@rubytech/create-maxy-code 0.1.416 → 0.1.417

package/dist/__tests__/outlook-client-id-env.test.js

@@ -0,0 +1,46 @@
+// acceptance gate for OUTLOOK_CLIENT_ID stamping in the claude-session-manager
+// systemd unit (Task 1473).
+//
+// The outlook MCP reads process.env.OUTLOOK_CLIENT_ID; the session manager is
+// the process that spawns claude -> MCP, so the client ID must land on this
+// unit's Environment= block. Two invariants:
+//   (a) a non-empty brand outlookClientId emits BOTH
+//       `Environment=OUTLOOK_CLIENT_ID=<id>` and
+//       `Environment=OUTLOOK_TENANT_ID=common` (multi-tenant /common app).
+//   (b) an empty / absent brand value emits NEITHER line — the plugin stays
+//       inert on that brand exactly as before (no regression), and the MCP's
+//       module-init no-throw path keeps the registry intact.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { buildClaudeSessionManagerUnitFile } from "../port-resolution.js";
+const ACCOUNT_ID = "12345678-9abc-def0-1234-56789abcdef0";
+const CLIENT_ID = "0fa68fe2-8bec-4007-a0c7-776636fbcf97";
+function build(outlookClientId) {
+    return buildClaudeSessionManagerUnitFile({
+        productName: "SiteDesk",
+        brandHostname: "sitedesk-code",
+        installDir: "/home/me/sitedesk-code",
+        persistDir: "/home/me/.sitedesk-code",
+        claudeSessionManagerPort: 19402,
+        brandPort: 19300,
+        maxyUiInternalPort: 19301,
+        accountId: ACCOUNT_ID,
+        cdpPort: 9224,
+        outlookClientId,
+    });
+}
+test("stamps OUTLOOK_CLIENT_ID + OUTLOOK_TENANT_ID for a non-empty brand value", () => {
+    const unit = build(CLIENT_ID);
+    assert.match(unit, new RegExp(`^Environment=OUTLOOK_CLIENT_ID=${CLIENT_ID}$`, "m"), "OUTLOOK_CLIENT_ID line missing or malformed");
+    assert.match(unit, /^Environment=OUTLOOK_TENANT_ID=common$/m, "OUTLOOK_TENANT_ID=common line missing");
+});
+test("stamps NEITHER line when the brand value is empty", () => {
+    const unit = build("");
+    assert.doesNotMatch(unit, /OUTLOOK_CLIENT_ID/, "unexpected OUTLOOK_CLIENT_ID on empty brand");
+    assert.doesNotMatch(unit, /OUTLOOK_TENANT_ID/, "unexpected OUTLOOK_TENANT_ID on empty brand");
+});
+test("stamps NEITHER line when the brand value is absent", () => {
+    const unit = build(undefined);
+    assert.doesNotMatch(unit, /OUTLOOK_CLIENT_ID/, "unexpected OUTLOOK_CLIENT_ID on absent brand");
+    assert.doesNotMatch(unit, /OUTLOOK_TENANT_ID/, "unexpected OUTLOOK_TENANT_ID on absent brand");
+});

