@cotal-ai/workspace 0.34.0 → 0.36.0

package/dist/agent-secrets.js

@@ -0,0 +1,468 @@
+/**
+ * The per-agent standing secrets, keyed per space — series P1 of
+ * `docs/design/space-segmentation-p7-p1.md` (§1's second inventory, §3's second placement).
+ *
+ * `<name>.creds`, `<name>.actor-token`, `<name>.sentinel.creds`, their per-incarnation
+ * `<name>.<lifecycleUid>.*` counterparts and the non-secret `<base>.auth-health.json` all sat
+ * directly under `<root>/.cotal/auth/creds`, which is root-scoped while every one of them is
+ * per-tenant in meaning. They now live in `<root>/.cotal/auth/creds/space.<hex>/`, key
+ * `auth/creds/space.<hex>/<basename>`.
+ *
+ * WHY THIS IS ITS OWN MODULE and not the block it used to be in `auth-paths.ts`: the surface now
+ * depends on the segmentation foundation (`space-segmentation.ts`), and that module already depends
+ * on `auth-paths.ts` for the encoder and the account inventory. Keeping the surface here puts it
+ * ABOVE both, so the shared choke point is reachable without inverting an existing dependency or
+ * teaching `auth-paths.ts` about rules it does not own. Nothing about the material changed in the
+ * move except the space.
+ *
+ * The migration for roots that already exist is §2's MOVE ON FIRST TOUCH, at the one choke point
+ * {@link agentCredsDir}, through the same {@link migrateLegacyMaterialIn} the P7 resolvers call.
+ * P1's hazard is milder than P7's — an agent secret read as absent is re-provisioned rather than
+ * run beside a live sibling — but it is the same shape and ends in the same place: a canonical
+ * mint beside legacy material nothing will ever reap, which is the residue this series exists to
+ * end.
+ */
+import { existsSync, readdirSync, rmSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+import { assertLifecycleToken } from "@cotal-ai/core";
+import { authDir, spaceFromSegment, spaceSegment } from "./auth-paths.js";
+import { migrateLegacyMaterialIn, spaceMaterialMigrationRefusal, } from "./space-segmentation.js";
+/** `<root>/.cotal/auth/creds` — the PARENT every space's agent-secret segment sits in, and the
+ *  directory the pre-P1 layout wrote its files directly into.
+ *
+ *  Resolves nothing and migrates nothing, so it is what the two callers that must NOT move material
+ *  ask for: {@link agentSecretKeysUnder}, which is a DELETER (§3.1, the same reason `clean`'s sweep
+ *  addresses `segmentedKey`), and {@link agentCredsDir} itself, which needs the parent to enumerate
+ *  before it can migrate. Every other caller wants {@link agentCredsDir}.
+ *
+ *  It keeps the name `creds`, which is load-bearing beyond this file: it is the one sibling of the
+ *  auth dir that `migrateLegacyUserAuthState` excludes BY NAME and that `userAuthSpacesOnDisk` skips,
+ *  so a space's segment landing inside it (rather than beside it, under `auth/`) leaves both of those
+ *  statements true as written. That is §3's reason for this placement. */
+export function agentCredsRoot(root) {
+    return join(authDir(root), "creds");
+}
+/** THE per-agent file segment — the single guarded encoder under every agent-secret key AND path
+ *  (the {@link spaceSegment} posture: one encoder, guarded before any key or path exists). The
+ *  alphabet is the manager's spawn-name discipline (`manager.nameError`); the CLI's `--name`
+ *  override historically had no such guard, so a path-hostile name is refused HERE, before it can
+ *  address a key or file outside the creds dir. */
+export function agentSecretSegment(name) {
+    if (!/^[A-Za-z0-9_-]+$/.test(name))
+        throw new Error(`unsafe agent name ${JSON.stringify(name)} for secret material (allowed: letters, digits, _ -)`);
+    return name;
+}
+// One filename source per kind — the store key and the materialized path project the SAME name,
+// so the two can never drift apart (the `delivery.creds` lesson, per kind).
+const agentFile = {
+    creds: (base) => `${base}.creds`,
+    actorToken: (base) => `${base}.actor-token`,
+    sentinelCreds: (base) => `${base}.sentinel.creds`,
+    health: (base) => `${base}.auth-health.json`,
+};
+/** The per-INCARNATION filename base `<name>.<lifecycleUid>` (SPEC 13.1 naming discipline brought
+ *  to the FS): an endpoint-provisioned incarnation's secret family embeds its lifecycle UID, so a
+ *  stale or replayed teardown for a retired incarnation addresses names a same-alias successor
+ *  never uses. The separator is a `.` — a character {@link agentSecretSegment} REFUSES in a
+ *  standing name — so the two families are STRUCTURALLY disjoint: no legal standing alias can
+ *  spell an incarnation base (`worker-<uid>` the standing name maps to `worker-<uid>.creds`;
+ *  `worker` at that uid maps to `worker.<uid>.creds`). Disjointness is grammar, not uid entropy —
+ *  a standing alias is chosen, not sampled, so entropy alone guarantees nothing. Standing
+ *  OPERATOR secrets (`cotal mint`, setup-seeded creds) stay on the name-keyed builders below —
+ *  they have no lifecycle. */
+function agentIncarnationBase(name, lifecycleUid) {
+    return `${agentSecretSegment(name)}.${assertLifecycleToken(lifecycleUid)}`;
+}
+/** The exact filename-base grammar the two builder families can produce — a standing name
+ *  ({@link agentSecretSegment}'s alphabet, no `.`) or an incarnation base `<name>.<uid>`
+ *  ({@link agentIncarnationBase}). Anything else is a stray no valid provisioning wrote. */
+const PROVISIONABLE_BASE = /^[A-Za-z0-9_-]+(\.[a-z0-9]{26,32})?$/;
+/** The three SECRET suffixes, longest first: `<name>.sentinel.creds` must never parse as
+ *  `<name>.sentinel` + `.creds`. Order is the contract, not a convenience. */
+const SECRET_SUFFIXES = [".sentinel.creds", ".actor-token", ".creds"];
+/** The suffixes a MIGRATION moves — the three secret kinds plus the non-secret health file.
