@cotal-ai/cli 0.5.0 → 0.7.0

package/dist/index.js

@@ -1,9 +1,10 @@
 import { registry } from "@cotal-ai/core";
 import { up } from "./commands/up.js";
 import { down } from "./commands/down.js";
+import { use, useComplete } from "./commands/use.js";
+import { meshes } from "./commands/meshes.js";
 import { setup, go } from "./commands/setup.js";
 import { join } from "./commands/join.js";
-import { watch } from "./commands/watch.js";
 import { console_ } from "./commands/console.js";
 import { demo } from "./commands/demo.js";
 import { web } from "./commands/web.js";
@@ -11,12 +12,11 @@ import { spawn, spawnComplete } from "./commands/spawn.js";
 import { personas, personasComplete } from "./commands/personas.js";
 import { completion, completionComplete, complete } from "./commands/completion.js";
 import { mint } from "./commands/mint.js";
-import { signer } from "./commands/signer.js";
 import { channels } from "./commands/channels.js";
 import { history } from "./commands/history.js";
 import { feedback } from "./commands/feedback.js";
-import { dm, msg, ask, msgComplete, askComplete } from "./commands/send.js";
-/** The minimal mesh CLI: thin NATS clients (up/join/watch), plus `spawn` — a
+import { send, sendComplete } from "./commands/send.js";
+/** The minimal mesh CLI: thin NATS clients (up/join/console), plus `spawn` — a
  *  foreground agent launch that reuses the connector's launch recipe. Self-registers
  *  on import; heavier surfaces (the manager's control plane) register the same way
  *  and are composed at a root. */
@@ -46,48 +46,39 @@ const baseCommands = [
         kind: "command",
         name: "down",
         group: "Mesh",
-        summary: "stop a background mesh started with `up --detach`",
+        summary: "stop a background mesh started with `up --detach` (run from its project — local only)",
         run: down,
     },
     {
         kind: "command",
-        name: "join",
-        group: "Mesh",
-        summary: "join a space (interactive) — --space <s> --name <n> [--role <r>]",
-        run: join,
-    },
-    {
-        kind: "command",
-        name: "watch",
+        name: "meshes",
         group: "Mesh",
-        summary: "observe all activity in a space — --space <s>",
-        run: watch,
+        summary: "list the running meshes (a `*` marks the `current` default a bare spawn joins)",
+        run: meshes,
     },
     {
         kind: "command",
-        name: "dm",
+        name: "use",
         group: "Mesh",
-        summary: "direct-message a peer by name",
-        usage: 'dm <agent> "<text>"  [--space <s>] [--server <url>] [--creds <path>]',
-        run: dm,
+        summary: "set the default mesh for a bare `cotal spawn` when several are running — use <space>",
+        run: use,
+        complete: useComplete,
     },
     {
         kind: "command",
-        name: "msg",
+        name: "join",
         group: "Mesh",
-        summary: "broadcast a message to a channel",
-        usage: 'msg <channel> "<text>"  [--space <s>] [--server <url>] [--creds <path>]',
-        run: msg,
-        complete: msgComplete,
+        summary: "join a space (interactive) — --space <s> --name <n> [--role <r>]",
+        run: join,
     },
     {
         kind: "command",
-        name: "ask",
+        name: "send",
         group: "Mesh",
-        summary: "anycast a message to a role (one instance answers)",
-        usage: 'ask <role> "<text>"  [--space <s>] [--server <url>] [--creds <path>]',
-        run: ask,
-        complete: askComplete,
+        summary: "send one message, then exit — send <dm <agent> | msg <channel> | ask <role>> \"<text>\"",
+        usage: 'send <dm <agent> | msg <channel> | ask <role>> "<text>"  [--space <s>] [--server <url>] [--creds <path>]',
+        run: send,
+        complete: sendComplete,
     },
     {
         kind: "command",
@@ -100,6 +91,9 @@ const baseCommands = [
         kind: "command",
         name: "demo",
         group: "Mesh",
+        // A dev/test traffic generator (see docs/protocol-view.md) — runnable, but kept off the
+        // top-level help so it doesn't clutter the user-facing surface.
+        hidden: true,
         summary: "replay a scripted multi-agent trace (all message types) to exercise the console/web — --space <s> [--interval <ms>] [--once]",
         run: demo,
     },
@@ -145,16 +139,9 @@ const baseCommands = [
         kind: "command",
         name: "mint",
         group: "Mesh",
-        summary: "mint a creds file for a space (auth mode) — mint <name> --profile <agent|observer> [--out <path>]",
+        summary: "mint a creds file for a space (auth mode) — mint <name> --profile <agent|observer> [--out <path>]; --signer emits a stripped account-signing file (no operator key) for a containerized manager",
         run: mint,
     },
-    {
-        kind: "command",
-        name: "signer",
-        group: "Mesh",
-        summary: "emit a stripped signer file (account signing material only, no operator key) for a containerized manager — [--out <path>] [--force]",
-        run: signer,
-    },
     {
         kind: "command",
         name: "channels",

