@cotal-ai/delivery 0.13.1 → 0.14.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/delivery.d.ts +6 -5
- package/dist/delivery.d.ts.map +1 -1
- package/dist/delivery.js +28 -10
- package/dist/delivery.js.map +1 -1
- package/dist/membership.d.ts +14 -5
- package/dist/membership.d.ts.map +1 -1
- package/dist/membership.js +28 -11
- package/dist/membership.js.map +1 -1
- package/package.json +3 -3
package/dist/delivery.d.ts
CHANGED
|
@@ -15,11 +15,12 @@ export { DELIVERY_CREDS_KEY };
|
|
|
15
15
|
* seam ships, operating sharded delivery is deferred to the channel-prefix grammar; see core-sub-fabric.md).
|
|
16
16
|
*
|
|
17
17
|
* `store` is the hosted-composition seam: a closed composition root calls this export directly and
|
|
18
|
-
* injects its own {@link SecretStore} (KMS/Vault…) holding the cred under
|
|
19
|
-
*
|
|
20
|
-
*
|
|
21
|
-
* (`remintDaemonCreds
|
|
22
|
-
*
|
|
18
|
+
* injects its own {@link SecretStore} (KMS/Vault…) holding the daemon cred under
|
|
19
|
+
* {@link DELIVERY_CREDS_KEY} AND the membership feed's rw cred under `membership-rw.creds`; the
|
|
20
|
+
* registered `deliver` command passes none and gets the workstation FS store (or `--creds`). The
|
|
21
|
+
* renewal owner's write side (`remintDaemonCreds`) is threaded through the manager's
|
|
22
|
+
* `ManagerOptions.secretStore` too, so a hosted composition renews both daemon kinds end-to-end when
|
|
23
|
+
* the manager and this daemon are handed the SAME store.
|
|
23
24
|
*/
|
|
24
25
|
export declare function runDelivery(args: ParsedArgs, store?: SecretStore): Promise<void>;
|
|
25
26
|
//# sourceMappingURL=delivery.d.ts.map
|
package/dist/delivery.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"delivery.d.ts","sourceRoot":"","sources":["../src/delivery.ts"],"names":[],"mappings":"AACA,OAAO,EAUL,KAAK,UAAU,EACf,KAAK,WAAW,EACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,
|
|
1
|
+
{"version":3,"file":"delivery.d.ts","sourceRoot":"","sources":["../src/delivery.ts"],"names":[],"mappings":"AACA,OAAO,EAUL,KAAK,UAAU,EACf,KAAK,WAAW,EACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAA2F,MAAM,qBAAqB,CAAC;AAMlJ;;;yBAGyB;AACzB,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAuF9B;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAuJtF"}
|
package/dist/delivery.js
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import { basename, dirname, join, resolve } from "node:path";
|
|
2
2
|
import { CotalEndpoint, DEFAULT_SERVER, LEASE_TTL_MS, credsClaims, idFromCreds, isReachable, mintCreds, newIdentity, } from "@cotal-ai/core";
|
|
3
|
-
import { DELIVERY_CREDS_KEY, FsSecretStore, authDir, findCotalRoot, loadSpaceAuth, workspaceSecretStore } from "@cotal-ai/workspace";
|
|
3
|
+
import { DELIVERY_CREDS_KEY, FsSecretStore, authDir, findCotalRoot, loadSpaceAuth, soleSpaceOf, workspaceSecretStore } from "@cotal-ai/workspace";
|
|
4
4
|
import { startMembership } from "./membership.js";
|
|
5
5
|
import { executeEviction, executePlaneLiveness } from "./evict-exec.js";
|
|
6
6
|
/** Re-exported for hosted compositions: the {@link SecretStore} key a store injected into
|
|
@@ -70,7 +70,10 @@ async function loadDeliveryCreds(src, v) {
|
|
|
70
70
|
if (src.injected)
|
|
71
71
|
throw new Error(`delivery: no cred in the injected secret store under key "${DELIVERY_CREDS_KEY}" — the hosted composition must put it before starting the daemon (local sources are never consulted when a store is injected)`);
|
|
72
72
|
if (v["dev-mint"] !== undefined) {
|
|
73
|
-
|
|
73
|
+
// Space-blind dev path: the root must name exactly one space (soleSpaceOf fails loud on several).
