@cotal-ai/delivery 0.35.0 → 0.37.0

package/dist/delivery.d.ts

@@ -1,10 +1,11 @@
 import { type ParsedArgs, type SecretStore } from "@cotal-ai/core";
-import { DELIVERY_CREDS_KEY } from "@cotal-ai/workspace";
-/** Re-exported for hosted compositions: the {@link SecretStore} key a store injected into
- *  {@link runDelivery} must hold the cred under. Defined once in workspace (the key↔filename
- *  convention is the workspace layout's) so the writer, the renewal owner, and this reader can
- *  never drift apart. */
-export { DELIVERY_CREDS_KEY };
+import { DELIVERY_CREDS_KIND, deliveryCredsKey } from "@cotal-ai/workspace";
+/** Re-exported for hosted compositions: the daemon cred's KIND, and the builder that turns it into
+ *  the {@link SecretStore} key for a space. Defined once in workspace (the layout is the workspace's)
+ *  so the writer, the renewal owner, and this reader can never drift apart. As of P7 the kind is NOT
+ *  the key — the key is per-space — so a hosted store must be keyed with the builder; the flat kind
+ *  is the pre-P7 key and putting there leaves this daemon reading an empty location. */
+export { DELIVERY_CREDS_KIND, deliveryCredsKey };
 /**
  * Run the delivery daemon: the server-side Plane-3 durable backstop. A thin composition root that
  * builds a scoped `delivery` endpoint, acquires the single-flight lease, and runs the existing
@@ -16,8 +17,10 @@ export { DELIVERY_CREDS_KEY };
  *
  * `store` is the hosted-composition seam: a closed composition root calls this export directly and
  * injects its own {@link SecretStore} (KMS/Vault…) holding the daemon cred under
- * {@link DELIVERY_CREDS_KEY} AND the membership feed's rw cred under `membership-rw.creds`; the
- * registered `deliver` command passes none and gets the workstation FS store (or `--creds`). The
+ * {@link deliveryCredsKey}`(space, …)` AND the membership feed's rw cred under the matching
+ * `membership-rw.creds` key — both PER-SPACE as of P7, so the bare kinds are the pre-P7 spelling and
+ * are not read; the registered `deliver` command passes none and gets the workstation FS store (or
+ * `--creds`). The
  * renewal owner's write side (`remintDaemonCreds`) is threaded through the manager's
  * `ManagerOptions.secretStore` too, so a hosted composition renews both daemon kinds end-to-end when
  * the manager and this daemon are handed the SAME store.

package/dist/delivery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delivery.d.ts","sourceRoot":"","sources":["../src/delivery.ts"],"names":[],"mappings":"AACA,OAAO,EAWL,KAAK,UAAU,EACf,KAAK,WAAW,EACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAA2F,MAAM,qBAAqB,CAAC;AAMlJ;;;yBAGyB;AACzB,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAuF9B;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA8LtF"}
+{"version":3,"file":"delivery.d.ts","sourceRoot":"","sources":["../src/delivery.ts"],"names":[],"mappings":"AACA,OAAO,EAWL,KAAK,UAAU,EACf,KAAK,WAAW,EACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAA0B,gBAAgB,EAAiF,MAAM,qBAAqB,CAAC;AAMnL;;;;wFAIwF;AACxF,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,CAAC;AA0GjD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA6NtF"}

