@cotal-ai/workspace 0.15.0 → 0.17.0

package/dist/connect.js

@@ -1,9 +1,9 @@
 import { existsSync, readFileSync } from "node:fs";
-import { DEFAULT_SERVER, DEFAULT_SPACE, isReachable, mintCreds, newIdentity, probeConnect, registry, } from "@cotal-ai/core";
+import { DEFAULT_SERVER, DEFAULT_SPACE, DEV_OWNER, isReachable, mintCreds, mintLifecycleUid, newIdentity, probeConnect, registry, } from "@cotal-ai/core";
 import { c } from "./colors.js";
 import { findCotalRoot, hasUserAuthState, userAuthStateDir } from "./auth-paths.js";
 import { workspaceSecretStore } from "./secret-store-fs.js";
-import { findMesh, getCurrent, removeMesh } from "./mesh-registry.js";
+import { findMesh, getCurrent, pruneMesh } from "./mesh-registry.js";
 import { isWorkspaceTargetError, resolveMeshTarget } from "./mesh-target.js";
 import { preflightTarget, pruneStaleMeshes } from "./preflight.js";
 import { renderWorkspaceError } from "./render.js";
@@ -11,10 +11,21 @@ import { renderWorkspaceError } from "./render.js";
  *  `new CotalEndpoint({...})` instead of passing `creds:` directly, so a user-mode connection
  *  (bearer + sentinel) and a static/raw one (creds) ride the same call sites without each command
  *  re-learning the mode split. */
+/** The connect material for one resolved connection, spread straight into `CotalEndpoint` options
+ *  or a standalone helper.
+ *
+ *  `tls` rides along with the credentials DELIBERATELY. It used to be dropped here — this function
+ *  returned creds/bearer only — which meant every caller that spread `endpointAuth(conn)` got the
+ *  identity and silently lost the transport requirement. That is the failure with no symptom: the
+ *  connection still works against an honest TLS broker (the client upgrades on the server's INFO),
+ *  so nothing looks wrong until an on-path attacker forges an INFO without `tls_required` and
+ *  collects the credentials in the clear. Keeping the two together means a caller cannot take the
+ *  identity without also taking the requirement that protects it. */
 export function endpointAuth(conn) {
+    const tls = conn.tls ? { tls: true } : {};
     if (conn.bearer && conn.sentinelCreds)
-        return { bearer: conn.bearer, sentinelCreds: conn.sentinelCreds };
-    return conn.creds !== undefined ? { creds: conn.creds } : {};
+        return { bearer: conn.bearer, sentinelCreds: conn.sentinelCreds, ...tls };
+    return conn.creds !== undefined ? { creds: conn.creds, ...tls } : { ...tls };
 }
 /** The ledger actor a HUMAN CLI connect runs as on a user-auth space (v1: one well-known name).
  *  Grant it once per user: `cotal actor grant cli --sub <your IdP subject>`. */
@@ -40,8 +51,8 @@ export async function userViewAuth(conn, view) {
     const store = workspaceSecretStore(conn.root);
     const mint = () => provider.userCredentials({ store, dir, space: conn.space, actor: CLI_USER_ACTOR, view });
     const { bearer, sentinelCreds } = await mint();
-    const { owner, actor } = principalFromBearer(bearer);
-    return { bearer, sentinelCreds, owner, actor, source: () => mint().then((r) => r.bearer) };
+    const { owner, actor, lifecycleUid } = principalFromBearer(bearer);
+    return { bearer, sentinelCreds, owner, actor, lifecycleUid, source: () => mint().then((r) => r.bearer) };
 }
 /** {@link userViewAuth}, workstation-flavoured: colour the thrown sentence and exit. */
 export async function userViewAuthOrExit(conn, view) {
@@ -53,9 +64,11 @@ export async function userViewAuthOrExit(conn, view) {
         process.exit(1);
     }
 }
-/** The (owner, actor) principal a minted bearer is bound to — read from the JWT payload WITHOUT
- *  verification (client side; the broker verifies). A bearer-source endpoint requires the principal
- *  pinned at construction, and the bearer is the one authoritative place it lives. */
+/** The (owner, actor, lifecycleUid) principal a minted bearer is bound to — read from the JWT
+ *  payload WITHOUT verification (client side; the broker verifies). A bearer-source endpoint
+ *  requires the principal pinned at construction, and the caller triple (1c.2c: the v0.4 ep-rail
+ *  subjects the callout-minted rows pin) needs the ledger lifecycle claim too — the bearer is the
+ *  one authoritative place all three live. */
 function principalFromBearer(bearer) {
     try {
         const mid = bearer.split(".")[1];
@@ -64,7 +77,9 @@ function principalFromBearer(bearer) {
         const payload = JSON.parse(Buffer.from(mid, "base64url").toString("utf8"));
         if (typeof payload.sub !== "string" || !payload.sub || typeof payload.act?.actor !== "string" || !payload.act.actor)
             throw new Error("missing sub/act.actor");
-        return { owner: payload.sub, actor: payload.act.actor };
+        if (typeof payload.act.lifecycleUid !== "string" || !payload.act.lifecycleUid)
+            throw new Error("missing act.lifecycleUid (lifecycle-bound bearers are the v0.4 hard cut)");
+        return { owner: payload.sub, actor: payload.act.actor, lifecycleUid: payload.act.lifecycleUid };
     }
     catch (e) {
         throw new Error(`could not read the principal from the minted bearer (${e instanceof Error ? e.message : String(e)}) - the auth service's build may be stale; restart it with \`cotal up\``);
@@ -107,8 +122,11 @@ export async function connectOrExit(flags, role) {
             process.exit(1);
         }
         const creds = readFileSync(flags.creds, "utf8");
+        // An explicit `--creds` file is an off-registry connect: no mesh record, so no recorded TLS
+        // intent to inherit. It stays non-strict, and that is a real (documented) gap rather than a
+        // safe default - a `--creds` connect to a TLS broker still upgrades, but is downgradeable.
