@rubytech/create-maxy-code 0.1.416 → 0.1.419

package/dist/__tests__/brand-port-uniqueness.test.js

@@ -0,0 +1,74 @@
+// Standing check: no two brands may fight for the same host resource when
+// co-resident on one device. Two namespaces are at stake:
+//
+//   1. Host TCP ports. neo4jPort / ttydPort / rfbPort / websockifyPort /
+//      cdpPort / claudeSessionManagerPort all bind TCP on the same host, so they
+//      must be globally unique across every (brand, field) pair — not merely
+//      unique within each field. A future brand whose ttydPort equals another
+//      brand's neo4jPort would EADDRINUSE at runtime with no build event, even
+//      though each field is individually unique.
+//   2. X display numbers. vncDisplay is an Xvnc display index (:NN and its
+//      /tmp/.X<NN>-lock), a namespace distinct from TCP ports, so it must be
+//      unique across brands on its own.
+//
+// This reconciles all brands/*/brand.json on every CI run. Path resolution
+// mirrors known-brand-hostnames.test.ts.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readdirSync, readFileSync, existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, resolve, join } from "node:path";
+// dist/__tests__/brand-port-uniqueness.test.js → maxy-code/brands
+const here = dirname(fileURLToPath(import.meta.url));
+const BRANDS_DIR = resolve(here, "../../../../brands");
+// Fields that bind a host TCP port (one shared namespace across all fields).
+const TCP_PORT_FIELDS = [
+    "neo4jPort",
+    "ttydPort",
+    "rfbPort",
+    "websockifyPort",
+    "cdpPort",
+    "claudeSessionManagerPort",
+];
+// X display index — its own namespace, unique per brand.
+const DISPLAY_FIELD = "vncDisplay";
+const ALL_FIELDS = [...TCP_PORT_FIELDS, DISPLAY_FIELD];
+function brandManifests() {
+    return readdirSync(BRANDS_DIR, { withFileTypes: true })
+        .filter((e) => e.isDirectory())
+        .map((e) => ({ name: e.name, path: join(BRANDS_DIR, e.name, "brand.json") }))
+        .filter((b) => existsSync(b.path))
+        .map((b) => ({ name: b.name, manifest: JSON.parse(readFileSync(b.path, "utf-8")) }));
+}
+test("brands/ is discoverable and every brand declares all port fields", () => {
+    const brands = brandManifests();
+    assert.ok(brands.length > 0, `no brand.json found under ${BRANDS_DIR}`);
+    for (const { name, manifest } of brands) {
+        for (const field of ALL_FIELDS) {
+            assert.equal(typeof manifest[field], "number", `brands/${name}/brand.json is missing numeric ${field}`);
+        }
+    }
+});
+test("host TCP ports are globally unique across every (brand, field)", () => {
+    const brands = brandManifests();
+    const seen = new Map(); // port -> "brand.field" that claimed it
+    for (const { name, manifest } of brands) {
+        for (const field of TCP_PORT_FIELDS) {
+            const value = manifest[field];
+            const owner = `${name}.${field}`;
+            const prior = seen.get(value);
+            assert.equal(prior, undefined, `TCP port collision: ${prior} and ${owner} both bind ${value} — they would EADDRINUSE when co-resident`);
+            seen.set(value, owner);
+        }
+    }
+});
+test("vncDisplay is unique across brands", () => {
+    const brands = brandManifests();
+    const seen = new Map();
+    for (const { name, manifest } of brands) {
+        const value = manifest[DISPLAY_FIELD];
+        const prior = seen.get(value);
+        assert.equal(prior, undefined, `vncDisplay collision: brands "${prior}" and "${name}" both use :${value}`);
+        seen.set(value, name);
+    }
+});