package/dist/delivery.js

@@ -1,34 +1,54 @@
 import { basename, dirname, join, resolve } from "node:path";
 import { CotalEndpoint, DEFAULT_SERVER, LEASE_TTL_MS, accountFromCreds, credsClaims, idFromCreds, isReachable, mintCreds, newIdentity, } from "@cotal-ai/core";
-import { DELIVERY_CREDS_KEY, FsSecretStore, authDir, findCotalRoot, loadSpaceAuth, soleSpaceOf, workspaceSecretStore } from "@cotal-ai/workspace";
+import { DELIVERY_CREDS_KIND, FsSecretStore, authDir, deliveryCredsKey, findCotalRoot, loadSpaceAuth, segmentedKey, soleSpaceOf, workspaceSecretStore } from "@cotal-ai/workspace";
 import { startMembership } from "./membership.js";
-import { executeEviction, executePlaneLiveness, executePrincipalLiveness } from "./evict-exec.js";
-/** Re-exported for hosted compositions: the {@link SecretStore} key a store injected into
- *  {@link runDelivery} must hold the cred under. Defined once in workspace (the key↔filename
- *  convention is the workspace layout's) so the writer, the renewal owner, and this reader can
- *  never drift apart. */
-export { DELIVERY_CREDS_KEY };
-/** Where the daemon's pre-minted cred lives — exactly ONE source, resolved up front: an injected
- *  {@link SecretStore} (a hosted composition), an explicit `--creds <file>` (e.g. a read-only
- *  container mount) as an FS store over that exact file, or the default workstation location.
- *  With an injected store the store is the ONLY credential source: every local-source flag
- *  (`--creds`, `--dev-mint`) is rejected loudly at this boundary — and it runs BEFORE any ambient
- *  read in `runDelivery` — so a hosted composition can never cross back into workstation trust
- *  material (a creds file, the local signer), not even for a space label. `where` is the human
- *  label used in error messages so a local operator still sees a path, not an abstract key. */
-function resolveCredsStore(v, injected) {
+import { executeEviction, executePlaneLiveness, executePrincipalLiveness, validateScanTargetAdmission } from "./evict-exec.js";
+/** Re-exported for hosted compositions: the daemon cred's KIND, and the builder that turns it into
+ *  the {@link SecretStore} key for a space. Defined once in workspace (the layout is the workspace's)
+ *  so the writer, the renewal owner, and this reader can never drift apart. As of P7 the kind is NOT
+ *  the key — the key is per-space — so a hosted store must be keyed with the builder; the flat kind
+ *  is the pre-P7 key and putting there leaves this daemon reading an empty location. */
+export { DELIVERY_CREDS_KIND, deliveryCredsKey };
+/**
+ * THE ORDERING-CRITICAL HALF of the cred-source decision, split out so it cannot drift below the
+ * ambient reads. With an injected store the store is the ONLY credential source: every local-source
+ * flag (`--creds`, `--dev-mint`) is rejected loudly HERE, before `runDelivery` derives a space —
+ * because that derivation itself reads the local signer under `--dev-mint`. A hosted composition
+ * must never cross back into workstation trust material, not even for a space label, and the space
+ * is now an INPUT to the key, which is exactly the pressure that would otherwise pull the
+ * derivation above this check.
+ */
+function assertNoLocalCredSourceFlags(v, injected) {
+    if (!injected)
+        return;
+    const local = ["creds", "dev-mint"].filter((f) => v[f] !== undefined);
+    if (local.length)
+        throw new Error(`delivery: ${local.map((f) => `--${f}`).join(" and ")} cannot be combined with an injected secret store — the store is the cred's only source`);
+}
+/** Where the daemon's pre-minted cred lives — exactly ONE source: an injected {@link SecretStore}
+ *  (a hosted composition), an explicit `--creds <file>` (e.g. a read-only container mount) as an FS
+ *  store over that exact file, or the default workstation location. `where` is the human label used
+ *  in error messages so a local operator still sees a path, not an abstract key.
+ *
+ *  Called AFTER {@link assertNoLocalCredSourceFlags} has settled the injected/local conflict, which
+ *  is what lets it take the derived `space`. The workstation arm goes through the per-kind RESOLVER:
+ *  it is the reader whose "absent" answer sends `ensureDelivery` off to mint, so reading the
+ *  canonical location past an unmigrated cred is how a root ends up with two live delivery creds.
+ *  The injected arm builds the key without touching a filesystem it does not have. `--creds` names
+ *  ONE file and is per-space by the operator's own choice of path, so it is neither segmented nor
+ *  migrated — the store there is rooted at that file's own directory. */
+function resolveCredsStore(v, space, injected) {
     if (injected) {
-        const local = ["creds", "dev-mint"].filter((f) => v[f] !== undefined);
-        if (local.length)
-            throw new Error(`delivery: ${local.map((f) => `--${f}`).join(" and ")} cannot be combined with an injected secret store — the store is the cred's only source`);
-        return { store: injected, key: DELIVERY_CREDS_KEY, where: `secret-store key "${DELIVERY_CREDS_KEY}"`, injected: true };
+        const key = segmentedKey(DELIVERY_CREDS_KIND, space);
+        return { store: injected, key, where: `secret-store key "${key}"`, injected: true };
     }
     if (v.creds !== undefined) {
         const p = resolve(v.creds);
         return { store: new FsSecretStore(dirname(p)), key: basename(p), where: p, injected: false };
     }
     const root = findCotalRoot();
-    return { store: workspaceSecretStore(root), key: DELIVERY_CREDS_KEY, where: join(root, ".cotal", DELIVERY_CREDS_KEY), injected: false };
+    const key = deliveryCredsKey(space, { injected: false, root });
+    return { store: workspaceSecretStore(root), key, where: join(root, ".cotal", key), injected: false };
 }
 /** The daemon's scoped `delivery` creds — the PRODUCTION path reads a PRE-MINTED cred through the
  *  {@link SecretStore} seam ({@link resolveCredsStore}; locally the CLI's `ensureDelivery` setup helper
@@ -68,7 +88,7 @@ async function loadDeliveryCreds(src, v) {
         };
     }
     if (src.injected)
-        throw new Error(`delivery: no cred in the injected secret store under key "${DELIVERY_CREDS_KEY}" — the hosted composition must put it before starting the daemon (local sources are never consulted when a store is injected)`);
+        throw new Error(`delivery: no cred in the injected secret store under key "${key}" — the hosted composition must put it before starting the daemon (local sources are never consulted when a store is injected). The key is PER-SPACE as of P7; a cred put under the bare kind "${DELIVERY_CREDS_KIND}" is not read here.`);
     if (v["dev-mint"] !== undefined) {
         // Space-blind dev path: the root must name exactly one space (soleSpaceOf fails loud on several).
         const devRoot = authDir(findCotalRoot());
@@ -95,8 +115,10 @@ async function loadDeliveryCreds(src, v) {
  *
  * `store` is the hosted-composition seam: a closed composition root calls this export directly and
  * injects its own {@link SecretStore} (KMS/Vault…) holding the daemon cred under
- * {@link DELIVERY_CREDS_KEY} AND the membership feed's rw cred under `membership-rw.creds`; the
- * registered `deliver` command passes none and gets the workstation FS store (or `--creds`). The
+ * {@link deliveryCredsKey}`(space, …)` AND the membership feed's rw cred under the matching
+ * `membership-rw.creds` key — both PER-SPACE as of P7, so the bare kinds are the pre-P7 spelling and
+ * are not read; the registered `deliver` command passes none and gets the workstation FS store (or
+ * `--creds`). The
  * renewal owner's write side (`remintDaemonCreds`) is threaded through the manager's
  * `ManagerOptions.secretStore` too, so a hosted composition renews both daemon kinds end-to-end when
  * the manager and this daemon are handed the SAME store.
@@ -108,13 +130,16 @@ export async function runDelivery(args, store) {
     if (shards !== 1 || shard !== 0)
         throw new Error(`delivery: sharded operation is not supported (N=1 only; got shard=${shard} shards=${shards}). ` +
             "The partition() seam ships but operating shards>1 needs the channel-prefix grammar — see core-sub-fabric.md.");
-    // Resolve the cred source FIRST — before the ambient space derivation below — so an injected
-    // store rejects local-source flags before anything can read the workstation signer.
-    const credsSrc = resolveCredsStore(v, store);
+    // Reject local-source flags FIRST — before the ambient space derivation below — so an injected
+    // store can never reach the workstation signer. The cred KEY is per-space as of P7, so resolving
+    // the source now needs the space that this check must precede; the check is therefore split out
+    // and stays here, ahead of everything ambient.
+    assertNoLocalCredSourceFlags(v, store);
     // Space comes from --space (the CLI passes it). Only --dev-mint may derive it from the local signer.
     const space = v.space ?? (v["dev-mint"] !== undefined ? soleSpaceOf(authDir(findCotalRoot())) : undefined);
     if (!space)
         throw new Error("delivery: --space is required (the scoped creds file does not encode it)");
+    const credsSrc = resolveCredsStore(v, space, store);
     const server = v.server ?? DEFAULT_SERVER;
     const creds = await loadDeliveryCreds(credsSrc, v); // pre-minted scoped cred; NO signer/loadSpaceAuth in this path
     let latestCreds = creds.initial; // freshest renewal — the broker-reachability poll below presents it
@@ -133,10 +158,26 @@ export async function runDelivery(args, store) {
     // of the WRONG account is indistinguishable from "the principal is gone" — a healthy-looking
     // answer that authorizes eviction and gate reconciliation. Resolving the root per request from
     // `process.cwd()` let that drift; and a daemon started in a foreign mesh root would sweep a
-    // foreign tenant while looking entirely well. So: the root is fixed at start, and the account on
-    // disk is cross-checked against the account this daemon's OWN credential authenticates as — a
-    // fact that does not come from that root, which is what makes it an independent check.
-    const scanTarget = { root: findCotalRoot(), expectedAccount: accountFromCreds(creds.initial) };
+    // foreign tenant while looking entirely well. So: the root is fixed at start, and the OBSERVER
+    // CRED is cross-checked against the account this daemon's OWN credential authenticates as — two
+    // facts, neither of which comes from that root, which is what makes it an independent check.
+    // The $SYS pair resolves through the SAME injected store, so a hosted composition needs no
+    // `.cotal/` file for it. `injected` is this composition root's own fact — recorded here, where it
+    // is known for certain, rather than inferred later by probing the store or sniffing the
+    // filesystem, both of which report "workstation" for a hosted daemon and would emit a CLI repair
+    // the host cannot run. It selects the REPAIR IDIOM only; failure semantics never fork on it.
+    const scanRoot = findCotalRoot();
+    const scanTarget = {
+        root: scanRoot,
+        expectedAccount: accountFromCreds(creds.initial),
+        source: store === undefined
+            ? { secrets: workspaceSecretStore(scanRoot), space, injected: false, root: scanRoot }
+            : { secrets: store, space, injected: true },
+    };
+    // The singleton lease is admission to serve this space, so the daemon must prove its scan tenancy
+    // before it can claim that slot. A wrong-root process previously acquired and renewed lease.0,
+    // then refused every admin-rail request on the account mismatch while blocking the valid daemon.
+    await validateScanTargetAdmission(scanTarget);
     console.error(`• delivery: $SYS sweeps bound to ${join(scanTarget.root, ".cotal")} (account ${scanTarget.expectedAccount})`);
     const ep = new CotalEndpoint({
         space,
@@ -152,7 +193,13 @@ export async function runDelivery(args, store) {
         registerPresence: false, // … but NEVER publish the daemon onto the roster (it's infra, not a peer)
         card: { id: idFromCreds(creds.initial), name: "delivery", role: "delivery", kind: "endpoint" },
     });
-    ep.on("error", (e) => console.error(`! delivery endpoint: ${e.message}`));
+    // Both channels: raw connection errors ride `error`, while every condition the endpoint is
+    // already surviving — a failed 75% renewal, the passive backstop's "still holds the previous
+    // cred" repair line — rides `warning` (#891). An operator who only sees the first watches the
+    // daemon go silent and then die at `exp` with no word of the remint it was waiting for.
+    const say = (e) => console.error(`! delivery endpoint: ${e.message}`);
+    ep.on("error", say);
+    ep.on("warning", say);
     await ep.start();
     // Acquire the single-flight lease BEFORE binding the loops: a loud refusal-to-bind if another daemon
     // already holds this shard (two clients binding the same durable name SPLIT delivery). The bucket TTL
@@ -218,7 +265,10 @@ export async function runDelivery(args, store) {
         // an arbitrary `--creds` path, whereas membership-rw lives under the workstation `.cotal/` key. With
         // no injected store, startMembership falls back to the workstation FS store.
         // Fail-soft, but never fault-FORGETFUL: whichever way the feed fails to come up, keep the reason.
-        ({ handle: membership, down: membershipDown } = await startMembership({ space, server }, store));
+        // `accountId` is the account THIS daemon's own cred authenticates as (pinned above), not a
+        // `.cotal/membership.json` read: the file was never an independent source (same directory as the
+        // creds, so a wrong root was wrong for both) and a hosted composition has none.
+        ({ handle: membership, down: membershipDown } = await startMembership({ space, server, accountId: scanTarget.expectedAccount }, store));
     }
     catch (e) {
         membershipDown = e.message;