|
|
74
|
+
const devRoot = authDir(findCotalRoot());
|
|
75
|
+
const devSpace = soleSpaceOf(devRoot);
|
|
76
|
+
const auth = devSpace ? loadSpaceAuth(devRoot, devSpace) : undefined;
|
|
74
77
|
if (!auth)
|
|
75
78
|
throw new Error("delivery --dev-mint: no .cotal/auth here to mint from");
|
|
76
79
|
console.error("⚠ delivery: --dev-mint — minting a scoped delivery cred from the LOCAL SIGNER (DEV ONLY; production mounts a pre-minted delivery.creds and the daemon never sees the signer)");
|
|
@@ -91,11 +94,12 @@ async function loadDeliveryCreds(src, v) {
|
|
|
91
94
|
* seam ships, operating sharded delivery is deferred to the channel-prefix grammar; see core-sub-fabric.md).
|
|
92
95
|
*
|
|
93
96
|
* `store` is the hosted-composition seam: a closed composition root calls this export directly and
|
|
94
|
-
* injects its own {@link SecretStore} (KMS/Vault…) holding the cred under
|
|
95
|
-
*
|
|
96
|
-
*
|
|
97
|
-
* (`remintDaemonCreds
|
|
98
|
-
*
|
|
97
|
+
* injects its own {@link SecretStore} (KMS/Vault…) holding the daemon cred under
|
|
98
|
+
* {@link DELIVERY_CREDS_KEY} AND the membership feed's rw cred under `membership-rw.creds`; the
|
|
99
|
+
* registered `deliver` command passes none and gets the workstation FS store (or `--creds`). The
|
|
100
|
+
* renewal owner's write side (`remintDaemonCreds`) is threaded through the manager's
|
|
101
|
+
* `ManagerOptions.secretStore` too, so a hosted composition renews both daemon kinds end-to-end when
|
|
102
|
+
* the manager and this daemon are handed the SAME store.
|
|
99
103
|
*/
|
|
100
104
|
export async function runDelivery(args, store) {
|
|
101
105
|
const v = args.values;
|
|
@@ -108,7 +112,7 @@ export async function runDelivery(args, store) {
|
|
|
108
112
|
// store rejects local-source flags before anything can read the workstation signer.
|
|
109
113
|
const credsSrc = resolveCredsStore(v, store);
|
|
110
114
|
// Space comes from --space (the CLI passes it). Only --dev-mint may derive it from the local signer.
|
|
111
|
-
const space = v.space ?? (v["dev-mint"] !== undefined ?
|
|
115
|
+
const space = v.space ?? (v["dev-mint"] !== undefined ? soleSpaceOf(authDir(findCotalRoot())) : undefined);
|
|
112
116
|
if (!space)
|
|
113
117
|
throw new Error("delivery: --space is required (the scoped creds file does not encode it)");
|
|
114
118
|
const server = v.server ?? DEFAULT_SERVER;
|
|
@@ -154,7 +158,18 @@ export async function runDelivery(args, store) {
|
|
|
154
158
|
// delivery-admin rail's `reloadCreds` (explicit class-2 adoption) also reloads the membership feed's
|
|
155
159
|
// rw connection via this hook.
|
|
156
160
|
await ep.startPlane3((owner, lifecycleUid) => ep.aclForOwner(owner, lifecycleUid), {
|
|
157
|
-
reloadMembershipCreds: async () =>
|
|
161
|
+
reloadMembershipCreds: async (expected) => {
|
|
162
|
+
if (!membership) {
|
|
163
|
+
// Absent feed: a FAILURE when the renewal owner EXPECTED a membership generation (it re-signed
|
|
164
|
+
// membership-rw.creds but the feed that must adopt it is not running), else n/a — a
|
|
165
|
+
// delivery-only renewal must never be falsely failed by an unprovisioned feed.
