@cotal-ai/cli 0.11.6 → 0.12.0

package/dist/lib/backup-artifact.js

@@ -0,0 +1,290 @@
+import { createHash, randomUUID } from "node:crypto";
+import { closeSync, constants, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, readSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, writeSync, } from "node:fs";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { hardenPrivate, } from "@cotal-ai/core";
+export const BACKUP_MANIFEST_FORMAT = "cotal-space-backup/v1";
+const MAX_MANIFEST_BYTES = 1024 * 1024;
+const MAX_CHECKPOINT_BYTES = 16 * 1024 * 1024;
+const COPY_BUFFER_BYTES = 1024 * 1024;
+function fsyncDirectory(path) {
+    let fd;
+    try {
+        fd = openSync(path, constants.O_RDONLY);
+        fsyncSync(fd);
+    }
+    catch (error) {
+        if (process.platform !== "win32")
+            throw error;
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+function safeFileName(name) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,200}$/.test(name) || name === "manifest.json")
+        throw new Error(`invalid backup artifact file name ${JSON.stringify(name)}`);
+}
+function writeAll(fd, chunk) {
+    let offset = 0;
+    while (offset < chunk.byteLength) {
+        const written = writeSync(fd, chunk, offset, chunk.byteLength - offset);
+        if (written <= 0)
+            throw new Error("backup artifact write made no progress");
+        offset += written;
+    }
+}
+function sameDirectoryIdentity(path, identity) {
+    try {
+        const stat = lstatSync(path, { bigint: true });
+        return stat.isDirectory() && !stat.isSymbolicLink() && stat.dev === identity.dev && stat.ino === identity.ino;
+    }
+    catch {
+        return false;
+    }
+}
+export function createArtifactWriter(destination) {
+    const directory = resolve(destination);
+    try {
+        mkdirSync(directory, { mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code === "EEXIST")
+            throw new Error(`backup destination already exists: ${directory}`);
+        throw error;
+    }
+    let identity;
+    try {
+        // The artifact holds whole-stream snapshots (chat, DMs) — the most sensitive bytes we write.
+        // `hardenPrivate` reasserts 0700 on POSIX and sets the win32 ACL, where the create mode above is
+        // a no-op; the dir grant is inheritable, so every file written below is born private too.
+        hardenPrivate(directory, "dir");
+        fsyncDirectory(dirname(directory));
+        const stat = lstatSync(directory, { bigint: true });
+        identity = { dev: stat.dev, ino: stat.ino };
+    }
+    catch (error) {
+        // The directory was exclusively created by this call and nothing has been written into it:
+        // a failed post-create step must not leak it and block a same-destination retry.
+        try {
+            const current = lstatSync(directory, { bigint: true });
+            if (current.isDirectory() && !current.isSymbolicLink())
+                rmSync(directory, { recursive: true });
+        }
+        catch { /* already absent */ }
+        throw error;
+    }
+    let published = false;
+    return {
+        directory,
+        identity,
+        async writeFile(name, kind, source, stream) {
+            if (published)
+                throw new Error("backup manifest is already published");
+            safeFileName(name);
+            const path = join(directory, name);
+            const fd = openSync(path, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600);
+            const hash = createHash("sha256");
+            let size = 0;
+            try {
+                const write = (chunk) => {
+                    writeAll(fd, chunk);
+                    hash.update(chunk);
+                    size += chunk.byteLength;
+                };
+                if (typeof source === "string")
+                    write(Buffer.from(source));
+                else if (source instanceof Uint8Array)
+                    write(source);
+                else
+                    for await (const chunk of source)
+                        write(chunk);
+                fsyncSync(fd);
+                if (fstatSync(fd).size !== size)
+                    throw new Error(`backup artifact size mismatch after writing ${name}`);
+            }
+            finally {
+                closeSync(fd);
+            }
+            return { path: name, size, sha256: hash.digest("hex"), kind, ...(stream ? { stream } : {}) };
+        },
+        publish(input, files) {
+            if (published)
+                throw new Error("backup manifest is already published");
+            const manifest = {
+                format: BACKUP_MANIFEST_FORMAT,
+                createdAt: new Date().toISOString(),
+                ...input,
+                files: [...files].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0),
+            };
+            // The manifest is the completion marker, so it must appear ATOMICALLY: durable bytes first
+            // at a temp name, then one rename. A crash can never leave a truncated manifest.json.
+            const path = join(directory, "manifest.json");
+            const tmp = join(directory, `manifest.json.${process.pid}.${randomUUID()}.tmp`);
+            const fd = openSync(tmp, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600);
+            try {
+                writeFileSync(fd, `${JSON.stringify(manifest, null, 2)}\n`);
+                fsyncSync(fd);
+                closeSync(fd);
+            }
+            catch (error) {
+                try {
+                    closeSync(fd);
+                }
+                catch { /* already closed */ }
+                try {
+                    rmSync(tmp);
+                }
+                catch { /* best effort for the exclusively-created temp */ }
+                throw error;
+            }
+            renameSync(tmp, path);
+            fsyncDirectory(directory);
+            published = true;
+            return manifest;
+        },
+        cleanup() {
+            if (published || !sameDirectoryIdentity(directory, identity))
+                return;
+            rmSync(directory, { recursive: true });
+            fsyncDirectory(dirname(directory));
+        },
+    };
+}
+function parseManifest(path) {
+    const stat = lstatSync(path);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_MANIFEST_BYTES)
+        throw new Error(`backup manifest is not a bounded regular file: ${path}`);
+    const value = JSON.parse(readFileSync(path, "utf8"));
+    if (value.format !== BACKUP_MANIFEST_FORMAT)
+        throw new Error(`unsupported backup format ${JSON.stringify(value.format)}`);
+    if (!value.space || !["full", "registry"].includes(value.selection) || !["auth", "open", "user"].includes(value.mode))
+        throw new Error("backup manifest has invalid space, selection, or mode");
+    if (!Array.isArray(value.files) || !Array.isArray(value.streams) || typeof value.checkpoints !== "string")
+        throw new Error("backup manifest has invalid inventory");
+    safeFileName(value.checkpoints);
+    for (const stream of value.streams) {