package/dist/delivery.js.map

@@ -1 +1 @@
-{"version":3,"file":"delivery.js","sourceRoot":"","sources":["../src/delivery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACL,aAAa,EACb,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,WAAW,EACX,SAAS,EACT,WAAW,GAIZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAClJ,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,wBAAwB,EAAmB,MAAM,iBAAiB,CAAC;AAInH;;;yBAGyB;AACzB,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAI9B;;;;;;;+FAO+F;AAC/F,SAAS,iBAAiB,CAAC,CAAS,EAAE,QAAsB;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QACtE,IAAI,KAAK,CAAC,MAAM;YACd,MAAM,IAAI,KAAK,CACb,aAAa,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,yFAAyF,CAC/I,CAAC;QACJ,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,qBAAqB,kBAAkB,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACzH,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC/F,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,OAAO,EAAE,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC1I,CAAC;AAED;;;;;;;;;;gBAUgB;AAChB,KAAK,UAAU,iBAAiB,CAAC,GAAgB,EAAE,CAAS;IAC1D,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,IAAwB,CAAC,CAAC,8DAA8D;QAC5F,OAAO;YACL,OAAO;YACP,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,OAAO,KAAK,SAAS;oBACvB,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,8EAA8E,CAAC,CAAC;gBACtJ,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBAC3C,uFAAuF;oBACvF,kFAAkF;oBAClF,wFAAwF;oBACxF,iFAAiF;oBACjF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;oBAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC;wBAAE,OAAO,OAAO,CAAC;oBACvH,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kNAAkN,CAAC,CAAC;gBAC9O,CAAC;gBACD,IAAI,GAAG,OAAO,CAAC;gBACf,OAAO,OAAO,CAAC;YACjB,CAAC;SACF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ;QACd,MAAM,IAAI,KAAK,CACb,6DAA6D,kBAAkB,gIAAgI,CAChN,CAAC;IACJ,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;QAChC,kGAAkG;QAClG,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACpF,OAAO,CAAC,KAAK,CAAC,8KAA8K,CAAC,CAAC;QAC9L,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC,CAAC,oDAAoD;QACpF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,KAAK,CACb,gCAAgC,KAAK,kJAAkJ,CACxL,CAAC;AACJ,CAAC;AAED,yFAAyF;AAEzF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAgB,EAAE,KAAmB;IACrE,MAAM,CAAC,GAAG,IAAI,CAAC,MAAgB,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,qEAAqE,KAAK,WAAW,MAAM,KAAK;YAC9F,8GAA8G,CACjH,CAAC;IAEJ,6FAA6F;IAC7F,oFAAoF;IACpF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAE7C,qGAAqG;IACrG,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3G,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IACxG,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,cAAc,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,+DAA+D;IACnH,IAAI,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,oEAAoE;IAErG,gGAAgG;IAChG,iGAAiG;IACjG,kGAAkG;IAClG,4FAA4F;IAC5F,8FAA8F;IAC9F,2FAA2F;IAC3F,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC;IAChC,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACxF,OAAO,CAAC,KAAK,CAAC,mCAAmC,MAAM,iBAAiB,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,iGAAiG;IACjG,6FAA6F;IAC7F,+FAA+F;IAC/F,4FAA4F;IAC5F,iGAAiG;IACjG,8FAA8F;IAC9F,uFAAuF;IACvF,MAAM,UAAU,GAAe,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,eAAe,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3G,OAAO,CAAC,KAAK,CAAC,oCAAoC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,aAAa,UAAU,CAAC,eAAe,GAAG,CAAC,CAAC;IAE7H,MAAM,EAAE,GAAG,IAAI,aAAa,CAAC;QAC3B,KAAK;QACL,OAAO,EAAE,MAAM;QACf,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,gGAAgG;QAChG,gGAAgG;QAChG,kFAAkF;QAClF,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QACvD,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,KAAK,EAAE,4DAA4D;QAC5E,aAAa,EAAE,IAAI,EAAE,4CAA4C;QACjE,gBAAgB,EAAE,KAAK,EAAE,0EAA0E;QACnG,IAAI,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE;KAC/F,CAAC,CAAC;IACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IAEjB,qGAAqG;IACrG,sGAAsG;IACtG,gEAAgE;IAChE,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,qDAAqD,KAAK,qDAAqD,CAAC,CAAC;QAC/H,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,gGAAgG;IAChG,oFAAoF;IACpF,IAAI,UAA4C,CAAC;IACjD,oGAAoG;IACpG,mGAAmG;IACnG,mDAAmD;IACnD,IAAI,cAAkC,CAAC;IAEvC,qGAAqG;IACrG,8FAA8F;IAC9F,qGAAqG;IACrG,+BAA+B;IAC/B,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE;QACjF,qBAAqB,EAAE,KAAK,EAAE,QAAiB,EAAE,EAAE;YACjD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,+FAA+F;gBAC/F,oFAAoF;gBACpF,+EAA+E;gBAC/E,IAAI,QAAQ,KAAK,SAAS;oBACxB,MAAM,IAAI,KAAK,CACb,6FAA6F,cAAc,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3I,CAAC;gBACJ,OAAO,EAAE,OAAO,EAAE,kDAAkD,cAAc,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;YACtH,CAAC;YACD,kGAAkG;YAClG,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,aAAsB,EAAE,CAAC;QAC5G,CAAC;QACD,2FAA2F;QAC3F,0FAA0F;QAC1F,cAAc,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC;QAC7E,4FAA4F;QAC5F,gGAAgG;QAChG,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC;QAC7E,wFAAwF;QACxF,0FAA0F;QAC1F,4FAA4F;QAC5F,iBAAiB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,wBAAwB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC;KAC1F,CAAC,CAAC;IACH,uGAAuG;IACvG,sGAAsG;IACtG,sDAAsD;IACtD,IAAI,CAAC;QAAC,QAAQ,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAAC,CAAC;IACpE,MAAM,CAAC,CAAC,0FAA0F,CAAC,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAE9H,kGAAkG;IAClG,sGAAsG;IACtG,mFAAmF;IACnF,IAAI,CAAC;QACH,oGAAoG;QACpG,qGAAqG;QACrG,6EAA6E;QAC7E,kGAAkG;QAClG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,MAAM,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IACnG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,cAAc,GAAI,CAAW,CAAC,OAAO,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,kCAAkC,cAAc,mDAAmD,CAAC,CAAC;IACrH,CAAC;IAED,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAQ,EAAE;QACtC,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,aAAa,CAAC,WAAW,CAAC,CAAC;QAC3B,sGAAsG;QACtG,wGAAwG;QACxG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3C,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBAAC,MAAM,UAAU,EAAE,IAAI,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;YACpE,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;YAChF,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,CAAC;IACF,+FAA+F;IAC/F,iEAAiE;IACjE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC;aACnC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;aAC3B,KAAK,CAAC,CAAC,CAAQ,EAAE,EAAE;YAClB,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,OAAO,qCAAqC,CAAC,CAAC;YAC7F,QAAQ,CAAC,CAAC,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAEjD,oGAAoG;IACpG,qGAAqG;IACrG,qGAAqG;IACrG,wGAAwG;IACxG,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,IAAI,MAAM,CAAC;IACnF,IAAI,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE;QACnC,IAAI,QAAQ;YAAE,OAAO;QACrB,8FAA8F;QAC9F,+FAA+F;QAC/F,gGAAgG;QAChG,4FAA4F;QAC5F,EAAE;QACF,4FAA4F;QAC5F,iGAAiG;QACjG,+FAA+F;QAC/F,+FAA+F;QAC/F,KAAK,WAAW,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;aAC5E,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;YACX,IAAI,EAAE,EAAE,CAAC;gBAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC/C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,cAAc,EAAE,CAAC;gBAChD,OAAO,CAAC,KAAK,CAAC,uCAAuC,cAAc,GAAG,IAAI,qCAAqC,CAAC,CAAC;gBACjH,QAAQ,CAAC,CAAC,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrB,CAAC,EAAE,IAAI,CAAC,CAAC;IAET,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,sBAAsB;AAC3D,CAAC"}