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAgB,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpF,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAE5E;;;kCAGkC;AAClC,MAAM,YAAY,GAAc;IAC9B;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,sGAAsG;QAC/G,GAAG,EAAE,KAAK;KACX;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,yFAAyF;QAClG,GAAG,EAAE,EAAE;KACR;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,oGAAoG;QAC7G,GAAG,EAAE,EAAE;KACR;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,mDAAmD;QAC5D,GAAG,EAAE,IAAI;KACV;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,kEAAkE;QAC3E,GAAG,EAAE,IAAI;KACV;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,+CAA+C;QACxD,GAAG,EAAE,KAAK;KACX;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,+BAA+B;QACxC,KAAK,EAAE,sEAAsE;QAC7E,GAAG,EAAE,EAAE;KACR;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,kCAAkC;QAC3C,KAAK,EAAE,yEAAyE;QAChF,GAAG,EAAE,GAAG;QACR,QAAQ,EAAE,WAAW;KACtB;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,oDAAoD;QAC7D,KAAK,EAAE,sEAAsE;QAC7E,GAAG,EAAE,GAAG;QACR,QAAQ,EAAE,WAAW;KACtB;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,yGAAyG;QAClH,GAAG,EAAE,QAAQ;KACd;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,8HAA8H;QACvI,GAAG,EAAE,IAAI;KACV;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,wGAAwG;QACjH,GAAG,EAAE,GAAG;KACT;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,QAAQ;QACf,OAAO,EACL,mKAAmK;QACrK,GAAG,EAAE,KAAK;QACV,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,QAAQ;QACf,OAAO,EACL,iMAAiM;QACnM,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,gBAAgB;KAC3B;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,4EAA4E;QACrF,GAAG,EAAE,UAAU;QACf,QAAQ,EAAE,kBAAkB;KAC7B;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,oEAAoE;QAC7E,GAAG,EAAE,QAAQ;KACd;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,mGAAmG;QAC5G,GAAG,EAAE,IAAI;KACV;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,MAAM;QACb,OAAO,EACL,qIAAqI;QACvI,GAAG,EAAE,MAAM;KACZ;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,MAAM;QACb,OAAO,EACL,qJAAqJ;QACvJ,GAAG,EAAE,QAAQ;KACd;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,8EAA8E;QACvF,GAAG,EAAE,OAAO;KACb;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,MAAM;QACb,OAAO,EACL,sJAAsJ;QACxJ,GAAG,EAAE,QAAQ;KACd;CACF,CAAC;AAEF,QAAQ,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,CAAC;AAEnC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAgB,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpF,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;kCAGkC;AAClC,MAAM,YAAY,GAAc;IAC9B;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,sGAAsG;QAC/G,GAAG,EAAE,KAAK;KACX;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,yFAAyF;QAClG,GAAG,EAAE,EAAE;KACR;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,oGAAoG;QAC7G,GAAG,EAAE,EAAE;KACR;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,uFAAuF;QAChG,GAAG,EAAE,IAAI;KACV;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,gFAAgF;QACzF,GAAG,EAAE,MAAM;KACZ;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,sFAAsF;QAC/F,GAAG,EAAE,GAAG;QACR,QAAQ,EAAE,WAAW;KACtB;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,kEAAkE;QAC3E,GAAG,EAAE,IAAI;KACV;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,yFAAyF;QAClG,KAAK,EAAE,0GAA0G;QACjH,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,YAAY;KACvB;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,yGAAyG;QAClH,GAAG,EAAE,QAAQ;KACd;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,MAAM;QACb,wFAAwF;QACxF,gEAAgE;QAChE,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,8HAA8H;QACvI,GAAG,EAAE,IAAI;KACV;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,wGAAwG;QACjH,GAAG,EAAE,GAAG;KACT;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,QAAQ;QACf,OAAO,EACL,mKAAmK;QACrK,GAAG,EAAE,KAAK;QACV,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,QAAQ;QACf,OAAO,EACL,iMAAiM;QACnM,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,gBAAgB;KAC3B;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,4EAA4E;QACrF,GAAG,EAAE,UAAU;QACf,QAAQ,EAAE,kBAAkB;KAC7B;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,oEAAoE;QAC7E,GAAG,EAAE,QAAQ;KACd;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,MAAM;QACb,OAAO,EACL,iMAAiM;QACnM,GAAG,EAAE,IAAI;KACV;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,MAAM;QACb,OAAO,EACL,qJAAqJ;QACvJ,GAAG,EAAE,QAAQ;KACd;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,8EAA8E;QACvF,GAAG,EAAE,OAAO;KACb;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,MAAM;QACb,OAAO,EACL,sJAAsJ;QACxJ,GAAG,EAAE,QAAQ;KACd;CACF,CAAC;AAEF,QAAQ,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,CAAC;AAEnC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC"}