+ *
+ *  The health file is here and NOT in {@link SECRET_SUFFIXES} because the two questions differ. It
+ *  holds no secret, so it never becomes a store key; but the manager records its path beside the
+ *  family's (`manager.ts` weighs all of actor-token, sentinel and health as ONE manager-owned
+ *  family), so a migration that moved the three secrets and left the health file behind would split
+ *  a family across two layouts and fail exactly that check. */
+const MIGRATABLE_SUFFIXES = [...SECRET_SUFFIXES, ".auth-health.json"];
+/** The base of a filename ending in one of `suffixes`, when the base is one a valid provisioning
+ *  could have written. `undefined` for a stray — a health file asked about a secret suffix, a name
+ *  the encoder would refuse, a leftover of some other tool. */
+function provisionableBase(file, suffixes) {
+    for (const suffix of suffixes) {
+        if (!file.endsWith(suffix))
+            continue;
+        const base = file.slice(0, -suffix.length);
+        // The longest matching suffix decides; a rejected base is a stray either way, so do not fall
+        // through and let a shorter suffix re-parse the same name into a different family.
+        return PROVISIONABLE_BASE.test(base) ? base : undefined;
+    }
+    return undefined;
+}
+/** The pre-P1 files sitting DIRECTLY in the creds dir — the set {@link agentCredsDir} migrates.
+ *
+ *  Two filters, and they exclude different things. The suffix check is what keeps a canonical
+ *  `space.<hex>` segment (and any sibling tenant's) out of the set — no segment name can end in a
+ *  migratable suffix — because moving one tenant's segment into another's would be the aliasing this
+ *  layout was designed to make impossible. The `isDirectory` check is what stops a DIRECTORY whose
+ *  name does end in one (`ghost.creds/`) from handing `renameSync` a whole tree: a directory is never
+ *  material whatever it is called. */
+function legacyAgentSecretFiles(parent) {
+    let entries;
+    try {
+        entries = readdirSync(parent, { withFileTypes: true });
+    }
+    catch (e) {
+        if (e.code === "ENOENT")
+            return []; // no creds dir → nothing minted
+        throw e;
+    }
+    return entries
+        .filter((e) => !e.isDirectory() && provisionableBase(e.name, MIGRATABLE_SUFFIXES) !== undefined)
+        .map((e) => e.name);
+}
+/**
+ * THE CHOKE POINT (§2 rule 1): `<root>/.cotal/auth/creds/space.<hex>` — this space's agent-secret
+ * dir, having moved any pre-P1 root-scoped files into it first.
+ *
+ * Every path and key below resolves through here, which is what makes "migrate on first touch"
+ * reach every flow rather than the ones someone remembered to update. A caller that builds
+ * `join(agentCredsRoot(root), …)` itself has reintroduced the read-fallback §2 rejects.
+ *
+ * THE MIGRATION IS PER FILE, and that is rule 2 met rather than dodged. P7 moves a fixed set of five
+ * kinds; this set is OPEN — one file per agent per kind, discovered by enumeration — so "the move is
+ * one `renameSync`" holds per FILE here instead of per kind. Each file is therefore wholly legacy or
+ * wholly canonical across a crash, and a crash midway through the set leaves a mixture that the next
+ * first touch simply finishes. That is §2.1's cause one, self-healing, and it needs no repair verb.
+ *
+ * Rules 3 and 4 come from the shared choke point unchanged, which is the point of calling it: rule 4
+ * is re-asked per file rather than once for the set, so the cost is one tenant-count read per file
+ * MOVED. That is bounded by the one-time migration of a root — after it, the set is empty and the
+ * only cost is the enumeration — and it buys a single implementation of the rule instead of a
+ * sweep-shaped copy of it.
+ */
+export function agentCredsDir(root, space) {
+    const parent = agentCredsRoot(root);
+    const canonical = join(parent, spaceSegment(space));
+    // Cheap gate first, as the prior art does it: a root with no creds dir has nothing to weigh, and
+    // one whose creds dir holds no legacy file (every root created after this series) skips straight
+    // to the canonical answer without a tenant-count read.
+    for (const file of legacyAgentSecretFiles(parent))
+        migrateLegacyMaterialIn(parent, root, space, file);
+    return canonical;
+}
+/** The segmented store-key prefix for `space`, resolving the migration on the FS composition first.
+ *
+ *  The composition is the P7 union used unchanged ({@link SpaceMaterialComposition}), for the reason
+ *  its own comment gives: an optional root would let a workstation caller silently take the hosted
+ *  answer and write a canonical key beside legacy material — which is not merely a missed migration
+ *  but a §2 rule 3 stalemate, since the next first touch then finds BOTH locations populated and
+ *  refuses. Requiring the root on that arm makes the unsound call impossible to express. */
+function agentSecretKeyPrefix(space, composition) {
+    if (!composition.injected)
+        agentCredsDir(composition.root, space);
+    return `auth/creds/${spaceSegment(space)}`;
+}
+/** Canonical {@link SecretStore} keys of the per-agent standing secrets, mirroring the
+ *  `.cotal/auth/creds/space.<hex>/<name>.<kind>` layout byte-for-byte under the workspace FS
+ *  composition. `<name>.creds` is the static-auth scoped cred; the actor token + sentinel cred are
+ *  the user-mode pair a spawn mints. The transient `<name>.auth-health.json` is runtime state, NOT a
+ *  secret kind — it stays plain-file (and moves with its family, see {@link MIGRATABLE_SUFFIXES}). */
+export const agentCredsKey = (space, name, composition) => `${agentSecretKeyPrefix(space, composition)}/${agentFile.creds(agentSecretSegment(name))}`;
+export const agentActorTokenKey = (space, name, composition) => `${agentSecretKeyPrefix(space, composition)}/${agentFile.actorToken(agentSecretSegment(name))}`;
+export const agentSentinelCredsKey = (space, name, composition) => `${agentSecretKeyPrefix(space, composition)}/${agentFile.sentinelCreds(agentSecretSegment(name))}`;
+/** Lifecycle-keyed {@link SecretStore} keys of one INCARNATION's secret family — the
+ *  per-incarnation counterparts of the standing name-keyed keys above, for any endpoint that
+ *  provisions managed lifecycles (the manager is the first client; delivery and future endpoints
+ *  ride the same seam). See {@link agentIncarnationBase} for why the uid is embedded. */
