@cotal-ai/cli 0.50.1 → 0.51.0

package/dist/commands/sync.js

@@ -0,0 +1,284 @@
+import { join } from "node:path";
+import { mkSecretDir, registry, resolveAuthProvider, writeSecretFileAtomic } from "@cotal-ai/core";
+import { clearCurrent, findCotalRoot, findMesh, getCurrent, homeCotalDir, loadMeshes, meshesForRoot, recordMesh, removeMesh, userAuthStateDir, } from "@cotal-ai/workspace";
+import { checkUserBundle } from "./meshes-add.js";
+import { c } from "../ui.js";
+const syncFlags = [
+    { name: "idp", type: "string", value: "<auth base URL>", description: "refresh only this signed-in IdP account" },
+];
+export { syncFlags };
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/** Canonicalize an IdP identity for account binding with the same URL shape the stock provider
+ * accepts: HTTPS, or loopback HTTP; no credentials, query, fragment, or trailing slash. This is not
+ * a bundle validator. It compares already-validated registration trust to the proved account. */
+function canonicalIdpUrl(raw, what) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new Error(`${what} is not a valid URL`);
+    }
+    const loopback = url.hostname === "127.0.0.1" || url.hostname === "[::1]" || url.hostname === "localhost";
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback))
+        throw new Error(`${what} must be https (or loopback http for local development)`);
+    if (url.username || url.password || url.search || url.hash)
+        throw new Error(`${what} must not contain credentials, a query, or a fragment`);
+    return `${url.origin}${url.pathname.replace(/\/$/, "")}`;
+}
+function assertRegistrationAccountBinding(bundle, account, label) {
+    const accountIdp = canonicalIdpUrl(account.idpUrl, "the proved account IdP URL");
+    const registrationIdp = canonicalIdpUrl(bundle.userAuth.idp.url, `${label} IdP URL`);
+    if (registrationIdp !== accountIdp || bundle.userAuth.idp.issuer !== account.issuer)
+        throw new Error(`${label} names IdP trust that differs from the proved catalog account`);
+    const accountOrigin = new URL(accountIdp).origin;
+    for (const [name, raw] of [
+        ["exchange endpoint", bundle.userAuth.endpoints?.url],
+        ["agent-provisioning endpoint", bundle.userAuth.endpoints?.agentProvisioningUrl],
+        ["manager-authority endpoint", bundle.userAuth.endpoints?.managerAuthorityUrl],
+    ]) {
+        if (!raw)
+            continue;
+        let endpoint;
+        try {
+            endpoint = new URL(raw);
+        }
+        catch {
+            throw new Error(`${label} ${name} is not a valid URL`);
+        }
+        if (endpoint.username || endpoint.password || endpoint.origin !== accountOrigin)
+            throw new Error(`${label} ${name} is not same-origin with the proved catalog account`);
+    }
+}
+export function validateCatalogSnapshot(value, account) {
+    if (!isRecord(value) || value.v !== 1 || !isRecord(value.account) || !Array.isArray(value.spaces))
+        throw new Error("the space catalog is not a v1 snapshot");
+    if (value.account.idpUrl !== account.idpUrl || value.account.issuer !== account.issuer || value.account.sub !== account.sub)
+        throw new Error("the space catalog account does not match the proved login");
+    const slugs = new Set();
+    for (let i = 0; i < value.spaces.length; i++) {
+        const row = value.spaces[i];
+        if (!isRecord(row))
+            throw new Error(`space catalog entry ${i + 1} is not an object`);
+        for (const key of ["id", "slug", "name", "kind", "role"])
+            if (typeof row[key] !== "string" || row[key].length === 0)
+                throw new Error(`space catalog entry ${i + 1} has no ${key}`);
+        const checked = checkUserBundle(JSON.stringify(row.registration));
+        if (!checked.ok)
+            throw new Error(`space catalog entry "${row.name}": ${checked.message.replace(/^✗ /, "")}`);
+        assertRegistrationAccountBinding(checked.value, account, `space catalog entry "${row.name}"`);
+        if (checked.value.space !== row.slug)
+            throw new Error(`space catalog entry "${row.name}" (${row.slug}) registration names space "${checked.value.space}"`);
+        if (slugs.has(row.slug))
+            throw new Error(`space catalog repeats the slug "${row.slug}"`);
+        slugs.add(row.slug);
+        row.registration = checked.value;
+    }
+}
+function catalogRoot(ownerKey, space) {
+    return join(homeCotalDir(), "catalog", ownerKey, encodeURIComponent(space));
+}
+function entryFor(account, row, fetchedAt, error) {
+    const root = catalogRoot(account.ownerKey, row.slug);
+    const dir = userAuthStateDir(root, row.slug);
+    const sentinelCredsPath = join(dir, "sentinel.creds");
+    return {
+        space: row.slug,
+        server: row.registration.server,
+        root,
+        mode: "user",
+        origin: "catalog",
+        catalogOwner: account.ownerKey,
+        catalogId: row.id,
+        catalogSlug: row.slug,
+        catalogName: row.name,
+        catalogKind: row.kind,
+        catalogRole: row.role,
+        ...(fetchedAt ? { catalogFetchedAt: fetchedAt } : {}),
+        ...(error ? { catalogError: error } : {}),
+        ...(row.registration.tlsRequired ? { tlsRequired: true } : {}),
+        ...(row.registration.policy ? { policy: row.registration.policy } : {}),
+        userAuth: { ...row.registration.userAuth, remote: true, sentinelCredsPath },
+        ts: new Date().toISOString(),
+    };
+}