package/dist/lib/connect.d.ts

@@ -0,0 +1,72 @@
+import { type MeshTarget, type Profile, type SpaceAuth } from "@cotal-ai/core";
+/**
+ * The one way every command that touches a running mesh figures out WHICH mesh + with what creds,
+ * and confirms it's actually up — so `spawn`, `send`/`dm`/`msg`/`ask`, `console`, `join`, `web`,
+ * `channels`, `history`, and `personas --running` all behave identically from any directory instead
+ * of each re-deriving it from a cwd walk-up (which mistook `$HOME/.cotal` for a space and crashed
+ * with a raw NATS auth violation). Two escape hatches take a RAW off-registry connection (no
+ * registry lookup, no stale-prune): explicit `--creds`, and `--server` + an unregistered `--space`
+ * (an open remote mesh that has no creds to pass).
+ */
+export interface ConnectFlags {
+    server?: string;
+    space?: string;
+    /** Explicit creds file — triggers a raw off-registry connection (see {@link connectOrExit}). */
+    creds?: string;
+}
+/** Raw NATS auth for an off-registry connection — a join link / --token / --user+--pass / --creds.
+ *  Structurally matches what `probeConnect` accepts. */
+export interface RawAuth {
+    token?: string;
+    user?: string;
+    pass?: string;
+    creds?: string;
+    tls?: boolean;
+}
+export interface Connection {
+    server: string;
+    space: string;
+    creds?: string;
+    /** The mesh's trust material when resolved from the registry on an auth mesh — undefined for an
+     *  open mesh or a raw off-registry connection (`--creds` or `--server`+unregistered `--space`).
+     *  (web keeps it for its per-delete manager mint.) */
+    auth?: SpaceAuth;
+}
+/**
+ * Resolve where a mesh-touching command connects + with what creds.
+ *  • Explicit `--creds` → a RAW off-registry connection: straight to `--server` (default loopback)
+ *    as `--space`, with those creds. No registry lookup, no stale-prune, plain reachability message
+ *    (the user is deliberately off-registry — e.g. a remote mesh that isn't locally recorded).
+ *  • Otherwise → resolve the running mesh from the registry (works from any dir), mint `role` creds
+ *    on an auth mesh, and preflight with the registry's stale-prune.
+ */
+export declare function connectOrExit(flags: ConnectFlags, role: Profile): Promise<Connection>;
+/** Reachability check for a RAW (off-registry) connection — one plain sentence, never a registry/
+ *  stale-entry message and never a prune. Used by the `--creds` escape hatch and `join`'s explicit
+ *  (link/token/creds) path, both of which connect to a broker the user named, not the registry. */
+export declare function reachableOrExit(server: string, auth?: RawAuth): Promise<void>;
+/** Resolve the mesh a command targets, exiting with one human sentence on an unresolved/ambiguous
+ *  registry rather than a stack trace. Prunes dead registry entries first so a crashed mesh doesn't
+ *  block a bare command or get offered by `--space`. */
+export declare function resolveTargetOrExit(flags: {
+    server?: string;
+    space?: string;
+}): Promise<MeshTarget>;
+/** The five distinct ways a preflight fails. Each also says whether the target OWNS its registry
+ *  entry (→ prune): `fromRegistry` means the server+mode came from a registry record (incl. a
+ *  `local-recorded` project matched by root), so a definitive failure is a stale-entry signal. */
+export type PreflightFailure = "unreachable" | "registry-creds-rejected" | "registry-open-now-auth" | "creds-rejected" | "open-wants-auth";
+/** Pure decision for {@link preflightOrExit} — separated from I/O so the whole branch tree is
+ *  unit-testable (it's the riskiest new logic: a wrong branch prunes a LIVE registry entry). A
+ *  non-registry source (`flag-server`/`local-space`, or a raw `--creds` connection) is NEVER pruned;
+ *  the user owns that diagnosis. */
+export declare function classifyPreflightFailure(source: MeshTarget["source"], reason: "auth-required" | "unreachable", hasAuth: boolean): {
+    prune: boolean;
+    kind: PreflightFailure;
+};
+/** Confirm the resolved mesh is up and accepts these creds — replaces the raw NATS "Authorization
+ *  Violation" trace with one sentence, and prunes the entry if the broker is gone / mismatched.
+ *  Probes with `probeCreds` when given (the caller's `--creds`/minted creds); otherwise mints a
+ *  throwaway identity from the target's own trust material. */
+export declare function preflightOrExit(target: MeshTarget, probeCreds?: string): Promise<void>;
+//# sourceMappingURL=connect.d.ts.map

package/dist/lib/connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../src/lib/connect.ts"],"names":[],"mappings":"AACA,OAAO,EAUL,KAAK,UAAU,EACf,KAAK,OAAO,EACZ,KAAK,SAAS,EACf,MAAM,gBAAgB,CAAC;AAIxB;;;;;;;;GAQG;AAEH,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gGAAgG;IAChG,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;wDACwD;AACxD,MAAM,WAAW,OAAO;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;0DAEsD;IACtD,IAAI,CAAC,EAAE,SAAS,CAAC;CAClB;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAoB3F;AAED;;mGAEmG;AACnG,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,OAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAWvF;AAED;;wDAEwD;AACxD,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,UAAU,CAAC,CAgBtB;AAED;;kGAEkG;AAClG,MAAM,MAAM,gBAAgB,GACxB,aAAa,GACb,yBAAyB,GACzB,wBAAwB,GACxB,gBAAgB,GAChB,iBAAiB,CAAC;AAEtB;;;oCAGoC;AACpC,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,EAC5B,MAAM,EAAE,eAAe,GAAG,aAAa,EACvC,OAAO,EAAE,OAAO,GACf;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAW5C;AAiBD;;;+DAG+D;AAC/D,wBAAsB,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS5F"}

