@cotal-ai/workspace 0.15.0 → 0.17.0

package/dist/mesh-target.d.ts

@@ -17,12 +17,22 @@ export interface MeshTarget {
     /** The mesh's auth mode — `user` is its OWN connect path (login + bearer), a hard branch:
      *  it never static-mints from `auth` and never connects credlessly like `open`. */
     mode: MeshEntry["mode"];
+    /** Whether connections to this mesh must REQUIRE TLS, carried through from the mesh record's
+     *  `tlsRequired`. Non-optional so the resolver cannot forget it: an omitted TLS requirement is
+     *  the dangerous default, because a client with none still connects to a TLS broker and looks
+     *  fine, while remaining downgradeable by a forged plaintext INFO. */
+    tlsRequired: boolean;
     /** Trust material, for a STATIC-auth mesh only — undefined for open AND for user mode (a
      *  user-mode root may still hold `auth.json` on disk; deliberately not loaded here so no caller
      *  can drift into minting static creds for a user-auth space). */
     auth?: SpaceAuth;
     /** User-auth client metadata (from the registry entry), present iff `mode === "user"`. */
     userAuth?: UserAuthInfo;
+    /** Who registered the mesh this target came from — see {@link MeshEntry.origin}. Absent for a
+     *  target resolved off disk rather than a record. Surfaces read it to say the right thing when
+     *  the broker is down: an `up` mesh is restarted with `cotal up`, a `manual` one runs somewhere
+     *  this machine does not control (so the local remedy is `cotal meshes rm`, not `cotal up`). */
+    origin?: MeshEntry["origin"];
     /** `<root>/.cotal/agents` — the persona catalog for this mesh. */
     personaRoot: string;
     /** Where the target came from — this also carries OWNERSHIP for pruning. `registry`/`current`/
@@ -59,6 +69,9 @@ export interface MeshTargetErrorDetails {
     requested?: string;
     /** For `stale-auth-root`: the space the on-disk auth now claims, diverging from the record. */
     found?: string;
+    /** For `stale-auth-root`: whether the diverging record was actually removed. An operator-registered
+     *  record is kept (see `pruneMesh`), and the copy must not claim a removal that did not happen. */
+    removed?: boolean;
 }
 /**
  * A typed mesh-target resolution failure. `message` is **log/dev-safe and command-agnostic** — never
@@ -77,6 +90,9 @@ export declare class MeshTargetError extends Error {
 /** Detect a {@link MeshTargetError} across the core/workspace/consumer package boundary without a
  *  brittle `instanceof` (which breaks if two copies of this package are installed) — a brand check. */
 export declare function isWorkspaceTargetError(e: unknown): e is MeshTargetError;
+/** `<root>/.cotal/agents` — a mesh's persona catalog. Exported because registration
+ *  (`cotal meshes add`) builds a target by hand and must resolve it to the same path this does. */
+export declare function personaDir(root: string): string;
 /**
  * Resolve the mesh target by precedence (first match wins):
  *  1. `--space` — registry lookup (errors if that space isn't running).

package/dist/mesh-target.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mesh-target.d.ts","sourceRoot":"","sources":["../src/mesh-target.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiC,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE/E,OAAO,EAML,KAAK,SAAS,EACd,KAAK,YAAY,EAClB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd;uFACmF;IACnF,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACxB;;sEAEkE;IAClE,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;4GAMwG;IACxG,MAAM,EACF,aAAa,GACb,YAAY,GACZ,qBAAqB,GACrB,aAAa,GACb,gBAAgB,GAChB,UAAU,GACV,SAAS,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;8DAE8D;AAC9D,MAAM,MAAM,mBAAmB,GAC3B,WAAW,GACX,eAAe,GACf,kBAAkB,GAClB,kBAAkB,GAClB,iBAAiB,GACjB,iBAAiB,GACjB,sBAAsB,CAAC;AAE3B;qGACqG;AACrG,MAAM,WAAW,sBAAsB;IACrC,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAID;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,mFAAmF;IACnF,QAAQ,CAAC,KAAK,uCAA0B;IACxC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;gBAEvC,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,sBAA2B,EACpC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAOhC;AAED;uGACuG;AACvG,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,eAAe,CAMvE;AAiJD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,YAAiB,GAAG,UAAU,CA4FnF"}
+{"version":3,"file":"mesh-target.d.ts","sourceRoot":"","sources":["../src/mesh-target.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiC,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE/E,OAAO,EAML,KAAK,SAAS,EACd,KAAK,YAAY,EAClB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd;uFACmF;IACnF,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACxB;;;0EAGsE;IACtE,WAAW,EAAE,OAAO,CAAC;IACrB;;sEAEkE;IAClE,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;;;oGAGgG;IAChG,MAAM,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC7B,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;4GAMwG;IACxG,MAAM,EACF,aAAa,GACb,YAAY,GACZ,qBAAqB,GACrB,aAAa,GACb,gBAAgB,GAChB,UAAU,GACV,SAAS,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;8DAE8D;AAC9D,MAAM,MAAM,mBAAmB,GAC3B,WAAW,GACX,eAAe,GACf,kBAAkB,GAClB,kBAAkB,GAClB,iBAAiB,GACjB,iBAAiB,GACjB,sBAAsB,CAAC;AAE3B;qGACqG;AACrG,MAAM,WAAW,sBAAsB;IACrC,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;uGACmG;IACnG,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAID;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,mFAAmF;IACnF,QAAQ,CAAC,KAAK,uCAA0B;IACxC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;gBAEvC,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,sBAA2B,EACpC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAOhC;AAED;uGACuG;AACvG,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,eAAe,CAMvE;AAED;mGACmG;AACnG,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/C;AAgJD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,YAAiB,GAAG,UAAU,CA4FnF"}

package/dist/mesh-target.js

@@ -2,7 +2,7 @@ import { existsSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { DEFAULT_SERVER, DEFAULT_SPACE } from "@cotal-ai/core";
 import { accountInventory, authDir, findCotalRoot, hasUserAuthState, listSpaceAccounts, loadSpaceAuth, soleSpaceOf, userAuthSpacesOnDisk } from "./auth-paths.js";
-import { findMesh, getCurrent, homeCotalDir, loadMeshes, removeMesh, } from "./mesh-registry.js";
+import { findMesh, getCurrent, homeCotalDir, loadMeshes, pruneMesh, } from "./mesh-registry.js";
 const WORKSPACE_TARGET_ERROR = "cotal:workspace:mesh-target-error";
 /**
  * A typed mesh-target resolution failure. `message` is **log/dev-safe and command-agnostic** — never
@@ -28,7 +28,9 @@ export function isWorkspaceTargetError(e) {
         e !== null &&
         e.brand === WORKSPACE_TARGET_ERROR);
 }
-function personaRoot(root) {
+/** `<root>/.cotal/agents` — a mesh's persona catalog. Exported because registration
+ *  (`cotal meshes add`) builds a target by hand and must resolve it to the same path this does. */
+export function personaDir(root) {
     return join(root, ".cotal", "agents");
 }
 /** Refuse to resolve a single mesh when ROOT's on-disk account inventory says it hosts more than
@@ -90,8 +92,8 @@ function targetFromEntry(m, server, source) {
         if (!auth) {
             const found = listSpaceAccounts(authDir(m.root));
             if (found.length) {
-                removeMesh(m.space);
-                throw new MeshTargetError("stale-auth-root", `registry entry "${m.space}" points at ${m.root}, whose on-disk auth is now for "${found.join('", "')}"`, { space: m.space, root: m.root, found: found.join(", ") });
+                const removed = pruneMesh(m.space);
+                throw new MeshTargetError("stale-auth-root", `registry entry "${m.space}" points at ${m.root}, whose on-disk auth is now for "${found.join('", "')}"`, { space: m.space, root: m.root, found: found.join(", "), removed });
             }
         }
     }
@@ -107,9 +109,11 @@ function targetFromEntry(m, server, source) {
         server,
         space: m.space,
         mode: m.mode,
+        tlsRequired: m.tlsRequired === true,
         auth,
         ...(userAuth ? { userAuth } : {}),
-        personaRoot: personaRoot(m.root),
+        ...(m.origin ? { origin: m.origin } : {}),
+        personaRoot: personaDir(m.root),
         source,
     };
 }
@@ -140,7 +144,8 @@ function localTarget(root, server, source) {
         : userAuthSpacesOnDisk(authDir(root))[0];
     if (userSpace !== undefined)
         throw new MeshTargetError("user-auth-unrecorded", `space "${userSpace}" has user auth enabled on disk but no usable registry entry`, { space: userSpace, root });
-    return { root, server, space, mode: auth ? "auth" : "open", auth, personaRoot: personaRoot(root), source };
+    // No mesh record on this path, so there is no recorded TLS decision to honour.
+    return { root, server, space, mode: auth ? "auth" : "open", tlsRequired: false, auth, personaRoot: personaDir(root), source };
 }
 /** A `.cotal/` that a user actually created here — not the machine-home dir the cwd walk-up lands on
  *  from outside any project (which has no space, just the daemon's pid/onboard files). */