+export const agentLifecycleCredsKey = (space, name, lifecycleUid, composition) => `${agentSecretKeyPrefix(space, composition)}/${agentFile.creds(agentIncarnationBase(name, lifecycleUid))}`;
+export const agentLifecycleActorTokenKey = (space, name, lifecycleUid, composition) => `${agentSecretKeyPrefix(space, composition)}/${agentFile.actorToken(agentIncarnationBase(name, lifecycleUid))}`;
+export const agentLifecycleSentinelCredsKey = (space, name, lifecycleUid, composition) => `${agentSecretKeyPrefix(space, composition)}/${agentFile.sentinelCreds(agentIncarnationBase(name, lifecycleUid))}`;
+/** The FS materialization paths of one agent's secret family (plus its non-secret health file) —
+ *  built from the SAME filename source as the key builders. These are the paths subprocesses read
+ *  (the bearer re-exec's `--token-file`, a launch's creds handoff), never an alternate source of
+ *  truth: under the local FS composition each path IS its key's storage location. */
+export function agentSecretFilePaths(root, space, name) {
+    return familyPaths(agentCredsDir(root, space), agentSecretSegment(name));
+}
+/** The lifecycle-keyed FS materialization paths of one INCARNATION's secret family (plus its
+ *  non-secret health file) — same projection rule as {@link agentSecretFilePaths}, built from the
+ *  {@link agentIncarnationBase} so a retired incarnation's teardown can never address a same-alias
+ *  successor's files. */
+export function agentLifecycleSecretFilePaths(root, space, name, lifecycleUid) {
+    return familyPaths(agentCredsDir(root, space), agentIncarnationBase(name, lifecycleUid));
+}
+/** One base's four paths under an already-resolved dir — the one place the family's shape is
+ *  spelled, so the standing and lifecycle builders cannot project different families. */
+function familyPaths(dir, base) {
+    return {
+        creds: join(dir, agentFile.creds(base)),
+        actorToken: join(dir, agentFile.actorToken(base)),
+        sentinelCreds: join(dir, agentFile.sentinelCreds(base)),
+        health: join(dir, agentFile.health(base)),
+    };
+}
+/**
+ * The store key of a materialized agent-secret FILE — the same projection the builders above apply,
+ * for callers that hold a RECORDED path (a resume inventory, a manifest ledger) rather than the
+ * (name, uid) coordinates: under mixed generations the recorded path is the truth, and its key must
+ * be derived from the SAME filename, never re-derived from the name alone (which would silently
+ * address a different generation's row).
+ *
+ * IT TAKES THE SPACE, AND CHECKS IT AGAINST THE PATH — the one signature change in this commit that
+ * is not bookkeeping. The segment could be read out of the recorded path instead, and nothing would
+ * have to change at a single call site; that is precisely why it must not be. A recorded path is
+ * caller-supplied data, and once the segment carries a tenant's identity, deriving it from that data
+ * means a record written for tenant A can name tenant B's segment and this function will hand back a
+ * key into it — which the manager then reads, overwrites, or DELETES. The space a caller is entitled
+ * to comes from its own authority (the manager's `space`, the ledger's), so it is passed in and the
+ * path is checked against it. A path outside the space's segment is refused rather than resolved,
+ * the same posture as the filename check that was already here.
+ */
+export function agentSecretKeyForFile(path, space) {
+    const file = basename(path);
+    const base = provisionableBase(file, SECRET_SUFFIXES);
+    if (base === undefined) {
+        if (!SECRET_SUFFIXES.some((s) => file.endsWith(s)))
+            throw new Error(`"${file}" is not an agent-secret filename (expected a .creds / .actor-token / .sentinel.creds suffix)`);
+        throw new Error(`"${file}" is not a provisionable agent-secret filename (a standing name, or <name>.<lifecycleUid>)`);
+    }
+    const segment = basename(dirname(path));
+    if (segment !== spaceSegment(space))
+        throw new Error(`${path} is not in space "${space}"'s agent-secret segment (${spaceSegment(space)}) - ` +
+            `${spaceFromSegment(segment) !== undefined ? `it names space "${spaceFromSegment(segment)}"'s` : "its parent directory is not a per-space segment at all"}, ` +
+            "and a recorded path may not choose which tenant's material a caller addresses");
+    return `auth/creds/${segment}/${file}`;
+}
+/**
+ * Enumerate the store keys of every per-agent standing secret currently materialized under this
+ * root — the reset/backstop sweep (`clean all`; despawn owns the primary delete). Deliberately
+ * filename-driven over the LOCAL creds dir: this surface is the FS composition (a hosted reset rides
+ * its own store), and a file only maps to a key if a valid spawn could have written it — health
+ * files and strays are left to the caller's raw cleanup.
+ *
+ * ROOT-WIDE AND MIGRATION-FREE, both deliberate. It takes no space because `clean all` resets the
+ * whole root, so it enumerates EVERY tenant's segment; and it is a DELETER (§3.1), so it addresses
+ * what is on disk rather than resolving through {@link agentCredsDir} — moving material into the
+ * path a sweep is about to delete is work done to undo itself, and a §2 rule 3 or 4 refusal must not
+ * fail a reset over material the reset does not care about.
+ *
+ * It reports BOTH levels: this space's segment (`auth/creds/space.<hex>/<file>`) and any pre-P1 file
+ * still sitting flat in the creds dir. Dropping the flat level would be the same defect this series
+ * exists to end, reintroduced in the sweeper — a reset that leaves an unmigrated root's agent creds
+ * on disk and reports success.
+ */
+export function agentSecretKeysUnder(root) {
+    const parent = agentCredsRoot(root);
+    let entries;
+    try {
+        entries = readdirSync(parent, { withFileTypes: true });
+    }
+    catch (e) {
+        if (e.code === "ENOENT")
+            return []; // no creds dir → nothing minted
+        throw e;
+    }
+    const keys = [];
+    for (const e of entries) {
+        if (!e.isDirectory()) {
+            if (provisionableBase(e.name, SECRET_SUFFIXES) !== undefined)
+                keys.push(`auth/creds/${e.name}`);
+            continue;
+        }
+        // Only a canonical segment is descended into. A stray subdirectory is not a tenant's material
+        // and its contents are nothing this sweep can name a key for.
