@cotal-ai/delivery 0.34.0 → 0.36.0

package/dist/delivery.d.ts

@@ -1,10 +1,11 @@
 import { type ParsedArgs, type SecretStore } from "@cotal-ai/core";
-import { DELIVERY_CREDS_KEY } from "@cotal-ai/workspace";
-/** Re-exported for hosted compositions: the {@link SecretStore} key a store injected into
- *  {@link runDelivery} must hold the cred under. Defined once in workspace (the key↔filename
- *  convention is the workspace layout's) so the writer, the renewal owner, and this reader can
- *  never drift apart. */
-export { DELIVERY_CREDS_KEY };
+import { DELIVERY_CREDS_KIND, deliveryCredsKey } from "@cotal-ai/workspace";
+/** Re-exported for hosted compositions: the daemon cred's KIND, and the builder that turns it into
+ *  the {@link SecretStore} key for a space. Defined once in workspace (the layout is the workspace's)
+ *  so the writer, the renewal owner, and this reader can never drift apart. As of P7 the kind is NOT
+ *  the key — the key is per-space — so a hosted store must be keyed with the builder; the flat kind
+ *  is the pre-P7 key and putting there leaves this daemon reading an empty location. */
+export { DELIVERY_CREDS_KIND, deliveryCredsKey };
 /**
  * Run the delivery daemon: the server-side Plane-3 durable backstop. A thin composition root that
  * builds a scoped `delivery` endpoint, acquires the single-flight lease, and runs the existing
@@ -16,8 +17,10 @@ export { DELIVERY_CREDS_KEY };
  *
  * `store` is the hosted-composition seam: a closed composition root calls this export directly and
  * injects its own {@link SecretStore} (KMS/Vault…) holding the daemon cred under
- * {@link DELIVERY_CREDS_KEY} AND the membership feed's rw cred under `membership-rw.creds`; the
- * registered `deliver` command passes none and gets the workstation FS store (or `--creds`). The
+ * {@link deliveryCredsKey}`(space, …)` AND the membership feed's rw cred under the matching
+ * `membership-rw.creds` key — both PER-SPACE as of P7, so the bare kinds are the pre-P7 spelling and
+ * are not read; the registered `deliver` command passes none and gets the workstation FS store (or
+ * `--creds`). The
  * renewal owner's write side (`remintDaemonCreds`) is threaded through the manager's
  * `ManagerOptions.secretStore` too, so a hosted composition renews both daemon kinds end-to-end when
  * the manager and this daemon are handed the SAME store.

package/dist/delivery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delivery.d.ts","sourceRoot":"","sources":["../src/delivery.ts"],"names":[],"mappings":"AACA,OAAO,EAWL,KAAK,UAAU,EACf,KAAK,WAAW,EACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAA2F,MAAM,qBAAqB,CAAC;AAMlJ;;;yBAGyB;AACzB,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAuF9B;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA8LtF"}
+{"version":3,"file":"delivery.d.ts","sourceRoot":"","sources":["../src/delivery.ts"],"names":[],"mappings":"AACA,OAAO,EAWL,KAAK,UAAU,EACf,KAAK,WAAW,EACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAA0B,gBAAgB,EAAiF,MAAM,qBAAqB,CAAC;AAMnL;;;;wFAIwF;AACxF,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,CAAC;AA0GjD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAmNtF"}

package/dist/delivery.js

@@ -1,34 +1,54 @@
 import { basename, dirname, join, resolve } from "node:path";
 import { CotalEndpoint, DEFAULT_SERVER, LEASE_TTL_MS, accountFromCreds, credsClaims, idFromCreds, isReachable, mintCreds, newIdentity, } from "@cotal-ai/core";
-import { DELIVERY_CREDS_KEY, FsSecretStore, authDir, findCotalRoot, loadSpaceAuth, soleSpaceOf, workspaceSecretStore } from "@cotal-ai/workspace";
+import { DELIVERY_CREDS_KIND, FsSecretStore, authDir, deliveryCredsKey, findCotalRoot, loadSpaceAuth, segmentedKey, soleSpaceOf, workspaceSecretStore } from "@cotal-ai/workspace";
 import { startMembership } from "./membership.js";
 import { executeEviction, executePlaneLiveness, executePrincipalLiveness } from "./evict-exec.js";
-/** Re-exported for hosted compositions: the {@link SecretStore} key a store injected into
- *  {@link runDelivery} must hold the cred under. Defined once in workspace (the key↔filename
- *  convention is the workspace layout's) so the writer, the renewal owner, and this reader can
- *  never drift apart. */
-export { DELIVERY_CREDS_KEY };
-/** Where the daemon's pre-minted cred lives — exactly ONE source, resolved up front: an injected
- *  {@link SecretStore} (a hosted composition), an explicit `--creds <file>` (e.g. a read-only
- *  container mount) as an FS store over that exact file, or the default workstation location.
- *  With an injected store the store is the ONLY credential source: every local-source flag
- *  (`--creds`, `--dev-mint`) is rejected loudly at this boundary — and it runs BEFORE any ambient
- *  read in `runDelivery` — so a hosted composition can never cross back into workstation trust
- *  material (a creds file, the local signer), not even for a space label. `where` is the human
- *  label used in error messages so a local operator still sees a path, not an abstract key. */
-function resolveCredsStore(v, injected) {
+/** Re-exported for hosted compositions: the daemon cred's KIND, and the builder that turns it into
+ *  the {@link SecretStore} key for a space. Defined once in workspace (the layout is the workspace's)
+ *  so the writer, the renewal owner, and this reader can never drift apart. As of P7 the kind is NOT
+ *  the key — the key is per-space — so a hosted store must be keyed with the builder; the flat kind
+ *  is the pre-P7 key and putting there leaves this daemon reading an empty location. */
+export { DELIVERY_CREDS_KIND, deliveryCredsKey };
+/**
+ * THE ORDERING-CRITICAL HALF of the cred-source decision, split out so it cannot drift below the
+ * ambient reads. With an injected store the store is the ONLY credential source: every local-source
+ * flag (`--creds`, `--dev-mint`) is rejected loudly HERE, before `runDelivery` derives a space —
+ * because that derivation itself reads the local signer under `--dev-mint`. A hosted composition
+ * must never cross back into workstation trust material, not even for a space label, and the space
+ * is now an INPUT to the key, which is exactly the pressure that would otherwise pull the
+ * derivation above this check.
+ */
+function assertNoLocalCredSourceFlags(v, injected) {
+    if (!injected)
+        return;
+    const local = ["creds", "dev-mint"].filter((f) => v[f] !== undefined);
+    if (local.length)
+        throw new Error(`delivery: ${local.map((f) => `--${f}`).join(" and ")} cannot be combined with an injected secret store — the store is the cred's only source`);
+}
+/** Where the daemon's pre-minted cred lives — exactly ONE source: an injected {@link SecretStore}
+ *  (a hosted composition), an explicit `--creds <file>` (e.g. a read-only container mount) as an FS
+ *  store over that exact file, or the default workstation location. `where` is the human label used
+ *  in error messages so a local operator still sees a path, not an abstract key.
+ *
+ *  Called AFTER {@link assertNoLocalCredSourceFlags} has settled the injected/local conflict, which
+ *  is what lets it take the derived `space`. The workstation arm goes through the per-kind RESOLVER:
+ *  it is the reader whose "absent" answer sends `ensureDelivery` off to mint, so reading the
+ *  canonical location past an unmigrated cred is how a root ends up with two live delivery creds.
+ *  The injected arm builds the key without touching a filesystem it does not have. `--creds` names
+ *  ONE file and is per-space by the operator's own choice of path, so it is neither segmented nor
+ *  migrated — the store there is rooted at that file's own directory. */
+function resolveCredsStore(v, space, injected) {
     if (injected) {
-        const local = ["creds", "dev-mint"].filter((f) => v[f] !== undefined);
-        if (local.length)
-            throw new Error(`delivery: ${local.map((f) => `--${f}`).join(" and ")} cannot be combined with an injected secret store — the store is the cred's only source`);
-        return { store: injected, key: DELIVERY_CREDS_KEY, where: `secret-store key "${DELIVERY_CREDS_KEY}"`, injected: true };
+        const key = segmentedKey(DELIVERY_CREDS_KIND, space);
+        return { store: injected, key, where: `secret-store key "${key}"`, injected: true };
     }
     if (v.creds !== undefined) {
         const p = resolve(v.creds);
         return { store: new FsSecretStore(dirname(p)), key: basename(p), where: p, injected: false };
     }
     const root = findCotalRoot();
-    return { store: workspaceSecretStore(root), key: DELIVERY_CREDS_KEY, where: join(root, ".cotal", DELIVERY_CREDS_KEY), injected: false };
+    const key = deliveryCredsKey(space, { injected: false, root });
+    return { store: workspaceSecretStore(root), key, where: join(root, ".cotal", key), injected: false };
 }
 /** The daemon's scoped `delivery` creds — the PRODUCTION path reads a PRE-MINTED cred through the
  *  {@link SecretStore} seam ({@link resolveCredsStore}; locally the CLI's `ensureDelivery` setup helper
@@ -68,7 +88,7 @@ async function loadDeliveryCreds(src, v) {
         };
     }
     if (src.injected)
-        throw new Error(`delivery: no cred in the injected secret store under key "${DELIVERY_CREDS_KEY}" — the hosted composition must put it before starting the daemon (local sources are never consulted when a store is injected)`);
+        throw new Error(`delivery: no cred in the injected secret store under key "${key}" — the hosted composition must put it before starting the daemon (local sources are never consulted when a store is injected). The key is PER-SPACE as of P7; a cred put under the bare kind "${DELIVERY_CREDS_KIND}" is not read here.`);
     if (v["dev-mint"] !== undefined) {
         // Space-blind dev path: the root must name exactly one space (soleSpaceOf fails loud on several).
         const devRoot = authDir(findCotalRoot());
@@ -95,8 +115,10 @@ async function loadDeliveryCreds(src, v) {
  *
  * `store` is the hosted-composition seam: a closed composition root calls this export directly and
  * injects its own {@link SecretStore} (KMS/Vault…) holding the daemon cred under
- * {@link DELIVERY_CREDS_KEY} AND the membership feed's rw cred under `membership-rw.creds`; the
- * registered `deliver` command passes none and gets the workstation FS store (or `--creds`). The
+ * {@link deliveryCredsKey}`(space, …)` AND the membership feed's rw cred under the matching
+ * `membership-rw.creds` key — both PER-SPACE as of P7, so the bare kinds are the pre-P7 spelling and
+ * are not read; the registered `deliver` command passes none and gets the workstation FS store (or
+ * `--creds`). The
  * renewal owner's write side (`remintDaemonCreds`) is threaded through the manager's
  * `ManagerOptions.secretStore` too, so a hosted composition renews both daemon kinds end-to-end when
  * the manager and this daemon are handed the SAME store.
@@ -108,13 +130,16 @@ export async function runDelivery(args, store) {
     if (shards !== 1 || shard !== 0)
         throw new Error(`delivery: sharded operation is not supported (N=1 only; got shard=${shard} shards=${shards}). ` +
             "The partition() seam ships but operating shards>1 needs the channel-prefix grammar — see core-sub-fabric.md.");
-    // Resolve the cred source FIRST — before the ambient space derivation below — so an injected
-    // store rejects local-source flags before anything can read the workstation signer.
-    const credsSrc = resolveCredsStore(v, store);
+    // Reject local-source flags FIRST — before the ambient space derivation below — so an injected
+    // store can never reach the workstation signer. The cred KEY is per-space as of P7, so resolving
+    // the source now needs the space that this check must precede; the check is therefore split out
+    // and stays here, ahead of everything ambient.
+    assertNoLocalCredSourceFlags(v, store);
     // Space comes from --space (the CLI passes it). Only --dev-mint may derive it from the local signer.
     const space = v.space ?? (v["dev-mint"] !== undefined ? soleSpaceOf(authDir(findCotalRoot())) : undefined);
     if (!space)
         throw new Error("delivery: --space is required (the scoped creds file does not encode it)");
+    const credsSrc = resolveCredsStore(v, space, store);
     const server = v.server ?? DEFAULT_SERVER;
     const creds = await loadDeliveryCreds(credsSrc, v); // pre-minted scoped cred; NO signer/loadSpaceAuth in this path
     let latestCreds = creds.initial; // freshest renewal — the broker-reachability poll below presents it
@@ -133,10 +158,22 @@ export async function runDelivery(args, store) {
     // of the WRONG account is indistinguishable from "the principal is gone" — a healthy-looking
     // answer that authorizes eviction and gate reconciliation. Resolving the root per request from
     // `process.cwd()` let that drift; and a daemon started in a foreign mesh root would sweep a
-    // foreign tenant while looking entirely well. So: the root is fixed at start, and the account on
-    // disk is cross-checked against the account this daemon's OWN credential authenticates as — a
-    // fact that does not come from that root, which is what makes it an independent check.
-    const scanTarget = { root: findCotalRoot(), expectedAccount: accountFromCreds(creds.initial) };
+    // foreign tenant while looking entirely well. So: the root is fixed at start, and the OBSERVER
+    // CRED is cross-checked against the account this daemon's OWN credential authenticates as — two
+    // facts, neither of which comes from that root, which is what makes it an independent check.
+    // The $SYS pair resolves through the SAME injected store, so a hosted composition needs no
+    // `.cotal/` file for it. `injected` is this composition root's own fact — recorded here, where it
+    // is known for certain, rather than inferred later by probing the store or sniffing the
+    // filesystem, both of which report "workstation" for a hosted daemon and would emit a CLI repair
+    // the host cannot run. It selects the REPAIR IDIOM only; failure semantics never fork on it.
+    const scanRoot = findCotalRoot();
+    const scanTarget = {
+        root: scanRoot,
+        expectedAccount: accountFromCreds(creds.initial),
+        source: store === undefined
+            ? { secrets: workspaceSecretStore(scanRoot), space, injected: false, root: scanRoot }
+            : { secrets: store, space, injected: true },
+    };
     console.error(`• delivery: $SYS sweeps bound to ${join(scanTarget.root, ".cotal")} (account ${scanTarget.expectedAccount})`);
     const ep = new CotalEndpoint({
         space,
@@ -218,7 +255,10 @@ export async function runDelivery(args, store) {
         // an arbitrary `--creds` path, whereas membership-rw lives under the workstation `.cotal/` key. With
         // no injected store, startMembership falls back to the workstation FS store.
         // Fail-soft, but never fault-FORGETFUL: whichever way the feed fails to come up, keep the reason.
-        ({ handle: membership, down: membershipDown } = await startMembership({ space, server }, store));
+        // `accountId` is the account THIS daemon's own cred authenticates as (pinned above), not a
+        // `.cotal/membership.json` read: the file was never an independent source (same directory as the
+        // creds, so a wrong root was wrong for both) and a hosted composition has none.
+        ({ handle: membership, down: membershipDown } = await startMembership({ space, server, accountId: scanTarget.expectedAccount }, store));
     }
     catch (e) {
         membershipDown = e.message;