package/dist/index.js

@@ -3579,6 +3579,32 @@ function installServiceDarwin() {
             else
                 envContent = envContent.trimEnd() + (envContent.length > 0 ? "\n" : "") + `NODE_BIN=${nodeBin}\n`;
         }
+        // Task 1473 — darwin has no systemd EnvironmentFile primitive, so the vendor
+        // Outlook app env is mirrored into .env (the wrapper sources it before exec).
+        // Symmetric with the Linux unit, which is rebuilt wholesale each run: a
+        // non-empty brand outlookClientId upserts BOTH vars together; empty / absent
+        // STRIPS both lines. Stripping matters because .env persists across installs —
+        // without it, a brand whose outlookClientId is later blanked (vendor-app
+        // rotation/revocation) would keep sourcing a stale, now-invalid client ID and
+        // keep reporting clientIdConfigured=true against its current empty intent.
+        if (BRAND.outlookClientId) {
+            for (const [key, value] of [
+                ["OUTLOOK_CLIENT_ID", BRAND.outlookClientId],
+                ["OUTLOOK_TENANT_ID", "common"],
+            ]) {
+                const re = new RegExp(`^${key}=.*$`, "m");
+                if (re.test(envContent))
+                    envContent = envContent.replace(re, `${key}=${value}`);
+                else
+                    envContent = envContent.trimEnd() + (envContent.length > 0 ? "\n" : "") + `${key}=${value}\n`;
+            }
+        }
+        else {
+            for (const key of ["OUTLOOK_CLIENT_ID", "OUTLOOK_TENANT_ID"]) {
+                envContent = envContent.replace(new RegExp(`^${key}=.*\\n?`, "m"), "");
+            }
+        }
+        logFile(`  [installer] op=outlook-client-id brand=${BRAND.hostname} stamped=${BRAND.outlookClientId ? "true" : "false"}`);
         writeFileSync(envPath, envContent);
         logFile(`  .env: DISPLAY_MODE=${DISPLAY_MODE}, EMBED_MODEL=${EMBED_MODEL}, EMBED_DIMENSIONS=${EMBED_DIMS}, NEO4J_URI=bolt://localhost:${NEO4J_PORT}, PORT=${PORT}, MAXY_UI_INTERNAL_PORT=${PORT} (darwin-collapsed), CLAUDE_SESSION_MANAGER_PORT=${BRAND.claudeSessionManagerPort}, HOSTNAME=0.0.0.0, ACCOUNT_ID=${installAccountId.slice(0, 8)}…, CLAUDE_CONFIG_DIR=${persistDir}/.claude, CLAUDE_BIN=${canonicalClaude ?? "unresolved(PATH)"}, NODE_BIN=${nodeBin}, PATH=${darwinServiceEnvPath}`);
     }
@@ -4161,9 +4187,14 @@ function installService() {
         maxyUiInternalPort: MAXY_UI_INTERNAL_PORT,
         accountId: installAccountId,
         cdpPort: CDP_PORT_BRAND,
+        outlookClientId: BRAND.outlookClientId,
     });
     writeFileSync(join(serviceDir, claudeSessionManagerUnitName), claudeSessionManagerUnit);
     logFile(`  ${claudeSessionManagerUnitName}: CLAUDE_SESSION_MANAGER_PORT=${CLAUDE_SESSION_MANAGER_PORT_BRAND} MAXY_UI_INTERNAL_PORT=${MAXY_UI_INTERNAL_PORT}`);
+    // Task 1473 — standing install-time signal reconciling brand.json intent
+    // (a non-empty outlookClientId) against what the unit shipped. `stamped=false`
+    // while the brand has a value is the mis-stamp signature.
+    logFile(`  [installer] op=outlook-client-id brand=${BRAND.hostname} stamped=${BRAND.outlookClientId ? "true" : "false"}`);
     // Task 250 — write the brand-agnostic `claude-ptys.slice` unit. Every
     // brand's session manager drops its per-spawn scope units under this
     // slice. Writing it once per install is idempotent (the content is

package/dist/port-resolution.js

@@ -128,6 +128,13 @@ export function buildClaudeSessionManagerUnitFile(o) {
     if (!o.accountId) {
         throw new Error("buildClaudeSessionManagerUnitFile: accountId is required — caller must resolve the on-disk account UUID before stamping the systemd unit.");
     }
+    // Task 1473 — a non-empty brand outlookClientId adds the vendor Outlook app
+    // env. Both lines land together so OUTLOOK_TENANT_ID (multi-tenant /common)
+    // never trails a bare client ID. Empty / absent brands stamp neither line —
+    // the plugin stays inert, no regression.
+    const outlookEnv = o.outlookClientId
+        ? `\nEnvironment=OUTLOOK_CLIENT_ID=${o.outlookClientId}\nEnvironment=OUTLOOK_TENANT_ID=common`
+        : "";
     return `[Unit]
 Description=${o.productName} Claude Session Manager
 After=network.target
@@ -149,7 +156,7 @@ Environment=PLATFORM_ROOT=${o.installDir}/platform
 Environment=MAXY_BRAND_PORT=${o.brandPort}
 Environment=MAXY_UI_INTERNAL_PORT=${o.maxyUiInternalPort}
 Environment=PLATFORM_PORT=${o.maxyUiInternalPort}
-Environment=CDP_PORT=${o.cdpPort}
+Environment=CDP_PORT=${o.cdpPort}${outlookEnv}
 EnvironmentFile=-${o.persistDir}/.env
 StandardOutput=append:${o.persistDir}/logs/server.log
 StandardError=append:${o.persistDir}/logs/server.log

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.416",
+  "version": "0.1.417",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/config/brand.json

@@ -14,6 +14,7 @@
   "websockifyPort": 6080,
   "cdpPort": 9222,
   "claudeSessionManagerPort": 19400,
+  "outlookClientId": "",
   "commercialMode": false,
   "vertical": "schema-knowledge-work",
   "shipsPremiumBundles": ["venture-studio", "writer-craft", "teaching", "management-consulting"],

package/payload/platform/lib/account-enumeration/dist/__tests__/is-provisioned.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=is-provisioned.test.d.ts.map

package/payload/platform/lib/account-enumeration/dist/__tests__/is-provisioned.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-provisioned.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/is-provisioned.test.ts"],"names":[],"mappings":""}

package/payload/platform/lib/account-enumeration/dist/__tests__/is-provisioned.test.js