+{"version":3,"file":"delivery.js","sourceRoot":"","sources":["../src/delivery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACL,aAAa,EACb,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,WAAW,EACX,SAAS,EACT,WAAW,GAIZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACnL,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,2BAA2B,EAAmB,MAAM,iBAAiB,CAAC;AAIhJ;;;;wFAIwF;AACxF,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,CAAC;AAIjD;;;;;;;;GAQG;AACH,SAAS,4BAA4B,CAAC,CAAS,EAAE,QAAsB;IACrE,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACtE,IAAI,KAAK,CAAC,MAAM;QACd,MAAM,IAAI,KAAK,CACb,aAAa,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,yFAAyF,CAC/I,CAAC;AACN,CAAC;AAED;;;;;;;;;;;yEAWyE;AACzE,SAAS,iBAAiB,CAAC,CAAS,EAAE,KAAa,EAAE,QAAsB;IACzE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;QACrD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,qBAAqB,GAAG,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC/F,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,OAAO,EAAE,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvG,CAAC;AAED;;;;;;;;;;gBAUgB;AAChB,KAAK,UAAU,iBAAiB,CAAC,GAAgB,EAAE,CAAS;IAC1D,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,IAAwB,CAAC,CAAC,8DAA8D;QAC5F,OAAO;YACL,OAAO;YACP,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,OAAO,KAAK,SAAS;oBACvB,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,8EAA8E,CAAC,CAAC;gBACtJ,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBAC3C,uFAAuF;oBACvF,kFAAkF;oBAClF,wFAAwF;oBACxF,iFAAiF;oBACjF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;oBAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC;wBAAE,OAAO,OAAO,CAAC;oBACvH,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kNAAkN,CAAC,CAAC;gBAC9O,CAAC;gBACD,IAAI,GAAG,OAAO,CAAC;gBACf,OAAO,OAAO,CAAC;YACjB,CAAC;SACF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ;QACd,MAAM,IAAI,KAAK,CACb,6DAA6D,GAAG,kMAAkM,mBAAmB,qBAAqB,CAC3S,CAAC;IACJ,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;QAChC,kGAAkG;QAClG,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACpF,OAAO,CAAC,KAAK,CAAC,8KAA8K,CAAC,CAAC;QAC9L,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC,CAAC,oDAAoD;QACpF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,KAAK,CACb,gCAAgC,KAAK,kJAAkJ,CACxL,CAAC;AACJ,CAAC;AAED,yFAAyF;AAEzF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAgB,EAAE,KAAmB;IACrE,MAAM,CAAC,GAAG,IAAI,CAAC,MAAgB,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,qEAAqE,KAAK,WAAW,MAAM,KAAK;YAC9F,8GAA8G,CACjH,CAAC;IAEJ,+FAA+F;IAC/F,iGAAiG;IACjG,gGAAgG;IAChG,+CAA+C;IAC/C,4BAA4B,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAEvC,qGAAqG;IACrG,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3G,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IACxG,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,cAAc,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,+DAA+D;IACnH,IAAI,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,oEAAoE;IAErG,gGAAgG;IAChG,iGAAiG;IACjG,kGAAkG;IAClG,4FAA4F;IAC5F,8FAA8F;IAC9F,2FAA2F;IAC3F,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC;IAChC,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACxF,OAAO,CAAC,KAAK,CAAC,mCAAmC,MAAM,iBAAiB,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,iGAAiG;IACjG,6FAA6F;IAC7F,+FAA+F;IAC/F,4FAA4F;IAC5F,+FAA+F;IAC/F,gGAAgG;IAChG,6FAA6F;IAC7F,2FAA2F;IAC3F,kGAAkG;IAClG,wFAAwF;IACxF,iGAAiG;IACjG,6FAA6F;IAC7F,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC;IACjC,MAAM,UAAU,GAAe;QAC7B,IAAI,EAAE,QAAQ;QACd,eAAe,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC;QAChD,MAAM,EAAE,KAAK,KAAK,SAAS;YACzB,CAAC,CAAC,EAAE,OAAO,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE;YACrF,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC9C,CAAC;IACF,kGAAkG;IAClG,+FAA+F;IAC/F,iGAAiG;IACjG,MAAM,2BAA2B,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,CAAC,KAAK,CAAC,oCAAoC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,aAAa,UAAU,CAAC,eAAe,GAAG,CAAC,CAAC;IAE7H,MAAM,EAAE,GAAG,IAAI,aAAa,CAAC;QAC3B,KAAK;QACL,OAAO,EAAE,MAAM;QACf,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,gGAAgG;QAChG,gGAAgG;QAChG,kFAAkF;QAClF,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QACvD,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,KAAK,EAAE,4DAA4D;QAC5E,aAAa,EAAE,IAAI,EAAE,4CAA4C;QACjE,gBAAgB,EAAE,KAAK,EAAE,0EAA0E;QACnG,IAAI,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE;KAC/F,CAAC,CAAC;IACH,2FAA2F;IAC3F,6FAA6F;IAC7F,8FAA8F;IAC9F,wFAAwF;IACxF,MAAM,GAAG,GAAG,CAAC,CAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7E,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACpB,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACtB,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IAEjB,qGAAqG;IACrG,sGAAsG;IACtG,gEAAgE;IAChE,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,qDAAqD,KAAK,qDAAqD,CAAC,CAAC;QAC/H,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,gGAAgG;IAChG,oFAAoF;IACpF,IAAI,UAA4C,CAAC;IACjD,oGAAoG;IACpG,mGAAmG;IACnG,mDAAmD;IACnD,IAAI,cAAkC,CAAC;IAEvC,qGAAqG;IACrG,8FAA8F;IAC9F,qGAAqG;IACrG,+BAA+B;IAC/B,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE;QACjF,qBAAqB,EAAE,KAAK,EAAE,QAAiB,EAAE,EAAE;YACjD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,+FAA+F;gBAC/F,oFAAoF;gBACpF,+EAA+E;gBAC/E,IAAI,QAAQ,KAAK,SAAS;oBACxB,MAAM,IAAI,KAAK,CACb,6FAA6F,cAAc,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3I,CAAC;gBACJ,OAAO,EAAE,OAAO,EAAE,kDAAkD,cAAc,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;YACtH,CAAC;YACD,kGAAkG;YAClG,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,aAAsB,EAAE,CAAC;QAC5G,CAAC;QACD,2FAA2F;QAC3F,0FAA0F;QAC1F,cAAc,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC;QAC7E,4FAA4F;QAC5F,gGAAgG;QAChG,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC;QAC7E,wFAAwF;QACxF,0FAA0F;QAC1F,4FAA4F;QAC5F,iBAAiB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,wBAAwB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC;KAC1F,CAAC,CAAC;IACH,uGAAuG;IACvG,sGAAsG;IACtG,sDAAsD;IACtD,IAAI,CAAC;QAAC,QAAQ,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAAC,CAAC;IACpE,MAAM,CAAC,CAAC,0FAA0F,CAAC,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAE9H,kGAAkG;IAClG,sGAAsG;IACtG,mFAAmF;IACnF,IAAI,CAAC;QACH,oGAAoG;QACpG,qGAAqG;QACrG,6EAA6E;QAC7E,kGAAkG;QAClG,2FAA2F;QAC3F,iGAAiG;QACjG,gFAAgF;QAChF,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,MAAM,eAAe,CACnE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,eAAe,EAAE,EACxD,KAAK,CACN,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,cAAc,GAAI,CAAW,CAAC,OAAO,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,kCAAkC,cAAc,mDAAmD,CAAC,CAAC;IACrH,CAAC;IAED,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAQ,EAAE;QACtC,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,aAAa,CAAC,WAAW,CAAC,CAAC;QAC3B,sGAAsG;QACtG,wGAAwG;QACxG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3C,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBAAC,MAAM,UAAU,EAAE,IAAI,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;YACpE,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;YAChF,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,CAAC;IACF,+FAA+F;IAC/F,iEAAiE;IACjE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC;aACnC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;aAC3B,KAAK,CAAC,CAAC,CAAQ,EAAE,EAAE;YAClB,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,OAAO,qCAAqC,CAAC,CAAC;YAC7F,QAAQ,CAAC,CAAC,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAEjD,oGAAoG;IACpG,qGAAqG;IACrG,qGAAqG;IACrG,wGAAwG;IACxG,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,IAAI,MAAM,CAAC;IACnF,IAAI,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE;QACnC,IAAI,QAAQ;YAAE,OAAO;QACrB,8FAA8F;QAC9F,+FAA+F;QAC/F,gGAAgG;QAChG,4FAA4F;QAC5F,EAAE;QACF,4FAA4F;QAC5F,iGAAiG;QACjG,+FAA+F;QAC/F,+FAA+F;QAC/F,KAAK,WAAW,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;aAC5E,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;YACX,IAAI,EAAE,EAAE,CAAC;gBAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC/C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,cAAc,EAAE,CAAC;gBAChD,OAAO,CAAC,KAAK,CAAC,uCAAuC,cAAc,GAAG,IAAI,qCAAqC,CAAC,CAAC;gBACjH,QAAQ,CAAC,CAAC,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrB,CAAC,EAAE,IAAI,CAAC,CAAC;IAET,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,sBAAsB;AAC3D,CAAC"}

