@cotal-ai/workspace 0.11.6 → 0.13.0

package/dist/renewal.js

@@ -2,6 +2,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { identityFromCreds, mintCreds, writeSecretFile, } from "@cotal-ai/core";
 import { authDir, loadSpaceAuth } from "./auth-paths.js";
+import { workspaceSecretStore } from "./secret-store-fs.js";
 /**
  * D5 slice 5 class-2 standing renewal — the RENEWAL OWNER'S half, shared by the manager (the
  * resident owner in every mesh mode) and `cotal doctor auth --fix` (the operator repair). The
@@ -9,30 +10,46 @@ import { authDir, loadSpaceAuth } from "./auth-paths.js";
  * passive 75% source re-read as backstop). Machine-local file work lives here in the workspace
  * layer: implementations never import each other.
  */
+/** The canonical secret-store key of the delivery daemon's scoped cred — by the FS convention the
+ *  key IS the filename under `.cotal/`. The single source for every tier (the CLI writer, the
+ *  delivery daemon reader, this renewal owner): a hand-copied drifted literal would silently split
+ *  the kind across two store entries with no compile error. Lives in workspace because the
+ *  key↔filename convention is the workspace layout's; implementations never import each other. */
+export const DELIVERY_CREDS_KEY = "delivery.creds";
 /** The seed-less daemon creds files a renewal owner re-signs. The $SYS files
  *  (membership-observer, connection-evictor) are deliberately ABSENT: they are rotation-renewed —
  *  no persisted seed can re-sign them, by design. */
 export const REMINTABLE_DAEMON_CREDS = [
-    { file: "delivery.creds", profile: "delivery" },
+    { file: DELIVERY_CREDS_KEY, profile: "delivery" },
     { file: "membership-rw.creds", profile: "membership-rw" },
 ];
 /** Re-sign the daemon creds files for their EXISTING nkeys (a renewal must never swap a daemon's
- *  identity — the daemon side pins it). Structured per-file results, never throws: a failed remint
- *  leaves the old cred running toward its loud expiry and the caller records/reports the failure. */
-export async function remintDaemonCreds(root) {
+ *  identity — the daemon side pins it). Reads and writes through the secret-store seam; `store` is
+ *  the renewal owner's injection point, SYMMETRIC with the daemon's `runDelivery(args, store?)`.
+ *  The manager — the D5 standing-renewal owner, and a hosted-path caller (manager.ts calls this
+ *  unconditionally) — must pass the SAME store it gives the daemon, or a hosted composition
+ *  re-signs into one store while the daemon reads another and rides to expiry. Threading the store
+ *  through the manager's entry is its own slice; until it lands, hosted end-to-end renewal on an
+ *  injected store is NOT yet wired, and no store means the local workspace FS composition (keys =
+ *  the filenames under `.cotal/`). The store's ATOMIC put is load-bearing here, because the daemons
+ *  re-read these files LIVE (the delivery endpoint's 75% source backstop, the membership rw
+ *  reconnect getter) and the plain `writeSecretFile` this replaced could tear such a concurrent
+ *  re-read. Structured per-file results, never throws: a failed remint leaves the old cred running
+ *  toward its loud expiry and the caller records/reports the failure. */
+export async function remintDaemonCreds(root, store) {
     const auth = loadSpaceAuth(authDir(root));
     if (!auth)
         return REMINTABLE_DAEMON_CREDS.map(({ file }) => ({ file, ok: false, skipped: "no-auth" }));
+    const s = store ?? workspaceSecretStore(root);
     const results = [];
     for (const { file, profile } of REMINTABLE_DAEMON_CREDS) {
-        const path = join(root, ".cotal", file);
-        if (!existsSync(path)) {
-            results.push({ file, ok: false, skipped: "missing-file" });
-            continue;
-        }
         try {
-            const identity = identityFromCreds(readFileSync(path, "utf8"));
-            writeSecretFile(path, await mintCreds(auth, identity, profile));
+            const current = await s.get(file);
+            if (current === undefined) {
+                results.push({ file, ok: false, skipped: "missing-file" });
+                continue;
+            }
+            await s.put(file, await mintCreds(auth, identityFromCreds(current), profile));
             results.push({ file, ok: true });
         }
         catch (e) {