+function writeCatalogCredential(entry, row) {
+    const path = entry.userAuth?.sentinelCredsPath;
+    if (!path)
+        throw new Error(`catalog registration for "${entry.space}" has no sentinel credential path`);
+    mkSecretDir(userAuthStateDir(entry.root, entry.space));
+    writeSecretFileAtomic(path, row.registration.sentinelCreds);
+}
+function sameEntry(a, b) {
+    const clean = (m) => ({ ...m, ts: undefined, catalogFetchedAt: undefined, catalogError: undefined });
+    return JSON.stringify(clean(a)) === JSON.stringify(clean(b));
+}
+const emptyDiff = () => ({ added: [], changed: [], removed: [], unchanged: [], collisions: [] });
+/** One account can be applied twice in one preparation: a repair of an interrupted application,
+ * then the refreshed snapshot. Report each slug against the registry the command started from, so
+ * the first classification of a slug stands. */
+function mergeDiff(prior, next) {
+    if (!prior)
+        return next;
+    const lists = ["added", "changed", "removed", "unchanged"];
+    const seen = new Set(lists.flatMap((k) => prior[k]));
+    const merged = { ...prior, collisions: [...new Set([...prior.collisions, ...next.collisions])].sort() };
+    for (const k of lists)
+        merged[k] = [...prior[k], ...next[k].filter((s) => !seen.has(s))].sort();
+    if (!merged.selectionInvalidated && next.selectionInvalidated)
+        merged.selectionInvalidated = next.selectionInvalidated;
+    return merged;
+}
+/** Reconcile the registry with one account's result. The provider calls this under its catalog
+ * lock, so no other preparation reads or writes discovered entries while it runs, and it is
+ * idempotent: the provider applies a cached snapshot again when an earlier application never
+ * finished. An unforced fresh or not-modified result is already applied and writes nothing. */
+function consume(result, force) {
+    return result.state === "updated" || result.state === "failed" || force ? applyResult(result) : emptyDiff();
+}
+function applyResult(result) {
+    const before = loadMeshes().filter((m) => m.origin === "catalog" && m.catalogOwner === result.account.ownerKey);
+    const priorByName = new Map(before.map((m) => [m.space, m]));
+    const diff = emptyDiff();
+    if (result.state === "failed") {
+        for (const old of before)
+            recordMesh({ ...old, ...(result.fetchedAt ? { catalogFetchedAt: result.fetchedAt } : {}), catalogError: result.error ?? "refresh failed" });
+        return diff;
+    }
+    if (result.snapshot === undefined)
+        return diff;
+    validateCatalogSnapshot(result.snapshot, result.account);
+    const snapshot = result.snapshot;
+    const nextSlugs = new Set(snapshot.spaces.map((s) => s.slug));
+    // Invalidate the selection BEFORE the first registry write. Once an entry is removed, a later
+    // application (after a death here) can no longer tell that the selected name belonged to this
+    // account, and the selection would outlive its entry.
+    const current = getCurrent();
+    if (current && priorByName.has(current) && !nextSlugs.has(current)) {
+        clearCurrent();
+        diff.selectionInvalidated = current;
+    }
+    for (const old of before) {
+        if (nextSlugs.has(old.space))
+            continue;
+        removeMesh(old.space);
+        diff.removed.push(old.space);
+    }
+    for (const row of snapshot.spaces) {
+        const existing = findMesh(row.slug);
+        if (existing && (existing.origin !== "catalog" || existing.catalogOwner !== result.account.ownerKey)) {
+            diff.collisions.push(row.slug);
+            continue;
+        }
+        const next = entryFor(result.account, row, result.fetchedAt);
+        const prior = priorByName.get(row.slug);
+        writeCatalogCredential(next, row);
+        recordMesh(next);
+        if (!prior)
+            diff.added.push(row.slug);
+        else if (sameEntry(prior, next))
+            diff.unchanged.push(row.slug);
+        else
+            diff.changed.push(row.slug);
+    }
+    for (const list of [diff.added, diff.changed, diff.removed, diff.unchanged, diff.collisions])
+        list.sort();
+    return diff;
+}
+export async function prepareCatalogTargets(opts = {}) {
+    const provider = resolveAuthProvider();
+    if (!provider.prepareSpaceCatalogs)
+        throw new Error(`auth provider "${provider.name}" does not support space catalogs`);
+    const applied = new Map();
+    const results = await provider.prepareSpaceCatalogs({
+        dir: homeCotalDir(),
+        ...(opts.idpUrl ? { idpUrl: opts.idpUrl } : {}),
+        ...(opts.force ? { force: true } : {}),
+        validate: validateCatalogSnapshot,
+        apply: (result) => void applied.set(result.account.ownerKey, mergeDiff(applied.get(result.account.ownerKey), consume(result, Boolean(opts.force)))),
+    });
+    return { results, diffs: results.map((result) => applied.get(result.account.ownerKey) ?? emptyDiff()) };
+}
+/** Shared once-per-command preparation. A named manual/local entry never depends on discovery and
+ * makes no request here: a manual entry's policy refresh runs where a launch, join, or manager start
+ * consumes it. Unknown names force one refresh even inside the freshness window. `status` keeps a
+ * failed stale snapshot only as timestamped diagnostics; operational commands refuse before target
+ * resolution. */
+export async function prepareCatalogCommand(args, diagnostics = false, command) {
+    const values = args.values;