package/dist/evict-exec.d.ts

@@ -1,4 +1,5 @@
 import { type EvictionResult, type PlaneLivenessResult, type PrincipalLivenessResult } from "@cotal-ai/core";
+import { type SysCredsSource } from "./sys-creds.js";
 /**
  * THE SCAN TARGET, resolved fail-closed and BOUND TO THE DAEMON'S OWN TENANCY.
  *
@@ -12,9 +13,17 @@ import { type EvictionResult, type PlaneLivenessResult, type PrincipalLivenessRe
  *
  * Two independent guards, because either alone leaves a real case open:
  *  - the root is PINNED AT DAEMON START, so it cannot drift with `process.cwd()` between requests;
- *  - the account on disk is CROSS-CHECKED against the account the daemon's own credential
+ *  - the OBSERVER CRED is CROSS-CHECKED against the account the daemon's own credential
  *    authenticates as. Pinning alone cannot notice a daemon that started in the wrong root to
- *    begin with; the tenancy check can, because the credential is not read from that root.
+ *    begin with; the tenancy check can, because neither side of it is read from that root.
+ *
+ * The second guard used to compare `.cotal/membership.json` against `expectedAccount`. It now
+ * compares the OBSERVER'S OWN CONNZ PERMISSION against it (`sys-creds.ts`), which is strictly
+ * stronger: the file sat in the same directory as the creds, so a wrong root was wrong for both, and
+ * its independence came from `expectedAccount` being derived from the cred anyway — the cred was
+ * always the real authority and the file was the thing being checked. The disk file is still read as
+ * a SECOND source on the workstation path, where the root genuinely can drift; it is no longer
+ * required, and a hosted composition has none.
  *
  * A mismatch REFUSES LOUD and names both sides. Note the asymmetry that makes this necessary: an
  * observer scoped to account A with accountId B under-reports (broker-denied → `unknown`, safe),
@@ -26,7 +35,35 @@ export interface ScanTarget {
     root: string;
     /** The account the daemon's own delivery credential authenticates as. */
     expectedAccount: string;
+    /** Where the $SYS pair is read from, and whether that store was injected (hosted) — the latter
+     *  selects the repair idiom only, never the failure semantics. */
+    source: SysCredsSource;
 }
+/**
+ * Pin check + the WORKSTATION-ONLY second source.
+ *
+ * The account to sweep is `target.expectedAccount` — the daemon's own credential, pinned at start.
+ * `membership.json` is no longer consulted for it. On the workstation path the file is still
+ * cross-checked WHEN PRESENT, because there a wrong root is a real, enumerated failure mode
+ * (see the cases above) and a second independent-ish source costs nothing. It is no longer
+ * REQUIRED: its absence is not an error, and a hosted composition never has one.
+ */
+export declare function validateScanTarget(target: ScanTarget, verb?: string): {
+    accountId: string;
+};
+/** Startup admission for the scan-backed delivery-admin rail.
+ *
+ * Root stability alone is not a tenancy proof for an injected store: the hosted composition has no
+ * `membership.json`, and the store may return another tenant's structurally valid observer. Read
+ * the pair through the exact source the executors will use, then validate the observer before the
+ * endpoint exists or lease.0 can be acquired. The observer is required because every liveness
+ * verdict needs an account-scoped complete scan. The evictor remains optional for pre-eviction
+ * spaces (their documented posture is deny-new-only), but when present it participates in the
+ * torn-rotation check so a mixed generation cannot be admitted as healthy.
+ */
+export declare function validateScanTargetAdmission(target: ScanTarget): Promise<{
+    accountId: string;
+}>;
 /**
  * The delivery daemon's LIVE-EVICTION executor (D5 slice 6, on the privileged delivery-admin rail):
  * force-drop a denied principal's live connections via the core scan→KICK→verify primitive. The two
@@ -44,13 +81,18 @@ export declare function executeEviction(server: string, target: ScanTarget, prin
  * connection tuples; anything else refuses loudly. A space provisioned before the observer existed
  * refuses with the regeneration step — the auth plane treats that refusal as UNKNOWN and never
  * reclaims over it (fail-closed).
+ *
+ * Asks for the observer ONLY, so the KICK cred is not even read into this process's memory on a
+ * read-only path. The cost is that the torn-rotation check cannot run here (it needs both halves);
+ * that is safe rather than a gap — a torn pair whose observer is the stale half is refused by the
+ * broker, and this path reads any refusal as UNKNOWN, which is already fail-closed.
  */
 export declare function executePlaneLiveness(server: string, target: ScanTarget, query: unknown): Promise<PlaneLivenessResult>;
 /**
  * The delivery daemon's FREEZE-HOLDER LIVENESS probe (#391, on the privileged delivery-admin rail):
  * answer whether ONE principal still holds a live connection, via the $SYS CONNZ observer cred
  * (opened per call; READ-ONLY — the KICK evictor cred never enters this path, and is not even read
- * from disk here).
+ * from the store here).
  *
  * This is the READ half of {@link executeEviction}, and it exists because the write half cannot
  * serve as its own precheck: a repair that must REFUSE while the holder is alive would, using