         await reachableOrExit(server, { creds });
-        return { server, space, creds };
+        return { server, space, tls: false, creds };
     }
     // A raw OPEN remote mesh: explicit `--server` + a `--space` that isn't locally registered. Naming
     // both is as deliberate as `--creds`, but an open broker has no creds to pass — connect bare,
@@ -123,25 +141,91 @@ export async function connectOrExit(flags, role) {
             console.error(c.red(`✗ space "${flags.space}" has user auth enabled on disk but no usable registry entry - re-record it with \`cotal up\` from its project folder, then sign in (\`cotal login\`)`));
             process.exit(1);
         }
+        // A raw OPEN remote broker named entirely on the command line: nothing recorded it, so there
+        // is no intent to honour. Non-strict, same documented gap as `--creds`.
         await reachableOrExit(flags.server, {});
-        return { server: flags.server, space: flags.space };
+        return { server: flags.server, space: flags.space, tls: false };
     }
     const target = await resolveTargetOrExit({ server: flags.server, space: flags.space });
     // USER MODE is a HARD branch: it never mints from on-disk trust material (static creds DO work
     // on a user-auth broker — minting here would silently connect the operator on the wrong identity
     // plane) and never connects credlessly. Everything it needs comes from the login cache + the
     // provider's space-scoped state; every failure is one sentence with the exact operator action.
-    if (target.mode === "user")
+    //
+    // The logged-in user bearer is the control surface; ledger scope is the grant. Operator
+    // INSTRUMENTS (`control-caller-*`) are static-mesh only — they carry rows the user bearer does
+    // not (the freeze STREAM.INFO read). Requesting one here used to fall through to the user bearer
+    // silently, so a caller believed it held instrument grants it did not. Refuse loud.
+    // `deployer` is NOT in that set: user-mode deploy connects as the bearer then elevates via
+    // `userViewAuth("deployer")`, which is a real exchange, not a silent substitute.
+    //
+    // Role is ignored for MINTING on this path (there is no instrument mint). The caller triple
+    // still lands: `userConnectOrExit` sets `epCaller` from the bearer's principal, so ep request
+    // subjects can be built. "Never consults role" means never mints by role — not "no triple".
+    if (target.mode === "user") {
+        if (role === "control-caller-privileged" || role === "control-caller-admin") {
+            console.error(c.red(`✗ cannot mint the "${role}" instrument on a user-mode mesh - the logged-in user bearer is the control surface (ledger scope is the grant). Operator instruments are static-mesh only.`));
+            process.exit(1);
+        }
         return userConnectOrExit(target);
-    const creds = target.auth ? await mintCreds(target.auth, newIdentity(), role) : undefined;
+    }
+    // An operator INSTRUMENT mint pins a fresh lifecycle uid: its ep-rail caller rows are
+    // lifecycle-keyed (SPEC §13.1/§13.2 — the reply rail names one incarnation), and the caller
+    // needs the triple back to build its request subjects. Every other profile mints as before.
+    const instrument = role === "control-caller-privileged" || role === "control-caller-admin" || role === "deployer";
+    let creds;
+    let epCaller;
+    if (target.auth) {
+        const identity = newIdentity();
+        if (instrument) {
+            const uid = mintLifecycleUid();
+            creds = await mintCreds(target.auth, identity, role, { lifecycleUid: uid });
+            epCaller = { owner: DEV_OWNER, actor: identity.id, uid };
+        }
+        else {
+            creds = await mintCreds(target.auth, identity, role);
+        }
+    }
     await preflightOrExit(target, creds);
-    return { server: target.server, space: target.space, creds, auth: target.auth, root: target.root, source: target.source };
+    // THE REGISTRY-RESOLVED PATH, and the one that must inherit the recorded decision: if the mesh
+    // record says this broker is TLS-required, the connection REQUIRES it. This is the site whose
+    // omission had no symptom - it connects either way against an honest broker.
+    return {
+        server: target.server, space: target.space, tls: target.tlsRequired, creds, auth: target.auth, root: target.root, source: target.source,
+        ...(epCaller ? { epCaller } : {}),
+    };
+}
+/**
+ * Connect as the logged-in user on a user-auth mesh. **No profile/role argument** — there is no
+ * instrument mint on this path; ledger scope is the grant and `epCaller` comes from the bearer
+ * principal. Prefer this over `connectOrExit(..., someRole)` whenever the caller already knows
+ * (or has just learned) the mesh is user-mode: a dummy role is a value that is meaningless today
+ * and wrong the day this path starts consulting it.
+ *
+ * If this function is ever changed to accept or consult a {@link Profile}, every caller is wrong.
+ */
+export async function connectUserControlOrExit(flags) {
+    if (flags.creds) {
+        console.error(c.red("✗ connectUserControlOrExit is the user-mode control path - it does not take --creds (that is the static/raw instrument path via connectOrExit)"));
+        process.exit(1);
+    }
+    const target = await resolveTargetOrExit({ server: flags.server, space: flags.space });
+    if (target.mode !== "user") {
+        console.error(c.red(`✗ connectUserControlOrExit requires a user-auth mesh (resolved mode is "${target.mode}") - use connectOrExit with an instrument profile on static/open meshes`));
+        process.exit(1);
+    }
+    return userConnectOrExit(target);
 }
 /** The user-mode connect: resolve the space's auth provider from the registry (composition-root
  *  supplied — never imported here), exchange this machine's login session for a bearer, and hand
  *  back bearer + sentinel. The provider owns the failure copy for its own steps (not logged in,
  *  service down, actor ungranted) — each is already an exact recovery sentence; this wrapper only
- *  colours and exits (the workstation-layer contract). */
+ *  colours and exits (the workstation-layer contract).
+ *
+ *  Takes a resolved target only — never a Profile. Callers that know the mesh is user-mode must
+ *  enter via {@link connectUserControlOrExit} (no role) or the user branch of {@link connectOrExit}
+ *  (which refuses control-caller-* instruments). If a Profile is ever threaded into this function,
+ *  the call sites that invented dummy roles are the defect. */
 async function userConnectOrExit(target) {
     const ua = target.userAuth; // mode "user" guarantees it (targetFromEntry throws otherwise)
     let provider;
@@ -159,14 +243,21 @@ async function userConnectOrExit(target) {
             space: target.space,
             actor: CLI_USER_ACTOR,
         });
+        // The v0.4 caller triple (1c.2c): the callout mints the cli actor's ep-rail rows keyed on the
+        // LEDGER lifecycle claim the bearer carries - the same three tokens, read client-side, let
+        // askManager's ep path build its request subjects. A re-granted alias invalidates the triple
+        // at the next exchange, exactly when the rows change.