+        if (!stream || typeof stream !== "object" || typeof stream.stream !== "string" || typeof stream.snapshot !== "string")
+            throw new Error("backup manifest has an invalid stream record");
+        safeFileName(stream.snapshot);
+    }
+    const keys = Object.keys(value).sort().join(",");
+    const expectedKeys = ["authority", "checkpoints", "createdAt", "files", "format", "mode", "selection", "source", "space", "streams"]
+        .filter((key) => key !== "authority" || value.authority !== undefined).sort().join(",");
+    if (keys !== expectedKeys || !Number.isFinite(Date.parse(value.createdAt)))
+        throw new Error("backup manifest has unknown fields or an invalid timestamp");
+    if (!value.source || typeof value.source.path !== "string" || !isAbsolute(value.source.path) ||
+        !/^\d+$/.test(value.source.dev) || !/^\d+$/.test(value.source.ino) ||
+        !/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value.source.generation))
+        throw new Error("backup manifest has an invalid source identity");
+    return value;
+}
+function copyPinnedFile(source, destination, expected) {
+    const pathStat = lstatSync(source);
+    if (!pathStat.isFile() || pathStat.isSymbolicLink())
+        throw new Error(`backup input is not a real file: ${source}`);
+    const noFollow = process.platform === "win32" ? 0 : constants.O_NOFOLLOW;
+    const sourceFd = openSync(source, constants.O_RDONLY | noFollow);
+    let destinationFd;
+    const hash = createHash("sha256");
+    let size = 0;
+    try {
+        const before = fstatSync(sourceFd, { bigint: true });
+        if (!before.isFile())
+            throw new Error(`backup input is not a regular file: ${source}`);
+        destinationFd = openSync(destination, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600);
+        const buffer = Buffer.allocUnsafe(COPY_BUFFER_BYTES);
+        for (;;) {
+            const count = readSync(sourceFd, buffer, 0, buffer.length, null);
+            if (count === 0)
+                break;
+            const chunk = buffer.subarray(0, count);
+            writeAll(destinationFd, chunk);
+            hash.update(chunk);
+            size += count;
+            if (size > expected.size)
+                throw new Error(`backup input grew while staging: ${source}`);
+        }
+        const after = fstatSync(sourceFd, { bigint: true });
+        if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeNs !== after.mtimeNs)
+            throw new Error(`backup input changed while staging: ${source}`);
+        if (size !== expected.size || hash.digest("hex") !== expected.sha256)
+            throw new Error(`backup input size or SHA-256 mismatch: ${source}`);
+        fsyncSync(destinationFd);
+        if (fstatSync(destinationFd).size !== size)
+            throw new Error(`staged backup size mismatch after writing ${destination}`);
+    }
+    finally {
+        if (destinationFd !== undefined)
+            closeSync(destinationFd);
+        closeSync(sourceFd);
+    }
+}
+/** Validate exact names and pin verified bytes into a private attempt directory before any mutation. */
+export function stageArtifact(artifactPath, parent) {
+    const artifact = resolve(artifactPath);
+    const artifactStat = lstatSync(artifact);
+    if (!artifactStat.isDirectory() || artifactStat.isSymbolicLink())
+        throw new Error(`backup artifact is not a real directory: ${artifact}`);
+    const manifest = parseManifest(join(artifact, "manifest.json"));
+    const expected = new Set(["manifest.json", ...manifest.files.map((file) => file.path)]);
+    const actual = readdirSync(artifact);
+    if (new Set(actual).size !== actual.length || actual.some((name) => !expected.has(name)) || actual.length !== expected.size)
+        throw new Error("backup artifact contains extra, duplicate, or missing files");
+    if (new Set(manifest.files.map((file) => file.path)).size !== manifest.files.length)
+        throw new Error("backup artifact file inventory contains duplicate paths");
+    for (const file of manifest.files) {
+        safeFileName(file.path);
+        if (!Number.isSafeInteger(file.size) || file.size < 0 || !/^[0-9a-f]{64}$/.test(file.sha256) ||
+            !["snapshot", "checkpoints"].includes(file.kind) ||
+            (file.kind === "snapshot") !== (typeof file.stream === "string"))
+            throw new Error(`backup file metadata is invalid: ${file.path}`);
+        if (file.kind === "checkpoints" && file.size > MAX_CHECKPOINT_BYTES)
+            throw new Error(`backup checkpoints exceed ${MAX_CHECKPOINT_BYTES} bytes`);
+    }
+    const checkpointFiles = manifest.files.filter((file) => file.kind === "checkpoints");
+    if (checkpointFiles.length !== 1 || checkpointFiles[0].path !== manifest.checkpoints)
+        throw new Error("backup manifest must name exactly one checkpoints file");
+    const snapshotFiles = new Map(manifest.files.filter((file) => file.kind === "snapshot").map((file) => [file.path, file.stream]));
+    if (snapshotFiles.size !== manifest.streams.length || manifest.streams.some((stream) => snapshotFiles.get(stream.snapshot) !== stream.stream))
+        throw new Error("backup stream records do not match snapshot file metadata");
+    const parentPath = realpathSync.native(resolve(parent));
+    const parentStat = lstatSync(parentPath, { bigint: true });
+    if (!parentStat.isDirectory() || parentStat.isSymbolicLink())
+        throw new Error(`restore staging parent is not a real directory: ${parentPath}`);
+    const parentIdentity = { dev: parentStat.dev, ino: parentStat.ino };
+    const directory = join(parentPath, `.cotal-restore-stage-${randomUUID()}`);
+    mkdirSync(directory, { mode: 0o700 });
+    hardenPrivate(directory, "dir"); // staged snapshots are the same secret bytes — private on win32 too
+    const identityStat = lstatSync(directory, { bigint: true });
+    const identity = { dev: identityStat.dev, ino: identityStat.ino };
+    try {
+        for (const file of manifest.files)
+            copyPinnedFile(join(artifact, file.path), join(directory, file.path), file);
+        writeFileSync(join(directory, "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`, { flag: "wx", mode: 0o600 });
+        fsyncDirectory(directory);
+    }
+    catch (error) {
+        if (sameDirectoryIdentity(parentPath, parentIdentity) && sameDirectoryIdentity(directory, identity))
+            rmSync(directory, { recursive: true });
+        throw error;
+    }
+    return {
+        manifest,
+        directory,
+        cleanup() {
+            if (sameDirectoryIdentity(parentPath, parentIdentity) && sameDirectoryIdentity(directory, identity))
+                rmSync(directory, { recursive: true });
+        },
+    };
+}
+export function readStagedCheckpoints(staged) {
+    const value = JSON.parse(readFileSync(join(staged.directory, staged.manifest.checkpoints), "utf8"));
+    if (!Array.isArray(value))
+        throw new Error("backup checkpoints must be an array");
+    return value;
+}
+export function snapshotFileName(stream) {
+    return `stream-${createHash("sha256").update(stream).digest("hex").slice(0, 24)}.snap`;
+}
+//# sourceMappingURL=backup-artifact.js.map

