@cotal-ai/cli 0.17.0 → 0.19.0

package/cotal-skills/skills/team-topology/SKILL.md

@@ -88,7 +88,7 @@ The lifecycle is **design → present → agree → deploy**, and agreement is a
 
 ## Substrate notes
 
-- **Cotal mesh**: each peer is its own process + minted credential under a manager (name the runtime: pty/orca/tmux/cmux). Confine via persona `allowSubscribe`/`allowPublish` frontmatter; author the `.cotal/agents/<name>.md` first, then (re)spawn so the credential is minted with the ACL. Spawn with an explicit `cwd` (the default roots peers in the manager's workspace). Verify your own subscriptions after joining every channel. Survey before spawning: roster + manager liveness (a dead manager inside `up` needs `supervise`; a stale long-lived manager pins pre-merge code and split-brains spawns), never reuse a dead agent's name, set channel replay deliberately (a joiner with replay ON back-reads history; a channel's durable backstop only activates on leave+rejoin, a bare re-join no-ops). Never disturb a live shared broker: kill by PID, no broad pkill. `mesh-teams` runs the review/implement/test loop; this skill specifies the shape it runs in.
+- **Cotal mesh**: each peer is its own process + minted credential under a manager (name the runtime: pty/orca/tmux/cmux/herdr). Confine via persona `allowSubscribe`/`allowPublish` frontmatter; author the `.cotal/agents/<name>.md` first, then (re)spawn so the credential is minted with the ACL. Spawn with an explicit `cwd` (the default roots peers in the manager's workspace). Verify your own subscriptions after joining every channel. Survey before spawning: roster + manager liveness (a dead manager inside `up` needs `supervise`; a stale long-lived manager pins pre-merge code and split-brains spawns), never reuse a dead agent's name, set channel replay deliberately (a joiner with replay ON back-reads history; a channel's durable backstop only activates on leave+rejoin, a bare re-join no-ops). Never disturb a live shared broker: kill by PID, no broad pkill. `mesh-teams` runs the review/implement/test loop; this skill specifies the shape it runs in.
 - **Harness subagents / workflows**: the coordinator is the main session; prefer a streaming pipeline over barrier-synchronized stages; give parallel writers isolated workspaces; and use structured, schema-validated returns where the harness supports them.
 
 ## Worked example (one instantiation, not the template)

package/dist/commands/agents.d.ts

@@ -19,6 +19,11 @@ export declare const stopFlags: readonly [{
     readonly type: "string";
     readonly value: "<n>";
     readonly description: string;
+}, {
+    readonly name: "on";
+    readonly type: "string";
+    readonly value: "<instance>";
+    readonly description: "target a specific manager instance id (multi-manager space); default = class anycast";
 }];
 export declare const psFlags: readonly [{
     readonly name: "space";
@@ -61,6 +66,11 @@ export declare const attachFlags: readonly [{
     readonly type: "string";
     readonly value: "<n>";
     readonly description: string;
+}, {
+    readonly name: "on";
+    readonly type: "string";
+    readonly value: "<instance>";
+    readonly description: "target a specific manager instance id (multi-manager space); default = class anycast";
 }];
 export declare function managedAgentComplete(argv: string[]): CompletionResult;
 export declare function stop(args: ParsedArgs): Promise<void>;

package/dist/commands/agents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/commands/agents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiD,KAAK,gBAAgB,EAAkC,KAAK,UAAU,EAAqB,MAAM,gBAAgB,CAAC;AAkB1K,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;EAAwG,CAAC;AAC/H,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;EAAoN,CAAC;AACzO,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;EAA6G,CAAC;AAEtI,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAQrE;AAED,wBAAsB,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB1D;AAsCD,wBAAsB,EAAE,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA4ExD;AAED,wBAAsB,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAoC5D"}
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/commands/agents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiD,KAAK,gBAAgB,EAAkC,KAAK,UAAU,EAAqB,MAAM,gBAAgB,CAAC;AAuB1K,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;EAAgH,CAAC;AACvI,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;EAAkE,CAAC;AACvF,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;EAAqH,CAAC;AAE9I,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAQrE;AAED,wBAAsB,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAwB1D;AA6FD,wBAAsB,EAAE,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAwFxD;AAED,wBAAsB,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAuC5D"}

