@cotal-ai/workspace 0.13.1 → 0.14.0

package/dist/mesh-registry.js

@@ -2,6 +2,7 @@ import { readFileSync, readdirSync, realpathSync, renameSync, rmSync } from "nod
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import { mkSecretDir, writeSecretFile } from "@cotal-ai/core";
+import { spaceSegment } from "./auth-paths.js";
 /** Runtime-validate a provider's opaque `publicAuth` blob into a {@link UserAuthInfo} — the
  *  workstation layer owns this shape (core stays IdP-agnostic), so the boundary where an
  *  arbitrary provider's metadata enters the registry is checked here, fail-loud. */
@@ -34,8 +35,43 @@ export function homeCotalDir() {
 export function meshesDir() {
     return join(homeCotalDir(), "meshes");
 }
+/** The canonical registry filename for a space: the workspace-wide injective `space.<hex>` segment
+ *  (see {@link spaceSegment}). Raw `encodeURIComponent` stems preserved ASCII case, so on a
+ *  case-insensitive filesystem two case-differing spaces addressed ONE registry file and the
+ *  second `up` silently swallowed the first mesh's record. The space's real name is authoritative
+ *  in the document; the filename only locates it. */
+function meshFileName(space) {
+    return `${spaceSegment(space)}.json`;
+}
 function meshFile(space) {
-    return join(meshesDir(), `${encodeURIComponent(space)}.json`);
+    return join(meshesDir(), meshFileName(space));
+}
+/** Remove every PRE-HEX registry file that records `space` (`<encodeURIComponent>.json` stems from
+ *  older builds). Matched by each document's own `space` - never by decoding the filename, which
+ *  would case-fold on this filesystem - so a legacy record can neither shadow nor resurrect a mesh
+ *  the canonical file no longer records. A file that will not parse is left for {@link loadMeshes}
+ *  to skip. */
+function removeLegacyMeshFiles(space) {
+    let files;
+    try {
+        files = readdirSync(meshesDir());
+    }
+    catch {
+        return; // no registry yet
+    }
+    const canonical = meshFileName(space);
+    for (const f of files) {
+        if (f === canonical || !f.endsWith(".json"))
+            continue;
+        try {
+            const doc = JSON.parse(readFileSync(join(meshesDir(), f), "utf8"));
+            if (doc.space === space)
+                rmSync(join(meshesDir(), f), { force: true });
+        }
+        catch {
+            /* unparseable stray - not provably this space's record, leave it */
+        }
+    }
 }
 function currentFile() {
     return join(homeCotalDir(), "current-mesh");
@@ -52,10 +88,12 @@ export function recordMesh(m) {
     const tmp = `${file}.${process.pid}.tmp`;
     writeSecretFile(tmp, JSON.stringify(m, null, 2)); // hardened before rename; rename preserves the ACL/mode
     renameSync(tmp, file); // atomic replace — a reader never sees a half-written record
+    removeLegacyMeshFiles(m.space); // a pre-hex record for this space must not survive as a duplicate
 }
 /** Drop a mesh from the registry (on `cotal down` / a stale-entry prune). Absent ⇒ no-op. */
 export function removeMesh(space) {
     rmSync(meshFile(space), { force: true });
+    removeLegacyMeshFiles(space); // else a pre-hex record would resurrect the mesh in every listing
 }
 /** Canonicalize a project root for comparison. A recorded root is whatever spelling `cotal up` was
  *  run under, so the same directory reaches us by several names: a symlinked root (macOS `/var` →
@@ -93,7 +131,9 @@ export function removeMeshesByRoot(root) {
     return removed;
 }
 /** All currently-recorded meshes. An unparseable/partially-written entry is skipped, not fatal —
- *  one bad file must not hide the rest. */
+ *  one bad file must not hide the rest. One record per space: if a pre-hex legacy file and the
+ *  canonical `space.<hex>` file both name the same space (a crash between {@link recordMesh}'s
+ *  write and its legacy sweep), the canonical one wins — it is the newer scheme's write. */
 export function loadMeshes() {
     let files;
     try {
@@ -102,16 +142,29 @@ export function loadMeshes() {
     catch {
         return []; // no registry yet
     }
-    const out = [];
+    const bySpace = new Map();
     for (const f of files.sort()) {
+        let entry;
+        try {
+            entry = JSON.parse(readFileSync(join(meshesDir(), f), "utf8"));
+        }
+        catch {
+            continue; /* skip a corrupt/half-written entry rather than fail the whole listing */
+        }
+        if (typeof entry.space !== "string" || !entry.space)
+            continue; // every consumer keys on space
+        let canonical = false;
         try {
-            out.push(JSON.parse(readFileSync(join(meshesDir(), f), "utf8")));
+            canonical = f === meshFileName(entry.space);
         }
         catch {
-            /* skip a corrupt/half-written entry rather than fail the whole listing */
+            /* a degenerate space name in the doc has no canonical filename - rank it as legacy */
         }
+        const prev = bySpace.get(entry.space);
+        if (!prev || (canonical && !prev.canonical))
+            bySpace.set(entry.space, { entry, canonical });
     }
-    return out;
+    return [...bySpace.values()].map((v) => v.entry);
 }
 export function findMesh(space) {
     return loadMeshes().find((m) => m.space === space);