+        const p = principalFromBearer(bearer);
         return {
             server: target.server,
             space: target.space,
+            tls: target.tlsRequired,
             bearer,
             sentinelCreds,
             userAuth: ua,
             root: target.root,
             source: target.source,
+            epCaller: { owner: p.owner, actor: p.actor, uid: p.lifecycleUid },
         };
     }
     catch (e) {
@@ -181,7 +272,10 @@ export async function reachableOrExit(server, auth = {}) {
     const probe = await probeConnect(server, auth);
     if (probe.ok)
         return;
-    console.error(c.red(renderWorkspaceError({ kind: "reachable", reason: probe.reason, server })));
+    // Whether the caller actually presented anything to be rejected. `tls` is deliberately not part
+    // of this: it is transport, not identity, and a TLS-only connection presents no credential.
+    const hasAuth = Boolean(auth.creds ?? auth.token ?? (auth.user && auth.pass));
+    console.error(c.red(renderWorkspaceError({ kind: "reachable", reason: probe.reason, server, hasAuth })));
     process.exit(1);
 }
 /** Resolve the mesh a command targets, exiting with one human sentence on an unresolved/ambiguous
@@ -233,9 +327,11 @@ export async function preflightOrExit(target, probeCreds) {
     const r = await preflightTarget(target, probeCreds);
     if (r.ok)
         return;
-    if (r.prune)
-        removeMesh(target.space);
-    console.error(c.red(renderWorkspaceError({ kind: "preflight", failure: r.kind, target, pruned: r.prune })));
+    // The classifier says whether this failure is a stale-entry signal; `pruneMesh` says whether the
+    // record is one an automatic sweep may delete (an operator-registered mesh is not). The message
+    // reports what ACTUALLY happened, so it never claims a removal that the registry refused.
+    const pruned = r.prune ? pruneMesh(target.space) : false;
+    console.error(c.red(renderWorkspaceError({ kind: "preflight", failure: r.kind, target, pruned })));
     process.exit(1);
 }
 //# sourceMappingURL=connect.js.map

package/dist/connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect.js","sourceRoot":"","sources":["../src/connect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EACL,cAAc,EACd,aAAa,EACb,WAAW,EACX,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,GAIT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,CAAC,EAAE,MAAM,aAAa,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAqB,MAAM,oBAAoB,CAAC;AACzF,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAmB,MAAM,kBAAkB,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAuDnD;;;kCAGkC;AAClC,MAAM,UAAU,YAAY,CAAC,IAAgB;IAC3C,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;IACzG,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED;gFACgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC;AAcpC;;;;;yEAKyE;AACzE,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAgB,EAAE,IAAY;IAC/D,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI;QAC9C,MAAM,IAAI,KAAK,CAAC,4DAA4D,IAAI,IAAI,CAAC,CAAC;IACxF,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;IACzB,IAAI,QAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAe,eAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,UAAU,IAAI,CAAC,KAAK,eAAe,EAAE,CAAC,QAAQ,oIAAoI,CACnL,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5G,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;IAC/C,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACrD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAgB,EAAE,IAAY;IACrE,IAAI,CAAC;QACH,OAAO,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;sFAEsF;AACtF,SAAS,mBAAmB,CAAC,MAAc;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAGxE,CAAC;QACF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,EAAE,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK;YACjH,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IAC1D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,yEAAyE,CAAC,CAAC;IAC/L,CAAC;AACH,CAAC;AAED;;;kGAGkG;AAClG,MAAM,UAAU,uCAAuC,CAAC,KAAa,EAAE,MAA0B,EAAE,IAAY;IAC7G,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,iBAAiB,GAAG,QAAQ,EAAE,IAAI,KAAK,MAAM,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC5G,MAAM,cAAc,GAAG,gBAAgB,CAAC,aAAa,EAAE,EAAE,KAAK,CAAC,CAAC;IAChE,IAAI,CAAC,iBAAiB,IAAI,CAAC,cAAc;QAAE,OAAO;IAClD,OAAO,CAAC,KAAK,CACX,CAAC,CAAC,GAAG,CACH,KAAK,IAAI,+DAA+D,KAAK,oGAAoG,CAClL,CACF,CAAC;IACF,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,kGAAkG,CAAC,CAAC,CAAC;IACzH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAmB,EAAE,IAAa;IACpE,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,aAAa,CAAC;QAC3C,gGAAgG;QAChG,yFAAyF;QACzF,+FAA+F;QAC/F,iGAAiG;QACjG,sBAAsB;QACtB,uCAAuC,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,cAAc,CAAC;QAC9C,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,2BAA2B,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACzC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IACD,kGAAkG;IAClG,8FAA8F;IAC9F,6FAA6F;IAC7F,gGAAgG;IAChG,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,4FAA4F;QAC5F,+FAA+F;QAC/F,yFAAyF;QACzF,8DAA8D;QAC9D,IAAI,gBAAgB,CAAC,aAAa,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACnD,OAAO,CAAC,KAAK,CACX,CAAC,CAAC,GAAG,CACH,YAAY,KAAK,CAAC,KAAK,uJAAuJ,CAC/K,CACF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACtD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACvF,+FAA+F;IAC/F,iGAAiG;IACjG,6FAA6F;IAC7F,+FAA+F;IAC/F,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,MAAM,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AAC5H,CAAC;AAED;;;;0DAI0D;AAC1D,KAAK,UAAU,iBAAiB,CAAC,MAAkB;IACjD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAS,CAAC,CAAC,+DAA+D;IAC5F,IAAI,QAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAe,eAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CACX,CAAC,CAAC,GAAG,CACH,YAAY,MAAM,CAAC,KAAK,eAAe,EAAE,CAAC,QAAQ,oIAAoI,CACvL,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC;YAC/D,KAAK,EAAE,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC;YACxC,GAAG,EAAE,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC;YAChD,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,cAAc;SACtB,CAAC,CAAC;QACH,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM;YACN,aAAa;YACb,QAAQ,EAAE,EAAE;YACZ,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;mGAEmG;AACnG,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,OAAgB,EAAE;IACtE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO;IACrB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED;;;;;+EAK+E;AAC/E