+    const requested = values.space ?? (command === "use" ? args.positionals[0] : undefined);
+    const named = requested ? findMesh(requested) : undefined;
+    if (named && named.origin !== "catalog")
+        return;
+    if (!requested && command !== "meshes") {
+        const current = getCurrent();
+        const selected = current ? findMesh(current) : undefined;
+        if (selected && selected.origin !== "catalog")
+            return;
+        const local = meshesForRoot(findCotalRoot()).filter((m) => m.origin !== "catalog");
+        if (local.length > 0)
+            return;
+        const registered = loadMeshes();
+        if (registered.length === 1 && registered[0].origin !== "catalog")
+            return;
+    }
+    const force = Boolean(requested && !named);
+    if (registry.all("auth-provider").length === 0)
+        return;
+    const provider = resolveAuthProvider();
+    if (!provider.prepareSpaceCatalogs)
+        return;
+    const diffs = [];
+    const results = await provider.prepareSpaceCatalogs({
+        dir: homeCotalDir(),
+        ...(named?.origin === "catalog" && named.userAuth?.idp.url ? { idpUrl: named.userAuth.idp.url } : {}),
+        ...(force ? { force: true } : {}),
+        validate: validateCatalogSnapshot,
+        apply: (result) => void diffs.push(consume(result, force)),
+    });
+    if (results.every((r) => r.state === "no-catalog" && r.snapshot === undefined))
+        return;
+    const vanished = diffs.map((d) => d.selectionInvalidated).filter((s) => Boolean(s));
+    if (vanished.length) {
+        const message = `selected space "${vanished.join("\", \"")}" vanished from its account catalog; no default mesh is selected`;
+        if (diagnostics)
+            console.error(c.yellow(message));
+        else
+            throw new Error(message);
+    }
+    if (diagnostics)
+        return;
+    const failures = results.filter((r) => r.state === "failed");
+    if (failures.length)
+        throw new Error(failures.map((r) => `space catalog for ${r.account.idpUrl} failed: ${r.error}`).join("; "));
+}
+export async function sync(args) {
+    const values = args.values;
+    const { results, diffs } = await prepareCatalogTargets({ idpUrl: values.idp, force: true });
+    if (results.length === 0) {
+        console.log(c.dim("no signed-in IdP accounts"));
+        return;
+    }
+    results.forEach((result, i) => {
+        const d = diffs[i];
+        const catalog = result.account.catalogUrl ? result.account.catalogUrl : "no catalog advertised";
+        console.log(`${result.account.idpUrl}  ${result.state}  ${catalog}`);
+        for (const [label, names] of [["added", d.added], ["changed", d.changed], ["removed", d.removed], ["unchanged", d.unchanged], ["collisions", d.collisions]])
+            console.log(`  ${label.padEnd(10)} ${names.length ? names.join(", ") : "-"}`);
+        if (d.selectionInvalidated)
+            console.log(c.yellow(`  selected space "${d.selectionInvalidated}" vanished; no default mesh is selected`));
+    });
+    const failures = results.filter((r) => r.state === "failed");
+    if (failures.length)
+        throw new Error(failures.map((r) => `space catalog for ${r.account.idpUrl} failed: ${r.error}`).join("; "));
+}
+const spaceCatalogConsumer = {
+    kind: "space-catalog-consumer",
+    name: "workspace",
+    validate: validateCatalogSnapshot,
+    apply: (result) => void consume(result, true),
+};
+registry.register(spaceCatalogConsumer);
+//# sourceMappingURL=sync.js.map

package/dist/commands/sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.js","sourceRoot":"","sources":["../../src/commands/sync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,mBAAmB,EAAE,qBAAqB,EAA4J,MAAM,gBAAgB,CAAC;AAC7P,OAAO,EACL,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,UAAU,EACV,aAAa,EACb,UAAU,EACV,UAAU,EACV,gBAAgB,GAEjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAmB,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,CAAC,EAAE,MAAM,UAAU,CAAC;AA0B7B,MAAM,SAAS,GAAG;IAChB,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,yCAAyC,EAAE;CAC3E,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,CAAC;AAIrB,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;iGAEiG;AACjG,SAAS,eAAe,CAAC,GAAW,EAAE,IAAY;IAChD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qBAAqB,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC;IAC1G,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,yDAAyD,CAAC,CAAC;IACpF,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;QACxD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uDAAuD,CAAC,CAAC;IAClF,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,gCAAgC,CAAC,MAAkB,EAAE,OAAgC,EAAE,KAAa;IAC3G,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;IACjF,MAAM,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,UAAU,CAAC,CAAC;IACrF,IAAI,eAAe,KAAK,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QACjF,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+DAA+D,CAAC,CAAC;IAC3F,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI;QACxB,CAAC,mBAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC;QACrD,CAAC,6BAA6B,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;QAChF,CAAC,4BAA4B,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;KACtE,EAAE,CAAC;QACX,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,QAAa,CAAC;QAClB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,IAAI,qBAAqB,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,aAAa;YAC7E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