package/dist/delivery.js.map

@@ -1 +1 @@
-{"version":3,"file":"delivery.js","sourceRoot":"","sources":["../src/delivery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACL,aAAa,EACb,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,WAAW,EACX,SAAS,EACT,WAAW,GAIZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAClJ,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,wBAAwB,EAAmB,MAAM,iBAAiB,CAAC;AAInH;;;yBAGyB;AACzB,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAI9B;;;;;;;+FAO+F;AAC/F,SAAS,iBAAiB,CAAC,CAAS,EAAE,QAAsB;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QACtE,IAAI,KAAK,CAAC,MAAM;YACd,MAAM,IAAI,KAAK,CACb,aAAa,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,yFAAyF,CAC/I,CAAC;QACJ,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,qBAAqB,kBAAkB,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACzH,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC/F,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,OAAO,EAAE,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC1I,CAAC;AAED;;;;;;;;;;gBAUgB;AAChB,KAAK,UAAU,iBAAiB,CAAC,GAAgB,EAAE,CAAS;IAC1D,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,IAAwB,CAAC,CAAC,8DAA8D;QAC5F,OAAO;YACL,OAAO;YACP,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,OAAO,KAAK,SAAS;oBACvB,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,8EAA8E,CAAC,CAAC;gBACtJ,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBAC3C,uFAAuF;oBACvF,kFAAkF;oBAClF,wFAAwF;oBACxF,iFAAiF;oBACjF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;oBAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC;wBAAE,OAAO,OAAO,CAAC;oBACvH,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kNAAkN,CAAC,CAAC;gBAC9O,CAAC;gBACD,IAAI,GAAG,OAAO,CAAC;gBACf,OAAO,OAAO,CAAC;YACjB,CAAC;SACF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ;QACd,MAAM,IAAI,KAAK,CACb,6DAA6D,kBAAkB,gIAAgI,CAChN,CAAC;IACJ,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;QAChC,kGAAkG;QAClG,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACpF,OAAO,CAAC,KAAK,CAAC,8KAA8K,CAAC,CAAC;QAC9L,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC,CAAC,oDAAoD;QACpF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,KAAK,CACb,gCAAgC,KAAK,kJAAkJ,CACxL,CAAC;AACJ,CAAC;AAED,yFAAyF;AAEzF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAgB,EAAE,KAAmB;IACrE,MAAM,CAAC,GAAG,IAAI,CAAC,MAAgB,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,qEAAqE,KAAK,WAAW,MAAM,KAAK;YAC9F,8GAA8G,CACjH,CAAC;IAEJ,6FAA6F;IAC7F,oFAAoF;IACpF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAE7C,qGAAqG;IACrG,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3G,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IACxG,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,cAAc,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,+DAA+D;IACnH,IAAI,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,oEAAoE;IAErG,gGAAgG;IAChG,iGAAiG;IACjG,kGAAkG;IAClG,4FAA4F;IAC5F,8FAA8F;IAC9F,2FAA2F;IAC3F,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC;IAChC,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACxF,OAAO,CAAC,KAAK,CAAC,mCAAmC,MAAM,iBAAiB,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,iGAAiG;IACjG,6FAA6F;IAC7F,+FAA+F;IAC/F,4FAA4F;IAC5F,iGAAiG;IACjG,8FAA8F;IAC9F,uFAAuF;IACvF,MAAM,UAAU,GAAe,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,eAAe,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3G,OAAO,CAAC,KAAK,CAAC,oCAAoC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,aAAa,UAAU,CAAC,eAAe,GAAG,CAAC,CAAC;IAE7H,MAAM,EAAE,GAAG,IAAI,aAAa,CAAC;QAC3B,KAAK;QACL,OAAO,EAAE,MAAM;QACf,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,gGAAgG;QAChG,gGAAgG;QAChG,kFAAkF;QAClF,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QACvD,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,KAAK,EAAE,4DAA4D;QAC5E,aAAa,EAAE,IAAI,EAAE,4CAA4C;QACjE,gBAAgB,EAAE,KAAK,EAAE,0EAA0E;QACnG,IAAI,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE;KAC/F,CAAC,CAAC;IACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IAEjB,qGAAqG;IACrG,sGAAsG;IACtG,gEAAgE;IAChE,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,qDAAqD,KAAK,qDAAqD,CAAC,CAAC;QAC/H,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,gGAAgG;IAChG,oFAAoF;IACpF,IAAI,UAA4C,CAAC;IACjD,oGAAoG;IACpG,mGAAmG;IACnG,mDAAmD;IACnD,IAAI,cAAkC,CAAC;IAEvC,qGAAqG;IACrG,8FAA8F;IAC9F,qGAAqG;IACrG,+BAA+B;IAC/B,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE;QACjF,qBAAqB,EAAE,KAAK,EAAE,QAAiB,EAAE,EAAE;YACjD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,+FAA+F;gBAC/F,oFAAoF;gBACpF,+EAA+E;gBAC/E,IAAI,QAAQ,KAAK,SAAS;oBACxB,MAAM,IAAI,KAAK,CACb,6FAA6F,cAAc,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3I,CAAC;gBACJ,OAAO,EAAE,OAAO,EAAE,kDAAkD,cAAc,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;YACtH,CAAC;YACD,kGAAkG;YAClG,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,aAAsB,EAAE,CAAC;QAC5G,CAAC;QACD,2FAA2F;QAC3F,0FAA0F;QAC1F,cAAc,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC;QAC7E,4FAA4F;QAC5F,gGAAgG;QAChG,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC;QAC7E,wFAAwF;QACxF,0FAA0F;QAC1F,4FAA4F;QAC5F,iBAAiB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,wBAAwB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC;KAC1F,CAAC,CAAC;IACH,uGAAuG;IACvG,sGAAsG;IACtG,sDAAsD;IACtD,IAAI,CAAC;QAAC,QAAQ,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAAC,CAAC;IACpE,MAAM,CAAC,CAAC,0FAA0F,CAAC,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAE9H,kGAAkG;IAClG,sGAAsG;IACtG,mFAAmF;IACnF,IAAI,CAAC;QACH,oGAAoG;QACpG,qGAAqG;QACrG,6EAA6E;QAC7E,kGAAkG;QAClG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,MAAM,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IACnG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,cAAc,GAAI,CAAW,CAAC,OAAO,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,kCAAkC,cAAc,mDAAmD,CAAC,CAAC;IACrH,CAAC;IAED,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAQ,EAAE;QACtC,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,aAAa,CAAC,WAAW,CAAC,CAAC;QAC3B,sGAAsG;QACtG,wGAAwG;QACxG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3C,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBAAC,MAAM,UAAU,EAAE,IAAI,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;YACpE,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;YAChF,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,CAAC;IACF,+FAA+F;IAC/F,iEAAiE;IACjE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC;aACnC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;aAC3B,KAAK,CAAC,CAAC,CAAQ,EAAE,EAAE;YAClB,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,OAAO,qCAAqC,CAAC,CAAC;YAC7F,QAAQ,CAAC,CAAC,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAEjD,oGAAoG;IACpG,qGAAqG;IACrG,qGAAqG;IACrG,wGAAwG;IACxG,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,IAAI,MAAM,CAAC;IACnF,IAAI,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE;QACnC,IAAI,QAAQ;YAAE,OAAO;QACrB,8FAA8F;QAC9F,+FAA+F;QAC/F,gGAAgG;QAChG,4FAA4F;QAC5F,EAAE;QACF,4FAA4F;QAC5F,iGAAiG;QACjG,+FAA+F;QAC/F,+FAA+F;QAC/F,KAAK,WAAW,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;aAC5E,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;YACX,IAAI,EAAE,EAAE,CAAC;gBAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC/C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,cAAc,EAAE,CAAC;gBAChD,OAAO,CAAC,KAAK,CAAC,uCAAuC,cAAc,GAAG,IAAI,qCAAqC,CAAC,CAAC;gBACjH,QAAQ,CAAC,CAAC,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrB,CAAC,EAAE,IAAI,CAAC,CAAC;IAET,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,sBAAsB;AAC3D,CAAC"}
+{"version":3,"file":"delivery.js","sourceRoot":"","sources":["../src/delivery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACL,aAAa,EACb,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,WAAW,EACX,SAAS,EACT,WAAW,GAIZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACnL,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,wBAAwB,EAAmB,MAAM,iBAAiB,CAAC;AAInH;;;;wFAIwF;AACxF,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,CAAC;AAIjD;;;;;;;;GAQG;AACH,SAAS,4BAA4B,CAAC,CAAS,EAAE,QAAsB;IACrE,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACtE,IAAI,KAAK,CAAC,MAAM;QACd,MAAM,IAAI,KAAK,CACb,aAAa,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,yFAAyF,CAC/I,CAAC;AACN,CAAC;AAED;;;;;;;;;;;yEAWyE;AACzE,SAAS,iBAAiB,CAAC,CAAS,EAAE,KAAa,EAAE,QAAsB;IACzE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;QACrD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,qBAAqB,GAAG,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC/F,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,OAAO,EAAE,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvG,CAAC;AAED;;;;;;;;;;gBAUgB;AAChB,KAAK,UAAU,iBAAiB,CAAC,GAAgB,EAAE,CAAS;IAC1D,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,IAAwB,CAAC,CAAC,8DAA8D;QAC5F,OAAO;YACL,OAAO;YACP,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,OAAO,KAAK,SAAS;oBACvB,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,8EAA8E,CAAC,CAAC;gBACtJ,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBAC3C,uFAAuF;oBACvF,kFAAkF;oBAClF,wFAAwF;oBACxF,iFAAiF;oBACjF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;oBAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC;wBAAE,OAAO,OAAO,CAAC;oBACvH,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kNAAkN,CAAC,CAAC;gBAC9O,CAAC;gBACD,IAAI,GAAG,OAAO,CAAC;gBACf,OAAO,OAAO,CAAC;YACjB,CAAC;SACF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ;QACd,MAAM,IAAI,KAAK,CACb,6DAA6D,GAAG,kMAAkM,mBAAmB,qBAAqB,CAC3S,CAAC;IACJ,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;QAChC,kGAAkG;QAClG,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACpF,OAAO,CAAC,KAAK,CAAC,8KAA8K,CAAC,CAAC;QAC9L,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC,CAAC,oDAAoD;QACpF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,KAAK,CACb,gCAAgC,KAAK,kJAAkJ,CACxL,CAAC;AACJ,CAAC;AAED,yFAAyF;AAEzF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAgB,EAAE,KAAmB;IACrE,MAAM,CAAC,GAAG,IAAI,CAAC,MAAgB,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,qEAAqE,KAAK,WAAW,MAAM,KAAK;YAC9F,8GAA8G,CACjH,CAAC;IAEJ,+FAA+F;IAC/F,iGAAiG;IACjG,gGAAgG;IAChG,+CAA+C;IAC/C,4BAA4B,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAEvC,qGAAqG;IACrG,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3G,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IACxG,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,cAAc,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,+DAA+D;IACnH,IAAI,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,oEAAoE;IAErG,gGAAgG;IAChG,iGAAiG;IACjG,kGAAkG;IAClG,4FAA4F;IAC5F,8FAA8F;IAC9F,2FAA2F;IAC3F,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC;IAChC,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACxF,OAAO,CAAC,KAAK,CAAC,mCAAmC,MAAM,iBAAiB,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,iGAAiG;IACjG,6FAA6F;IAC7F,+FAA+F;IAC/F,4FAA4F;IAC5F,+FAA+F;IAC/F,gGAAgG;IAChG,6FAA6F;IAC7F,2FAA2F;IAC3F,kGAAkG;IAClG,wFAAwF;IACxF,iGAAiG;IACjG,6FAA6F;IAC7F,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC;IACjC,MAAM,UAAU,GAAe;QAC7B,IAAI,EAAE,QAAQ;QACd,eAAe,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC;QAChD,MAAM,EAAE,KAAK,KAAK,SAAS;YACzB,CAAC,CAAC,EAAE,OAAO,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE;YACrF,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC9C,CAAC;IACF,OAAO,CAAC,KAAK,CAAC,oCAAoC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,aAAa,UAAU,CAAC,eAAe,GAAG,CAAC,CAAC;IAE7H,MAAM,EAAE,GAAG,IAAI,aAAa,CAAC;QAC3B,KAAK;QACL,OAAO,EAAE,MAAM;QACf,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,gGAAgG;QAChG,gGAAgG;QAChG,kFAAkF;QAClF,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QACvD,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,KAAK,EAAE,4DAA4D;QAC5E,aAAa,EAAE,IAAI,EAAE,4CAA4C;QACjE,gBAAgB,EAAE,KAAK,EAAE,0EAA0E;QACnG,IAAI,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE;KAC/F,CAAC,CAAC;IACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IAEjB,qGAAqG;IACrG,sGAAsG;IACtG,gEAAgE;IAChE,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,qDAAqD,KAAK,qDAAqD,CAAC,CAAC;QAC/H,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,gGAAgG;IAChG,oFAAoF;IACpF,IAAI,UAA4C,CAAC;IACjD,oGAAoG;IACpG,mGAAmG;IACnG,mDAAmD;IACnD,IAAI,cAAkC,CAAC;IAEvC,qGAAqG;IACrG,8FAA8F;IAC9F,qGAAqG;IACrG,+BAA+B;IAC/B,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE;QACjF,qBAAqB,EAAE,KAAK,EAAE,QAAiB,EAAE,EAAE;YACjD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,+FAA+F;gBAC/F,oFAAoF;gBACpF,+EAA+E;gBAC/E,IAAI,QAAQ,KAAK,SAAS;oBACxB,MAAM,IAAI,KAAK,CACb,6FAA6F,cAAc,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3I,CAAC;gBACJ,OAAO,EAAE,OAAO,EAAE,kDAAkD,cAAc,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;YACtH,CAAC;YACD,kGAAkG;YAClG,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,aAAsB,EAAE,CAAC;QAC5G,CAAC;QACD,2FAA2F;QAC3F,0FAA0F;QAC1F,cAAc,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC;QAC7E,4FAA4F;QAC5F,gGAAgG;QAChG,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC;QAC7E,wFAAwF;QACxF,0FAA0F;QAC1F,4FAA4F;QAC5F,iBAAiB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,wBAAwB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC;KAC1F,CAAC,CAAC;IACH,uGAAuG;IACvG,sGAAsG;IACtG,sDAAsD;IACtD,IAAI,CAAC;QAAC,QAAQ,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAAC,CAAC;IACpE,MAAM,CAAC,CAAC,0FAA0F,CAAC,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAE9H,kGAAkG;IAClG,sGAAsG;IACtG,mFAAmF;IACnF,IAAI,CAAC;QACH,oGAAoG;QACpG,qGAAqG;QACrG,6EAA6E;QAC7E,kGAAkG;QAClG,2FAA2F;QAC3F,iGAAiG;QACjG,gFAAgF;QAChF,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,MAAM,eAAe,CACnE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,eAAe,EAAE,EACxD,KAAK,CACN,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,cAAc,GAAI,CAAW,CAAC,OAAO,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,kCAAkC,cAAc,mDAAmD,CAAC,CAAC;IACrH,CAAC;IAED,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAQ,EAAE;QACtC,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,aAAa,CAAC,WAAW,CAAC,CAAC;QAC3B,sGAAsG;QACtG,wGAAwG;QACxG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3C,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBAAC,MAAM,UAAU,EAAE,IAAI,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;YACpE,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;YAChF,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,CAAC;IACF,+FAA+F;IAC/F,iEAAiE;IACjE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC;aACnC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;aAC3B,KAAK,CAAC,CAAC,CAAQ,EAAE,EAAE;YAClB,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,OAAO,qCAAqC,CAAC,CAAC;YAC7F,QAAQ,CAAC,CAAC,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAEjD,oGAAoG;IACpG,qGAAqG;IACrG,qGAAqG;IACrG,wGAAwG;IACxG,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,IAAI,MAAM,CAAC;IACnF,IAAI,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE;QACnC,IAAI,QAAQ;YAAE,OAAO;QACrB,8FAA8F;QAC9F,+FAA+F;QAC/F,gGAAgG;QAChG,4FAA4F;QAC5F,EAAE;QACF,4FAA4F;QAC5F,iGAAiG;QACjG,+FAA+F;QAC/F,+FAA+F;QAC/F,KAAK,WAAW,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;aAC5E,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;YACX,IAAI,EAAE,EAAE,CAAC;gBAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC/C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,cAAc,EAAE,CAAC;gBAChD,OAAO,CAAC,KAAK,CAAC,uCAAuC,cAAc,GAAG,IAAI,qCAAqC,CAAC,CAAC;gBACjH,QAAQ,CAAC,CAAC,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrB,CAAC,EAAE,IAAI,CAAC,CAAC;IAET,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,sBAAsB;AAC3D,CAAC"}