package/dist/__tests__/outlook-client-id-env.test.js

@@ -0,0 +1,46 @@
+// acceptance gate for OUTLOOK_CLIENT_ID stamping in the claude-session-manager
+// systemd unit (Task 1473).
+//
+// The outlook MCP reads process.env.OUTLOOK_CLIENT_ID; the session manager is
+// the process that spawns claude -> MCP, so the client ID must land on this
+// unit's Environment= block. Two invariants:
+//   (a) a non-empty brand outlookClientId emits BOTH
+//       `Environment=OUTLOOK_CLIENT_ID=<id>` and
+//       `Environment=OUTLOOK_TENANT_ID=common` (multi-tenant /common app).
+//   (b) an empty / absent brand value emits NEITHER line — the plugin stays
+//       inert on that brand exactly as before (no regression), and the MCP's
+//       module-init no-throw path keeps the registry intact.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { buildClaudeSessionManagerUnitFile } from "../port-resolution.js";
+const ACCOUNT_ID = "12345678-9abc-def0-1234-56789abcdef0";
+const CLIENT_ID = "0fa68fe2-8bec-4007-a0c7-776636fbcf97";
+function build(outlookClientId) {
+    return buildClaudeSessionManagerUnitFile({
+        productName: "SiteDesk",
+        brandHostname: "sitedesk-code",
+        installDir: "/home/me/sitedesk-code",
+        persistDir: "/home/me/.sitedesk-code",
+        claudeSessionManagerPort: 19402,
+        brandPort: 19300,
+        maxyUiInternalPort: 19301,
+        accountId: ACCOUNT_ID,
+        cdpPort: 9224,
+        outlookClientId,
+    });
+}
+test("stamps OUTLOOK_CLIENT_ID + OUTLOOK_TENANT_ID for a non-empty brand value", () => {
+    const unit = build(CLIENT_ID);
+    assert.match(unit, new RegExp(`^Environment=OUTLOOK_CLIENT_ID=${CLIENT_ID}$`, "m"), "OUTLOOK_CLIENT_ID line missing or malformed");
+    assert.match(unit, /^Environment=OUTLOOK_TENANT_ID=common$/m, "OUTLOOK_TENANT_ID=common line missing");
+});
+test("stamps NEITHER line when the brand value is empty", () => {
+    const unit = build("");
+    assert.doesNotMatch(unit, /OUTLOOK_CLIENT_ID/, "unexpected OUTLOOK_CLIENT_ID on empty brand");
+    assert.doesNotMatch(unit, /OUTLOOK_TENANT_ID/, "unexpected OUTLOOK_TENANT_ID on empty brand");
+});
+test("stamps NEITHER line when the brand value is absent", () => {
+    const unit = build(undefined);
+    assert.doesNotMatch(unit, /OUTLOOK_CLIENT_ID/, "unexpected OUTLOOK_CLIENT_ID on absent brand");
+    assert.doesNotMatch(unit, /OUTLOOK_TENANT_ID/, "unexpected OUTLOOK_TENANT_ID on absent brand");
+});

package/dist/index.js

@@ -3579,6 +3579,32 @@ function installServiceDarwin() {
             else
                 envContent = envContent.trimEnd() + (envContent.length > 0 ? "\n" : "") + `NODE_BIN=${nodeBin}\n`;
         }
+        // Task 1473 — darwin has no systemd EnvironmentFile primitive, so the vendor
+        // Outlook app env is mirrored into .env (the wrapper sources it before exec).
+        // Symmetric with the Linux unit, which is rebuilt wholesale each run: a
+        // non-empty brand outlookClientId upserts BOTH vars together; empty / absent
+        // STRIPS both lines. Stripping matters because .env persists across installs —
+        // without it, a brand whose outlookClientId is later blanked (vendor-app
+        // rotation/revocation) would keep sourcing a stale, now-invalid client ID and
+        // keep reporting clientIdConfigured=true against its current empty intent.
+        if (BRAND.outlookClientId) {
+            for (const [key, value] of [
+                ["OUTLOOK_CLIENT_ID", BRAND.outlookClientId],
+                ["OUTLOOK_TENANT_ID", "common"],
+            ]) {
+                const re = new RegExp(`^${key}=.*$`, "m");
+                if (re.test(envContent))
+                    envContent = envContent.replace(re, `${key}=${value}`);
+                else
+                    envContent = envContent.trimEnd() + (envContent.length > 0 ? "\n" : "") + `${key}=${value}\n`;
+            }
+        }
+        else {
+            for (const key of ["OUTLOOK_CLIENT_ID", "OUTLOOK_TENANT_ID"]) {
+                envContent = envContent.replace(new RegExp(`^${key}=.*\\n?`, "m"), "");
+            }
+        }
+        logFile(`  [installer] op=outlook-client-id brand=${BRAND.hostname} stamped=${BRAND.outlookClientId ? "true" : "false"}`);
         writeFileSync(envPath, envContent);
         logFile(`  .env: DISPLAY_MODE=${DISPLAY_MODE}, EMBED_MODEL=${EMBED_MODEL}, EMBED_DIMENSIONS=${EMBED_DIMS}, NEO4J_URI=bolt://localhost:${NEO4J_PORT}, PORT=${PORT}, MAXY_UI_INTERNAL_PORT=${PORT} (darwin-collapsed), CLAUDE_SESSION_MANAGER_PORT=${BRAND.claudeSessionManagerPort}, HOSTNAME=0.0.0.0, ACCOUNT_ID=${installAccountId.slice(0, 8)}…, CLAUDE_CONFIG_DIR=${persistDir}/.claude, CLAUDE_BIN=${canonicalClaude ?? "unresolved(PATH)"}, NODE_BIN=${nodeBin}, PATH=${darwinServiceEnvPath}`);
     }
@@ -4161,9 +4187,14 @@ function installService() {
         maxyUiInternalPort: MAXY_UI_INTERNAL_PORT,
         accountId: installAccountId,
         cdpPort: CDP_PORT_BRAND,
+        outlookClientId: BRAND.outlookClientId,
     });
     writeFileSync(join(serviceDir, claudeSessionManagerUnitName), claudeSessionManagerUnit);
     logFile(`  ${claudeSessionManagerUnitName}: CLAUDE_SESSION_MANAGER_PORT=${CLAUDE_SESSION_MANAGER_PORT_BRAND} MAXY_UI_INTERNAL_PORT=${MAXY_UI_INTERNAL_PORT}`);
+    // Task 1473 — standing install-time signal reconciling brand.json intent
+    // (a non-empty outlookClientId) against what the unit shipped. `stamped=false`
+    // while the brand has a value is the mis-stamp signature.
+    logFile(`  [installer] op=outlook-client-id brand=${BRAND.hostname} stamped=${BRAND.outlookClientId ? "true" : "false"}`);
     // Task 250 — write the brand-agnostic `claude-ptys.slice` unit. Every
     // brand's session manager drops its per-spawn scope units under this
     // slice. Writing it once per install is idempotent (the content is

