@vincentt-xr/cli 0.20.0 → 0.22.0

package/dist/dx/command.js

@@ -1,9 +1,11 @@
 import { findClusters, rankClusters } from "./clusters.js";
-import { enablementLine } from "./enablement.js";
+import { dxConsentJson, enablementLine, resolveConsentView } from "./enablement.js";
 import { journalEnabled, journalPath, readJournal } from "./journal.js";
 import { buildReport, renderPayload } from "./send.js";
 import { resolveBuiltWith } from "../platform/resolve.js";
 import { EXIT } from "../lib/exitCodes.js";
+import { isAuthRefused } from "../shared/authError.js";
+import { UpgradeRequiredError } from "../shared/upgradeError.js";
 const MINUTE_MS = 60 * 1000;
 const HOUR_MS = 60 * MINUTE_MS;
 const DAY_MS = 24 * HOUR_MS;
@@ -120,19 +122,27 @@ export function dxCommand(deps, options) {
         return 0;
     }
     const clusters = rankClusters(findClusters(entries));
-    const enablement = deps.enablement?.() ?? { enabled: false };
+    const local = deps.enablement?.() ?? { enabled: false };
+    const view = deps.consentView?.() ?? {
+        shown: local,
+        local,
+        checked: "machine",
+        signedIn: false,
+    };
     if (options.json) {
         // The JSON object carries enablement as FIELDS because --json is the path an
         // AGENT reads, and an agent that can send unattended should be able to see
-        // that it can.
+        // that it can. `dxSendEnabled*` stay this machine's flag; `dxConsent` is the
+        // account-first answer and says where it was checked.
         deps.print(JSON.stringify({
             window: options.window.label,
             runs: entries.length,
             clusters,
-            dxSendEnabled: enablement.enabled,
-            ...(enablement.enabled && enablement.at !== undefined
-                ? { dxSendEnabledAt: enablement.at }
+            dxSendEnabled: view.local.enabled,
+            ...(view.local.enabled && view.local.at !== undefined
+                ? { dxSendEnabledAt: view.local.at }
                 : {}),
+            dxConsent: dxConsentJson(view),
         }, null, 2));
         return 0;
     }
@@ -162,13 +172,13 @@ export function dxCommand(deps, options) {
     // Beside it, and ONLY when enabled. Enablement is durable and has no expiry, so
     // this line is the mitigation rather than a status decoration; printing an
     // `off` counterpart on every run is how it would get skimmed past.
-    const line = enablementLine(enablement, deps.now());
+    const line = enablementLine(view.shown, deps.now());
     if (line !== undefined)
         deps.print(line);
     return 0;
 }
 /** Wire the command to the real journal. */
-export function runDx(args, print, enablement = () => ({ enabled: false })) {
+export function runDx(args, print, enablement = () => ({ enabled: false }), consentView) {
     return dxCommand({
         entries: (window) => readJournal(window),
         print,
@@ -176,6 +186,7 @@ export function runDx(args, print, enablement = () => ({ enabled: false })) {
         enabled: () => journalEnabled(),
         path: journalPath,
         enablement,
+        consentView,
     }, parseDxOptions(args));
 }
 /** A date a human can read, for the sunset refusal. */
@@ -186,11 +197,13 @@ function sunsetDate(sunset) {
  * `vincentt dx enable` — grant durable permission to send DX reports without asking
  * first.
  *
- * TWO PATHS, and which one runs is decided by whether there is a terminal to ask in:
+ * TWO PATHS to ONE account grant, and which one runs is decided by whether there is a
+ * terminal to ask in:
  *
- *   - At a TTY: the original terminal prompt, unchanged. A person is already here and
- *     can read the disclosure where they stand; sending them to a browser would be
- *     ceremony.
+ *   - At a TTY: the terminal prompt. A person is already here and can read the
+ *     disclosure where they stand; sending them to a browser would be ceremony. On `y`
+ *     the CLI POSTs /me/dx-consent with the PAT, and writes the local flag only after
+ *     the account recorded the grant.