package/dist/lib/backup-artifact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-artifact.js","sourceRoot":"","sources":["../../src/lib/backup-artifact.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,UAAU,EACV,MAAM,EACN,QAAQ,EACR,aAAa,EACb,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EACL,aAAa,GAId,MAAM,gBAAgB,CAAC;AAIxB,MAAM,CAAC,MAAM,sBAAsB,GAAG,uBAAgC,CAAC;AACvE,MAAM,kBAAkB,GAAG,IAAI,GAAG,IAAI,CAAC;AACvC,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC9C,MAAM,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAAC;AAsCtC,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,MAAM,KAAK,CAAC;IAChD,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,eAAe;QAC9E,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,QAAQ,CAAC,EAAU,EAAE,KAAiB;IAC7C,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC;QACxE,IAAI,OAAO,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5E,MAAM,IAAI,OAAO,CAAC;IACpB,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,QAAsC;IACjF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,CAAC;IAChH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,SAAS,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YACpD,MAAM,IAAI,KAAK,CAAC,sCAAsC,SAAS,EAAE,CAAC,CAAC;QACrE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,QAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,6FAA6F;QAC7F,iGAAiG;QACjG,0FAA0F;QAC1F,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAChC,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,QAAQ,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,2FAA2F;QAC3F,iFAAiF;QACjF,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,IAAI,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE;gBAAE,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjG,CAAC;QAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;QAChC,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,OAAO;QACL,SAAS;QACT,QAAQ;QACR,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM;YACxC,IAAI,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YACvE,YAAY,CAAC,IAAI,CAAC,CAAC;YACnB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACnC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC5F,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,CAAC,KAAiB,EAAE,EAAE;oBAClC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;oBACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACnB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;gBAC3B,CAAC,CAAC;gBACF,IAAI,OAAO,MAAM,KAAK,QAAQ;oBAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;qBACtD,IAAI,MAAM,YAAY,UAAU;oBAAE,KAAK,CAAC,MAAM,CAAC,CAAC;;oBAChD,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM;wBAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACpD,SAAS,CAAC,EAAE,CAAC,CAAC;gBACd,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,IAAI,EAAE,CAAC,CAAC;YAC1G,CAAC;oBAAS,CAAC;gBACT,SAAS,CAAC,EAAE,CAAC,CAAC;YAChB,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/F,CAAC;QACD,OAAO,CAAC,KAAK,EAAE,KAAK;YAClB,IAAI,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YACvE,MAAM,QAAQ,GAAmB;gBAC/B,MAAM,EAAE,sBAAsB;gBAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,GAAG,KAAK;gBACR,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACjF,CAAC;YACF,2FAA2F;YAC3F,sFAAsF;YACtF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,iBAAiB,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC,CAAC;YAChF,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC3F,IAAI,CAAC;gBACH,aAAa,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC5D,SAAS,CAAC,EAAE,CAAC,CAAC;gBACd,SAAS,CAAC,EAAE,CAAC,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC;oBAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;gBACrD,IAAI,CAAC;oBAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,kDAAkD,CAAC,CAAC;gBACjF,MAAM,KAAK,CAAC;YACd,CAAC;YACD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACtB,cAAc,CAAC,SAAS,CAAC,CAAC;YAC1B,SAAS,GAAG,IAAI,CAAC;YACjB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO;YACL,IAAI,SAAS,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,QAAQ,CAAC;gBAAE,OAAO;YACrE,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvC,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,kBAAkB;QAC3E,MAAM,IAAI,KAAK,CAAC,kDAAkD,IAAI,EAAE,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAmB,CAAC;IACvE,IAAI,KAAK,CAAC,MAAM,KAAK,sBAAsB;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1H,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;QACnH,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACvG,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAChC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YACnH,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;SACjI,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,WAAW,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1F,IAAI,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;QACxF,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC;QAClE,CAAC,wEAAwE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC;QACzG,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,WAAmB,EAAE,QAA0B;IACrF,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,EAAE,CAAC,CAAC;IACnH,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC;IACzE,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAAC;IACjE,IAAI,aAAiC,CAAC;IACtC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,EAAE,CAAC,CAAC;QACvF,aAAa,GAAG,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACxG,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;QACrD,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACjE,IAAI,KAAK,KAAK,CAAC;gBAAE,MAAM;YACvB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACxC,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnB,IAAI,IAAI,KAAK,CAAC;YACd,IAAI,IAAI,GAAG,QAAQ,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;YACxH,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,EAAE,CAAC,CAAC;QACnE,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,MAAM;YAClE,MAAM,IAAI,KAAK,CAAC,0CAA0C,MAAM,EAAE,CAAC,CAAC;QACtE,SAAS,CAAC,aAAa,CAAC,CAAC;QACzB,IAAI,SAAS,CAAC,aAAa,CAAC,CAAC,IAAI,KAAK,IAAI;YACxC,MAAM,IAAI,KAAK,CAAC,6CAA6C,WAAW,EAAE,CAAC,CAAC;IAChF,CAAC;YAAS,CAAC;QACT,IAAI,aAAa,KAAK,SAAS;YAAE,SAAS,CAAC,aAAa,CAAC,CAAC;QAC1D,SAAS,CAAC,QAAQ,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAQD,wGAAwG;AACxG,MAAM,UAAU,aAAa,CAAC,YAAoB,EAAE,MAAc;IAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,YAAY,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,QAAQ,EAAE,CAAC,CAAC;IAC1I,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI;QACzH,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,CAAC,MAAM;QACjF,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YACxF,CAAC,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAChD,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,IAAI,GAAG,oBAAoB;YACjE,MAAM,IAAI,KAAK,CAAC,6BAA6B,oBAAoB,QAAQ,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;IACrF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,WAAW;QAClF,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACjI,IAAI,aAAa,CAAC,IAAI,KAAK,QAAQ,CAAC,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC;QAC3I,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,UAAU,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,UAAU,EAAE,CAAC,CAAC;IAC/I,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC;IACpE,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,wBAAwB,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3E,SAAS,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtC,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,oEAAoE;IACrG,MAAM,YAAY,GAAG,SAAS,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC;IAClE,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK;YAAE,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAC/G,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvH,cAAc,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,qBAAqB,CAAC,UAAU,EAAE,cAAc,CAAC,IAAI,qBAAqB,CAAC,SAAS,EAAE,QAAQ,CAAC;YAAE,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5I,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO;QACL,QAAQ;QACR,SAAS;QACT,OAAO;YACL,IAAI,qBAAqB,CAAC,UAAU,EAAE,cAAc,CAAC,IAAI,qBAAqB,CAAC,SAAS,EAAE,QAAQ,CAAC;gBAAE,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9I,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAsB;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAY,CAAC;IAC/G,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAClF,OAAO,KAAuC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC;AACzF,CAAC"}