package/dist/known-brands.js

@@ -18,6 +18,7 @@ export const KNOWN_BRAND_HOSTNAMES = [
     "realagent",
     "realagent-code",
     "sitedesk-code",
+    "property-administrators",
     "maxy-2",
     "maxy-3",
     "maxy-4",

package/dist/port-resolution.js

@@ -128,6 +128,13 @@ export function buildClaudeSessionManagerUnitFile(o) {
     if (!o.accountId) {
         throw new Error("buildClaudeSessionManagerUnitFile: accountId is required — caller must resolve the on-disk account UUID before stamping the systemd unit.");
     }
+    // Task 1473 — a non-empty brand outlookClientId adds the vendor Outlook app
+    // env. Both lines land together so OUTLOOK_TENANT_ID (multi-tenant /common)
+    // never trails a bare client ID. Empty / absent brands stamp neither line —
+    // the plugin stays inert, no regression.
+    const outlookEnv = o.outlookClientId
+        ? `\nEnvironment=OUTLOOK_CLIENT_ID=${o.outlookClientId}\nEnvironment=OUTLOOK_TENANT_ID=common`
+        : "";
     return `[Unit]
 Description=${o.productName} Claude Session Manager
 After=network.target
@@ -149,7 +156,7 @@ Environment=PLATFORM_ROOT=${o.installDir}/platform
 Environment=MAXY_BRAND_PORT=${o.brandPort}
 Environment=MAXY_UI_INTERNAL_PORT=${o.maxyUiInternalPort}
 Environment=PLATFORM_PORT=${o.maxyUiInternalPort}
-Environment=CDP_PORT=${o.cdpPort}
+Environment=CDP_PORT=${o.cdpPort}${outlookEnv}
 EnvironmentFile=-${o.persistDir}/.env
 StandardOutput=append:${o.persistDir}/logs/server.log
 StandardError=append:${o.persistDir}/logs/server.log

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.416",
+  "version": "0.1.419",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/config/brand-registry.json

@@ -8,6 +8,14 @@
       "websockifyPort": 6080,
       "cdpPort": 9222
     },
+    {
+      "hostname": "property-administrators",
+      "configDir": ".property-administrators",
+      "vncDisplay": 102,
+      "rfbPort": 5903,
+      "websockifyPort": 6083,
+      "cdpPort": 9225
+    },
     {
       "hostname": "realagent-code",
       "configDir": ".realagent-code",

package/payload/platform/config/brand.json

@@ -14,6 +14,7 @@
   "websockifyPort": 6080,
   "cdpPort": 9222,
   "claudeSessionManagerPort": 19400,
+  "outlookClientId": "",
   "commercialMode": false,
   "vertical": "schema-knowledge-work",
   "shipsPremiumBundles": ["venture-studio", "writer-craft", "teaching", "management-consulting"],

package/payload/platform/lib/account-enumeration/dist/__tests__/is-provisioned.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=is-provisioned.test.d.ts.map

package/payload/platform/lib/account-enumeration/dist/__tests__/is-provisioned.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-provisioned.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/is-provisioned.test.ts"],"names":[],"mappings":""}

package/payload/platform/lib/account-enumeration/dist/__tests__/is-provisioned.test.js