  *   - With no TTY: the BROWSER path. This is the case the feature exists for — a
  *     creator driving the CLI through a coding agent has no terminal, so the old code
  *     refused and the flow dead-ended. It now opens the console, where a human can
@@ -222,44 +235,87 @@ export async function dxEnableCommand(deps, sunset) {
     // signed out cannot complete either path, and reading a consent disclosure before
     // being told so is wasted attention.
     const auth = await deps.auth?.();
-    if (auth === undefined) {
-        deps.print("");
-        deps.print("  Allowing unattended reports is recorded on your Vincentt account, and");
-        deps.print("  this machine is not signed in. Nothing was changed.");
-        deps.print("");
-        deps.print("  Run `vincentt login` first.");
-        deps.print("");
-        return EXIT.NOT_AUTHENTICATED;
-    }
+    if (auth === undefined)
+        return signedOutRefusal(deps);
     if (!deps.interactive()) {
         return enableViaBrowser(deps);
     }
     // What is being granted, INCLUDING the note risk. The note is the part a
     // creator does not picture: enablement is what lets an agent compose prose they
     // have not read and put it on the wire.
+    // The wording names the ACCOUNT because the answer reaches every machine on it; a
+    // prompt that said "this machine" would ask for less than it grants.
     deps.print("");
     deps.print("  Unattended DX submission");
     deps.print("");
-    deps.print("  Your agent will be able to send friction reports from this machine without");
-    deps.print("  asking you first. A report includes a note, which is sent exactly as written.");
-    deps.print("  An agent may compose a note you have not read.");
+    deps.print("  Your agent will be able to send friction reports without asking you first,");
+    deps.print("  from any machine signed in to your Vincentt account. A report includes a note,");
+    deps.print("  which is sent exactly as written. An agent may compose a note you have not read.");
     deps.print("");
-    deps.print("  This stays on until you run `vincentt dx disable`.");
+    deps.print("  This stays on until you run `vincentt dx disable` or turn it off in the console.");
     deps.print("");
-    if (!(await deps.confirm("Enable on this machine?"))) {
+    if (!(await deps.confirm("Allow unattended reports on your account?"))) {
         deps.print("");
         deps.print("  Not enabled.");
         deps.print("");
         return 0;
     }
-    // Written on every enable, so the age reports from the LATEST grant rather than
-    // the first — a re-enable is a fresh decision and dates from when it was made.
-    await deps.save({ at: new Date(deps.now()).toISOString() });
+    return grantAtTerminal(deps, auth);
+}
+/**
+ * The terminal grant: the account first, then this machine's copy.
+ *
+ * ORDER IS THE PROPERTY. A local flag written before the account recorded the grant is a
+ * machine-only grant, which is exactly what this path no longer makes; so every failure
+ * arm returns before `save` and leaves config.json untouched. A 426 or 401 propagates,
+ * so the caller renders the shared version or sign-in refusal.
+ *
+ * The local date is the ACCOUNT's, so a re-grant re-dates both and the age always
+ * reports from the latest grant.
+ */
+async function grantAtTerminal(deps, auth) {
+    let result;
+    try {
+        result =
+            deps.grantAccountConsent === undefined
+                ? { kind: "unreachable" }
+                : await deps.grantAccountConsent(auth);
+    }
+    catch (err) {
+        if (err instanceof UpgradeRequiredError)
+            throw err;
+        if (isAuthRefused(err))
+            return signedOutRefusal(deps);
+        result = { kind: "unreachable" };
+    }
+    if (result.kind !== "granted" || result.enablement.at === undefined) {
+        deps.print("");
+        deps.print(`  ✗ ${GRANT_FAILURE[result.kind === "granted" ? "not_granted" : result.kind]}`);
+        deps.print("  Nothing was changed.");
+        deps.print("");
+        return 1;
+    }
+    await deps.save({ at: result.enablement.at });
     deps.print("");
-    deps.print("  Enabled. Reports may now be sent without a prompt.");
+    deps.print("  Enabled for your account. Reports may now be sent without a prompt from any");
+    deps.print("  machine signed in to it.");
     deps.print("");
     return 0;
 }
+const GRANT_FAILURE = {
+    not_granted: "Vincentt did not record your consent.",
+    rate_limited: "Too many consent changes. Wait a minute and try again.",
+    unreachable: "Could not reach Vincentt to record your consent.",
+};
+function signedOutRefusal(deps) {
+    deps.print("");
+    deps.print("  Allowing unattended reports is recorded on your Vincentt account, and");
+    deps.print("  this machine is not signed in. Nothing was changed.");
+    deps.print("");
+    deps.print("  Run `vincentt login` first.");
+    deps.print("");
+    return EXIT.NOT_AUTHENTICATED;
+}
 /**
  * The no-TTY arm: hand the decision to a human in a browser.