package/dist/mesh-target.js.map

@@ -1 +1 @@
-{"version":3,"file":"mesh-target.js","sourceRoot":"","sources":["../src/mesh-target.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAkB,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAClK,OAAO,EACL,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,UAAU,EACV,UAAU,GAGX,MAAM,oBAAoB,CAAC;AAgF5B,MAAM,sBAAsB,GAAG,mCAAmC,CAAC;AAEnE;;;;GAIG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,mFAAmF;IAC1E,KAAK,GAAG,sBAAsB,CAAC;IAC/B,IAAI,CAAsB;IAC1B,OAAO,CAAyB;IACzC,YACE,IAAyB,EACzB,OAAe,EACf,UAAkC,EAAE,EACpC,OAA6B;QAE7B,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED;uGACuG;AACvG,MAAM,UAAU,sBAAsB,CAAC,CAAU;IAC/C,OAAO,CACL,OAAO,CAAC,KAAK,QAAQ;QACrB,CAAC,KAAK,IAAI;QACT,CAAyB,CAAC,KAAK,KAAK,sBAAsB,CAC5D,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED;;;;;uCAKuC;AACvC;;;;;2FAK2F;AAC3F,SAAS,gBAAgB,CAAC,IAAY,EAAE,KAAa;IACnD,IAAI,CAAC;QACH,OAAO,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAG,CAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY;IAC5C,iGAAiG;IACjG,6FAA6F;IAC7F,kGAAkG;IAClG,uBAAuB;IACvB,IAAI,GAA4C,CAAC;IACjD,IAAI,CAAC;QACH,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAG,CAAW,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QACxB,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,GAAG,IAAI,UAAU,GAAG,CAAC,OAAO,CAAC,MAAM,kCAAkC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,yDAAyD,EACpJ,EAAE,IAAI,EAAE,CACT,CAAC;IACJ,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACvB,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,GAAG,IAAI,gCAAgC,GAAG,CAAC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,EACpH,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,CAChC,CAAC;AACN,CAAC;AAED,SAAS,eAAe,CAAC,CAAY,EAAE,MAAc,EAAE,MAA4B;IACjF,4FAA4F;IAC5F,6FAA6F;IAC7F,gGAAgG;IAChG,+FAA+F;IAC/F,IAAI,IAA2B,CAAC;IAChC,IAAI,QAAkC,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACtB,4FAA4F;QAC5F,gGAAgG;QAChG,gGAAgG;QAChG,+FAA+F;QAC/F,+DAA+D;QAC/D,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACzC,gGAAgG;QAChG,6FAA6F;QAC7F,gGAAgG;QAChG,8FAA8F;QAC9F,2DAA2D;QAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACjD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,mBAAmB,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,IAAI,oCAAoC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EACxG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1D,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC7B,8FAA8F;QAC9F,4EAA4E;QAC5E,IAAI,CAAC,CAAC,CAAC,QAAQ;YACb,MAAM,IAAI,eAAe,CACvB,sBAAsB,EACtB,mBAAmB,CAAC,CAAC,KAAK,4CAA4C,EACtE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CACjC,CAAC;QACJ,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;IACxB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM;QACN,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI;QACJ,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QAChC,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc,EAAE,MAA4B;IAC7E,2FAA2F;IAC3F,gGAAgG;IAChG,mGAAmG;IACnG,6DAA6D;IAC7D,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,aAAa,CAAC;IACtD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAG,CAAW,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3C,gGAAgG;IAChG,iGAAiG;IACjG,+FAA+F;IAC/F,gGAAgG;IAChG,iGAAiG;IACjG,4FAA4F;IAC5F,gGAAgG;IAChG,MAAM,SAAS,GAAG,IAAI;QACpB,CAAC,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC;YAC7B,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,SAAS;QACb,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,SAAS,KAAK,SAAS;QACzB,MAAM,IAAI,eAAe,CACvB,sBAAsB,EACtB,UAAU,SAAS,8DAA8D,EACjF,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAC3B,CAAC;IACJ,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;AAC7G,CAAC;AAED;0FAC0F;AAC1F,SAAS,cAAc,CAAC,IAAY;IAClC,+FAA+F;IAC/F,oFAAoF;IACpF,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;AACvG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,QAAsB,EAAE;IACrE,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC;YACJ,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,kBAAkB,KAAK,CAAC,KAAK,cAAc,EAAE;gBACtF,SAAS,EAAE,KAAK,CAAC,KAAK;aACvB,CAAC,CAAC;QACL,kGAAkG;QAClG,mGAAmG;QACnG,mGAAmG;QACnG,+DAA+D;QAC/D,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC;QAC3E,OAAO,eAAe,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACzG,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,6FAA6F;QAC7F,6FAA6F;QAC7F,6FAA6F;QAC7F,qEAAqE;QACrE,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC;QACvE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YACrB,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,GAAG,QAAQ,CAAC,MAAM,2BAA2B,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAChI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CACnF,CAAC;QACJ,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAChB,8FAA8F;YAC9F,4FAA4F;YAC5F,8FAA8F;YAC9F,+FAA+F;YAC/F,sBAAsB;YACtB,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC3C,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,IAAI,GAAG;QAAE,OAAO,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAE5D,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,6FAA6F;QAC7F,8FAA8F;QAC9F,+FAA+F;QAC/F,4FAA4F;QAC5F,8FAA8F;QAC9F,sFAAsF;QACtF,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAC/B,iFAAiF;QACjF,+FAA+F;QAC/F,+FAA+F;QAC/F,oEAAoE;QACpE,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5E,mGAAmG;QACnG,mGAAmG;QACnG,6FAA6F;QAC7F,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;YACxB,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,8BAA8B,WAAW,CAAC,MAAM,YAAY,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,EACjI,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAChE,CAAC;QACJ,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,QAAQ;YAAE,OAAO,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAClF,8FAA8F;QAC9F,+FAA+F;QAC/F,6FAA6F;QAC7F,mEAAmE;QACnE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CACxE,CAAC;QACF,IAAI,SAAS;YACX,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,kBAAkB,SAAS,CAAC,KAAK,oBAAoB,cAAc,EAAE,EACrE,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CACnD,CAAC;QACJ,OAAO,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IACnF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAEzF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IAC1D,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,4BAA4B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;QAC5F,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"mesh-target.js","sourceRoot":"","sources":["../src/mesh-target.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAkB,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAClK,OAAO,EACL,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,UAAU,EACV,SAAS,GAGV,MAAM,oBAAoB,CAAC;AA6F5B,MAAM,sBAAsB,GAAG,mCAAmC,CAAC;AAEnE;;;;GAIG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,mFAAmF;IAC1E,KAAK,GAAG,sBAAsB,CAAC;IAC/B,IAAI,CAAsB;IAC1B,OAAO,CAAyB;IACzC,YACE,IAAyB,EACzB,OAAe,EACf,UAAkC,EAAE,EACpC,OAA6B;QAE7B,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED;uGACuG;AACvG,MAAM,UAAU,sBAAsB,CAAC,CAAU;IAC/C,OAAO,CACL,OAAO,CAAC,KAAK,QAAQ;QACrB,CAAC,KAAK,IAAI;QACT,CAAyB,CAAC,KAAK,KAAK,sBAAsB,CAC5D,CAAC;AACJ,CAAC;AAED;mGACmG;AACnG,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED;;;;;uCAKuC;AACvC;;;;;2FAK2F;AAC3F,SAAS,gBAAgB,CAAC,IAAY,EAAE,KAAa;IACnD,IAAI,CAAC;QACH,OAAO,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAG,CAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY;IAC5C,iGAAiG;IACjG,6FAA6F;IAC7F,kGAAkG;IAClG,uBAAuB;IACvB,IAAI,GAA4C,CAAC;IACjD,IAAI,CAAC;QACH,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAG,CAAW,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QACxB,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,GAAG,IAAI,UAAU,GAAG,CAAC,OAAO,CAAC,MAAM,kCAAkC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,yDAAyD,EACpJ,EAAE,IAAI,EAAE,CACT,CAAC;IACJ,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACvB,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,GAAG,IAAI,gCAAgC,GAAG,CAAC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,EACpH,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,CAChC,CAAC;AACN,CAAC;AAED,SAAS,eAAe,CAAC,CAAY,EAAE,MAAc,EAAE,MAA4B;IACjF,4FAA4F;IAC5F,6FAA6F;IAC7F,gGAAgG;IAChG,+FAA+F;IAC/F,IAAI,IAA2B,CAAC;IAChC,IAAI,QAAkC,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACtB,4FAA4F;QAC5F,gGAAgG;QAChG,gGAAgG;QAChG,+FAA+F;QAC/F,+DAA+D;QAC/D,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACzC,gGAAgG;QAChG,6FAA6F;QAC7F,gGAAgG;QAChG,8FAA8F;QAC9F,2DAA2D;QAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACjD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACnC,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,mBAAmB,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,IAAI,oCAAoC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EACxG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CACnE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC7B,8FAA8F;QAC9F,4EAA4E;QAC5E,IAAI,CAAC,CAAC,CAAC,QAAQ;YACb,MAAM,IAAI,eAAe,CACvB,sBAAsB,EACtB,mBAAmB,CAAC,CAAC,KAAK,4CAA4C,EACtE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CACjC,CAAC;QACJ,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;IACxB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM;QACN,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW,KAAK,IAAI;QACnC,IAAI;QACJ,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/B,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc,EAAE,MAA4B;IAC7E,2FAA2F;IAC3F,gGAAgG;IAChG,mGAAmG;IACnG,6DAA6D;IAC7D,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,aAAa,CAAC;IACtD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAG,CAAW,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3C,gGAAgG;IAChG,iGAAiG;IACjG,+FAA+F;IAC/F,gGAAgG;IAChG,iGAAiG;IACjG,4FAA4F;IAC5F,gGAAgG;IAChG,MAAM,SAAS,GAAG,IAAI;QACpB,CAAC,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC;YAC7B,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,SAAS;QACb,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,SAAS,KAAK,SAAS;QACzB,MAAM,IAAI,eAAe,CACvB,sBAAsB,EACtB,UAAU,SAAS,8DAA8D,EACjF,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAC3B,CAAC;IACJ,+EAA+E;IAC/E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;AAChI,CAAC;AAED;0FAC0F;AAC1F,SAAS,cAAc,CAAC,IAAY;IAClC,+FAA+F;IAC/F,oFAAoF;IACpF,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;AACvG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,QAAsB,EAAE;IACrE,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC;YACJ,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,kBAAkB,KAAK,CAAC,KAAK,cAAc,EAAE;gBACtF,SAAS,EAAE,KAAK,CAAC,KAAK;aACvB,CAAC,CAAC;QACL,kGAAkG;QAClG,mGAAmG;QACnG,mGAAmG;QACnG,+DAA+D;QAC/D,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC;QAC3E,OAAO,eAAe,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACzG,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,6FAA6F;QAC7F,6FAA6F;QAC7F,6FAA6F;QAC7F,qEAAqE;QACrE,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC;QACvE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YACrB,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,GAAG,QAAQ,CAAC,MAAM,2BAA2B,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAChI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CACnF,CAAC;QACJ,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAChB,8FAA8F;YAC9F,4FAA4F;YAC5F,8FAA8F;YAC9F,+FAA+F;YAC/F,sBAAsB;YACtB,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC3C,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,IAAI,GAAG;QAAE,OAAO,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAE5D,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,6FAA6F;QAC7F,8FAA8F;QAC9F,+FAA+F;QAC/F,4FAA4F;QAC5F,8FAA8F;QAC9F,sFAAsF;QACtF,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAC/B,iFAAiF;QACjF,+FAA+F;QAC/F,+FAA+F;QAC/F,oEAAoE;QACpE,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5E,mGAAmG;QACnG,mGAAmG;QACnG,6FAA6F;QAC7F,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;YACxB,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,8BAA8B,WAAW,CAAC,MAAM,YAAY,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,EACjI,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAChE,CAAC;QACJ,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,QAAQ;YAAE,OAAO,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAClF,8FAA8F;QAC9F,+FAA+F;QAC/F,6FAA6F;QAC7F,mEAAmE;QACnE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CACxE,CAAC;QACF,IAAI,SAAS;YACX,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,kBAAkB,SAAS,CAAC,KAAK,oBAAoB,cAAc,EAAE,EACrE,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CACnD,CAAC;QACJ,OAAO,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IACnF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAEzF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IAC1D,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,4BAA4B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;QAC5F,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC"}