package/dist/evict-exec.d.ts

@@ -1,4 +1,5 @@
 import { type EvictionResult, type PlaneLivenessResult, type PrincipalLivenessResult } from "@cotal-ai/core";
+import { type SysCredsSource } from "./sys-creds.js";
 /**
  * THE SCAN TARGET, resolved fail-closed and BOUND TO THE DAEMON'S OWN TENANCY.
  *
@@ -12,9 +13,17 @@ import { type EvictionResult, type PlaneLivenessResult, type PrincipalLivenessRe
  *
  * Two independent guards, because either alone leaves a real case open:
  *  - the root is PINNED AT DAEMON START, so it cannot drift with `process.cwd()` between requests;
- *  - the account on disk is CROSS-CHECKED against the account the daemon's own credential
+ *  - the OBSERVER CRED is CROSS-CHECKED against the account the daemon's own credential
  *    authenticates as. Pinning alone cannot notice a daemon that started in the wrong root to
- *    begin with; the tenancy check can, because the credential is not read from that root.
+ *    begin with; the tenancy check can, because neither side of it is read from that root.
+ *
+ * The second guard used to compare `.cotal/membership.json` against `expectedAccount`. It now
+ * compares the OBSERVER'S OWN CONNZ PERMISSION against it (`sys-creds.ts`), which is strictly
+ * stronger: the file sat in the same directory as the creds, so a wrong root was wrong for both, and
+ * its independence came from `expectedAccount` being derived from the cred anyway — the cred was
+ * always the real authority and the file was the thing being checked. The disk file is still read as
+ * a SECOND source on the workstation path, where the root genuinely can drift; it is no longer
+ * required, and a hosted composition has none.
  *
  * A mismatch REFUSES LOUD and names both sides. Note the asymmetry that makes this necessary: an
  * observer scoped to account A with accountId B under-reports (broker-denied → `unknown`, safe),
@@ -26,6 +35,9 @@ export interface ScanTarget {
     root: string;
     /** The account the daemon's own delivery credential authenticates as. */
     expectedAccount: string;
+    /** Where the $SYS pair is read from, and whether that store was injected (hosted) — the latter
+     *  selects the repair idiom only, never the failure semantics. */
+    source: SysCredsSource;
 }
 /**
  * The delivery daemon's LIVE-EVICTION executor (D5 slice 6, on the privileged delivery-admin rail):
@@ -44,13 +56,18 @@ export declare function executeEviction(server: string, target: ScanTarget, prin
  * connection tuples; anything else refuses loudly. A space provisioned before the observer existed
  * refuses with the regeneration step — the auth plane treats that refusal as UNKNOWN and never
  * reclaims over it (fail-closed).
+ *
+ * Asks for the observer ONLY, so the KICK cred is not even read into this process's memory on a
+ * read-only path. The cost is that the torn-rotation check cannot run here (it needs both halves);
+ * that is safe rather than a gap — a torn pair whose observer is the stale half is refused by the
+ * broker, and this path reads any refusal as UNKNOWN, which is already fail-closed.
  */
 export declare function executePlaneLiveness(server: string, target: ScanTarget, query: unknown): Promise<PlaneLivenessResult>;
 /**
  * The delivery daemon's FREEZE-HOLDER LIVENESS probe (#391, on the privileged delivery-admin rail):
  * answer whether ONE principal still holds a live connection, via the $SYS CONNZ observer cred
  * (opened per call; READ-ONLY — the KICK evictor cred never enters this path, and is not even read
- * from disk here).
+ * from the store here).
  *
  * This is the READ half of {@link executeEviction}, and it exists because the write half cannot
  * serve as its own precheck: a repair that must REFUSE while the holder is alive would, using

package/dist/evict-exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evict-exec.d.ts","sourceRoot":"","sources":["../src/evict-exec.ts"],"names":[],"mappings":"AAEA,OAAO,EAOL,KAAK,cAAc,EAEnB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,gBAAgB,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAC;CACzB;AAsBD;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAwBpH;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAkB3H;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAuBvI"}
+{"version":3,"file":"evict-exec.d.ts","sourceRoot":"","sources":["../src/evict-exec.ts"],"names":[],"mappings":"AAEA,OAAO,EAOL,KAAK,cAAc,EAEnB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAA0E,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAG7H;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAC;IACxB;sEACkE;IAClE,MAAM,EAAE,cAAc,CAAC;CACxB;AAqED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAmBpH;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAc3H;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAmBvI"}