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAGzC;IACC,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,MAAM,gBAAgB,EAAE,CAAC;IAC3C,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;IACD,gGAAgG;IAChG,kGAAkG;IAClG,8CAA8C;IAC9C,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;QACvD,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB,GAAG,sBAAsB,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACxF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;0BAK0B;AAC1B,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAkB,EAAE,UAAmB;IAC3E,2FAA2F;IAC3F,0FAA0F;IAC1F,4FAA4F;IAC5F,2FAA2F;IAC3F,oDAAoD;IACpD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,IAAI,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO;QAC7C,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,KAAK,QAAQ,MAAM,CAAC,MAAM,wEAAwE,CAAC,CAAC,CAAC;QAC3I,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACpD,IAAI,CAAC,CAAC,EAAE;QAAE,OAAO;IACjB,IAAI,CAAC,CAAC,KAAK;QAAE,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}
+{"version":3,"file":"connect.js","sourceRoot":"","sources":["../src/connect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EACL,cAAc,EACd,aAAa,EACb,SAAS,EACT,WAAW,EACX,SAAS,EACT,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,QAAQ,GAKT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,CAAC,EAAE,MAAM,aAAa,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAqB,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAmB,MAAM,kBAAkB,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AA0EnD;;;kCAGkC;AAClC;;;;;;;;;qEASqE;AACrE,MAAM,UAAU,YAAY,CAAC,IAAgB;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,GAAG,GAAG,EAAE,CAAC;IACjH,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC;AAC/E,CAAC;AAED;gFACgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC;AAiBpC;;;;;yEAKyE;AACzE,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAgB,EAAE,IAAY;IAC/D,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI;QAC9C,MAAM,IAAI,KAAK,CAAC,4DAA4D,IAAI,IAAI,CAAC,CAAC;IACxF,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;IACzB,IAAI,QAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAe,eAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,UAAU,IAAI,CAAC,KAAK,eAAe,EAAE,CAAC,QAAQ,oIAAoI,CACnL,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5G,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;IAC/C,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACnE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;AAC3G,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAgB,EAAE,IAAY;IACrE,IAAI,CAAC;QACH,OAAO,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;8CAI8C;AAC9C,SAAS,mBAAmB,CAAC,MAAc;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAGxE,CAAC;QACF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,EAAE,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK;YACjH,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,IAAI,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY;YAC3E,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAC9F,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;IAClG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,yEAAyE,CAAC,CAAC;IAC/L,CAAC;AACH,CAAC;AAED;;;kGAGkG;AAClG,MAAM,UAAU,uCAAuC,CAAC,KAAa,EAAE,MAA0B,EAAE,IAAY;IAC7G,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,iBAAiB,GAAG,QAAQ,EAAE,IAAI,KAAK,MAAM,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC5G,MAAM,cAAc,GAAG,gBAAgB,CAAC,aAAa,EAAE,EAAE,KAAK,CAAC,CAAC;IAChE,IAAI,CAAC,iBAAiB,IAAI,CAAC,cAAc;QAAE,OAAO;IAClD,OAAO,CAAC,KAAK,CACX,CAAC,CAAC,GAAG,CACH,KAAK,IAAI,+DAA+D,KAAK,oGAAoG,CAClL,CACF,CAAC;IACF,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,kGAAkG,CAAC,CAAC,CAAC;IACzH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAmB,EAAE,IAAa;IACpE,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,aAAa,CAAC;QAC3C,gGAAgG;QAChG,yFAAyF;QACzF,+FAA+F;QAC/F,iGAAiG;QACjG,sBAAsB;QACtB,uCAAuC,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,cAAc,CAAC;QAC9C,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,2BAA2B,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAChD,4FAA4F;QAC5F,4FAA4F;QAC5F,2FAA2F;QAC3F,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACzC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9C,CAAC;IACD,kGAAkG;IAClG,8FAA8F;IAC9F,6FAA6F;IAC7F,gGAAgG;IAChG,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,4FAA4F;QAC5F,+FAA+F;QAC/F,yFAAyF;QACzF,8DAA8D;QAC9D,IAAI,gBAAgB,CAAC,aAAa,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACnD,OAAO,CAAC,KAAK,CACX,CAAC,CAAC,GAAG,CACH,YAAY,KAAK,CAAC,KAAK,uJAAuJ,CAC/K,CACF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,6FAA6F;QAC7F,wEAAwE;QACxE,MAAM,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACvF,+FAA+F;IAC/F,iGAAiG;IACjG,6FAA6F;IAC7F,+FAA+F;IAC/F,EAAE;IACF,wFAAwF;IACxF,+FAA+F;IAC/F,iGAAiG;IACjG,oFAAoF;IACpF,2FAA2F;IAC3F,iFAAiF;IACjF,EAAE;IACF,4FAA4F;IAC5F,8FAA8F;IAC9F,4FAA4F;IAC5F,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,IAAI,IAAI,KAAK,2BAA2B,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;YAC5E,OAAO,CAAC,KAAK,CACX,CAAC,CAAC,GAAG,CACH,sBAAsB,IAAI,6JAA6J,CACxL,CACF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,sFAAsF;IACtF,4FAA4F;IAC5F,4FAA4F;IAC5F,MAAM,UAAU,GAAG,IAAI,KAAK,2BAA2B,IAAI,IAAI,KAAK,sBAAsB,IAAI,IAAI,KAAK,UAAU,CAAC;IAClH,IAAI,KAAyB,CAAC;IAC9B,IAAI,QAA8B,CAAC;IACnC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;YAC/B,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5E,QAAQ,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;QAC3D,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,MAAM,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACrC,+FAA+F;IAC/F,8FAA8F;IAC9F,6EAA6E;IAC7E,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM;QACvI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAAmB;IAChE,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CACX,CAAC,CAAC,GAAG,CACH,gJAAgJ,CACjJ,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACvF,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,CAAC,KAAK,CACX,CAAC,CAAC,GAAG,CACH,2EAA2E,MAAM,CAAC,IAAI,yEAAyE,CAChK,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;+DAS+D;AAC/D,KAAK,UAAU,iBAAiB,CAAC,MAAkB;IACjD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAS,CAAC,CAAC,+DAA+D;IAC5F,IAAI,QAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAe,eAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CACX,CAAC,CAAC,GAAG,CACH,YAAY,MAAM,CAAC,KAAK,eAAe,EAAE,CAAC,QAAQ,oIAAoI,CACvL,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC;YAC/D,KAAK,EAAE,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC;YACxC,GAAG,EAAE,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC;YAChD,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,cAAc;SACtB,CAAC,CAAC;QACH,8FAA8F;QAC9F,2FAA2F;QAC3F,6FAA6F;QAC7F,sDAAsD;QACtD,MAAM,CAAC,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACtC,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,GAAG,EAAE,MAAM,CAAC,WAAW;YACvB,MAAM;YACN,aAAa;YACb,QAAQ,EAAE,EAAE;YACZ,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,YAAY,EAAE;SAClE,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;mGAEmG;AACnG,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,OAAgB,EAAE;IACtE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO;IACrB,gGAAgG;IAChG,4FAA4F;IAC5F,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACzG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED;;;;;+EAK+E;AAC/E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAGzC;IACC,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,MAAM,gBAAgB,EAAE,CAAC;IAC3C,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;IACD,gGAAgG;IAChG,kGAAkG;IAClG,8CAA8C;IAC9C,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;QACvD,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB,GAAG,sBAAsB,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACxF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;0BAK0B;AAC1B,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAkB,EAAE,UAAmB;IAC3E,2FAA2F;IAC3F,0FAA0F;IAC1F,4FAA4F;IAC5F,2FAA2F;IAC3F,oDAAoD;IACpD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,IAAI,MAAM,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO;QAC7C,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,KAAK,QAAQ,MAAM,CAAC,MAAM,wEAAwE,CAAC,CAAC,CAAC;QAC3I,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACpD,IAAI,CAAC,CAAC,EAAE;QAAE,OAAO;IACjB,iGAAiG;IACjG,gGAAgG;IAChG,0FAA0F;IAC1F,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzD,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACnG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/dist/index.d.ts

@@ -14,11 +14,14 @@ export * from "./maintenance.js";
 export * from "./flags.js";
 export * from "./provenance.js";
 export * from "./mesh-registry.js";
+export * from "./broker-policy.js";
 export * from "./mesh-target.js";
 export * from "./preflight.js";
 export * from "./render.js";
 export * from "./renewal.js";
 export * from "./secret-store-fs.js";
 export * from "./space.js";
+export * from "./system-rotation.js";
 export * from "./win-cmd.js";
+export * from "./pid.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,sBAAsB,CAAC;AACrC,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC"}

package/dist/index.js

@@ -14,11 +14,14 @@ export * from "./maintenance.js";
 export * from "./flags.js";
 export * from "./provenance.js";
 export * from "./mesh-registry.js";
+export * from "./broker-policy.js";
 export * from "./mesh-target.js";
 export * from "./preflight.js";
 export * from "./render.js";
 export * from "./renewal.js";
 export * from "./secret-store-fs.js";
 export * from "./space.js";
+export * from "./system-rotation.js";
 export * from "./win-cmd.js";
+export * from "./pid.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,sBAAsB,CAAC;AACrC,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC"}

package/dist/mesh-registry.d.ts

@@ -1,6 +1,9 @@
 /**
- * The registry of running meshes: one record per broker `cotal up` started on this machine, so a
- * `cotal spawn` from *any* directory can find which mesh to join, with which creds and personas.
+ * The registry of meshes this machine can reach, so a `cotal spawn` from *any* directory can find
+ * which mesh to join, with which creds and personas. One record per broker `cotal up` started here,
+ * plus any an operator registered by hand with `cotal meshes add` — a mesh running on another
+ * machine, which no local command could otherwise describe. {@link MeshEntry.origin} is which, and
+ * decides what may delete the record without being told to.
  *
  * Stored as **one JSON file per mesh** (`~/.cotal/meshes/<space>.json`) rather than a single
  * `meshes.json`: concurrent `up`/`down` never read-modify-write the same file (no lost-update race),
@@ -35,6 +38,37 @@ export interface MeshEntry {
      *  a manifest deploy — reads it back, or the attach face silently reverts to loopback and remote
      *  `cotal attach` dies. Absent means the operator never asked for exposure: loopback, as before. */
     attachHost?: string;
+    /** TLS-REQUIRED CLIENT INTENT: this broker serves TLS, so every first-party connection resolved
+     *  through this record must REQUIRE it rather than merely tolerate it. Absent means no such
+     *  decision was recorded (and is what any record written before this field means).
+     *
+     *  It is deliberately a bare flag and NOT the cert or key paths. Those live in the broker launch
+     *  policy under the workspace root, because this record is machine-home state that feeds status
+     *  output, join links and mesh messages — none of which should carry a path to a private key.
+     *
+     *  Why the flag has to exist at all, rather than clients inferring TLS from the broker: a NATS
+     *  client that omits the requirement still CONNECTS to a TLS broker, by upgrading the same socket
+     *  once it reads `tls_required` in the server's INFO. But that INFO is unauthenticated plaintext,
+     *  so an on-path attacker can forge one without it — and a client with no requirement of its own
+     *  will then send its credentials in the clear. The flag is what turns "encrypted if the server
+     *  says so" into "encrypted or refuse". */
+    tlsRequired?: boolean;
+    /** Who put this record here — and therefore what may take it out. `up` (the default, and what any
+     *  record written without the field is) means THIS machine started the mesh: it is safe to drop
+     *  on a liveness verdict or a local teardown, because `cotal up` writes it straight back.
+     *  `manual` means an operator registered it by hand (`cotal meshes add`) — typically a mesh
+     *  running on another machine, whose record nothing here can reconstruct.
+     *
+     *  A `manual` record is removed or downgraded only by an act that NAMES it, or by a launch that
+     *  demonstrably BECOMES that mesh:
+     *   - `cotal meshes rm` (drops it) and `cotal meshes add --force` (replaces it);
+     *   - a `cotal up` that actually starts the broker for that same space, server and root — it now
+     *     runs the mesh, so it claims the record and `cotal down` clears it again.