package/dist/pid.d.ts

@@ -0,0 +1,49 @@
+/**
+ * THE pid-attribution contract for machine-local pidfiles, in ONE place.
+ *
+ * Two copies of "parse a pid" + "is it alive" had drifted (a bounded parser in `auth-proc`, an
+ * unbounded `Number.isInteger` parser plus a two-state `isAlive` in `down`), and the gap between a
+ * guard's validity predicate and what `process.kill` actually accepts is exactly where a live
+ * process gets misread as dead and its pidfile deleted under a clean-stop report. One parser, one
+ * tri-state probe, so every surface that decides "is this record a live process, a dead one, or
+ * unattributable" decides it the same way.
+ *
+ * WHO CAN ACTUALLY CONSUME IT, because "consumed everywhere" was never reachable and claiming it
+ * hid the gap. This lives in `workspace` (machine-local operator tooling), the widest tier that may
+ * hold a local-process concept: the CLI, the manager, the auth service and the web surface all
+ * depend on it. `extensions/*` peer-depend `core` ONLY, and a pid probe is not a wire concept, so
+ * moving it into core to reach them would leak a local concern into the standard. The two
+ * extension-side probes (`connector-opencode`, `connector-hermes`) therefore keep their own copies
+ * BY CONSTRUCTION, not by oversight; if they need this contract, the fix is a shared local-process
+ * module they may depend on, never a core export.
+ */
+/** A Node/POSIX-signalable pid: a positive INTEGER within the signed 32-bit range `process.kill`
+ *  accepts (it throws `ERR_INVALID_ARG_TYPE`/`ERR_OUT_OF_RANGE` outside it). Anything else -
+ *  fractional, non-numeric, non-positive, oversized - is undefined: UNATTRIBUTABLE, never a pid to
+ *  probe or delete a record against. */
+export declare function parsePid(raw: string): number | undefined;
+/** The errno-to-state MAPPING, split out from the syscall so it can be tested exhaustively without
+ *  an environment in the loop. The whole contract turns on one rule: only an actual `ESRCH` proves a
+ *  process gone. `EPERM` (it exists, it is just another user's, so we cannot signal it) is ALIVE.
+ *  Anything else - argument/range errors, unfamiliar errnos, a missing code - is UNKNOWN, never dead.
+ *
+ *  This is exported because the old suite could only reach the EPERM rule by probing pid 1 and
+ *  hoping the process was unprivileged, so as root or in some containers that cell SKIPPED and the
+ *  suite still printed a passing banner: a wrong implementation reading green. A pure mapping has
+ *  no fixture to skip. Found by review, not by me. */
+export declare function livenessFromErrno(code: string | undefined): "alive" | "dead" | "unknown";
+/** Tri-state liveness against the real kernel.
+ *
+ *  CALLERS MUST PICK A DIRECTION, because the two questions pull opposite ways:
+ *    destructive ("may I delete this record?")      -> preserve on doubt: `!== "dead"`
+ *    presence    ("is it up, may I skip starting?") -> require proof:    `=== "alive"`
+ *  A presence check written as `!== "dead"` turns an `unknown` into a permanent, silent, retry-proof
+ *  false-up. Reviewed against a repro that wedged three control-plane retries against an
+ *  unreachable manager. */
+/** The liveness probe as a DEPENDENCY. `unknown` is only producible by kernel policy (a seccomp
+ *  `SECCOMP_RET_ERRNO` filter, an LSM answering `security_task_kill`), so no test input can reach it
+ *  and the branch that handles it would otherwise be guarded by nothing executable. Callers take
+ *  this so that branch can be driven directly. Production passes nothing and gets the real one. */
+export type LivenessProbe = (pid: number) => "alive" | "dead" | "unknown";
+export declare function probeLiveness(pid: number): "alive" | "dead" | "unknown";
+//# sourceMappingURL=pid.d.ts.map