package/dist/commands/agents.js

@@ -2,7 +2,7 @@ import { mintCreds, newIdentity, standaloneConnectOpts } from "@cotal-ai/core";
 import { authDir, findCotalRoot, loadMeshes, loadSpaceAuth, targetFlags } from "@cotal-ai/workspace";
 import { connect } from "@nats-io/transport-node";
 import { c } from "../ui.js";
-import { askManager, scatterManager, failIfNotOk, resolveControlTarget } from "../lib/control.js";
+import { askManager, scatterManager, failIfNotOk, resolveControlTarget, onInstanceOrExit } from "../lib/control.js";
 import { attachClient, detachKey, meshSessionTransport } from "../lib/attach-client.js";
 import { completingFlagValue } from "../lib/completion.js";
 /**
@@ -12,9 +12,14 @@ import { completingFlagValue } from "../lib/completion.js";
  * Detached LAUNCH is `cotal spawn --detach` (spawn.ts) — one launch grammar for both modes.
  */
 const nameFlag = (what) => ({ name: "name", type: "string", value: "<n>", description: what });
-export const stopFlags = [...targetFlags, nameFlag("managed agent to stop (required)")];
-export const psFlags = [...targetFlags, { name: "on", type: "string", value: "<instance>", description: "target a specific manager instance id (multi-manager space); default = class anycast" }];
-export const attachFlags = [...targetFlags, nameFlag("managed agent to attach to (required)")];
+/** `--on <instance>`: address ONE manager instance instead of the class queue. Shared by
+ *  ps/stop/attach so the three cannot drift. For stop and attach it is the seat-locality escape
+ *  hatch: the manager that can act on a seat is the one HOSTING it, which is not necessarily the
+ *  one that wins the class queue. */
+const onFlag = { name: "on", type: "string", value: "<instance>", description: "target a specific manager instance id (multi-manager space); default = class anycast" };
+export const stopFlags = [...targetFlags, nameFlag("managed agent to stop (required)"), onFlag];
+export const psFlags = [...targetFlags, onFlag];
+export const attachFlags = [...targetFlags, nameFlag("managed agent to attach to (required)"), onFlag];
 export function managedAgentComplete(argv) {
     const flag = completingFlagValue(argv, attachFlags);
     if (flag?.name === "space")
@@ -40,15 +45,55 @@ export async function stop(args) {
     // "owner"` (its own-domain despawn row), and the MANAGER authorizes: agents under your own
     // owner pass with scope "spawn", another owner's agent needs "admin" on your ledger row (the
     // handler's fresh any-mode authorization). No client-side try-admin-then-owner fallback.
-    const t = await resolveControlTarget(v, "control-caller-admin");
+    // Seat-locality: the manager that can stop a seat is the one HOSTING it, so resolve WHERE before
+    // choosing WHO. Must precede the mint — a credential cannot gain an instance rail after issuance.
+    const on = await pinForTarget(v, "cotal stop");
+    const t = await resolveControlTarget(v, "control-caller-admin", on);
     const reach = t.auth.bearer ? "owner" : "any";
-    const reply = await askManager(t.space, t.server, "stop", { name: v.name }, t.auth, reach);
+    const reply = await askManager(t.space, t.server, "stop", { name: v.name }, t.auth, reach, undefined, { instanceId: on });
     failIfNotOk(reply);
     // User mesh: a stop IS a grant revoke (rows are runtime grants — a non-running agent holds no
     // standing mint secret); a respawn re-grants automatically. Say so, so the operator's
     // restart-vs-revoke model is visible at the command, not inferred from docs.
     console.log(c.dim(`✓ stopped ${v.name}${t.auth.bearer ? " - its actor grant is revoked; a respawn re-grants automatically" : ""}`));
 }
+async function locateSeat(v, name) {
+    // USER mode cannot do this: a ledger-scoped bearer does not hold the freeze rows, so a scatter
+    // dies on a permissions violation that reads as "no manager". Left unpinned — `--on` stays the
+    // manual escape hatch there, and docs/cli.md says so rather than this failing mysteriously.
+    const probe = await resolveControlTarget(v, "control-caller-privileged");
+    if (probe.auth.bearer)
+        return { kind: "unpinned" };
+    const scatter = await scatterManager(probe.space, probe.server, "ps", probe.auth);
+    if (!scatter.ok)
+        return { kind: "unpinned" }; // cannot locate ⇒ behave exactly as before, never worse
+    const reachable = scatter.instances.filter((i) => i.reachable);
+    const unreachable = scatter.instances.filter((i) => !i.reachable).map((i) => i.instanceId);
+    if (reachable.length <= 1 && !unreachable.length)
+        return { kind: "unpinned" };
+    const host = reachable.find((i) => (i.data ?? []).some((r) => r.name === name));
+    if (host)
+        return { kind: "pin", instanceId: host.instanceId };
+    return { kind: "absent", checked: reachable.length, unreachable };
+}
+/** Resolve `--on` for a targeted verb: an explicit pin wins; otherwise locate the seat. Returns the
+ *  instance to address, or exits with an error that says WHICH case the miss was. */
+async function pinForTarget(v, verb) {
+    const on = onInstanceOrExit(v.on, verb);
+    if (on !== undefined)
+        return on;
+    const loc = await locateSeat(v, String(v.name));
+    if (loc.kind === "pin")
+        return loc.instanceId;
+    if (loc.kind === "unpinned")
+        return undefined;
+    // The honest error #383 asked for: name the search, not just the absence.
+    const missed = loc.unreachable.length
+        ? ` ${loc.unreachable.length} manager instance(s) did not answer (${loc.unreachable.join(", ")}), so it may be hosted by one of those: retry, or \`${verb} --on <instance>\` (the whole id, as printed) if you know where it is.`
+        : "";
+    console.error(c.red(`✗ no managed agent "${v.name}" on any of the ${loc.checked} reachable manager instance(s) in this space.${missed}`));
+    process.exit(1);
+}
 /** Render one managed-agent row (status + optional auth-health line), indented for the per-manager
  *  grouping a class scatter prints. */
 function printAgentRow(r, indent = "") {
@@ -72,11 +117,14 @@ function printAgentRow(r, indent = "") {
 }
 export async function ps(args) {
     const v = args.values;
-    const t = await resolveControlTarget(v, "control-caller-privileged");
+    const on = onInstanceOrExit(v.on, "cotal ps");
+    // `--on` must reach the MINT, not just the invoke: the one-shot instrument is issued during
+    // this resolve, and a credential cannot gain an instance rail after it is minted.
+    const t = await resolveControlTarget(v, "control-caller-privileged", on);
     // `--on <instance>`: pin ps to ONE manager instance's `inst` route (P2 item 3 multi-manager) — a
     // single-manager view. Same path for both modes (no freeze; no scatter).
-    if (v.on) {
-        const reply = await askManager(t.space, t.server, "ps", undefined, t.auth, "owner", undefined, v.on);
+    if (on !== undefined) {
+        const reply = await askManager(t.space, t.server, "ps", undefined, t.auth, "owner", undefined, { instanceId: on });
         failIfNotOk(reply);
         const rows = reply.data ?? [];
         if (!rows.length) {
@@ -101,7 +149,9 @@ export async function ps(args) {
     // the freeze rows; every registered instance is attributed, and a non-answering one is labeled
     // unreachable (pin 3).
     if (t.auth.bearer) {
-        const reply = await askManager(t.space, t.server, "ps", undefined, t.auth, "owner");
+        // `ps` has `--on` and did not pass it on this branch (the pinned branch returned above), so a
+        // split may name it as the remedy: the pin is declared, empty.
+        const reply = await askManager(t.space, t.server, "ps", undefined, t.auth, "owner", undefined, {});
         failIfNotOk(reply);
         const rows = reply.data ?? [];
         if (!rows.length) {
@@ -131,8 +181,15 @@ export async function ps(args) {
         return;
     }
     // Multi-manager: group under a per-instance header; unreachable instances are shown, never dropped.
+    //
+    // The header prints the FULL instance id, not a prefix. This block runs only in a multi-manager
+    // space (precisely when the split makes `--on <instance>` the one way to address a manager) and
+    // `--on` takes nothing but the whole 26-32 char lifecycle token (`assertLifecycleToken`). An
+    // abbreviated header therefore showed the operator an id that the very next command refuses
+    // (`"4ik6rb0e" is not a valid lifecycle token`), with the full value printed nowhere: the remedy
+    // was named and then withheld. Width costs one line here; the prefix cost the flag entirely.
     for (const inst of instances) {
-        const label = `manager ${inst.instanceId.slice(0, 8)}`;
+        const label = `manager ${inst.instanceId}`;
         if (!inst.reachable) {
             console.log(`${c.bold(label)}  ${c.red("unreachable")}`);
             continue;
@@ -156,9 +213,12 @@ export async function attach(args) {
     // Same reach routing as stop: static mesh → any-mode on the `control-caller-admin` instrument;
     // user mesh → the operator's own bearer with owner reach, the manager deciding (own owner-domain
     // passes with "spawn", cross-owner needs ledger "admin").
-    const t = await resolveControlTarget(v, "control-caller-admin");
+    // Same seat-locality rule as stop, and it matters more here: attaching to a seat means reaching
+    // the process, which only its host manager has.
+    const on = await pinForTarget(v, "cotal attach");
+    const t = await resolveControlTarget(v, "control-caller-admin", on);
     const reach = t.auth.bearer ? "owner" : "any";
-    const reply = await askManager(t.space, t.server, "attach", { name: v.name }, t.auth, reach);
+    const reply = await askManager(t.space, t.server, "attach", { name: v.name }, t.auth, reach, undefined, { instanceId: on });
     failIfNotOk(reply);
     // P2 item 6: the reply is the holder-bound §13.6 session GRANT (no ws:// URL). Redeem it over the
     // mesh — mint a per-session, rails-only caller cred from the local space seed, connect, and drive