|
|
166
|
+
if (expected !== undefined)
|
|
167
|
+
throw new Error("membership feed is not running, but a membership generation was expected - nothing adopted");
|
|
168
|
+
return { skipped: "membership feed not running (nothing to reload)" };
|
|
169
|
+
}
|
|
170
|
+
// Symmetric with delivery: claim broker acceptance (the preflight), not verified resident reauth.
|
|
171
|
+
return { brokerAccepted: await membership.reloadRwCreds(expected), residentSwap: "best-effort" };
|
|
172
|
+
},
|
|
158
173
|
// Live-eviction executor (D5 slice 6): per-call $SYS observer/evictor connections; refuses
|
|
159
174
|
// loudly on a pre-evictor space. Rare repair/flip step — never a standing $SYS conn here.
|
|
160
175
|
evictPrincipal: (principal) => executeEviction(server, principal),
|
|
@@ -174,7 +189,10 @@ export async function runDelivery(args, store) {
|
|
|
174
189
|
// reader + data-account feed writer), isolated from Plane-3. Fail-soft — a missing cred / start error
|
|
175
190
|
// logs and the graph degrades to traffic-only; Plane-3 delivery is never affected.
|
|
176
191
|
try {
|
|
177
|
-
|
|
192
|
+
// Pass the INJECTED store (hosted KMS/Vault), NOT credsSrc.store — that one may be an FS store over
|
|
193
|
+
// an arbitrary `--creds` path, whereas membership-rw lives under the workstation `.cotal/` key. With
|
|
194
|
+
// no injected store, startMembership falls back to the workstation FS store.
|
|
195
|
+
membership = await startMembership({ space, server }, store);
|
|
178
196
|
}
|
|
179
197
|
catch (e) {
|
|
180
198
|
console.error(`! membership: failed to start (${e.message}) — graph membership degraded, delivery unaffected`);
|
package/dist/delivery.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"delivery.js","sourceRoot":"","sources":["../src/delivery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACL,aAAa,EACb,cAAc,EACd,YAAY,EACZ,WAAW,EACX,WAAW,EACX,WAAW,EACX,SAAS,EACT,WAAW,GAIZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;
|
|
1
|
+
{"version":3,"file":"delivery.js","sourceRoot":"","sources":["../src/delivery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACL,aAAa,EACb,cAAc,EACd,YAAY,EACZ,WAAW,EACX,WAAW,EACX,WAAW,EACX,SAAS,EACT,WAAW,GAIZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAClJ,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAIxE;;;yBAGyB;AACzB,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAI9B;;;;;;;+FAO+F;AAC/F,SAAS,iBAAiB,CAAC,CAAS,EAAE,QAAsB;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QACtE,IAAI,KAAK,CAAC,MAAM;YACd,MAAM,IAAI,KAAK,CACb,aAAa,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,yFAAyF,CAC/I,CAAC;QACJ,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,qBAAqB,kBAAkB,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACzH,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC/F,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,OAAO,EAAE,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC1I,CAAC;AAED;;;;;;;;;;gBAUgB;AAChB,KAAK,UAAU,iBAAiB,CAAC,GAAgB,EAAE,CAAS;IAC1D,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,IAAwB,CAAC,CAAC,8DAA8D;QAC5F,OAAO;YACL,OAAO;YACP,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,OAAO,KAAK,SAAS;oBACvB,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,8EAA8E,CAAC,CAAC;gBACtJ,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBAC3C,uFAAuF;oBACvF,kFAAkF;oBAClF,wFAAwF;oBACxF,iFAAiF;oBACjF