package/dist/pid.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pid.d.ts","sourceRoot":"","sources":["../src/pid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;wCAGwC;AACxC,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGxD;AAED;;;;;;;;sDAQsD;AACtD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAIxF;AAED;;;;;;;2BAO2B;AAC3B;;;mGAGmG;AACnG,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;AAE1E,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAOvE"}

package/dist/pid.js

@@ -0,0 +1,53 @@
+/**
+ * THE pid-attribution contract for machine-local pidfiles, in ONE place.
+ *
+ * Two copies of "parse a pid" + "is it alive" had drifted (a bounded parser in `auth-proc`, an
+ * unbounded `Number.isInteger` parser plus a two-state `isAlive` in `down`), and the gap between a
+ * guard's validity predicate and what `process.kill` actually accepts is exactly where a live
+ * process gets misread as dead and its pidfile deleted under a clean-stop report. One parser, one
+ * tri-state probe, so every surface that decides "is this record a live process, a dead one, or
+ * unattributable" decides it the same way.
+ *
+ * WHO CAN ACTUALLY CONSUME IT, because "consumed everywhere" was never reachable and claiming it
+ * hid the gap. This lives in `workspace` (machine-local operator tooling), the widest tier that may
+ * hold a local-process concept: the CLI, the manager, the auth service and the web surface all
+ * depend on it. `extensions/*` peer-depend `core` ONLY, and a pid probe is not a wire concept, so
+ * moving it into core to reach them would leak a local concern into the standard. The two
+ * extension-side probes (`connector-opencode`, `connector-hermes`) therefore keep their own copies
+ * BY CONSTRUCTION, not by oversight; if they need this contract, the fix is a shared local-process
+ * module they may depend on, never a core export.
+ */
+/** A Node/POSIX-signalable pid: a positive INTEGER within the signed 32-bit range `process.kill`
+ *  accepts (it throws `ERR_INVALID_ARG_TYPE`/`ERR_OUT_OF_RANGE` outside it). Anything else -
+ *  fractional, non-numeric, non-positive, oversized - is undefined: UNATTRIBUTABLE, never a pid to
+ *  probe or delete a record against. */
+export function parsePid(raw) {
+    const n = Number(raw.trim());
+    return Number.isInteger(n) && n > 0 && n <= 0x7fffffff ? n : undefined;
+}
+/** The errno-to-state MAPPING, split out from the syscall so it can be tested exhaustively without
+ *  an environment in the loop. The whole contract turns on one rule: only an actual `ESRCH` proves a
+ *  process gone. `EPERM` (it exists, it is just another user's, so we cannot signal it) is ALIVE.
+ *  Anything else - argument/range errors, unfamiliar errnos, a missing code - is UNKNOWN, never dead.
+ *
+ *  This is exported because the old suite could only reach the EPERM rule by probing pid 1 and
+ *  hoping the process was unprivileged, so as root or in some containers that cell SKIPPED and the
+ *  suite still printed a passing banner: a wrong implementation reading green. A pure mapping has
+ *  no fixture to skip. Found by review, not by me. */
+export function livenessFromErrno(code) {
+    if (code === "ESRCH")
+        return "dead";
+    if (code === "EPERM")
+        return "alive"; // exists, just not ours to signal
+    return "unknown"; // ERR_INVALID_ARG_TYPE / ERR_OUT_OF_RANGE / anything else - cannot attribute
+}
+export function probeLiveness(pid) {
+    try {
+        process.kill(pid, 0);
+        return "alive";
+    }
+    catch (e) {
+        return livenessFromErrno(e.code);
+    }
+}
+//# sourceMappingURL=pid.js.map

package/dist/pid.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pid.js","sourceRoot":"","sources":["../src/pid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;wCAGwC;AACxC,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACzE,CAAC;AAED;;;;;;;;sDAQsD;AACtD,MAAM,UAAU,iBAAiB,CAAC,IAAwB;IACxD,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC;IACpC,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC,CAAC,kCAAkC;IACxE,OAAO,SAAS,CAAC,CAAC,6EAA6E;AACjG,CAAC;AAgBD,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,iBAAiB,CAAE,CAA2B,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC"}

package/dist/preflight.d.ts

@@ -13,7 +13,12 @@ import type { MeshTarget } from "./mesh-target.js";
 /** The five distinct ways a preflight fails. Each also carries whether the target OWNS its registry
  *  entry (→ prune): `fromRegistry` means the server+mode came from a registry record (incl. a
  *  `local-recorded` project matched by root), so a definitive failure is a stale-entry signal. */
-export type PreflightFailure = "unreachable" | "registry-creds-rejected" | "registry-open-now-auth" | "creds-rejected" | "open-wants-auth" | "stale-auth";
+export type PreflightFailure = "unreachable" | "registry-creds-rejected" | "registry-open-now-auth" | "creds-rejected" | "open-wants-auth" | "stale-auth"
+/** A TLS-required NATS listener still greets (INFO.tls_required) but the TLS probe could not
+ *  complete the handshake — typically a private CA without `NODE_EXTRA_CA_CERTS`. NEVER a prune
+ *  signal: INFO is unauthenticated shape evidence, not peer identity; conservatively keep the
+ *  record and repair client trust rather than re-register. */
+ | "tls-trust";
 /** Pure decision tree — separated from I/O so the whole branch tree is unit-testable (it's the
  *  riskiest logic: a wrong branch prunes a LIVE registry entry). Only a registry-OWNED source
  *  (`registry`/`current`/`flag-space`/`local-recorded`) is ever pruned. A non-registry source —
@@ -35,5 +40,14 @@ export declare function preflightTarget(target: MeshTarget, probeCreds?: string)
     kind: PreflightFailure;
     prune: boolean;
 }>;
-export declare function pruneStaleMeshes(): Promise<void>;
+/** What one sweep did. `offline` is the entries whose broker is gone but whose record STAYS —
+ *  operator-registered (`cotal meshes add`) meshes, which {@link pruneMesh} never deletes. A surface
+ *  that lists meshes renders that as a state instead of probing every broker a second time. */
+export interface MeshSweep {
+    /** Spaces whose dead record was dropped. */
+    pruned: string[];
+    /** Spaces kept despite a dead broker (operator-registered). */
+    offline: string[];
+}
+export declare function pruneStaleMeshes(): Promise<MeshSweep>;
 //# sourceMappingURL=preflight.d.ts.map