package/dist/mesh-registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"mesh-registry.js","sourceRoot":"","sources":["../src/mesh-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACtF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAiD9D;;oFAEoF;AACpF,MAAM,UAAU,kBAAkB,CAAC,CAAU;IAC3C,MAAM,CAAC,GAAG,CAAiB,CAAC;IAC5B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ;QACtF,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG;QAC1F,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ;QAC5G,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QACrF,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;QACpG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACtG,CAAC;AAED;;;;6DAI6D;AAC7D,MAAM,UAAU,YAAY;IAC1B,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IAC1D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,SAAS;IACvB,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,cAAc,CAAC,CAAC;AAC9C,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,UAAU,CAAC,CAAY;IACrC,iGAAiG;IACjG,0FAA0F;IAC1F,qCAAqC;IACrC,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC/B,4FAA4F;IAC5F,uCAAuC;IACvC,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACzC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,wDAAwD;IAC1G,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,6DAA6D;AACtF,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED;;;;gDAIgD;AAChD,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC;QAAC,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AACrE,CAAC;AAED;;;;;iGAKiG;AACjG,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC;AACvE,CAAC;AAED;4FAC4F;AAC5F,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,UAAU,EAAE,KAAK,CAAC,CAAC,KAAK;YAAE,YAAY,EAAE,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;2CAC2C;AAC3C,MAAM,UAAU,UAAU;IACxB,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,kBAAkB;IAC/B,CAAC;IACD,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAc,CAAC,CAAC;QAChF,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,OAAO,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AACrD,CAAC;AAED;;oBAEoB;AACpB,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC;IAC5B,eAAe,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"mesh-registry.js","sourceRoot":"","sources":["../src/mesh-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACtF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAiD/C;;oFAEoF;AACpF,MAAM,UAAU,kBAAkB,CAAC,CAAU;IAC3C,MAAM,CAAC,GAAG,CAAiB,CAAC;IAC5B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ;QACtF,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG;QAC1F,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ;QAC5G,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QACrF,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;QACpG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACtG,CAAC;AAED;;;;6DAI6D;AAC7D,MAAM,UAAU,YAAY;IAC1B,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IAC1D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,SAAS;IACvB,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED;;;;qDAIqD;AACrD,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC;AACvC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;eAIe;AACf,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,kBAAkB;IAC5B,CAAC;IACD,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAc,CAAC;YAChF,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;gBAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,cAAc,CAAC,CAAC;AAC9C,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,UAAU,CAAC,CAAY;IACrC,iGAAiG;IACjG,0FAA0F;IAC1F,qCAAqC;IACrC,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC/B,4FAA4F;IAC5F,uCAAuC;IACvC,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACzC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,wDAAwD;IAC1G,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,6DAA6D;IACpF,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,kEAAkE;AACpG,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,kEAAkE;AAClG,CAAC;AAED;;;;gDAIgD;AAChD,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC;QAAC,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AACrE,CAAC;AAED;;;;;iGAKiG;AACjG,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC;AACvE,CAAC;AAED;4FAC4F;AAC5F,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,UAAU,EAAE,KAAK,CAAC,CAAC,KAAK;YAAE,YAAY,EAAE,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;4FAG4F;AAC5F,MAAM,UAAU,UAAU;IACxB,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,kBAAkB;IAC/B,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoD,CAAC;IAC5E,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7B,IAAI,KAAgB,CAAC;QACrB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAc,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,0EAA0E;QACtF,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK;YAAE,SAAS,CAAC,+BAA+B;QAC9F,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,sFAAsF;QACxF,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,OAAO,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AACrD,CAAC;AAED;;oBAEoB;AACpB,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC;IAC5B,eAAe,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACzC,CAAC"}

package/dist/mesh-target.d.ts

@@ -43,7 +43,7 @@ export interface ResolveFlags {
 /** The distinct, command-agnostic reasons {@link resolveMeshTarget} can't pick a single mesh. Each
  *  maps 1:1 to a former prose-throw; the recovery copy (`cotal up`/`meshes`/`use`) is the renderer's
  *  job ({@link renderWorkspaceError}), not the protocol's. */
-export type MeshTargetErrorCode = "no-meshes" | "unknown-space" | "ambiguous-target" | "default-occupied" | "stale-auth-root" | "user-auth-unrecorded";
+export type MeshTargetErrorCode = "no-meshes" | "unknown-space" | "ambiguous-target" | "default-occupied" | "stale-auth-root" | "unreadable-auth" | "user-auth-unrecorded";
 /** Structured context for a {@link MeshTargetError} — enough for any surface to render its own
  *  recovery affordance (a CLI sentence, a web button, an SDK embed that wants no command at all). */
 export interface MeshTargetErrorDetails {

package/dist/mesh-target.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mesh-target.d.ts","sourceRoot":"","sources":["../src/mesh-target.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiC,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE/E,OAAO,EAML,KAAK,SAAS,EACd,KAAK,YAAY,EAClB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd;uFACmF;IACnF,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACxB;;sEAEkE;IAClE,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;4GAMwG;IACxG,MAAM,EACF,aAAa,GACb,YAAY,GACZ,qBAAqB,GACrB,aAAa,GACb,gBAAgB,GAChB,UAAU,GACV,SAAS,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;8DAE8D;AAC9D,MAAM,MAAM,mBAAmB,GAC3B,WAAW,GACX,eAAe,GACf,kBAAkB,GAClB,kBAAkB,GAClB,iBAAiB,GACjB,sBAAsB,CAAC;AAE3B;qGACqG;AACrG,MAAM,WAAW,sBAAsB;IACrC,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAID;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,mFAAmF;IACnF,QAAQ,CAAC,KAAK,uCAA0B;IACxC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;gBAEvC,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,sBAA2B,EACpC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAOhC;AAED;uGACuG;AACvG,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,eAAe,CAMvE;AAmGD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,YAAiB,GAAG,UAAU,CAyDnF"}
+{"version":3,"file":"mesh-target.d.ts","sourceRoot":"","sources":["../src/mesh-target.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiC,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE/E,OAAO,EAML,KAAK,SAAS,EACd,KAAK,YAAY,EAClB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd;uFACmF;IACnF,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACxB;;sEAEkE;IAClE,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;4GAMwG;IACxG,MAAM,EACF,aAAa,GACb,YAAY,GACZ,qBAAqB,GACrB,aAAa,GACb,gBAAgB,GAChB,UAAU,GACV,SAAS,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;8DAE8D;AAC9D,MAAM,MAAM,mBAAmB,GAC3B,WAAW,GACX,eAAe,GACf,kBAAkB,GAClB,kBAAkB,GAClB,iBAAiB,GACjB,iBAAiB,GACjB,sBAAsB,CAAC;AAE3B;qGACqG;AACrG,MAAM,WAAW,sBAAsB;IACrC,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAID;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,mFAAmF;IACnF,QAAQ,CAAC,KAAK,uCAA0B;IACxC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;gBAEvC,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,sBAA2B,EACpC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAOhC;AAED;uGACuG;AACvG,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,eAAe,CAMvE;AAiJD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,YAAiB,GAAG,UAAU,CA4FnF"}