package/dist/evict-exec.js

@@ -1,23 +1,72 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { evictDeniedPrincipalWithCreds, isPlaneConnTuple, isPrincipalOwnerToken, observePlaneLivenessWithCreds, observePrincipalLivenessWithCreds, parsePrincipalKey, } from "@cotal-ai/core";
-import { findCotalRoot } from "@cotal-ai/workspace";
+import { CONNECTION_EVICTOR_CREDS_KIND, findCotalRoot, membershipConfigPath, MEMBERSHIP_OBSERVER_CREDS_KIND } from "@cotal-ai/workspace";
+import { loadSysPair, observerTenancyProblem, repairAdvice, tornRotationProblem } from "./sys-creds.js";
+/**
+ * Pin check + the WORKSTATION-ONLY second source.
+ *
+ * The account to sweep is `target.expectedAccount` — the daemon's own credential, pinned at start.
+ * `membership.json` is no longer consulted for it. On the workstation path the file is still
+ * cross-checked WHEN PRESENT, because there a wrong root is a real, enumerated failure mode
+ * (see the cases above) and a second independent-ish source costs nothing. It is no longer
+ * REQUIRED: its absence is not an error, and a hosted composition never has one.
+ */
 function resolveScan(target, verb) {
     const live = findCotalRoot();
     if (live !== target.root)
         throw new Error(`${verb}: the mesh root resolved at this request (${live}) is not the one this daemon started in (${target.root}); ` +
             "the scan account would be read from a different workspace than the one this daemon serves. Refusing — a sweep of the wrong account looks exactly like a dead principal");
-    const dir = join(target.root, ".cotal");
-    const cfgPath = join(dir, "membership.json");
-    if (!existsSync(cfgPath))
-        throw new Error(`${verb}: ${cfgPath} is missing, so the account to scan is unknown`);
-    const accountId = JSON.parse(readFileSync(cfgPath, "utf8")).accountId;
-    if (!accountId)
-        throw new Error(`${verb}: ${cfgPath} has no accountId`);
-    if (accountId !== target.expectedAccount)
-        throw new Error(`${verb}: ${cfgPath} names account ${accountId}, but this daemon's own credential authenticates as ${target.expectedAccount}. ` +
-            "That disk material belongs to a different mesh, and sweeping it would return a confident, WRONG answer (a complete sweep of the wrong account is indistinguishable from a gone principal). Refusing — start the daemon from the workspace root whose account it serves");
-    return { dir, accountId };
+    if (!target.source.injected) {
+        // Through the kind's resolver (P7 §2 rule 1), not a hand-composed `.cotal/membership.json`:
+        // the file is per-space now, and reading the canonical location past an unmigrated copy would
+        // silently drop this second source — turning a wrong-root refusal into a confident sweep.
+        // `target.source.space` is the space the daemon started in, pinned with the rest of the source.
+        const cfgPath = membershipConfigPath(target.root, target.source.space);
+        if (existsSync(cfgPath)) {
+            // A malformed file on a path that no longer needs it must not take eviction down; only a file
+            // that names a DIFFERENT account is evidence of the drift this check exists to catch.
+            let onDisk;
+            try {
+                onDisk = JSON.parse(readFileSync(cfgPath, "utf8")).accountId;
+            }
+            catch {
+                onDisk = undefined;
+            }
+            if (onDisk !== undefined && onDisk !== target.expectedAccount)
+                throw new Error(`${verb}: ${cfgPath} names account ${onDisk}, but this daemon's own credential authenticates as ${target.expectedAccount}. ` +
+                    "That disk material belongs to a different mesh, and sweeping it would return a confident, WRONG answer (a complete sweep of the wrong account is indistinguishable from a gone principal). Refusing — start the daemon from the workspace root whose account it serves");
+        }
+    }
+    return { accountId: target.expectedAccount };
+}
+/** Read the $SYS material for one verb and run every pre-connect check, or THROW.
+ *
+ *  Fail-loud is the whole posture here (design §4.2): a missing key is a REFUSAL, full stop. In
+ *  particular a missing evictor must NOT silently fall back to deny-new-only inside the executor —
+ *  that posture is the CALLER's documented degradation, reached by handling this refusal, never
+ *  something the executor may choose on its own. And absence (`undefined` per the `SecretStore`
+ *  contract) is the only thing treated as "not provisioned": a `get()` that throws is a refusal,
+ *  not an absence, and propagates untouched from `loadSysPair`. */
+async function loadCheckedSys(target, verb, need) {
+    const sys = await loadSysPair(target.source, need);
+    if (sys.missing.length)
+        throw new Error(`${verb}: the $SYS ${need === "both" ? "observer/evictor creds are" : "observer creds are"} not provisioned here ` +
+            `(missing ${sys.missing.join(", ")}; a space created before live eviction) - ${repairAdvice(target.source, sys.missing)}. ` +
+            "Until then removal is deny-new-only (durable reauth)");
+    const observer = sys.observer;
+    const tenancy = observerTenancyProblem(observer, target.expectedAccount);
+    if (tenancy)
+        throw new Error(`${verb}: ${tenancy}. Refusing`);
+    if (sys.evictor !== undefined) {
+        // The torn-rotation check now covers this path too. It used to exist only in the feed, so
+        // eviction could open a half-rotated pair and get a bare "Authorization Violation" from the
+        // broker with nothing naming the cause.
+        const torn = tornRotationProblem(observer, sys.evictor, () => repairAdvice(target.source, [MEMBERSHIP_OBSERVER_CREDS_KIND, CONNECTION_EVICTOR_CREDS_KIND]));
+        if (torn)
+            throw new Error(`${verb}: ${torn}. Refusing`);
+    }
+    return { observer, ...(sys.evictor !== undefined ? { evictor: sys.evictor } : {}) };
 }
 /**
  * The delivery daemon's LIVE-EVICTION executor (D5 slice 6, on the privileged delivery-admin rail):
@@ -37,15 +86,12 @@ export async function executeEviction(server, target, principal) {
     const parsed = parsePrincipalKey(principal);
     if (!parsed || !isPrincipalOwnerToken(parsed.owner))
         throw new Error(`evictPrincipal: "${principal}" is not a real owner.actor principal (owner must be \`local\` or a derived \`u_…\` token — the only shapes CONNZ attribution can surface)`);
-    const { dir, accountId } = resolveScan(target, "evictPrincipal");
-    const obsPath = join(dir, "membership-observer.creds");
-    const evPath = join(dir, "connection-evictor.creds");
-    if (!existsSync(obsPath) || !existsSync(evPath))
-        throw new Error("evictPrincipal: the $SYS observer/evictor creds are not provisioned here (a space created before live eviction); mint them with `cotal down` then `cotal up --rotate-sys`. Until then removal is deny-new-only (durable reauth)");
+    const { accountId } = resolveScan(target, "evictPrincipal");
+    const sys = await loadCheckedSys(target, "evictPrincipal", "both");
     return evictDeniedPrincipalWithCreds({
         servers: server,
-        observerCreds: readFileSync(obsPath, "utf8"),
-        evictorCreds: readFileSync(evPath, "utf8"),
+        observerCreds: sys.observer,
+        evictorCreds: sys.evictor,
         accountId,
         principal,
     });
@@ -58,6 +104,11 @@ export async function executeEviction(server, target, principal) {
  * connection tuples; anything else refuses loudly. A space provisioned before the observer existed
  * refuses with the regeneration step — the auth plane treats that refusal as UNKNOWN and never
  * reclaims over it (fail-closed).
+ *
+ * Asks for the observer ONLY, so the KICK cred is not even read into this process's memory on a
+ * read-only path. The cost is that the torn-rotation check cannot run here (it needs both halves);
+ * that is safe rather than a gap — a torn pair whose observer is the stale half is refused by the
+ * broker, and this path reads any refusal as UNKNOWN, which is already fail-closed.
  */
 export async function executePlaneLiveness(server, target, query) {
     const q = query;
@@ -65,13 +116,11 @@ export async function executePlaneLiveness(server, target, query) {
         Object.keys(q).some((k) => k !== "ledger" && k !== "records") || // closed top-level shape
         !isPlaneConnTuple(q.ledger) || !isPlaneConnTuple(q.records))
         throw new Error("planeConnLiveness: the query must be exactly { ledger, records } connection tuples ({ serverId, cid, userNkey }); refusing a malformed or wider query");
-    const { dir, accountId } = resolveScan(target, "planeConnLiveness");
-    const obsPath = join(dir, "membership-observer.creds");
-    if (!existsSync(obsPath))
-        throw new Error("planeConnLiveness: the $SYS observer creds are not provisioned here (a space created before live observation); mint them with `cotal down` then `cotal up --rotate-sys`");
+    const { accountId } = resolveScan(target, "planeConnLiveness");
+    const sys = await loadCheckedSys(target, "planeConnLiveness", "observer");
     return observePlaneLivenessWithCreds({
         servers: server,
-        observerCreds: readFileSync(obsPath, "utf8"),
+        observerCreds: sys.observer,
         accountId,
         query: { ledger: q.ledger, records: q.records },
     });
@@ -80,7 +129,7 @@ export async function executePlaneLiveness(server, target, query) {
  * The delivery daemon's FREEZE-HOLDER LIVENESS probe (#391, on the privileged delivery-admin rail):
  * answer whether ONE principal still holds a live connection, via the $SYS CONNZ observer cred
  * (opened per call; READ-ONLY — the KICK evictor cred never enters this path, and is not even read
- * from disk here).
+ * from the store here).
  *
  * This is the READ half of {@link executeEviction}, and it exists because the write half cannot
  * serve as its own precheck: a repair that must REFUSE while the holder is alive would, using
@@ -100,13 +149,11 @@ export async function executePrincipalLiveness(server, target, principal) {
     const parsed = parsePrincipalKey(wanted);
     if (!parsed || !isPrincipalOwnerToken(parsed.owner))
         throw new Error(`principalLiveness: "${wanted}" is not a real owner.actor principal (owner must be \`local\` or a derived \`u_…\` token — the only shapes CONNZ attribution can surface)`);
-    const { dir, accountId } = resolveScan(target, "principalLiveness");
-    const obsPath = join(dir, "membership-observer.creds");
-    if (!existsSync(obsPath))
-        throw new Error("principalLiveness: the $SYS observer creds are not provisioned here (a space created before live observation); mint them with `cotal down` then `cotal up --rotate-sys`");
+    const { accountId } = resolveScan(target, "principalLiveness");
+    const sys = await loadCheckedSys(target, "principalLiveness", "observer");
     return observePrincipalLivenessWithCreds({
         servers: server,
-        observerCreds: readFileSync(obsPath, "utf8"),
+        observerCreds: sys.observer,
         accountId,
         principal: wanted,
     });

package/dist/evict-exec.js.map

@@ -1 +1 @@
-{"version":3,"file":"evict-exec.js","sourceRoot":"","sources":["../src/evict-exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,6BAA6B,EAC7B,gBAAgB,EAChB,qBAAqB,EACrB,6BAA6B,EAC7B,iCAAiC,EACjC,iBAAiB,GAKlB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAgCpD,SAAS,WAAW,CAAC,MAAkB,EAAE,IAAY;IACnD,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,IAAI,IAAI,KAAK,MAAM,CAAC,IAAI;QACtB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,6CAA6C,IAAI,4CAA4C,MAAM,CAAC,IAAI,KAAK;YACpH,wKAAwK,CACzK,CAAC;IACJ,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,OAAO,gDAAgD,CAAC,CAAC;IAC/G,MAAM,SAAS,GAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAA4B,CAAC,SAAS,CAAC;IAClG,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,OAAO,mBAAmB,CAAC,CAAC;IACxE,IAAI,SAAS,KAAK,MAAM,CAAC,eAAe;QACtC,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,KAAK,OAAO,kBAAkB,SAAS,uDAAuD,MAAM,CAAC,eAAe,IAAI;YAC/H,wQAAwQ,CACzQ,CAAC;IACJ,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,MAAkB,EAAE,SAAiB;IACzF,+FAA+F;IAC/F,iGAAiG;IACjG,4FAA4F;IAC5F,6FAA6F;IAC7F,2FAA2F;IAC3F,uFAAuF;IACvF,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,oBAAoB,SAAS,4IAA4I,CAAC,CAAC;IAC7L,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,iOAAiO,CAClO,CAAC;IACJ,OAAO,6BAA6B,CAAC;QACnC,OAAO,EAAE,MAAM;QACf,aAAa,EAAE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC;QAC5C,YAAY,EAAE,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC;QAC1C,SAAS;QACT,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc,EAAE,MAAkB,EAAE,KAAc;IAC3F,MAAM,CAAC,GAAG,KAAgD,CAAC;IAC3D,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QACtD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,SAAS,CAAC,IAAI,yBAAyB;QAC1F,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,uJAAuJ,CAAC,CAAC;IAC3K,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,yKAAyK,CAC1K,CAAC;IACJ,OAAO,6BAA6B,CAAC;QACnC,OAAO,EAAE,MAAM;QACf,aAAa,EAAE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC;QAC5C,SAAS;QACT,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAAc,EAAE,MAAkB,EAAE,SAAkB;IACnG,8FAA8F;IAC9F,0FAA0F;IAC1F,4FAA4F;IAC5F,gGAAgG;IAChG,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,4IAA4I,CAAC,CAAC;IAC7L,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,yKAAyK,CAC1K,CAAC;IACJ,OAAO,iCAAiC,CAAC;QACvC,OAAO,EAAE,MAAM;QACf,aAAa,EAAE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC;QAC5C,SAAS;QACT,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"evict-exec.js","sourceRoot":"","sources":["../src/evict-exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,6BAA6B,EAC7B,gBAAgB,EAChB,qBAAqB,EACrB,6BAA6B,EAC7B,iCAAiC,EACjC,iBAAiB,GAKlB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,6BAA6B,EAAE,aAAa,EAAE,oBAAoB,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AACzI,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,YAAY,EAAE,mBAAmB,EAAuB,MAAM,gBAAgB,CAAC;AA2C7H;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,MAAkB,EAAE,IAAY;IACnD,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,IAAI,IAAI,KAAK,MAAM,CAAC,IAAI;QACtB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,6CAA6C,IAAI,4CAA4C,MAAM,CAAC,IAAI,KAAK;YACpH,wKAAwK,CACzK,CAAC;IACJ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC5B,4FAA4F;QAC5F,8FAA8F;QAC9F,0FAA0F;QAC1F,gGAAgG;QAChG,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,8FAA8F;YAC9F,sFAAsF;YACtF,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBAAC,MAAM,GAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAA4B,CAAC,SAAS,CAAC;YAAC,CAAC;YACjG,MAAM,CAAC;gBAAC,MAAM,GAAG,SAAS,CAAC;YAAC,CAAC;YAC7B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,MAAM,CAAC,eAAe;gBAC3D,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,KAAK,OAAO,kBAAkB,MAAM,uDAAuD,MAAM,CAAC,eAAe,IAAI;oBAC5H,wQAAwQ,CACzQ,CAAC;QACN,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;mEAOmE;AACnE,KAAK,UAAU,cAAc,CAAC,MAAkB,EAAE,IAAY,EAAE,IAAyB;IACvF,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACnD,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM;QACpB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,cAAc,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,oBAAoB,wBAAwB;YAClH,YAAY,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,6CAA6C,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;YAC3H,sDAAsD,CACvD,CAAC;IACJ,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAkB,CAAC;IACxC,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IACzE,IAAI,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,OAAO,YAAY,CAAC,CAAC;IAC9D,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9B,0FAA0F;QAC1F,4FAA4F;QAC5F,wCAAwC;QACxC,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,8BAA8B,EAAE,6BAA6B,CAAC,CAAC,CAAC,CAAC;QAC5J,IAAI,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,IAAI,YAAY,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACtF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,MAAkB,EAAE,SAAiB;IACzF,+FAA+F;IAC/F,iGAAiG;IACjG,4FAA4F;IAC5F,6FAA6F;IAC7F,2FAA2F;IAC3F,uFAAuF;IACvF,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,oBAAoB,SAAS,4IAA4I,CAAC,CAAC;IAC7L,MAAM,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;IACnE,OAAO,6BAA6B,CAAC;QACnC,OAAO,EAAE,MAAM;QACf,aAAa,EAAE,GAAG,CAAC,QAAQ;QAC3B,YAAY,EAAE,GAAG,CAAC,OAAiB;QACnC,SAAS;QACT,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc,EAAE,MAAkB,EAAE,KAAc;IAC3F,MAAM,CAAC,GAAG,KAAgD,CAAC;IAC3D,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QACtD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,SAAS,CAAC,IAAI,yBAAyB;QAC1F,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,uJAAuJ,CAAC,CAAC;IAC3K,MAAM,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,mBAAmB,EAAE,UAAU,CAAC,CAAC;IAC1E,OAAO,6BAA6B,CAAC;QACnC,OAAO,EAAE,MAAM;QACf,aAAa,EAAE,GAAG,CAAC,QAAQ;QAC3B,SAAS;QACT,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAAc,EAAE,MAAkB,EAAE,SAAkB;IACnG,8FAA8F;IAC9F,0FAA0F;IAC1F,4FAA4F;IAC5F,gGAAgG;IAChG,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,4IAA4I,CAAC,CAAC;IAC7L,MAAM,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,mBAAmB,EAAE,UAAU,CAAC,CAAC;IAC1E,OAAO,iCAAiC,CAAC;QACvC,OAAO,EAAE,MAAM;QACf,aAAa,EAAE,GAAG,CAAC,QAAQ;QAC3B,SAAS;QACT,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { DELIVERY_CREDS_KEY, runDelivery } from "./delivery.js";
+import { DELIVERY_CREDS_KIND, deliveryCredsKey, runDelivery } from "./delivery.js";
 import { runFeedbackIntake } from "./feedback-intake.js";
-export { DELIVERY_CREDS_KEY, runDelivery };
+export { DELIVERY_CREDS_KIND, deliveryCredsKey, runDelivery };
 export { runFeedbackIntake };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AA4CzD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AA4CzD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/index.js