package/dist/preflight.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;;;;;;;GAUG;AAEH;;kGAEkG;AAClG,MAAM,MAAM,gBAAgB,GACxB,aAAa,GACb,yBAAyB,GACzB,wBAAwB,GACxB,gBAAgB,GAChB,iBAAiB,GACjB,YAAY,CAAC;AAEjB;;;;;oGAKoG;AACpG,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,EAC5B,MAAM,EAAE,eAAe,GAAG,YAAY,GAAG,aAAa,EACtD,OAAO,EAAE,OAAO,GACf;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAkB5C;AAED;;;uFAGuF;AACvF,wBAAsB,eAAe,CACnC,MAAM,EAAE,UAAU,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC,CAuB/E;AA2BD,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAQtD"}
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;;;;;;;GAUG;AAEH;;kGAEkG;AAClG,MAAM,MAAM,gBAAgB,GACxB,aAAa,GACb,yBAAyB,GACzB,wBAAwB,GACxB,gBAAgB,GAChB,iBAAiB,GACjB,YAAY;AACd;;;8DAG8D;GAC5D,WAAW,CAAC;AAEhB;;;;;oGAKoG;AACpG,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,EAC5B,MAAM,EAAE,eAAe,GAAG,YAAY,GAAG,aAAa,EACtD,OAAO,EAAE,OAAO,GACf;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAkB5C;AAED;;;uFAGuF;AACvF,wBAAsB,eAAe,CACnC,MAAM,EAAE,UAAU,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC,CA4D/E;AAgFD;;+FAE+F;AAC/F,MAAM,WAAW,SAAS;IACxB,4CAA4C;IAC5C,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,+DAA+D;IAC/D,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,SAAS,CAAC,CAW3D"}

package/dist/preflight.js

@@ -1,5 +1,6 @@
+import { createConnection } from "node:net";
 import { mintCreds, newIdentity, probeConnect, isReachable } from "@cotal-ai/core";
-import { loadMeshes, removeMesh } from "./mesh-registry.js";
+import { loadMeshes, pruneMesh } from "./mesh-registry.js";
 /** Pure decision tree — separated from I/O so the whole branch tree is unit-testable (it's the
  *  riskiest logic: a wrong branch prunes a LIVE registry entry). Only a registry-OWNED source
  *  (`registry`/`current`/`flag-space`/`local-recorded`) is ever pruned. A non-registry source —
@@ -40,24 +41,113 @@ export async function preflightTarget(target, probeCreds) {
     if (target.mode === "user")
         throw new Error("preflightTarget: a user-mode target cannot be credless-probed - the caller owns the user connect (see preflightOrExit's user branch)");
     const creds = probeCreds ?? (target.auth ? await mintCreds(target.auth, newIdentity(), "probe") : undefined);
-    const auth = creds ? { creds } : {};
+    // THE RECORDED TLS REQUIREMENT IS PART OF THE PROBE, not decoration on the record.
+    //
+    // Without it this probe connects to ANY broker on the recorded address, including a plaintext one
+    // substituted for the TLS broker the record describes — and reports `ok`. Two independent testers
+    // drove exactly that: record a TLS mesh, kill its broker, start a plaintext `nats-server` on the
+    // same port, and `cotal status` returned rc=0 and "connection ok".
+    //
+    // That is worse than a missing feature. A tool that is silent about a substitution is a gap; one
+    // that AFFIRMATIVELY REPORTS HEALTHY is a hazard, because the operator's rational response to a
+    // green check is to stop looking. The recorded requirement is the only thing that can tell those
+    // two brokers apart, since the plaintext one answers perfectly well.
+    const auth = { ...(creds ? { creds } : {}), ...(target.tlsRequired ? { tls: true } : {}) };
     let probe = await probeConnect(target.server, auth);
     if (probe.ok)
         return { ok: true };
     // CONFIRM BEFORE CONDEMNING. `probeConnect`'s default budget is 1s, and this is a CREDENTIALED
     // connect: TCP, INFO, then the JWT exchange — several round trips. A perfectly healthy broker
     // across a slow or jittery link (a relayed overlay VPN, a loaded host) misses that routinely, and
-    // the verdict here is destructive: a registry-sourced failure DELETES the entry, and for a mesh
-    // this machine did not start that is unrecoverable, since only `cotal up` writes registry records.
+    // the verdict here is destructive: a registry-sourced failure DELETES the entry, and re-writing
+    // one costs the operator either a `cotal up` or the exact `cotal meshes add` line again.
     // The observed failure mode was exactly this — a live, reachable mesh reported as "no mesh
     // running (stale registry entry - removed)" because the handshake needed more than a second.
     // So a first failure only makes it a candidate; re-probe with a budget that fits a real network.
     probe = await probeConnect(target.server, { ...auth, timeoutMs: PREFLIGHT_CONFIRM_TIMEOUT_MS });
     if (probe.ok)
         return { ok: true };
+    // TLS-REQUIRED + "unreachable" is often NOT a dead broker. `probeConnect` maps every non-auth
+    // failure (including certificate verification) to `unreachable`. Against a private-CA mesh
+    // without `NODE_EXTRA_CA_CERTS`, the TLS handshake fails while the broker is live and still
+    // greets with plaintext INFO advertising `tls_required`. Classifying that as unreachable + prune
+    // DELETES a healthy tlsRequired registry entry — durable state destroyed on a recoverable trust
+    // error. This branch introduced tlsRequired meshes, so the mis-prune is in scope.
+    //
+    // Discriminator must be stronger than bare liveness. A *different* broker on the recorded port
+    // (the classic plaintext-substitute case this file's own comment documents) also answers INFO —
+    // bare `isReachable` alone would mis-label that as tls-trust and keep a stale record. Only an
+    // INFO that still advertises `tls_required: true` is shape evidence consistent with the record
+    // (a TLS-required NATS listener, not a plaintext substitute). INFO is unauthenticated and is NOT
+    // peer identity. Anything else falls through to the normal unreachable/prune path.
+    //
+    // CONFIRM BEFORE CONDEMNING applies here too: a single 1s INFO read on a slow/jittery link would
+    // miss a live TLS greeting and fall through to prune — recreating the S10 data-loss under load.
+    // First miss only makes it a candidate; a second, longer read must also miss before we prune.
+    if (target.tlsRequired && probe.reason === "unreachable") {
+        const info = (await readNatsInfoGreeting(target.server)) ??
+            (await readNatsInfoGreeting(target.server, PRUNE_CONFIRM_TIMEOUT_MS));
+        if (info?.tls_required === true)
+            return { ok: false, kind: "tls-trust", prune: false };
+    }
     const { prune, kind } = classifyPreflightFailure(target.source, probe.reason, Boolean(target.auth));
     return { ok: false, kind, prune };
 }
+/** Read the pre-auth NATS INFO greeting (plaintext, before any STARTTLS). Returns null if nothing
+ *  usable answered. Used to distinguish a TLS-required NATS listener from a plaintext substitute
+ *  without a TLS handshake. It does NOT establish mesh identity — INFO is unauthenticated. */
+async function readNatsInfoGreeting(server, timeoutMs = 1_000) {
+    let host;
+    let port;
+    try {
+        const u = new URL(server.includes("://") ? server : `nats://${server}`);
+        host = u.hostname;
+        port = u.port ? Number(u.port) : 4222;
+        if (!host || !Number.isFinite(port))
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return new Promise((resolve) => {
+        const sock = createConnection({ host, port });
+        let buf = "";
+        let done = false;
+        const finish = (v) => {
+            if (done)
+                return;
+            done = true;
+            try {
+                sock.destroy();
+            }
+            catch { /* */ }
+            resolve(v);
+        };
+        sock.setTimeout(timeoutMs, () => finish(null));
+        sock.on("error", () => finish(null));
+        sock.on("close", () => finish(null));
+        sock.on("data", (chunk) => {
+            buf += chunk.toString("utf8");
+            const nl = buf.indexOf("\r\n");
+            if (nl < 0) {
+                if (buf.length > 4096)
+                    finish(null);
+                return;
+            }
+            const line = buf.slice(0, nl);
+            const brace = line.indexOf("{");
+            if (!/^INFO\b/.test(line) || brace < 0)
+                return finish(null);
+            try {
+                const j = JSON.parse(line.slice(brace));
+                finish(j);
+            }
+            catch {
+                finish(null);
+            }
+        });
+    });
+}
 /**
  * Drop registry entries whose broker is gone — a `cotal up` that crashed or was `kill -9`'d without
  * `cotal down` leaves a record behind. This is liveness-only and we hold NO creds for these meshes,
@@ -68,9 +158,12 @@ export async function preflightTarget(target, probeCreds) {
  * registry mutation stays opt-in: callers that act on the registry (`spawn`/`use`/`meshes`, the
  * manager control commands) invoke it; `<TAB>` completion must not.
  *
- * **Deletion needs CONFIRMATION, not one timeout.** Pruning is destructive and, for a mesh this
- * machine did not start, unrecoverable: only `cotal up` writes registry records, so a wrongly
- * pruned remote mesh cannot be re-registered. `isReachable`'s default budget is 1s, which a
+ * Only `up`-written records are candidates at all: {@link pruneMesh} keeps an operator-registered
+ * (`cotal meshes add`) one whatever the probe says, and this reports it as `offline` instead.
+ *
+ * **Deletion needs CONFIRMATION, not one timeout.** Pruning is destructive: a wrongly pruned mesh
+ * costs the operator a re-`up` (or, for a remote one, the exact registration line again) and every
+ * command in between fails on a mesh that was live all along. `isReachable`'s default budget is 1s, which a
  * perfectly healthy broker across a slow or jittery link (a relayed overlay VPN, a loaded host)
  * misses routinely — one such blip silently unregistered a live remote mesh. So a first failure
  * only makes it a CANDIDATE: confirm with a second, longer probe and prune only if that also
@@ -82,12 +175,15 @@ const PRUNE_CONFIRM_TIMEOUT_MS = 5_000;
  *  because this probe completes an AUTH HANDSHAKE, not just a TCP+INFO liveness check. */
 const PREFLIGHT_CONFIRM_TIMEOUT_MS = 8_000;
 export async function pruneStaleMeshes() {
+    const sweep = { pruned: [], offline: [] };
     await Promise.all(loadMeshes().map(async (m) => {
         if (await isReachable(m.server))
             return;
         if (await isReachable(m.server, { timeoutMs: PRUNE_CONFIRM_TIMEOUT_MS }))
             return;
-        removeMesh(m.space);
+        // pruneMesh, not removeMesh: an operator-registered record outlives its broker being down.
+        (pruneMesh(m.space) ? sweep.pruned : sweep.offline).push(m.space);
     }));
+    return sweep;
 }
 //# sourceMappingURL=preflight.js.map

