c1
+    cluster:
+      server: https://192.0.2.50:6443
+      certificate-authority-data: ${b64(pemCert)}
+contexts:
+  - name: admin@hf-c1
+    context: { cluster: hf-c1, user: admin@hf-c1 }
+users:
+  - name: admin@hf-c1
+    user:
+      client-certificate-data: ${b64(pemCert)}
+      client-key-data: ${b64(pemKey)}
+current-context: admin@hf-c1
+`;
+
+const config = {
+  c1: { context: 'admin@hf-c1', key: 'kubeconfig', mount: 'talos-c1', uid: 'uid-c1' },
+};
+const connection = talosOpenBaoConnection('uid-c1');
+
+const baoGet =
+  (stdout: string): FakeHandler =>
+  (call) => {
+    if (call.command !== 'bao' || call.args[1] !== 'get') {
+      throw new Error(`unexpected call ${call.command} ${call.args.join(' ')}`);
+    }
+    return { stdout };
+  };
+
+const provideBao = (handler: FakeHandler, calls: FakeCall[]) =>
+  Layer.succeed(ChildProcessSpawner.ChildProcessSpawner, fakeSpawner(handler, calls));
+
+/** Through the registered adapter, so a missing layer cannot pass this test. */
+const runAdapter = (target: Connection, handler: FakeHandler, calls: FakeCall[] = []) =>
+  Effect.runPromise(
+    Effect.gen(function* () {
+      const adapter = yield* ClusterAdapter('talos-openbao');
+      return yield* adapter.connect(target);
+    }).pipe(
+      Effect.provide(TalosOpenBaoAdapter(config).pipe(Layer.provide(provideBao(handler, calls)))),
+    ),
+  );
+
+/** Direct connect, so `catchTag` sees the typed error channel the layer's signature widens. */
+const runDirect = <A, E>(
+  effect: Effect.Effect<A, E, ChildProcessSpawner.ChildProcessSpawner>,
+  handler: FakeHandler,
+  calls: FakeCall[] = [],
+) =>
+  Effect.runPromise(
+    Effect.provideService(
+      effect,
+      ChildProcessSpawner.ChildProcessSpawner,
+      fakeSpawner(handler, calls),
+    ),
+  );
+
+const persisted = () => {
+  const attrs = buildAttrs(kubeconfigYaml, {
+    context: 'admin@hf-c1',
+    node: '198.51.100.10',
+    target: { cluster: 'c1', mount: 'talos-c1' },
+  });
+  if (attrs === undefined) throw new Error('fixture kubeconfig did not parse');
+  const helm = {
+    chart: 'oci://quay.io/cilium/charts/cilium',
+    code: { hash: 'abc' },
+    connection,
+    namespace: 'kube-system',
+    objects: [],
+    releaseName: 'cilium',
+    version: '1.20.2',
+  } satisfies HelmChart['Attributes'];
+  const manifest = {
+    apiVersion: 'v1',
+    connection,
+    kind: 'Namespace',
+    name: 'kube-system',
+    namespace: 'kube-system',
+    ref: { apiVersion: 'v1', kind: 'Namespace', name: 'kube-system' },
+    uid: undefined,
+  } satisfies Manifest['Attributes'];
+  return JSON.stringify({ helm, manifest, kubeconfig: attrs });
+};
+
+test('ClusterHealth attributes are ClusterLike', () => {
+  expect(healthIsClusterLike).toBe(true);
+});
+
+test('HelmChart and Manifest attributes carry no PEM and no sentinel path', () => {
+  expect(kubeconfigYaml).toContain('BEGIN CERTIFICATE');
+  expect(kubeconfigYaml).toContain('PRIVATE KEY');
+  const encoded = persisted();
+  expect(encoded).not.toContain('BEGIN CERTIFICATE');
+  expect(encoded).not.toContain('PRIVATE KEY');
+  expect(encoded).not.toContain(b64(pemCert));
+  expect(encoded).not.toContain(b64(pemKey));
+  expect(encoded).not.toContain('talos-first-boot-unwired');
+  expect(encoded).not.toContain('client-cert');
+  expect(encoded).toContain('talos-openbao');
+});
+
+test('connect reads the vault in memory and returns PEM only on the transport', async () => {
+  const calls: FakeCall[] = [];
+  const api = fakeApiServer({ '192.0.2.50': 'uid-c1' });