@@ -0,0 +1,81 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = __importDefault(require("node:test"));
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const index_js_1 = require("../index.js");
+const BOOT_ID = "12345678-9abc-def0-1234-56789abcdef0";
+const LATER_ID = "99999999-aaaa-bbbb-cccc-dddddddddddd";
+/** One valid account dir (BOOT_ID) that existed at "boot". */
+function makeFixture() {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), "acct-prov-"));
+    (0, node_fs_1.mkdirSync)((0, node_path_1.join)(root, BOOT_ID));
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(root, BOOT_ID, "account.json"), JSON.stringify({ id: BOOT_ID }));
+    return root;
+}
+/** Provision a second account dir on disk AFTER boot (simulates account_create). */
+function provisionLater(root) {
+    (0, node_fs_1.mkdirSync)((0, node_path_1.join)(root, LATER_ID));
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(root, LATER_ID, "account.json"), JSON.stringify({ id: LATER_ID }));
+}
+(0, node_test_1.default)("isProvisionedAccount: a created-after-boot id resolves via re-scan on miss", () => {
+    (0, index_js_1._resetEnumerationCache)();
+    const root = makeFixture();
+    try {
+        // Warm the cache at "boot" — only BOOT_ID is present.
+        strict_1.default.deepEqual((0, index_js_1.enumerateValidAccountIds)(root), [BOOT_ID]);
+        // A sub-account is provisioned after the snapshot.
+        provisionLater(root);
+        // Miss against the cached set must re-scan disk and find it — no restart.
+        strict_1.default.equal((0, index_js_1.isProvisionedAccount)(root, LATER_ID), true);
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true });
+    }
+});
+(0, node_test_1.default)("isProvisionedAccount: a truly-absent id still returns false after re-scan", () => {
+    (0, index_js_1._resetEnumerationCache)();
+    const root = makeFixture();
+    try {
+        (0, index_js_1.enumerateValidAccountIds)(root); // warm
+        const bogus = "00000000-0000-0000-0000-000000000000";
+        strict_1.default.equal((0, index_js_1.isProvisionedAccount)(root, bogus), false);
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true });
+    }
+});
+(0, node_test_1.default)("isProvisionedAccount: a warmed hit returns true without re-scanning", () => {
+    (0, index_js_1._resetEnumerationCache)();
+    const root = makeFixture();
+    try {
+        (0, index_js_1.enumerateValidAccountIds)(root); // warm = [BOOT_ID]
+        // Provision a second dir AFTER warming.
+        provisionLater(root);
+        // HIT: BOOT_ID is already in the cached set → true, and the cache must NOT
+        // be refreshed (no readdirSync). Proof: the cached set still hides LATER_ID.
+        strict_1.default.equal((0, index_js_1.isProvisionedAccount)(root, BOOT_ID), true);
+        strict_1.default.deepEqual((0, index_js_1.enumerateValidAccountIds)(root), [BOOT_ID], "a hit must not refresh the cache — LATER_ID must stay hidden");
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true });
+    }
+});
+(0, node_test_1.default)("isProvisionedAccount: cold cache scans disk and answers", () => {
+    (0, index_js_1._resetEnumerationCache)();
+    const root = makeFixture();
+    try {
+        // No warm call — cache is cold. A miss (cold) must scan and answer both ways.
+        strict_1.default.equal((0, index_js_1.isProvisionedAccount)(root, BOOT_ID), true);
+        strict_1.default.equal((0, index_js_1.isProvisionedAccount)(root, LATER_ID), false);
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true });
+    }
+});
+//# sourceMappingURL=is-provisioned.test.js.map

package/payload/platform/lib/account-enumeration/dist/__tests__/is-provisioned.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-provisioned.test.js","sourceRoot":"","sources":["../../src/__tests__/is-provisioned.test.ts"],"names":[],"mappings":";;;;;AAAA,0DAA6B;AAC7B,gEAAwC;AACxC,qCAAwE;AACxE,qCAAiC;AACjC,yCAAiC;AACjC,0CAIqB;AAErB,MAAM,OAAO,GAAG,sCAAsC,CAAC;AACvD,MAAM,QAAQ,GAAG,sCAAsC,CAAC;AAExD,8DAA8D;AAC9D,SAAS,WAAW;IAClB,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,YAAY,CAAC,CAAC,CAAC;IACvD,IAAA,mBAAS,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/B,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACpF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oFAAoF;AACpF,SAAS,cAAc,CAAC,IAAY;IAClC,IAAA,mBAAS,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAChC,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,IAAA,mBAAI,EAAC,4EAA4E,EAAE,GAAG,EAAE;IACtF,IAAA,iCAAsB,GAAE,CAAC;IACzB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,sDAAsD;QACtD,gBAAM,CAAC,SAAS,CAAC,IAAA,mCAAwB,EAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5D,mDAAmD;QACnD,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,0EAA0E;QAC1E,gBAAM,CAAC,KAAK,CAAC,IAAA,+BAAoB,EAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3D,CAAC;YAAS,CAAC;QACT,IAAA,gBAAM,EAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,2EAA2E,EAAE,GAAG,EAAE;IACrF,IAAA,iCAAsB,GAAE,CAAC;IACzB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,IAAA,mCAAwB,EAAC,IAAI,CAAC,CAAC,CAAC,OAAO;QACvC,MAAM,KAAK,GAAG,sCAAsC,CAAC;QACrD,gBAAM,CAAC,KAAK,CAAC,IAAA,+BAAoB,EAAC,IAAI,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;YAAS,CAAC;QACT,IAAA,gBAAM,EAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,qEAAqE,EAAE,GAAG,EAAE;IAC/E,IAAA,iCAAsB,GAAE,CAAC;IACzB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,IAAA,mCAAwB,EAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB;QACnD,wCAAwC;QACxC,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,2EAA2E;QAC3E,6EAA6E;QAC7E,gBAAM,CAAC,KAAK,CAAC,IAAA,+BAAoB,EAAC,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;QACxD,gBAAM,CAAC,SAAS,CACd,IAAA,mCAAwB,EAAC,IAAI,CAAC,EAC9B,CAAC,OAAO,CAAC,EACT,8DAA8D,CAC/D,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAA,gBAAM,EAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,yDAAyD,EAAE,GAAG,EAAE;IACnE,IAAA,iCAAsB,GAAE,CAAC;IACzB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,8EAA8E;QAC9E,gBAAM,CAAC,KAAK,CAAC,IAAA,+BAAoB,EAAC,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;QACxD,gBAAM,CAAC,KAAK,CAAC,IAAA,+BAAoB,EAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;YAAS,CAAC;QACT,IAAA,gBAAM,EAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;AACH,CAAC,CAAC,CAAC"}