package/dist/preflight.js.map

@@ -1 +1 @@
-{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AA0B5D;;;;;oGAKoG;AACpG,MAAM,UAAU,wBAAwB,CACtC,MAA4B,EAC5B,MAAsD,EACtD,OAAgB;IAEhB,mGAAmG;IACnG,iGAAiG;IACjG,MAAM,YAAY,GAChB,MAAM,KAAK,UAAU;QACrB,MAAM,KAAK,SAAS;QACpB,MAAM,KAAK,YAAY;QACvB,MAAM,KAAK,gBAAgB,CAAC;IAC9B,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAClF,iGAAiG;IACjG,+FAA+F;IAC/F,2FAA2F;IAC3F,6FAA6F;IAC7F,IAAI,MAAM,KAAK,YAAY;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IACzE,IAAI,YAAY,IAAI,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;IACrF,IAAI,YAAY;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;IACzE,IAAI,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;IAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;AACnD,CAAC;AAED;;;uFAGuF;AACvF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAkB,EAClB,UAAmB;IAEnB,8FAA8F;IAC9F,4FAA4F;IAC5F,iGAAiG;IACjG,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QACxB,MAAM,IAAI,KAAK,CAAC,sIAAsI,CAAC,CAAC;IAC1J,MAAM,KAAK,GACT,UAAU,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpC,IAAI,KAAK,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAClC,+FAA+F;IAC/F,8FAA8F;IAC9F,kGAAkG;IAClG,gGAAgG;IAChG,mGAAmG;IACnG,2FAA2F;IAC3F,6FAA6F;IAC7F,iGAAiG;IACjG,KAAK,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAChG,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAClC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,wBAAwB,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACpG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAEvC;0FAC0F;AAC1F,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAE3C,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,OAAO,CAAC,GAAG,CACf,UAAU,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3B,IAAI,MAAM,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,OAAO;QACxC,IAAI,MAAM,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,wBAAwB,EAAE,CAAC;YAAE,OAAO;QACjF,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC,CAAC,CACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AA+B3D;;;;;oGAKoG;AACpG,MAAM,UAAU,wBAAwB,CACtC,MAA4B,EAC5B,MAAsD,EACtD,OAAgB;IAEhB,mGAAmG;IACnG,iGAAiG;IACjG,MAAM,YAAY,GAChB,MAAM,KAAK,UAAU;QACrB,MAAM,KAAK,SAAS;QACpB,MAAM,KAAK,YAAY;QACvB,MAAM,KAAK,gBAAgB,CAAC;IAC9B,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAClF,iGAAiG;IACjG,+FAA+F;IAC/F,2FAA2F;IAC3F,6FAA6F;IAC7F,IAAI,MAAM,KAAK,YAAY;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IACzE,IAAI,YAAY,IAAI,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;IACrF,IAAI,YAAY;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;IACzE,IAAI,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;IAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;AACnD,CAAC;AAED;;;uFAGuF;AACvF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAkB,EAClB,UAAmB;IAEnB,8FAA8F;IAC9F,4FAA4F;IAC5F,iGAAiG;IACjG,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QACxB,MAAM,IAAI,KAAK,CAAC,sIAAsI,CAAC,CAAC;IAC1J,MAAM,KAAK,GACT,UAAU,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjG,mFAAmF;IACnF,EAAE;IACF,kGAAkG;IAClG,kGAAkG;IAClG,iGAAiG;IACjG,mEAAmE;IACnE,EAAE;IACF,iGAAiG;IACjG,gGAAgG;IAChG,iGAAiG;IACjG,qEAAqE;IACrE,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACpG,IAAI,KAAK,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAClC,+FAA+F;IAC/F,8FAA8F;IAC9F,kGAAkG;IAClG,gGAAgG;IAChG,yFAAyF;IACzF,2FAA2F;IAC3F,6FAA6F;IAC7F,iGAAiG;IACjG,KAAK,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAChG,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAElC,8FAA8F;IAC9F,2FAA2F;IAC3F,4FAA4F;IAC5F,iGAAiG;IACjG,gGAAgG;IAChG,kFAAkF;IAClF,EAAE;IACF,+FAA+F;IAC/F,gGAAgG;IAChG,8FAA8F;IAC9F,+FAA+F;IAC/F,iGAAiG;IACjG,mFAAmF;IACnF,EAAE;IACF,iGAAiG;IACjG,gGAAgG;IAChG,8FAA8F;IAC9F,IAAI,MAAM,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QACzD,MAAM,IAAI,GACR,CAAC,MAAM,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3C,CAAC,MAAM,oBAAoB,CAAC,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC,CAAC;QACxE,IAAI,IAAI,EAAE,YAAY,KAAK,IAAI;YAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,wBAAwB,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACpG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC;AAED;;8FAE8F;AAC9F,KAAK,UAAU,oBAAoB,CACjC,MAAc,EACd,SAAS,GAAG,KAAK;IAEjB,IAAI,IAAY,CAAC;IACjB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC;QACxE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;QAClB,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,MAAM,MAAM,GAAG,CAAC,CAAoC,EAAE,EAAE;YACtD,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,IAAI,CAAC;gBAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;YACvC,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAChC,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9B,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;gBACX,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI;oBAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBACpC,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC;gBAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5D,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAA+B,CAAC;gBACtE,MAAM,CAAC,CAAC,CAAC,CAAC;YACZ,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAEvC;0FAC0F;AAC1F,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAY3C,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,KAAK,GAAc,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACrD,MAAM,OAAO,CAAC,GAAG,CACf,UAAU,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3B,IAAI,MAAM,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,OAAO;QACxC,IAAI,MAAM,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,wBAAwB,EAAE,CAAC;YAAE,OAAO;QACjF,2FAA2F;QAC3F,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC,CAAC,CACH,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/render.d.ts