package/dist/lib/delivery-proc.d.ts

@@ -4,6 +4,8 @@ type Opts = {
     spawn?: string[];
     runtime?: string;
     launch?: string;
+    resumeAttempt?: string;
+    resumeCommitToken?: string;
 };
 /** True if the delivery daemon we started for this folder is still running (pid file + liveness). */
 export declare function deliveryUp(): boolean;
@@ -23,8 +25,11 @@ export declare function startDeliveryDetached(o?: Opts): number;
 export declare function ensureDelivery(o?: Opts): Promise<{
     running: boolean;
 }>;
-/** Stop the detached delivery daemon if we started one, and drop its creds file. */
-export declare function stopDelivery(): void;
+/** Stop the detached delivery daemon if we started one, and drop its creds from the store. The pid
+ *  kill runs even if the creds delete fails (finally) — a delete error must never leave the daemon
+ *  alive to outlive the teardown and reattach to a restarted broker; the error still propagates
+ *  after the kill so the caller can surface it. */
+export declare function stopDelivery(): Promise<void>;
 /** Bring up the control plane in the correct cutover order: OLD-manager preflight → delivery daemon
  *  (auth only, fails closed on a live old manager) → manager (lifecycle, writes the delivery-aware
  *  marker). The manager no longer depends on the daemon (it hosts no Plane-3), so the daemon is started