package/dist/commands/agents.js.map

@@ -1 +1 @@
-{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/commands/agents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,qBAAqB,EAA6F,MAAM,gBAAgB,CAAC;AAC1K,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,UAAU,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAClG,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D;;;;;GAKG;AAEH,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAChC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAU,CAAC;AAE/E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAG,WAAW,EAAE,QAAQ,CAAC,kCAAkC,CAAC,CAAwC,CAAC;AAC/H,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,GAAG,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,sFAAsF,EAAE,CAAwC,CAAC;AACzO,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAG,WAAW,EAAE,QAAQ,CAAC,uCAAuC,CAAC,CAAwC,CAAC;AAEtI,MAAM,UAAU,oBAAoB,CAAC,IAAc;IACjD,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAClH,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACvE,IAAI,IAAI,EAAE,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACtE,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;QAClB,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACzH,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAgB;IACzC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAsC,CAAC;IACtD,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,+FAA+F;IAC/F,wFAAwF;IACxF,cAAc;IACd,0FAA0F;IAC1F,2FAA2F;IAC3F,6FAA6F;IAC7F,yFAAyF;IACzF,MAAM,CAAC,GAAG,MAAM,oBAAoB,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9C,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3F,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,8FAA8F;IAC9F,sFAAsF;IACtF,6EAA6E;IAC7E,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,kEAAkE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACtI,CAAC;AAYD;uCACuC;AACvC,SAAS,aAAa,CAAC,CAAW,EAAE,MAAM,GAAG,EAAE;IAC7C,MAAM,MAAM,GACV,CAAC,CAAC,IAAI,KAAK,QAAQ;QACjB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;QACvB,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS;YACpB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;YAClB,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS;gBACpB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;gBACpB,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS;oBACpB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;oBACrB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3B,+FAA+F;IAC/F,iDAAiD;IACjD,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,KAAK,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5E,OAAO,CAAC,GAAG,CACT,GAAG,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CACtE,CAAC,CAAC,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,IAAI,CACzB,KAAK,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CACpE,CAAC;IACF,kGAAkG;IAClG,mEAAmE;IACnE,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU;QAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,IAAgB;IACvC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAoC,CAAC;IACpD,MAAM,CAAC,GAAG,MAAM,oBAAoB,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC;IACrE,iGAAiG;IACjG,yEAAyE;IACzE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACrG,WAAW,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,IAAI,GAAI,KAAK,CAAC,IAAmB,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,aAAa,CAAC,CAAC,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IAED,4FAA4F;IAC5F,6FAA6F;IAC7F,sBAAsB;IACtB,EAAE;IACF,sFAAsF;IACtF,0FAA0F;IAC1F,yFAAyF;IACzF,wFAAwF;IACxF,wFAAwF;IACxF,EAAE;IACF,+FAA+F;IAC/F,+FAA+F;IAC/F,uBAAuB;IACvB,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACpF,WAAW,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,IAAI,GAAI,KAAK,CAAC,IAAmB,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,aAAa,CAAC,CAAC,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACtE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,mEAAmE;IACnE,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAC3C,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAChG,CAAC;IACF,gGAAgG;IAChG,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC5E,MAAM,IAAI,GAAI,SAAS,CAAC,CAAC,CAAC,CAAC,IAAmB,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,aAAa,CAAC,CAAC,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IACD,oGAAoG;IACpG,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,WAAW,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YACzD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACtD,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAI,IAAI,CAAC,IAAmB,IAAI,EAAE,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,SAAS,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC7H,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAgB;IAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,MAAwC,CAAC;IACxD,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,+FAA+F;IAC/F,iGAAiG;IACjG,0DAA0D;IAC1D,MAAM,CAAC,GAAG,MAAM,oBAAoB,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9C,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7F,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,kGAAkG;IAClG,kGAAkG;IAClG,8FAA8F;IAC9F,yFAAyF;IACzF,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,IAA+B,CAAC;IACxD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,qIAAqI,CAAC,CAAC,CAAC;QAC5J,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,gBAAgB,EAAE;QACxD,aAAa,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE;QACnG,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,sDAAsD;KAChG,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3J,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,MAAM,SAAS,EAAE,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC;IAC/E,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,oBAAoB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IACtD,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/commands/agents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,qBAAqB,EAA6F,MAAM,gBAAgB,CAAC;AAC1K,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,UAAU,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACpH,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D;;;;;GAKG;AAEH,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAChC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAU,CAAC;AAE/E;;;qCAGqC;AACrC,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,sFAAsF,EAAW,CAAC;AACjL,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAG,WAAW,EAAE,QAAQ,CAAC,kCAAkC,CAAC,EAAE,MAAM,CAAwC,CAAC;AACvI,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,GAAG,WAAW,EAAE,MAAM,CAAwC,CAAC;AACvF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAG,WAAW,EAAE,QAAQ,CAAC,uCAAuC,CAAC,EAAE,MAAM,CAAwC,CAAC;AAE9I,MAAM,UAAU,oBAAoB,CAAC,IAAc;IACjD,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAClH,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACvE,IAAI,IAAI,EAAE,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACtE,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;QAClB,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACzH,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAgB;IACzC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAsC,CAAC;IACtD,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,+FAA+F;IAC/F,wFAAwF;IACxF,cAAc;IACd,0FAA0F;IAC1F,2FAA2F;IAC3F,6FAA6F;IAC7F,yFAAyF;IACzF,iGAAiG;IACjG,kGAAkG;IAClG,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAG,MAAM,oBAAoB,CAAC,CAAC,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9C,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1H,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,8FAA8F;IAC9F,sFAAsF;IACtF,6EAA6E;IAC7E,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,kEAAkE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACtI,CAAC;AAmCD,KAAK,UAAU,UAAU,CAAC,CAA+B,EAAE,IAAY;IACrE,+FAA+F;IAC/F,+FAA+F;IAC/F,4FAA4F;IAC5F,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC;IACzE,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAClF,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,wDAAwD;IACtG,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC3F,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9E,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,CAAC,CAAC,IAA+B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC;IAC5G,IAAI,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IAC9D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC;AACpE,CAAC;AAED;qFACqF;AACrF,KAAK,UAAU,YAAY,CAAC,CAA+B,EAAE,IAAY;IACvE,MAAM,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,GAAG,CAAC,UAAU,CAAC;IAC9C,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IAC9C,0EAA0E;IAC1E,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM;QACnC,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,wCAAwC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,uDAAuD,IAAI,wEAAwE;QACjO,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,IAAI,mBAAmB,GAAG,CAAC,OAAO,gDAAgD,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1I,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED;uCACuC;AACvC,SAAS,aAAa,CAAC,CAAW,EAAE,MAAM,GAAG,EAAE;IAC7C,MAAM,MAAM,GACV,CAAC,CAAC,IAAI,KAAK,QAAQ;QACjB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;QACvB,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS;YACpB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;YAClB,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS;gBACpB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;gBACpB,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS;oBACpB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;oBACrB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3B,+FAA+F;IAC/F,iDAAiD;IACjD,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,KAAK,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5E,OAAO,CAAC,GAAG,CACT,GAAG,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CACtE,CAAC,CAAC,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,IAAI,CACzB,KAAK,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CACpE,CAAC;IACF,kGAAkG;IAClG,mEAAmE;IACnE,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU;QAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,IAAgB;IACvC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAoC,CAAC;IACpD,MAAM,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAC9C,4FAA4F;IAC5F,kFAAkF;IAClF,MAAM,CAAC,GAAG,MAAM,oBAAoB,CAAC,CAAC,EAAE,2BAA2B,EAAE,EAAE,CAAC,CAAC;IACzE,iGAAiG;IACjG,yEAAyE;IACzE,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACnH,WAAW,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,IAAI,GAAI,KAAK,CAAC,IAAmB,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,aAAa,CAAC,CAAC,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IAED,4FAA4F;IAC5F,6FAA6F;IAC7F,sBAAsB;IACtB,EAAE;IACF,sFAAsF;IACtF,0FAA0F;IAC1F,yFAAyF;IACzF,wFAAwF;IACxF,wFAAwF;IACxF,EAAE;IACF,+FAA+F;IAC/F,+FAA+F;IAC/F,uBAAuB;IACvB,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAClB,8FAA8F;QAC9F,+DAA+D;QAC/D,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACnG,WAAW,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,IAAI,GAAI,KAAK,CAAC,IAAmB,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,aAAa,CAAC,CAAC,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACtE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,mEAAmE;IACnE,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAC3C,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAChG,CAAC;IACF,gGAAgG;IAChG,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC5E,MAAM,IAAI,GAAI,SAAS,CAAC,CAAC,CAAC,CAAC,IAAmB,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,aAAa,CAAC,CAAC,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IACD,oGAAoG;IACpG,EAAE;IACF,gGAAgG;IAChG,gGAAgG;IAChG,6FAA6F;IAC7F,4FAA4F;IAC5F,iGAAiG;IACjG,6FAA6F;IAC7F,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,WAAW,IAAI,CAAC,UAAU,EAAE,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YACzD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACtD,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAI,IAAI,CAAC,IAAmB,IAAI,EAAE,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,SAAS,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC7H,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAgB;IAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,MAAwC,CAAC;IACxD,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,+FAA+F;IAC/F,iGAAiG;IACjG,0DAA0D;IAC1D,gGAAgG;IAChG,gDAAgD;IAChD,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,CAAU,EAAE,cAAc,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,MAAM,oBAAoB,CAAC,CAAC,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9C,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5H,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,kGAAkG;IAClG,kGAAkG;IAClG,8FAA8F;IAC9F,yFAAyF;IACzF,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,IAA+B,CAAC;IACxD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,qIAAqI,CAAC,CAAC,CAAC;QAC5J,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,gBAAgB,EAAE;QACxD,aAAa,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE;QACnG,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,sDAAsD;KAChG,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3J,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,MAAM,SAAS,EAAE,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC;IAC/E,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,oBAAoB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IACtD,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACpD,CAAC"}