,IAAI,qDAAqD,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAc,EAAE,OAAgC;IACtF,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAC/F,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;QACzH,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACrF,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAU;YAC/D,IAAI,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;gBACvD,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,IAAI,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7G,gCAAgC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,wBAAwB,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;QAC9F,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,GAAG,CAAC,IAAI;YAClC,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,+BAA+B,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;QACvH,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;QACzF,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,KAAa;IAClD,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,QAAQ,CAAC,OAAgC,EAAE,GAAiB,EAAE,SAAkB,EAAE,KAAc;IACvG,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACtD,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,IAAI;QACf,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,MAAM;QAC/B,IAAI;QACJ,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,OAAO,CAAC,QAAQ;QAC9B,SAAS,EAAE,GAAG,CAAC,EAAE;QACjB,WAAW,EAAE,GAAG,CAAC,IAAI;QACrB,WAAW,EAAE,GAAG,CAAC,IAAI;QACrB,WAAW,EAAE,GAAG,CAAC,IAAI;QACrB,WAAW,EAAE,GAAG,CAAC,IAAI;QACrB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,QAAQ,EAAE,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE;QAC3E,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAgB,EAAE,GAAiB;IACjE,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IAC/C,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,CAAC,KAAK,mCAAmC,CAAC,CAAC;IACxG,WAAW,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACvD,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,CAAY,EAAE,CAAY;IAC3C,MAAM,KAAK,GAAG,CAAC,CAAY,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC;IAChH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,SAAS,GAAG,GAAgB,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;AAE9G;;gDAEgD;AAChD,SAAS,SAAS,CAAC,KAA8B,EAAE,IAAiB;IAClE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,CAAU,CAAC;IACpE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,MAAM,GAAgB,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACrH,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChG,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI,IAAI,CAAC,oBAAoB;QAAE,MAAM,CAAC,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,CAAC;IACvH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;+FAG+F;AAC/F,SAAS,OAAO,CAAC,MAA8B,EAAE,KAAc;IAC7D,OAAO,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AAC9G,CAAC;AAED,SAAS,WAAW,CAAC,MAA8B;IACjD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,MAAM;YACtB,UAAU,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,IAAI,gBAAgB,EAAE,CAAC,CAAC;QAC9I,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/C,uBAAuB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,8FAA8F;IAC9F,8FAA8F;IAC9F,sDAAsD;IACtD,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,IAAI,OAAO,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACnE,YAAY,EAAE,CAAC;QACf,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC;IACtC,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACvC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,YAAY,KAAK,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,sBAAsB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAClC,UAAU,CAAC,IAAI,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;aACjC,IAAI,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC;YAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;;YAC1D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC;QAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1G,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAA6C,EAAE;IACzF,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACvC,IAAI,CAAC,QAAQ,CAAC,oBAAoB;QAChC,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,IAAI,mCAAmC,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC;QAClD,GAAG,EAAE,YAAY,EAAE;QACnB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,QAAQ,EAAE,uBAAuB;QACjC,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;KACpJ,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC,EAAE,CAAC;AAC1G,CAAC;AAED;;;;iBAIiB;AACjB,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAgB,EAAE,WAAW,GAAG,KAAK,EAAE,OAA0B;IAC3G,MAAM,MAAM,GAAG,IAAI,CAAC,MAA4B,CAAC;IACjD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO;IAChD,IAAI,CAAC,SAAS,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzD,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO;QACtD,MAAM,KAAK,GAAG,aAAa,CAAC,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QACnF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO;QAC7B,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;QAChC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,QAAQ,CAAC,GAAG,CAAe,eAAe,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACrE,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACvC,IAAI,CAAC,QAAQ,CAAC,oBAAoB;QAAE,OAAO;IAC3C,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC;QAClD,GAAG,EAAE,YAAY,EAAE;QACnB,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,QAAQ,EAAE,uBAAuB;QACjC,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;KAC3D,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC;QAAE,OAAO