package/payload/platform/lib/account-enumeration/dist/index.d.ts

@@ -6,6 +6,23 @@
  * be hiding).
  */
 export declare function enumerateValidAccountIds(accountsDir: string): string[];
+/**
+ * Membership test with re-scan-on-miss: is `id` a currently-provisioned account
+ * under `accountsDir`?
+ *
+ * Hit path — `id` is in the cached set — returns true with no I/O (the common
+ * case; the cache still serves it). Miss path — `id` is absent from the cached
+ * set, or the cache is cold — drops the stale entry and re-scans `accountsDir`
+ * once (refreshing the cache) before answering.
+ *
+ * This closes the created-after-boot gap (Task 1471): a sub-account provisioned
+ * by the runtime `account_create` lifecycle tool after a consumer process booted
+ * is invisible to that process's boot-time cached set. Without the re-scan, the
+ * cross-account resolver rejects the id as not-provisioned even though its dir
+ * and `account.json` exist on disk. A single `readdirSync` on the miss finds it;
+ * a genuinely-absent id pays the same one scan and correctly returns false.
+ */
+export declare function isProvisionedAccount(accountsDir: string, id: string): boolean;
 /**
  * Returns the single `role:"house"` account UUID under `accountsDir`.
  *

package/payload/platform/lib/account-enumeration/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA6BA;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAgCtE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAsBjE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAqBvE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAS9C;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,mCAAmC,GAC3C,SAAS,GACT,oBAAoB,GACpB,UAAU,CAAC;AAEf,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,mCAAmC,CAAC;IAC5C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEN,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,EAAE,MAAM,EAAE,GAChB,sBAAsB,CAWxB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAwCA;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAgCtE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAO7E;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAsBjE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAqBvE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAS9C;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,mCAAmC,GAC3C,SAAS,GACT,oBAAoB,GACpB,UAAU,CAAC;AAEf,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,mCAAmC,CAAC;IAC5C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEN,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,EAAE,MAAM,EAAE,GAChB,sBAAsB,CAWxB"}