package/dist/lib/connect.js

@@ -0,0 +1,115 @@
+import { readFileSync } from "node:fs";
+import { DEFAULT_SERVER, DEFAULT_SPACE, findMesh, getCurrent, mintCreds, newIdentity, probeConnect, removeMesh, resolveMeshTarget, } from "@cotal-ai/core";
+import { c } from "../ui.js";
+import { pruneStaleMeshes } from "./meshes.js";
+/**
+ * Resolve where a mesh-touching command connects + with what creds.
+ *  • Explicit `--creds` → a RAW off-registry connection: straight to `--server` (default loopback)
+ *    as `--space`, with those creds. No registry lookup, no stale-prune, plain reachability message
+ *    (the user is deliberately off-registry — e.g. a remote mesh that isn't locally recorded).
+ *  • Otherwise → resolve the running mesh from the registry (works from any dir), mint `role` creds
+ *    on an auth mesh, and preflight with the registry's stale-prune.
+ */
+export async function connectOrExit(flags, role) {
+    if (flags.creds) {
+        const server = flags.server ?? DEFAULT_SERVER;
+        const space = flags.space ?? DEFAULT_SPACE;
+        const creds = readFileSync(flags.creds, "utf8");
+        await reachableOrExit(server, { creds });
+        return { server, space, creds };
+    }
+    // A raw OPEN remote mesh: explicit `--server` + a `--space` that isn't locally registered. Naming
+    // both is as deliberate as `--creds`, but an open broker has no creds to pass — connect bare,
+    // off-registry (no registry lookup, no prune). A registered `--space` still goes through the
+    // resolver below (which honors `--server` as an override); `--server` alone resolves there too.
+    if (flags.server && flags.space && !findMesh(flags.space)) {
+        await reachableOrExit(flags.server, {});
+        return { server: flags.server, space: flags.space };
+    }
+    const target = await resolveTargetOrExit({ server: flags.server, space: flags.space });
+    const creds = target.auth ? await mintCreds(target.auth, newIdentity(), role) : undefined;
+    await preflightOrExit(target, creds);
+    return { server: target.server, space: target.space, creds, auth: target.auth };
+}
+/** Reachability check for a RAW (off-registry) connection — one plain sentence, never a registry/
+ *  stale-entry message and never a prune. Used by the `--creds` escape hatch and `join`'s explicit
+ *  (link/token/creds) path, both of which connect to a broker the user named, not the registry. */
+export async function reachableOrExit(server, auth = {}) {
+    const probe = await probeConnect(server, auth);
+    if (probe.ok)
+        return;
+    console.error(c.red(probe.reason === "auth-required"
+        ? `✗ credentials rejected at ${server} — check your creds, or the broker wants different auth`
+        : `✗ can't reach a broker at ${server} — is it running? (\`cotal up\`)`));
+    process.exit(1);
+}
+/** Resolve the mesh a command targets, exiting with one human sentence on an unresolved/ambiguous
+ *  registry rather than a stack trace. Prunes dead registry entries first so a crashed mesh doesn't
+ *  block a bare command or get offered by `--space`. */
+export async function resolveTargetOrExit(flags) {
+    await pruneStaleMeshes();
+    let target;
+    try {
+        target = resolveMeshTarget(process.cwd(), flags);
+    }
+    catch (e) {
+        console.error(c.red(`✗ ${e.message}`));
+        process.exit(1);
+    }
+    // If a dangling `current` was silently bypassed — it named a mesh that's since gone and we fell
+    // back to the only live one — say so. The N>1 case errors loudly; this is the one spot that would
+    // otherwise quietly redirect a stale default.
+    const cur = getCurrent();
+    if (cur && !findMesh(cur) && target.source === "registry")
+        console.error(c.dim(`note: default mesh "${cur}" is down — using "${target.space}"`));
+    return target;
+}
+/** Pure decision for {@link preflightOrExit} — separated from I/O so the whole branch tree is
+ *  unit-testable (it's the riskiest new logic: a wrong branch prunes a LIVE registry entry). A
+ *  non-registry source (`flag-server`/`local-space`, or a raw `--creds` connection) is NEVER pruned;
+ *  the user owns that diagnosis. */
+export function classifyPreflightFailure(source, reason, hasAuth) {
+    const fromRegistry = source === "registry" ||
+        source === "current" ||
+        source === "flag-space" ||
+        source === "local-recorded";
+    if (reason === "unreachable")
+        return { prune: fromRegistry, kind: "unreachable" };
+    if (fromRegistry && hasAuth)
+        return { prune: true, kind: "registry-creds-rejected" };
+    if (fromRegistry)
+        return { prune: true, kind: "registry-open-now-auth" };
+    if (hasAuth)
+        return { prune: false, kind: "creds-rejected" };
+    return { prune: false, kind: "open-wants-auth" };
+}
+function preflightMessage(kind, t, pruned) {
+    switch (kind) {
+        case "unreachable":
+            return `✗ no mesh running at ${t.server}${pruned ? " (stale registry entry — removed)" : ""} — run \`cotal up\``;
+        case "registry-creds-rejected":
+            return `✗ mesh "${t.space}" at ${t.server} no longer matches its registry entry (credentials rejected — port reused?) — re-run \`cotal up\` from ${t.root}, or \`cotal meshes\` to see what's live`;
+        case "registry-open-now-auth":
+            return `✗ open mesh "${t.space}" at ${t.server} no longer matches its registry entry (broker now requires auth — port reused?) — re-run \`cotal up\` from ${t.root}, or \`cotal meshes\` to see what's live`;
+        case "creds-rejected":
+            return `✗ credentials for "${t.space}" were rejected at ${t.server} — a different mesh may be running there. Run \`cotal meshes\` to check, or \`cotal up\` here to start yours`;
+        case "open-wants-auth":
+            return `✗ broker at ${t.server} requires auth, but this mesh is open (no trust material) — use \`--space <name>\` for an auth mesh, or run \`cotal up\` here without \`--open\``;
+    }
+}
+/** Confirm the resolved mesh is up and accepts these creds — replaces the raw NATS "Authorization
+ *  Violation" trace with one sentence, and prunes the entry if the broker is gone / mismatched.
+ *  Probes with `probeCreds` when given (the caller's `--creds`/minted creds); otherwise mints a
+ *  throwaway identity from the target's own trust material. */
+export async function preflightOrExit(target, probeCreds) {
+    const creds = probeCreds ?? (target.auth ? await mintCreds(target.auth, newIdentity(), "manager") : undefined);
+    const probe = await probeConnect(target.server, creds ? { creds } : {});
+    if (probe.ok)
+        return;
+    const { prune, kind } = classifyPreflightFailure(target.source, probe.reason, Boolean(target.auth));
+    if (prune)
+        removeMesh(target.space);
+    console.error(c.red(preflightMessage(kind, target, prune)));
+    process.exit(1);
+}
+//# sourceMappingURL=connect.js.map