;IACvF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,mBAAmB,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,kEAAkE,CAAC;QAC7H,IAAI,WAAW;YAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;;YAC7C,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,WAAW;QAAE,OAAO;IACxB,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC;IAC7D,IAAI,QAAQ,CAAC,MAAM;QACjB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,MAAM,YAAY,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAChH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAgB;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAoB,CAAC;IACzC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,qBAAqB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC;QAChD,OAAO;IACT,CAAC;IACD,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;QAC5B,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,uBAAuB,CAAC;QAChG,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC,CAAC;QACrE,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,CAAU;YAClK,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,CAAC,oBAAoB;YACxB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,oBAAoB,yCAAyC,CAAC,CAAC,CAAC;IAChH,CAAC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC;IAC7D,IAAI,QAAQ,CAAC,MAAM;QACjB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,MAAM,YAAY,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAChH,CAAC;AAED,MAAM,oBAAoB,GAAyB;IACjD,IAAI,EAAE,wBAAwB;IAC9B,IAAI,EAAE,WAAW;IACjB,QAAQ,EAAE,uBAAuB;IACjC,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC;CAC9C,CAAC;AAEF,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC"}

package/dist/commands/up.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"up.d.ts","sourceRoot":"","sources":["../../src/commands/up.ts"],"names":[],"mappings":"AAkBA,OAAO,EAOL,KAAK,eAAe,EAgBpB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EA8BL,KAAK,SAAS,EAoBd,KAAK,eAAe,EASrB,MAAM,qBAAqB,CAAC;AAsD7B,yGAAyG;AACzG,eAAO,MAAM,OAAO,EAAE,QAAQ,EAyB7B,CAAC;AAEF;;;qGAGqG;AACrG,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAS3D;AAED;2FAC2F;AAC3F,wBAAsB,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAWzF;AAszDD,MAAM,WAAW,UAAU;IACzB;;;;;;;;;OASG;IACH,SAAS,EAAE,eAAe,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8FAA8F;IAC9F,QAAQ,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/B;;4FAEwF;IACxF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;qEACiE;IACjE,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B,sFAAsF;IACtF,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC;wDACoD;IACpD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;yGACqG;IACrG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;+EAC2E;IAC3E,aAAa,CAAC,EAAE;QACd,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9C,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;KACzB,CAAC;IACF,gGAAgG;IAChG,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAGrC,IAAI,EAAE,UAAU,GACf,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAqI5I;AA2DD;;;;;oGAKoG;AACpG,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAc3F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAElF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEnF;AAED;;;+DAG+D;AAC/D;;;;;;;;;;GAUG;AACH,KAAK,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAExC;;mCAEmC;AACnC,eAAO,MAAM,oBAAoB,GAAI,GAAG,SAAS,EAAE,YAAY,UAAU,KAAG,IAAoC,CAAC"}
+{"version":3,"file":"up.d.ts","sourceRoot":"","sources":["../../src/commands/up.ts"],"names":[],"mappings":"AAkBA,OAAO,EAOL,KAAK,eAAe,EAgBpB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EA+BL,KAAK,SAAS,EAqBd,KAAK,eAAe,EASrB,MAAM,qBAAqB,CAAC;AAuD7B,yGAAyG;AACzG,eAAO,MAAM,OAAO,EAAE,QAAQ,EA0B7B,CAAC;AAEF;;;qGAGqG;AACrG,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAS3D;AAED;2FAC2F;AAC3F,wBAAsB,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAWzF;AAi0DD,MAAM,WAAW,UAAU;IACzB;;;;;;;;;OASG;IACH,SAAS,EAAE,eAAe,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8FAA8F;IAC9F,QAAQ,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/B;;4FAEwF;IACxF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;qEACiE;IACjE,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B,sFAAsF;IACtF,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC;wDACoD;IACpD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;yGACqG;IACrG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;+EAC2E;IAC3E,aAAa,CAAC,EAAE;QACd,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9C,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;KACzB,CAAC;IACF,gGAAgG;IAChG,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAGrC,IAAI,EAAE,UAAU,GACf,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAqI5I;AA2DD;;;;;oGAKoG;AACpG,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAc3F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAElF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEnF;AAED;;;+DAG+D;AAC/D;;;;;;;;;;GAUG;AACH,KAAK,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAExC;;mCAEmC;AACnC,eAAO,MAAM,oBAAoB,GAAI,GAAG,SAAS,EAAE,YAAY,UAAU,KAAG,IAAoC,CAAC"}

package/dist/commands/up.js

@@ -1,15 +1,16 @@
 import { spawn } from "node:child_process";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { createConnection, createServer } from "node:net";
 import { hostname } from "node:os";