package/dist/mesh-target.js

@@ -1,7 +1,7 @@
-import { existsSync, readdirSync } from "node:fs";
+import { existsSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { DEFAULT_SERVER, DEFAULT_SPACE } from "@cotal-ai/core";
-import { authDir, findCotalRoot, loadSpaceAuth, userAuthStateDir } from "./auth-paths.js";
+import { accountInventory, authDir, findCotalRoot, hasUserAuthState, listSpaceAccounts, loadSpaceAuth, soleSpaceOf, userAuthSpacesOnDisk } from "./auth-paths.js";
 import { findMesh, getCurrent, homeCotalDir, loadMeshes, removeMesh, } from "./mesh-registry.js";
 const WORKSPACE_TARGET_ERROR = "cotal:workspace:mesh-target-error";
 /**
@@ -31,6 +31,43 @@ export function isWorkspaceTargetError(e) {
 function personaRoot(root) {
     return join(root, ".cotal", "agents");
 }
+/** Refuse to resolve a single mesh when ROOT's on-disk account inventory says it hosts more than
+ *  one tenant (or an unreadable one). The disk is the tenant authority ahead of the registry: a
+ *  broker with several account records is several tenants even if only one is registered, so any
+ *  path that would otherwise auto-pick (a bare local root, a `--server` that names this broker)
+ *  must refuse here. `--space` is the way to name one. A root with 0 or 1 accounts (open or
+ *  single-tenant) passes untouched. */
+/** Load a space's composed trust, converting a COMPOSITION failure into a typed target error. The
+ *  record can pass the on-disk shape gate yet fail to compose - a malformed account JWT, or a
+ *  well-formed one signed by a foreign operator - and `loadSpaceAuth` throws a raw error there.
+ *  Every resolver caller is a surface (`status`, `spawn`, the web dashboard) that must present a
+ *  legible failure, not crash on an uncaught throw, so the throw becomes `unreadable-auth`. An
+ *  absent record is not a failure here - it returns undefined, same as `loadSpaceAuth`. */
+function loadTrustOrThrow(root, space) {
+    try {
+        return loadSpaceAuth(authDir(root), space);
+    }
+    catch (e) {
+        throw new MeshTargetError("unreadable-auth", e.message, { space, root });
+    }
+}
+function assertRootIsSingleTenant(root) {
+    // `accountInventory`'s readdir can THROW (EACCES/ELOOP on `.cotal/auth`): it lets that propagate
+    // so the broker-wide guards fail CLOSED, but the resolver is a presentation surface and must
+    // convert it to a typed error, or `status`/`spawn` crash on the raw throw. An unreadable auth dir
+    // is unreadable trust.
+    let inv;
+    try {
+        inv = accountInventory(authDir(root));
+    }
+    catch (e) {
+        throw new MeshTargetError("unreadable-auth", e.message, { root });
+    }
+    if (inv.corrupt.length > 0)
+        throw new MeshTargetError("ambiguous-target", `${root} holds ${inv.corrupt.length} unreadable account record(s) (${inv.corrupt.join(", ")}) - the tenant list is uncertain; repair or remove them`, { root });
+    if (inv.spaces.length > 1)
+        throw new MeshTargetError("ambiguous-target", `${root}'s broker holds accounts for ${inv.spaces.length} spaces (${inv.spaces.join(", ")}) - name one with --space`, { root, available: inv.spaces });
+}
 function targetFromEntry(m, server, source) {
     // Honor the recorded mode: an OPEN mesh connects credlessly even if its root still has auth
     // material on disk (e.g. a root that once ran auth mode). Loading it would make `spawn` mint
@@ -39,13 +76,23 @@ function targetFromEntry(m, server, source) {
     let auth;
     let userAuth;
     if (m.mode === "auth") {
-        auth = loadSpaceAuth(authDir(m.root));
-        // Defense in depth: the root's on-disk auth must still be for THIS space. A divergence (the root
+        // Space-KEYED load: ask for this entry's own space rather than "the" auth of the root, so a
+        // root serving several spaces can never hand back a neighbour's account. A record that will not
+        // COMPOSE into usable trust (malformed account JWT, or one signed by a foreign operator) throws
+        // inside `loadSpaceAuth`; convert it to a typed target error so a caller like `status` reports
+        // it and exits 0 instead of crashing on the raw compose throw.
+        auth = loadTrustOrThrow(m.root, m.space);
+        // Defense in depth: the root's on-disk auth must still cover THIS space. A divergence (the root
         // was re-`up`ed as a different space without re-recording) would otherwise mint mesh-A creds
-        // against the entry for space B. Prune the stale entry and fail loud rather than connect wrong.
-        if (auth && auth.space !== m.space) {
-            removeMesh(m.space);
-            throw new MeshTargetError("stale-auth-root", `registry entry "${m.space}" points at ${m.root}, whose on-disk auth is now for "${auth.space}"`, { space: m.space, root: m.root, found: auth.space });
+        // against the entry for space B. Now that the load is space-keyed the divergence surfaces as an
+        // ABSENT account rather than a mismatched one, so detect it by what the root DOES hold; prune
+        // the stale entry and fail loud rather than connect wrong.
+        if (!auth) {
+            const found = listSpaceAccounts(authDir(m.root));
+            if (found.length) {
+                removeMesh(m.space);
+                throw new MeshTargetError("stale-auth-root", `registry entry "${m.space}" points at ${m.root}, whose on-disk auth is now for "${found.join('", "')}"`, { space: m.space, root: m.root, found: found.join(", ") });
+            }
         }
     }
     else if (m.mode === "user") {
@@ -67,8 +114,18 @@ function targetFromEntry(m, server, source) {
     };
 }
 function localTarget(root, server, source) {
-    const auth = loadSpaceAuth(authDir(root));
-    const space = auth?.space ?? DEFAULT_SPACE;
+    // No registry entry and no explicit space, so the root itself must name exactly one space;
+    // `soleSpaceOf` fails loud rather than picking one when it holds several (or the tenant list is
+    // unreadable). Surface that as a catchable target error so a caller like `status` reports it as an
+    // ambiguous target instead of crashing on an uncaught throw.
+    let space;
+    try {
+        space = soleSpaceOf(authDir(root)) ?? DEFAULT_SPACE;
+    }
+    catch (e) {
+        throw new MeshTargetError("ambiguous-target", e.message, { root });
+    }