package/dist/commands/meshes-add.d.ts

@@ -1,4 +1,5 @@
 import { type SpaceAuth } from "@cotal-ai/core";
+import { type JoinTarget } from "../lib/join-target.js";
 import { type MeshEntry, type MeshTarget, type PreflightFailure } from "@cotal-ai/workspace";
 /**
  * The rules behind `cotal meshes add`, as decisions rather than side effects.
@@ -31,6 +32,22 @@ export declare function isDir(path: string): boolean;
  * here repeats the input — the commonest malformed broker URL is a half-typed credential one.
  */
 export declare function checkServer(raw: string): Check<string>;
+/**
+ * May this machine send its credentials to that address?
+ *
+ * Registering a mesh is how a machine joins a broker it does not run, and every later command then
+ * dials that address with an agent credential in the CONNECT line. NATS sends the initial INFO in
+ * plaintext and unauthenticated, so an on-path attacker forges one that does not set
+ * `tls_required` and reads the credential; the client side is the only fence, and this build has
+ * no client-TLS surface yet. So the address itself is the gate. See {@link classifyJoinTarget} for
+ * the ranges and for why hostnames are refused even when they resolve somewhere permitted.
+ *
+ * This is a SAFETY rule, not a liveness check, which is why it sits with {@link checkServer} above
+ * the `--force` branch rather than inside it. `--force` exists to register a mesh that is *down*
+ * right now; it must not double as permission to ship credentials across an untrusted network,
+ * where there is nothing to verify later and no error to come back and fix.
+ */
+export declare function checkDialPolicy(server: string, allowUnencryptedOverlay?: boolean): Check<JoinTarget>;
 /** Where this mesh's local trust + personas live. An explicit path must be an existing directory
  *  (the record's whole job is to point at `.cotal/auth` and `.cotal/agents` under it). With no
  *  flag, the nearest genuine project up-tree — and `findCotalRoot` returns its STARTING directory

package/dist/commands/meshes-add.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"meshes-add.d.ts","sourceRoot":"","sources":["../../src/commands/meshes-add.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAYL,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,gBAAgB,EACtB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;GASG;AAEH,uGAAuG;AACvG,MAAM,MAAM,KAAK,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAK/E;;kEAEkE;AAClE,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAM3C;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAgBtD;AAED;;;wFAGwF;AACxF,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAW9E;AAED;0EAC0E;AAC1E,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAY7H;AAED;;;gFAGgF;AAChF,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC,CAM7G;AAOD;;;;;+BAK+B;AAC/B,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,GAAG,aAAa,CAAC,CAI/F;AAED,yFAAyF;AACzF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAM7J;AAED;8FAC8F;AAC9F,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,UAAU,CA+B7I;AAED;;qGAEqG;AACrG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAehH;AAED;kCACkC;AAClC,wBAAsB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAG3E;AAED;8FAC8F;AAC9F,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,GAAG;IAAE,cAAc,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAS/F;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAM1D"}
+{"version":3,"file":"meshes-add.d.ts","sourceRoot":"","sources":["../../src/commands/meshes-add.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAsB,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EAYL,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,gBAAgB,EACtB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;GASG;AAEH,uGAAuG;AACvG,MAAM,MAAM,KAAK,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAiB/E;;kEAEkE;AAClE,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAM3C;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAgBtD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,uBAAuB,UAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAiBlG;AAED;;;wFAGwF;AACxF,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAW9E;AAED;0EAC0E;AAC1E,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAY7H;AAED;;;gFAGgF;AAChF,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC,CAM7G;AAOD;;;;;+BAK+B;AAC/B,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,GAAG,aAAa,CAAC,CAI/F;AAED,yFAAyF;AACzF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAM7J;AAED;8FAC8F;AAC9F,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,UAAU,CA+B7I;AAED;;qGAEqG;AACrG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAehH;AAED;kCACkC;AAClC,wBAAsB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAG3E;AAED;8FAC8F;AAC9F,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,GAAG;IAAE,cAAc,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAS/F;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAM1D"}