 import { mkdirSync, writeFileSync, readFileSync, existsSync, openSync, statSync, readSync, closeSync, lstatSync, rmSync, realpathSync, } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { isReachable, DEFAULT_SERVER, createSpaceAuth, serverConfig, openServerConfig, validateTlsMaterial, mintCreds, mintLifecycleUid, DEV_OWNER, mintConnectionEvictorCreds, mintMembershipObserverCreds, newIdentity, setupSpaceStreams, reconcileSpaceTtls, standaloneConnectOpts, seedChannelRegistry, ensureDefaultDeliveryClass, mkSecretDir, writeSecretFile, } from "@cotal-ai/core";
 import { connect } from "@nats-io/transport-node";
-import { assertSingleSpaceBroker, assertUserAuthInfo, authDir, getSoleSpaceAuth, getSpaceAuth, hasUserAuthState, listSpaceAccounts, preloadSpaceAccounts, putSpaceAuth, clearCurrent, findMesh, getCurrent, loadMeshes, connectionEvictorCredsKey, membershipConfigPath, membershipObserverCredsKey, membershipRwCredsKey, MEMBERSHIP_CONFIG_KIND, MEMBERSHIP_RW_CREDS_KIND, parsePositiveIntegerFlag, recordMesh, meshesForRoot, removeMesh, rotateSystemCreds, setCurrent, staleSystemCreds, SYSTEM_CREDS_FILES, userAuthStateDir, workspaceSecretStore, acquireMaintenanceLock, assertStoreIdentity, assessRestoreClaim, beginOrdinaryResume, bindOrdinaryResumeListener, consumeRetiredMaintenance, markOrdinaryResumeActive, markOrdinaryResumeDegraded, replaceDeadOrdinaryResumeListener, localProcessOwnerStatus, readMaintenanceJournal, readMaintenanceResumeDocument, readStoreIdentity, recordOrdinaryResumeManagerCommit, releaseMaintenanceLock, retireOrdinaryResume, sameStoreIdentity, readBrokerPolicy, writeBrokerPolicy, removeIdentityPin, writeIdentityPin, } from "@cotal-ai/workspace";
+import { assertSingleSpaceBroker, assertUserAuthInfo, authDir, getSoleSpaceAuth, getSpaceAuth, hasUserAuthState, listSpaceAccounts, preloadSpaceAccounts, putSpaceAuth, clearCurrent, findMesh, getCurrent, loadMeshes, connectionEvictorCredsKey, membershipConfigPath, membershipObserverCredsKey, membershipRwCredsKey, MEMBERSHIP_CONFIG_KIND, MEMBERSHIP_RW_CREDS_KIND, parsePositiveIntegerFlag, recordMesh, meshesForRoot, removeMesh, rotateSystemCreds, setCurrent, staleSystemCreds, SYSTEM_CREDS_FILES, userAuthStateDir, userAuthSpacesOnDisk, workspaceSecretStore, acquireMaintenanceLock, assertStoreIdentity, assessRestoreClaim, beginOrdinaryResume, bindOrdinaryResumeListener, consumeRetiredMaintenance, markOrdinaryResumeActive, markOrdinaryResumeDegraded, replaceDeadOrdinaryResumeListener, localProcessOwnerStatus, readMaintenanceJournal, readMaintenanceResumeDocument, seatCheckpointDir, readStoreIdentity, recordOrdinaryResumeManagerCommit, releaseMaintenanceLock, retireOrdinaryResume, sameStoreIdentity, readBrokerPolicy, writeBrokerPolicy, removeIdentityPin, writeIdentityPin, } from "@cotal-ai/workspace";
 import { ensureAuthService, resolveAuthProvider, stopAuthService } from "../lib/auth-proc.js";
 import { resolveSpace } from "../lib/status.js";
 import { c } from "../ui.js";
+import { admitAndRestoreSeatCheckpoints } from "../lib/seat-resume.js";
 import { resolveNatsServer } from "../lib/nats-bin.js";
 import { cotalPath, cotalRoot } from "../lib/paths.js";
 import { renderDetachedSummary } from "../lib/up-report.js";
@@ -31,7 +32,7 @@ const pendingOrdinaryResumes = new Map();
 /** `cotal up` flags — colocated with the command (like `spawnFlags`) so its completion can read them. */
 export const upFlags = [
     { name: "server", type: "string", value: "<url>", description: "listen URL override" },
-    { name: "host", type: "string", value: "<host>", description: "bind host override" },
+    { name: "host", type: "string", value: "<host>", description: "bind host override (an IP/hostname, not a URL; the URL is --server)" },
     { name: "space", type: "string", value: "<s>", description: "space name (default: the folder's)" },
     { name: "store-dir", type: "string", value: "<dir>", description: "JetStream store directory" },
     { name: "channels", type: "string", value: "<path>", description: "channel-registry seed file (JSON; default .cotal/channels.json)" },
@@ -40,6 +41,7 @@ export const upFlags = [
     { name: "restore", type: "string", value: "<dir>", description: "restore an offline backup before exposing the normal listener" },
     { name: "restore-only", type: "string", value: "<registry>", description: "restore only the registry component" },
     { name: "accept-missing-source", type: "boolean", description: "explicit disaster consent when the inode-bound preserved source is absent" },
+    { name: "accept-stale-checkpoint", type: "boolean", description: "explicit consent to resume a seat checkpoint captured outside its recorded recency horizon" },
     { name: "open", type: "boolean", description: "unauthenticated dev mesh (no JWT/ACLs)" },
     { name: "user-auth", type: "boolean", description: "per-USER auth: login + bearer through the space's auth service" },
     { name: "idp", type: "string", value: "<url>", description: "with --user-auth: the IdP auth base URL to pin (first enable)" },
@@ -206,6 +208,10 @@ async function runUp(args, inheritedLock, onAdopt) {
                 if (values.runtime && runtimes[0] && values.runtime !== runtimes[0])
                     throw new Error(`--runtime ${values.runtime} contradicts the preserved agent runtime ${runtimes[0]}; omit it to resume the same principals`);
                 const resumeRuntime = values.runtime ?? runtimes[0] ?? "pty";
+                // Admit every seat checkpoint the cut wrote and take custody, BEFORE the resume attempt is
+                // journalled and long before a manager starts. A refusal here costs nothing because
+                // nothing has been started; the same refusal after a launch would be a second writer.
