@cotal-ai/workspace 0.13.1 → 0.14.0

package/dist/renewal.js

@@ -1,14 +1,15 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-import { identityFromCreds, mintCreds, writeSecretFile, } from "@cotal-ai/core";
-import { authDir, loadSpaceAuth } from "./auth-paths.js";
+import { credsClaims, credsFingerprint, identityFromCreds, mintCreds, writeSecretFile, } from "@cotal-ai/core";
+import { getSpaceAuth } from "./auth-paths.js";
 import { workspaceSecretStore } from "./secret-store-fs.js";
 /**
  * D5 slice 5 class-2 standing renewal — the RENEWAL OWNER'S half, shared by the manager (the
  * resident owner in every mesh mode) and `cotal doctor auth --fix` (the operator repair). The
- * daemon's half is the explicit `reloadCreds` adoption op on the delivery-admin rail (plus the
- * passive 75% source re-read as backstop). Machine-local file work lives here in the workspace
- * layer: implementations never import each other.
+ * daemon's half is the explicit `reloadCreds` adoption op on the delivery-admin rail, plus each
+ * daemon's own 75% renewal timer (the delivery endpoint re-reads its source; the membership feed
+ * preflight-proves each candidate). Machine-local file work lives here in the workspace layer:
+ * implementations never import each other.
  */
 /** The canonical secret-store key of the delivery daemon's scoped cred — by the FS convention the
  *  key IS the filename under `.cotal/`. The single source for every tier (the CLI writer, the
@@ -16,31 +17,65 @@ import { workspaceSecretStore } from "./secret-store-fs.js";
  *  the kind across two store entries with no compile error. Lives in workspace because the
  *  key↔filename convention is the workspace layout's; implementations never import each other. */
 export const DELIVERY_CREDS_KEY = "delivery.creds";
+/** The membership feed's data-account rw cred key — the same key↔filename discipline as
+ *  {@link DELIVERY_CREDS_KEY}. Named (not a bare literal) so the renewal owner can map a remint
+ *  result back to the daemon's `membership` component without a hand-copied string. */
+export const MEMBERSHIP_RW_CREDS_KEY = "membership-rw.creds";
 /** The seed-less daemon creds files a renewal owner re-signs. The $SYS files
  *  (membership-observer, connection-evictor) are deliberately ABSENT: they are rotation-renewed —
  *  no persisted seed can re-sign them, by design. */
 export const REMINTABLE_DAEMON_CREDS = [
     { file: DELIVERY_CREDS_KEY, profile: "delivery" },
-    { file: "membership-rw.creds", profile: "membership-rw" },
+    { file: MEMBERSHIP_RW_CREDS_KEY, profile: "membership-rw" },
 ];
 /** Re-sign the daemon creds files for their EXISTING nkeys (a renewal must never swap a daemon's
  *  identity — the daemon side pins it). Reads and writes through the secret-store seam; `store` is
  *  the renewal owner's injection point, SYMMETRIC with the daemon's `runDelivery(args, store?)`.
  *  The manager — the D5 standing-renewal owner, and a hosted-path caller (manager.ts calls this
- *  unconditionally) — must pass the SAME store it gives the daemon, or a hosted composition
- *  re-signs into one store while the daemon reads another and rides to expiry. Threading the store
- *  through the manager's entry is its own slice; until it lands, hosted end-to-end renewal on an
- *  injected store is NOT yet wired, and no store means the local workspace FS composition (keys =
- *  the filenames under `.cotal/`). The store's ATOMIC put is load-bearing here, because the daemons
- *  re-read these files LIVE (the delivery endpoint's 75% source backstop, the membership rw
- *  reconnect getter) and the plain `writeSecretFile` this replaced could tear such a concurrent
- *  re-read. Structured per-file results, never throws: a failed remint leaves the old cred running
- *  toward its loud expiry and the caller records/reports the failure. */
-export async function remintDaemonCreds(root, store) {
-    const auth = loadSpaceAuth(authDir(root));
+ *  unconditionally) — passes the SAME store it gives the daemon (its `ManagerOptions.secretStore`),
+ *  so a hosted composition re-signs into the store the daemon renews from, never a divergent one; no
+ *  store means the local workspace FS composition (keys = the filenames under `.cotal/`).
+ *
+ *  `expectedSpace` (the caller's known space — the manager's `this.space`, doctor's resolved space) is
+ *  a REQUIRED positional and is validated against the store's signer: the daemon creds are SPACE-SCOPED,
+ *  so a store whose signer is for a DIFFERENT space (a swap after start, a misconfigured hosted mount)
+ *  must NOT re-sign — that would overwrite each last-good cred with one the space's broker rejects,
+ *  breaking the daemon on a value that looks freshly renewed. It is required (not optional) so the
+ *  unsafe no-space call cannot compile — the same claim-exceeds-enforcement trap the cross-space fix
+ *  would otherwise leave for the next caller. A signer that fails validation fails EVERY file
+ *  (`ok:false`), leaving the standing creds intact toward their loud expiry rather than clobbering them.
+ *  The store's ATOMIC put is load-bearing here, because the daemons re-read these values LIVE (the
+ *  delivery endpoint's 75% source refresh, the membership feed's 75% renewal fetch).
+ *
+ *  The last-good cred is NEVER overwritten with an UNPROVEN one — a bundle's JWT chain is self-bound,