package/payload/platform/lib/account-enumeration/dist/index.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.enumerateValidAccountIds = enumerateValidAccountIds;
+exports.isProvisionedAccount = isProvisionedAccount;
 exports.resolveHouseAccountId = resolveHouseAccountId;
 exports.resolveHouseOrSoleAccountId = resolveHouseOrSoleAccountId;
 exports.getAccountsDirFromEnv = getAccountsDirFromEnv;
@@ -16,16 +17,27 @@ exports.validateAccountIdEnv = validateAccountIdEnv;
  * (`WHERE n.accountId = $accountId`) silently hides leaks from every UI;
  * an unenforced writer can leak indefinitely with zero downstream symptom.
  *
- * Two consumers:
- *   1. `writeNodeWithEdges` (platform/lib/graph-write/) — central write-time
- *      floor; rejects any write whose `props.accountId` is not in the set
- *      returned here, unless `createdBy.agent === 'system'` (bootstrap).
- *   2. `resolvePlatformAccountId` (platform/ui/app/lib/whatsapp/platform-account-id.ts)
- *      — WhatsApp writer-side helper; loud-throws on zero or multi accounts.
+ * Consumers of the enumerated set:
+ *   - The cross-account resolver's injected validity check (the `memory` and
+ *     `filesystem` MCP plugins) — the check that gates a `targetAccountId`.
+ *     These call `isProvisionedAccount` (re-scan-on-miss), not the cached list
+ *     directly, so a sub-account created at runtime is not masked by the boot
+ *     snapshot (Task 1471).
+ *   - `resolvePlatformAccountId` (platform/ui/app/lib/whatsapp/platform-account-id.ts)
+ *     — WhatsApp writer-side helper; loud-throws on zero or multi accounts.
+ *   - Boot-time env-vs-disk validation (`validateAccountIdEnv`).
  *
- * Per-process cache keyed on `accountsDir` — Phase 0 invariant has accounts
- * created at install time, so adding/removing accounts requires a service
- * restart anyway.
+ * NOTE: `writeNodeWithEdges` (platform/lib/graph-write/) does NOT enumerate.
+ * Its account floor compares `props.accountId` against `process.env.ACCOUNT_ID`
+ * (the spawning process's boot-validated id), deliberately staying out of the
+ * `node:fs` import chain so the ESM payload bundle emits no `__require("fs")`
+ * shim. So the write gate does not share the cache's staleness.
+ *
+ * Per-process cache keyed on `accountsDir`. The install-time invariant (accounts
+ * created only at install) no longer holds: the runtime `account_create`
+ * lifecycle tool provisions sub-accounts during a live session. `enumerate…`
+ * keeps its cached-list semantics for the hit path; `isProvisionedAccount`
+ * re-scans on a miss so a created-after-boot account resolves without restart.
  */
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
@@ -73,6 +85,31 @@ function enumerateValidAccountIds(accountsDir) {
     cache.set(accountsDir, valid);
     return valid;
 }
+/**
+ * Membership test with re-scan-on-miss: is `id` a currently-provisioned account
+ * under `accountsDir`?
+ *
+ * Hit path — `id` is in the cached set — returns true with no I/O (the common
+ * case; the cache still serves it). Miss path — `id` is absent from the cached
+ * set, or the cache is cold — drops the stale entry and re-scans `accountsDir`
+ * once (refreshing the cache) before answering.
+ *
+ * This closes the created-after-boot gap (Task 1471): a sub-account provisioned
+ * by the runtime `account_create` lifecycle tool after a consumer process booted
+ * is invisible to that process's boot-time cached set. Without the re-scan, the
+ * cross-account resolver rejects the id as not-provisioned even though its dir
+ * and `account.json` exist on disk. A single `readdirSync` on the miss finds it;
+ * a genuinely-absent id pays the same one scan and correctly returns false.
+ */
+function isProvisionedAccount(accountsDir, id) {
+    const cached = cache.get(accountsDir);
+    if (cached?.includes(id))
+        return true;
+    // Miss: `id` is not in the cached set (or the cache is cold). Drop the stale
+    // snapshot and re-scan disk once so a real, on-disk account is not masked.
+    cache.delete(accountsDir);
+    return enumerateValidAccountIds(accountsDir).includes(id);
+}
 /**
  * Returns the single `role:"house"` account UUID under `accountsDir`.
  *

package/payload/platform/lib/account-enumeration/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;AAoCA,4DAgCC;AAoBD,sDAsBC;AAeD,kEAqBC;AAUD,sDASC;AAMD,wDAEC;AA8BD,oDAcC;AAzND;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qCAAoD;AACpD,yCAAoC;AAEpC,MAAM,OAAO,GACX,iEAAiE,CAAC;AAEpE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;AAE1C;;;;;;GAMG;AACH,SAAgB,wBAAwB,CAAC,WAAmB;IAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAExC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,qBAAW,EAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAClC,MAAM,UAAU,GAAG,IAAA,mBAAO,EAAC,WAAW,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,IAAI,IAAI,KAAK,QAAQ;gBAAE,SAAS;YAChC,kEAAkE;YAClE,kCAAkC;QACpC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,qBAAqB,CAAC,WAAmB;IACvD,MAAM,KAAK,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,IAAA,mBAAO,EAAC,WAAW,EAAE,EAAE,EAAE,cAAc,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAEvD,CAAC;YACF,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,oDAAoD,MAAM,CAAC,MAAM,UAAU,WAAW,GAAG;YACvF,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,oDAAoD;YACnF,6CAA6C,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,2BAA2B,CAAC,WAAmB;IAC7D,MAAM,KAAK,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,IAAA,mBAAO,EAAC,WAAW,EAAE,EAAE,EAAE,cAAc,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAEvD,CAAC;YACF,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,IAAI,KAAK,CACb,0DAA0D,MAAM,CAAC,MAAM,UAAU,KAAK,CAAC,MAAM,GAAG;QAC9F,SAAS,WAAW,yEAAyE;QAC7F,6CAA6C,CAChD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,kFAAkF,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,mBAAO,EAAC,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB;IACpC,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AA8BD,SAAgB,oBAAoB,CAClC,QAA4B,EAC5B,OAAiB;IAEjB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;AA+CA,4DAgCC;AAkBD,oDAOC;AAoBD,sDAsBC;AAeD,kEAqBC;AAUD,sDASC;AAMD,wDAEC;AA8BD,oDAcC;AA7PD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,qCAAoD;AACpD,yCAAoC;AAEpC,MAAM,OAAO,GACX,iEAAiE,CAAC;AAEpE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;AAE1C;;;;;;GAMG;AACH,SAAgB,wBAAwB,CAAC,WAAmB;IAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAExC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,qBAAW,EAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAClC,MAAM,UAAU,GAAG,IAAA,mBAAO,EAAC,WAAW,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,IAAI,IAAI,KAAK,QAAQ;gBAAE,SAAS;YAChC,kEAAkE;YAClE,kCAAkC;QACpC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,oBAAoB,CAAC,WAAmB,EAAE,EAAU;IAClE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,6EAA6E;IAC7E,2EAA2E;IAC3E,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1B,OAAO,wBAAwB,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,qBAAqB,CAAC,WAAmB;IACvD,MAAM,KAAK,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,IAAA,mBAAO,EAAC,WAAW,EAAE,EAAE,EAAE,cAAc,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAEvD,CAAC;YACF,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,oDAAoD,MAAM,CAAC,MAAM,UAAU,WAAW,GAAG;YACvF,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,oDAAoD;YACnF,6CAA6C,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,2BAA2B,CAAC,WAAmB;IAC7D,MAAM,KAAK,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,IAAA,mBAAO,EAAC,WAAW,EAAE,EAAE,EAAE,cAAc,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAEvD,CAAC;YACF,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,IAAI,KAAK,CACb,0DAA0D,MAAM,CAAC,MAAM,UAAU,KAAK,CAAC,MAAM,GAAG;QAC9F,SAAS,WAAW,yEAAyE;QAC7F,6CAA6C,CAChD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,kFAAkF,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,mBAAO,EAAC,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB;IACpC,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AA8BD,SAAgB,oBAAoB,CAClC,QAA4B,EAC5B,OAAiB;IAEjB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC"}