+        if (spaceFromSegment(e.name) === undefined)
+            continue;
+        keys.push(...segmentSecretKeys(parent, e.name));
+    }
+    return keys;
+}
+/** The store keys of the secrets materialized in ONE segment — the file→key projection both the
+ *  root-wide sweep above and the per-space reap below run, named once so a reap can never disagree
+ *  with the sweep about which files in a segment are addressable material. */
+function segmentSecretKeys(parent, segment) {
+    let files;
+    try {
+        files = readdirSync(join(parent, segment));
+    }
+    catch (e) {
+        if (e.code === "ENOENT")
+            return []; // no segment → nothing minted here
+        throw e;
+    }
+    const keys = [];
+    for (const file of files)
+        if (provisionableBase(file, SECRET_SUFFIXES) !== undefined)
+            keys.push(`auth/creds/${segment}/${file}`);
+    return keys;
+}
+/**
+ * {@link agentSecretKeysUnder} narrowed to ONE tenant — what `cotal space rm` reaps, and what it can
+ * list before it commits to reaping.
+ *
+ * IT DOES NOT REPORT THE FLAT LEVEL, and that is the whole difference between the two. `clean all`
+ * resets the root, so it must name a pre-P1 file sitting directly in the creds dir or leave it
+ * behind. A per-space reap must NOT: a flat file names no tenant, so attributing it to the tenant
+ * being removed is a guess, and acting on the guess deletes what may be a survivor's live material.
+ * That case is refused up front by {@link assertAgentSecretsReapable} rather than resolved here.
+ *
+ * Migration-free for the same reason as the root-wide sweep: this is a DELETER (§3.1).
+ */
+export function agentSecretKeysForSpace(root, space) {
+    return segmentSecretKeys(agentCredsRoot(root), spaceSegment(space));
+}
+/** The pre-P1 agent-secret files still sitting flat in this root's creds dir — what
+ *  {@link assertAgentSecretsReapable} refuses over.
+ *
+ *  It is {@link legacyAgentSecretFiles} at the one parent that matters, exported rather than
+ *  re-derived so the door and the MIGRATION weigh the same set by construction: the files this
+ *  refuses over are exactly the files the next {@link agentCredsDir} touch would move, which is the
+ *  claim the refusal's text makes. Two implementations of "what counts as legacy" would drift at
+ *  whichever one is not the one someone edits. */
+export function unsegmentedAgentSecrets(root) {
+    return legacyAgentSecretFiles(agentCredsRoot(root));
+}
+/**
+ * The "what do I do about it" half of the refusal below — ASKED of the shared rule
+ * ({@link spaceMaterialMigrationRefusal}), never assumed, for the reason P7's `migrationRemedy`
+ * records: advice composed from a guess about who is asking hands the operator a command that
+ * cannot succeed.
+ *
+ * It is P1's OWN remedy rather than a call to P7's, because the two series migrate on different
+ * verbs and P7's sentence names the wrong one. `cotal up` moves the five P7 kinds; it never touches
+ * a P1 resolver (the call sites are `spawn`, `mint`, `doctor auth`, the manager and the manifest
+ * ledger), so telling an operator to run `up` and retry would leave these files exactly where they
+ * are. `doctor auth` is named because it is the read-only one: it resolves this space's segment
+ * through {@link agentCredsDir} on every run (`doctor.ts:169`), so it migrates without minting.
+ */
+function agentSecretMigrationRemedy(root) {
+    const refusal = spaceMaterialMigrationRefusal(root);
+    if (!refusal)
+        return "Run `cotal doctor auth` for the sole tenant once to move them into its segment, then retry.";
+    // The multi-tenant branch, which is the one `space rm` actually reaches (§2.2 step 2 refuses the
+    // last tenant, so this precondition is only ever asked on a root holding more than one). There is
+    // no verb to offer: every P1 resolver hits the same rule 4 refusal, and no command can attribute a
+    // file that names no owner. So the remedy is the manual move, stated as one.
+    return (`Migrating them first is not available on this root either: ${refusal.reason}. ` +
+        "Decide which tenant each file belongs to and move it into that tenant's segment " +
+        "(auth/creds/space.<hex>/), or remove it, then retry.");
+}
+/**
+ * `cotal space rm` STEP 1'S PRECONDITION for the step 7 agent-secret reap
+ * (`per-space-lifecycle.md` §2.2) — {@link assertSpaceMaterialReapable}'s P1 counterpart, asked at
+ * step 1 for the same reason: step 5 is the point of no return, so a precondition discovered at step
+ * 7 would refuse after the tenant's data is already gone, leave the journal entry that gates every
+ * other verb standing, and fail identically on every re-run of the removal it is supposed to let a
+ * crash finish.
+ *
+ * WHAT IT REFUSES: a root still holding pre-P1 agent secrets flat in `auth/creds`. P7's counterpart
+ * refuses over the same unattributability — the files name no tenant, so reaping around them strands
+ * what may be the departing tenant's and reaping them may take a survivor's — and that argument
+ * applies here unchanged.
+ *
+ * BUT P1'S CASE IS SHARPER, and this is the part that is not a translation of P7's. Those flat files
+ * are inert TODAY only because §2 rule 4 refuses to migrate on a multi-tenant root. Step 7 deletes
+ * the departing tenant's account record; on a two-tenant root that leaves ONE space in the inventory,
+ * which is exactly the condition under which rule 4 stops refusing. So the next `cotal spawn`, `mint`
+ * or `doctor auth` by the survivor resolves {@link agentCredsDir} and MOVES the departed tenant's
+ * secrets into the survivor's segment — where the layout now reads as an assertion that they are the
+ * survivor's. Removing a tenant is what converts material that is legibly unowned into a confident
+ * attribution nobody made, and it does so silently, later, from an unrelated verb. Refusing here is
+ * the only place that can be stopped while the evidence still exists.
+ *
+ * NOT YET CALLED: `cotal space rm` does not exist as a command today (§2.2 designs it; no `space`
+ * verb is implemented). This lands with the material it guards so the verb cannot be written without
+ * it, the same reason {@link assertSpaceMaterialReapable} landed with P7's reap.
+ */
+export function assertAgentSecretsReapable(root, space, operation) {
+    const present = unsegmentedAgentSecrets(root);
+    if (present.length === 0)
+        return;
+    // The set is OPEN (one file per agent per kind), unlike P7's five named kinds, so an unmigrated
+    // root can hold a great many. Name enough to recognize the material and count the rest.