  *
@@ -324,8 +380,8 @@ async function enableViaBrowser(deps) {
  * Clears BOTH local keys AND revokes the account grant when there is a PAT to do it
  * with. Both halves are needed: a creator who runs `disable` means "stop sending", and
  * clearing only the local flag would leave the account grant standing, so the very next
- * `--send` would be authorized by arm (c) and the command would appear not to have
- * worked.
+ * `--send` would be authorized by the account and the command would appear not to
+ * have worked.
  *
  * ORDER IS DELIBERATE: local first, network second. The local clear is the one that
  * cannot fail and the one that stops THIS machine, which is the machine the creator is
@@ -370,6 +426,41 @@ export async function dxDisableCommand(deps) {
     deps.print("");
     return 0;
 }
+/**
+ * The one consent gate both send paths call (f7 Scenario 3), checked in order:
+ *
+ *   1. an interactive session → ask, then send. No /me read at all, so a creator at their
+ *      own terminal is never blocked by an API being slow or down.
+ *   2. signed in and GET /me answers: a strict grant sends (source: account); any other
+ *      200 clears this machine's flag and refuses.
+ *   3. /me cannot be read and this machine's flag is valid → send (source: machine).
+ *
+ * An unreadable /me never authorizes by itself; it only lets an existing local flag stand.
+ */
+export async function gateSend(deps, auth) {
+    if (deps.interactive())
+        return { arm: "interactive" };
+    const view = await resolveConsentView({
+        auth,
+        readAccount: deps.accountConsent,
+        local: () => deps.enablement?.() ?? { enabled: false },
+        clearLocal: () => deps.clearEnablement?.() ?? Promise.resolve(),
+    });
+    return view.shown.enabled
+        ? { arm: "unattended", enablement: view.shown }
+        : { arm: "refused" };
+}
+/**
+ * The gate's refusal. It NAMES the enabling command: a refusal is an answer to a
+ * command the caller typed, which makes it SOLICITED output — the prohibition is on
+ * UNBIDDEN output instructing a caller. A refusal naming nothing leaves a human at
+ * exit 1 with no path forward, for no security gain.
+ */
+export const SEND_REFUSAL_LINES = [
+    "Sending a report needs consent that has not been given on this account.",
+    "`vincentt dx enable` opens the Vincentt console so you can allow it.",
+    "It takes one click, and it works from here.",
+];
 /**
  * `vincentt dx --send`.
  *
@@ -377,7 +468,7 @@ export async function dxDisableCommand(deps) {
  * who cannot see what leaves their machine before it leaves has not agreed to
  * anything:
  *
- *     friction → GATE (three arms) → auth → RESOLVE → build → SHOW → ask → post
+ *     friction → auth → GATE → RESOLVE → build → SHOW → ask → post
  */
 export async function dxSendCommand(deps, options) {
     if (!deps.enabled()) {
@@ -410,59 +501,20 @@ export async function dxSendCommand(deps, options) {
     // the check sits on the act being authorized rather than on a flag that only
     // modifies how it is confirmed.
     //
-    // The second arm is the SUPPORTED unattended path: a person, at a terminal,
-    // ran `vincentt dx enable` on this machine. That is a prior deliberate act
-    // rather than a per-send answer, which is what makes it consent at all.