package/payload/platform/lib/account-enumeration/src/__tests__/is-provisioned.test.ts

@@ -0,0 +1,86 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  enumerateValidAccountIds,
+  isProvisionedAccount,
+  _resetEnumerationCache,
+} from "../index.js";
+
+const BOOT_ID = "12345678-9abc-def0-1234-56789abcdef0";
+const LATER_ID = "99999999-aaaa-bbbb-cccc-dddddddddddd";
+
+/** One valid account dir (BOOT_ID) that existed at "boot". */
+function makeFixture(): string {
+  const root = mkdtempSync(join(tmpdir(), "acct-prov-"));
+  mkdirSync(join(root, BOOT_ID));
+  writeFileSync(join(root, BOOT_ID, "account.json"), JSON.stringify({ id: BOOT_ID }));
+  return root;
+}
+
+/** Provision a second account dir on disk AFTER boot (simulates account_create). */
+function provisionLater(root: string): void {
+  mkdirSync(join(root, LATER_ID));
+  writeFileSync(join(root, LATER_ID, "account.json"), JSON.stringify({ id: LATER_ID }));
+}
+
+test("isProvisionedAccount: a created-after-boot id resolves via re-scan on miss", () => {
+  _resetEnumerationCache();
+  const root = makeFixture();
+  try {
+    // Warm the cache at "boot" — only BOOT_ID is present.
+    assert.deepEqual(enumerateValidAccountIds(root), [BOOT_ID]);
+    // A sub-account is provisioned after the snapshot.
+    provisionLater(root);
+    // Miss against the cached set must re-scan disk and find it — no restart.
+    assert.equal(isProvisionedAccount(root, LATER_ID), true);
+  } finally {
+    rmSync(root, { recursive: true });
+  }
+});
+
+test("isProvisionedAccount: a truly-absent id still returns false after re-scan", () => {
+  _resetEnumerationCache();
+  const root = makeFixture();
+  try {
+    enumerateValidAccountIds(root); // warm
+    const bogus = "00000000-0000-0000-0000-000000000000";
+    assert.equal(isProvisionedAccount(root, bogus), false);
+  } finally {
+    rmSync(root, { recursive: true });
+  }
+});
+
+test("isProvisionedAccount: a warmed hit returns true without re-scanning", () => {
+  _resetEnumerationCache();
+  const root = makeFixture();
+  try {
+    enumerateValidAccountIds(root); // warm = [BOOT_ID]
+    // Provision a second dir AFTER warming.
+    provisionLater(root);
+    // HIT: BOOT_ID is already in the cached set → true, and the cache must NOT
+    // be refreshed (no readdirSync). Proof: the cached set still hides LATER_ID.
+    assert.equal(isProvisionedAccount(root, BOOT_ID), true);
+    assert.deepEqual(
+      enumerateValidAccountIds(root),
+      [BOOT_ID],
+      "a hit must not refresh the cache — LATER_ID must stay hidden",
+    );
+  } finally {
+    rmSync(root, { recursive: true });
+  }
+});
+
+test("isProvisionedAccount: cold cache scans disk and answers", () => {
+  _resetEnumerationCache();
+  const root = makeFixture();
+  try {
+    // No warm call — cache is cold. A miss (cold) must scan and answer both ways.
+    assert.equal(isProvisionedAccount(root, BOOT_ID), true);
+    assert.equal(isProvisionedAccount(root, LATER_ID), false);
+  } finally {
+    rmSync(root, { recursive: true });
+  }
+});