package/dist/evict-exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evict-exec.d.ts","sourceRoot":"","sources":["../src/evict-exec.ts"],"names":[],"mappings":"AAEA,OAAO,EAOL,KAAK,cAAc,EAEnB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,gBAAgB,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAC;CACzB;AAsBD;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAwBpH;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAkB3H;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAuBvI"}
+{"version":3,"file":"evict-exec.d.ts","sourceRoot":"","sources":["../src/evict-exec.ts"],"names":[],"mappings":"AAEA,OAAO,EAOL,KAAK,cAAc,EAEnB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAA0E,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAG7H;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAC;IACxB;sEACkE;IAClE,MAAM,EAAE,cAAc,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,SAAqB,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CA2BvG;AAED;;;;;;;;;GASG;AACH,wBAAsB,2BAA2B,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBpG;AA+BD;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAmBpH;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAc3H;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAmBvI"}

package/dist/evict-exec.js

@@ -1,23 +1,97 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { evictDeniedPrincipalWithCreds, isPlaneConnTuple, isPrincipalOwnerToken, observePlaneLivenessWithCreds, observePrincipalLivenessWithCreds, parsePrincipalKey, } from "@cotal-ai/core";
-import { findCotalRoot } from "@cotal-ai/workspace";
-function resolveScan(target, verb) {
+import { CONNECTION_EVICTOR_CREDS_KIND, findCotalRoot, membershipConfigPath, MEMBERSHIP_OBSERVER_CREDS_KIND } from "@cotal-ai/workspace";
+import { loadSysPair, observerTenancyProblem, repairAdvice, tornRotationProblem } from "./sys-creds.js";
+/**
+ * Pin check + the WORKSTATION-ONLY second source.
+ *
+ * The account to sweep is `target.expectedAccount` — the daemon's own credential, pinned at start.
+ * `membership.json` is no longer consulted for it. On the workstation path the file is still
+ * cross-checked WHEN PRESENT, because there a wrong root is a real, enumerated failure mode
+ * (see the cases above) and a second independent-ish source costs nothing. It is no longer
+ * REQUIRED: its absence is not an error, and a hosted composition never has one.
+ */
+export function validateScanTarget(target, verb = "delivery startup") {
     const live = findCotalRoot();
     if (live !== target.root)
         throw new Error(`${verb}: the mesh root resolved at this request (${live}) is not the one this daemon started in (${target.root}); ` +
             "the scan account would be read from a different workspace than the one this daemon serves. Refusing — a sweep of the wrong account looks exactly like a dead principal");
-    const dir = join(target.root, ".cotal");
-    const cfgPath = join(dir, "membership.json");
-    if (!existsSync(cfgPath))
-        throw new Error(`${verb}: ${cfgPath} is missing, so the account to scan is unknown`);
-    const accountId = JSON.parse(readFileSync(cfgPath, "utf8")).accountId;
-    if (!accountId)
-        throw new Error(`${verb}: ${cfgPath} has no accountId`);
-    if (accountId !== target.expectedAccount)
-        throw new Error(`${verb}: ${cfgPath} names account ${accountId}, but this daemon's own credential authenticates as ${target.expectedAccount}. ` +
-            "That disk material belongs to a different mesh, and sweeping it would return a confident, WRONG answer (a complete sweep of the wrong account is indistinguishable from a gone principal). Refusing — start the daemon from the workspace root whose account it serves");
-    return { dir, accountId };
+    if (!target.source.injected) {
+        // Through the kind's resolver (P7 §2 rule 1), not a hand-composed `.cotal/membership.json`:
+        // the file is per-space now, and reading the canonical location past an unmigrated copy would
+        // silently drop this second source — turning a wrong-root refusal into a confident sweep.
+        // `target.source.space` is the space the daemon started in, pinned with the rest of the source.
+        const cfgPath = membershipConfigPath(target.root, target.source.space);
+        if (existsSync(cfgPath)) {
+            // A malformed file on a path that no longer needs it must not take eviction down; only a file
+            // that names a DIFFERENT account is evidence of the drift this check exists to catch.
+            let onDisk;
+            try {
+                onDisk = JSON.parse(readFileSync(cfgPath, "utf8")).accountId;
+            }
+            catch {
+                onDisk = undefined;
+            }
+            if (onDisk !== undefined && onDisk !== target.expectedAccount)
+                throw new Error(`${verb}: ${cfgPath} names account ${onDisk}, but this daemon's own credential authenticates as ${target.expectedAccount}. ` +
+                    "That disk material belongs to a different mesh, and sweeping it would return a confident, WRONG answer (a complete sweep of the wrong account is indistinguishable from a gone principal). Refusing — start the daemon from the workspace root whose account it serves");
+        }
+    }
+    return { accountId: target.expectedAccount };
+}
+/** Startup admission for the scan-backed delivery-admin rail.
+ *
+ * Root stability alone is not a tenancy proof for an injected store: the hosted composition has no
+ * `membership.json`, and the store may return another tenant's structurally valid observer. Read
+ * the pair through the exact source the executors will use, then validate the observer before the
+ * endpoint exists or lease.0 can be acquired. The observer is required because every liveness
+ * verdict needs an account-scoped complete scan. The evictor remains optional for pre-eviction
+ * spaces (their documented posture is deny-new-only), but when present it participates in the
+ * torn-rotation check so a mixed generation cannot be admitted as healthy.
+ */
+export async function validateScanTargetAdmission(target) {
+    const scan = validateScanTarget(target);
+    const sys = await loadSysPair(target.source, "both");
+    if (sys.observer === undefined)
+        throw new Error(`delivery startup: the $SYS observer cred is not provisioned here (missing ${MEMBERSHIP_OBSERVER_CREDS_KIND}) - ${repairAdvice(target.source, [MEMBERSHIP_OBSERVER_CREDS_KIND])}. Refusing before endpoint construction and lease admission because this daemon cannot establish which account its scan rail serves`);
+    const tenancy = observerTenancyProblem(sys.observer, target.expectedAccount);
+    if (tenancy)
+        throw new Error(`delivery startup: ${tenancy}. Refusing before endpoint construction and lease admission`);
+    if (sys.evictor !== undefined) {
+        const torn = tornRotationProblem(sys.observer, sys.evictor, () => repairAdvice(target.source, [MEMBERSHIP_OBSERVER_CREDS_KIND, CONNECTION_EVICTOR_CREDS_KIND]));
+        if (torn)
+            throw new Error(`delivery startup: ${torn}. Refusing before endpoint construction and lease admission`);
+    }
+    return scan;