@@ -0,0 +1,81 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = __importDefault(require("node:test"));
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const index_js_1 = require("../index.js");
+const BOOT_ID = "12345678-9abc-def0-1234-56789abcdef0";
+const LATER_ID = "99999999-aaaa-bbbb-cccc-dddddddddddd";
+/** One valid account dir (BOOT_ID) that existed at "boot". */
+function makeFixture() {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), "acct-prov-"));
+    (0, node_fs_1.mkdirSync)((0, node_path_1.join)(root, BOOT_ID));
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(root, BOOT_ID, "account.json"), JSON.stringify({ id: BOOT_ID }));
+    return root;
+}
+/** Provision a second account dir on disk AFTER boot (simulates account_create). */
+function provisionLater(root) {
+    (0, node_fs_1.mkdirSync)((0, node_path_1.join)(root, LATER_ID));
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(root, LATER_ID, "account.json"), JSON.stringify({ id: LATER_ID }));
+}
+(0, node_test_1.default)("isProvisionedAccount: a created-after-boot id resolves via re-scan on miss", () => {
+    (0, index_js_1._resetEnumerationCache)();
+    const root = makeFixture();
+    try {
+        // Warm the cache at "boot" — only BOOT_ID is present.
+        strict_1.default.deepEqual((0, index_js_1.enumerateValidAccountIds)(root), [BOOT_ID]);
+        // A sub-account is provisioned after the snapshot.
+        provisionLater(root);
+        // Miss against the cached set must re-scan disk and find it — no restart.
+        strict_1.default.equal((0, index_js_1.isProvisionedAccount)(root, LATER_ID), true);
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true });
+    }
+});
+(0, node_test_1.default)("isProvisionedAccount: a truly-absent id still returns false after re-scan", () => {
+    (0, index_js_1._resetEnumerationCache)();
+    const root = makeFixture();
+    try {
+        (0, index_js_1.enumerateValidAccountIds)(root); // warm
+        const bogus = "00000000-0000-0000-0000-000000000000";
+        strict_1.default.equal((0, index_js_1.isProvisionedAccount)(root, bogus), false);
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true });
+    }
+});
+(0, node_test_1.default)("isProvisionedAccount: a warmed hit returns true without re-scanning", () => {
+    (0, index_js_1._resetEnumerationCache)();
+    const root = makeFixture();
+    try {
+        (0, index_js_1.enumerateValidAccountIds)(root); // warm = [BOOT_ID]
+        // Provision a second dir AFTER warming.
+        provisionLater(root);
+        // HIT: BOOT_ID is already in the cached set → true, and the cache must NOT
+        // be refreshed (no readdirSync). Proof: the cached set still hides LATER_ID.
+        strict_1.default.equal((0, index_js_1.isProvisionedAccount)(root, BOOT_ID), true);
+        strict_1.default.deepEqual((0, index_js_1.enumerateValidAccountIds)(root), [BOOT_ID], "a hit must not refresh the cache — LATER_ID must stay hidden");
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true });
+    }
+});
+(0, node_test_1.default)("isProvisionedAccount: cold cache scans disk and answers", () => {
+    (0, index_js_1._resetEnumerationCache)();
+    const root = makeFixture();
+    try {
+        // No warm call — cache is cold. A miss (cold) must scan and answer both ways.
+        strict_1.default.equal((0, index_js_1.isProvisionedAccount)(root, BOOT_ID), true);
+        strict_1.default.equal((0, index_js_1.isProvisionedAccount)(root, LATER_ID), false);
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true });
+    }
+});
+//# sourceMappingURL=is-provisioned.test.js.map

package/payload/platform/lib/account-enumeration/dist/__tests__/is-provisioned.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-provisioned.test.js","sourceRoot":"","sources":["../../src/__tests__/is-provisioned.test.ts"],"names":[],"mappings":";;;;;AAAA,0DAA6B;AAC7B,gEAAwC;AACxC,qCAAwE;AACxE,qCAAiC;AACjC,yCAAiC;AACjC,0CAIqB;AAErB,MAAM,OAAO,GAAG,sCAAsC,CAAC;AACvD,MAAM,QAAQ,GAAG,sCAAsC,CAAC;AAExD,8DAA8D;AAC9D,SAAS,WAAW;IAClB,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,YAAY,CAAC,CAAC,CAAC;IACvD,IAAA,mBAAS,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/B,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACpF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oFAAoF;AACpF,SAAS,cAAc,CAAC,IAAY;IAClC,IAAA,mBAAS,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAChC,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,IAAA,mBAAI,EAAC,4EAA4E,EAAE,GAAG,EAAE;IACtF,IAAA,iCAAsB,GAAE,CAAC;IACzB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,sDAAsD;QACtD,gBAAM,CAAC,SAAS,CAAC,IAAA,mCAAwB,EAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5D,mDAAmD;QACnD,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,0EAA0E;QAC1E,gBAAM,CAAC,KAAK,CAAC,IAAA,+BAAoB,EAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3D,CAAC;YAAS,CAAC;QACT,IAAA,gBAAM,EAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,2EAA2E,EAAE,GAAG,EAAE;IACrF,IAAA,iCAAsB,GAAE,CAAC;IACzB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,IAAA,mCAAwB,EAAC,IAAI,CAAC,CAAC,CAAC,OAAO;QACvC,MAAM,KAAK,GAAG,sCAAsC,CAAC;QACrD,gBAAM,CAAC,KAAK,CAAC,IAAA,+BAAoB,EAAC,IAAI,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;YAAS,CAAC;QACT,IAAA,gBAAM,EAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,qEAAqE,EAAE,GAAG,EAAE;IAC/E,IAAA,iCAAsB,GAAE,CAAC;IACzB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,IAAA,mCAAwB,EAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB;QACnD,wCAAwC;QACxC,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,2EAA2E;QAC3E,6EAA6E;QAC7E,gBAAM,CAAC,KAAK,CAAC,IAAA,+BAAoB,EAAC,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;QACxD,gBAAM,CAAC,SAAS,CACd,IAAA,mCAAwB,EAAC,IAAI,CAAC,EAC9B,CAAC,OAAO,CAAC,EACT,8DAA8D,CAC/D,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAA,gBAAM,EAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,yDAAyD,EAAE,GAAG,EAAE;IACnE,IAAA,iCAAsB,GAAE,CAAC;IACzB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,8EAA8E;QAC9E,gBAAM,CAAC,KAAK,CAAC,IAAA,+BAAoB,EAAC,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;QACxD,gBAAM,CAAC,KAAK,CAAC,IAAA,+BAAoB,EAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;YAAS,CAAC;QACT,IAAA,gBAAM,EAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;AACH,CAAC,CAAC,CAAC"}