package/dist/lib/connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../src/lib/connect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EACL,cAAc,EACd,aAAa,EACb,QAAQ,EACR,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,UAAU,EACV,iBAAiB,GAIlB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,CAAC,EAAE,MAAM,UAAU,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAuC/C;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAmB,EAAE,IAAa;IACpE,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,cAAc,CAAC;QAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,aAAa,CAAC;QAC3C,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACzC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IACD,kGAAkG;IAClG,8FAA8F;IAC9F,6FAA6F;IAC7F,gGAAgG;IAChG,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACtD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,MAAM,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAClF,CAAC;AAED;;mGAEmG;AACnG,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,OAAgB,EAAE;IACtE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO;IACrB,OAAO,CAAC,KAAK,CACX,CAAC,CAAC,GAAG,CACH,KAAK,CAAC,MAAM,KAAK,eAAe;QAC9B,CAAC,CAAC,6BAA6B,MAAM,yDAAyD;QAC9F,CAAC,CAAC,6BAA6B,MAAM,kCAAkC,CAC1E,CACF,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED;;wDAEwD;AACxD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAGzC;IACC,MAAM,gBAAgB,EAAE,CAAC;IACzB,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,gGAAgG;IAChG,kGAAkG;IAClG,8CAA8C;IAC9C,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;QACvD,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB,GAAG,sBAAsB,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACxF,OAAO,MAAM,CAAC;AAChB,CAAC;AAYD;;;oCAGoC;AACpC,MAAM,UAAU,wBAAwB,CACtC,MAA4B,EAC5B,MAAuC,EACvC,OAAgB;IAEhB,MAAM,YAAY,GAChB,MAAM,KAAK,UAAU;QACrB,MAAM,KAAK,SAAS;QACpB,MAAM,KAAK,YAAY;QACvB,MAAM,KAAK,gBAAgB,CAAC;IAC9B,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAClF,IAAI,YAAY,IAAI,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;IACrF,IAAI,YAAY;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;IACzE,IAAI,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;IAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAsB,EAAE,CAAa,EAAE,MAAe;IAC9E,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,aAAa;YAChB,OAAO,wBAAwB,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,qBAAqB,CAAC;QACnH,KAAK,yBAAyB;YAC5B,OAAO,WAAW,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,MAAM,0GAA0G,CAAC,CAAC,IAAI,0CAA0C,CAAC;QACtM,KAAK,wBAAwB;YAC3B,OAAO,gBAAgB,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,MAAM,8GAA8G,CAAC,CAAC,IAAI,0CAA0C,CAAC;QAC/M,KAAK,gBAAgB;YACnB,OAAO,sBAAsB,CAAC,CAAC,KAAK,sBAAsB,CAAC,CAAC,MAAM,8GAA8G,CAAC;QACnL,KAAK,iBAAiB;YACpB,OAAO,eAAe,CAAC,CAAC,MAAM,kJAAkJ,CAAC;IACrL,CAAC;AACH,CAAC;AAED;;;+DAG+D;AAC/D,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAkB,EAAE,UAAmB;IAC3E,MAAM,KAAK,GACT,UAAU,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACnG,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO;IACrB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,wBAAwB,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACpG,IAAI,KAAK;QAAE,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/dist/lib/delivery-proc.d.ts