package/dist/commands/meshes-add.js

@@ -1,8 +1,19 @@
 import { statSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { probeConnect } from "@cotal-ai/core";
+import { classifyJoinTarget } from "../lib/join-target.js";
 import { authDir, findCotalRoot, findMesh, getCurrent, homeCotalDir, listSpaceAccounts, loadSpaceAuth, personaDir, preflightTarget, recordMesh, setCurrent, } from "@cotal-ai/workspace";
 const bad = (message) => ({ ok: false, message });
+/** The cost of the copy every "copy the mesh's auth here" recovery asks the operator to make.
+ *
+ *  It is one shared constant because there are five such instructions and the review found four of
+ *  them saying only "credentials". A directory that composes for an auth mesh carries the account
+ *  SIGNING SEED, so the machine holding it can mint any identity in the space: the honest word is
+ *  authority, not credentials, and the operator hears it at the moment they are told to copy
+ *  rather than only in a guide they may never open. */
+const CA_COST = "\n  Note: that directory carries the space's account signing seed, so any machine holding it can mint" +
+    "\n  any identity in the space until the signing key is rotated and every credential re-minted. Copy it" +
+    "\n  only to machines you would trust with the whole mesh.";
 const good = (value) => ({ ok: true, value });
 /** Is this path a directory? `existsSync` is not the question: a regular FILE named `.cotal` would
  *  pass it and record a root whose `.cotal/auth` and `.cotal/agents` can never exist. `statSync`
@@ -43,6 +54,40 @@ export function checkServer(raw) {
         return bad("✗ --server names no host - a broker URL needs one (e.g. nats://127.0.0.1:4222)");
     return good(raw);
 }
+/**
+ * May this machine send its credentials to that address?
+ *
+ * Registering a mesh is how a machine joins a broker it does not run, and every later command then
+ * dials that address with an agent credential in the CONNECT line. NATS sends the initial INFO in
+ * plaintext and unauthenticated, so an on-path attacker forges one that does not set
+ * `tls_required` and reads the credential; the client side is the only fence, and this build has
+ * no client-TLS surface yet. So the address itself is the gate. See {@link classifyJoinTarget} for
+ * the ranges and for why hostnames are refused even when they resolve somewhere permitted.
+ *
+ * This is a SAFETY rule, not a liveness check, which is why it sits with {@link checkServer} above
+ * the `--force` branch rather than inside it. `--force` exists to register a mesh that is *down*
+ * right now; it must not double as permission to ship credentials across an untrusted network,
+ * where there is nothing to verify later and no error to come back and fix.
+ */
+export function checkDialPolicy(server, allowUnencryptedOverlay = false) {
+    try {
+        // WHEN THE RECORD CAN CARRY TLS INTENT, THIS LINE CHANGES AND THIS COMMENT GOES.
+        // `tlsRequired` is a property of the connection this registration will produce, and no field
+        // records it yet; it arrives with the work that teaches the broker to serve TLS. Passing a
+        // hardcoded `false` is honest rather than lazy: today no dial can require TLS.
+        //
+        // What that means CONCRETELY: public addresses, ordinary private ranges and hostnames are
+        // refused outright. An overlay literal is refused TOO unless the operator passed the explicit
+        // opt-in, because a printed warning is not a fence — stderr is not read by scripts, and the
+        // warning was never persisted, so nothing repeated it at the dials that followed. With the
+        // opt-in it is permitted and returns a residual, which the caller both prints AND records as
+        // consent. When the TLS field exists this passes the record's real intent and the opt-in goes.
+        return good(classifyJoinTarget(server, { tlsRequired: false, allowUnencryptedOverlay }));
+    }
+    catch (e) {
+        return bad(`✗ ${e.message}`);
+    }
+}
 /** Where this mesh's local trust + personas live. An explicit path must be an existing directory
  *  (the record's whole job is to point at `.cotal/auth` and `.cotal/agents` under it). With no
  *  flag, the nearest genuine project up-tree — and `findCotalRoot` returns its STARTING directory
@@ -71,7 +116,7 @@ export function checkMode(space, root, accounts, flag) {
         return bad(`✗ --mode user cannot be registered by hand - a user-auth space carries pinned IdP trust (issuer, audience, login URL) that only \`cotal up --user-auth\` establishes, in the root where its broker runs`);
     const mode = flag ?? (accounts.includes(space) ? "auth" : "open");
     if (mode === "auth" && !accounts.includes(space))
-        return bad(`✗ --mode auth needs "${space}"'s trust material under ${authDir(root)}${accounts.length ? ` (it holds "${accounts.join('", "')}")` : " (it holds none)"} - copy the mesh's account + creds there, point --root at where they already are, or register it --mode open`);
+        return bad(`✗ --mode auth needs "${space}"'s trust material under ${authDir(root)}${accounts.length ? ` (it holds "${accounts.join('", "')}")` : " (it holds none)"} - copy the mesh's account + creds there, point --root at where they already are, or register it --mode open` + CA_COST);
     return good(mode);
 }
 /** For an AUTH registration the root must yield trust that actually COMPOSES. An account record on
@@ -84,7 +129,7 @@ export function checkTrust(mode, root, space) {
     const auth = loadSpaceAuth(authDir(root), space);
     return auth
         ? good(auth)
-        : bad(`✗ "${space}" has an account record under ${authDir(root)} but its trust does not compose (the broker record or signing material is missing) - copy the mesh's full .cotal/auth from where it runs, or register it --mode open`);
+        : bad(`✗ "${space}" has an account record under ${authDir(root)} but its trust does not compose (the broker record or signing material is missing) - copy the mesh's full .cotal/auth from where it runs, or register it --mode open` + CA_COST);
 }
 /** Budget for the credless mode probe. Generous on purpose: a slow answer must not be read as "the
  *  broker is open" (it is only ever read as `ok` vs a reason), and this runs once, at registration,
@@ -107,7 +152,7 @@ export function checkEnforcement(mode, enforces, server, space, root) {
     if (mode === "auth" && enforces === "open")
         return bad(`✗ the broker at ${server} accepts unauthenticated connections, so it cannot be registered as an auth mesh - it enforces no credentials; register it \`--mode open\`, or point --server at the authenticated broker for "${space}"`);
     if (mode === "open" && enforces === "auth")
-        return bad(`✗ the broker at ${server} requires auth, so it cannot be registered as an open mesh - copy that mesh's account + creds under ${authDir(root)} and re-run with --mode auth`);
+        return bad(`✗ the broker at ${server} requires auth, so it cannot be registered as an open mesh - copy that mesh's account + creds under ${authDir(root)} and re-run with --mode auth` + CA_COST);
     return good(undefined);
 }
 /** The target this registration would resolve to. `flag-server` is the source that can never
@@ -156,7 +201,7 @@ export function verifyFailureMessage(kind, space, server, root) {
             return `✗ the broker at ${server} rejected the credentials for "${space}" under ${authDir(root)} - re-mint them where the mesh runs, or check that --server points at that mesh`;
         case "open-wants-auth":
         case "registry-open-now-auth":
-            return `✗ the broker at ${server} requires auth, but nothing under ${authDir(root)} covers "${space}" - copy the mesh's account + creds there and re-run with --mode auth`;
+            return `✗ the broker at ${server} requires auth, but nothing under ${authDir(root)} covers "${space}" - copy the mesh's account + creds there and re-run with --mode auth` + CA_COST;
         case "stale-auth":
             return `✗ the credentials for "${space}" under ${authDir(root)} have EXPIRED - re-mint them where the mesh runs (the broker itself is up)`;
         case "tls-trust":