package/payload/platform/lib/account-enumeration/dist/index.d.ts

@@ -6,6 +6,23 @@
  * be hiding).
  */
 export declare function enumerateValidAccountIds(accountsDir: string): string[];
+/**
+ * Membership test with re-scan-on-miss: is `id` a currently-provisioned account
+ * under `accountsDir`?
+ *
+ * Hit path — `id` is in the cached set — returns true with no I/O (the common
+ * case; the cache still serves it). Miss path — `id` is absent from the cached
+ * set, or the cache is cold — drops the stale entry and re-scans `accountsDir`
+ * once (refreshing the cache) before answering.
+ *
+ * This closes the created-after-boot gap (Task 1471): a sub-account provisioned
+ * by the runtime `account_create` lifecycle tool after a consumer process booted
+ * is invisible to that process's boot-time cached set. Without the re-scan, the
+ * cross-account resolver rejects the id as not-provisioned even though its dir
+ * and `account.json` exist on disk. A single `readdirSync` on the miss finds it;
+ * a genuinely-absent id pays the same one scan and correctly returns false.
+ */
+export declare function isProvisionedAccount(accountsDir: string, id: string): boolean;
 /**
  * Returns the single `role:"house"` account UUID under `accountsDir`.
  *

package/payload/platform/lib/account-enumeration/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA6BA;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAgCtE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAsBjE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAqBvE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAS9C;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,mCAAmC,GAC3C,SAAS,GACT,oBAAoB,GACpB,UAAU,CAAC;AAEf,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,mCAAmC,CAAC;IAC5C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEN,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,EAAE,MAAM,EAAE,GAChB,sBAAsB,CAWxB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAwCA;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAgCtE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAO7E;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAsBjE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAqBvE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAS9C;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,mCAAmC,GAC3C,SAAS,GACT,oBAAoB,GACpB,UAAU,CAAC;AAEf,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,mCAAmC,CAAC;IAC5C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEN,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,EAAE,MAAM,EAAE,GAChB,sBAAsB,CAWxB"}