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;oBAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC;wBAAE,OAAO,OAAO,CAAC;oBACvH,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kNAAkN,CAAC,CAAC;gBAC9O,CAAC;gBACD,IAAI,GAAG,OAAO,CAAC;gBACf,OAAO,OAAO,CAAC;YACjB,CAAC;SACF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ;QACd,MAAM,IAAI,KAAK,CACb,6DAA6D,kBAAkB,gIAAgI,CAChN,CAAC;IACJ,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;QAChC,kGAAkG;QAClG,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACpF,OAAO,CAAC,KAAK,CAAC,8KAA8K,CAAC,CAAC;QAC9L,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC,CAAC,oDAAoD;QACpF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,KAAK,CACb,gCAAgC,KAAK,kJAAkJ,CACxL,CAAC;AACJ,CAAC;AAED,yFAAyF;AAEzF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAgB,EAAE,KAAmB;IACrE,MAAM,CAAC,GAAG,IAAI,CAAC,MAAgB,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,qEAAqE,KAAK,WAAW,MAAM,KAAK;YAC9F,8GAA8G,CACjH,CAAC;IAEJ,6FAA6F;IAC7F,oFAAoF;IACpF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAE7C,qGAAqG;IACrG,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3G,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IACxG,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,cAAc,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,+DAA+D;IACnH,IAAI,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,oEAAoE;IAErG,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,CAAC,KAAK,CAAC,mCAAmC,MAAM,iBAAiB,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,EAAE,GAAG,IAAI,aAAa,CAAC;QAC3B,KAAK;QACL,OAAO,EAAE,MAAM;QACf,gGAAgG;QAChG,gGAAgG;QAChG,kFAAkF;QAClF,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QACvD,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,KAAK,EAAE,4DAA4D;QAC5E,aAAa,EAAE,IAAI,EAAE,4CAA4C;QACjE,gBAAgB,EAAE,KAAK,EAAE,0EAA0E;QACnG,IAAI,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE;KAC/F,CAAC,CAAC;IACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IAEjB,qGAAqG;IACrG,sGAAsG;IACtG,gEAAgE;IAChE,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,qDAAqD,KAAK,qDAAqD,CAAC,CAAC;QAC/H,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,gGAAgG;IAChG,oFAAoF;IACpF,IAAI,UAA4C,CAAC;IAEjD,qGAAqG;IACrG,8FAA8F;IAC9F,qGAAqG;IACrG,+BAA+B;IAC/B,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE;QACjF,qBAAqB,EAAE,KAAK,EAAE,QAAiB,EAAE,EAAE;YACjD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,+FAA+F;gBAC/F,oFAAoF;gBACpF,+EAA+E;gBAC/E,IAAI,QAAQ,KAAK,SAAS;oBACxB,MAAM,IAAI,KAAK,CAAC,4FAA4F,CAAC,CAAC;gBAChH,OAAO,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC;YACxE,CAAC;YACD,kGAAkG;YAClG,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,aAAsB,EAAE,CAAC;QAC5G,CAAC;QACD,2FAA2F;QAC3F,0FAA0F;QAC1F,cAAc,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC;QACjE,4FAA4F;QAC5F,gGAAgG;QAChG,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC;KAClE,CAAC,CAAC;IACH,uGAAuG;IACvG,sGAAsG;IACtG,sDAAsD;IACtD,IAAI,CAAC;QAAC,QAAQ,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAAC,CAAC;IACpE,MAAM,CAAC,CAAC,0FAA0F,CAAC,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAE9H,kGAAkG;IAClG,sGAAsG;IACtG,mFAAmF;IACnF,IAAI,CAAC;QACH,oGAAoG;QACpG,qGAAqG;QACrG,6EAA6E;QAC7E,UAAU,GAAG,MAAM,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,kCAAmC,CAAW,CAAC,OAAO,oDAAoD,CAAC,CAAC;IAC5H,CAAC;IAED,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAQ,EAAE;QACtC,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,aAAa,CAAC,WAAW,CAAC,CAAC;QAC3B,sGAAsG;QACtG,wGAAwG;QACxG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3C,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBAAC,MAAM,UAAU,EAAE,IAAI,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;YACpE,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;YAChF,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,CAAC;IACF,+FAA+F;IAC/F,iEAAiE;IACjE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC;aACnC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;aAC3B,KAAK,CAAC,CAAC,CAAQ,EAAE,EAAE;YAClB,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,OAAO,qCAAqC,CAAC,CAAC;YAC7F,QAAQ,CAAC,CAAC,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAEjD,oGAAoG;IACpG,qGAAqG;IACrG,qGAAqG;IACrG,wGAAwG;IACxG,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,IAAI,MAAM,CAAC;IACnF,IAAI,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE;QACnC,IAAI,QAAQ;YAAE,OAAO;QACrB,KAAK,WAAW,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;aAC7C,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;YACX,IAAI,EAAE,EAAE,CAAC;gBAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC/C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,cAAc,EAAE,CAAC;gBAChD,OAAO,CAAC,KAAK,CAAC,uCAAuC,cAAc,GAAG,IAAI,qCAAqC,CAAC,CAAC;gBACjH,QAAQ,CAAC,CAAC,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrB,CAAC,EAAE,IAAI,CAAC,CAAC;IAET,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,sBAAsB;AAC3D,CAAC"}
|
package/dist/membership.d.ts
CHANGED
|
@@ -1,16 +1,25 @@
|
|
|
1
|
-
import { type MembershipFeedHandle } from "@cotal-ai/core";
|
|
1
|
+
import { type MembershipFeedHandle, type SecretStore } from "@cotal-ai/core";
|
|
2
2
|
/**
|
|
3
3
|
* The delivery daemon's thin composition root for the broker-sourced graph-membership feed. It loads the
|
|
4
|
-
*
|
|
5
|
-
* never holds the signer) and
|
|
6
|
-
* the
|
|
4
|
+
* DATA account id + the SYSTEM-account observer cred from `.cotal/` (written by `cotal up`; the daemon
|
|
5
|
+
* never holds the signer) and reads the DATA-account rw cred through the {@link SecretStore} seam — the
|
|
6
|
+
* SAME seam the renewal owner (the manager) re-signs into — so a hosted composition can renew the feed's
|
|
7
|
+
* writer end-to-end (KMS/Vault) without a daemon restart. `store` is that hosted injection point; with
|
|
8
|
+
* none, the workstation FS store (keys = the filenames under `.cotal/`) is used, so a local `cotal up`
|
|
9
|
+
* is byte-for-byte unchanged. It hands the two creds + the account id to the core feed engine
|
|
10
|
+
* ({@link startMembershipFeed}, which owns the two connections + the poll loop + the rw 75% renewal).
|
|
7
11
|
*
|
|
8
12
|
* Deliberately ISOLATED from Plane-3: a separate module, separate connections, and a fail-soft contract —
|
|
9
13
|
* if the creds aren't provisioned (a pre-feature space) or the feed can't start, it logs and returns
|
|
10
14
|
* `undefined`; the graph degrades to traffic-only and delivery is untouched.
|
|
15
|
+
*
|
|
16
|
+
* Residual (deferred, non-blocking): the observer cred + `membership.json` (the account id) are still
|
|
17
|
+
* read from `.cotal/` files, so a fully hosted feed on an injected store also needs those two threaded.
|
|
18
|
+
* They are a static $SYS cred and non-secret config, respectively — the renewable rw kind is what 3b
|
|
19
|
+
* migrates; the manager re-signs only it.