package/dist/commands/meshes-add.js.map

@@ -1 +1 @@
-{"version":3,"file":"meshes-add.js","sourceRoot":"","sources":["../../src/commands/meshes-add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAkB,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EACL,OAAO,EACP,aAAa,EACb,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,eAAe,EACf,UAAU,EACV,UAAU,GAIX,MAAM,qBAAqB,CAAC;AAgB7B,MAAM,GAAG,GAAG,CAAC,OAAe,EAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AACxE,MAAM,IAAI,GAAG,CAAI,KAAQ,EAAY,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAE9D;;kEAEkE;AAClE,MAAM,UAAU,KAAK,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,+EAA+E,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QACxD,OAAO,GAAG,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,iEAAiE,CAAC,CAAC;IACjI,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ;QAC1B,OAAO,GAAG,CAAC,2CAA2C,CAAC,CAAC,QAAQ,uGAAuG,CAAC,CAAC;IAC3K,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI;QACpB,OAAO,GAAG,CAAC,mDAAmD,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1G,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC,sDAAsD,CAAC,CAAC;IACzG,IAAI,CAAC,CAAC,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,gFAAgF,CAAC,CAAC;IAC9G,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED;;;wFAGwF;AACxF,MAAM,UAAU,SAAS,CAAC,IAAwB,EAAE,GAAW;IAC7D,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,KAAK,CAAC,GAAG,CAAC;YACf,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACX,CAAC,CAAC,GAAG,CAAC,YAAY,GAAG,+FAA+F,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC;QACrF,OAAO,GAAG,CAAC,iKAAiK,CAAC,CAAC;IAChL,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,IAAY,EAAE,QAAkB,EAAE,IAAwB;IACjG,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM;QAC7E,OAAO,GAAG,CAAC,uCAAuC,IAAI,IAAI,CAAC,CAAC;IAC9D,iGAAiG;IACjG,gGAAgG;IAChG,0CAA0C;IAC1C,IAAI,IAAI,KAAK,MAAM;QACjB,OAAO,GAAG,CAAC,yMAAyM,CAAC,CAAC;IACxN,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAClE,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC9C,OAAO,GAAG,CAAC,wBAAwB,KAAK,4BAA4B,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,8GAA8G,CAAC,CAAC;IACrR,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAED;;;gFAGgF;AAChF,MAAM,UAAU,UAAU,CAAC,IAAuB,EAAE,IAAY,EAAE,KAAa;IAC7E,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACjD,OAAO,IAAI;QACT,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,iCAAiC,OAAO,CAAC,IAAI,CAAC,sKAAsK,CAAC,CAAC;AAC3O,CAAC;AAED;;iEAEiE;AACjE,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAEpC;;;;;+BAK+B;AAC/B,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC9E,IAAI,IAAI,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC3B,OAAO,IAAI,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC;AAClE,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,gBAAgB,CAAC,IAAuB,EAAE,QAAyC,EAAE,MAAc,EAAE,KAAa,EAAE,IAAY;IAC9I,IAAI,IAAI,KAAK,MAAM,IAAI,QAAQ,KAAK,MAAM;QACxC,OAAO,GAAG,CAAC,mBAAmB,MAAM,kMAAkM,KAAK,GAAG,CAAC,CAAC;IAClP,IAAI,IAAI,KAAK,MAAM,IAAI,QAAQ,KAAK,MAAM;QACxC,OAAO,GAAG,CAAC,mBAAmB,MAAM,uGAAuG,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC1L,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;AACzB,CAAC;AAED;8FAC8F;AAC9F,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,MAAc,EAAE,IAAY,EAAE,IAAuB,EAAE,IAA2B;IAC/H,OAAO;QACL,IAAI;QACJ,MAAM;QACN,KAAK;QACL,IAAI;QACJ,uFAAuF;QACvF,0FAA0F;QAC1F,uBAAuB;QACvB,EAAE;QACF,wFAAwF;QACxF,6FAA6F;QAC7F,6EAA6E;QAC7E,0FAA0F;QAC1F,yCAAyC;QACzC,EAAE;QACF,gGAAgG;QAChG,+FAA+F;QAC/F,gGAAgG;QAChG,4EAA4E;QAC5E,EAAE;QACF,6FAA6F;QAC7F,8FAA8F;QAC9F,kGAAkG;QAClG,gGAAgG;QAChG,oEAAoE;QACpE,WAAW,EAAE,KAAK;QAClB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC;QAC7B,MAAM,EAAE,aAAa;KACtB,CAAC;AACJ,CAAC;AAED;;qGAEqG;AACrG,MAAM,UAAU,oBAAoB,CAAC,IAAsB,EAAE,KAAa,EAAE,MAAc,EAAE,IAAY;IACtG,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,aAAa;YAChB,OAAO,2BAA2B,MAAM,8DAA8D,CAAC;QACzG,KAAK,gBAAgB,CAAC;QACtB,KAAK,yBAAyB;YAC5B,OAAO,mBAAmB,MAAM,kCAAkC,KAAK,WAAW,OAAO,CAAC,IAAI,CAAC,iFAAiF,CAAC;QACnL,KAAK,iBAAiB,CAAC;QACvB,KAAK,wBAAwB;YAC3B,OAAO,mBAAmB,MAAM,qCAAqC,OAAO,CAAC,IAAI,CAAC,YAAY,KAAK,uEAAuE,CAAC;QAC7K,KAAK,YAAY;YACf,OAAO,0BAA0B,KAAK,WAAW,OAAO,CAAC,IAAI,CAAC,4EAA4E,CAAC;QAC7I,KAAK,WAAW;YACd,OAAO,mBAAmB,MAAM,yKAAyK,CAAC;IAC9M,CAAC;AACH,CAAC;AAED;kCACkC;AAClC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAkB;IACnD,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9G,CAAC;AAED;8FAC8F;AAC9F,MAAM,UAAU,WAAW,CAAC,KAAgB;IAC1C,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,aAAa,GAAG,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,2BAA2B;IACzF,UAAU,CAAC,KAAK,CAAC,CAAC;IAClB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,CAAC,aAAa,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,oBAAqB,CAAW,CAAC,OAAO,2FAA2F,CAAC,CAAC;IACpK,CAAC;AACH,CAAC"}
+{"version":3,"file":"meshes-add.js","sourceRoot":"","sources":["../../src/commands/meshes-add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAkB,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAmB,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EACL,OAAO,EACP,aAAa,EACb,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,eAAe,EACf,UAAU,EACV,UAAU,GAIX,MAAM,qBAAqB,CAAC;AAgB7B,MAAM,GAAG,GAAG,CAAC,OAAe,EAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AAExE;;;;;;uDAMuD;AACvD,MAAM,OAAO,GACX,uGAAuG;IACvG,wGAAwG;IACxG,2DAA2D,CAAC;AAC9D,MAAM,IAAI,GAAG,CAAI,KAAQ,EAAY,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAE9D;;kEAEkE;AAClE,MAAM,UAAU,KAAK,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,+EAA+E,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QACxD,OAAO,GAAG,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,iEAAiE,CAAC,CAAC;IACjI,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ;QAC1B,OAAO,GAAG,CAAC,2CAA2C,CAAC,CAAC,QAAQ,uGAAuG,CAAC,CAAC;IAC3K,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI;QACpB,OAAO,GAAG,CAAC,mDAAmD,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1G,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC,sDAAsD,CAAC,CAAC;IACzG,IAAI,CAAC,CAAC,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,gFAAgF,CAAC,CAAC;IAC9G,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,uBAAuB,GAAG,KAAK;IAC7E,IAAI,CAAC;QACH,iFAAiF;QACjF,6FAA6F;QAC7F,2FAA2F;QAC3F,+EAA+E;QAC/E,EAAE;QACF,0FAA0F;QAC1F,8FAA8F;QAC9F,4FAA4F;QAC5F,2FAA2F;QAC3F,6FAA6F;QAC7F,+FAA+F;QAC/F,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC;IAC3F,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,GAAG,CAAC,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED;;;wFAGwF;AACxF,MAAM,UAAU,SAAS,CAAC,IAAwB,EAAE,GAAW;IAC7D,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,KAAK,CAAC,GAAG,CAAC;YACf,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACX,CAAC,CAAC,GAAG,CAAC,YAAY,GAAG,+FAA+F,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC;QACrF,OAAO,GAAG,CAAC,iKAAiK,CAAC,CAAC;IAChL,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,IAAY,EAAE,QAAkB,EAAE,IAAwB;IACjG,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM;QAC7E,OAAO,GAAG,CAAC,uCAAuC,IAAI,IAAI,CAAC,CAAC;IAC9D,iGAAiG;IACjG,gGAAgG;IAChG,0CAA0C;IAC1C,IAAI,IAAI,KAAK,MAAM;QACjB,OAAO,GAAG,CAAC,yMAAyM,CAAC,CAAC;IACxN,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAClE,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC9C,OAAO,GAAG,CAAC,wBAAwB,KAAK,4BAA4B,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,8GAA8G,GAAG,OAAO,CAAC,CAAC;IAC/R,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAED;;;gFAGgF;AAChF,MAAM,UAAU,UAAU,CAAC,IAAuB,EAAE,IAAY,EAAE,KAAa;IAC7E,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACjD,OAAO,IAAI;QACT,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,iCAAiC,OAAO,CAAC,IAAI,CAAC,sKAAsK,GAAG,OAAO,CAAC,CAAC;AACrP,CAAC;AAED;;iEAEiE;AACjE,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAEpC;;;;;+BAK+B;AAC/B,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC9E,IAAI,IAAI,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC3B,OAAO,IAAI,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC;AAClE,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,gBAAgB,CAAC,IAAuB,EAAE,QAAyC,EAAE,MAAc,EAAE,KAAa,EAAE,IAAY;IAC9I,IAAI,IAAI,KAAK,MAAM,IAAI,QAAQ,KAAK,MAAM;QACxC,OAAO,GAAG,CAAC,mBAAmB,MAAM,kMAAkM,KAAK,GAAG,CAAC,CAAC;IAClP,IAAI,IAAI,KAAK,MAAM,IAAI,QAAQ,KAAK,MAAM;QACxC,OAAO,GAAG,CAAC,mBAAmB,MAAM,uGAAuG,OAAO,CAAC,IAAI,CAAC,8BAA8B,GAAG,OAAO,CAAC,CAAC;IACpM,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;AACzB,CAAC;AAED;8FAC8F;AAC9F,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,MAAc,EAAE,IAAY,EAAE,IAAuB,EAAE,IAA2B;IAC/H,OAAO;QACL,IAAI;QACJ,MAAM;QACN,KAAK;QACL,IAAI;QACJ,uFAAuF;QACvF,0FAA0F;QAC1F,uBAAuB;QACvB,EAAE;QACF,wFAAwF;QACxF,6FAA6F;QAC7F,6EAA6E;QAC7E,0FAA0F;QAC1F,yCAAyC;QACzC,EAAE;QACF,gGAAgG;QAChG,+FAA+F;QAC/F,gGAAgG;QAChG,4EAA4E;QAC5E,EAAE;QACF,6FAA6F;QAC7F,8FAA8F;QAC9F,kGAAkG;QAClG,gGAAgG;QAChG,oEAAoE;QACpE,WAAW,EAAE,KAAK;QAClB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC;QAC7B,MAAM,EAAE,aAAa;KACtB,CAAC;AACJ,CAAC;AAED;;qGAEqG;AACrG,MAAM,UAAU,oBAAoB,CAAC,IAAsB,EAAE,KAAa,EAAE,MAAc,EAAE,IAAY;IACtG,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,aAAa;YAChB,OAAO,2BAA2B,MAAM,8DAA8D,CAAC;QACzG,KAAK,gBAAgB,CAAC;QACtB,KAAK,yBAAyB;YAC5B,OAAO,mBAAmB,MAAM,kCAAkC,KAAK,WAAW,OAAO,CAAC,IAAI,CAAC,iFAAiF,CAAC;QACnL,KAAK,iBAAiB,CAAC;QACvB,KAAK,wBAAwB;YAC3B,OAAO,mBAAmB,MAAM,qCAAqC,OAAO,CAAC,IAAI,CAAC,YAAY,KAAK,uEAAuE,GAAG,OAAO,CAAC;QACvL,KAAK,YAAY;YACf,OAAO,0BAA0B,KAAK,WAAW,OAAO,CAAC,IAAI,CAAC,4EAA4E,CAAC;QAC7I,KAAK,WAAW;YACd,OAAO,mBAAmB,MAAM,yKAAyK,CAAC;IAC9M,CAAC;AACH,CAAC;AAED;kCACkC;AAClC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAkB;IACnD,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9G,CAAC;AAED;8FAC8F;AAC9F,MAAM,UAAU,WAAW,CAAC,KAAgB;IAC1C,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,aAAa,GAAG,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,2BAA2B;IACzF,UAAU,CAAC,KAAK,CAAC,CAAC;IAClB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,CAAC,aAAa,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,oBAAqB,CAAW,CAAC,OAAO,2FAA2F,CAAC,CAAC;IACpK,CAAC;AACH,CAAC"}