package/payload/platform/lib/account-enumeration/dist/index.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.enumerateValidAccountIds = enumerateValidAccountIds;
+exports.isProvisionedAccount = isProvisionedAccount;
 exports.resolveHouseAccountId = resolveHouseAccountId;
 exports.resolveHouseOrSoleAccountId = resolveHouseOrSoleAccountId;
 exports.getAccountsDirFromEnv = getAccountsDirFromEnv;
@@ -16,16 +17,27 @@ exports.validateAccountIdEnv = validateAccountIdEnv;
  * (`WHERE n.accountId = $accountId`) silently hides leaks from every UI;
  * an unenforced writer can leak indefinitely with zero downstream symptom.
  *
- * Two consumers:
- *   1. `writeNodeWithEdges` (platform/lib/graph-write/) — central write-time
- *      floor; rejects any write whose `props.accountId` is not in the set
- *      returned here, unless `createdBy.agent === 'system'` (bootstrap).
- *   2. `resolvePlatformAccountId` (platform/ui/app/lib/whatsapp/platform-account-id.ts)
- *      — WhatsApp writer-side helper; loud-throws on zero or multi accounts.
+ * Consumers of the enumerated set:
+ *   - The cross-account resolver's injected validity check (the `memory` and
+ *     `filesystem` MCP plugins) — the check that gates a `targetAccountId`.
+ *     These call `isProvisionedAccount` (re-scan-on-miss), not the cached list
+ *     directly, so a sub-account created at runtime is not masked by the boot
+ *     snapshot (Task 1471).
+ *   - `resolvePlatformAccountId` (platform/ui/app/lib/whatsapp/platform-account-id.ts)
+ *     — WhatsApp writer-side helper; loud-throws on zero or multi accounts.
+ *   - Boot-time env-vs-disk validation (`validateAccountIdEnv`).
  *
- * Per-process cache keyed on `accountsDir` — Phase 0 invariant has accounts
- * created at install time, so adding/removing accounts requires a service
- * restart anyway.
+ * NOTE: `writeNodeWithEdges` (platform/lib/graph-write/) does NOT enumerate.
+ * Its account floor compares `props.accountId` against `process.env.ACCOUNT_ID`
+ * (the spawning process's boot-validated id), deliberately staying out of the
+ * `node:fs` import chain so the ESM payload bundle emits no `__require("fs")`
+ * shim. So the write gate does not share the cache's staleness.
+ *
+ * Per-process cache keyed on `accountsDir`. The install-time invariant (accounts
+ * created only at install) no longer holds: the runtime `account_create`
+ * lifecycle tool provisions sub-accounts during a live session. `enumerate…`
+ * keeps its cached-list semantics for the hit path; `isProvisionedAccount`
+ * re-scans on a miss so a created-after-boot account resolves without restart.
  */
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
@@ -73,6 +85,31 @@ function enumerateValidAccountIds(accountsDir) {
     cache.set(accountsDir, valid);
     return valid;
 }
+/**
+ * Membership test with re-scan-on-miss: is `id` a currently-provisioned account
+ * under `accountsDir`?
+ *
+ * Hit path — `id` is in the cached set — returns true with no I/O (the common
+ * case; the cache still serves it). Miss path — `id` is absent from the cached
+ * set, or the cache is cold — drops the stale entry and re-scans `accountsDir`
+ * once (refreshing the cache) before answering.
+ *
+ * This closes the created-after-boot gap (Task 1471): a sub-account provisioned
+ * by the runtime `account_create` lifecycle tool after a consumer process booted
+ * is invisible to that process's boot-time cached set. Without the re-scan, the
+ * cross-account resolver rejects the id as not-provisioned even though its dir
+ * and `account.json` exist on disk. A single `readdirSync` on the miss finds it;
+ * a genuinely-absent id pays the same one scan and correctly returns false.
+ */
+function isProvisionedAccount(accountsDir, id) {
+    const cached = cache.get(accountsDir);
+    if (cached?.includes(id))
+        return true;
+    // Miss: `id` is not in the cached set (or the cache is cold). Drop the stale
+    // snapshot and re-scan disk once so a real, on-disk account is not masked.
+    cache.delete(accountsDir);
+    return enumerateValidAccountIds(accountsDir).includes(id);
+}
 /**
  * Returns the single `role:"house"` account UUID under `accountsDir`.
  *