package/dist/lib/delivery-proc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delivery-proc.d.ts","sourceRoot":"","sources":["../../src/lib/delivery-proc.ts"],"names":[],"mappings":"AAmBA,KAAK,IAAI,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAWrG,qGAAqG;AACrG,wBAAgB,UAAU,IAAI,OAAO,CAKpC;AAeD;;0GAE0G;AAC1G,wBAAgB,8BAA8B,IAAI,IAAI,CAKrD;AAED;;8FAE8F;AAC9F,wBAAgB,qBAAqB,CAAC,CAAC,GAAE,IAAS,GAAG,MAAM,CAkB1D;AAED;;;;sFAIsF;AACtF,wBAAsB,cAAc,CAAC,CAAC,GAAE,IAAS,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA8BhF;AAED,oFAAoF;AACpF,wBAAgB,YAAY,IAAI,IAAI,CAanC;AAED;;;;+FAI+F;AAC/F,wBAAsB,kBAAkB,CAAC,CAAC,GAAE,IAAS,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAIpF"}
+{"version":3,"file":"delivery-proc.d.ts","sourceRoot":"","sources":["../../src/lib/delivery-proc.ts"],"names":[],"mappings":"AAmBA,KAAK,IAAI,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAWzJ,qGAAqG;AACrG,wBAAgB,UAAU,IAAI,OAAO,CAKpC;AAeD;;0GAE0G;AAC1G,wBAAgB,8BAA8B,IAAI,IAAI,CAKrD;AAED;;8FAE8F;AAC9F,wBAAgB,qBAAqB,CAAC,CAAC,GAAE,IAAS,GAAG,MAAM,CAkB1D;AAED;;;;sFAIsF;AACtF,wBAAsB,cAAc,CAAC,CAAC,GAAE,IAAS,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA+BhF;AAED;;;mDAGmD;AACnD,wBAAsB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAiBlD;AAED;;;;+FAI+F;AAC/F,wBAAsB,kBAAkB,CAAC,CAAC,GAAE,IAAS,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAIpF"}

package/dist/lib/delivery-proc.js

@@ -1,13 +1,15 @@
 import { spawn } from "node:child_process";
 import { existsSync, openSync, closeSync, writeFileSync, readFileSync, rmSync } from "node:fs";
-import { DEFAULT_SERVER, mintCreds, mkSecretDir, newIdentity, waitForDeliveryLease, writeSecretFile, } from "@cotal-ai/core";
-import { authDir, findCotalRoot, loadSpaceAuth } from "@cotal-ai/workspace";
+import { DEFAULT_SERVER, mintCreds, newIdentity, waitForDeliveryLease, } from "@cotal-ai/core";
+import { DELIVERY_CREDS_KEY, authDir, findCotalRoot, loadSpaceAuth, workspaceSecretStore } from "@cotal-ai/workspace";
 import { selfArgv } from "./self-exec.js";
 import { resolveSpace } from "./status.js";
 import { cotalPath } from "./paths.js";
 import { ensureManager, managerHasDeliveryMarker, managerUp, stopManager } from "./manager-proc.js";
 const PID_PATH = () => cotalPath("delivery.pid");
-const CREDS_PATH = () => cotalPath("delivery.creds");
+// The daemon's cred goes through the secret-store seam; the shared key (== the filename, so the
+// file stays `.cotal/delivery.creds`) comes from workspace — never a hand-copied literal.
+const credsStore = () => workspaceSecretStore(findCotalRoot());
 function alive(pid) {
     try {
         process.kill(pid, 0);
@@ -89,8 +91,9 @@ export async function ensureDelivery(o = {}) {
     const space = o.space ?? resolveSpace(process.cwd());
     const server = o.server ?? DEFAULT_SERVER;
     if (!deliveryUp()) {
-        mkSecretDir(cotalPath()); // harden .cotal/ before the cred lands (born under a private ACL, no race)
-        writeSecretFile(CREDS_PATH(), creds);
+        // The store's put hardens `.cotal/` first (the cred is born under a private ACL, no race) and
+        // lands it atomically — same path and bytes as before the seam.
+        await credsStore().put(DELIVERY_CREDS_KEY, creds);
         startDeliveryDetached({ ...o, space, server });
     }
     // ALWAYS wait for the daemon to be READY (lease flipped ready AFTER it bound ctl.delivery) before
@@ -102,22 +105,29 @@ export async function ensureDelivery(o = {}) {
         console.error("• delivery daemon not yet ready (responder not bound) - boot durable joins will reconcile when it is");
     return { running: true };
 }
-/** Stop the detached delivery daemon if we started one, and drop its creds file. */
-export function stopDelivery() {
-    rmSync(CREDS_PATH(), { force: true });
-    const p = PID_PATH();
-    if (!existsSync(p))
-        return;
-    const pid = Number(readFileSync(p, "utf8").trim());
-    if (Number.isFinite(pid)) {
-        try {
-            process.kill(pid, "SIGTERM");
-        }
-        catch {
-            /* already gone */
+/** Stop the detached delivery daemon if we started one, and drop its creds from the store. The pid
+ *  kill runs even if the creds delete fails (finally) — a delete error must never leave the daemon
+ *  alive to outlive the teardown and reattach to a restarted broker; the error still propagates
+ *  after the kill so the caller can surface it. */
+export async function stopDelivery() {
+    try {
+        await credsStore().delete(DELIVERY_CREDS_KEY);
+    }
+    finally {
+        const p = PID_PATH();
+        if (existsSync(p)) {
+            const pid = Number(readFileSync(p, "utf8").trim());
+            if (Number.isFinite(pid)) {
+                try {
+                    process.kill(pid, "SIGTERM");
+                }
+                catch {
+                    /* already gone */
+                }
+            }
+            rmSync(p);
         }
     }
-    rmSync(p);
 }
 /** Bring up the control plane in the correct cutover order: OLD-manager preflight → delivery daemon
  *  (auth only, fails closed on a live old manager) → manager (lifecycle, writes the delivery-aware