package/dist/commands/meshes-wizard.d.ts

@@ -52,6 +52,7 @@ export interface WizardIO {
     }): Promise<T>;
     confirm(opts: {
         message: string;
+        initialValue?: boolean;
     }): Promise<boolean>;
 }
 /** The real terminal, via clack. Cancellation (Ctrl-C / Esc) exits here rather than returning a
@@ -69,6 +70,8 @@ export interface WizardSeed {
     root?: string;
     mode?: string;
     force?: boolean;
+    /** Pre-accepted overlay tunnel dependency (the flag form's `--allow-unencrypted-overlay`). */
+    allowUnencryptedOverlay?: boolean;
 }
 /** Run the guided registration. Returns false if the operator backed out (the caller exits 0 —
  *  cancelling is not a failure). */

package/dist/commands/meshes-wizard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"meshes-wizard.d.ts","sourceRoot":"","sources":["../../src/commands/meshes-wizard.ts"],"names":[],"mappings":"AAkBA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;GASG;AACH,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,GAAG,EAAE;QAAE,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC9E,OAAO,IAAI;QAAE,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC7D,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjI,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE;YAAE,KAAK,EAAE,CAAC,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACxG,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtD;AAED;0EAC0E;AAC1E,wBAAgB,OAAO,IAAI,QAAQ,CAgBlC;AAED;;kCAEkC;AAClC,wBAAgB,SAAS,IAAI,OAAO,CAEnC;AAED;wCACwC;AACxC,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;oCACoC;AACpC,wBAAsB,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,GAAE,QAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAoOzG"}
+{"version":3,"file":"meshes-wizard.d.ts","sourceRoot":"","sources":["../../src/commands/meshes-wizard.ts"],"names":[],"mappings":"AAmBA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;GASG;AACH,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,GAAG,EAAE;QAAE,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC9E,OAAO,IAAI;QAAE,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC7D,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjI,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE;YAAE,KAAK,EAAE,CAAC,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACxG,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9E;AAED;0EAC0E;AAC1E,wBAAgB,OAAO,IAAI,QAAQ,CAmBlC;AAED;;kCAEkC;AAClC,wBAAgB,SAAS,IAAI,OAAO,CAEnC;AAED;wCACwC;AACxC,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8FAA8F;IAC9F,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AAED;oCACoC;AACpC,wBAAsB,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,GAAE,QAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAkSzG"}