+ *  not broker-bound (two `createSpaceAuth(space)` calls yield same-named, DIFFERENT-account chains), so
+ *  a same-label alternate signer could mint a broker-dead cred and CLOBBER the last-good (availability
+ *  loss). Proof before overwrite is one of: (1) `opts.preflight` — a disposable "does the broker accept
+ *  this cred" probe the caller owns (the manager passes a {@link probeConnect} over `this.servers`),
+ *  which gates EVERY candidate when supplied; or (2) AUTHORITY CONTINUITY — the candidate is signed by
+ *  the SAME account signing key (`iss`) as the current (last-good, already broker-accepted) cred, the
+ *  same authority the broker trusts, which the OFFLINE local repair (`doctor auth --fix`) relies on. A
+ *  same-label alternate account breaks continuity, so with no preflight it is refused, not clobbered.
+ *
+ *  Structured per-file results, never throws: a failed remint leaves the old cred running toward its
+ *  loud expiry and the caller records/reports the failure. */
+export async function remintDaemonCreds(root, expectedSpace, store, opts) {
+    const s = store ?? workspaceSecretStore(root);
+    // Read + FULLY VALIDATE the SIGNER through the SAME store the daemon creds live in (symmetric with
+    // the daemon's `runDelivery(args, store)`) — reading it from the FS while writing the daemon creds
+    // to an injected store would split authority (signer ← disk, cred ← KMS): the class 3b closed for
+    // daemon creds, here for the signer. `getSpaceAuth(s, expectedSpace)` cross-checks the trust chain
+    // against the caller's space; a wrong-space or malformed signer THROWS (never re-signs).
+    let auth;
+    try {
+        auth = await getSpaceAuth(s, expectedSpace);
+    }
+    catch (e) {
+        // Wrong-space / malformed signer: fail every file, DO NOT overwrite the last-good creds.
+        return REMINTABLE_DAEMON_CREDS.map(({ file }) => ({ file, ok: false, error: e.message }));
+    }
     if (!auth)
         return REMINTABLE_DAEMON_CREDS.map(({ file }) => ({ file, ok: false, skipped: "no-auth" }));
-    const s = store ?? workspaceSecretStore(root);
     const results = [];
     for (const { file, profile } of REMINTABLE_DAEMON_CREDS) {
         try {
@@ -49,8 +84,33 @@ export async function remintDaemonCreds(root, store) {
                 results.push({ file, ok: false, skipped: "missing-file" });
                 continue;
             }
-            await s.put(file, await mintCreds(auth, identityFromCreds(current), profile));
-            results.push({ file, ok: true });
+            const next = await mintCreds(auth, identityFromCreds(current), profile);
+            // NEVER overwrite the last-good cred with an UNPROVEN one. A bundle's JWT chain is SELF-bound,
+            // not broker-bound (two `createSpaceAuth(space)` calls yield same-named, DIFFERENT-account chains),
+            // so `expectedSpace` + full-chain validity is not enough. Proof is one of:
+            //  (1) a broker PREFLIGHT — the manager's live "does the broker accept this cred" probe; OR
+            //  (2) AUTHORITY CONTINUITY — the candidate is signed by the SAME account signing key (`iss`) as
+            //      the current (last-good, already broker-accepted) cred, i.e. the same authority the broker
+            //      already trusts. This is what the OFFLINE local repair (`doctor auth --fix`, no live broker)
+            //      relies on. A same-label ALTERNATE account (full OR stripped) breaks continuity, so with no
+            //      preflight it is REFUSED — the last-good is preserved rather than clobbered by a broker-dead cred.
+            let proven;
+            let why;
+            if (opts?.preflight) {
+                proven = await opts.preflight(next);
+                why = "the broker refused the re-signed cred (wrong-account or unreachable signer)";
+            }
+            else {
+                const iss = credsClaims(next).iss;
+                proven = iss !== undefined && iss === credsClaims(current).iss;
+                why = "the re-signed cred's signer is not the last-good cred's authority, and no broker preflight was supplied";
+            }
+            if (!proven) {
+                results.push({ file, ok: false, error: `${why} - last-good cred preserved` });
+                continue;
+            }
+            await s.put(file, next);
+            results.push({ file, ok: true, fingerprint: credsFingerprint(next) });
         }
         catch (e) {
             results.push({ file, ok: false, error: e.message });
@@ -62,7 +122,11 @@ export function renewalRecordPath(root) {
     return join(root, ".cotal", "renewal.json");
 }
 export function writeRenewalRecord(root, record) {
-    writeSecretFile(renewalRecordPath(root), JSON.stringify(record, null, 2));
+    // REDACT the ephemeral generation token HERE, at the single persistence boundary, so no writer
+    // (the manager, `doctor auth --fix`, or any future caller) can leak the stable secret-derived
+    // fingerprint to `.cotal/renewal.json`. `JSON.stringify` then omits the `undefined` field.
+    const redacted = { ...record, results: record.results.map((r) => ({ ...r, fingerprint: undefined })) };
+    writeSecretFile(renewalRecordPath(root), JSON.stringify(redacted, null, 2));
 }
 export function readRenewalRecord(root) {
     const p = renewalRecordPath(root);