package/dist/lib/delivery-proc.js.map

@@ -1 +1 @@
-{"version":3,"file":"delivery-proc.js","sourceRoot":"","sources":["../../src/lib/delivery-proc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC/F,OAAO,EACL,cAAc,EACd,SAAS,EACT,WAAW,EACX,WAAW,EACX,oBAAoB,EACpB,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEpG,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;AACjD,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;AAIrD,SAAS,KAAK,CAAC,GAAW;IACxB,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,UAAU;IACxB,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;IACrB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED;mDACmD;AACnD,SAAS,OAAO;IACd,OAAO,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;gDAEgD;AAChD,SAAS,qBAAqB;IAC5B,OAAO,SAAS,EAAE,IAAI,CAAC,wBAAwB,EAAE,CAAC;AACpD,CAAC;AAED;;0GAE0G;AAC1G,MAAM,UAAU,8BAA8B;IAC5C,IAAI,qBAAqB,EAAE,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,mGAAmG,CAAC,CAAC;QACnH,WAAW,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;8FAE8F;AAC9F,MAAM,UAAU,qBAAqB,CAAC,IAAU,EAAE;IAChD,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG;QACX,GAAG,IAAI;QACP,SAAS;QACT,SAAS;QACT,CAAC,CAAC,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACtC,UAAU;QACV,CAAC,CAAC,MAAM,IAAI,cAAc;KAC3B,CAAC;IACF,mGAAmG;IACnG,gGAAgG;IAChG,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACxI,SAAS,CAAC,EAAE,CAAC,CAAC;IACd,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,aAAa,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;AACxB,CAAC;AAED;;;;sFAIsF;AACtF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAU,EAAE;IAC/C,IAAI,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,kDAAkD;IAC7F,IAAI,qBAAqB,EAAE,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CACX,yJAAyJ,CAC1J,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,uGAAuG;IACvG,wGAAwG;IACxG,sGAAsG;IACtG,kBAAkB;IAClB,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAE,CAAC;IACtD,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,cAAc,CAAC;IAC1C,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAClB,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,2EAA2E;QACrG,eAAe,CAAC,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC;QACrC,qBAAqB,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,kGAAkG;IAClG,uGAAuG;IACvG,wGAAwG;IACxG,mEAAmE;IACnE,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC,KAAK;QACR,OAAO,CAAC,KAAK,CAAC,sGAAsG,CAAC,CAAC;IACxH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,YAAY;IAC1B,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;IACrB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO;IAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;IACD,MAAM,CAAC,CAAC,CAAC,CAAC;AACZ,CAAC;AAED;;;;+FAI+F;AAC/F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAU,EAAE;IACnD,8BAA8B,EAAE,CAAC;IACjC,MAAM,cAAc,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"delivery-proc.js","sourceRoot":"","sources":["../../src/lib/delivery-proc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC/F,OAAO,EACL,cAAc,EACd,SAAS,EACT,WAAW,EACX,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACtH,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEpG,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;AACjD,gGAAgG;AAChG,0FAA0F;AAC1F,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,oBAAoB,CAAC,aAAa,EAAE,CAAC,CAAC;AAI/D,SAAS,KAAK,CAAC,GAAW;IACxB,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,UAAU;IACxB,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;IACrB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED;mDACmD;AACnD,SAAS,OAAO;IACd,OAAO,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;gDAEgD;AAChD,SAAS,qBAAqB;IAC5B,OAAO,SAAS,EAAE,IAAI,CAAC,wBAAwB,EAAE,CAAC;AACpD,CAAC;AAED;;0GAE0G;AAC1G,MAAM,UAAU,8BAA8B;IAC5C,IAAI,qBAAqB,EAAE,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,mGAAmG,CAAC,CAAC;QACnH,WAAW,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;8FAE8F;AAC9F,MAAM,UAAU,qBAAqB,CAAC,IAAU,EAAE;IAChD,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG;QACX,GAAG,IAAI;QACP,SAAS;QACT,SAAS;QACT,CAAC,CAAC,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACtC,UAAU;QACV,CAAC,CAAC,MAAM,IAAI,cAAc;KAC3B,CAAC;IACF,mGAAmG;IACnG,gGAAgG;IAChG,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACxI,SAAS,CAAC,EAAE,CAAC,CAAC;IACd,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,aAAa,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;AACxB,CAAC;AAED;;;;sFAIsF;AACtF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAU,EAAE;IAC/C,IAAI,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,kDAAkD;IAC7F,IAAI,qBAAqB,EAAE,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CACX,yJAAyJ,CAC1J,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,uGAAuG;IACvG,wGAAwG;IACxG,sGAAsG;IACtG,kBAAkB;IAClB,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAE,CAAC;IACtD,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,cAAc,CAAC;IAC1C,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAClB,8FAA8F;QAC9F,gEAAgE;QAChE,MAAM,UAAU,EAAE,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;QAClD,qBAAqB,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,kGAAkG;IAClG,uGAAuG;IACvG,wGAAwG;IACxG,mEAAmE;IACnE,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC,KAAK;QACR,OAAO,CAAC,KAAK,CAAC,sGAAsG,CAAC,CAAC;IACxH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;mDAGmD;AACnD,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,IAAI,CAAC;QACH,MAAM,UAAU,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAChD,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;QACrB,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBAC/B,CAAC;gBAAC,MAAM,CAAC;oBACP,kBAAkB;gBACpB,CAAC;YACH,CAAC;YACD,MAAM,CAAC,CAAC,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;+FAI+F;AAC/F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAU,EAAE;IACnD,8BAA8B,EAAE,CAAC;IACjC,MAAM,cAAc,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC"}