+    const shown = present.slice(0, 4);
+    const listed = shown.join(", ") + (present.length > shown.length ? `, +${present.length - shown.length} more` : "");
+    throw new Error(`${operation} refuses: this root holds ${present.length} pre-P1 agent secret file(s) directly in auth/creds (${listed}), which name no space. ` +
+        `Removing "${space}" would leave them for a surviving tenant to inherit, and on a two-tenant root it makes that inheritance automatic: ` +
+        "the removal leaves one space in the inventory, which is the condition under which the migration rules stop refusing, " +
+        "so the survivor's next agent-secret touch moves them into the survivor's segment and records an owner nobody chose. " +
+        agentSecretMigrationRemedy(root));
+}
+/**
+ * `cotal space rm` STEP 7 (`per-space-lifecycle.md` §2.2): reap ONE tenant's per-agent standing
+ * secrets — the residue that step used to LIST and leave behind, because before this series the
+ * creds dir named no tenant and reaping one space's would have risked a sibling's.
+ *
+ * IT CANNOT REFUSE, the same contract {@link reapSpaceMaterial} carries and for the same reason: it
+ * runs past step 5's point of no return, where a throw strands the journal entry and recurs
+ * identically on every re-run. Seam failures are returned, not thrown, and the caller must read
+ * `failed` or the material silently survives the tenant. Its precondition is
+ * {@link assertAgentSecretsReapable}, asked at step 1.
+ *
+ * THE ENUMERATION IS ALSO GUARDED, which P7's reap does not need. P7 sweeps a fixed array of four
+ * kinds; this set is OPEN and discovered by reading the segment, so the reap has an I/O step BEFORE
+ * its first seam call, and an unreadable segment there would throw straight out of a function that
+ * has promised not to. It is reported like any other failure instead. (The one input that could
+ * still throw is the space name, encoded once up front before anything has happened — and it comes
+ * from the verb's own inventory read, not from disk.)
+ *
+ * The seam deletes come FIRST and are addressed by the on-disk key, never through
+ * {@link agentCredsDir}: a reaper is a DELETER (§3.1), so it must not migrate material into the path
+ * it is about to remove — and on the multi-tenant root this verb runs on, that migration is the very
+ * mis-attribution the precondition exists to prevent. The store is asked because under a
+ * non-plain-file composition the key is where the material lives; the directory removal after it is
+ * what takes the non-key files in the segment (the `.auth-health.json` runtime state, which is never
+ * a store key) and anything a stray left behind.
+ *
+ * It removes only THIS space's segment, never `auth/creds` itself. That parent is the shared one —
+ * every tenant's segment is a child of it — so the glob-shaped reach a reader arrives at after
+ * seeing a directory removal would take every survivor's live agent secrets and report success.
+ *
+ * WHAT IT DOES NOT REACH: an INJECTED composition. The reap enumerates from the filesystem because
+ * {@link SecretStore} has no list operation and P1's key set is open — there is no fixed array to
+ * sweep the way P7 sweeps its four kinds — so a hosted deployment reaps a tenant's agent secrets
+ * through its own store's teardown. That is the same boundary {@link agentSecretKeysUnder} already
+ * draws for `clean all`, stated here rather than left to be discovered: a `removed` list from a root
+ * with no local segment is empty because there was nothing local, not because a store was checked.
+ */
+export async function reapAgentSecrets(root, space, secrets) {
+    const removed = [];
+    const failed = [];
+    const segment = spaceSegment(space);
+    const dir = join(agentCredsRoot(root), segment);
+    let keys = [];
+    try {
+        keys = agentSecretKeysForSpace(root, space);
+    }
+    catch (e) {
+        failed.push(`${segment}: enumerating this space's agent secrets: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    for (const key of keys) {
+        try {
+            // Idempotent on an absent key by the seam's contract, and the `get` keeps the report honest
+            // rather than claiming a removal for material that was never there.
+            if ((await secrets.get(key)) !== undefined) {
+                await secrets.delete(key);
+                removed.push(`.cotal/${key}`);
+            }
+        }
+        catch (e) {
+            failed.push(`${key}: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+    try {
+        if (existsSync(dir)) {
+            rmSync(dir, { recursive: true, force: true });
+            removed.push(`.cotal/auth/creds/${segment} (this space's agent secrets)`);
+        }
+    }
+    catch (e) {
+        failed.push(`${segment}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    return { removed, failed };
+}
+//# sourceMappingURL=agent-secrets.js.map

package/dist/agent-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-secrets.js","sourceRoot":"","sources":["../src/agent-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAoB,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EACL,uBAAuB,EAAE,6BAA6B,GACvD,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;0EAW0E;AAC1E,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC;AAED;;;;mDAImD;AACnD,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACnH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gGAAgG;AAChG,4EAA4E;AAC5E,MAAM,SAAS,GAAG;IAChB,KAAK,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,IAAI,QAAQ;IACxC,UAAU,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,IAAI,cAAc;IACnD,aAAa,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,IAAI,iBAAiB;IACzD,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,IAAI,mBAAmB;CACrD,CAAC;AAEF;;;;;;;;;8BAS8B;AAC9B,SAAS,oBAAoB,CAAC,IAAY,EAAE,YAAoB;IAC9D,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,YAAY,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;4FAE4F;AAC5F,MAAM,kBAAkB,GAAG,sCAAsC,CAAC;AAElE;8EAC8E;AAC9E,MAAM,eAAe,GAAG,CAAC,iBAAiB,EAAE,cAAc,EAAE,QAAQ,CAAU,CAAC;AAE/E;;;;;;+DAM+D;AAC/D,MAAM,mBAAmB,GAAG,CAAC,GAAG,eAAe,EAAE,mBAAmB,CAAU,CAAC;AAE/E;;+DAE+D;AAC/D,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAA2B;IAClE,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,SAAS;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,6FAA6F;QAC7F,mFAAmF;QACnF,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;sCAOsC;AACtC,SAAS,sBAAsB,CAAC,MAAc;IAC5C,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC,CAAC,gCAAgC;QAC/F,MAAM,CAAC,CAAC;IACV,CAAC;IACD,OAAO,OAAO;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,iBAAiB,CAAC,CAAC,CAAC,IAAI,EAAE,mBAAmB,CAAC,KAAK,SAAS,CAAC;SAC/F,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,KAAa;IACvD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,iGAAiG;IACjG,iGAAiG;IACjG,uDAAuD;IACvD,KAAK,MAAM,IAAI,IAAI,sBAAsB,CAAC,MAAM,CAAC;QAAE,uBAAuB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACtG,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;4FAM4F;AAC5F,SAAS,oBAAoB,CAAC,KAAa,EAAE,WAAqC;IAChF,IAAI,CAAC,WAAW,CAAC,QAAQ;QAAE,aAAa,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClE,OAAO,cAAc,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED;;;;sGAIsG;AACtG,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,WAAqC,EAAU,EAAE,CAC1G,GAAG,oBAAoB,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;AAC7F,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,WAAqC,EAAU,EAAE,CAC/G,GAAG,oBAAoB,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;AAClG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,WAAqC,EAAU,EAAE,CAClH,GAAG,oBAAoB,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,SAAS,CAAC,aAAa,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;AAErG;;;yFAGyF;AACzF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,KAAa,EAAE,IAAY,EAAE,YAAoB,EAAE,WAAqC,EAChF,EAAE,CAAC,GAAG,oBAAoB,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;AACxH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,KAAa,EAAE,IAAY,EAAE,YAAoB,EAAE,WAAqC,EAChF,EAAE,CAAC,GAAG,oBAAoB,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,oBAAoB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;AAC7H,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,KAAa,EAAE,IAAY,EAAE,YAAoB,EAAE,WAAqC,EAChF,EAAE,CAAC,GAAG,oBAAoB,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,SAAS,CAAC,aAAa,CAAC,oBAAoB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;AAEhI;;;qFAGqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,KAAa,EAAE,IAAY;IAG5E,OAAO,WAAW,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;;yBAGyB;AACzB,MAAM,UAAU,6BAA6B,CAAC,IAAY,EAAE,KAAa,EAAE,IAAY,EAAE,YAAoB;IAG3G,OAAO,WAAW,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,oBAAoB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED;yFACyF;AACzF,SAAS,WAAW,CAAC,GAAW,EAAE,IAAY;IAG5C,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACjD,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,KAAa;IAC/D,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACtD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,+FAA+F,CAAC,CAAC;QAC3H,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,4FAA4F,CAAC,CAAC;IACxH,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,IAAI,OAAO,KAAK,YAAY,CAAC,KAAK,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,qBAAqB,KAAK,6BAA6B,YAAY,CAAC,KAAK,CAAC,MAAM;YACvF,GAAG,gBAAgB,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,wDAAwD,IAAI;YAC7J,+EAA+E,CAChF,CAAC;IACJ,OAAO,cAAc,OAAO,IAAI,IAAI,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC,CAAC,gCAAgC;QAC/F,MAAM,CAAC,CAAC;IACV,CAAC;IACD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACrB,IAAI,iBAAiB,CAAC,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAChG,SAAS;QACX,CAAC;QACD,8FAA8F;QAC9F,8DAA8D;QAC9D,IAAI,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QACrD,IAAI,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;8EAE8E;AAC9E,SAAS,iBAAiB,CAAC,MAAc,EAAE,OAAe;IACxD,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC,CAAC,mCAAmC;QAClG,MAAM,CAAC,CAAC;IACV,CAAC;IACD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,KAAK;QACtB,IAAI,iBAAiB,CAAC,IAAI,EAAE,eAAe,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,cAAc,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC;IACzG,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,KAAa;IACjE,OAAO,iBAAiB,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;kDAOkD;AAClD,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,sBAAsB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,0BAA0B,CAAC,IAAY;IAC9C,MAAM,OAAO,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO;QACV,OAAO,6FAA6F,CAAC;IACvG,iGAAiG;IACjG,kGAAkG;IAClG,mGAAmG;IACnG,6EAA6E;IAC7E,OAAO,CACL,8DAA8D,OAAO,CAAC,MAAM,IAAI;QAChF,kFAAkF;QAClF,sDAAsD,CACvD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAY,EAAE,KAAa,EAAE,SAAiB;IACvF,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,gGAAgG;IAChG,wFAAwF;IACxF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpH,MAAM,IAAI,KAAK,CACb,GAAG,SAAS,6BAA6B,OAAO,CAAC,MAAM,wDAAwD,MAAM,0BAA0B;QAC/I,aAAa,KAAK,sHAAsH;QACxI,uHAAuH;QACvH,sHAAsH;QACtH,0BAA0B,CAAC,IAAI,CAAC,CACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY,EACZ,KAAa,EACb,OAAoB;IAEpB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IAEhD,IAAI,IAAI,GAAa,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,IAAI,GAAG,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,6CAA6C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,4FAA4F;YAC5F,oEAAoE;YACpE,IAAI,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC3C,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC1B,OAAO,CAAC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,qBAAqB,OAAO,+BAA+B,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC"}

package/dist/auth-paths.d.ts

@@ -13,7 +13,16 @@ export declare function spaceKey(space: string): string;
  *  dir (`broker.json`, `account.<hex>.json`, `server.conf`, `creds/`): none of those start with
  *  `space.`, and the hex body cannot smuggle one in. Consumed by the state dir AND the auth
  *  secret-store key builders; two independently-guarded encoders were the defect generator (one
- *  gains a rule the other doesn't), so keep exactly one. */
+ *  gains a rule the other doesn't), so keep exactly one.