@@ -6,7 +6,7 @@
  * `@cotal-ai/manager` or `@cotal-ai/cli` (one-way tiering).
  */
 import { registry } from "@cotal-ai/core";
-import { DELIVERY_CREDS_KEY, runDelivery } from "./delivery.js";
+import { DELIVERY_CREDS_KIND, deliveryCredsKey, runDelivery } from "./delivery.js";
 import { runFeedbackIntake } from "./feedback-intake.js";
 const deliveryCommands = [
     {
@@ -46,6 +46,6 @@ const deliveryCommands = [
     },
 ];
 registry.register(...deliveryCommands);
-export { DELIVERY_CREDS_KEY, runDelivery };
+export { DELIVERY_CREDS_KIND, deliveryCredsKey, runDelivery };
 export { runFeedbackIntake };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,QAAQ,EAAgB,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,MAAM,gBAAgB,GAAc;IAClC;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,SAAS;QAChB,OAAO,EACL,0IAA0I;QAC5I,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,8DAA8D,EAAE;YAC5H,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,sCAAsC,EAAE;YACvG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,oEAAoE,EAAE;YACnH,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,iCAAiC,EAAE;YAClG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,8CAA8C,EAAE;YAC5G,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,wCAAwC,EAAE;YACvG,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,mEAAmE,EAAE;SACxH;QACD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC;KACjC;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,SAAS;QAChB,OAAO,EACL,+FAA+F;QACjG,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,mCAAmC,EAAE;YACnG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,6BAA6B,EAAE;YAC1F,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,oEAAoE,EAAE;YACpI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,+DAA+D,EAAE;YAChI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,0DAA0D,EAAE;YACxH,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,sDAAsD,EAAE;YACzH,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,sCAAsC,EAAE;YACvG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,6CAA6C,EAAE;YAC9G,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,iDAAiD,EAAE;YACnH,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,kDAAkD,EAAE;SACtH;QACD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC;KACvC;CACF,CAAC;AAEF,QAAQ,CAAC,QAAQ,CAAC,GAAG,gBAAgB,CAAC,CAAC;AAEvC,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,QAAQ,EAAgB,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,MAAM,gBAAgB,GAAc;IAClC;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,SAAS;QAChB,OAAO,EACL,0IAA0I;QAC5I,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,8DAA8D,EAAE;YAC5H,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,sCAAsC,EAAE;YACvG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,oEAAoE,EAAE;YACnH,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,iCAAiC,EAAE;YAClG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,8CAA8C,EAAE;YAC5G,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,wCAAwC,EAAE;YACvG,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,mEAAmE,EAAE;SACxH;QACD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC;KACjC;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,SAAS;QAChB,OAAO,EACL,+FAA+F;QACjG,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,mCAAmC,EAAE;YACnG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,6BAA6B,EAAE;YAC1F,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,oEAAoE,EAAE;YACpI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,+DAA+D,EAAE;YAChI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,0DAA0D,EAAE;YACxH,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,sDAAsD,EAAE;YACzH,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,sCAAsC,EAAE;YACvG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,6CAA6C,EAAE;YAC9G,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,iDAAiD,EAAE;YACnH,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,kDAAkD,EAAE;SACtH;QACD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC;KACvC;CACF,CAAC;AAEF,QAAQ,CAAC,QAAQ,CAAC,GAAG,gBAAgB,CAAC,CAAC;AAEvC,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/membership.d.ts

@@ -1,22 +1,21 @@
 import { type MembershipFeedHandle, type SecretStore } from "@cotal-ai/core";
 /**
- * The delivery daemon's thin composition root for the broker-sourced graph-membership feed. It loads the
- * DATA account id + the SYSTEM-account observer cred from `.cotal/` (written by `cotal up`; the daemon
- * never holds the signer) and reads the DATA-account rw cred through the {@link SecretStore} seam — the
- * SAME seam the renewal owner (the manager) re-signs into — so a hosted composition can renew the feed's
- * writer end-to-end (KMS/Vault) without a daemon restart. `store` is that hosted injection point; with
- * none, the workstation FS store (keys = the filenames under `.cotal/`) is used, so a local `cotal up`
- * is byte-for-byte unchanged. It hands the two creds + the account id to the core feed engine
- * ({@link startMembershipFeed}, which owns the two connections + the poll loop + the rw 75% renewal).
+ * The delivery daemon's thin composition root for the broker-sourced graph-membership feed. Every
+ * credential it needs — the DATA-account rw cred AND the SYSTEM-account observer — now resolves
+ * through the {@link SecretStore} seam, so a hosted composition can supply all of them with no file
+ * on disk. `store` is that injection point; with none, the workstation FS store is used (keys = the
+ * filenames under `.cotal/`), so a local `cotal up` is byte-for-byte unchanged. It hands the two
+ * creds + the account id to the core feed engine ({@link startMembershipFeed}, which owns the two
+ * connections + the poll loop + the rw 75% renewal).
  *
- * Deliberately ISOLATED from Plane-3: a separate module, separate connections, and a fail-soft contract —
- * if the creds aren't provisioned (a pre-feature space) or the feed can't start, it logs and returns
- * `undefined`; the graph degrades to traffic-only and delivery is untouched.
+ * The ACCOUNT ID is no longer read from `.cotal/membership.json`. It arrives as `opts.accountId` —
+ * the account the daemon's own delivery cred authenticates as, pinned once at start — and the
+ * observer is checked against it intrinsically (see `sys-creds.ts`). That file was never an
+ * independent source: it sat in the same directory as the creds, so a wrong root was wrong for both.
  *
- * Residual (deferred, non-blocking): the observer cred + `membership.json` (the account id) are still
- * read from `.cotal/` files, so a fully hosted feed on an injected store also needs those two threaded.
- * They are a static $SYS cred and non-secret config, respectively — the renewable rw kind is what 3b
- * migrates; the manager re-signs only it.
+ * Deliberately ISOLATED from Plane-3: a separate module, separate connections, and a fail-soft
+ * contract — if the creds aren't provisioned (a pre-feature space) or the feed can't start, it logs
+ * and returns `{ down }`; the graph degrades to traffic-only and delivery is untouched.
  */
 /** Why the feed is, or is not, running. `down` carries the DIAGNOSIS to the caller, because the
  *  daemon's log line is not the only place it is needed: an adoption reply that says only "the feed is
@@ -32,5 +31,6 @@ export type MembershipStart = {
 export declare function startMembership(opts: {
     space: string;
     server: string;
+    accountId: string;
 }, store?: SecretStore): Promise<MembershipStart>;
 //# sourceMappingURL=membership.d.ts.map

package/dist/membership.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"membership.d.ts","sourceRoot":"","sources":["../src/membership.ts"],"names":[],"mappings":"AAEA,OAAO,EAAuD,KAAK,oBAAoB,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGlI;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;+FAG+F;AAC/F,MAAM,MAAM,eAAe,GAAG;IAAE,MAAM,EAAE,oBAAoB,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,MAAM,CAAC,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAExH,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,CAqG5H"}
+{"version":3,"file":"membership.d.ts","sourceRoot":"","sources":["../src/membership.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0C,KAAK,oBAAoB,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAIrH;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;+FAG+F;AAC/F,MAAM,MAAM,eAAe,GAAG;IAAE,MAAM,EAAE,oBAAoB,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,MAAM,CAAC,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAExH,wBAAsB,eAAe,CACnC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EAC1D,KAAK,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,eAAe,CAAC,CA8G1B"}