@@ -23,6 +23,7 @@ export type WorkspaceError = {
     kind: "reachable";
     reason: "auth-required" | "stale-auth" | "unreachable";
     server: string;
+    hasAuth: boolean;
 };
 /** Render a workspace failure as the canonical one-line `cotal …` sentence. */
 export declare function renderWorkspaceError(e: WorkspaceError): string;

package/dist/render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GACrF;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,eAAe,GAAG,YAAY,GAAG,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,cAAc,GAAG,MAAM,CAS9D"}
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GACrF;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,eAAe,GAAG,YAAY,GAAG,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AAEpH,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,cAAc,GAAG,MAAM,CAS9D"}

package/dist/render.js

@@ -6,7 +6,7 @@ export function renderWorkspaceError(e) {
         case "preflight":
             return renderPreflightFailure(e.failure, e.target, e.pruned);
         case "reachable":
-            return renderReachable(e.reason, e.server);
+            return renderReachable(e.reason, e.server, e.hasAuth);
     }
 }
 /** "Which mesh" resolution failures — maps a {@link MeshTargetError}'s `{code, details}` to copy. */
@@ -22,7 +22,11 @@ function renderTargetError(err) {
         case "default-occupied":
             return `✗ another mesh ("${d.space}") is running at ${d.server} - run \`cotal up\` here to start yours, or \`--space ${d.space}\` to join it`;
         case "stale-auth-root":
-            return `✗ registry entry "${d.space}" points at ${d.root}, whose auth is now for "${d.found}" - stale entry removed; re-run \`cotal up\` or check \`cotal meshes\``;
+            // An operator-registered entry is KEPT (only `cotal meshes rm` drops it), so the recovery
+            // there is to point it at the right root — never a claim that it was removed for you.
+            return d.removed === false
+                ? `✗ registry entry "${d.space}" points at ${d.root}, whose auth is now for "${d.found}" - re-register it with \`cotal meshes add ${d.space} --server <url> --root <dir>\` (\`--force\` replaces), or \`cotal meshes rm ${d.space}\``
+                : `✗ registry entry "${d.space}" points at ${d.root}, whose auth is now for "${d.found}" - stale entry removed; re-run \`cotal up\` or check \`cotal meshes\``;
         case "unreadable-auth":
             return `✗ space "${d.space}"'s trust material under ${d.root} will not load (${err.message}) - repair or remove the account record, then re-run \`cotal up\``;
         case "user-auth-unrecorded":
@@ -36,26 +40,48 @@ function renderTargetError(err) {
 function renderPreflightFailure(kind, t, pruned) {
     switch (kind) {
         case "unreachable":
+            // An operator-registered mesh usually runs on ANOTHER machine, so `cotal up` is the wrong
+            // remedy here — this machine can only wait for it or stop pointing at it.
+            if (t.origin === "manual")
+                return `✗ no broker answered at ${t.server} - "${t.space}" is registered here but its mesh is not up; start it where it runs, or \`cotal meshes rm ${t.space}\` to unregister it`;
             return `✗ no mesh running at ${t.server}${pruned ? " (stale registry entry - removed)" : ""} - run \`cotal up\``;
+        // The registry-mismatch pair, like `unreachable`, must not prescribe `cotal up` for a mesh this
+        // machine only registered: the repair there is the credentials under `--root`, or re-registering
+        // the entry — `cotal up` would start a DIFFERENT, local mesh under that name.
         case "registry-creds-rejected":
-            return `✗ mesh "${t.space}" at ${t.server} no longer matches its registry entry (credentials rejected - port reused?) - re-run \`cotal up\` from ${t.root}, or \`cotal meshes\` to see what's live`;
+            return t.origin === "manual"
+                ? `✗ mesh "${t.space}" at ${t.server} rejected the credentials under ${t.root} - re-mint them where that mesh runs, or re-register it with \`cotal meshes add ${t.space} --server <url> --root <dir> --force\``
+                : `✗ mesh "${t.space}" at ${t.server} no longer matches its registry entry (credentials rejected - port reused?) - re-run \`cotal up\` from ${t.root}, or \`cotal meshes\` to see what's live`;
         case "registry-open-now-auth":
-            return `✗ open mesh "${t.space}" at ${t.server} no longer matches its registry entry (broker now requires auth - port reused?) - re-run \`cotal up\` from ${t.root}, or \`cotal meshes\` to see what's live`;
+            return t.origin === "manual"
+                ? `✗ "${t.space}" is registered as an open mesh, but the broker at ${t.server} requires auth - copy that mesh's account + creds under ${t.root} and re-register with \`cotal meshes add ${t.space} --server ${t.server} --mode auth --force\``
+                : `✗ open mesh "${t.space}" at ${t.server} no longer matches its registry entry (broker now requires auth - port reused?) - re-run \`cotal up\` from ${t.root}, or \`cotal meshes\` to see what's live`;
         case "creds-rejected":
             return `✗ credentials for "${t.space}" were rejected at ${t.server} - a different mesh may be running there. Run \`cotal meshes\` to check, or \`cotal up\` here to start yours`;
         case "open-wants-auth":
             return `✗ broker at ${t.server} requires auth, but this mesh is open (no trust material) - use \`--space <name>\` for an auth mesh, or run \`cotal up\` here without \`--open\``;
         case "stale-auth":
             return `✗ credentials for "${t.space}" have EXPIRED - this mesh enforces bounded credential lifetimes; run \`cotal doctor auth\` in ${t.root} for the diagnosis + exact repair (the mesh itself is up)`;
+        case "tls-trust":
+            // INFO advertised tls_required (shape evidence only — unauthenticated). Never claims removal
+            // or peer identity; conservatively keep the record and point at the trust-store repair.
+            return `✗ mesh "${t.space}" at ${t.server} requires TLS but this client could not complete the handshake (untrusted or missing CA?) - set \`NODE_EXTRA_CA_CERTS\` to the issuing CA for a private CA, or fix the trust store; a TLS-required NATS listener still greets there (INFO is unauthenticated — not mesh identity) so the registry entry was conservatively kept`;
     }
 }
 /** Plain reachability for a RAW (off-registry) probe — the `--creds` / `--server`+unregistered-`--space`
  *  escape hatch, which never touches the registry (no prune, no stale-entry wording). */
-function renderReachable(reason, server) {
+function renderReachable(reason, server, hasAuth) {
     if (reason === "stale-auth")
         return `✗ credential EXPIRED at ${server} - bounded lifetime reached (credential death); run \`cotal doctor auth\` where the mesh runs, or re-mint the credential`;
-    return reason === "auth-required"
+    if (reason === "unreachable")
+        return `✗ can't reach a broker at ${server} - is it running? (\`cotal up\`)`;
+    // `auth-required` is two different user situations with two different repairs, and this path used
+    // to collapse them. The registry path never did: `classifyPreflightFailure` branches on the same
+    // bit into `creds-rejected` vs `open-wants-auth`. Told "credentials rejected" after sending NO
+    // credentials, a caller goes looking for what is wrong with creds they never had, when the actual
+    // next step is to obtain some.
+    return hasAuth
         ? `✗ credentials rejected at ${server} - check your creds, or the broker wants different auth`
-        : `✗ can't reach a broker at ${server} - is it running? (\`cotal up\`)`;
+        : `✗ broker at ${server} requires auth, but no credentials were supplied - pass \`--creds <file>\`, or \`cotal join\` with a link/token`;
 }
 //# sourceMappingURL=render.js.map