+     *  Nothing else infers its way past: not the liveness sweep, not the classified preflight prune,
+     *  not `cotal down` / `cotal clean all` sweeping a shared root, and not a `cotal up` REFRESH that
+     *  merely found a broker already answering (it starts nothing, so it keeps the origin). A `cotal
+     *  up` for that space anywhere else refuses outright rather than reclaim the name. */
+    origin?: "up" | "manual";
     /** ISO timestamp of when the record was written. */
     ts: string;
 }
@@ -61,11 +95,19 @@ export interface UserAuthInfo {
  *  workstation layer owns this shape (core stays IdP-agnostic), so the boundary where an
  *  arbitrary provider's metadata enters the registry is checked here, fail-loud. */
 export declare function assertUserAuthInfo(v: unknown): UserAuthInfo;
-/** The cotal machine-home dir, overridable via `COTAL_HOME` so tests sandbox it and never touch the
- *  real one. POSIX: `~/.cotal`. Windows: `%LOCALAPPDATA%\Cotal` — the platform's place for per-user
- *  app state (a dotdir in the profile root is a Unix idiom; `%LOCALAPPDATA%` is already a per-user
- *  private dir, so secrets under it start owner-only). The single source of that path for the
- *  registry, the current pointer, and the onboard marker. */
+/** The cotal machine-home dir, overridable via `COTAL_HOME`.
+ *
+ *  WHAT THE OVERRIDE ENFORCES (and only this): the mesh registry (`meshes/`), the current-mesh
+ *  pointer, and the onboard marker resolve under this directory. POSIX default `~/.cotal`; Windows
+ *  `%LOCALAPPDATA%\Cotal`.
+ *
+ *  WHAT IT DOES NOT ENFORCE: project-root state. `cotal up`, broker launch policy
+ *  (`.cotal/broker-policy.json`), the NATS store, manager/delivery pidfiles, and auth material all
+ *  resolve via {@link findCotalRoot} (walk up from cwd for a `.cotal/`). Setting only `COTAL_HOME`
+ *  does not redirect those paths. A test or probe that sets `COTAL_HOME` and runs a real
+ *  `cotal up` from a tree whose walked root is the operator home can still write live operator
+ *  config. Sandbox the project root too (temp dir with its own `.cotal/`, and run the CLI with
+ *  `cwd` there) — or you have sandboxed the registry label, not the launch surface. */
 export declare function homeCotalDir(): string;
 /** Directory holding the per-mesh registry files (`~/.cotal/meshes`). */
 export declare function meshesDir(): string;
@@ -73,6 +115,20 @@ export declare function meshesDir(): string;
 export declare function recordMesh(m: MeshEntry): void;
 /** Drop a mesh from the registry (on `cotal down` / a stale-entry prune). Absent ⇒ no-op. */
 export declare function removeMesh(space: string): void;
+/**
+ * Drop a record because its mesh looks GONE — the auto-prune path, as opposed to the operator
+ * saying so. Returns whether the record was actually removed.
+ *
+ * Every automatic deletion goes through here rather than {@link removeMesh}, because the rule is one
+ * rule and forgetting it at a single site is the whole failure: a `manual` record (`cotal meshes
+ * add`) is NEVER auto-pruned. An `up` record is safe to drop — `cotal up` writes it back — but a
+ * manual one usually describes a mesh on ANOTHER machine, and nothing on this machine can
+ * reconstruct the server URL, root and mode the operator typed. A sleeping laptop or a VPN blip
+ * would otherwise unregister a perfectly healthy remote mesh for good (observed exactly once, and
+ * once was enough). An unreachable manual record is a STATE the surfaces report ("offline"), not a
+ * deletion; `cotal meshes rm` is how it leaves.
+ */
+export declare function pruneMesh(space: string): boolean;
 /** Every registry entry recorded for THIS project root, matched {@link canonicalRoot}-wise so a
  *  differently-spelled root still matches. The root is the only sound key for a local operation on
  *  an OPEN mesh, which has no auth material to resolve its space NAME from — that would fall back
@@ -80,9 +136,24 @@ export declare function removeMesh(space: string): void;
  *  the registry must go through here: a raw `===` silently misses, which for a safety check (e.g.
  *  `cotal clean`'s reachable-broker refusal) reads as "no mesh recorded" and lets it proceed. */
 export declare function meshesForRoot(root: string): MeshEntry[];
-/** Drop every registry entry recorded for THIS project root, releasing the `current` pointer per
- *  removed entry (on `cotal down` / `cotal clean all`). Returns the removed space names. */
+/**
+ * Drop the entries recorded for THIS project root because the mesh they describe was just stopped
+ * or wiped (`cotal down` / `cotal clean all`), releasing the `current` pointer per removed entry.
+ * Returns the removed space names.
+ *
+ * OPERATOR-REGISTERED entries are skipped. The root is shared, not owned: `cotal meshes add`
+ * defaults `--root` to the project you run it in, so registering a mesh that runs elsewhere from
+ * inside your own project files both records under one root. Tearing down THIS project's mesh says
+ * nothing about the remote one, and deleting its record here is the unrecoverable case (`down` can
+ * rewrite what `up` wrote; nothing rewrites a hand-registered record). `cotal meshes rm` is how one
+ * of those leaves.