package/dist/membership.js

@@ -1,78 +1,85 @@
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-import { credsClaims, inspectCredHealth, startMembershipFeed } from "@cotal-ai/core";
-import { findCotalRoot, MEMBERSHIP_RW_CREDS_KEY, workspaceSecretStore } from "@cotal-ai/workspace";
+import { inspectCredHealth, startMembershipFeed } from "@cotal-ai/core";
+import { CONNECTION_EVICTOR_CREDS_KIND, findCotalRoot, membershipRwCredsKey, MEMBERSHIP_OBSERVER_CREDS_KIND, MEMBERSHIP_RW_CREDS_KIND, workspaceSecretStore } from "@cotal-ai/workspace";
+import { loadSysPair, observerTenancyProblem, repairAdvice, tornRotationProblem } from "./sys-creds.js";
 export async function startMembership(opts, store) {
-    const root = findCotalRoot();
-    const dir = join(root, ".cotal");
-    const obsPath = join(dir, "membership-observer.creds");
-    const cfgPath = join(dir, "membership.json");
-    const secrets = store ?? workspaceSecretStore(root);
-    const rw = await secrets.get(MEMBERSHIP_RW_CREDS_KEY);
+    // `injected` is the composition root's own fact, decided here before any I/O — never inferred by
+    // probing the store or sniffing `.cotal/`, which would report "workstation" for a hosted daemon
+    // and emit a CLI repair the host cannot run (design §4.1). The workstation arm carries the root
+    // it resolved, because that is what lets `repairAdvice` ask whether the command it would name is
+    // one this root can actually run; a hosted composition has no root and names no command.
+    // Spelled as a branch, not a `??`, so the root is still resolved ONLY when no store was injected.
+    let source;
+    if (store === undefined) {
+        const root = findCotalRoot();
+        source = { secrets: workspaceSecretStore(root), space: opts.space, injected: false, root };
+    }
+    else {
+        source = { secrets: store, space: opts.space, injected: true };
+    }
+    // Through the per-kind resolver (P7 §2 rule 1) — the source's arms ARE the composition it takes.
+    // The rw cred is absent-means-MINT on the `up` side, so reading the canonical location past an
+    // unmigrated copy would report the bundle incomplete and let the next `up` mint a second one.
+    const rwKey = membershipRwCredsKey(opts.space, source);
+    const rw = await source.secrets.get(rwKey);
+    // Ask for both $SYS creds: the observer is REQUIRED, the evictor only feeds the torn-rotation
+    // check below. A space with no evictor still runs a perfectly good feed (eviction refuses on its
+    // own path, loudly), so its absence must not take the feed down.
+    const sys = await loadSysPair(source, "both");
     const missing = [
-        rw === undefined ? MEMBERSHIP_RW_CREDS_KEY : undefined,
-        existsSync(obsPath) ? undefined : "membership-observer.creds",
-        existsSync(cfgPath) ? undefined : "membership.json",
+        rw === undefined ? MEMBERSHIP_RW_CREDS_KIND : undefined,
+        ...sys.missing.filter((k) => k !== CONNECTION_EVICTOR_CREDS_KIND),
     ].filter((f) => f !== undefined);
     if (missing.length) {
         // Name the missing piece AND a repair that reaches it. The bundle has two halves with two
         // different repairs, and naming the wrong one costs an operator a full mesh stop for nothing.
         // The $SYS-signed half (observer, evictor) can only be minted while the never-persisted system
-        // signing seed is in memory, so it takes a rotation. The DATA half (rw cred, account id) is
-        // signed by the data account, whose seed IS persisted, so a plain `cotal up` heals it — that is
-        // what `healMembershipDataCreds` in `up` does, on every path rather than only a fresh space.
-        const down = missing.length === 1 && missing[0] === "membership-observer.creds"
-            ? "the $SYS observer cred is missing - re-mint it with `cotal down` then `cotal up --rotate-sys`"
-            // Name the remedy that matches the MISSING piece, because the two halves are repaired by
-            // different acts. The data half (`membership-rw.creds`, `membership.json`) is signed by the
-            // data account, whose seed is persisted, so a plain `cotal up` mints it. The $SYS half
-            // (observer, evictor) can only be re-minted while the never-persisted $SYS seed is in
-            // memory, which is a system-account rotation. Telling an operator to rotate when a plain
-            // `up` would do it sends them through a full mesh stop for nothing.
-            : `the membership bundle is incomplete here (missing ${missing.join(", ")}) - ${missing.every((m) => m === MEMBERSHIP_RW_CREDS_KEY || m === "membership.json")
-                ? "run `cotal up` to provision the data-account half (no rotation needed)"
-                : "the $SYS-signed creds can only be re-minted while the system account is being provisioned: `cotal down` then `cotal up --rotate-sys`"}`;
+        // signing seed is in memory, so it takes a rotation. The DATA half (the rw cred) is signed by
+        // the data account, whose seed IS persisted, so a plain `cotal up` heals it — that is what
+        // `healMembershipDataCreds` in `up` does, on every path rather than only a fresh space.
+        // Only the REPAIR tail forks on `injected`; this diagnosis half is identical in both.
+        const sysMissing = missing.filter((m) => m === MEMBERSHIP_OBSERVER_CREDS_KIND);
+        const down = missing.length === 1 && missing[0] === MEMBERSHIP_OBSERVER_CREDS_KIND
+            ? `the $SYS observer cred is missing (kind "${MEMBERSHIP_OBSERVER_CREDS_KIND}") - ${repairAdvice(source, sysMissing)}`
+            : `the membership bundle is incomplete here (missing ${missing.join(", ")}) - ${sysMissing.length === 0
+                ? source.injected
+                    ? `re-sign the data-account half into the store under ${rwKey} (no rotation needed)`
+                    : "run `cotal up` to provision the data-account half (no rotation needed)"
+                : `the $SYS-signed creds can only be re-minted while the system account is being provisioned: ${repairAdvice(source, sysMissing)}`}`;
         console.error(`• membership: ${down}. The graph falls back to traffic-only; delivery is unaffected.`);
         return { down };
     }
-    const accountId = JSON.parse(readFileSync(cfgPath, "utf8")).accountId;
-    if (!accountId) {
-        const down = ".cotal/membership.json has no accountId";
-        console.error(`• membership: ${down}; membership disabled (delivery unaffected)`);
-        return { down };
+    const obsCreds = sys.observer; // required above; absence already returned
+    // TENANCY, before connecting. The observer names its own DATA account in its CONNZ permission, so
+    // it can be checked against the account this daemon's own cred authenticates as with no adjacent
+    // file at all. The broker enforces the same scoping independently — this local read buys the
+    // DIAGNOSIS (a line naming both accounts) rather than the guarantee.
+    const tenancy = observerTenancyProblem(obsCreds, opts.accountId);
+    if (tenancy) {
+        console.error(`! membership: ${tenancy}; graph membership degraded, delivery unaffected`);
+        return { down: tenancy };
+    }
+    // A TORN rotation is the other way this cred goes broker-dead without a byte of its own changing:
+    // `rotateSystemCreds` commits the trust record, then writes both $SYS creds, so a crash between the
+    // two leaves one on the retired system account, and the broker answers the same bare
+    // "Authorization Violation" either way. Shared with the eviction path as of this change — it used
+    // to live only here, which left eviction opening a half-rotated pair blind.
+    if (sys.evictor !== undefined) {
+        const torn = tornRotationProblem(obsCreds, sys.evictor, () => repairAdvice(source, [MEMBERSHIP_OBSERVER_CREDS_KIND, CONNECTION_EVICTOR_CREDS_KIND]));
+        if (torn) {
+            console.error(`! membership: ${torn}; graph membership degraded, delivery unaffected`);
+            return { down: torn };
+        }
     }
     // Check the OBSERVER's own expiry before connecting. It is `rotation-renewed`, so unlike every
     // renewable cred here nothing re-signs it: at its 30-day horizon the broker simply answers
     // "Authorization Violation", which names neither the credential nor the repair. Reading the JWT
     // costs nothing and turns the daemon's one loud line into the actual diagnosis: the difference
     // between an operator finding this in minutes and finding it in a support thread.
-    const obsCreds = readFileSync(obsPath, "utf8");
-    // A TORN rotation is the other way this cred goes broker-dead without a byte of its own changing:
-    // `rotateSystemCreds` commits the trust record, then writes both $SYS creds, so a crash between the
-    // two leaves one file on the retired system account. The broker answers the same bare
-    // "Authorization Violation" either way. The daemon cannot ask the trust record which account is
-    // current (it deliberately never loads the signer), but it does not need to: the pair is written
-    // by one rotation, so two DIFFERENT issuers prove one of them is stale, with no signer read at all.
-    // (`doctor auth`, which legitimately holds the record, checks each file against it directly.)
-    const evPath = join(dir, "connection-evictor.creds");
-    if (existsSync(evPath)) {
-        let obsIss, evIss;
-        try {
-            obsIss = credsClaims(obsCreds).iss;
-            evIss = credsClaims(readFileSync(evPath, "utf8")).iss;
-        }
-        catch { /* an unreadable file is the health check's case just below */ }
-        if (obsIss !== undefined && evIss !== undefined && obsIss !== evIss) {
-            const down = `the two $SYS creds are signed by DIFFERENT system accounts (observer ${obsIss.slice(0, 12)}…, evictor ${evIss.slice(0, 12)}…) - a system-account rotation did not finish, so one of them is broker-dead: re-run \`cotal down\` then \`cotal up --rotate-sys\` to land a complete generation`;
-            console.error(`! membership: ${down}; graph membership degraded, delivery unaffected`);
-            return { down };
-        }
-    }
     const obs = inspectCredHealth(obsCreds);
     if (obs.state === "expired" || obs.state === "unreadable") {
         const down = obs.state === "expired"
-            ? `the $SYS observer cred (${obsPath}) EXPIRED ${new Date((obs.exp ?? 0) * 1000).toISOString()} and the broker denies it - it is rotation-renewed, so nothing re-signs it: run \`cotal down\` then \`cotal up --rotate-sys\` (agents, creds and data are untouched)`
-            : `the $SYS observer cred (${obsPath}) is unreadable (${obs.error})`;
+            ? `the $SYS observer cred (kind "${MEMBERSHIP_OBSERVER_CREDS_KIND}") EXPIRED ${new Date((obs.exp ?? 0) * 1000).toISOString()} and the broker denies it - it is rotation-renewed, so nothing re-signs it: ${repairAdvice(source, [MEMBERSHIP_OBSERVER_CREDS_KIND])} (agents, creds and data are untouched)`
+            : `the $SYS observer cred (kind "${MEMBERSHIP_OBSERVER_CREDS_KIND}") is unreadable (${obs.error})`;
         console.error(`! membership: ${down}; graph membership degraded, delivery unaffected`);
         return { down };
     }
@@ -80,16 +87,16 @@ export async function startMembership(opts, store) {
     const handle = await startMembershipFeed({
         servers: opts.server,
         space: opts.space,
-        accountId,
+        accountId: opts.accountId,
         // Observer is rotation-renewed ($SYS): a static read — its renewal is a system rotation + restart.
         observerCreds: obsCreds,
         // rw is class-2 standing-renewable: read through the store seam and renewed on a 75% timer that
         // preflight-proves each candidate the manager re-signs into the store (D5 slice 5). The daemon
         // never sees the signer; the manager owns the re-sign.
         rwCreds: async () => {
-            const cur = await secrets.get(MEMBERSHIP_RW_CREDS_KEY);
+            const cur = await source.secrets.get(rwKey);
             if (cur === undefined)
-                throw new Error(`membership: the scoped rw cred is gone (key "${MEMBERSHIP_RW_CREDS_KEY}") — restore it (locally: re-run \`cotal up\`) before the current JWT expires`);
+                throw new Error(`membership: the scoped rw cred is gone (kind "${MEMBERSHIP_RW_CREDS_KIND}") — restore it (locally: re-run \`cotal up\`) before the current JWT expires`);
             return cur;
         },
         intervalMs,

package/dist/membership.js.map

@@ -1 +1 @@
-{"version":3,"file":"membership.js","sourceRoot":"","sources":["../src/membership.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,mBAAmB,EAA+C,MAAM,gBAAgB,CAAC;AAClI,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AA4BnG,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAuC,EAAE,KAAmB;IAChG,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,KAAK,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAEpD,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG;QACd,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS;QACtD,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,2BAA2B;QAC7D,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB;KACpD,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,0FAA0F;QAC1F,8FAA8F;QAC9F,+FAA+F;QAC/F,4FAA4F;QAC5F,gGAAgG;QAChG,6FAA6F;QAC7F,MAAM,IAAI,GACR,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,2BAA2B;YAChE,CAAC,CAAC,+FAA+F;YACjG,yFAAyF;YACzF,4FAA4F;YAC5F,uFAAuF;YACvF,sFAAsF;YACtF,yFAAyF;YACzF,oEAAoE;YACpE,CAAC,CAAC,qDAAqD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OACrE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,uBAAuB,IAAI,CAAC,KAAK,iBAAiB,CAAC;gBAC5E,CAAC,CAAC,wEAAwE;gBAC1E,CAAC,CAAC,sIACN,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CAAC,iBAAiB,IAAI,iEAAiE,CAAC,CAAC;QACtG,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAA4B,CAAC,SAAS,CAAC;IAClG,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,yCAAyC,CAAC;QACvD,OAAO,CAAC,KAAK,CAAC,iBAAiB,IAAI,6CAA6C,CAAC,CAAC;QAClF,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IAED,+FAA+F;IAC/F,2FAA2F;IAC3F,gGAAgG;IAChG,+FAA+F;IAC/F,kFAAkF;IAClF,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/C,kGAAkG;IAClG,oGAAoG;IACpG,sFAAsF;IACtF,gGAAgG;IAChG,iGAAiG;IACjG,oGAAoG;IACpG,8FAA8F;IAC9F,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,IAAI,MAA0B,EAAE,KAAyB,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC;YACnC,KAAK,GAAG,WAAW,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC,CAAC,8DAA8D,CAAC,CAAC;QAC1E,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACpE,MAAM,IAAI,GAAG,wEAAwE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,kKAAkK,CAAC;YAC3S,OAAO,CAAC,KAAK,CAAC,iBAAiB,IAAI,kDAAkD,CAAC,CAAC;YACvF,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;QAC1D,MAAM,IAAI,GACR,GAAG,CAAC,KAAK,KAAK,SAAS;YACrB,CAAC,CAAC,2BAA2B,OAAO,aAAa,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,sKAAsK;YACpQ,CAAC,CAAC,2BAA2B,OAAO,oBAAoB,GAAG,CAAC,KAAK,GAAG,CAAC;QACzE,OAAO,CAAC,KAAK,CAAC,iBAAiB,IAAI,kDAAkD,CAAC,CAAC;QACvF,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,IAAI,SAAS,CAAC,CAAC,oBAAoB;IACtG,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACvC,OAAO,EAAE,IAAI,CAAC,MAAM;QACpB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS;QACT,mGAAmG;QACnG,aAAa,EAAE,QAAQ;QACvB,gGAAgG;QAChG,+FAA+F;QAC/F,uDAAuD;QACvD,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YACvD,IAAI,GAAG,KAAK,SAAS;gBACnB,MAAM,IAAI,KAAK,CAAC,gDAAgD,uBAAuB,+EAA+E,CAAC,CAAC;YAC1K,OAAO,GAAG,CAAC;QACb,CAAC;QACD,UAAU;KACX,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,oEAAoE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9F,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC"}
+{"version":3,"file":"membership.js","sourceRoot":"","sources":["../src/membership.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAA+C,MAAM,gBAAgB,CAAC;AACrH,OAAO,EAAE,6BAA6B,EAAE,aAAa,EAAE,oBAAoB,EAAE,8BAA8B,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACzL,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,YAAY,EAAE,mBAAmB,EAAuB,MAAM,gBAAgB,CAAC;AA2B7H,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAA0D,EAC1D,KAAmB;IAEnB,iGAAiG;IACjG,gGAAgG;IAChG,gGAAgG;IAChG,iGAAiG;IACjG,yFAAyF;IACzF,kGAAkG;IAClG,IAAI,MAAsB,CAAC;IAC3B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;QAC7B,MAAM,GAAG,EAAE,OAAO,EAAE,oBAAoB,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC7F,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjE,CAAC;IAED,iGAAiG;IACjG,+FAA+F;IAC/F,8FAA8F;IAC9F,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3C,8FAA8F;IAC9F,iGAAiG;IACjG,iEAAiE;IACjE,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG;QACd,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,SAAS;QACvD,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,6BAA6B,CAAC;KAClE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,0FAA0F;QAC1F,8FAA8F;QAC9F,+FAA+F;QAC/F,8FAA8F;QAC9F,2FAA2F;QAC3F,wFAAwF;QACxF,sFAAsF;QACtF,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,8BAA8B,CAAC,CAAC;QAC/E,MAAM,IAAI,GACR,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,8BAA8B;YACnE,CAAC,CAAC,4CAA4C,8BAA8B,QAAQ,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE;YACtH,CAAC,CAAC,qDAAqD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OACrE,UAAU,CAAC,MAAM,KAAK,CAAC;gBACrB,CAAC,CAAC,MAAM,CAAC,QAAQ;oBACf,CAAC,CAAC,sDAAsD,KAAK,uBAAuB;oBACpF,CAAC,CAAC,wEAAwE;gBAC5E,CAAC,CAAC,8FAA8F,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,EACpI,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CAAC,iBAAiB,IAAI,iEAAiE,CAAC,CAAC;QACtG,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAkB,CAAC,CAAC,2CAA2C;IAEpF,kGAAkG;IAClG,iGAAiG;IACjG,6FAA6F;IAC7F,qEAAqE;IACrE,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACjE,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,iBAAiB,OAAO,kDAAkD,CAAC,CAAC;QAC1F,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,kGAAkG;IAClG,oGAAoG;IACpG,qFAAqF;IACrF,kGAAkG;IAClG,4EAA4E;IAC5E,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,8BAA8B,EAAE,6BAA6B,CAAC,CAAC,CAAC,CAAC;QACrJ,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,KAAK,CAAC,iBAAiB,IAAI,kDAAkD,CAAC,CAAC;YACvF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IAED,+FAA+F;IAC/F,2FAA2F;IAC3F,gGAAgG;IAChG,+FAA+F;IAC/F,kFAAkF;IAClF,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;QAC1D,MAAM,IAAI,GACR,GAAG,CAAC,KAAK,KAAK,SAAS;YACrB,CAAC,CAAC,iCAAiC,8BAA8B,cAAc,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,+EAA+E,YAAY,CAAC,MAAM,EAAE,CAAC,8BAA8B,CAAC,CAAC,yCAAyC;YAC1S,CAAC,CAAC,iCAAiC,8BAA8B,qBAAqB,GAAG,CAAC,KAAK,GAAG,CAAC;QACvG,OAAO,CAAC,KAAK,CAAC,iBAAiB,IAAI,kDAAkD,CAAC,CAAC;QACvF,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,IAAI,SAAS,CAAC,CAAC,oBAAoB;IACtG,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACvC,OAAO,EAAE,IAAI,CAAC,MAAM;QACpB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,mGAAmG;QACnG,aAAa,EAAE,QAAQ;QACvB,gGAAgG;QAChG,+FAA+F;QAC/F,uDAAuD;QACvD,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,GAAG,KAAK,SAAS;gBACnB,MAAM,IAAI,KAAK,CAAC,iDAAiD,wBAAwB,+EAA+E,CAAC,CAAC;YAC5K,OAAO,GAAG,CAAC;QACb,CAAC;QACD,UAAU;KACX,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,oEAAoE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9F,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC"}