package/payload/platform/lib/account-enumeration/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;AAoCA,4DAgCC;AAoBD,sDAsBC;AAeD,kEAqBC;AAUD,sDASC;AAMD,wDAEC;AA8BD,oDAcC;AAzND;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qCAAoD;AACpD,yCAAoC;AAEpC,MAAM,OAAO,GACX,iEAAiE,CAAC;AAEpE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;AAE1C;;;;;;GAMG;AACH,SAAgB,wBAAwB,CAAC,WAAmB;IAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAExC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,qBAAW,EAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAClC,MAAM,UAAU,GAAG,IAAA,mBAAO,EAAC,WAAW,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,IAAI,IAAI,KAAK,QAAQ;gBAAE,SAAS;YAChC,kEAAkE;YAClE,kCAAkC;QACpC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,qBAAqB,CAAC,WAAmB;IACvD,MAAM,KAAK,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,IAAA,mBAAO,EAAC,WAAW,EAAE,EAAE,EAAE,cAAc,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAEvD,CAAC;YACF,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,oDAAoD,MAAM,CAAC,MAAM,UAAU,WAAW,GAAG;YACvF,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,oDAAoD;YACnF,6CAA6C,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,2BAA2B,CAAC,WAAmB;IAC7D,MAAM,KAAK,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,IAAA,mBAAO,EAAC,WAAW,EAAE,EAAE,EAAE,cAAc,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAEvD,CAAC;YACF,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,IAAI,KAAK,CACb,0DAA0D,MAAM,CAAC,MAAM,UAAU,KAAK,CAAC,MAAM,GAAG;QAC9F,SAAS,WAAW,yEAAyE;QAC7F,6CAA6C,CAChD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,kFAAkF,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,mBAAO,EAAC,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB;IACpC,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AA8BD,SAAgB,oBAAoB,CAClC,QAA4B,EAC5B,OAAiB;IAEjB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;AA+CA,4DAgCC;AAkBD,oDAOC;AAoBD,sDAsBC;AAeD,kEAqBC;AAUD,sDASC;AAMD,wDAEC;AA8BD,oDAcC;AA7PD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,qCAAoD;AACpD,yCAAoC;AAEpC,MAAM,OAAO,GACX,iEAAiE,CAAC;AAEpE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;AAE1C;;;;;;GAMG;AACH,SAAgB,wBAAwB,CAAC,WAAmB;IAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAExC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,qBAAW,EAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAClC,MAAM,UAAU,GAAG,IAAA,mBAAO,EAAC,WAAW,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,IAAI,IAAI,KAAK,QAAQ;gBAAE,SAAS;YAChC,kEAAkE;YAClE,kCAAkC;QACpC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,oBAAoB,CAAC,WAAmB,EAAE,EAAU;IAClE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,6EAA6E;IAC7E,2EAA2E;IAC3E,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1B,OAAO,wBAAwB,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,qBAAqB,CAAC,WAAmB;IACvD,MAAM,KAAK,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,IAAA,mBAAO,EAAC,WAAW,EAAE,EAAE,EAAE,cAAc,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAEvD,CAAC;YACF,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,oDAAoD,MAAM,CAAC,MAAM,UAAU,WAAW,GAAG;YACvF,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,oDAAoD;YACnF,6CAA6C,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,2BAA2B,CAAC,WAAmB;IAC7D,MAAM,KAAK,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,IAAA,mBAAO,EAAC,WAAW,EAAE,EAAE,EAAE,cAAc,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAEvD,CAAC;YACF,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,IAAI,KAAK,CACb,0DAA0D,MAAM,CAAC,MAAM,UAAU,KAAK,CAAC,MAAM,GAAG;QAC9F,SAAS,WAAW,yEAAyE;QAC7F,6CAA6C,CAChD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,kFAAkF,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,mBAAO,EAAC,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB;IACpC,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AA8BD,SAAgB,oBAAoB,CAClC,QAA4B,EAC5B,OAAiB;IAEjB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC"}

package/payload/platform/lib/account-enumeration/src/__tests__/is-provisioned.test.ts

@@ -0,0 +1,86 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  enumerateValidAccountIds,
+  isProvisionedAccount,
+  _resetEnumerationCache,
+} from "../index.js";
+
+const BOOT_ID = "12345678-9abc-def0-1234-56789abcdef0";
+const LATER_ID = "99999999-aaaa-bbbb-cccc-dddddddddddd";
+
+/** One valid account dir (BOOT_ID) that existed at "boot". */
+function makeFixture(): string {
+  const root = mkdtempSync(join(tmpdir(), "acct-prov-"));
+  mkdirSync(join(root, BOOT_ID));
+  writeFileSync(join(root, BOOT_ID, "account.json"), JSON.stringify({ id: BOOT_ID }));
+  return root;
+}
+
+/** Provision a second account dir on disk AFTER boot (simulates account_create). */
+function provisionLater(root: string): void {
+  mkdirSync(join(root, LATER_ID));
+  writeFileSync(join(root, LATER_ID, "account.json"), JSON.stringify({ id: LATER_ID }));
+}
+
+test("isProvisionedAccount: a created-after-boot id resolves via re-scan on miss", () => {
+  _resetEnumerationCache();
+  const root = makeFixture();
+  try {
+    // Warm the cache at "boot" — only BOOT_ID is present.
+    assert.deepEqual(enumerateValidAccountIds(root), [BOOT_ID]);
+    // A sub-account is provisioned after the snapshot.
+    provisionLater(root);
+    // Miss against the cached set must re-scan disk and find it — no restart.
+    assert.equal(isProvisionedAccount(root, LATER_ID), true);
+  } finally {
+    rmSync(root, { recursive: true });
+  }
+});
+
+test("isProvisionedAccount: a truly-absent id still returns false after re-scan", () => {
+  _resetEnumerationCache();
+  const root = makeFixture();
+  try {
+    enumerateValidAccountIds(root); // warm
+    const bogus = "00000000-0000-0000-0000-000000000000";
+    assert.equal(isProvisionedAccount(root, bogus), false);
+  } finally {
+    rmSync(root, { recursive: true });
+  }
+});
+
+test("isProvisionedAccount: a warmed hit returns true without re-scanning", () => {
+  _resetEnumerationCache();
+  const root = makeFixture();
+  try {
+    enumerateValidAccountIds(root); // warm = [BOOT_ID]
+    // Provision a second dir AFTER warming.
+    provisionLater(root);
+    // HIT: BOOT_ID is already in the cached set → true, and the cache must NOT
+    // be refreshed (no readdirSync). Proof: the cached set still hides LATER_ID.
+    assert.equal(isProvisionedAccount(root, BOOT_ID), true);
+    assert.deepEqual(
+      enumerateValidAccountIds(root),
+      [BOOT_ID],
+      "a hit must not refresh the cache — LATER_ID must stay hidden",
+    );
+  } finally {
+    rmSync(root, { recursive: true });
+  }
+});
+
+test("isProvisionedAccount: cold cache scans disk and answers", () => {
+  _resetEnumerationCache();
+  const root = makeFixture();
+  try {
+    // No warm call — cache is cold. A miss (cold) must scan and answer both ways.
+    assert.equal(isProvisionedAccount(root, BOOT_ID), true);
+    assert.equal(isProvisionedAccount(root, LATER_ID), false);
+  } finally {
+    rmSync(root, { recursive: true });
+  }
+});