package/dist/renewal.js.map

@@ -1 +1 @@
-{"version":3,"file":"renewal.js","sourceRoot":"","sources":["../src/renewal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,eAAe,GAGhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D;;;;;;GAMG;AAEH;;;;kGAIkG;AAClG,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAEnD;;qDAEqD;AACrD,MAAM,CAAC,MAAM,uBAAuB,GAAsD;IACxF,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,UAAU,EAAE;IACjD,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,eAAe,EAAE;CAC1D,CAAC;AAUF;;;;;;;;;;;;yEAYyE;AACzE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAmB;IACvE,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,uBAAuB,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAkB,EAAE,CAAC,CAAC,CAAC;IAChH,MAAM,CAAC,GAAG,KAAK,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,uBAAuB,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC3D,SAAS;YACX,CAAC;YACD,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,SAAS,CAAC,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9E,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAeD,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,MAAqB;IACpE,eAAe,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAkB,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,qEAAqE;IACzF,CAAC;AACH,CAAC"}
+{"version":3,"file":"renewal.js","sourceRoot":"","sources":["../src/renewal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,SAAS,EACT,eAAe,GAIhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D;;;;;;;GAOG;AAEH;;;;kGAIkG;AAClG,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAEnD;;uFAEuF;AACvF,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D;;qDAEqD;AACrD,MAAM,CAAC,MAAM,uBAAuB,GAAsD;IACxF,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,UAAU,EAAE;IACjD,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,eAAe,EAAE;CAC5D,CAAC;AAeF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8DA8B8D;AAC9D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY,EACZ,aAAqB,EACrB,KAAmB,EACnB,IAA0D;IAE1D,MAAM,CAAC,GAAG,KAAK,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC9C,mGAAmG;IACnG,mGAAmG;IACnG,kGAAkG;IAClG,mGAAmG;IACnG,yFAAyF;IACzF,IAAI,IAA2B,CAAC;IAChC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,yFAAyF;QACzF,OAAO,uBAAuB,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,uBAAuB,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAkB,EAAE,CAAC,CAAC,CAAC;IAChH,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,uBAAuB,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC3D,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;YACxE,+FAA+F;YAC/F,oGAAoG;YACpG,2EAA2E;YAC3E,4FAA4F;YAC5F,iGAAiG;YACjG,iGAAiG;YACjG,mGAAmG;YACnG,kGAAkG;YAClG,yGAAyG;YACzG,IAAI,MAAe,CAAC;YACpB,IAAI,GAAW,CAAC;YAChB,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC;gBACpB,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACpC,GAAG,GAAG,6EAA6E,CAAC;YACtF,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;gBAClC,MAAM,GAAG,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,WAAW,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC;gBAC/D,GAAG,GAAG,yGAAyG,CAAC;YAClH,CAAC;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,GAAG,6BAA6B,EAAE,CAAC,CAAC;gBAC9E,SAAS;YACX,CAAC;YACD,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAeD,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,MAAqB;IACpE,+FAA+F;IAC/F,8FAA8F;IAC9F,2FAA2F;IAC3F,MAAM,QAAQ,GAAkB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC;IACtH,eAAe,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAkB,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,qEAAqE;IACzF,CAAC;AACH,CAAC"}