package/dist/sys-creds.d.ts

@@ -0,0 +1,139 @@
+import { type SecretStore } from "@cotal-ai/core";
+/**
+ * THE `$SYS` PAIR, read through the {@link SecretStore} seam and checked before it is used.
+ *
+ * Both consumers of the observer/evictor creds — the graph feed (`membership.ts`) and the
+ * eviction/liveness executors (`evict-exec.ts`) — resolve them here so the three checks that make a
+ * `$SYS` cred trustworthy cannot drift apart or exist on only one path:
+ *
+ *  1. TENANCY (the observer names its own account — {@link observerTenancyProblem});
+ *  2. TORN ROTATION (the pair was signed by ONE system account — {@link tornRotationProblem});
+ *  3. STORE-AWARE REPAIR (the advice names something the reader can actually do —
+ *     {@link repairAdvice}).
+ *
+ * Check 2 previously existed ONLY in the feed path, so the eviction path could open a half-rotated
+ * pair and get a bare "Authorization Violation" from the broker. Sharing it is the point of this
+ * module, not a side effect of it.
+ *
+ * This module DECIDES NOTHING ABOUT POSTURE. It reports problems as strings and absence as a list
+ * of missing keys; whether that is a fail-soft `down` (the feed) or a loud throw (eviction) belongs
+ * to the caller, because the two postures are deliberately different and flattening them here is
+ * exactly the refactor `docs/design/u3-membership-sys-injection.md` §4 exists to prevent.
+ */
+/** The `$SYS` creds' source: the store to read them from, the SPACE they are scoped to, and whether
+ *  that store was INJECTED. `injected` is the composition root's own fact (`store !== undefined` at
+ *  the runner) — never inferred by probing the store or sniffing `.cotal/`, both of which report
+ *  "workstation" for a hosted daemon and would emit CLI advice a host cannot run (design §4.1).
+ *
+ *  A UNION rather than a flag plus an optional root, because the workstation arm cannot do its job
+ *  without a root and the hosted arm has none: {@link repairAdvice} must ASK the root whether the
+ *  command it is about to name would run, and a `root?: string` would let a composition build a
+ *  workstation source with no root and silently fall back to advice nobody checked. Same idiom as
+ *  the rest of this module — the unsound call is made impossible to express rather than guarded
+ *  against at runtime. The two arms are exactly workspace's `SpaceMaterialComposition`, which is
+ *  what {@link loadSysPair} hands the per-kind resolvers.
+ *
+ *  `space` joined it in P7: the pair is per-space material now, so a source that named only a store
+ *  and a root no longer names a location. It is on BOTH arms because both need it — the workstation
+ *  arm to migrate and read, the hosted arm to build the key it tells an operator to `put` under. */
+export type SysCredsSource = {
+    secrets: SecretStore;
+    space: string;
+    injected: true;
+    root?: undefined;
+} | {
+    secrets: SecretStore;
+    space: string;
+    injected: false;
+    root: string;
+};
+/** Repair advice for missing/unusable `$SYS` material, in the reader's own idiom.
+ *
+ *  The DIAGNOSIS half (which key, which account) is identical in both compositions and is built by
+ *  the caller; only this repair TAIL forks. On a workstation the repair is a real command; against a
+ *  hosted store it is the mint window plus the key to `put` under, because `cotal up --rotate-sys`
+ *  is unactionable there — and emitting it into a hosted log degrades the diagnosis even when the
+ *  failure semantics are right. Both halves say the same true thing: the `$SYS` pair can only be
+ *  minted while the never-persisted system signing seed is in memory.
+ *
+ *  THERE IS A THIRD CASE, and until now this function could not see it: on a root hosting several
+ *  spaces the workstation advice names two verbs that BOTH refuse. `cotal up --rotate-sys` and
+ *  `cotal down` are broker-wide and `assertSingleSpaceBroker` turns them away naming the tenants,
+ *  so the operator whose observer is missing is handed a command, runs it, and is refused — with
+ *  the refusal itself explaining that the remedy does not exist yet. That is advice which cannot
+ *  succeed, the same defect `healMembershipDataCreds`'s own comment records, and it was reachable
+ *  on a real root (`docs/design/space-segmentation-p7-p1.md` §6, probe-executed).
+ *
+ *  So the workstation arm consults the guard before naming its command, and where the guard would
+ *  refuse it states the truth instead: the guard's own words, then the reason no other command can
+ *  substitute. NAMING NOTHING IS THE POINT — there is no verb to offer here, and inventing a
+ *  gentler-sounding one would restore the defect.
+ *
+ *  This makes the function read the filesystem on the workstation arm, which is why the callers
+ *  pass it as a THUNK: it is built only on a path that has already failed, never on a healthy one. */
+export declare function repairAdvice(source: SysCredsSource, kinds: readonly string[]): string;
+/** The DATA account an observer cred is scoped to, read out of its own `$SYS.REQ.ACCOUNT.<id>.CONNZ`
+ *  publish permission, or `undefined` if it carries none.
+ *
+ *  This is a LOCAL read of a signed document, and it buys the DIAGNOSIS, not the guarantee: the
+ *  broker independently refuses a CONNZ request for any other account, because the permission is in
+ *  the JWT it validates. Doing it here, before connecting, is what turns that refusal from a bare
+ *  "Authorization Violation" into a line naming both accounts (design §4.3). */
+export declare function connzAccountOf(observerCreds: string): string | undefined;
+/**
+ * THE TENANCY CHECK — the guard that replaces the eliminated `membership.json` cross-check.
+ *
+ * Every sweep below resolves an ACCOUNT, and a complete, well-formed sweep of the WRONG account is
+ * indistinguishable from "the principal is gone": a healthy-looking answer that authorizes eviction.
+ * Note the asymmetry that makes this necessary — an observer scoped to A used with accountId B
+ * under-reports (broker-denied → `unknown`, safe), but observer A used with accountId A while the
+ * GATE lives on B is internally consistent and answers a confident, WRONG `gone`.
+ *
+ * Checking the observer against the account the daemon's OWN cred authenticates as is strictly
+ * stronger than the file it replaces: the file sat in the same `.cotal/` dir as the creds, so a root
+ * that was wrong was wrong for both, and its independence came from `expectedAccount` being derived
+ * from the cred anyway. The cred was always the real authority; the file was the thing being checked.
+ *
+ * An observer carrying NO CONNZ permission is refused rather than trusted: it cannot do the job, and
+ * treating "no account named" as "any account" is the exact failure this guard exists to stop.
+ */
+export declare function observerTenancyProblem(observerCreds: string, expectedAccount: string): string | undefined;
+/**
+ * THE TORN-ROTATION CHECK — two `$SYS` creds signed by DIFFERENT system accounts.
+ *
+ * `rotateSystemCreds` commits the trust record, then writes both creds, so a crash between the two
+ * leaves one of them on the RETIRED system account. The broker answers the same bare "Authorization
+ * Violation" either way, and the daemon cannot ask the trust record which account is current (it
+ * deliberately never loads the signer) — but it does not need to: the pair is written by ONE
+ * rotation, so two different issuers prove one of them is stale, with no signer read at all.
+ *
+ * Shared by both paths as of this change. It previously lived only in the feed, which left eviction
+ * — the path that actually kills connections — opening a half-rotated pair blind.
+ *
+ * `advice` is a THUNK because {@link repairAdvice} now reads the root's tenant list: both call sites
+ * sit on a healthy path (`loadCheckedSys` runs per eviction), and eagerly building advice nobody
+ * will read would put a directory listing on every successful call.
+ */
+export declare function tornRotationProblem(observerCreds: string, evictorCreds: string, advice: () => string): string | undefined;
+/** What {@link loadSysPair} was asked for. The liveness verbs are READ-ONLY and must not even read
+ *  the KICK cred — least privilege is not only about what a connection may do, but about what the
+ *  process reads into memory on a path that never needs it. */
+export type SysCredsNeed = "observer" | "both";
+export interface SysPair {
+    observer?: string;
+    evictor?: string;
+    /** Keys the store returned `undefined` for — ABSENCE, per the `SecretStore` contract. A `get()`
+     *  that THROWS is a refusal, not an absence, and propagates out of {@link loadSysPair}. */
+    missing: string[];
+}
+/** Read the `$SYS` pair through the store. Absence is reported; every other failure propagates.
+ *
+ *  The distinction is load-bearing: `undefined` means "not provisioned here", which each caller
+ *  answers in its own posture, whereas a KMS timeout or a revoked role is a REFUSAL that must not be
+ *  mistaken for an unprovisioned space and quietly degraded into deny-new-only.
+ *
+ *  Reading per call (rather than once at start) is strictly better than the `readFileSync` it
+ *  replaces: a hosted store re-keyed by a rotation is picked up on the next eviction with no daemon
+ *  restart. No renewal timer is added, and none is wanted — these stay `rotation-renewed`. */
+export declare function loadSysPair(source: SysCredsSource, need: SysCredsNeed): Promise<SysPair>;
+//# sourceMappingURL=sys-creds.d.ts.map

package/dist/sys-creds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sys-creds.d.ts","sourceRoot":"","sources":["../src/sys-creds.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAM/D;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;;;;;;;;;;;;oGAeoG;AACpG,MAAM,MAAM,cAAc,GACtB;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,CAAA;CAAE,GACzE;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAsB3E;;;;;;;;;;;;;;;;;;;;;;;sGAuBsG;AACtG,wBAAgB,YAAY,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAgBrF;AAED;;;;;;gFAMgF;AAChF,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMxE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAezG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,MAAM,GAAG,MAAM,GAAG,SAAS,CAazH;AAED;;+DAE+D;AAC/D,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,MAAM,CAAC;AAE/C,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;+FAC2F;IAC3F,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;;;8FAQ8F;AAC9F,wBAAsB,WAAW,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAgB9F"}