@@ -0,0 +1,35 @@
+type Opts = {
+    space?: string;
+    server?: string;
+    spawn?: string[];
+};
+/** True if the delivery daemon we started for this folder is still running (pid file + liveness). */
+export declare function deliveryUp(): boolean;
+/** Cutover preflight — the FIRST action, BEFORE the daemon can bind: stop any old Plane-3-hosting
+ *  manager (live `manager.pid` without the delivery-aware marker) so it never double-binds the
+ *  daemon's durables. A delivery-aware (this-build) manager is left running. No-op on a fresh install. */
+export declare function stopOldHostingManagerIfPresent(): void;
+/** Start the delivery daemon detached (pid in `.cotal/delivery.pid`, output to `.cotal/delivery.log`),
+ *  stopped by `cotal down`. Re-execs this CLI's `deliver` command; the daemon loads the pre-minted
+ *  scoped `delivery.creds` (written by {@link ensureDelivery}) — it never sees the signer. */
+export declare function startDeliveryDetached(o?: Opts): number;
+/** Make the server-side delivery daemon available (auth mode only). FAILS CLOSED: refuses to launch
+ *  while an old Plane-3-hosting manager is live (the preflight should have stopped it) so the daemon
+ *  never double-binds. Mints a SCOPED `delivery` cred from the local signer ONCE, writes it to
+ *  `.cotal/delivery.creds` (0600), and launches the daemon WITHOUT signer access. Best-effort — callers
+ *  treat it as non-fatal (a missing daemon degrades durable delivery, never live). */
+export declare function ensureDelivery(o?: Opts): Promise<{
+    running: boolean;
+}>;
+/** Stop the detached delivery daemon if we started one, and drop its creds file. */
+export declare function stopDelivery(): void;
+/** Bring up the control plane in the correct cutover order: OLD-manager preflight → delivery daemon
+ *  (auth only, fails closed on a live old manager) → manager (lifecycle, writes the delivery-aware
+ *  marker). The manager no longer depends on the daemon (it hosts no Plane-3), so the daemon is started
+ *  first only to close the old-manager double-bind window and so freshly-spawned agents find the
+ *  `ctl.delivery` responder for their boot self-join (a miss honest-degrades to live-only). */
+export declare function ensureControlPlane(o?: Opts): Promise<{
+    running: boolean;
+}>;
+export {};
+//# sourceMappingURL=delivery-proc.d.ts.map

package/dist/lib/delivery-proc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery-proc.d.ts","sourceRoot":"","sources":["../../src/lib/delivery-proc.ts"],"names":[],"mappings":"AAmBA,KAAK,IAAI,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAWlE,qGAAqG;AACrG,wBAAgB,UAAU,IAAI,OAAO,CAKpC;AAeD;;0GAE0G;AAC1G,wBAAgB,8BAA8B,IAAI,IAAI,CAKrD;AAED;;8FAE8F;AAC9F,wBAAgB,qBAAqB,CAAC,CAAC,GAAE,IAAS,GAAG,MAAM,CAgB1D;AAED;;;;sFAIsF;AACtF,wBAAsB,cAAc,CAAC,CAAC,GAAE,IAAS,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA6BhF;AAED,oFAAoF;AACpF,wBAAgB,YAAY,IAAI,IAAI,CAanC;AAED;;;;+FAI+F;AAC/F,wBAAsB,kBAAkB,CAAC,CAAC,GAAE,IAAS,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAIpF"}