+    // The unattended path is a prior deliberate act — a person granted it on the
+    // account, at a terminal or in the console — rather than a per-send answer, which
+    // is what makes it consent at all. See gateSend for the order.
     //
-    // The THIRD arm is the same kind of prior deliberate act, made in the console and
-    // recorded on the ACCOUNT rather than on this machine. It exists because the second
-    // arm cannot be reached at all by the creator this feature is for: driving the CLI
-    // through a coding agent, there is no terminal to run `dx enable` in.
-    const localEnablement = deps.enablement?.() ?? { enabled: false };
-    const interactive = deps.interactive();
-    // Auth is resolved BEFORE the gate now, because arm (c) needs a credential to read
-    // /me. The signed-out refusal still comes AFTER the gate, so a caller with neither a
+    // Auth is resolved BEFORE the gate, because the account read needs a credential.
+    // The signed-out refusal still comes AFTER the gate, so a caller with neither a
     // terminal nor consent gets the refusal about consent — the thing they need to fix —
     // rather than being sent to `login` first and only then told that logging in was not
     // sufficient.
     const auth = await deps.auth();
-    // Arm (c) is consulted ONLY when the first two have not already allowed the send.
-    // Skipping it otherwise is not just an optimization: it keeps `--send` from making a
-    // network call it does not need, so a creator at their own terminal is never blocked
-    // by an API being slow or down.
-    let accountEnablement = { enabled: false };
-    if (!interactive && !localEnablement.enabled && auth !== undefined) {
-        try {
-            accountEnablement = (await deps.accountConsent?.(auth)) ?? { enabled: false };
-        }
-        catch {
-            // A NETWORK FAILURE FALLS BACK TO THE OTHER TWO ARMS, and since we only get here
-            // when both have already said no, that means refusing. This is the fail-CLOSED
-            // direction: an unreachable API can never authorize a send.
-            //
-            // The swallow is deliberate and is the whole point of the arm's placement — a
-            // /me that is down must never BLOCK a send that (a) or (b) already allows, and it
-            // cannot, because those paths never reach this call at all.
-            accountEnablement = { enabled: false };
-        }
-    }
-    // The grant that authorizes this send, and the one whose age gets reported. The local
-    // flag wins when both exist: it is the more specific statement (this machine) and it
-    // is the one `dx disable` can always clear.
-    const enablement = localEnablement.enabled
-        ? localEnablement
-        : accountEnablement;
-    if (!interactive && !enablement.enabled) {
-        // This refusal NAMES the enabling command. A refusal is an answer to a
-        // command the caller typed, which makes it SOLICITED output — the
-        // prohibition is on UNBIDDEN output instructing a caller (the nudge names
-        // neither `enable` nor `--send`, and still must not). A refusal naming
-        // nothing satisfies the letter of that rule and leaves a human at exit 1
-        // with no path forward, for no security gain: guessability was never the
-        // threat.
-        deps.print("Sending a report needs consent that has not been given on this account.");
-        deps.print("`vincentt dx enable` opens the Vincentt console so you can allow it.");
-        deps.print("It takes one click, and it works from here.");
+    const gate = await gateSend(deps, auth);
+    if (gate.arm === "refused") {
+        for (const l of SEND_REFUSAL_LINES)
+            deps.print(l);
         return 1;
     }
     if (auth === undefined) {
@@ -491,9 +543,9 @@ export async function dxSendCommand(deps, options) {
     const report = buildReport(clusters, deps.cliVersion(), options.note, builtWith);
     // Above the payload, on the unattended path only: name that this is enabled,
     // how old the grant is, WHERE it was granted, and that nothing is going to ask.
-    const unattended = !interactive && enablement.enabled;
-    if (unattended) {
-        const line = enablementLine(enablement, deps.now());
+    const unattended = gate.arm === "unattended";
+    if (gate.arm === "unattended") {
+        const line = enablementLine(gate.enablement, deps.now());
         if (line !== undefined) {
             deps.print("");
             deps.print(`${line}. Not asking.`);
@@ -511,8 +563,8 @@ export async function dxSendCommand(deps, options) {
     for (const l of renderPayload(report))
         deps.print(l);
     deps.print("");
-    // The enabled machine does not ask. --yes still means only "skip the question"
-    // and is inert without one of the two arms above.