package/dist/lib/endpoint-cut.d.ts

@@ -0,0 +1,5 @@
+/** Refuse every positive listener signal, including auth rejection from an otherwise live broker. */
+export declare function assertEndpointUnreachable(server: string): Promise<void>;
+/** Allow normal shutdown latency, but publish no cut while the exact recorded endpoint still answers. */
+export declare function waitForEndpointUnreachable(server: string, timeoutMs?: number): Promise<void>;
+//# sourceMappingURL=endpoint-cut.d.ts.map

package/dist/lib/endpoint-cut.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-cut.d.ts","sourceRoot":"","sources":["../../src/lib/endpoint-cut.ts"],"names":[],"mappings":"AAIA,qGAAqG;AACrG,wBAAsB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA2B7E;AAED,yGAAyG;AACzG,wBAAsB,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAWlG"}

package/dist/lib/endpoint-cut.js

@@ -0,0 +1,53 @@
+import { createConnection } from "node:net";
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** Refuse every positive listener signal, including auth rejection from an otherwise live broker. */
+export async function assertEndpointUnreachable(server) {
+    let endpoint;
+    try {
+        endpoint = new URL(server);
+    }
+    catch {
+        throw new Error(`maintenance cannot prove invalid recorded NATS endpoint ${server} unreachable`);
+    }
+    if (!endpoint.hostname || !["nats:", "tls:"].includes(endpoint.protocol))
+        throw new Error(`maintenance cannot prove invalid recorded NATS endpoint ${server} unreachable`);
+    await new Promise((resolve, reject) => {
+        const socket = createConnection({ host: endpoint.hostname, port: Number(endpoint.port) || 4222 });
+        let settled = false;
+        const finish = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            socket.destroy();
+            if (error)
+                reject(error);
+            else
+                resolve();
+        };
+        socket.setTimeout(500);
+        socket.once("connect", () => finish(new Error(`maintenance requires the recorded NATS endpoint ${server} to have no listener`)));
+        socket.once("timeout", () => finish(new Error(`maintenance could not prove the recorded NATS endpoint ${server} unreachable`)));
+        socket.once("error", (error) => {
+            if (error.code === "ECONNREFUSED")
+                finish();
+            else
+                finish(new Error(`maintenance could not prove the recorded NATS endpoint ${server} unreachable: ${error.message}`));
+        });
+    });
+}
+/** Allow normal shutdown latency, but publish no cut while the exact recorded endpoint still answers. */
+export async function waitForEndpointUnreachable(server, timeoutMs = 20_000) {
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        try {
+            await assertEndpointUnreachable(server);
+            return;
+        }
+        catch (error) {
+            if (Date.now() >= deadline)
+                throw error;
+        }
+        await sleep(100);
+    }
+}
+//# sourceMappingURL=endpoint-cut.js.map

package/dist/lib/endpoint-cut.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-cut.js","sourceRoot":"","sources":["../../src/lib/endpoint-cut.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAE5C,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEhF,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,MAAc;IAC5D,IAAI,QAAa,CAAC;IAClB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2DAA2D,MAAM,cAAc,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,2DAA2D,MAAM,cAAc,CAAC,CAAC;IACnG,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAClG,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;gBACpB,OAAO,EAAE,CAAC;QACjB,CAAC,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,MAAM,sBAAsB,CAAC,CAAC,CAAC,CAAC;QACjI,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0DAA0D,MAAM,cAAc,CAAC,CAAC,CAAC,CAAC;QAChI,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;YACpD,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;gBAAE,MAAM,EAAE,CAAC;;gBACvC,MAAM,CAAC,IAAI,KAAK,CAAC,0DAA0D,MAAM,iBAAiB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC3H,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,MAAc,EAAE,SAAS,GAAG,MAAM;IACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,yBAAyB,CAAC,MAAM,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,MAAM,KAAK,CAAC;QAC1C,CAAC;QACD,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/lib/isolated-broker.d.ts