package/dist/sys-creds.js

@@ -0,0 +1,163 @@
+import { credsClaims } from "@cotal-ai/core";
+import { assertSingleSpaceBroker, authDir, connectionEvictorCredsKey, CONNECTION_EVICTOR_CREDS_KIND, membershipObserverCredsKey, MEMBERSHIP_OBSERVER_CREDS_KIND, segmentedKey, } from "@cotal-ai/workspace";
+/** The broker-wide operation `repairAdvice` would send a workstation operator to, phrased so the
+ *  guard's own refusal reads as a sentence when it is quoted back. */
+const ROTATE_SYS = "re-minting the $SYS pair (`cotal up --rotate-sys`)";
+/** Why the rotation would refuse on this root, or `undefined` if it would run.
+ *
+ *  ASKED OF THE GUARD ITSELF, never re-derived from a tenant count read here. The advice is only
+ *  honest if it agrees with the thing that actually refuses, and a second implementation of the
+ *  single-space rule is a second thing to drift. Every throw counts as a refusal, including the
+ *  fail-CLOSED corrupt-inventory one: an operator sent to a command that refuses for a reason this
+ *  function could not read is in exactly the state this check exists to end. */
+function rotationRefusal(root) {
+    try {
+        assertSingleSpaceBroker(authDir(root), ROTATE_SYS);
+        return undefined;
+    }
+    catch (e) {
+        return e.message;
+    }
+}
+/** Repair advice for missing/unusable `$SYS` material, in the reader's own idiom.
+ *
+ *  The DIAGNOSIS half (which key, which account) is identical in both compositions and is built by
+ *  the caller; only this repair TAIL forks. On a workstation the repair is a real command; against a
+ *  hosted store it is the mint window plus the key to `put` under, because `cotal up --rotate-sys`
+ *  is unactionable there — and emitting it into a hosted log degrades the diagnosis even when the
+ *  failure semantics are right. Both halves say the same true thing: the `$SYS` pair can only be
+ *  minted while the never-persisted system signing seed is in memory.
+ *
+ *  THERE IS A THIRD CASE, and until now this function could not see it: on a root hosting several
+ *  spaces the workstation advice names two verbs that BOTH refuse. `cotal up --rotate-sys` and
+ *  `cotal down` are broker-wide and `assertSingleSpaceBroker` turns them away naming the tenants,
+ *  so the operator whose observer is missing is handed a command, runs it, and is refused — with
+ *  the refusal itself explaining that the remedy does not exist yet. That is advice which cannot
+ *  succeed, the same defect `healMembershipDataCreds`'s own comment records, and it was reachable
+ *  on a real root (`docs/design/space-segmentation-p7-p1.md` §6, probe-executed).
+ *
+ *  So the workstation arm consults the guard before naming its command, and where the guard would
+ *  refuse it states the truth instead: the guard's own words, then the reason no other command can
+ *  substitute. NAMING NOTHING IS THE POINT — there is no verb to offer here, and inventing a
+ *  gentler-sounding one would restore the defect.
+ *
+ *  This makes the function read the filesystem on the workstation arm, which is why the callers
+ *  pass it as a THUNK: it is built only on a path that has already failed, never on a healthy one. */
+export function repairAdvice(source, kinds) {
+    const named = kinds.length ? kinds.join(" + ") : "the $SYS pair";
+    // The hosted arm names a KEY to `put` under, so it must name the SEGMENTED one — the kind alone is
+    // the pre-P7 key and putting there would leave the daemon still reading an empty location. The
+    // workstation arm names a command, not a key, so it keeps the kinds an operator recognises.
+    // Non-migrating on purpose: this builds a STRING for a store the process cannot reach.
+    if (source.injected)
+        return `re-mint the $SYS pair at a system-account rotation (the seed is in memory only at that moment) and \`put\` it under ${kinds.length ? kinds.map((k) => segmentedKey(k, source.space)).join(" + ") : "the $SYS pair's per-space keys"}`;
+    const refusal = rotationRefusal(source.root);
+    if (refusal === undefined)
+        return "re-mint it with `cotal down` then `cotal up --rotate-sys`";
+    return (`${refusal}. There is no other command that mints ${named}: the $SYS signing seed is discarded at provisioning, ` +
+        "so nothing can re-sign it on this root until per-space segmentation lands");
+}
+/** The DATA account an observer cred is scoped to, read out of its own `$SYS.REQ.ACCOUNT.<id>.CONNZ`
+ *  publish permission, or `undefined` if it carries none.
+ *
+ *  This is a LOCAL read of a signed document, and it buys the DIAGNOSIS, not the guarantee: the
+ *  broker independently refuses a CONNZ request for any other account, because the permission is in
+ *  the JWT it validates. Doing it here, before connecting, is what turns that refusal from a bare
+ *  "Authorization Violation" into a line naming both accounts (design §4.3). */
+export function connzAccountOf(observerCreds) {
+    for (const subject of credsClaims(observerCreds).nats?.pub?.allow ?? []) {
+        const m = /^\$SYS\.REQ\.ACCOUNT\.(A[A-Z2-7]{55})\.CONNZ$/.exec(subject);
+        if (m)
+            return m[1];
+    }
+    return undefined;
+}
+/**
+ * THE TENANCY CHECK — the guard that replaces the eliminated `membership.json` cross-check.
+ *
+ * Every sweep below resolves an ACCOUNT, and a complete, well-formed sweep of the WRONG account is
+ * indistinguishable from "the principal is gone": a healthy-looking answer that authorizes eviction.
+ * Note the asymmetry that makes this necessary — an observer scoped to A used with accountId B
+ * under-reports (broker-denied → `unknown`, safe), but observer A used with accountId A while the
+ * GATE lives on B is internally consistent and answers a confident, WRONG `gone`.
+ *
+ * Checking the observer against the account the daemon's OWN cred authenticates as is strictly
+ * stronger than the file it replaces: the file sat in the same `.cotal/` dir as the creds, so a root
+ * that was wrong was wrong for both, and its independence came from `expectedAccount` being derived
+ * from the cred anyway. The cred was always the real authority; the file was the thing being checked.
+ *
+ * An observer carrying NO CONNZ permission is refused rather than trusted: it cannot do the job, and
+ * treating "no account named" as "any account" is the exact failure this guard exists to stop.
+ */
+export function observerTenancyProblem(observerCreds, expectedAccount) {
+    let scoped;
+    try {
+        scoped = connzAccountOf(observerCreds);
+    }
+    catch (e) {
+        return `the $SYS observer cred is unreadable (${e.message})`;
+    }
+    if (scoped === undefined)
+        return "the $SYS observer cred carries no `$SYS.REQ.ACCOUNT.<id>.CONNZ` permission, so it names no account to sweep and cannot be checked against this daemon's own tenancy";
+    if (scoped !== expectedAccount)
+        return (`the $SYS observer cred is scoped to account ${scoped}, but this daemon's own credential authenticates as ${expectedAccount}. ` +
+            "That credential belongs to a different mesh, and sweeping it would return a confident, WRONG answer (a complete sweep of the wrong account is indistinguishable from a gone principal)");
+    return undefined;
+}
+/**
+ * THE TORN-ROTATION CHECK — two `$SYS` creds signed by DIFFERENT system accounts.
+ *
+ * `rotateSystemCreds` commits the trust record, then writes both creds, so a crash between the two
+ * leaves one of them on the RETIRED system account. The broker answers the same bare "Authorization
+ * Violation" either way, and the daemon cannot ask the trust record which account is current (it
+ * deliberately never loads the signer) — but it does not need to: the pair is written by ONE
+ * rotation, so two different issuers prove one of them is stale, with no signer read at all.
+ *
+ * Shared by both paths as of this change. It previously lived only in the feed, which left eviction
+ * — the path that actually kills connections — opening a half-rotated pair blind.
+ *
+ * `advice` is a THUNK because {@link repairAdvice} now reads the root's tenant list: both call sites
+ * sit on a healthy path (`loadCheckedSys` runs per eviction), and eagerly building advice nobody
+ * will read would put a directory listing on every successful call.
+ */
+export function tornRotationProblem(observerCreds, evictorCreds, advice) {
+    let obsIss, evIss;
+    try {
+        obsIss = credsClaims(observerCreds).iss;
+        evIss = credsClaims(evictorCreds).iss;
+    }
+    catch {
+        return undefined; // an undecodable cred is the health check's case, reported with its own message
+    }
+    if (obsIss === undefined || evIss === undefined || obsIss === evIss)
+        return undefined;
+    return (`the two $SYS creds are signed by DIFFERENT system accounts (observer ${obsIss.slice(0, 12)}…, evictor ${evIss.slice(0, 12)}…) - ` +
+        `a system-account rotation did not finish, so one of them is broker-dead: ${advice()} to land a complete generation`);
+}
+/** Read the `$SYS` pair through the store. Absence is reported; every other failure propagates.
+ *
+ *  The distinction is load-bearing: `undefined` means "not provisioned here", which each caller
+ *  answers in its own posture, whereas a KMS timeout or a revoked role is a REFUSAL that must not be
+ *  mistaken for an unprovisioned space and quietly degraded into deny-new-only.
+ *
+ *  Reading per call (rather than once at start) is strictly better than the `readFileSync` it
+ *  replaces: a hosted store re-keyed by a rotation is picked up on the next eviction with no daemon
+ *  restart. No renewal timer is added, and none is wanted — these stay `rotation-renewed`. */
+export async function loadSysPair(source, need) {
+    // The per-kind RESOLVERS (P7 §2 rule 1). The source's two arms ARE the composition they take, so
+    // a workstation daemon moves a legacy flat pair on this first touch and a hosted one never
+    // touches a filesystem. Reading the canonical location WITHOUT that move is the failure the
+    // resolver exists to stop: it answers `undefined`, which every caller here treats as "not
+    // provisioned", and sends an operator to a rotation for creds that are sitting on the same disk.
+    const observer = await source.secrets.get(membershipObserverCredsKey(source.space, source));
+    const evictor = need === "both" ? await source.secrets.get(connectionEvictorCredsKey(source.space, source)) : undefined;
+    // Reported as KINDS, never the segmented keys: `missing` is read by operators and compared
+    // against by callers (`membership.ts` filters the evictor out of its own diagnosis by name), and
+    // a `space.<hex>/` prefix would break both. The hosted arm's `put` key is named by `repairAdvice`.
+    const missing = [
+        observer === undefined ? MEMBERSHIP_OBSERVER_CREDS_KIND : undefined,
+        need === "both" && evictor === undefined ? CONNECTION_EVICTOR_CREDS_KIND : undefined,
+    ].filter((k) => k !== undefined);
+    return { ...(observer !== undefined ? { observer } : {}), ...(evictor !== undefined ? { evictor } : {}), missing };
+}
+//# sourceMappingURL=sys-creds.js.map

package/dist/sys-creds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sys-creds.js","sourceRoot":"","sources":["../src/sys-creds.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAoB,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EACL,uBAAuB,EAAE,OAAO,EAAE,yBAAyB,EAAE,6BAA6B,EAC1F,0BAA0B,EAAE,8BAA8B,EAAE,YAAY,GACzE,MAAM,qBAAqB,CAAC;AA4C7B;sEACsE;AACtE,MAAM,UAAU,GAAG,oDAAoD,CAAC;AAExE;;;;;;gFAMgF;AAChF,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC;QACnD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAQ,CAAW,CAAC,OAAO,CAAC;IAC9B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;sGAuBsG;AACtG,MAAM,UAAU,YAAY,CAAC,MAAsB,EAAE,KAAwB;IAC3E,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;IACjE,mGAAmG;IACnG,+FAA+F;IAC/F,4FAA4F;IAC5F,uFAAuF;IACvF,IAAI,MAAM,CAAC,QAAQ;QACjB,OAAO,uHACL,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,gCAC/E,EAAE,CAAC;IACL,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,2DAA2D,CAAC;IAC9F,OAAO,CACL,GAAG,OAAO,0CAA0C,KAAK,wDAAwD;QACjH,2EAA2E,CAC5E,CAAC;AACJ,CAAC;AAED;;;;;;gFAMgF;AAChF,MAAM,UAAU,cAAc,CAAC,aAAqB;IAClD,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QACxE,MAAM,CAAC,GAAG,+CAA+C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,aAAqB,EAAE,eAAuB;IACnF,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,yCAA0C,CAAW,CAAC,OAAO,GAAG,CAAC;IAC1E,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QACtB,OAAO,qKAAqK,CAAC;IAC/K,IAAI,MAAM,KAAK,eAAe;QAC5B,OAAO,CACL,+CAA+C,MAAM,uDAAuD,eAAe,IAAI;YAC/H,wLAAwL,CACzL,CAAC;IACJ,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CAAC,aAAqB,EAAE,YAAoB,EAAE,MAAoB;IACnG,IAAI,MAA0B,EAAE,KAAyB,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC;QACxC,KAAK,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,gFAAgF;IACpG,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IACtF,OAAO,CACL,wEAAwE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO;QAClI,4EAA4E,MAAM,EAAE,gCAAgC,CACrH,CAAC;AACJ,CAAC;AAeD;;;;;;;;8FAQ8F;AAC9F,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAsB,EAAE,IAAkB;IAC1E,iGAAiG;IACjG,2FAA2F;IAC3F,4FAA4F;IAC5F,0FAA0F;IAC1F,iGAAiG;IACjG,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxH,2FAA2F;IAC3F,iGAAiG;IACjG,mGAAmG;IACnG,MAAM,OAAO,GAAG;QACd,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,SAAS;QACnE,IAAI,KAAK,MAAM,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,SAAS;KACrF,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAC9C,OAAO,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;AACrH,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cotal-ai/delivery",
   "description": "Cotal delivery daemon: the server-side Plane-3 durable backstop (fan-out writer + trusted reader + membership/ACL authority), a scoped least-privilege NATS client co-located with the broker.",
-  "version": "0.34.0",
+  "version": "0.36.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -18,8 +18,8 @@
     }
   },
   "dependencies": {
-    "@cotal-ai/core": "0.34.0",
-    "@cotal-ai/workspace": "0.34.0"
+    "@cotal-ai/core": "0.36.0",
+    "@cotal-ai/workspace": "0.36.0"
   },
   "files": [
     "dist"