+}
+/** Read the $SYS material for one verb and run every pre-connect check, or THROW.
+ *
+ *  Fail-loud is the whole posture here (design §4.2): a missing key is a REFUSAL, full stop. In
+ *  particular a missing evictor must NOT silently fall back to deny-new-only inside the executor —
+ *  that posture is the CALLER's documented degradation, reached by handling this refusal, never
+ *  something the executor may choose on its own. And absence (`undefined` per the `SecretStore`
+ *  contract) is the only thing treated as "not provisioned": a `get()` that throws is a refusal,
+ *  not an absence, and propagates untouched from `loadSysPair`. */
+async function loadCheckedSys(target, verb, need) {
+    const sys = await loadSysPair(target.source, need);
+    if (sys.missing.length)
+        throw new Error(`${verb}: the $SYS ${need === "both" ? "observer/evictor creds are" : "observer creds are"} not provisioned here ` +
+            `(missing ${sys.missing.join(", ")}; a space created before live eviction) - ${repairAdvice(target.source, sys.missing)}. ` +
+            "Until then removal is deny-new-only (durable reauth)");
+    const observer = sys.observer;
+    const tenancy = observerTenancyProblem(observer, target.expectedAccount);
+    if (tenancy)
+        throw new Error(`${verb}: ${tenancy}. Refusing`);
+    if (sys.evictor !== undefined) {
+        // The torn-rotation check now covers this path too. It used to exist only in the feed, so
+        // eviction could open a half-rotated pair and get a bare "Authorization Violation" from the
+        // broker with nothing naming the cause.
+        const torn = tornRotationProblem(observer, sys.evictor, () => repairAdvice(target.source, [MEMBERSHIP_OBSERVER_CREDS_KIND, CONNECTION_EVICTOR_CREDS_KIND]));
+        if (torn)
+            throw new Error(`${verb}: ${torn}. Refusing`);
+    }
+    return { observer, ...(sys.evictor !== undefined ? { evictor: sys.evictor } : {}) };
 }
 /**
  * The delivery daemon's LIVE-EVICTION executor (D5 slice 6, on the privileged delivery-admin rail):
@@ -37,15 +111,12 @@ export async function executeEviction(server, target, principal) {
     const parsed = parsePrincipalKey(principal);
     if (!parsed || !isPrincipalOwnerToken(parsed.owner))
         throw new Error(`evictPrincipal: "${principal}" is not a real owner.actor principal (owner must be \`local\` or a derived \`u_…\` token — the only shapes CONNZ attribution can surface)`);
-    const { dir, accountId } = resolveScan(target, "evictPrincipal");
-    const obsPath = join(dir, "membership-observer.creds");
-    const evPath = join(dir, "connection-evictor.creds");
-    if (!existsSync(obsPath) || !existsSync(evPath))
-        throw new Error("evictPrincipal: the $SYS observer/evictor creds are not provisioned here (a space created before live eviction); mint them with `cotal down` then `cotal up --rotate-sys`. Until then removal is deny-new-only (durable reauth)");
+    const { accountId } = validateScanTarget(target, "evictPrincipal");
+    const sys = await loadCheckedSys(target, "evictPrincipal", "both");
     return evictDeniedPrincipalWithCreds({
         servers: server,
-        observerCreds: readFileSync(obsPath, "utf8"),
-        evictorCreds: readFileSync(evPath, "utf8"),
+        observerCreds: sys.observer,
+        evictorCreds: sys.evictor,
         accountId,
         principal,
     });
@@ -58,6 +129,11 @@ export async function executeEviction(server, target, principal) {
  * connection tuples; anything else refuses loudly. A space provisioned before the observer existed
  * refuses with the regeneration step — the auth plane treats that refusal as UNKNOWN and never
  * reclaims over it (fail-closed).
+ *
+ * Asks for the observer ONLY, so the KICK cred is not even read into this process's memory on a
+ * read-only path. The cost is that the torn-rotation check cannot run here (it needs both halves);
+ * that is safe rather than a gap — a torn pair whose observer is the stale half is refused by the
+ * broker, and this path reads any refusal as UNKNOWN, which is already fail-closed.
  */
 export async function executePlaneLiveness(server, target, query) {
     const q = query;
@@ -65,13 +141,11 @@ export async function executePlaneLiveness(server, target, query) {
         Object.keys(q).some((k) => k !== "ledger" && k !== "records") || // closed top-level shape
         !isPlaneConnTuple(q.ledger) || !isPlaneConnTuple(q.records))
         throw new Error("planeConnLiveness: the query must be exactly { ledger, records } connection tuples ({ serverId, cid, userNkey }); refusing a malformed or wider query");
-    const { dir, accountId } = resolveScan(target, "planeConnLiveness");
-    const obsPath = join(dir, "membership-observer.creds");
-    if (!existsSync(obsPath))
-        throw new Error("planeConnLiveness: the $SYS observer creds are not provisioned here (a space created before live observation); mint them with `cotal down` then `cotal up --rotate-sys`");
+    const { accountId } = validateScanTarget(target, "planeConnLiveness");
+    const sys = await loadCheckedSys(target, "planeConnLiveness", "observer");
     return observePlaneLivenessWithCreds({
         servers: server,
-        observerCreds: readFileSync(obsPath, "utf8"),
+        observerCreds: sys.observer,
         accountId,
         query: { ledger: q.ledger, records: q.records },
     });
@@ -80,7 +154,7 @@ export async function executePlaneLiveness(server, target, query) {
  * The delivery daemon's FREEZE-HOLDER LIVENESS probe (#391, on the privileged delivery-admin rail):
  * answer whether ONE principal still holds a live connection, via the $SYS CONNZ observer cred
  * (opened per call; READ-ONLY — the KICK evictor cred never enters this path, and is not even read
- * from disk here).
+ * from the store here).
  *
  * This is the READ half of {@link executeEviction}, and it exists because the write half cannot
  * serve as its own precheck: a repair that must REFUSE while the holder is alive would, using
@@ -100,13 +174,11 @@ export async function executePrincipalLiveness(server, target, principal) {
     const parsed = parsePrincipalKey(wanted);
     if (!parsed || !isPrincipalOwnerToken(parsed.owner))
         throw new Error(`principalLiveness: "${wanted}" is not a real owner.actor principal (owner must be \`local\` or a derived \`u_…\` token — the only shapes CONNZ attribution can surface)`);
-    const { dir, accountId } = resolveScan(target, "principalLiveness");
-    const obsPath = join(dir, "membership-observer.creds");
-    if (!existsSync(obsPath))
-        throw new Error("principalLiveness: the $SYS observer creds are not provisioned here (a space created before live observation); mint them with `cotal down` then `cotal up --rotate-sys`");
+    const { accountId } = validateScanTarget(target, "principalLiveness");
+    const sys = await loadCheckedSys(target, "principalLiveness", "observer");
     return observePrincipalLivenessWithCreds({
         servers: server,
-        observerCreds: readFileSync(obsPath, "utf8"),
+        observerCreds: sys.observer,
         accountId,
         principal: wanted,
     });