+ */
 export declare function removeMeshesByRoot(root: string): string[];
+/** The entries this root actually RUNS — what a local teardown or wipe may act on. The complement
+ *  of the skip in {@link removeMeshesByRoot}, exported so a caller that guards on "is this root's
+ *  mesh still live" asks about its OWN mesh: a hand-registered record co-rooted here points at a
+ *  broker on another machine, which the operator cannot stop and must not be blocked by. */
+export declare function localMeshesForRoot(root: string): MeshEntry[];
 /** All currently-recorded meshes. An unparseable/partially-written entry is skipped, not fatal —
  *  one bad file must not hide the rest. One record per space: if a pre-hex legacy file and the
  *  canonical `space.<hex>` file both name the same space (a crash between {@link recordMesh}'s

package/dist/mesh-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mesh-registry.d.ts","sourceRoot":"","sources":["../src/mesh-registry.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,SAAS;IACxB,wDAAwD;IACxD,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC;IACb;;8FAE0F;IAC1F,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAC/B;;;6FAGyF;IACzF,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;;;;;;wGAMoG;IACpG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;;+FAI+F;AAC/F,MAAM,WAAW,YAAY;IAC3B,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,iGAAiG;IACjG,GAAG,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,mGAAmG;IACnG,SAAS,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9B;AAED;;oFAEoF;AACpF,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG,YAAY,CAY3D;AAED;;;;6DAI6D;AAC7D,wBAAgB,YAAY,IAAI,MAAM,CAKrC;AAED,yEAAyE;AACzE,wBAAgB,SAAS,IAAI,MAAM,CAElC;AA2CD,kGAAkG;AAClG,wBAAgB,UAAU,CAAC,CAAC,EAAE,SAAS,GAAG,IAAI,CAY7C;AAED,6FAA6F;AAC7F,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAG9C;AAWD;;;;;iGAKiG;AACjG,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,CAGvD;AAED;4FAC4F;AAC5F,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAQzD;AAED;;;4FAG4F;AAC5F,wBAAgB,UAAU,IAAI,SAAS,EAAE,CA0BxC;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAE7D;AAED;;oBAEoB;AACpB,wBAAgB,UAAU,IAAI,MAAM,GAAG,SAAS,CAM/C;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAG9C;AAED,wBAAgB,YAAY,IAAI,IAAI,CAEnC"}
+{"version":3,"file":"mesh-registry.d.ts","sourceRoot":"","sources":["../src/mesh-registry.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,SAAS;IACxB,wDAAwD;IACxD,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC;IACb;;8FAE0F;IAC1F,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAC/B;;;6FAGyF;IACzF,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;;;;;;wGAMoG;IACpG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;;+CAa2C;IAC3C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;;;;0FAcsF;IACtF,MAAM,CAAC,EAAE,IAAI,GAAG,QAAQ,CAAC;IACzB,oDAAoD;IACpD,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;;+FAI+F;AAC/F,MAAM,WAAW,YAAY;IAC3B,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,iGAAiG;IACjG,GAAG,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,mGAAmG;IACnG,SAAS,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9B;AAED;;oFAEoF;AACpF,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG,YAAY,CAY3D;AAED;;;;;;;;;;;;uFAYuF;AACvF,wBAAgB,YAAY,IAAI,MAAM,CAKrC;AAED,yEAAyE;AACzE,wBAAgB,SAAS,IAAI,MAAM,CAElC;AA2CD,kGAAkG;AAClG,wBAAgB,UAAU,CAAC,CAAC,EAAE,SAAS,GAAG,IAAI,CAY7C;AAED,6FAA6F;AAC7F,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAG9C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAKhD;AAWD;;;;;iGAKiG;AACjG,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,CAGvD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CASzD;AAED;;;4FAG4F;AAC5F,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,CAE5D;AAED;;;4FAG4F;AAC5F,wBAAgB,UAAU,IAAI,SAAS,EAAE,CA0BxC;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAE7D;AAED;;oBAEoB;AACpB,wBAAgB,UAAU,IAAI,MAAM,GAAG,SAAS,CAM/C;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAG9C;AAED,wBAAgB,YAAY,IAAI,IAAI,CAEnC"}

package/dist/mesh-registry.js

@@ -19,11 +19,19 @@ export function assertUserAuthInfo(v) {
     return { provider: o.provider, idp: { url: o.idp.url, issuer: o.idp.issuer, audience: o.idp.audience },
         ...(o.endpoints ? { endpoints: { ...(o.endpoints.url ? { url: o.endpoints.url } : {}) } } : {}) };
 }
-/** The cotal machine-home dir, overridable via `COTAL_HOME` so tests sandbox it and never touch the
- *  real one. POSIX: `~/.cotal`. Windows: `%LOCALAPPDATA%\Cotal` — the platform's place for per-user
- *  app state (a dotdir in the profile root is a Unix idiom; `%LOCALAPPDATA%` is already a per-user
- *  private dir, so secrets under it start owner-only). The single source of that path for the
- *  registry, the current pointer, and the onboard marker. */
+/** The cotal machine-home dir, overridable via `COTAL_HOME`.
+ *
+ *  WHAT THE OVERRIDE ENFORCES (and only this): the mesh registry (`meshes/`), the current-mesh
+ *  pointer, and the onboard marker resolve under this directory. POSIX default `~/.cotal`; Windows
+ *  `%LOCALAPPDATA%\Cotal`.
+ *
+ *  WHAT IT DOES NOT ENFORCE: project-root state. `cotal up`, broker launch policy
+ *  (`.cotal/broker-policy.json`), the NATS store, manager/delivery pidfiles, and auth material all
+ *  resolve via {@link findCotalRoot} (walk up from cwd for a `.cotal/`). Setting only `COTAL_HOME`
+ *  does not redirect those paths. A test or probe that sets `COTAL_HOME` and runs a real
+ *  `cotal up` from a tree whose walked root is the operator home can still write live operator
+ *  config. Sandbox the project root too (temp dir with its own `.cotal/`, and run the CLI with
+ *  `cwd` there) — or you have sandboxed the registry label, not the launch surface. */
 export function homeCotalDir() {
     if (process.env.COTAL_HOME)
         return process.env.COTAL_HOME;
@@ -95,6 +103,26 @@ export function removeMesh(space) {
     rmSync(meshFile(space), { force: true });
     removeLegacyMeshFiles(space); // else a pre-hex record would resurrect the mesh in every listing
 }
+/**
+ * Drop a record because its mesh looks GONE — the auto-prune path, as opposed to the operator
+ * saying so. Returns whether the record was actually removed.
+ *
+ * Every automatic deletion goes through here rather than {@link removeMesh}, because the rule is one
+ * rule and forgetting it at a single site is the whole failure: a `manual` record (`cotal meshes
+ * add`) is NEVER auto-pruned. An `up` record is safe to drop — `cotal up` writes it back — but a
+ * manual one usually describes a mesh on ANOTHER machine, and nothing on this machine can
+ * reconstruct the server URL, root and mode the operator typed. A sleeping laptop or a VPN blip
+ * would otherwise unregister a perfectly healthy remote mesh for good (observed exactly once, and
+ * once was enough). An unreachable manual record is a STATE the surfaces report ("offline"), not a
+ * deletion; `cotal meshes rm` is how it leaves.
+ */
+export function pruneMesh(space) {
+    const m = findMesh(space);
+    if (!m || m.origin === "manual")
+        return false;
+    removeMesh(space);
+    return true;
+}
 /** Canonicalize a project root for comparison. A recorded root is whatever spelling `cotal up` was
  *  run under, so the same directory reaches us by several names: a symlinked root (macOS `/var` →
  *  `/private/var`) or, on Windows, an 8.3 short name (`C:\Users\RUNNER~1\…`) — `process.cwd()` keeps
@@ -118,11 +146,23 @@ export function meshesForRoot(root) {
     const rootKey = canonicalRoot(root);
     return loadMeshes().filter((m) => canonicalRoot(m.root) === rootKey);
 }
-/** Drop every registry entry recorded for THIS project root, releasing the `current` pointer per
- *  removed entry (on `cotal down` / `cotal clean all`). Returns the removed space names. */
+/**
+ * Drop the entries recorded for THIS project root because the mesh they describe was just stopped
+ * or wiped (`cotal down` / `cotal clean all`), releasing the `current` pointer per removed entry.