+ *
+ *  The non-collision claim now spans a WIDER namespace than the auth dir. Segmenting the root-scoped
+ *  P7 material puts a `space.<hex>` directly under `.cotal/`, so the guarantee must hold against the
+ *  children of `.cotal/` too (`agents`, `auth`, `nats`, `manifests`, the `*.creds`/`*.pid`/`*.log`
+ *  files, and `auth-service.<spaceKey>.pid`, which is the nearest miss). It does, for the same
+ *  reason: no `.cotal` child begins with `space.`. That held by ACCIDENT until something asserted
+ *  it — `RESERVED_COTAL_CHILDREN` in `space-segmentation.ts` carries the list and
+ *  `smoke:space-segmentation` is the guard, so a future `.cotal` child named `space.*` fails a suite
+ *  instead of silently aliasing a tenant's segment. */
 export declare function spaceSegment(space: string): string;
 /** The space a canonical segment encodes, or undefined when the name is not one {@link spaceSegment}
  *  wrote (wrong prefix, non-hex body, or a body that does not round-trip). Enumeration and the
@@ -45,58 +54,6 @@ export declare function hasUserAuthState(root: string, space: string): boolean;
  *  legacy dirs are reported too (decoded from their verbatim names), so a guard reading this stays
  *  fail-closed before the one-time migration has run. */
 export declare function userAuthSpacesOnDisk(dir: string): string[];
-/** The dir every per-agent standing secret materializes under (`<root>/.cotal/auth/creds`) —
- *  space-INDEPENDENT today (one root serves one space); multi-space-per-root re-keys this layout
- *  as a caller change, same as {@link userAuthStateDir}'s note. */
-export declare function agentCredsDir(root: string): string;
-/** THE per-agent file segment — the single guarded encoder under every agent-secret key AND path
- *  (the {@link spaceSegment} posture: one encoder, guarded before any key or path exists). The
- *  alphabet is the manager's spawn-name discipline (`manager.nameError`); the CLI's `--name`
- *  override historically had no such guard, so a path-hostile name is refused HERE, before it can
- *  address a key or file outside the creds dir. */
-export declare function agentSecretSegment(name: string): string;
-/** Canonical {@link SecretStore} keys of the per-agent standing secrets, mirroring today's
- *  `.cotal/auth/creds/<name>.<kind>` layout byte-for-byte under the workspace FS composition.
- *  `<name>.creds` is the static-auth scoped cred; the actor token + sentinel cred are the
- *  user-mode pair a spawn mints. The transient `<name>.auth-health.json` is runtime state, NOT a
- *  secret kind — it stays plain-file. */
-export declare const agentCredsKey: (name: string) => string;
-export declare const agentActorTokenKey: (name: string) => string;
-export declare const agentSentinelCredsKey: (name: string) => string;
-/** Lifecycle-keyed {@link SecretStore} keys of one INCARNATION's secret family — the
- *  per-incarnation counterparts of the standing name-keyed keys above, for any endpoint that
- *  provisions managed lifecycles (the manager is the first client; delivery and future endpoints
- *  ride the same seam). See {@link agentIncarnationBase} for why the uid is embedded. */
-export declare const agentLifecycleCredsKey: (name: string, lifecycleUid: string) => string;
-export declare const agentLifecycleActorTokenKey: (name: string, lifecycleUid: string) => string;
-export declare const agentLifecycleSentinelCredsKey: (name: string, lifecycleUid: string) => string;
-/** The FS materialization paths of one agent's secret family (plus its non-secret health file) —
- *  built from the SAME filename source as the key builders. These are the paths subprocesses read
- *  (the bearer re-exec's `--token-file`, a launch's creds handoff), never an alternate source of
- *  truth: under the local FS composition each path IS its key's storage location. */
-export declare function agentSecretFilePaths(root: string, name: string): {
-    creds: string;
-    actorToken: string;
-    sentinelCreds: string;
-    health: string;
-};
-/** The lifecycle-keyed FS materialization paths of one INCARNATION's secret family (plus its
- *  non-secret health file) — same projection rule as {@link agentSecretFilePaths}, built from the
- *  {@link agentIncarnationBase} so a retired incarnation's teardown can never address a same-alias
- *  successor's files. */
-export declare function agentLifecycleSecretFilePaths(root: string, name: string, lifecycleUid: string): {
-    creds: string;
-    actorToken: string;
-    sentinelCreds: string;
-    health: string;
-};
-export declare function agentSecretKeyForFile(path: string): string;
-/** Enumerate the store keys of every per-agent standing secret currently materialized under this
- *  root — the reset/backstop sweep (`clean all`; despawn owns the primary delete). Deliberately
- *  filename-driven over the LOCAL creds dir: this surface is the FS composition (a hosted reset
- *  rides its own store), and a file only maps to a key if a valid spawn could have written it —
- *  health files and strays are left to the caller's raw cleanup. */
-export declare function agentSecretKeysUnder(root: string): string[];
 /** Materialize a store secret into a 0600 file for a process that can only read files — the
  *  agent-bearer re-exec (`--token-file`) and the launch-time creds handoff. The STORE is the
  *  source of truth; the file is a caller-owned projection at an explicit path (under the local FS
@@ -240,6 +197,22 @@ export declare function accountInventory(dir: string): {
  *  names come from each record's authoritative `space`. Callers that must act on the blast radius use
  *  {@link assertSingleSpaceBroker} / {@link soleSpaceOf}, which also refuse on an unreadable record. */
 export declare function listSpaceAccounts(dir: string): string[];
+/** The accounts a broker config must PRELOAD: every tenant this auth dir holds, with `current` first.
+ *
+ *  The MEMORY resolver is a whole-broker map, so the rendered config IS the tenant list - it does not
+ *  add the space being booted to whatever the running broker already trusts, it replaces the set.
+ *  Rendering from the one space a `cotal up` was asked for therefore evicts every sibling silently:
+ *  the broker starts, that space works, and every cred minted under the others is refused with
+ *  nothing printed anywhere. A render reads this, never a single space.
+ *
+ *  `current` comes from the CALLER because the caller's copy can be fresher than the disk - a space
+ *  minted moments ago, or an account whose trust record this same boot just rotated - and rendering
+ *  the stale on-disk copy of the space being booted is the other half of the same bug.