package/dist/commands/meshes-wizard.js

@@ -2,7 +2,7 @@ import * as p from "@clack/prompts";
 import { findMesh } from "@cotal-ai/workspace";
 import { bold, brand, brandBold, dim, ok } from "../lib/theme.js";
 import { abortIfCancel } from "../lib/cancel.js";
-import { candidateTarget, checkEnforcement, checkMode, checkRoot, checkServer, checkTrust, isDir, probeEnforcement, spacesAtRoot, verifyTarget, writeRecord, } from "./meshes-add.js";
+import { candidateTarget, checkDialPolicy, checkEnforcement, checkMode, checkRoot, checkServer, checkTrust, isDir, probeEnforcement, spacesAtRoot, verifyTarget, writeRecord, } from "./meshes-add.js";
 /** The real terminal, via clack. Cancellation (Ctrl-C / Esc) exits here rather than returning a
  *  sentinel the wizard body would have to thread through every branch. */
 export function clackIO() {
@@ -18,7 +18,10 @@ export function clackIO() {
         },
         text: async (opts) => abortIfCancel(await p.text(opts)),
         select: async (opts) => abortIfCancel(await p.select(opts)),
-        confirm: async (opts) => abortIfCancel(await p.confirm({ ...opts, initialValue: true })),
+        // `initialValue` is a per-call decision, not a house style: an ordinary "register this?"
+        // may default yes, but a consent to an unencrypted transport must not be given by pressing
+        // Enter. Callers that omit it keep the old default.
+        confirm: async (opts) => abortIfCancel(await p.confirm({ initialValue: true, ...opts })),
     };
 }
 /** Whether a guided run is possible at all: both ends of the pipe must be a real terminal. Without
@@ -42,17 +45,35 @@ export async function addWizard(seed, cwd, io = clackIO()) {
     let replace = Boolean(seed.force);
     // ── 1. the one thing that cannot be derived ────────────────────────────────────────────────────
     let server = seed.server;
+    // The address the operator accepted the tunnel dependency FOR, not merely that they once did.
+    // A bare boolean survives "use a different address", so accepting an overlay and then finishing
+    // on loopback wrote evidence of a consent that was never given for the recorded target. The
+    // flag form never had this because it persists from the FINAL classification; this now matches.
+    // `undefined` when nothing is accepted; a pre-seeded flag accepts only the seeded server.
+    let ackedFor = seed.allowUnencryptedOverlay && seed.server ? seed.server : undefined;
+    /** Whether the FINAL settled address carried a residual — the thing actually recorded. */
+    let overlayResidual = false;
     let enforces = "unreachable";
     for (;;) {
         if (!server) {
             server = await io.text({
                 message: "Broker URL of the mesh you want to reach",
-                placeholder: "nats://10.0.0.5:4222",
+                placeholder: "nats://100.90.12.34:4222",
                 validate: (v) => {
                     if (!v)
                         return "Required - this is the address the mesh's broker listens on.";
                     const r = checkServer(v);
-                    return r.ok ? undefined : r.message.replace(/^✗ (--server )?/, "");
+                    if (!r.ok)
+                        return r.message.replace(/^✗ (--server )?/, "");
+                    // The same safety gate the flag form applies, asked here so a refused address is
+                    // caught at the prompt instead of after the operator has answered three more
+                    // questions. Both front ends must agree; that is what this module exists for.
+                    // Classified as a CANDIDATE here (acceptance granted for the check) so an overlay
+                    // address survives the prompt and reaches the question below. Refusing it here made
+                    // that question unreachable: the operator could never say yes to something the
+                    // validator had already rejected.
+                    const d = checkDialPolicy(v, true);
+                    return d.ok ? undefined : d.message.replace(/^✗ /, "");
                 },
             });
         }
@@ -63,7 +84,44 @@ export async function addWizard(seed, cwd, io = clackIO()) {
                 server = undefined;
                 continue;
             }
+            const dial = checkDialPolicy(server, true); // candidate; the ask below decides
+            if (!dial.ok) {
+                io.log.error(dial.message);
+                server = undefined;
+                continue;
+            }
+        }
+        // A permitted-but-not-guaranteed target is said out loud here too, not only in the flag form.
+        // Recomputed rather than threaded because the typed path validates inside its own callback:
+        // the check is pure, and one call site for the warning beats two ways of reaching it.
+        // The guided form ASKS instead of taking a flag, which is the same explicit acceptance by a
+        // different surface. Refusing here without offering the choice would make the wizard unable to
+        // register an overlay mesh at all, and silently accepting would be the warning-and-continue
+        // shape that was just removed.
+        if (ackedFor !== server) {
+            const probe = checkDialPolicy(server, true);
+            if (probe.ok && probe.value.residual) {
+                io.log.warn(probe.value.residual);
+                // DEFAULT DENY. This is the one confirmation in the wizard where pressing Enter must not
+                // agree: everything else here is a convenience default, this is consent to a transport we
+                // cannot verify.
+                const accepted = await io.confirm({ message: "Register it anyway, accepting that dependency?", initialValue: false });
+                if (!accepted) {
+                    server = undefined;
+                    continue;
+                }
+                ackedFor = server; // bound to THIS address; a different one asks again
+            }
+        }
+        // Re-checked with the REAL answer, so the decision is enforced by the same rule the flag form
+        // uses rather than by the branch above happening to be right.
+        const settled = checkDialPolicy(server, ackedFor === server);
+        if (!settled.ok) {
+            io.log.error(settled.message);
+            server = undefined;
+            continue;
         }
+        overlayResidual = Boolean(settled.value.residual);
         const spin = io.spinner();
         spin.start(`Asking ${server} what it is`);
         enforces = await probeEnforcement(server);
@@ -120,7 +178,10 @@ export async function addWizard(seed, cwd, io = clackIO()) {
         if (enforces !== "auth" || accounts.length > 0)
             break;
         io.log.warn(`That broker requires credentials, and ${bold(root)} holds none.\n` +
-            dim("Copy the mesh's .cotal/auth from the machine it runs on (or `cotal mint` there), then point at that folder."));
+            dim("Copy the mesh's .cotal/auth from the machine it runs on, then point at that folder.\n") +
+            dim("That directory carries the space's account SIGNING SEED: a machine holding it can mint any\n") +
+            dim("identity in the space, so it is a certificate authority for the mesh rather than a client of it.\n") +
+            dim("`cotal mint` alone does NOT satisfy this - registration needs composable signing material."));
         const next = await io.select({
             message: "That folder holds no credentials for this broker. What next?",
             options: [
@@ -234,7 +295,18 @@ export async function addWizard(seed, cwd, io = clackIO()) {
     const go = await io.confirm({ message: "Register this mesh?" });
     if (!go)
         return cancelled(io, "Nothing was registered.");
-    const entry = { space, server: server, root, mode, origin: "manual", ts: new Date().toISOString() };
+    // The guided consent is PERSISTED, exactly as the flag form persists it. Asking the operator and
+    // then writing a record that does not remember the answer is the printed-and-forgotten shape the
+    // opt-in replaced, one surface over.
+    const entry = {
+        space, server: server, root, mode, origin: "manual",
+        // From the FINAL classification, never from "the operator accepted something earlier". The
+        // flag form persists `dial.residual` for the same reason: the field is evidence about the
+        // recorded target, and evidence that can detach from its subject is worse than none, because
+        // the use-time fence this exists for would read it as authorization.
+        ...(overlayResidual ? { unencryptedOverlay: true } : {}),
+        ts: new Date().toISOString(),
+    };
     const result = writeRecord(entry);
     // Padded from the rendered widths, not a guess: the commands carry the space name, so a
     // hard-coded gutter misaligns for every name but the one it was written against.