+ * Returns the removed space names.
+ *
+ * OPERATOR-REGISTERED entries are skipped. The root is shared, not owned: `cotal meshes add`
+ * defaults `--root` to the project you run it in, so registering a mesh that runs elsewhere from
+ * inside your own project files both records under one root. Tearing down THIS project's mesh says
+ * nothing about the remote one, and deleting its record here is the unrecoverable case (`down` can
+ * rewrite what `up` wrote; nothing rewrites a hand-registered record). `cotal meshes rm` is how one
+ * of those leaves.
+ */
 export function removeMeshesByRoot(root) {
     const removed = [];
     for (const m of meshesForRoot(root)) {
+        if (m.origin === "manual")
+            continue;
         removeMesh(m.space);
         if (getCurrent() === m.space)
             clearCurrent();
@@ -130,6 +170,13 @@ export function removeMeshesByRoot(root) {
     }
     return removed;
 }
+/** The entries this root actually RUNS — what a local teardown or wipe may act on. The complement
+ *  of the skip in {@link removeMeshesByRoot}, exported so a caller that guards on "is this root's
+ *  mesh still live" asks about its OWN mesh: a hand-registered record co-rooted here points at a
+ *  broker on another machine, which the operator cannot stop and must not be blocked by. */
+export function localMeshesForRoot(root) {
+    return meshesForRoot(root).filter((m) => m.origin !== "manual");
+}
 /** All currently-recorded meshes. An unparseable/partially-written entry is skipped, not fatal —
  *  one bad file must not hide the rest. One record per space: if a pre-hex legacy file and the
  *  canonical `space.<hex>` file both name the same space (a crash between {@link recordMesh}'s

package/dist/mesh-registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"mesh-registry.js","sourceRoot":"","sources":["../src/mesh-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACtF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAyD/C;;oFAEoF;AACpF,MAAM,UAAU,kBAAkB,CAAC,CAAU;IAC3C,MAAM,CAAC,GAAG,CAAiB,CAAC;IAC5B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ;QACtF,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG;QAC1F,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ;QAC5G,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QACrF,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;QACpG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACtG,CAAC;AAED;;;;6DAI6D;AAC7D,MAAM,UAAU,YAAY;IAC1B,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IAC1D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,SAAS;IACvB,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED;;;;qDAIqD;AACrD,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC;AACvC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;eAIe;AACf,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,kBAAkB;IAC5B,CAAC;IACD,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAc,CAAC;YAChF,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;gBAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,cAAc,CAAC,CAAC;AAC9C,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,UAAU,CAAC,CAAY;IACrC,iGAAiG;IACjG,0FAA0F;IAC1F,qCAAqC;IACrC,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC/B,4FAA4F;IAC5F,uCAAuC;IACvC,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACzC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,wDAAwD;IAC1G,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,6DAA6D;IACpF,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,kEAAkE;AACpG,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,kEAAkE;AAClG,CAAC;AAED;;;;gDAIgD;AAChD,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC;QAAC,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AACrE,CAAC;AAED;;;;;iGAKiG;AACjG,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC;AACvE,CAAC;AAED;4FAC4F;AAC5F,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,UAAU,EAAE,KAAK,CAAC,CAAC,KAAK;YAAE,YAAY,EAAE,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;4FAG4F;AAC5F,MAAM,UAAU,UAAU;IACxB,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,kBAAkB;IAC/B,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoD,CAAC;IAC5E,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7B,IAAI,KAAgB,CAAC;QACrB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAc,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,0EAA0E;QACtF,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK;YAAE,SAAS,CAAC,+BAA+B;QAC9F,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,sFAAsF;QACxF,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,OAAO,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AACrD,CAAC;AAED;;oBAEoB;AACpB,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC;IAC5B,eAAe,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"mesh-registry.js","sourceRoot":"","sources":["../src/mesh-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACtF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AA2F/C;;oFAEoF;AACpF,MAAM,UAAU,kBAAkB,CAAC,CAAU;IAC3C,MAAM,CAAC,GAAG,CAAiB,CAAC;IAC5B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ;QACtF,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG;QAC1F,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ;QAC5G,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QACrF,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;QACpG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACtG,CAAC;AAED;;;;;;;;;;;;uFAYuF;AACvF,MAAM,UAAU,YAAY;IAC1B,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IAC1D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,SAAS;IACvB,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED;;;;qDAIqD;AACrD,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC;AACvC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;eAIe;AACf,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,kBAAkB;IAC5B,CAAC;IACD,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAc,CAAC;YAChF,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;gBAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,cAAc,CAAC,CAAC;AAC9C,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,UAAU,CAAC,CAAY;IACrC,iGAAiG;IACjG,0FAA0F;IAC1F,qCAAqC;IACrC,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC/B,4FAA4F;IAC5F,uCAAuC;IACvC,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACzC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,wDAAwD;IAC1G,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,6DAA6D;IACpF,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,kEAAkE;AACpG,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,kEAAkE;AAClG,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,UAAU,CAAC,KAAK,CAAC,CAAC;IAClB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;gDAIgD;AAChD,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC;QAAC,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AACrE,CAAC;AAED;;;;;iGAKiG;AACjG,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,SAAS;QACpC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,UAAU,EAAE,KAAK,CAAC,CAAC,KAAK;YAAE,YAAY,EAAE,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;4FAG4F;AAC5F,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;AAClE,CAAC;AAED;;;4FAG4F;AAC5F,MAAM,UAAU,UAAU;IACxB,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,kBAAkB;IAC/B,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoD,CAAC;IAC5E,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7B,IAAI,KAAgB,CAAC;QACrB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAc,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,0EAA0E;QACtF,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK;YAAE,SAAS,CAAC,+BAA+B;QAC9F,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,sFAAsF;QACxF,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,OAAO,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AACrD,CAAC;AAED;;oBAEoB;AACpB,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC;IAC5B,eAAe,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACzC,CAAC"}