package/payload/platform/lib/account-enumeration/src/index.ts

@@ -8,16 +8,27 @@
  * (`WHERE n.accountId = $accountId`) silently hides leaks from every UI;
  * an unenforced writer can leak indefinitely with zero downstream symptom.
  *
- * Two consumers:
- *   1. `writeNodeWithEdges` (platform/lib/graph-write/) — central write-time
- *      floor; rejects any write whose `props.accountId` is not in the set
- *      returned here, unless `createdBy.agent === 'system'` (bootstrap).
- *   2. `resolvePlatformAccountId` (platform/ui/app/lib/whatsapp/platform-account-id.ts)
- *      — WhatsApp writer-side helper; loud-throws on zero or multi accounts.
+ * Consumers of the enumerated set:
+ *   - The cross-account resolver's injected validity check (the `memory` and
+ *     `filesystem` MCP plugins) — the check that gates a `targetAccountId`.
+ *     These call `isProvisionedAccount` (re-scan-on-miss), not the cached list
+ *     directly, so a sub-account created at runtime is not masked by the boot
+ *     snapshot (Task 1471).
+ *   - `resolvePlatformAccountId` (platform/ui/app/lib/whatsapp/platform-account-id.ts)
+ *     — WhatsApp writer-side helper; loud-throws on zero or multi accounts.
+ *   - Boot-time env-vs-disk validation (`validateAccountIdEnv`).
  *
- * Per-process cache keyed on `accountsDir` — Phase 0 invariant has accounts
- * created at install time, so adding/removing accounts requires a service
- * restart anyway.
+ * NOTE: `writeNodeWithEdges` (platform/lib/graph-write/) does NOT enumerate.
+ * Its account floor compares `props.accountId` against `process.env.ACCOUNT_ID`
+ * (the spawning process's boot-validated id), deliberately staying out of the
+ * `node:fs` import chain so the ESM payload bundle emits no `__require("fs")`
+ * shim. So the write gate does not share the cache's staleness.
+ *
+ * Per-process cache keyed on `accountsDir`. The install-time invariant (accounts
+ * created only at install) no longer holds: the runtime `account_create`
+ * lifecycle tool provisions sub-accounts during a live session. `enumerate…`
+ * keeps its cached-list semantics for the hit path; `isProvisionedAccount`
+ * re-scans on a miss so a created-after-boot account resolves without restart.
  */
 import { readdirSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
@@ -68,6 +79,31 @@ export function enumerateValidAccountIds(accountsDir: string): string[] {
   return valid;
 }
 
+/**
+ * Membership test with re-scan-on-miss: is `id` a currently-provisioned account
+ * under `accountsDir`?
+ *
+ * Hit path — `id` is in the cached set — returns true with no I/O (the common
+ * case; the cache still serves it). Miss path — `id` is absent from the cached
+ * set, or the cache is cold — drops the stale entry and re-scans `accountsDir`
+ * once (refreshing the cache) before answering.
+ *
+ * This closes the created-after-boot gap (Task 1471): a sub-account provisioned
+ * by the runtime `account_create` lifecycle tool after a consumer process booted
+ * is invisible to that process's boot-time cached set. Without the re-scan, the
+ * cross-account resolver rejects the id as not-provisioned even though its dir
+ * and `account.json` exist on disk. A single `readdirSync` on the miss finds it;
+ * a genuinely-absent id pays the same one scan and correctly returns false.
+ */
+export function isProvisionedAccount(accountsDir: string, id: string): boolean {
+  const cached = cache.get(accountsDir);
+  if (cached?.includes(id)) return true;
+  // Miss: `id` is not in the cached set (or the cache is cold). Drop the stale
+  // snapshot and re-scan disk once so a real, on-disk account is not masked.
+  cache.delete(accountsDir);
+  return enumerateValidAccountIds(accountsDir).includes(id);
+}
+
 /**
  * Returns the single `role:"house"` account UUID under `accountsDir`.
  *