+  let transport: Awaited<ReturnType<typeof runAdapter>>;
+  try {
+    transport = await runAdapter(
+      connection,
+      baoGet(JSON.stringify({ data: { data: { kubeconfig: kubeconfigYaml } } })),
+      calls,
+    );
+  } finally {
+    api.restore();
+  }
+  expect(api.seen).toEqual(['GET 192.0.2.50/api/v1/namespaces/kube-system']);
+  expect(calls.map((call) => call.command)).toEqual(['bao']);
+  expect(calls[0]?.args[1]).toBe('get');
+  expect(calls[0]?.stdin).toBeUndefined();
+  expect(transport.endpoint).toBe('https://192.0.2.50:6443');
+  expect(transport.clientCert?.certificate).toContain('BEGIN CERTIFICATE');
+  expect(transport.clientCert?.key).toContain('PRIVATE KEY');
+  expect(await Effect.runPromise(transport.headers)).toEqual({});
+  expect(JSON.stringify(connection)).not.toContain('BEGIN CERTIFICATE');
+});
+
+const absent = () => ({ exitCode: 2, stderr: 'No value found at talos-c1/data/kubeconfig' });
+
+test('a missing key on a live cluster is the loud TalosVaultKeyMissing, not ClusterNotFound', async () => {
+  const message = await runDirect(
+    connectTalosOpenBao(config, connection).pipe(
+      Effect.catchTag('TalosVaultKeyMissing', (error) => Effect.succeed(error.message)),
+    ),
+    absent,
+  );
+  expect(message).toContain('talos-c1/kubeconfig');
+  expect(message).not.toContain('BEGIN CERTIFICATE');
+  let caught: unknown;
+  try {
+    await runAdapter(connection, absent);
+  } catch (error) {
+    caught = error;
+  }
+  expect(caught).not.toBeInstanceOf(ClusterNotFoundError);
+  expect(String(caught)).toContain('talos-c1/kubeconfig');
+});
+
+test('a retired pin is ClusterNotFoundError with no vault read', async () => {
+  const retired = { c1: { ...config.c1, retired: true } };
+  const calls: FakeCall[] = [];
+  const message = await runDirect(
+    connectTalosOpenBao(retired, connection).pipe(
+      Effect.catchTag('Kubernetes.ClusterNotFoundError', (error) => Effect.succeed(error.message)),
+    ),
+    absent,
+    calls,
+  );
+  expect(message).toContain('retired');
+  expect(calls).toEqual([]);
+});
+
+test('a vault denial is not reported as a missing key', async () => {
+  let caught: unknown;
+  try {
+    await runDirect(connectTalosOpenBao(config, connection), () => ({
+      exitCode: 1,
+      stderr: 'permission denied',
+    }));
+  } catch (error) {
+    caught = error;
+  }
+  expect(caught).toBeInstanceOf(Error);
+  expect(caught).not.toBeInstanceOf(ClusterNotFoundError);
+  expect(String(caught)).toContain('permission denied');
+  expect(String(caught)).toContain('talos-c1/kubeconfig');
+});
+
+test('an unreadable document fails without echoing PEM', async () => {
+  const secret = `${beginLine('PRIVATE KEY')}\nnot-a-document\n`;
+  const message = await runDirect(
+    connectTalosOpenBao(config, connection).pipe(
+      Effect.catchTag('TalosKubeconfigUnreadable', (error) => Effect.succeed(error.message)),
+    ),
+    baoGet(JSON.stringify({ data: { data: { kubeconfig: secret } } })),
+  );
+  expect(message).toContain('talos-c1/kubeconfig');
+  expect(message).toContain('admin@hf-c1');
+  expect(message).not.toContain('PRIVATE KEY');
+});
+
+test('a different auth kind never calls bao', async () => {
+  const calls: FakeCall[] = [];
+  const message = await runDirect(
+    connectTalosOpenBao(config, { auth: { kind: 'token', token: 'not-a-token' } }).pipe(
+      Effect.catchTag('TalosOpenBaoAuthKind', (error) => Effect.succeed(error.message)),
+    ),
+    baoGet('{}'),
+    calls,
+  );
+  expect(message).toContain('token');
+  expect(calls).toEqual([]);
+});