+    const auth = loadTrustOrThrow(root, space);
     // U10 guard: a user-auth space resolved WITHOUT its registry entry (pruned/never recorded) must
     // not silently static-mint — static creds DO work on a user-auth broker, which would connect the
     // operator on the wrong identity plane. The on-disk marker is the space-scoped user-auth state
@@ -77,7 +134,7 @@ function localTarget(root, server, source) {
     // proves user auth was enabled here, and the alternative would classify the root "open" and
     // connect credlessly toward a user-auth broker. Fail closed on the marker, whichever half died.
     const userSpace = auth
-        ? existsSync(userAuthStateDir(root, space))
+        ? hasUserAuthState(root, space)
             ? space
             : undefined
         : userAuthSpacesOnDisk(authDir(root))[0];
@@ -85,21 +142,6 @@ function localTarget(root, server, source) {
         throw new MeshTargetError("user-auth-unrecorded", `space "${userSpace}" has user auth enabled on disk but no usable registry entry`, { space: userSpace, root });
     return { root, server, space, mode: auth ? "auth" : "open", auth, personaRoot: personaRoot(root), source };
 }
-/** Space names with user-auth state under a root's auth dir, detectable WITHOUT `auth.json`: each
- *  enabled space is a subdirectory (encodeURIComponent(space)) holding the provider's pinned
- *  material — `idp.json` is written first at enable, `callout.json` right after, so either one
- *  marks the dir as user-auth state (never confusable with a stray empty folder). */
-function userAuthSpacesOnDisk(dir) {
-    try {
-        return readdirSync(dir, { withFileTypes: true })
-            .filter((e) => e.isDirectory() &&
-            (existsSync(join(dir, e.name, "idp.json")) || existsSync(join(dir, e.name, "callout.json"))))
-            .map((e) => decodeURIComponent(e.name));
-    }
-    catch {
-        return []; // no auth dir at all — nothing user-auth here
-    }
-}
 /** A `.cotal/` that a user actually created here — not the machine-home dir the cwd walk-up lands on
  *  from outside any project (which has no space, just the daemon's pid/onboard files). */
 function isGenuineSpace(root) {
@@ -131,9 +173,22 @@ export function resolveMeshTarget(cwd, flags = {}) {
         return targetFromEntry(m, flags.server ?? m.server, overriding ? "flag-space-override" : "flag-space");
     }
     if (flags.server) {
-        const m = loadMeshes().find((e) => e.server === flags.server);
-        if (m)
-            return targetFromEntry(m, flags.server, "flag-server");
+        // One broker can host several spaces, and each records its own registry entry under the SAME
+        // server URL - so "the entry on that server" is not a single thing. `.find()` would silently
+        // hand back whichever sorted first, connecting the caller to an arbitrary tenant; refuse and
+        // name them instead (`--space` picks one explicitly, handled above).
+        const onServer = loadMeshes().filter((e) => e.server === flags.server);
+        if (onServer.length > 1)
+            throw new MeshTargetError("ambiguous-target", `${onServer.length} spaces are recorded at ${flags.server} (${onServer.map((e) => e.space).join(", ")}) - name one with --space`, { server: flags.server, available: onServer.map((e) => `${e.space} (${e.root})`) });
+        if (onServer[0]) {
+            // `--server` names a BROKER, not a tenant. One registry row at that server does not prove the
+            // broker hosts one tenant: the row's own root may hold several account records on disk with
+            // only this one registered (a pruned/partial registration). The disk is the authority - if it
+            // shows several tenants (or an unreadable one), `--server` alone cannot pick, same as the bare
+            // local branch below.
+            assertRootIsSingleTenant(onServer[0].root);
+            return targetFromEntry(onServer[0], flags.server, "flag-server");
+        }
         return localTarget(findCotalRoot(cwd), flags.server, "flag-server");
     }
     const meshes = loadMeshes();
@@ -143,11 +198,24 @@ export function resolveMeshTarget(cwd, flags = {}) {
         return targetFromEntry(cur, cur.server, "current");
     const root = findCotalRoot(cwd);
     if (isGenuineSpace(root)) {
+        // The DISK is the tenant authority for this root, before any registry record: a broker whose
+        // auth dir holds several accounts stays several tenants even when only one of them happens to
+        // be registered (a pruned entry, a partial registration). Trusting the single surviving record
+        // here would silently resolve a multi-tenant root to whichever tenant kept its record - the
+        // same auto-pick `soleSpaceOf` refuses on the unrecorded path. And an UNREADABLE record means
+        // the tenant count itself is uncertain, which cannot resolve to a single mesh either.
+        assertRootIsSingleTenant(root);
         // For a local project, if its mesh is in the registry, use the RECORDED server +
         // mode, not DEFAULT_SERVER: a project started with `--server …:4333` must spawn against :4333,
         // and a recorded OPEN mesh must not mint creds off stale `.cotal/auth` left on disk. Fall back
         // to the local default only when nothing is recorded for this root.
-        const recorded = meshes.find((m) => resolve(m.root) === resolve(root));
+        const rootMatches = meshes.filter((m) => resolve(m.root) === resolve(root));
+        // A broker that runs several spaces records one entry per space, all under this same root. With no
+        // `--space` to pick one, `.find()` would silently resolve whichever sorted first; name the tenants
+        // and refuse instead (the same posture as `soleSpaceOf` for an unrecorded multi-space root).
+        if (rootMatches.length > 1)
+            throw new MeshTargetError("ambiguous-target", `this folder's broker hosts ${rootMatches.length} spaces (${rootMatches.map((m) => m.space).join(", ")}) - name one with --space`, { available: rootMatches.map((m) => `${m.space} (${m.root})`) });
+        const recorded = rootMatches[0];
         if (recorded)
             return targetFromEntry(recorded, recorded.server, "local-recorded");
         // No record for this root (migration, or our broker went down and the entry was just pruned).