package/payload/platform/lib/account-enumeration/src/index.ts

@@ -8,16 +8,27 @@
  * (`WHERE n.accountId = $accountId`) silently hides leaks from every UI;
  * an unenforced writer can leak indefinitely with zero downstream symptom.
  *
- * Two consumers:
- *   1. `writeNodeWithEdges` (platform/lib/graph-write/) — central write-time
- *      floor; rejects any write whose `props.accountId` is not in the set
- *      returned here, unless `createdBy.agent === 'system'` (bootstrap).
- *   2. `resolvePlatformAccountId` (platform/ui/app/lib/whatsapp/platform-account-id.ts)
- *      — WhatsApp writer-side helper; loud-throws on zero or multi accounts.
+ * Consumers of the enumerated set:
+ *   - The cross-account resolver's injected validity check (the `memory` and
+ *     `filesystem` MCP plugins) — the check that gates a `targetAccountId`.
+ *     These call `isProvisionedAccount` (re-scan-on-miss), not the cached list
+ *     directly, so a sub-account created at runtime is not masked by the boot
+ *     snapshot (Task 1471).
+ *   - `resolvePlatformAccountId` (platform/ui/app/lib/whatsapp/platform-account-id.ts)
+ *     — WhatsApp writer-side helper; loud-throws on zero or multi accounts.
+ *   - Boot-time env-vs-disk validation (`validateAccountIdEnv`).
  *
- * Per-process cache keyed on `accountsDir` — Phase 0 invariant has accounts
- * created at install time, so adding/removing accounts requires a service
- * restart anyway.
+ * NOTE: `writeNodeWithEdges` (platform/lib/graph-write/) does NOT enumerate.
+ * Its account floor compares `props.accountId` against `process.env.ACCOUNT_ID`
+ * (the spawning process's boot-validated id), deliberately staying out of the
+ * `node:fs` import chain so the ESM payload bundle emits no `__require("fs")`
+ * shim. So the write gate does not share the cache's staleness.
+ *
+ * Per-process cache keyed on `accountsDir`. The install-time invariant (accounts
+ * created only at install) no longer holds: the runtime `account_create`
+ * lifecycle tool provisions sub-accounts during a live session. `enumerate…`
+ * keeps its cached-list semantics for the hit path; `isProvisionedAccount`
+ * re-scans on a miss so a created-after-boot account resolves without restart.
  */
 import { readdirSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
@@ -68,6 +79,31 @@ export function enumerateValidAccountIds(accountsDir: string): string[] {
   return valid;
 }
 
+/**
+ * Membership test with re-scan-on-miss: is `id` a currently-provisioned account
+ * under `accountsDir`?
+ *
+ * Hit path — `id` is in the cached set — returns true with no I/O (the common
+ * case; the cache still serves it). Miss path — `id` is absent from the cached
+ * set, or the cache is cold — drops the stale entry and re-scans `accountsDir`
+ * once (refreshing the cache) before answering.
+ *
+ * This closes the created-after-boot gap (Task 1471): a sub-account provisioned
+ * by the runtime `account_create` lifecycle tool after a consumer process booted
+ * is invisible to that process's boot-time cached set. Without the re-scan, the
+ * cross-account resolver rejects the id as not-provisioned even though its dir
+ * and `account.json` exist on disk. A single `readdirSync` on the miss finds it;
+ * a genuinely-absent id pays the same one scan and correctly returns false.
+ */
+export function isProvisionedAccount(accountsDir: string, id: string): boolean {
+  const cached = cache.get(accountsDir);
+  if (cached?.includes(id)) return true;
+  // Miss: `id` is not in the cached set (or the cache is cold). Drop the stale
+  // snapshot and re-scan disk once so a real, on-disk account is not masked.
+  cache.delete(accountsDir);
+  return enumerateValidAccountIds(accountsDir).includes(id);
+}
+
 /**
  * Returns the single `role:"house"` account UUID under `accountsDir`.
  *