+    // The unattended path does not ask. --yes still means only "skip the question"
+    // and is inert without a grant.
     if (!unattended && !options.yes && !(await deps.confirm("Send this report?"))) {
         deps.print("Not sent.");
         return 0;
@@ -526,6 +578,8 @@ export async function dxSendCommand(deps, options) {
         return 0;
     }
     catch (err) {
+        if (err instanceof UpgradeRequiredError)
+            throw err;
         deps.print("");
         deps.print(`✗ ${err instanceof Error ? err.message : String(err)}`);
         return 1;

package/dist/dx/consent.d.ts

@@ -1,16 +1,35 @@
-import { type Enablement } from "./enablement.js";
+import { type AccountRead, type Enablement } from "./enablement.js";
+/** POST /me/dx-consent, sorted into the outcomes `dx enable` answers differently. */
+export type GrantResult = {
+    kind: "granted";
+    enablement: Enablement;
+} | {
+    kind: "not_granted";
+} | {
+    kind: "rate_limited";
+} | {
+    kind: "unreachable";
+};
 /**
  * The account-consent seam.
  *
- * `read` returns the parsed Enablement rather than the raw envelope so the strict
+ * Both reads return parsed results rather than the raw envelope so the strict
  * `=== true` interpretation happens in exactly one place and cannot be re-derived
  * loosely by a second caller.
  */
 export interface ConsentBackend {
-    /** GET /me → the account's dxReportsConsent fields, read strictly. */
-    read(apiUrl: string, pat: string, now: number): Promise<Enablement>;
-    /** POST /me/dx-consent — grant. Idempotent; a re-grant refreshes the timestamp. */
-    grant(apiUrl: string, pat: string, now: number): Promise<Enablement>;
+    /**
+     * GET /me → the account's consent, read strictly. A 426, a 5xx, a network error or a
+     * timeout is `unreadable`: the CLI floor refuses /me while reports stay floor-exempt,
+     * so a below-floor CLI must fall back to its local flag rather than stop. A 401 still
+     * rejects with the shared sign-in error.
+     */
+    read(apiUrl: string, pat: string, now: number, timeoutMs?: number): Promise<AccountRead>;
+    /**
+     * POST /me/dx-consent — grant. A re-grant refreshes the timestamp. Rejects only with
+     * the version refusal (426) or the sign-in error (401); every other outcome is a result.
+     */
+    grant(apiUrl: string, pat: string, now: number): Promise<GrantResult>;
     /** DELETE /me/dx-consent — revoke. Never fails on already-revoked. */
     revoke(apiUrl: string, pat: string): Promise<void>;
 }

package/dist/dx/consent.js

@@ -1,17 +1,11 @@
 /**
- * The ACCOUNT half of unattended-send authorization.
+ * The ACCOUNT grant for unattended sends: the authority, which the local flag caches.
  *
- * `vincentt dx enable` used to require a TTY, which dead-ends the flow this feature is
- * actually for: a creator drives the CLI through a coding agent, the agent has no
- * terminal, and the command refuses. Consent therefore moves to the console, where a
- * human can actually read the disclosure and click — the CLI opens a browser and waits.
- *
- * The grant is PER-ACCOUNT, not per-machine: one decision covers every machine the
- * creator signs in on. That is a wider blast radius than the local flag, which is why
- * the console page carries the full disclosure (including that an agent may compose a
- * note the user has not read) and why the visibility line names the console as the
- * source — a creator who wants it off needs to know that clearing a local flag is not
- * enough.
+ * A person grants it at a terminal (`dx enable` POSTs /me/dx-consent with the PAT) or,
+ * with no terminal, on the console page the CLI opens. Either way the grant is
+ * PER-ACCOUNT: one decision covers every machine the creator signs in on, which is why
+ * both surfaces carry the full disclosure (including that an agent may compose a note
+ * the user has not read) and why the visibility line names where it was granted.