+ *
+ *  Fail-CLOSED on a corrupt record, like the guards above: a file that occupies the account namespace
+ *  but will not validate may be a real tenant, and rendering without it is precisely the silent
+ *  eviction this exists to prevent. */
+export declare function preloadSpaceAccounts(dir: string, current: SpaceAccountAuth): SpaceAccountAuth[];
 /** THE store key of the broker trust record. Under the workspace store (rooted at `.cotal`) it
  *  resolves byte-for-byte to `.cotal/auth/broker.json`. One source for every signer-bearing tier -
  *  a drifted literal would silently split the kind. */

package/dist/auth-paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-paths.d.ts","sourceRoot":"","sources":["../src/auth-paths.ts"],"names":[],"mappings":"AAEA,OAAO,EAQL,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACf,MAAM,gBAAgB,CAAC;AAexB,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED;;;;;;gGAMgG;AAChG,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAa9C;AAqBD;;;;;4DAK4D;AAC5D,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElD;AAID;;qFAEqF;AACrF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMjE;AAED;;;;;;;;;;;;4FAY4F;AAC5F,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAIpE;AAwFD;;;mEAGmE;AACnE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAErE;AAED;;;;;yDAKyD;AACzD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAiB1D;AAID;;mEAEmE;AACnE,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;;mDAImD;AACnD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIvD;AAwBD;;;;yCAIyC;AACzC,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,MAAmE,CAAC;AACjH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,KAAG,MAAwE,CAAC;AAC3H,eAAO,MAAM,qBAAqB,GAAI,MAAM,MAAM,KAAG,MAA2E,CAAC;AAEjI;;;yFAGyF;AACzF,eAAO,MAAM,sBAAsB,GAAI,MAAM,MAAM,EAAE,cAAc,MAAM,KAAG,MACD,CAAC;AAC5E,eAAO,MAAM,2BAA2B,GAAI,MAAM,MAAM,EAAE,cAAc,MAAM,KAAG,MACD,CAAC;AACjF,eAAO,MAAM,8BAA8B,GAAI,MAAM,MAAM,EAAE,cAAc,MAAM,KAAG,MACD,CAAC;AAEpF;;;qFAGqF;AACrF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG;IAChE,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;CAC1E,CASA;AAED;;;yBAGyB;AACzB,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG;IAC/F,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;CAC1E,CASA;AAaD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAU1D;AAED;;;;oEAIoE;AACpE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAmB3D;AAED;;;;;;2BAM2B;AAC3B,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM1G;AAED;;iGAEiG;AACjG,wBAAgB,aAAa,CAAC,KAAK,GAAE,MAAsB,GAAG,MAAM,CAQnE;AAED;;;;;;;;;;;;;;;;;;;6DAmB6D;AAC7D,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAkCrH;AAkBD,+CAA+C;AAC/C,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;;;6FAK6F;AAC7F,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAID;;;8DAG8D;AAC9D,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAa5G;AACD,kGAAkG;AAClG,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,uBAAuB,GAAG,IAAI,CAIhH;AAwDD;;;;0FAI0F;AAC1F,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnE;AAyED;;;mEAGmE;AACnE,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAqCpE;AAED;iEACiE;AACjE,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAKlE;AAED;;;iBAGiB;AACjB,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,gBAAgB,GAAG,IAAI,CAQtF;AAED;;gEAEgE;AAChE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAY7F;AAOD;;;;4CAI4C;AAC5C,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAiB/E;AAED;;;sDAGsD;AACtD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAGpE;AAED;;;;4FAI4F;AAC5F,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,IAAI,CAGhE;AAED;;;;;;;;uCAQuC;AACvC,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAY3D;AAED;;;;;;;;;;;;wGAYwG;AACxG,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAU5E;AAED;;;;;;;;;;;;;gEAagE;AAChE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAwCrF;AAED;;wGAEwG;AACxG,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAEvD;AAYD;;uDAEuD;AACvD,eAAO,MAAM,eAAe,qBAAwB,CAAC;AAErD;6EAC6E;AAC7E,eAAO,MAAM,cAAc,mBAAsB,CAAC;AAElD;oDACoD;AACpD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD;AA4BD;;;;;;;;;;wDAUwD;AACxD,wBAAsB,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAoCpG;AAED;;;;kFAIkF;AAClF,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAGtG;AAED;;;;;;;;;;;;;iFAaiF;AACjF,wBAAsB,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAyCrF;AAED;;;;8DAI8D;AAC9D,wBAAsB,eAAe,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAItF"}
+{"version":3,"file":"auth-paths.d.ts","sourceRoot":"","sources":["../src/auth-paths.ts"],"names":[],"mappings":"AAEA,OAAO,EAOL,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACf,MAAM,gBAAgB,CAAC;AAqBxB,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED;;;;;;gGAMgG;AAChG,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAa9C;AAqBD;;;;;;;;;;;;;;uDAcuD;AACvD,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElD;AAID;;qFAEqF;AACrF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMjE;AAED;;;;;;;;;;;;4FAY4F;AAC5F,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAIpE;AAwFD;;;mEAGmE;AACnE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAErE;AAED;;;;;yDAKyD;AACzD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAiB1D;AAED;;;;;;2BAM2B;AAC3B,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM1G;AAED;;iGAEiG;AACjG,wBAAgB,aAAa,CAAC,KAAK,GAAE,MAAsB,GAAG,MAAM,CAQnE;AAED;;;;;;;;;;;;;;;;;;;6DAmB6D;AAC7D,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAkCrH;AAkBD,+CAA+C;AAC/C,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;;;6FAK6F;AAC7F,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAID;;;8DAG8D;AAC9D,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAa5G;AACD,kGAAkG;AAClG,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,uBAAuB,GAAG,IAAI,CAIhH;AAwDD;;;;0FAI0F;AAC1F,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnE;AAyED;;;mEAGmE;AACnE,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAqCpE;AAED;iEACiE;AACjE,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAKlE;AAED;;;iBAGiB;AACjB,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,gBAAgB,GAAG,IAAI,CAQtF;AAED;;gEAEgE;AAChE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAY7F;AAOD;;;;4CAI4C;AAC5C,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAiB/E;AAED;;;sDAGsD;AACtD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAGpE;AAED;;;;4FAI4F;AAC5F,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,IAAI,CAGhE;AAED;;;;;;;;uCAQuC;AACvC,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAY3D;AAED;;;;;;;;;;;;wGAYwG;AACxG,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAU5E;AAED;;;;;;;;;;;;;gEAagE;AAChE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAwCrF;AAED;;wGAEwG;AACxG,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAEvD;AAED;;;;;;;;;;;;;;uCAcuC;AACvC,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,gBAAgB,EAAE,CAgB/F;AAYD;;uDAEuD;AACvD,eAAO,MAAM,eAAe,qBAAwB,CAAC;AAErD;6EAC6E;AAC7E,eAAO,MAAM,cAAc,mBAAsB,CAAC;AAElD;oDACoD;AACpD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD;AA4BD;;;;;;;;;;wDAUwD;AACxD,wBAAsB,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAoCpG;AAED;;;;kFAIkF;AAClF,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAGtG;AAED;;;;;;;;;;;;;iFAaiF;AACjF,wBAAsB,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAyCrF;AAED;;;;8DAI8D;AAC9D,wBAAsB,eAAe,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAItF"}