package/dist/render.js.map

@@ -1 +1 @@
-{"version":3,"file":"render.js","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAmBA,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,CAAiB;IACpD,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACpC,KAAK,WAAW;YACd,OAAO,sBAAsB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/D,KAAK,WAAW;YACd,OAAO,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,qGAAqG;AACrG,SAAS,iBAAiB,CAAC,GAAoB;IAC7C,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;IACtB,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,WAAW;YACd,OAAO,qEAAqE,CAAC;QAC/E,KAAK,eAAe;YAClB,OAAO,oBAAoB,CAAC,CAAC,SAAS,qCAAqC,CAAC;QAC9E,KAAK,kBAAkB;YACrB,OAAO,+BAA+B,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gFAAgF,CAAC;QACvJ,KAAK,kBAAkB;YACrB,OAAO,oBAAoB,CAAC,CAAC,KAAK,oBAAoB,CAAC,CAAC,MAAM,yDAAyD,CAAC,CAAC,KAAK,eAAe,CAAC;QAChJ,KAAK,iBAAiB;YACpB,OAAO,qBAAqB,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,IAAI,4BAA4B,CAAC,CAAC,KAAK,wEAAwE,CAAC;QACtK,KAAK,iBAAiB;YACpB,OAAO,YAAY,CAAC,CAAC,KAAK,4BAA4B,CAAC,CAAC,IAAI,mBAAmB,GAAG,CAAC,OAAO,mEAAmE,CAAC;QAChK,KAAK,sBAAsB;YACzB,gFAAgF;YAChF,yFAAyF;YACzF,yFAAyF;YACzF,OAAO,YAAY,CAAC,CAAC,KAAK,6HAA6H,CAAC,CAAC,IAAI,IAAI,iBAAiB,qHAAqH,CAAC;IAC5S,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,SAAS,sBAAsB,CAAC,IAAsB,EAAE,CAAa,EAAE,MAAe;IACpF,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,aAAa;YAChB,OAAO,wBAAwB,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,qBAAqB,CAAC;QACnH,KAAK,yBAAyB;YAC5B,OAAO,WAAW,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,MAAM,0GAA0G,CAAC,CAAC,IAAI,0CAA0C,CAAC;QACtM,KAAK,wBAAwB;YAC3B,OAAO,gBAAgB,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,MAAM,8GAA8G,CAAC,CAAC,IAAI,0CAA0C,CAAC;QAC/M,KAAK,gBAAgB;YACnB,OAAO,sBAAsB,CAAC,CAAC,KAAK,sBAAsB,CAAC,CAAC,MAAM,8GAA8G,CAAC;QACnL,KAAK,iBAAiB;YACpB,OAAO,eAAe,CAAC,CAAC,MAAM,kJAAkJ,CAAC;QACnL,KAAK,YAAY;YACf,OAAO,sBAAsB,CAAC,CAAC,KAAK,kGAAkG,CAAC,CAAC,IAAI,2DAA2D,CAAC;IAC5M,CAAC;AACH,CAAC;AAED;yFACyF;AACzF,SAAS,eAAe,CAAC,MAAsD,EAAE,MAAc;IAC7F,IAAI,MAAM,KAAK,YAAY;QACzB,OAAO,2BAA2B,MAAM,0HAA0H,CAAC;IACrK,OAAO,MAAM,KAAK,eAAe;QAC/B,CAAC,CAAC,6BAA6B,MAAM,yDAAyD;QAC9F,CAAC,CAAC,6BAA6B,MAAM,kCAAkC,CAAC;AAC5E,CAAC"}
+{"version":3,"file":"render.js","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAmBA,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,CAAiB;IACpD,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACpC,KAAK,WAAW;YACd,OAAO,sBAAsB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/D,KAAK,WAAW;YACd,OAAO,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,qGAAqG;AACrG,SAAS,iBAAiB,CAAC,GAAoB;IAC7C,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;IACtB,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,WAAW;YACd,OAAO,qEAAqE,CAAC;QAC/E,KAAK,eAAe;YAClB,OAAO,oBAAoB,CAAC,CAAC,SAAS,qCAAqC,CAAC;QAC9E,KAAK,kBAAkB;YACrB,OAAO,+BAA+B,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gFAAgF,CAAC;QACvJ,KAAK,kBAAkB;YACrB,OAAO,oBAAoB,CAAC,CAAC,KAAK,oBAAoB,CAAC,CAAC,MAAM,yDAAyD,CAAC,CAAC,KAAK,eAAe,CAAC;QAChJ,KAAK,iBAAiB;YACpB,0FAA0F;YAC1F,sFAAsF;YACtF,OAAO,CAAC,CAAC,OAAO,KAAK,KAAK;gBACxB,CAAC,CAAC,qBAAqB,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,IAAI,4BAA4B,CAAC,CAAC,KAAK,8CAA8C,CAAC,CAAC,KAAK,+EAA+E,CAAC,CAAC,KAAK,IAAI;gBACrO,CAAC,CAAC,qBAAqB,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,IAAI,4BAA4B,CAAC,CAAC,KAAK,wEAAwE,CAAC;QACnK,KAAK,iBAAiB;YACpB,OAAO,YAAY,CAAC,CAAC,KAAK,4BAA4B,CAAC,CAAC,IAAI,mBAAmB,GAAG,CAAC,OAAO,mEAAmE,CAAC;QAChK,KAAK,sBAAsB;YACzB,gFAAgF;YAChF,yFAAyF;YACzF,yFAAyF;YACzF,OAAO,YAAY,CAAC,CAAC,KAAK,6HAA6H,CAAC,CAAC,IAAI,IAAI,iBAAiB,qHAAqH,CAAC;IAC5S,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,SAAS,sBAAsB,CAAC,IAAsB,EAAE,CAAa,EAAE,MAAe;IACpF,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,aAAa;YAChB,0FAA0F;YAC1F,0EAA0E;YAC1E,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;gBACvB,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,KAAK,6FAA6F,CAAC,CAAC,KAAK,qBAAqB,CAAC;YACpL,OAAO,wBAAwB,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,qBAAqB,CAAC;QACnH,gGAAgG;QAChG,iGAAiG;QACjG,8EAA8E;QAC9E,KAAK,yBAAyB;YAC5B,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;gBAC1B,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,MAAM,mCAAmC,CAAC,CAAC,IAAI,mFAAmF,CAAC,CAAC,KAAK,wCAAwC;gBAC/M,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,MAAM,0GAA0G,CAAC,CAAC,IAAI,0CAA0C,CAAC;QACnM,KAAK,wBAAwB;YAC3B,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;gBAC1B,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,sDAAsD,CAAC,CAAC,MAAM,2DAA2D,CAAC,CAAC,IAAI,4CAA4C,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,MAAM,wBAAwB;gBAC9O,CAAC,CAAC,gBAAgB,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,MAAM,8GAA8G,CAAC,CAAC,IAAI,0CAA0C,CAAC;QAC5M,KAAK,gBAAgB;YACnB,OAAO,sBAAsB,CAAC,CAAC,KAAK,sBAAsB,CAAC,CAAC,MAAM,8GAA8G,CAAC;QACnL,KAAK,iBAAiB;YACpB,OAAO,eAAe,CAAC,CAAC,MAAM,kJAAkJ,CAAC;QACnL,KAAK,YAAY;YACf,OAAO,sBAAsB,CAAC,CAAC,KAAK,kGAAkG,CAAC,CAAC,IAAI,2DAA2D,CAAC;QAC1M,KAAK,WAAW;YACd,6FAA6F;YAC7F,wFAAwF;YACxF,OAAO,WAAW,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,MAAM,iUAAiU,CAAC;IAC/W,CAAC;AACH,CAAC;AAED;yFACyF;AACzF,SAAS,eAAe,CACtB,MAAsD,EACtD,MAAc,EACd,OAAgB;IAEhB,IAAI,MAAM,KAAK,YAAY;QACzB,OAAO,2BAA2B,MAAM,0HAA0H,CAAC;IACrK,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO,6BAA6B,MAAM,kCAAkC,CAAC;IAC3G,kGAAkG;IAClG,iGAAiG;IACjG,+FAA+F;IAC/F,kGAAkG;IAClG,+BAA+B;IAC/B,OAAO,OAAO;QACZ,CAAC,CAAC,6BAA6B,MAAM,yDAAyD;QAC9F,CAAC,CAAC,eAAe,MAAM,iHAAiH,CAAC;AAC7I,CAAC"}