package/dist/mesh-target.js.map

@@ -1 +1 @@
-{"version":3,"file":"mesh-target.js","sourceRoot":"","sources":["../src/mesh-target.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAkB,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC1F,OAAO,EACL,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,UAAU,EACV,UAAU,GAGX,MAAM,oBAAoB,CAAC;AA+E5B,MAAM,sBAAsB,GAAG,mCAAmC,CAAC;AAEnE;;;;GAIG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,mFAAmF;IAC1E,KAAK,GAAG,sBAAsB,CAAC;IAC/B,IAAI,CAAsB;IAC1B,OAAO,CAAyB;IACzC,YACE,IAAyB,EACzB,OAAe,EACf,UAAkC,EAAE,EACpC,OAA6B;QAE7B,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED;uGACuG;AACvG,MAAM,UAAU,sBAAsB,CAAC,CAAU;IAC/C,OAAO,CACL,OAAO,CAAC,KAAK,QAAQ;QACrB,CAAC,KAAK,IAAI;QACT,CAAyB,CAAC,KAAK,KAAK,sBAAsB,CAC5D,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,eAAe,CAAC,CAAY,EAAE,MAAc,EAAE,MAA4B;IACjF,4FAA4F;IAC5F,6FAA6F;IAC7F,gGAAgG;IAChG,+FAA+F;IAC/F,IAAI,IAA2B,CAAC;IAChC,IAAI,QAAkC,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACtB,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,iGAAiG;QACjG,6FAA6F;QAC7F,gGAAgG;QAChG,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;YACnC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,mBAAmB,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,IAAI,oCAAoC,IAAI,CAAC,KAAK,GAAG,EAChG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CACpD,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC7B,8FAA8F;QAC9F,4EAA4E;QAC5E,IAAI,CAAC,CAAC,CAAC,QAAQ;YACb,MAAM,IAAI,eAAe,CACvB,sBAAsB,EACtB,mBAAmB,CAAC,CAAC,KAAK,4CAA4C,EACtE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CACjC,CAAC;QACJ,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;IACxB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM;QACN,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI;QACJ,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QAChC,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc,EAAE,MAA4B;IAC7E,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,aAAa,CAAC;IAC3C,gGAAgG;IAChG,iGAAiG;IACjG,+FAA+F;IAC/F,gGAAgG;IAChG,iGAAiG;IACjG,4FAA4F;IAC5F,gGAAgG;IAChG,MAAM,SAAS,GAAG,IAAI;QACpB,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACzC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,SAAS;QACb,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,SAAS,KAAK,SAAS;QACzB,MAAM,IAAI,eAAe,CACvB,sBAAsB,EACtB,UAAU,SAAS,8DAA8D,EACjF,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAC3B,CAAC;IACJ,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;AAC7G,CAAC;AAED;;;qFAGqF;AACrF,SAAS,oBAAoB,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aAC7C,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,WAAW,EAAE;YACf,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,CAC/F;aACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,8CAA8C;IAC3D,CAAC;AACH,CAAC;AAED;0FAC0F;AAC1F,SAAS,cAAc,CAAC,IAAY;IAClC,+FAA+F;IAC/F,oFAAoF;IACpF,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;AACvG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,QAAsB,EAAE;IACrE,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC;YACJ,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,kBAAkB,KAAK,CAAC,KAAK,cAAc,EAAE;gBACtF,SAAS,EAAE,KAAK,CAAC,KAAK;aACvB,CAAC,CAAC;QACL,kGAAkG;QAClG,mGAAmG;QACnG,mGAAmG;QACnG,+DAA+D;QAC/D,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC;QAC3E,OAAO,eAAe,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACzG,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC;YAAE,OAAO,eAAe,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC9D,OAAO,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,IAAI,GAAG;QAAE,OAAO,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAE5D,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,iFAAiF;QACjF,+FAA+F;QAC/F,+FAA+F;QAC/F,oEAAoE;QACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,IAAI,QAAQ;YAAE,OAAO,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAClF,8FAA8F;QAC9F,+FAA+F;QAC/F,6FAA6F;QAC7F,mEAAmE;QACnE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CACxE,CAAC;QACF,IAAI,SAAS;YACX,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,kBAAkB,SAAS,CAAC,KAAK,oBAAoB,cAAc,EAAE,EACrE,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CACnD,CAAC;QACJ,OAAO,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IACnF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAEzF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IAC1D,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,4BAA4B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;QAC5F,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"mesh-target.js","sourceRoot":"","sources":["../src/mesh-target.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAkB,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAClK,OAAO,EACL,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,UAAU,EACV,UAAU,GAGX,MAAM,oBAAoB,CAAC;AAgF5B,MAAM,sBAAsB,GAAG,mCAAmC,CAAC;AAEnE;;;;GAIG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,mFAAmF;IAC1E,KAAK,GAAG,sBAAsB,CAAC;IAC/B,IAAI,CAAsB;IAC1B,OAAO,CAAyB;IACzC,YACE,IAAyB,EACzB,OAAe,EACf,UAAkC,EAAE,EACpC,OAA6B;QAE7B,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED;uGACuG;AACvG,MAAM,UAAU,sBAAsB,CAAC,CAAU;IAC/C,OAAO,CACL,OAAO,CAAC,KAAK,QAAQ;QACrB,CAAC,KAAK,IAAI;QACT,CAAyB,CAAC,KAAK,KAAK,sBAAsB,CAC5D,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED;;;;;uCAKuC;AACvC;;;;;2FAK2F;AAC3F,SAAS,gBAAgB,CAAC,IAAY,EAAE,KAAa;IACnD,IAAI,CAAC;QACH,OAAO,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAG,CAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY;IAC5C,iGAAiG;IACjG,6FAA6F;IAC7F,kGAAkG;IAClG,uBAAuB;IACvB,IAAI,GAA4C,CAAC;IACjD,IAAI,CAAC;QACH,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAG,CAAW,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QACxB,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,GAAG,IAAI,UAAU,GAAG,CAAC,OAAO,CAAC,MAAM,kCAAkC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,yDAAyD,EACpJ,EAAE,IAAI,EAAE,CACT,CAAC;IACJ,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACvB,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,GAAG,IAAI,gCAAgC,GAAG,CAAC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,EACpH,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,CAChC,CAAC;AACN,CAAC;AAED,SAAS,eAAe,CAAC,CAAY,EAAE,MAAc,EAAE,MAA4B;IACjF,4FAA4F;IAC5F,6FAA6F;IAC7F,gGAAgG;IAChG,+FAA+F;IAC/F,IAAI,IAA2B,CAAC;IAChC,IAAI,QAAkC,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACtB,4FAA4F;QAC5F,gGAAgG;QAChG,gGAAgG;QAChG,+FAA+F;QAC/F,+DAA+D;QAC/D,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACzC,gGAAgG;QAChG,6FAA6F;QAC7F,gGAAgG;QAChG,8FAA8F;QAC9F,2DAA2D;QAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACjD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,mBAAmB,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,IAAI,oCAAoC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EACxG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1D,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC7B,8FAA8F;QAC9F,4EAA4E;QAC5E,IAAI,CAAC,CAAC,CAAC,QAAQ;YACb,MAAM,IAAI,eAAe,CACvB,sBAAsB,EACtB,mBAAmB,CAAC,CAAC,KAAK,4CAA4C,EACtE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CACjC,CAAC;QACJ,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;IACxB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM;QACN,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI;QACJ,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QAChC,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc,EAAE,MAA4B;IAC7E,2FAA2F;IAC3F,gGAAgG;IAChG,mGAAmG;IACnG,6DAA6D;IAC7D,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,aAAa,CAAC;IACtD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAG,CAAW,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3C,gGAAgG;IAChG,iGAAiG;IACjG,+FAA+F;IAC/F,gGAAgG;IAChG,iGAAiG;IACjG,4FAA4F;IAC5F,gGAAgG;IAChG,MAAM,SAAS,GAAG,IAAI;QACpB,CAAC,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC;YAC7B,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,SAAS;QACb,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,SAAS,KAAK,SAAS;QACzB,MAAM,IAAI,eAAe,CACvB,sBAAsB,EACtB,UAAU,SAAS,8DAA8D,EACjF,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAC3B,CAAC;IACJ,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;AAC7G,CAAC;AAED;0FAC0F;AAC1F,SAAS,cAAc,CAAC,IAAY;IAClC,+FAA+F;IAC/F,oFAAoF;IACpF,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;AACvG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,QAAsB,EAAE;IACrE,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC;YACJ,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,kBAAkB,KAAK,CAAC,KAAK,cAAc,EAAE;gBACtF,SAAS,EAAE,KAAK,CAAC,KAAK;aACvB,CAAC,CAAC;QACL,kGAAkG;QAClG,mGAAmG;QACnG,mGAAmG;QACnG,+DAA+D;QAC/D,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC;QAC3E,OAAO,eAAe,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACzG,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,6FAA6F;QAC7F,6FAA6F;QAC7F,6FAA6F;QAC7F,qEAAqE;QACrE,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC;QACvE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YACrB,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,GAAG,QAAQ,CAAC,MAAM,2BAA2B,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAChI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CACnF,CAAC;QACJ,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAChB,8FAA8F;YAC9F,4FAA4F;YAC5F,8FAA8F;YAC9F,+FAA+F;YAC/F,sBAAsB;YACtB,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC3C,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,IAAI,GAAG;QAAE,OAAO,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAE5D,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,6FAA6F;QAC7F,8FAA8F;QAC9F,+FAA+F;QAC/F,4FAA4F;QAC5F,8FAA8F;QAC9F,sFAAsF;QACtF,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAC/B,iFAAiF;QACjF,+FAA+F;QAC/F,+FAA+F;QAC/F,oEAAoE;QACpE,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5E,mGAAmG;QACnG,mGAAmG;QACnG,6FAA6F;QAC7F,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;YACxB,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,8BAA8B,WAAW,CAAC,MAAM,YAAY,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,EACjI,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAChE,CAAC;QACJ,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,QAAQ;YAAE,OAAO,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAClF,8FAA8F;QAC9F,+FAA+F;QAC/F,6FAA6F;QAC7F,mEAAmE;QACnE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CACxE,CAAC;QACF,IAAI,SAAS;YACX,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,kBAAkB,SAAS,CAAC,KAAK,oBAAoB,cAAc,EAAE,EACrE,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CACnD,CAAC;QACJ,OAAO,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IACnF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAEzF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IAC1D,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,4BAA4B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;QAC5F,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC"}