@@ -0,0 +1,70 @@
+import { type NatsConnection } from "@nats-io/transport-node";
+import { type BackupPermissionScope, type RestorePermissionScope, type SpaceAuth } from "@cotal-ai/core";
+import type { MaintenanceAuthMode, ProcessOwner } from "@cotal-ai/workspace";
+export interface PrivateAttemptsDirectory {
+    path: string;
+    identity: {
+        dev: bigint;
+        ino: bigint;
+    };
+}
+export declare function ensurePrivateAttemptsDir(root: string): PrivateAttemptsDirectory;
+/** With the maintenance journal at `ready` and no live claim, nothing may legitimately live in the
+ *  private attempts directory: every entry is residue of a dead attempt (staging, clones, broker
+ *  run files) and is removed before new maintenance work begins. Strict — a failed removal aborts
+ *  the caller rather than proceeding over unowned residue. */
+export declare function sweepAttemptResidue(root: string): void;
+export interface AttemptDirectory {
+    path: string;
+    identity: {
+        dev: bigint;
+        ino: bigint;
+    };
+    cleanup(): void;
+}
+export declare function createAttemptClone(root: string, sourceStore: string, attemptId: string): AttemptDirectory;
+export interface IsolatedRunFile {
+    path: string;
+    dev: string;
+    ino: string;
+}
+export interface IsolatedBroker {
+    server: string;
+    initialLogin: IsolatedMaintenanceLogin;
+    brokerOwner: ProcessOwner;
+    watchdogOwner: ProcessOwner;
+    /** Attempt-owned run files (config, broker log, pid handshake) for claim journaling. */
+    runFiles: readonly IsolatedRunFile[];
+    addLogin(scope: IsolatedMaintenanceScope | ((connId: string) => IsolatedMaintenanceScope)): Promise<IsolatedMaintenanceLogin>;
+    stop(): Promise<void>;
+}
+export type IsolatedMaintenanceScope = {
+    profile: "backup";
+    scope: BackupPermissionScope;
+} | {
+    profile: "restore";
+    scope: RestorePermissionScope;
+} | {
+    profile: "infrastructure";
+    streams: readonly string[];
+};
+export interface IsolatedMaintenanceLogin {
+    readonly user: string;
+    readonly pass: string;
+    readonly connId: string;
+    readonly scope: IsolatedMaintenanceScope;
+}
+export declare function connectIsolatedBroker(broker: Pick<IsolatedBroker, "server">, login: IsolatedMaintenanceLogin): Promise<NatsConnection>;
+export declare function startIsolatedBroker(options: {
+    root: string;
+    storeDir: string;
+    space: string;
+    mode: MaintenanceAuthMode;
+    auth?: SpaceAuth;
+    deadline: Date;
+    label: "backup" | "restore" | "quarantine";
+    initialScope: IsolatedMaintenanceScope;
+    /** Attempt id prefixing the run files, tying them to the journaled maintenance attempt. */
+    attemptId?: string;
+}): Promise<IsolatedBroker>;
+//# sourceMappingURL=isolated-broker.d.ts.map

package/dist/lib/isolated-broker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isolated-broker.d.ts","sourceRoot":"","sources":["../../src/lib/isolated-broker.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAW,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,SAAS,EACf,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAM7E,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CACxC;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,wBAAwB,CAkB/E;AAQD;;;8DAG8D;AAC9D,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAQtD;AAwCD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,gBAAgB,CA+CzG;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,wBAAwB,CAAC;IACvC,WAAW,EAAE,YAAY,CAAC;IAC1B,aAAa,EAAE,YAAY,CAAC;IAC5B,wFAAwF;IACxF,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,wBAAwB,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,wBAAwB,CAAC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC9H,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,MAAM,MAAM,wBAAwB,GAChC;IAAE,OAAO,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,qBAAqB,CAAA;CAAE,GACnD;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,sBAAsB,CAAA;CAAE,GACrD;IAAE,OAAO,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAE9D,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;CAC1C;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,EACtC,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,cAAc,CAAC,CAQzB;AA2FD,wBAAsB,mBAAmB,CAAC,OAAO,EAAE;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,mBAAmB,CAAC;IAC1B,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,QAAQ,EAAE,IAAI,CAAC;IACf,KAAK,EAAE,QAAQ,GAAG,SAAS,GAAG,YAAY,CAAC;IAC3C,YAAY,EAAE,wBAAwB,CAAC;IACvC,2FAA2F;IAC3F,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,cAAc,CAAC,CAyJ1B"}