|
|
11
20
|
*/
|
|
12
21
|
export declare function startMembership(opts: {
|
|
13
22
|
space: string;
|
|
14
23
|
server: string;
|
|
15
|
-
}): Promise<MembershipFeedHandle | undefined>;
|
|
24
|
+
}, store?: SecretStore): Promise<MembershipFeedHandle | undefined>;
|
|
16
25
|
//# sourceMappingURL=membership.d.ts.map
|
package/dist/membership.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"membership.d.ts","sourceRoot":"","sources":["../src/membership.ts"],"names":[],"mappings":"AAEA,OAAO,EAAuB,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;
|
|
1
|
+
{"version":3,"file":"membership.d.ts","sourceRoot":"","sources":["../src/membership.ts"],"names":[],"mappings":"AAEA,OAAO,EAAuB,KAAK,oBAAoB,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGlG;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAyC7I"}
|
package/dist/membership.js
CHANGED
|
@@ -1,23 +1,34 @@
|
|
|
1
1
|
import { existsSync, readFileSync } from "node:fs";
|
|
2
2
|
import { join } from "node:path";
|
|
3
3
|
import { startMembershipFeed } from "@cotal-ai/core";
|
|
4
|
-
import { findCotalRoot } from "@cotal-ai/workspace";
|
|
4
|
+
import { findCotalRoot, MEMBERSHIP_RW_CREDS_KEY, workspaceSecretStore } from "@cotal-ai/workspace";
|
|
5
5
|
/**
|
|
6
6
|
* The delivery daemon's thin composition root for the broker-sourced graph-membership feed. It loads the
|
|
7
|
-
*
|
|
8
|
-
* never holds the signer) and
|
|
9
|
-
* the
|
|
7
|
+
* DATA account id + the SYSTEM-account observer cred from `.cotal/` (written by `cotal up`; the daemon
|
|
8
|
+
* never holds the signer) and reads the DATA-account rw cred through the {@link SecretStore} seam — the
|
|
9
|
+
* SAME seam the renewal owner (the manager) re-signs into — so a hosted composition can renew the feed's
|
|
10
|
+
* writer end-to-end (KMS/Vault) without a daemon restart. `store` is that hosted injection point; with
|
|
11
|
+
* none, the workstation FS store (keys = the filenames under `.cotal/`) is used, so a local `cotal up`
|
|
12
|
+
* is byte-for-byte unchanged. It hands the two creds + the account id to the core feed engine
|
|
13
|
+
* ({@link startMembershipFeed}, which owns the two connections + the poll loop + the rw 75% renewal).
|
|
10
14
|
*
|
|
11
15
|
* Deliberately ISOLATED from Plane-3: a separate module, separate connections, and a fail-soft contract —
|
|
12
16
|
* if the creds aren't provisioned (a pre-feature space) or the feed can't start, it logs and returns
|
|
13
17
|
* `undefined`; the graph degrades to traffic-only and delivery is untouched.
|
|
18
|
+
*
|
|
19
|
+
* Residual (deferred, non-blocking): the observer cred + `membership.json` (the account id) are still
|
|
20
|
+
* read from `.cotal/` files, so a fully hosted feed on an injected store also needs those two threaded.
|
|
21
|
+
* They are a static $SYS cred and non-secret config, respectively — the renewable rw kind is what 3b
|
|
22
|
+
* migrates; the manager re-signs only it.
|
|
14
23
|
*/
|
|
15
|
-
export async function startMembership(opts) {
|
|
16
|
-
const
|
|
24
|
+
export async function startMembership(opts, store) {
|
|
25
|
+
const root = findCotalRoot();
|
|
26
|
+
const dir = join(root, ".cotal");
|
|
17
27
|
const obsPath = join(dir, "membership-observer.creds");
|
|
18
|
-
const rwPath = join(dir, "membership-rw.creds");
|
|
19
28
|
const cfgPath = join(dir, "membership.json");
|
|
20
|
-
|
|
29
|
+
const secrets = store ?? workspaceSecretStore(root);
|
|
30
|
+
const rw = await secrets.get(MEMBERSHIP_RW_CREDS_KEY);
|
|
31
|
+
if (rw === undefined || !existsSync(obsPath) || !existsSync(cfgPath)) {
|
|
21
32
|
console.error("• membership: scoped creds not provisioned here — broker-sourced graph membership disabled (the graph falls back to traffic-only). Provisioned on a fresh `cotal up`; a space created before this feature needs its auth regenerated. Delivery is unaffected.");
|
|
22
33
|
return undefined;
|
|
23
34
|
}
|
|
@@ -33,9 +44,15 @@ export async function startMembership(opts) {
|
|
|
33
44
|
accountId,
|
|
34
45
|
// Observer is rotation-renewed ($SYS): a static read — its renewal is a system rotation + restart.