package/dist/official-connectors.d.ts

@@ -9,6 +9,18 @@
  * must not import the CLI — it is pure data supplied to the generic materialize/hint path.
  */
 export declare const OFFICIAL_CONNECTORS: Readonly<Record<string, string>>;
+/** A first-party extension the umbrella (`cotal-ai`) bundles and versions in lockstep: its npm package
+ *  plus the repo-relative source dir the prepack copy and dev seeding resolve it from. This is the four
+ *  connectors PLUS the web dashboard — every first-party piece the binary ships and the seed reconcile
+ *  keeps at the binary's own version, so `npm i -g cotal-ai@X` carries them all at X with no separate
+ *  fetch and no version skew. A third-party `cotal ext add`ed package is NOT here; it versions on its
+ *  own line. web lives in `implementations/web` (the connectors under `extensions/`), hence the explicit
+ *  source dir rather than a derived `extensions/<name>`. */
+export interface SeededExtension {
+    readonly pkg: string;
+    readonly srcDir: string;
+}
+export declare const SEEDED_EXTENSIONS: Readonly<Record<string, SeededExtension>>;
 /** The default connector/agent type when `COTAL_DEFAULT_AGENT` is unset (David's locked decision). */
 export declare const DEFAULT_CONNECTOR = "claude";
 /** `cotal` is reserved: it is the binary's own name, so a connector must never claim it (there is no

package/dist/official-connectors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"official-connectors.d.ts","sourceRoot":"","sources":["../src/official-connectors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAKhE,CAAC;AAEF,sGAAsG;AACtG,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C;kFACkF;AAClF,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAAc,CAAC;AAErE;mGACmG;AACnG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKzD"}
+{"version":3,"file":"official-connectors.d.ts","sourceRoot":"","sources":["../src/official-connectors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAKhE,CAAC;AAEF;;;;;;4DAM4D;AAC5D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAKvE,CAAC;AAEF,sGAAsG;AACtG,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C;kFACkF;AAClF,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAAc,CAAC;AAErE;mGACmG;AACnG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKzD"}

package/dist/official-connectors.js

@@ -14,6 +14,10 @@ export const OFFICIAL_CONNECTORS = {
     hermes: "@cotal-ai/connector-hermes",
     pi: "@cotal-ai/pi",
 };
+export const SEEDED_EXTENSIONS = {
+    ...Object.fromEntries(Object.entries(OFFICIAL_CONNECTORS).map(([name, pkg]) => [name, { pkg, srcDir: `extensions/${pkg.split("/")[1]}` }])),
+    web: { pkg: "@cotal-ai/web", srcDir: "implementations/web" },
+};
 /** The default connector/agent type when `COTAL_DEFAULT_AGENT` is unset (David's locked decision). */
 export const DEFAULT_CONNECTOR = "claude";
 /** `cotal` is reserved: it is the binary's own name, so a connector must never claim it (there is no

package/dist/official-connectors.js.map

@@ -1 +1 @@
-{"version":3,"file":"official-connectors.js","sourceRoot":"","sources":["../src/official-connectors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAqC;IACnE,MAAM,EAAE,iCAAiC;IACzC,QAAQ,EAAE,8BAA8B;IACxC,MAAM,EAAE,4BAA4B;IACpC,EAAE,EAAE,cAAc;CACnB,CAAC;AAEF,sGAAsG;AACtG,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAE1C;kFACkF;AAClF,MAAM,CAAC,MAAM,wBAAwB,GAAsB,CAAC,OAAO,CAAC,CAAC;AAErE;mGACmG;AACnG,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,GAAG;QACR,CAAC,CAAC,iBAAiB,IAAI,6CAA6C,GAAG,IAAI;QAC3E,CAAC,CAAC,iBAAiB,IAAI,qFAAqF,CAAC;AACjH,CAAC"}
+{"version":3,"file":"official-connectors.js","sourceRoot":"","sources":["../src/official-connectors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAqC;IACnE,MAAM,EAAE,iCAAiC;IACzC,QAAQ,EAAE,8BAA8B;IACxC,MAAM,EAAE,4BAA4B;IACpC,EAAE,EAAE,cAAc;CACnB,CAAC;AAcF,MAAM,CAAC,MAAM,iBAAiB,GAA8C;IAC1E,GAAI,MAAM,CAAC,WAAW,CACpB,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CACjF;IACrC,GAAG,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,qBAAqB,EAAE;CAC7D,CAAC;AAEF,sGAAsG;AACtG,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAE1C;kFACkF;AAClF,MAAM,CAAC,MAAM,wBAAwB,GAAsB,CAAC,OAAO,CAAC,CAAC;AAErE;mGACmG;AACnG,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,GAAG;QACR,CAAC,CAAC,iBAAiB,IAAI,6CAA6C,GAAG,IAAI;QAC3E,CAAC,CAAC,iBAAiB,IAAI,qFAAqF,CAAC;AACjH,CAAC"}

package/dist/render.js

@@ -23,6 +23,8 @@ function renderTargetError(err) {
             return `✗ another mesh ("${d.space}") is running at ${d.server} - run \`cotal up\` here to start yours, or \`--space ${d.space}\` to join it`;
         case "stale-auth-root":
             return `✗ registry entry "${d.space}" points at ${d.root}, whose auth is now for "${d.found}" - stale entry removed; re-run \`cotal up\` or check \`cotal meshes\``;
+        case "unreadable-auth":
+            return `✗ space "${d.space}"'s trust material under ${d.root} will not load (${err.message}) - repair or remove the account record, then re-run \`cotal up\``;
         case "user-auth-unrecorded":
             // U11: without a TRUSTED local record of the space's IdP there is no actionable
             // `cotal login --idp <?>` line to print — the honest recovery is re-registering the mesh