package/dist/renewal.js.map

@@ -1 +1 @@
-{"version":3,"file":"renewal.js","sourceRoot":"","sources":["../src/renewal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,eAAe,GAEhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEzD;;;;;;GAMG;AAEH;;qDAEqD;AACrD,MAAM,CAAC,MAAM,uBAAuB,GAAsD;IACxF,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,UAAU,EAAE;IAC/C,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,eAAe,EAAE;CAC1D,CAAC;AAUF;;qGAEqG;AACrG,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAClD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,uBAAuB,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAkB,EAAE,CAAC,CAAC,CAAC;IAChH,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,uBAAuB,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC/D,eAAe,CAAC,IAAI,EAAE,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAeD,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,MAAqB;IACpE,eAAe,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAkB,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,qEAAqE;IACzF,CAAC;AACH,CAAC"}
+{"version":3,"file":"renewal.js","sourceRoot":"","sources":["../src/renewal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,eAAe,GAGhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D;;;;;;GAMG;AAEH;;;;kGAIkG;AAClG,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAEnD;;qDAEqD;AACrD,MAAM,CAAC,MAAM,uBAAuB,GAAsD;IACxF,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,UAAU,EAAE;IACjD,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,eAAe,EAAE;CAC1D,CAAC;AAUF;;;;;;;;;;;;yEAYyE;AACzE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAmB;IACvE,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,uBAAuB,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAkB,EAAE,CAAC,CAAC,CAAC;IAChH,MAAM,CAAC,GAAG,KAAK,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,uBAAuB,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC3D,SAAS;YACX,CAAC;YACD,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,SAAS,CAAC,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9E,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAeD,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,MAAqB;IACpE,eAAe,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAkB,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,qEAAqE;IACzF,CAAC;AACH,CAAC"}

package/dist/secret-store-fs.d.ts

@@ -0,0 +1,39 @@
+import { type SecretStore } from "@cotal-ai/core";
+/** THE local composition of the secret keyspace: a filesystem store rooted at the workspace's
+ *  `.cotal/` dir, so every canonical key (`delivery.creds`, `auth/<space>/callout.json`, …)
+ *  lands byte-for-byte on today's paths. Every local caller composes through here — a hand-rolled
+ *  root that drifted from `.cotal` would silently split the keyspace in two. */
+export declare function workspaceSecretStore(root: string): FsSecretStore;
+/**
+ * The default filesystem {@link SecretStore}: the workstation adapter behind core's abstract seam.
+ *
+ * Keys are opaque logical strings the owning packages build to MIRROR today's exact `.cotal` layout
+ * per kind — `delivery.creds`, `auth/callout.json`, `<agent>.creds`, and so on — so a local
+ * `cotal up` writes byte-for-byte the same files it does today. That layout is heterogeneous (a few
+ * kinds are already space-segmented on disk, most are not), so each key builder reproduces its
+ * kind's current path verbatim. Crucially the key carries NO injected tenant / `<space>` prefix: a
+ * hosted KMS/Vault adapter adds per-tenant scope inside ITS OWN resolve from its injection context,
+ * which keeps one backend-agnostic key per kind and preserves local byte-for-byte.
+ *
+ * This adapter adds nothing of its own: it delegates to the `secret-fs` primitives for the
+ * 0600 / icacls / atomic-replace / fail-closed guarantees. Constructed with an EXPLICIT base root
+ * (no ambient `~/.cotal`), absolutized so keys are cwd-independent. Lives in `@cotal-ai/workspace`,
+ * not core, because on-disk layout is a workstation concern, not the wire protocol.
+ *
+ * Residual (documented): a symlink UNDER the root that points outside is not caught (no realpath) —
+ * acceptable for a single-tenant workstation; a multi-tenant FS deployment should realpath-check.
+ */
+export declare class FsSecretStore implements SecretStore {
+    private readonly root;
+    constructor(root: string);
+    /** Resolve a logical key to an absolute path strictly UNDER `root`, fail-closed: reject empty,
+     *  NUL, absolute keys, the root itself (`.`), and any key that normalizes outside the root
+     *  (`..` traversal). Containment is checked via `path.relative`, not a `root + sep` prefix —
+     *  the prefix form breaks at a filesystem-root base (`/` doubles the separator and rejects
+     *  every key). A malformed key must never read or clobber a path outside the store's tree. */
+    private resolve;
+    get(key: string): Promise<string | undefined>;
+    put(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+//# sourceMappingURL=secret-store-fs.d.ts.map

package/dist/secret-store-fs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store-fs.d.ts","sourceRoot":"","sources":["../src/secret-store-fs.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsC,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAEtF;;;gFAGgF;AAChF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAEhE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,aAAc,YAAW,WAAW;IAC/C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;gBAElB,IAAI,EAAE,MAAM;IAKxB;;;;kGAI8F;IAC9F,OAAO,CAAC,OAAO;IAYT,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAU7C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM9C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAQzC"}

