@cotal-ai/delivery 0.48.2 → 0.50.0

package/dist/delivery.d.ts

@@ -1,4 +1,4 @@
-import { type ParsedArgs, type SecretStore } from "@cotal-ai/core";
+import { type ParsedArgs, type SecretStore, type SecretStoreIdentity } from "@cotal-ai/core";
 import { DELIVERY_CREDS_KIND, deliveryCredsKey } from "@cotal-ai/workspace";
 /** Re-exported for hosted compositions: the daemon cred's KIND, and the builder that turns it into
  *  the {@link SecretStore} key for a space. Defined once in workspace (the layout is the workspace's)
@@ -6,6 +6,92 @@ import { DELIVERY_CREDS_KIND, deliveryCredsKey } from "@cotal-ai/workspace";
  *  the key — the key is per-space — so a hosted store must be keyed with the builder; the flat kind
  *  is the pre-P7 key and putting there leaves this daemon reading an empty location. */
 export { DELIVERY_CREDS_KIND, deliveryCredsKey };
+type CredsSource = {
+    store: SecretStore;
+    key: string;
+    where: string;
+    injected: boolean;
+    identity: SecretStoreIdentity;
+};
+/**
+ * The store identity THIS daemon will re-read on `reloadCreds`. It is the same store
+ * `resolveCredsStore` returns: an injected coordinate, a `--creds` file that is
+ * exactly `<root>/.cotal/<spaceSegment(space)>/delivery.creds` (named as the
+ * workstation root, matching the canonical arm), a `--creds` file that is not
+ * that file (named as the file's own directory), or the workstation root.
+ * Naming an ancestor via `findCotalRoot` would certify a two-root composition
+ * as a same-store proof.
+ */
+export declare function reloadStoreIdentityOf(src: Pick<CredsSource, "injected" | "identity"> & {
+    store?: SecretStore;
+}): SecretStoreIdentity;
+/**
+ * Identity of the store a `--creds` file is reloaded from.
+ *
+ * With `--creds` the store object is deliberately FLAT (root = the file's own
+ * directory, key = basename). The canonical store is `<root>/.cotal` with a
+ * segmented key. Different store objects, but when `--creds` names THE FILE THE
+ * MANAGER WRITES they resolve THE SAME FILE, so they are the same authority.
+ * Identity names that authority, not the store object's root.
+ *
+ * The manager remints only `segmentedKey(DELIVERY_CREDS_KIND, space)` under
+ * `<root>/.cotal`. Collapse only that exact path: basename is `delivery.creds`,
+ * parent of the file dir is `.cotal`, and the file dir is `spaceSegment(space)`
+ * for THIS space. Another space's segment, a decoy basename, `.cotal/auth/...`,
+ * or a legacy `<root>/.cotal/delivery.creds` keep `dirname`. Never
+ * `spaceFromSegment` ("a valid segment") and never `findCotalRoot`.
+ */
+export declare function reloadStoreIdentityFromCredsPath(credsPath: string, space: string): SecretStoreIdentity;
+/**
+ * Workstation root implied by a `--creds` path: the parent of the enclosing
+ * `.cotal` directory. A path that is not under any `.cotal` tree names no
+ * workstation (a flat mount, a container file) and returns undefined.
+ *
+ * Distinct from {@link reloadStoreIdentityFromCredsPath}, which names the
+ * SecretStore the manager challenges. That identity stays the file's own
+ * directory for a legacy shallow path; this helper answers a different
+ * question so the cwd guard can compare two workspace roots.
+ */
+export declare function workspaceRootFromCredsPath(credsPath: string): string | undefined;
+/**
+ * Uninjected `--creds` that names one real workstation root while process cwd
+ * resolves another is a false same-store proof: membership-rw still resolves
+ * via `findCotalRoot()` (cwd), not the `--creds` file. Fire only when BOTH
+ * sides resolve real workstation roots and those differ. A path that is not
+ * under a `.cotal` tree names no workstation, so this check does not fire
+ * (the manager challenge already diverges on that composition). Injected
+ * compositions skip this: both rails take the injected store. Never silently
+ * prefer either root.
+ */
+export declare function assertUninjectedCredsSharesCwdRoot(opts: {
+    injected: boolean;
+    credsPath: string;
+    cwdRoot?: string;
+}): void;
+/**
+ * RECORD THIS PROCESS as the space's delivery daemon, and un-record it on a clean exit (#1528).
+ *
+ * The daemon writes its OWN record because it is the only participant that always knows it is
+ * running. Until now `delivery.<space>.pid` was written ONLY by the CLI launcher
+ * (`startDeliveryDetached`), so every other route to a live daemon — a container entrypoint,
+ * systemd, an operator typing `cotal deliver --space …`, a hosted composition calling
+ * {@link runDelivery} — left whatever was on disk untouched and readers believed it. A record naming
+ * a pid that died days ago does not merely under-report: `down`'s `mayBeRunning` guard exists to
+ * fail CLOSED so `cotal down nats` cannot pull the broker out from under a live dependant, and a
+ * stale record supplies exactly the proof-of-death that guard requires.
+ *
+ * The launcher's shape is followed rather than re-invented: the CANONICAL path (never a pre-upgrade
+ * name), a provably dead pre-upgrade record reclaimed first so an upgraded root never holds both
+ * spellings, then the #969 identity pin beside it. The pin goes with the record on the way out.
+ *
+ * The removal is pid-CHECKED, like the manager's: a daemon that exits must not delete a record that
+ * already belongs to its successor (a fast restart writes the new pid before the old process has
+ * finished unwinding), so the record goes only while it still names this process.
+ *
+ * A root with no `.cotal/` is not a workstation and gets no record — a hosted composition has none,
+ * and creating one here would plant a stray workspace root wherever the daemon happened to run.
+ */
+export declare function recordDeliveryPid(root: string, space: string): () => void;
 /**
  * Run the delivery daemon: the server-side Plane-3 durable backstop. A thin composition root that
  * builds a scoped `delivery` endpoint, acquires the single-flight lease, and runs the existing

package/dist/delivery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delivery.d.ts","sourceRoot":"","sources":["../src/delivery.ts"],"names":[],"mappings":"AACA,OAAO,EAcL,KAAK,UAAU,EACf,KAAK,WAAW,EAEjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAA0B,gBAAgB,EAAiF,MAAM,qBAAqB,CAAC;AAMnL;;;;wFAIwF;AACxF,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,CAAC;AA0GjD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAuQtF"}
+{"version":3,"file":"delivery.d.ts","sourceRoot":"","sources":["../src/delivery.ts"],"names":[],"mappings":"AAEA,OAAO,EAkBL,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,mBAAmB,EAEzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAuE,gBAAgB,EAAiK,MAAM,qBAAqB,CAAC;AAOhT;;;;wFAIwF;AACxF,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,CAAC;AAEjD,KAAK,WAAW,GAAG;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAExH;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,UAAU,CAAC,GAAG;IAAE,KAAK,CAAC,EAAE,WAAW,CAAA;CAAE,GACxE,mBAAmB,CAWrB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gCAAgC,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAatG;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAWhF;AAED;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAAC,IAAI,EAAE;IACvD,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,CAYP;AA+HD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,IAAI,CAqBzE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBtF"}