package/dist/render.js.map

@@ -1 +1 @@
-{"version":3,"file":"render.js","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAmBA,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,CAAiB;IACpD,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACpC,KAAK,WAAW;YACd,OAAO,sBAAsB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/D,KAAK,WAAW;YACd,OAAO,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,qGAAqG;AACrG,SAAS,iBAAiB,CAAC,GAAoB;IAC7C,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;IACtB,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,WAAW;YACd,OAAO,qEAAqE,CAAC;QAC/E,KAAK,eAAe;YAClB,OAAO,oBAAoB,CAAC,CAAC,SAAS,qCAAqC,CAAC;QAC9E,KAAK,kBAAkB;YACrB,OAAO,+BAA+B,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gFAAgF,CAAC;QACvJ,KAAK,kBAAkB;YACrB,OAAO,oBAAoB,CAAC,CAAC,KAAK,oBAAoB,CAAC,CAAC,MAAM,yDAAyD,CAAC,CAAC,KAAK,eAAe,CAAC;QAChJ,KAAK,iBAAiB;YACpB,OAAO,qBAAqB,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,IAAI,4BAA4B,CAAC,CAAC,KAAK,wEAAwE,CAAC;QACtK,KAAK,sBAAsB;YACzB,gFAAgF;YAChF,yFAAyF;YACzF,yFAAyF;YACzF,OAAO,YAAY,CAAC,CAAC,KAAK,6HAA6H,CAAC,CAAC,IAAI,IAAI,iBAAiB,qHAAqH,CAAC;IAC5S,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,SAAS,sBAAsB,CAAC,IAAsB,EAAE,CAAa,EAAE,MAAe;IACpF,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,aAAa;YAChB,OAAO,wBAAwB,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,qBAAqB,CAAC;QACnH,KAAK,yBAAyB;YAC5B,OAAO,WAAW,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,MAAM,0GAA0G,CAAC,CAAC,IAAI,0CAA0C,CAAC;QACtM,KAAK,wBAAwB;YAC3B,OAAO,gBAAgB,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,MAAM,8GAA8G,CAAC,CAAC,IAAI,0CAA0C,CAAC;QAC/M,KAAK,gBAAgB;YACnB,OAAO,sBAAsB,CAAC,CAAC,KAAK,sBAAsB,CAAC,CAAC,MAAM,8GAA8G,CAAC;QACnL,KAAK,iBAAiB;YACpB,OAAO,eAAe,CAAC,CAAC,MAAM,kJAAkJ,CAAC;QACnL,KAAK,YAAY;YACf,OAAO,sBAAsB,CAAC,CAAC,KAAK,kGAAkG,CAAC,CAAC,IAAI,2DAA2D,CAAC;IAC5M,CAAC;AACH,CAAC;AAED;yFACyF;AACzF,SAAS,eAAe,CAAC,MAAsD,EAAE,MAAc;IAC7F,IAAI,MAAM,KAAK,YAAY;QACzB,OAAO,2BAA2B,MAAM,0HAA0H,CAAC;IACrK,OAAO,MAAM,KAAK,eAAe;QAC/B,CAAC,CAAC,6BAA6B,MAAM,yDAAyD;QAC9F,CAAC,CAAC,6BAA6B,MAAM,kCAAkC,CAAC;AAC5E,CAAC"}
+{"version":3,"file":"render.js","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAmBA,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,CAAiB;IACpD,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACpC,KAAK,WAAW;YACd,OAAO,sBAAsB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/D,KAAK,WAAW;YACd,OAAO,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,qGAAqG;AACrG,SAAS,iBAAiB,CAAC,GAAoB;IAC7C,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;IACtB,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,WAAW;YACd,OAAO,qEAAqE,CAAC;QAC/E,KAAK,eAAe;YAClB,OAAO,oBAAoB,CAAC,CAAC,SAAS,qCAAqC,CAAC;QAC9E,KAAK,kBAAkB;YACrB,OAAO,+BAA+B,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gFAAgF,CAAC;QACvJ,KAAK,kBAAkB;YACrB,OAAO,oBAAoB,CAAC,CAAC,KAAK,oBAAoB,CAAC,CAAC,MAAM,yDAAyD,CAAC,CAAC,KAAK,eAAe,CAAC;QAChJ,KAAK,iBAAiB;YACpB,OAAO,qBAAqB,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,IAAI,4BAA4B,CAAC,CAAC,KAAK,wEAAwE,CAAC;QACtK,KAAK,iBAAiB;YACpB,OAAO,YAAY,CAAC,CAAC,KAAK,4BAA4B,CAAC,CAAC,IAAI,mBAAmB,GAAG,CAAC,OAAO,mEAAmE,CAAC;QAChK,KAAK,sBAAsB;YACzB,gFAAgF;YAChF,yFAAyF;YACzF,yFAAyF;YACzF,OAAO,YAAY,CAAC,CAAC,KAAK,6HAA6H,CAAC,CAAC,IAAI,IAAI,iBAAiB,qHAAqH,CAAC;IAC5S,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,SAAS,sBAAsB,CAAC,IAAsB,EAAE,CAAa,EAAE,MAAe;IACpF,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,aAAa;YAChB,OAAO,wBAAwB,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,qBAAqB,CAAC;QACnH,KAAK,yBAAyB;YAC5B,OAAO,WAAW,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,MAAM,0GAA0G,CAAC,CAAC,IAAI,0CAA0C,CAAC;QACtM,KAAK,wBAAwB;YAC3B,OAAO,gBAAgB,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,MAAM,8GAA8G,CAAC,CAAC,IAAI,0CAA0C,CAAC;QAC/M,KAAK,gBAAgB;YACnB,OAAO,sBAAsB,CAAC,CAAC,KAAK,sBAAsB,CAAC,CAAC,MAAM,8GAA8G,CAAC;QACnL,KAAK,iBAAiB;YACpB,OAAO,eAAe,CAAC,CAAC,MAAM,kJAAkJ,CAAC;QACnL,KAAK,YAAY;YACf,OAAO,sBAAsB,CAAC,CAAC,KAAK,kGAAkG,CAAC,CAAC,IAAI,2DAA2D,CAAC;IAC5M,CAAC;AACH,CAAC;AAED;yFACyF;AACzF,SAAS,eAAe,CAAC,MAAsD,EAAE,MAAc;IAC7F,IAAI,MAAM,KAAK,YAAY;QACzB,OAAO,2BAA2B,MAAM,0HAA0H,CAAC;IACrK,OAAO,MAAM,KAAK,eAAe;QAC/B,CAAC,CAAC,6BAA6B,MAAM,yDAAyD;QAC9F,CAAC,CAAC,6BAA6B,MAAM,kCAAkC,CAAC;AAC5E,CAAC"}