package/dist/secret-store-fs.js

@@ -0,0 +1,80 @@
+import { readFileSync, rmSync } from "node:fs";
+import { join, dirname, isAbsolute, normalize, relative, resolve, sep } from "node:path";
+import { mkSecretDir, writeSecretFileAtomic } from "@cotal-ai/core";
+/** THE local composition of the secret keyspace: a filesystem store rooted at the workspace's
+ *  `.cotal/` dir, so every canonical key (`delivery.creds`, `auth/<space>/callout.json`, …)
+ *  lands byte-for-byte on today's paths. Every local caller composes through here — a hand-rolled
+ *  root that drifted from `.cotal` would silently split the keyspace in two. */
+export function workspaceSecretStore(root) {
+    return new FsSecretStore(join(root, ".cotal"));
+}
+/**
+ * The default filesystem {@link SecretStore}: the workstation adapter behind core's abstract seam.
+ *
+ * Keys are opaque logical strings the owning packages build to MIRROR today's exact `.cotal` layout
+ * per kind — `delivery.creds`, `auth/callout.json`, `<agent>.creds`, and so on — so a local
+ * `cotal up` writes byte-for-byte the same files it does today. That layout is heterogeneous (a few
+ * kinds are already space-segmented on disk, most are not), so each key builder reproduces its
+ * kind's current path verbatim. Crucially the key carries NO injected tenant / `<space>` prefix: a
+ * hosted KMS/Vault adapter adds per-tenant scope inside ITS OWN resolve from its injection context,
+ * which keeps one backend-agnostic key per kind and preserves local byte-for-byte.
+ *
+ * This adapter adds nothing of its own: it delegates to the `secret-fs` primitives for the
+ * 0600 / icacls / atomic-replace / fail-closed guarantees. Constructed with an EXPLICIT base root
+ * (no ambient `~/.cotal`), absolutized so keys are cwd-independent. Lives in `@cotal-ai/workspace`,
+ * not core, because on-disk layout is a workstation concern, not the wire protocol.
+ *
+ * Residual (documented): a symlink UNDER the root that points outside is not caught (no realpath) —
+ * acceptable for a single-tenant workstation; a multi-tenant FS deployment should realpath-check.
+ */
+export class FsSecretStore {
+    root;
+    constructor(root) {
+        if (!root)
+            throw new Error("FsSecretStore: root is required");
+        this.root = normalize(resolve(root)); // absolutize so keys are cwd-independent
+    }
+    /** Resolve a logical key to an absolute path strictly UNDER `root`, fail-closed: reject empty,
+     *  NUL, absolute keys, the root itself (`.`), and any key that normalizes outside the root
+     *  (`..` traversal). Containment is checked via `path.relative`, not a `root + sep` prefix —
+     *  the prefix form breaks at a filesystem-root base (`/` doubles the separator and rejects
+     *  every key). A malformed key must never read or clobber a path outside the store's tree. */
+    resolve(key) {
+        if (!key || key.includes("\0"))
+            throw new Error(`FsSecretStore: invalid key ${JSON.stringify(key)}`);
+        if (isAbsolute(key))
+            throw new Error(`FsSecretStore: key must be relative, got ${JSON.stringify(key)}`);
+        const abs = normalize(join(this.root, key));
+        const rel = relative(this.root, abs);
+        if (!rel || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel))
+            throw new Error(`FsSecretStore: key must name a file under the root: ${JSON.stringify(key)}`);
+        return abs;
+    }
+    async get(key) {
+        const p = this.resolve(key);
+        try {
+            return readFileSync(p, "utf8");
+        }
+        catch (e) {
+            if (e.code === "ENOENT")
+                return undefined; // absent → undefined, race-safe
+            throw e;
+        }
+    }
+    async put(key, value) {
+        const p = this.resolve(key);
+        mkSecretDir(dirname(p)); // harden the parent dir before the secret lands (0700 / private ACL)
+        writeSecretFileAtomic(p, value); // temp + rename: a concurrent get sees old or new, never torn
+    }
+    async delete(key) {
+        const p = this.resolve(key);
+        try {
+            rmSync(p);
+        }
+        catch (e) {
+            if (e.code !== "ENOENT")
+                throw e; // already-absent is success (idempotent)
+        }
+    }
+}
+//# sourceMappingURL=secret-store-fs.js.map

package/dist/secret-store-fs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store-fs.js","sourceRoot":"","sources":["../src/secret-store-fs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAoB,MAAM,gBAAgB,CAAC;AAEtF;;;gFAGgF;AAChF,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,aAAa;IACP,IAAI,CAAS;IAE9B,YAAY,IAAY;QACtB,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,yCAAyC;IACjF,CAAC;IAED;;;;kGAI8F;IACtF,OAAO,CAAC,GAAW;QACzB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvE,IAAI,UAAU,CAAC,GAAG,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrF,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,uDAAuD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChG,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC,CAAC,gCAAgC;YACtG,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QAClC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,qEAAqE;QAC9F,qBAAqB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,8DAA8D;IACjG,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,CAAC,CAAC,CAAC,CAAC;QACZ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,CAAC,CAAC,CAAC,yCAAyC;QACxG,CAAC;IACH,CAAC;CACF"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cotal-ai/workspace",
   "description": "Cotal machine-local workstation layer: the ~/.cotal mesh registry, target resolution, preflight, on-disk auth-path I/O, and the command-copy renderer — operator concerns over a local checkout, kept separate from the wire protocol in @cotal-ai/core.",
-  "version": "0.11.6",
+  "version": "0.13.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -18,7 +18,7 @@
     }
   },
   "dependencies": {
-    "@cotal-ai/core": "0.11.6"
+    "@cotal-ai/core": "0.13.0"
   },
   "files": [
     "dist"
@@ -29,6 +29,6 @@
   "scripts": {
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "build": "tsc -p tsconfig.json",
-    "test": "tsx smoke/preflight.smoke.ts"
+    "test": "tsx smoke/preflight.smoke.ts && tsx smoke/maintenance.smoke.ts"
   }
 }