package/dist/space.d.ts

@@ -1,5 +1,7 @@
 /** The space this folder operates on: its `.cotal/auth` space if set up, else the default.
- *  A folder has exactly one space (its auth) — commands resolve it through here so they always
- *  match the folder's mesh instead of assuming the global default. */
+ *  Commands resolve it through here so they always match the folder's mesh instead of assuming the
+ *  global default. A root that has grown to hold SEVERAL space accounts makes this question
+ *  ambiguous, and {@link soleSpaceOf} fails loud there rather than picking one - such a caller has
+ *  to name its space (`--space`). */
 export declare function resolveSpace(cwd: string): string;
 //# sourceMappingURL=space.d.ts.map

package/dist/space.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"space.d.ts","sourceRoot":"","sources":["../src/space.ts"],"names":[],"mappings":"AAGA;;sEAEsE;AACtE,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD"}
+{"version":3,"file":"space.d.ts","sourceRoot":"","sources":["../src/space.ts"],"names":[],"mappings":"AAGA;;;;qCAIqC;AACrC,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD"}

package/dist/space.js

@@ -1,9 +1,11 @@
 import { DEFAULT_SPACE } from "@cotal-ai/core";
-import { authDir, findCotalRoot, loadSpaceAuth } from "./auth-paths.js";
+import { authDir, findCotalRoot, soleSpaceOf } from "./auth-paths.js";
 /** The space this folder operates on: its `.cotal/auth` space if set up, else the default.
- *  A folder has exactly one space (its auth) — commands resolve it through here so they always
- *  match the folder's mesh instead of assuming the global default. */
+ *  Commands resolve it through here so they always match the folder's mesh instead of assuming the
+ *  global default. A root that has grown to hold SEVERAL space accounts makes this question
+ *  ambiguous, and {@link soleSpaceOf} fails loud there rather than picking one - such a caller has
+ *  to name its space (`--space`). */
 export function resolveSpace(cwd) {
-    return loadSpaceAuth(authDir(findCotalRoot(cwd)))?.space ?? DEFAULT_SPACE;
+    return soleSpaceOf(authDir(findCotalRoot(cwd))) ?? DEFAULT_SPACE;
 }
 //# sourceMappingURL=space.js.map

package/dist/space.js.map

@@ -1 +1 @@
-{"version":3,"file":"space.js","sourceRoot":"","sources":["../src/space.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAExE;;sEAEsE;AACtE,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,aAAa,CAAC;AAC5E,CAAC"}
+{"version":3,"file":"space.js","sourceRoot":"","sources":["../src/space.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEtE;;;;qCAIqC;AACrC,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC;AACnE,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cotal-ai/workspace",
   "description": "Cotal machine-local workstation layer: the ~/.cotal mesh registry, target resolution, preflight, on-disk auth-path I/O, and the command-copy renderer — operator concerns over a local checkout, kept separate from the wire protocol in @cotal-ai/core.",
-  "version": "0.13.1",
+  "version": "0.14.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -18,7 +18,7 @@
     }
   },
   "dependencies": {
-    "@cotal-ai/core": "0.13.1"
+    "@cotal-ai/core": "0.14.0"
   },
   "files": [
     "dist"