package/dist/renewal.d.ts

@@ -2,9 +2,10 @@ import { type Profile, type SecretStore } from "@cotal-ai/core";
 /**
  * D5 slice 5 class-2 standing renewal — the RENEWAL OWNER'S half, shared by the manager (the
  * resident owner in every mesh mode) and `cotal doctor auth --fix` (the operator repair). The
- * daemon's half is the explicit `reloadCreds` adoption op on the delivery-admin rail (plus the
- * passive 75% source re-read as backstop). Machine-local file work lives here in the workspace
- * layer: implementations never import each other.
+ * daemon's half is the explicit `reloadCreds` adoption op on the delivery-admin rail, plus each
+ * daemon's own 75% renewal timer (the delivery endpoint re-reads its source; the membership feed
+ * preflight-proves each candidate). Machine-local file work lives here in the workspace layer:
+ * implementations never import each other.
  */
 /** The canonical secret-store key of the delivery daemon's scoped cred — by the FS convention the
  *  key IS the filename under `.cotal/`. The single source for every tier (the CLI writer, the
@@ -12,6 +13,10 @@ import { type Profile, type SecretStore } from "@cotal-ai/core";
  *  the kind across two store entries with no compile error. Lives in workspace because the
  *  key↔filename convention is the workspace layout's; implementations never import each other. */
 export declare const DELIVERY_CREDS_KEY = "delivery.creds";
+/** The membership feed's data-account rw cred key — the same key↔filename discipline as
+ *  {@link DELIVERY_CREDS_KEY}. Named (not a bare literal) so the renewal owner can map a remint
+ *  result back to the daemon's `membership` component without a hand-copied string. */
+export declare const MEMBERSHIP_RW_CREDS_KEY = "membership-rw.creds";
 /** The seed-less daemon creds files a renewal owner re-signs. The $SYS files
  *  (membership-observer, connection-evictor) are deliberately ABSENT: they are rotation-renewed —
  *  no persisted seed can re-sign them, by design. */
@@ -25,21 +30,46 @@ export interface RemintResult {
     ok: boolean;
     skipped?: "missing-file" | "no-auth";
     error?: string;
+    /** EPHEMERAL SHA-256 of the JUST-RE-SIGNED cred's USER JWT — the EXPECTED-generation token the
+     *  renewal owner hands the daemon so an adoption reply can prove it adopted THIS generation, not
+     *  merely re-read some file. Present only on `ok`. NEVER persisted: the caller strips it before
+     *  writing the renewal record (a stable secret-derived token must not land on disk). */
+    fingerprint?: string;
 }
 /** Re-sign the daemon creds files for their EXISTING nkeys (a renewal must never swap a daemon's
  *  identity — the daemon side pins it). Reads and writes through the secret-store seam; `store` is
  *  the renewal owner's injection point, SYMMETRIC with the daemon's `runDelivery(args, store?)`.
  *  The manager — the D5 standing-renewal owner, and a hosted-path caller (manager.ts calls this
- *  unconditionally) — must pass the SAME store it gives the daemon, or a hosted composition
- *  re-signs into one store while the daemon reads another and rides to expiry. Threading the store
- *  through the manager's entry is its own slice; until it lands, hosted end-to-end renewal on an
- *  injected store is NOT yet wired, and no store means the local workspace FS composition (keys =
- *  the filenames under `.cotal/`). The store's ATOMIC put is load-bearing here, because the daemons
- *  re-read these files LIVE (the delivery endpoint's 75% source backstop, the membership rw
- *  reconnect getter) and the plain `writeSecretFile` this replaced could tear such a concurrent
- *  re-read. Structured per-file results, never throws: a failed remint leaves the old cred running
- *  toward its loud expiry and the caller records/reports the failure. */
-export declare function remintDaemonCreds(root: string, store?: SecretStore): Promise<RemintResult[]>;
+ *  unconditionally) — passes the SAME store it gives the daemon (its `ManagerOptions.secretStore`),
+ *  so a hosted composition re-signs into the store the daemon renews from, never a divergent one; no
+ *  store means the local workspace FS composition (keys = the filenames under `.cotal/`).
+ *
+ *  `expectedSpace` (the caller's known space — the manager's `this.space`, doctor's resolved space) is
+ *  a REQUIRED positional and is validated against the store's signer: the daemon creds are SPACE-SCOPED,
+ *  so a store whose signer is for a DIFFERENT space (a swap after start, a misconfigured hosted mount)
+ *  must NOT re-sign — that would overwrite each last-good cred with one the space's broker rejects,
+ *  breaking the daemon on a value that looks freshly renewed. It is required (not optional) so the
+ *  unsafe no-space call cannot compile — the same claim-exceeds-enforcement trap the cross-space fix
+ *  would otherwise leave for the next caller. A signer that fails validation fails EVERY file
+ *  (`ok:false`), leaving the standing creds intact toward their loud expiry rather than clobbering them.
+ *  The store's ATOMIC put is load-bearing here, because the daemons re-read these values LIVE (the
+ *  delivery endpoint's 75% source refresh, the membership feed's 75% renewal fetch).
+ *
+ *  The last-good cred is NEVER overwritten with an UNPROVEN one — a bundle's JWT chain is self-bound,
+ *  not broker-bound (two `createSpaceAuth(space)` calls yield same-named, DIFFERENT-account chains), so
+ *  a same-label alternate signer could mint a broker-dead cred and CLOBBER the last-good (availability
+ *  loss). Proof before overwrite is one of: (1) `opts.preflight` — a disposable "does the broker accept
+ *  this cred" probe the caller owns (the manager passes a {@link probeConnect} over `this.servers`),
+ *  which gates EVERY candidate when supplied; or (2) AUTHORITY CONTINUITY — the candidate is signed by
+ *  the SAME account signing key (`iss`) as the current (last-good, already broker-accepted) cred, the
+ *  same authority the broker trusts, which the OFFLINE local repair (`doctor auth --fix`) relies on. A
+ *  same-label alternate account breaks continuity, so with no preflight it is refused, not clobbered.
+ *
+ *  Structured per-file results, never throws: a failed remint leaves the old cred running toward its
+ *  loud expiry and the caller records/reports the failure. */
+export declare function remintDaemonCreds(root: string, expectedSpace: string, store?: SecretStore, opts?: {
+    preflight?: (creds: string) => Promise<boolean>;
+}): Promise<RemintResult[]>;
 /** The renewal owner's audit record — what `cotal doctor auth` renders so "file re-signed" and
  *  "daemon adopted" are distinguishable states, per the D5 panel gate. One file, overwritten per
  *  pass: the CURRENT renewal state, not a log (history is the git/ops layer's job). */

package/dist/renewal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"renewal.d.ts","sourceRoot":"","sources":["../src/renewal.ts"],"names":[],"mappings":"AAEA,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,WAAW,EACjB,MAAM,gBAAgB,CAAC;AAIxB;;;;;;GAMG;AAEH;;;;kGAIkG;AAClG,eAAO,MAAM,kBAAkB,mBAAmB,CAAC;AAEnD;;qDAEqD;AACrD,eAAO,MAAM,uBAAuB,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAGrF,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;yEAYyE;AACzE,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAmBlG;AAED;;uFAEuF;AACvF,MAAM,WAAW,aAAa;IAC5B,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,6FAA6F;IAC7F,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,IAAI,CAE5E;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAQzE"}
+{"version":3,"file":"renewal.d.ts","sourceRoot":"","sources":["../src/renewal.ts"],"names":[],"mappings":"AAEA,OAAO,EAML,KAAK,OAAO,EACZ,KAAK,WAAW,EAEjB,MAAM,gBAAgB,CAAC;AAIxB;;;;;;;GAOG;AAEH;;;;kGAIkG;AAClG,eAAO,MAAM,kBAAkB,mBAAmB,CAAC;AAEnD;;uFAEuF;AACvF,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D;;qDAEqD;AACrD,eAAO,MAAM,uBAAuB,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAGrF,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;4FAGwF;IACxF,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8DA8B8D;AAC9D,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,EACrB,KAAK,CAAC,EAAE,WAAW,EACnB,IAAI,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,GACzD,OAAO,CAAC,YAAY,EAAE,CAAC,CAsDzB;AAED;;uFAEuF;AACvF,MAAM,WAAW,aAAa;IAC5B,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,6FAA6F;IAC7F,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,IAAI,CAM5E;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAQzE"}