package/payload/platform/lib/account-scope/dist/index.d.ts

@@ -1,7 +1,7 @@
 export type EffectiveAccount = {
     accountId: string;
 } | {
-    reject: "cross-account-denied" | "cross-account-invalid-target";
+    reject: "cross-account-denied" | "cross-account-invalid-target" | "cross-account-target-not-provisioned";
 };
 /**
  * Resolve the account a call acts on. Fail-closed: only a house-scoped session
@@ -10,15 +10,24 @@ export type EffectiveAccount = {
  * downgraded to its own account.
  *
  * `isValidAccountId` is injected (required, no default): the UI passes its
- * fs-backed `isValidAccountId`; the `filesystem` plugin passes a check over
- * `enumerateValidAccountIds`. Keeping validity injected is what lets this
- * module stay pure.
+ * fs-backed `isValidAccountId` (reads disk fresh every call); the `memory` and
+ * `filesystem` plugins pass `isProvisionedAccount` (cached-hit, re-scan-on-miss).
+ * Keeping validity injected is what lets this module stay pure.
+ *
+ * `notProvisionedReason` names the reject emitted when the injected check fails.
+ * It defaults to `cross-account-invalid-target` (the UI path, byte-identical to
+ * the 1440 landing). The MCP plugins pass `cross-account-target-not-provisioned`
+ * because their injected check re-scans disk on a miss (Task 1471) — so a false
+ * from it means the id is genuinely not on disk, distinct from a stale-cache
+ * miss (which no longer rejects). The distinct reason lets an operator tell a
+ * wrong/typo id from the (now-eliminated) created-after-boot case in the
+ * `[xacct] op=call … reason=` line.
  */
 export declare function resolveEffectiveAccountCore(input: {
     ownAccountId: string;
     houseScope: string | null;
     targetAccountId?: string | null;
-}, isValidAccountId: (id: string) => boolean): EffectiveAccount;
+}, isValidAccountId: (id: string) => boolean, notProvisionedReason?: "cross-account-invalid-target" | "cross-account-target-not-provisioned"): EffectiveAccount;
 /**
  * Boot-reader that consumers import to learn their house scope from the spawn
  * env. An empty value reads as null — a non-house session carries no scope.

package/payload/platform/lib/account-scope/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,gBAAgB,GACxB;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,sBAAsB,GAAG,8BAA8B,CAAA;CAAE,CAAC;AAExE;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAC3F,gBAAgB,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,GACxC,gBAAgB,CAMlB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,IAAI,CAEvF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,gBAAgB,GACxB;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GACrB;IACE,MAAM,EACF,sBAAsB,GACtB,8BAA8B,GAC9B,sCAAsC,CAAC;CAC5C,CAAC;AAEN;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAC3F,gBAAgB,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,EACzC,oBAAoB,GAChB,8BAA8B,GAC9B,sCAAuE,GAC1E,gBAAgB,CAMlB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,IAAI,CAEvF"}

package/payload/platform/lib/account-scope/dist/index.js

@@ -9,18 +9,27 @@ exports.readHouseAdminScope = readHouseAdminScope;
  * downgraded to its own account.
  *
  * `isValidAccountId` is injected (required, no default): the UI passes its
- * fs-backed `isValidAccountId`; the `filesystem` plugin passes a check over
- * `enumerateValidAccountIds`. Keeping validity injected is what lets this
- * module stay pure.
+ * fs-backed `isValidAccountId` (reads disk fresh every call); the `memory` and
+ * `filesystem` plugins pass `isProvisionedAccount` (cached-hit, re-scan-on-miss).
+ * Keeping validity injected is what lets this module stay pure.
+ *
+ * `notProvisionedReason` names the reject emitted when the injected check fails.
+ * It defaults to `cross-account-invalid-target` (the UI path, byte-identical to
+ * the 1440 landing). The MCP plugins pass `cross-account-target-not-provisioned`
+ * because their injected check re-scans disk on a miss (Task 1471) — so a false
+ * from it means the id is genuinely not on disk, distinct from a stale-cache
+ * miss (which no longer rejects). The distinct reason lets an operator tell a
+ * wrong/typo id from the (now-eliminated) created-after-boot case in the
+ * `[xacct] op=call … reason=` line.
  */
-function resolveEffectiveAccountCore(input, isValidAccountId) {
+function resolveEffectiveAccountCore(input, isValidAccountId, notProvisionedReason = "cross-account-invalid-target") {
     const { ownAccountId, houseScope, targetAccountId } = input;
     if (!targetAccountId)
         return { accountId: ownAccountId };
     if (!houseScope)
         return { reject: "cross-account-denied" };
     if (!isValidAccountId(targetAccountId))
-        return { reject: "cross-account-invalid-target" };
+        return { reject: notProvisionedReason };
     return { accountId: targetAccountId };
 }
 /**

package/payload/platform/lib/account-scope/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;AAyBA,kEASC;AAMD,kDAEC;AA5BD;;;;;;;;;;GAUG;AACH,SAAgB,2BAA2B,CACzC,KAA2F,EAC3F,gBAAyC;IAEzC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IAC5D,IAAI,CAAC,eAAe;QAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;IACzD,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC3D,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAC1F,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtE,OAAO,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;AAuCA,kEAYC;AAMD,kDAEC;AAxCD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAgB,2BAA2B,CACzC,KAA2F,EAC3F,gBAAyC,EACzC,uBAE6C,8BAA8B;IAE3E,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IAC5D,IAAI,CAAC,eAAe;QAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;IACzD,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC3D,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAChF,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtE,OAAO,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC"}