+                const staleConsent = admitAndRestoreSeatCheckpoints(root, journal.space, journal.cut.attemptId, values, resume.inventory);
                 const serverNonce = randomUUID().replaceAll("-", "");
                 const serverName = `${attemptId}-${serverNonce}`;
                 beginOrdinaryResume(lock, {
@@ -217,6 +223,12 @@ async function runUp(args, inheritedLock, onAdopt) {
                         detached: Boolean(values.detach),
                         serverName,
                         serverNonce,
+                        // Durable evidence of consent, not a print. An operator asking later why a seat resumed
+                        // from a checkpoint past its horizon must be able to read that it was admitted, for
+                        // which seat, and by how far, from the journal rather than from a lost terminal.
+                        ...(staleConsent.length
+                            ? { acceptedStaleCheckpoints: staleConsent.map((seat) => ({ ...seat })) }
+                            : {}),
                     },
                 });
                 pending = {
@@ -1671,7 +1683,7 @@ async function upManifest(file, opts) {
     const host = m.broker?.host ?? "127.0.0.1";
     // Same bind-vs-probe reconciliation as the flag path: a manifest that sets `broker.host` without
     // an explicit `broker.servers` would otherwise bind one address and be probed at another.
-    const server = m.broker?.host ? reconcileHostAndServer(m.broker.host, m.broker?.servers) : (m.broker?.servers ?? DEFAULT_SERVER);
+    const server = m.broker?.host ? reconcileHostAndServer(m.broker.host, m.broker?.servers, "broker.host", "broker.servers") : (m.broker?.servers ?? DEFAULT_SERVER);
     const open = m.broker?.auth === false; // default is auth
     const userAuth = m.broker?.auth === "user" ? { idpUrl: opts.idp ?? m.broker?.idp } : undefined; // flag > manifest
     const runtime = m.runtime ?? "pty";
@@ -2073,8 +2085,8 @@ export async function claimSpace(space, server, root) {
     // reclaimed: unreachable is not proof the mesh is gone (the record describes a broker on another
     // machine), the reclaim runs BEFORE this launch starts anything, and `cotal down` — what the
     // liveness branch below would advise — cannot stop a mesh this machine does not run.
-    if (existing.origin === "manual")
-        throw new Error(`space "${space}" is registered to a mesh at ${existing.server} (${existing.root}) - it was registered by hand, so \`cotal up\` neither takes it over nor reclaims the name: \`cotal meshes rm ${space}\` to drop that record first, or start this one under a different \`--space\``);
+    if (existing.origin === "manual" || existing.origin === "catalog")
+        throw new Error(`space "${space}" is registered to a mesh at ${existing.server} (${existing.root}) - it is ${existing.origin === "catalog" ? "owned by a signed-in space catalog" : "registered by hand"}, so \`cotal up\` neither takes it over nor reclaims the name: ${existing.origin === "catalog" ? "use a different `--space`, or remove access at the IdP and run `cotal sync`" : `\`cotal meshes rm ${space}\` to drop that record first, or start this one under a different \`--space\``}`);
     if (await isReachable(existing.server)) {
         throw new Error(`space "${space}" is already in use by a mesh at ${existing.server} (${existing.root}) - pick a different \`--space\`, or \`cotal down\` it first`);
     }
@@ -2117,7 +2129,7 @@ function recordOurMesh(m, provenance) {
     const cur = getCurrent();
     const usableCurrent = cur && findMesh(cur) ? cur : undefined; // compute before recording m
     const prior = findMesh(m.space);
-    const origin = provenance === "refresh" && prior?.origin === "manual" ? "manual" : "up";
+    const origin = provenance === "refresh" && (prior?.origin === "manual" || prior?.origin === "catalog") ? prior.origin : "up";
     // A REFRESH starts nothing: it concluded the mesh is up from reachability alone, and rebuilds `m`
     // from what THIS launch knows, which is never the operator's past decisions. `origin` was already
     // carried across for that reason; the overlay acceptance is the same class and was not, so a
@@ -2170,6 +2182,36 @@ async function waitReady(server, creds) {
  *  the probe/registry URL stays whatever it already is (loopback by default), which the wildcard
  *  bind necessarily covers. */
 const WILDCARD_HOSTS = new Set(["0.0.0.0", "::", "[::]"]);
+/** Establish that a bind-host value IS a host, BEFORE anything brackets it, and return the
+ *  bracketed literal a URL can hold (#1697).