package/dist/evict-exec.js.map

@@ -1 +1 @@
-{"version":3,"file":"evict-exec.js","sourceRoot":"","sources":["../src/evict-exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,6BAA6B,EAC7B,gBAAgB,EAChB,qBAAqB,EACrB,6BAA6B,EAC7B,iCAAiC,EACjC,iBAAiB,GAKlB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAgCpD,SAAS,WAAW,CAAC,MAAkB,EAAE,IAAY;IACnD,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,IAAI,IAAI,KAAK,MAAM,CAAC,IAAI;QACtB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,6CAA6C,IAAI,4CAA4C,MAAM,CAAC,IAAI,KAAK;YACpH,wKAAwK,CACzK,CAAC;IACJ,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,OAAO,gDAAgD,CAAC,CAAC;IAC/G,MAAM,SAAS,GAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAA4B,CAAC,SAAS,CAAC;IAClG,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,OAAO,mBAAmB,CAAC,CAAC;IACxE,IAAI,SAAS,KAAK,MAAM,CAAC,eAAe;QACtC,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,KAAK,OAAO,kBAAkB,SAAS,uDAAuD,MAAM,CAAC,eAAe,IAAI;YAC/H,wQAAwQ,CACzQ,CAAC;IACJ,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,MAAkB,EAAE,SAAiB;IACzF,+FAA+F;IAC/F,iGAAiG;IACjG,4FAA4F;IAC5F,6FAA6F;IAC7F,2FAA2F;IAC3F,uFAAuF;IACvF,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,oBAAoB,SAAS,4IAA4I,CAAC,CAAC;IAC7L,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,iOAAiO,CAClO,CAAC;IACJ,OAAO,6BAA6B,CAAC;QACnC,OAAO,EAAE,MAAM;QACf,aAAa,EAAE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC;QAC5C,YAAY,EAAE,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC;QAC1C,SAAS;QACT,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc,EAAE,MAAkB,EAAE,KAAc;IAC3F,MAAM,CAAC,GAAG,KAAgD,CAAC;IAC3D,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QACtD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,SAAS,CAAC,IAAI,yBAAyB;QAC1F,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,uJAAuJ,CAAC,CAAC;IAC3K,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,yKAAyK,CAC1K,CAAC;IACJ,OAAO,6BAA6B,CAAC;QACnC,OAAO,EAAE,MAAM;QACf,aAAa,EAAE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC;QAC5C,SAAS;QACT,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAAc,EAAE,MAAkB,EAAE,SAAkB;IACnG,8FAA8F;IAC9F,0FAA0F;IAC1F,4FAA4F;IAC5F,gGAAgG;IAChG,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,4IAA4I,CAAC,CAAC;IAC7L,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,yKAAyK,CAC1K,CAAC;IACJ,OAAO,iCAAiC,CAAC;QACvC,OAAO,EAAE,MAAM;QACf,aAAa,EAAE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC;QAC5C,SAAS;QACT,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"evict-exec.js","sourceRoot":"","sources":["../src/evict-exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,6BAA6B,EAC7B,gBAAgB,EAChB,qBAAqB,EACrB,6BAA6B,EAC7B,iCAAiC,EACjC,iBAAiB,GAKlB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,6BAA6B,EAAE,aAAa,EAAE,oBAAoB,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AACzI,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,YAAY,EAAE,mBAAmB,EAAuB,MAAM,gBAAgB,CAAC;AA2C7H;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAkB,EAAE,IAAI,GAAG,kBAAkB;IAC9E,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,IAAI,IAAI,KAAK,MAAM,CAAC,IAAI;QACtB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,6CAA6C,IAAI,4CAA4C,MAAM,CAAC,IAAI,KAAK;YACpH,wKAAwK,CACzK,CAAC;IACJ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC5B,4FAA4F;QAC5F,8FAA8F;QAC9F,0FAA0F;QAC1F,gGAAgG;QAChG,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,8FAA8F;YAC9F,sFAAsF;YACtF,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBAAC,MAAM,GAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAA4B,CAAC,SAAS,CAAC;YAAC,CAAC;YACjG,MAAM,CAAC;gBAAC,MAAM,GAAG,SAAS,CAAC;YAAC,CAAC;YAC7B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,MAAM,CAAC,eAAe;gBAC3D,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,KAAK,OAAO,kBAAkB,MAAM,uDAAuD,MAAM,CAAC,eAAe,IAAI;oBAC5H,wQAAwQ,CACzQ,CAAC;QACN,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,MAAkB;IAClE,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;QAC5B,MAAM,IAAI,KAAK,CACb,6EAA6E,8BAA8B,OACzG,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,8BAA8B,CAAC,CAC9D,qIAAqI,CACtI,CAAC;IACJ,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAC7E,IAAI,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,6DAA6D,CAAC,CAAC;IACxH,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAC/D,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,8BAA8B,EAAE,6BAA6B,CAAC,CAAC,CAAC,CAAC;QAChG,IAAI,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,6DAA6D,CAAC,CAAC;IACpH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;mEAOmE;AACnE,KAAK,UAAU,cAAc,CAAC,MAAkB,EAAE,IAAY,EAAE,IAAyB;IACvF,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACnD,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM;QACpB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,cAAc,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,oBAAoB,wBAAwB;YAClH,YAAY,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,6CAA6C,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;YAC3H,sDAAsD,CACvD,CAAC;IACJ,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAkB,CAAC;IACxC,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IACzE,IAAI,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,OAAO,YAAY,CAAC,CAAC;IAC9D,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9B,0FAA0F;QAC1F,4FAA4F;QAC5F,wCAAwC;QACxC,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,8BAA8B,EAAE,6BAA6B,CAAC,CAAC,CAAC,CAAC;QAC5J,IAAI,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,IAAI,YAAY,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACtF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,MAAkB,EAAE,SAAiB;IACzF,+FAA+F;IAC/F,iGAAiG;IACjG,4FAA4F;IAC5F,6FAA6F;IAC7F,2FAA2F;IAC3F,uFAAuF;IACvF,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,oBAAoB,SAAS,4IAA4I,CAAC,CAAC;IAC7L,MAAM,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;IACnE,OAAO,6BAA6B,CAAC;QACnC,OAAO,EAAE,MAAM;QACf,aAAa,EAAE,GAAG,CAAC,QAAQ;QAC3B,YAAY,EAAE,GAAG,CAAC,OAAiB;QACnC,SAAS;QACT,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc,EAAE,MAAkB,EAAE,KAAc;IAC3F,MAAM,CAAC,GAAG,KAAgD,CAAC;IAC3D,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QACtD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,SAAS,CAAC,IAAI,yBAAyB;QAC1F,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,uJAAuJ,CAAC,CAAC;IAC3K,MAAM,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,mBAAmB,EAAE,UAAU,CAAC,CAAC;IAC1E,OAAO,6BAA6B,CAAC;QACnC,OAAO,EAAE,MAAM;QACf,aAAa,EAAE,GAAG,CAAC,QAAQ;QAC3B,SAAS;QACT,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAAc,EAAE,MAAkB,EAAE,SAAkB;IACnG,8FAA8F;IAC9F,0FAA0F;IAC1F,4FAA4F;IAC5F,gGAAgG;IAChG,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,4IAA4I,CAAC,CAAC;IAC7L,MAAM,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,mBAAmB,EAAE,UAAU,CAAC,CAAC;IAC1E,OAAO,iCAAiC,CAAC;QACvC,OAAO,EAAE,MAAM;QACf,aAAa,EAAE,GAAG,CAAC,QAAQ;QAC3B,SAAS;QACT,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;AACL,CAAC"}

package/dist/feedback-intake.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"feedback-intake.d.ts","sourceRoot":"","sources":["../src/feedback-intake.ts"],"names":[],"mappings":"AAIA,OAAO,EAAgE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAqD/G,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA0HvE"}
+{"version":3,"file":"feedback-intake.d.ts","sourceRoot":"","sources":["../src/feedback-intake.ts"],"names":[],"mappings":"AAIA,OAAO,EAAgE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAqD/G,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA2HvE"}

package/dist/feedback-intake.js

@@ -58,6 +58,7 @@ export async function runFeedbackIntake(args) {
         },
     });
     ep.on("error", (e) => console.error(c.red("! " + e.message)));
+    ep.on("warning", (e) => console.error(c.red("! " + e.message)));
     await ep.start();
     mkdirSync(dirname(store), { recursive: true });
     const http = createServer(async (req, res) => {