package/dist/lib/delivery-proc.js

@@ -0,0 +1,128 @@
+import { spawn } from "node:child_process";
+import { existsSync, openSync, closeSync, writeFileSync, readFileSync, rmSync } from "node:fs";
+import { DEFAULT_SERVER, authDir, findCotalRoot, loadSpaceAuth, mintCreds, newIdentity, waitForDeliveryLease, } from "@cotal-ai/core";
+import { selfArgv } from "./self-exec.js";
+import { resolveSpace } from "./status.js";
+import { cotalPath } from "./paths.js";
+import { ensureManager, managerHasDeliveryMarker, managerUp, stopManager } from "./manager-proc.js";
+const PID_PATH = () => cotalPath("delivery.pid");
+const CREDS_PATH = () => cotalPath("delivery.creds");
+function alive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** True if the delivery daemon we started for this folder is still running (pid file + liveness). */
+export function deliveryUp() {
+    const p = PID_PATH();
+    if (!existsSync(p))
+        return false;
+    const pid = Number(readFileSync(p, "utf8").trim());
+    return Number.isFinite(pid) && alive(pid);
+}
+/** True when this folder runs an authed mesh — the only mode with a delivery daemon (Plane-3 needs the
+ *  trusted reader; open dev mode is live-only). */
+function hasAuth() {
+    return Boolean(loadSpaceAuth(authDir(findCotalRoot())));
+}
+/** True if an OLD (pre-delivery-daemon) Plane-3-hosting manager is live: a `manager.pid` that is alive
+ *  but carries no delivery-aware marker. Such a manager still calls `startPlane3` and would double-bind
+ *  `fanout`/`reader` against the new daemon. */
+function oldHostingManagerLive() {
+    return managerUp() && !managerHasDeliveryMarker();
+}
+/** Cutover preflight — the FIRST action, BEFORE the daemon can bind: stop any old Plane-3-hosting
+ *  manager (live `manager.pid` without the delivery-aware marker) so it never double-binds the
+ *  daemon's durables. A delivery-aware (this-build) manager is left running. No-op on a fresh install. */
+export function stopOldHostingManagerIfPresent() {
+    if (oldHostingManagerLive()) {
+        console.error("• stopping an old Plane-3-hosting manager before starting the delivery daemon (cutover preflight)");
+        stopManager();
+    }
+}
+/** Start the delivery daemon detached (pid in `.cotal/delivery.pid`, output to `.cotal/delivery.log`),
+ *  stopped by `cotal down`. Re-execs this CLI's `deliver` command; the daemon loads the pre-minted
+ *  scoped `delivery.creds` (written by {@link ensureDelivery}) — it never sees the signer. */
+export function startDeliveryDetached(o = {}) {
+    const fd = openSync(cotalPath("delivery.log"), "a");
+    const [node, ...self] = selfArgv();
+    const args = [
+        ...self,
+        "deliver",
+        "--space",
+        o.space ?? resolveSpace(process.cwd()),
+        "--server",
+        o.server ?? DEFAULT_SERVER,
+    ];
+    const child = spawn(node, args, { detached: true, stdio: ["ignore", fd, fd] });
+    closeSync(fd);
+    child.unref();
+    writeFileSync(PID_PATH(), String(child.pid));
+    return child.pid ?? 0;
+}
+/** Make the server-side delivery daemon available (auth mode only). FAILS CLOSED: refuses to launch
+ *  while an old Plane-3-hosting manager is live (the preflight should have stopped it) so the daemon
+ *  never double-binds. Mints a SCOPED `delivery` cred from the local signer ONCE, writes it to
+ *  `.cotal/delivery.creds` (0600), and launches the daemon WITHOUT signer access. Best-effort — callers
+ *  treat it as non-fatal (a missing daemon degrades durable delivery, never live). */
+export async function ensureDelivery(o = {}) {
+    if (!hasAuth())
+        return { running: false }; // open dev mode — no daemon, agents are live-only
+    if (oldHostingManagerLive()) {
+        console.error("✗ delivery: an old Plane-3-hosting manager is still live (no delivery-aware marker). Refusing to start the daemon — run `cotal down` first, then retry.");
+        return { running: false };
+    }
+    // Mint a scoped delivery cred (used to probe readiness; for a NEW launch it is ALSO the daemon's cred,
+    // written to disk). The daemon process reads the file and never holds the signer (a container mounts it
+    // read-only). A reuse (daemon already up) mints a throwaway probe cred — the running daemon keeps its
+    // own creds file.
+    const auth = loadSpaceAuth(authDir(findCotalRoot()));
+    const id = newIdentity();
+    const creds = await mintCreds(auth, id, "delivery");
+    const space = o.space ?? resolveSpace(process.cwd());
+    const server = o.server ?? DEFAULT_SERVER;
+    if (!deliveryUp()) {
+        writeFileSync(CREDS_PATH(), creds, { mode: 0o600 });
+        startDeliveryDetached({ ...o, space, server });
+    }
+    // ALWAYS wait for the daemon to be READY (lease flipped ready AFTER it bound ctl.delivery) before
+    // returning — for a fresh launch AND a reused live daemon — so agents the manager spawns next find the
+    // responder for their boot self-join. Non-fatal on timeout: the boot self-join reconciles with backoff,
+    // which is the real safety net for a slow start or a later outage.
+    const ready = await waitForDeliveryLease({ servers: server, space, creds, id: id.id });
+    if (!ready)
+        console.error("• delivery daemon not yet ready (responder not bound) — boot durable joins will reconcile when it is");
+    return { running: true };
+}
+/** Stop the detached delivery daemon if we started one, and drop its creds file. */
+export function stopDelivery() {
+    rmSync(CREDS_PATH(), { force: true });
+    const p = PID_PATH();
+    if (!existsSync(p))
+        return;
+    const pid = Number(readFileSync(p, "utf8").trim());
+    if (Number.isFinite(pid)) {
+        try {
+            process.kill(pid, "SIGTERM");
+        }
+        catch {
+            /* already gone */
+        }
+    }
+    rmSync(p);
+}
+/** Bring up the control plane in the correct cutover order: OLD-manager preflight → delivery daemon
+ *  (auth only, fails closed on a live old manager) → manager (lifecycle, writes the delivery-aware
+ *  marker). The manager no longer depends on the daemon (it hosts no Plane-3), so the daemon is started
+ *  first only to close the old-manager double-bind window and so freshly-spawned agents find the
+ *  `ctl.delivery` responder for their boot self-join (a miss honest-degrades to live-only). */
+export async function ensureControlPlane(o = {}) {
+    stopOldHostingManagerIfPresent();
+    await ensureDelivery(o);
+    return ensureManager(o);
+}
+//# sourceMappingURL=delivery-proc.js.map