|
|
35
46
|
observerCreds: readFileSync(obsPath, "utf8"),
|
|
36
|
-
// rw is class-2 standing-renewable:
|
|
37
|
-
//
|
|
38
|
-
|
|
47
|
+
// rw is class-2 standing-renewable: read through the store seam and renewed on a 75% timer that
|
|
48
|
+
// preflight-proves each candidate the manager re-signs into the store (D5 slice 5). The daemon
|
|
49
|
+
// never sees the signer; the manager owns the re-sign.
|
|
50
|
+
rwCreds: async () => {
|
|
51
|
+
const cur = await secrets.get(MEMBERSHIP_RW_CREDS_KEY);
|
|
52
|
+
if (cur === undefined)
|
|
53
|
+
throw new Error(`membership: the scoped rw cred is gone (key "${MEMBERSHIP_RW_CREDS_KEY}") — restore it (locally: re-run \`cotal up\`) before the current JWT expires`);
|
|
54
|
+
return cur;
|
|
55
|
+
},
|
|
39
56
|
intervalMs,
|
|
40
57
|
});
|
|
41
58
|
console.log(`✓ membership feed up (broker-sourced channel membership) — space ${opts.space}`);
|
package/dist/membership.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"membership.js","sourceRoot":"","sources":["../src/membership.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,mBAAmB,
|
|
1
|
+
{"version":3,"file":"membership.js","sourceRoot":"","sources":["../src/membership.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAA+C,MAAM,gBAAgB,CAAC;AAClG,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEnG;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAuC,EAAE,KAAmB;IAChG,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,KAAK,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAEpD,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACtD,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,KAAK,CACX,+PAA+P,CAChQ,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAA4B,CAAC,SAAS,CAAC;IAClG,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,mGAAmG,CAAC,CAAC;QACnH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,IAAI,SAAS,CAAC,CAAC,oBAAoB;IACtG,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACvC,OAAO,EAAE,IAAI,CAAC,MAAM;QACpB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS;QACT,mGAAmG;QACnG,aAAa,EAAE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC;QAC5C,gGAAgG;QAChG,+FAA+F;QAC/F,uDAAuD;QACvD,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YACvD,IAAI,GAAG,KAAK,SAAS;gBACnB,MAAM,IAAI,KAAK,CAAC,gDAAgD,uBAAuB,+EAA+E,CAAC,CAAC;YAC1K,OAAO,GAAG,CAAC;QACb,CAAC;QACD,UAAU;KACX,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,oEAAoE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9F,OAAO,MAAM,CAAC;AAChB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cotal-ai/delivery",
|
|
3
3
|
"description": "Cotal delivery daemon: the server-side Plane-3 durable backstop (fan-out writer + trusted reader + membership/ACL authority), a scoped least-privilege NATS client co-located with the broker.",
|
|
4
|
-
"version": "0.
|
|
4
|
+
"version": "0.14.0",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"repository": {
|
|
7
7
|
"type": "git",
|
|
@@ -18,8 +18,8 @@
|
|
|
18
18
|
}
|
|
19
19
|
},
|
|
20
20
|
"dependencies": {
|
|
21
|
-
"@cotal-ai/core": "0.
|
|
22
|
-
"@cotal-ai/workspace": "0.
|
|
21
|
+
"@cotal-ai/core": "0.14.0",
|
|
22
|
+
"@cotal-ai/workspace": "0.14.0"
|
|
23
23
|
},
|
|
24
24
|
"files": [
|
|
25
25
|
"dist"
|