+ *
+ *  `--host` is the bind address; its sibling `--server` takes a URL, the registry stores and prints
+ *  URLs, and every message in this area shows one — so an operator plausibly types the URL here
+ *  (the manifest's `broker.host` carries the same ambiguity against `broker.servers`). Unrejected,
+ *  the IPv6 bracketing wrapped it into `nats://[nats://127.0.0.1:4222]:4222`, which is not a URL at
+ *  all. Nothing checked the derived string: the first code to look at it compared it with the
+ *  space's registry record, failed for a reason unrelated to what was typed, and showed the
+ *  operator the "registered by hand" refusal whose remedy de-registers a live mesh. Refused by name
+ *  here instead — pointing at the URL-carrying sibling — and a value that still cannot serve as a
+ *  URL host (a `host:port` spelling, say) is refused rather than reaching that comparison as a
+ *  silently wrong server string. Never rewritten: a value this flag cannot use is an error, not a
+ *  URL to derive from. */
+function assertBindableHost(host, source, urlSource) {
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(host)) {
+        console.error(c.red(`✗ ${source} ${host} looks like a URL - it takes a bind host only (an IP or hostname, no scheme); pass the broker URL with ${urlSource} instead`));
+        process.exit(1);
+    }
+    const literal = host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+    try {
+        // ONE parse, both consumers served from it: `literal` builds the derived URL (a URL host needs
+        // the brackets), `hostname` compares against the explicit server's (the URL API strips them).
+        return { literal, hostname: new URL(`nats://${literal}:1`).hostname };
+    }
+    catch {
+        console.error(c.red(`✗ ${source} ${host} is not a valid bind host - an IP or hostname only, with no port; the port comes from ${urlSource} (or its default), never from the bind host`));
+        process.exit(1);
+    }
+}
 /**
  * Reconcile the bind address (`--host`, manifest `broker.host`) with the broker URL the readiness
  * probe, the mesh registry, and every later client use.
@@ -2180,16 +2222,19 @@ const WILDCARD_HOSTS = new Set(["0.0.0.0", "::", "[::]"]);
  * derive one from the host (keeping the URL's port); with both, refuse a contradicting pair rather
  * than starting a broker that nothing can reach.
  */
-function reconcileHostAndServer(host, explicitServer) {
+function reconcileHostAndServer(host, explicitServer, source = "--host", urlSource = "--server") {
     const url = new URL(explicitServer ?? DEFAULT_SERVER);
     if (WILDCARD_HOSTS.has(host))
         return explicitServer ?? DEFAULT_SERVER;
-    // An unbracketed IPv6 literal cannot be assigned to a URL host — bracket it so the URL parses.
-    const literal = host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+    const { literal, hostname } = assertBindableHost(host, source, urlSource);
     if (!explicitServer)
         return `nats://${literal}:${url.port || "4222"}`;
-    if (url.hostname !== new URL(`nats://${literal}:1`).hostname) {
-        console.error(c.red(`✗ --host ${host} and --server ${explicitServer} name different addresses - the broker would bind ${host} but be probed at ${url.hostname}. Pass one, or make them agree.`));
+    // NO parse on this path: `assertBindableHost` just parsed the identical literal above, so the
+    // mismatch check compares two parsed hostnames and can only ever print its diagnostic and exit 1
+    // — the "never throw a raw Invalid URL" requirement (#1697) holds by construction, not by a
+    // second guard that no input could reach.
+    if (url.hostname !== hostname) {
+        console.error(c.red(`✗ ${source} ${host} and ${urlSource} ${explicitServer} name different addresses - the broker would bind ${host} but be probed at ${url.hostname}. Pass one, or make them agree.`));
         process.exit(1);
     }
     return explicitServer;
@@ -2569,7 +2614,20 @@ transport, rotateSys = false) {
     // map, so a config rendered from one space evicts the rest silently. `auth` leads the list because
     // this function's copy can be fresher than the disk (a space created above, or one whose trust
     // record `--rotate-sys` just replaced). Refuses on an unreadable record rather than dropping it.
-    writeFileSync(confPath, serverConfig(auth, preloadSpaceAccounts(dir, auth), { transport, port, storeDir, host, wsPort, wsHost: host, ...(prepared ? { extraAccounts: prepared.extraAccounts } : {}) }));
+    const spaces = preloadSpaceAccounts(dir, auth);
+    const enabled = userAuthSpacesOnDisk(dir);
+    for (const enabledSpace of enabled) {
+        if (!spaces.some((s) => s.space === enabledSpace))
+            throw new Error(`space "${enabledSpace}" has user auth enabled but no data account record - refusing to render an incomplete broker resolver`);
+    }
+    const extraAccounts = [];
+    for (const enabledSpace of enabled) {
+        const accounts = enabledSpace === space && prepared
+            ? prepared.extraAccounts
+            : await resolveAuthProvider().preloadAccounts({ store, space: enabledSpace });
+        extraAccounts.push(...accounts);
+    }
+    writeFileSync(confPath, serverConfig(auth, spaces, { transport, port, storeDir, host, wsPort, wsHost: host, extraAccounts }));
     // Ephemeral setup cred: used only to probe reachability, pre-create the space streams/buckets
     // (setupSpaceStreams) and seed the channel registry (seedChannelRegistry) — all within the
     // enumerated `provisioner` scope. No broad `manager` residual for the up path.