package/dist/lib/delivery-proc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery-proc.js","sourceRoot":"","sources":["../../src/lib/delivery-proc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC/F,OAAO,EACL,cAAc,EACd,OAAO,EACP,aAAa,EACb,aAAa,EACb,SAAS,EACT,WAAW,EACX,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEpG,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;AACjD,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;AAIrD,SAAS,KAAK,CAAC,GAAW;IACxB,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,UAAU;IACxB,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;IACrB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED;mDACmD;AACnD,SAAS,OAAO;IACd,OAAO,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;gDAEgD;AAChD,SAAS,qBAAqB;IAC5B,OAAO,SAAS,EAAE,IAAI,CAAC,wBAAwB,EAAE,CAAC;AACpD,CAAC;AAED;;0GAE0G;AAC1G,MAAM,UAAU,8BAA8B;IAC5C,IAAI,qBAAqB,EAAE,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,mGAAmG,CAAC,CAAC;QACnH,WAAW,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;8FAE8F;AAC9F,MAAM,UAAU,qBAAqB,CAAC,IAAU,EAAE;IAChD,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG;QACX,GAAG,IAAI;QACP,SAAS;QACT,SAAS;QACT,CAAC,CAAC,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACtC,UAAU;QACV,CAAC,CAAC,MAAM,IAAI,cAAc;KAC3B,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/E,SAAS,CAAC,EAAE,CAAC,CAAC;IACd,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,aAAa,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;AACxB,CAAC;AAED;;;;sFAIsF;AACtF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAU,EAAE;IAC/C,IAAI,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,kDAAkD;IAC7F,IAAI,qBAAqB,EAAE,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CACX,yJAAyJ,CAC1J,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,uGAAuG;IACvG,wGAAwG;IACxG,sGAAsG;IACtG,kBAAkB;IAClB,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAE,CAAC;IACtD,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,cAAc,CAAC;IAC1C,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAClB,aAAa,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,qBAAqB,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,kGAAkG;IAClG,uGAAuG;IACvG,wGAAwG;IACxG,mEAAmE;IACnE,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC,KAAK;QACR,OAAO,CAAC,KAAK,CAAC,sGAAsG,CAAC,CAAC;IACxH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,YAAY;IAC1B,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;IACrB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO;IAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;IACD,MAAM,CAAC,CAAC,CAAC,CAAC;AACZ,CAAC;AAED;;;;+FAI+F;AAC/F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAU,EAAE;IACnD,8BAA8B,EAAE,CAAC;IACjC,MAAM,cAAc,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC"}

package/dist/lib/manager-proc.d.ts

@@ -1,11 +1,20 @@
 /** True if the manager we started for this folder is still running (pid file + liveness). */
 export declare function managerUp(): boolean;
+/** True if the live manager carries a delivery-aware marker BOUND to its current pid (i.e. it's THIS
+ *  build, non-hosting). Fail-closed: the marker stores the pid it was written for, and this requires it
+ *  to equal the live `manager.pid` — a stale marker left by a crash, a mismatch, or an unparseable file
+ *  all read as NOT delivery-aware, so a live old hosting `manager.pid` can't be mistaken for non-hosting
+ *  and the delivery preflight stops it. */
+export declare function managerHasDeliveryMarker(): boolean;
 /** True if any process's full command line matches `pattern` (`pgrep -f`). Detects processes that
  *  have no pid file — the cmux-tab manager and the driving session — which live in cmux tabs. */
 export declare function pgrepMatches(pattern: string): boolean;
 /** True if a cmux-runtime manager is live for this space. Its cmux tab persists after the process
- *  exits, so a workspace listing isn't proof — the process is. Matches prod `cotal.js` and dev
- *  `cotal.ts` (both carry `cmux --space <space>`). */
+ *  exits, so a workspace listing isn't proof — the process is. A cmux manager runs `… supervise
+ *  --runtime cmux … --space <space> …`; match order-independently (the session launcher emits the
+ *  two flags adjacent, but a hand-typed launch may reorder them) by narrowing to `--runtime cmux`
+ *  processes, then confirming the exact `--space <space>` token in each one's argv. Works for prod
+ *  `cotal.js` and dev `cotal.ts` alike. */
 export declare function cmuxManagerRunning(space: string): boolean;
 /** Start the control-plane manager detached (pid in `.cotal/manager.pid`, output to
  *  `.cotal/manager.log`), stopped by `cotal down`. Re-execs this same CLI's `supervise` — the

package/dist/lib/manager-proc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manager-proc.d.ts","sourceRoot":"","sources":["../../src/lib/manager-proc.ts"],"names":[],"mappings":"AAkBA,6FAA6F;AAC7F,wBAAgB,SAAS,IAAI,OAAO,CAKnC;AAED;iGACiG;AACjG,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;sDAEsD;AACtD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;;0FAI0F;AAC1F,wBAAgB,oBAAoB,CAAC,CAAC,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GAAG,MAAM,CAiB1G;AAED;iEACiE;AACjE,wBAAgB,aAAa,CAAC,CAAC,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAIjH;AAED;wGACwG;AACxG,wBAAgB,WAAW,IAAI,IAAI,CAYlC"}
+{"version":3,"file":"manager-proc.d.ts","sourceRoot":"","sources":["../../src/lib/manager-proc.ts"],"names":[],"mappings":"AAwBA,6FAA6F;AAC7F,wBAAgB,SAAS,IAAI,OAAO,CAKnC;AAED;;;;2CAI2C;AAC3C,wBAAgB,wBAAwB,IAAI,OAAO,CAOlD;AAED;iGACiG;AACjG,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;2CAK2C;AAC3C,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAczD;AAED;;;;0FAI0F;AAC1F,wBAAgB,oBAAoB,CAAC,CAAC,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GAAG,MAAM,CAoB1G;AAED;iEACiE;AACjE,wBAAgB,aAAa,CAAC,CAAC,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAO,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAIjH;AAED;wGACwG;AACxG,wBAAgB,WAAW,IAAI,IAAI,CAalC"}