  *
  * Every call is isolated behind ConsentBackend so the command layer is unit-testable
  * with no network.
@@ -21,10 +15,10 @@ import { waitForLoopbackCallback } from "../login/loopback.js";
 import { browserPage } from "../login/pkceLogin.js";
 import { stateMatches } from "../login/pkce.js";
 import { getFreePort } from "../preview/net.js";
-import { authFailureMessage } from "../shared/authError.js";
-import { clientHeaders } from "../shared/clientHeader.js";
-import { apiFetch } from "../shared/http.js";
-import { readAccountConsent } from "./enablement.js";
+import { AuthExpiredError, authFailureMessage, rejectAuthExpired, } from "../shared/authError.js";
+import { apiFetch, apiRequest, withDeadline } from "../shared/http.js";
+import { rejectUpgradeRequired, UpgradeRequiredError } from "../shared/upgradeError.js";
+import { readAccountEnablement, } from "./enablement.js";
 async function safeText(res) {
     try {
         return (await res.text()).slice(0, 300);
@@ -48,32 +42,67 @@ function unwrapMe(raw) {
 }
 /** The real HTTP-backed ConsentBackend, pointed at a Vincentt API base URL. */
 export function httpConsentBackend() {
-    const strip = (u) => u.replace(/\/$/, "");
+    const call = async (apiUrl, pat, path, init) => {
+        const res = await apiRequest({ apiUrl, pat }, path, init, { authenticated: true });
+        await rejectUpgradeRequired(res);
+        return res;
+    };
     return {
-        async read(apiUrl, pat, now) {
-            const res = await apiFetch(`${strip(apiUrl)}/me`, {
-                headers: { ...clientHeaders(), authorization: `Bearer ${pat}` },
-            });
-            if (!res.ok) {
-                throw new Error(authFailureMessage("Could not read your account", res.status, await safeText(res)));
+        async read(apiUrl, pat, now, timeoutMs) {
+            const fetchImpl = timeoutMs === undefined
+                ? apiFetch
+                : withDeadline((input, init) => globalThis.fetch(input, init), timeoutMs);
+            let res;
+            let body;
+            try {
+                res = await apiRequest({ apiUrl, pat }, "/me", {}, { authenticated: true }, fetchImpl);
+                if (res.status === 401)
+                    rejectAuthExpired(res);
+                if (!res.ok)
+                    return { kind: "unreadable" };
+                body = await res.json();
+            }
+            catch (err) {
+                if (err instanceof AuthExpiredError)
+                    throw err;
+                // A 200 whose body does not parse (a captive portal, a proxy page) is not an
+                // account answer, so it must not clear this machine's flag.
+                return { kind: "unreadable" };
             }
-            return readAccountConsent(unwrapMe(await res.json()), now);
+            const enablement = readAccountEnablement(unwrapMe(body), now);
+            return enablement.enabled
+                ? { kind: "granted", enablement }
+                : { kind: "not_granted" };
         },
         async grant(apiUrl, pat, now) {
-            const res = await apiFetch(`${strip(apiUrl)}/me/dx-consent`, {
-                method: "POST",
-                headers: { ...clientHeaders(), authorization: `Bearer ${pat}` },
-            });
-            if (!res.ok) {
-                throw new Error(authFailureMessage("Could not record consent", res.status, await safeText(res)));
+            let res;
+            try {
+                res = await call(apiUrl, pat, "/me/dx-consent", { method: "POST" });
+            }
+            catch (err) {
+                if (err instanceof UpgradeRequiredError)
+                    throw err;
+                return { kind: "unreachable" };
+            }
+            rejectAuthExpired(res);
+            if (res.status === 429)
+                return { kind: "rate_limited" };
+            if (!res.ok)
+                return { kind: "unreachable" };
+            let body;
+            try {
+                body = await res.json();
+            }
+            catch {
+                return { kind: "not_granted" };
             }
-            return readAccountConsent(unwrapMe(await res.json()), now);
+            const enablement = readAccountEnablement(unwrapMe(body), now);
+            return enablement.enabled
+                ? { kind: "granted", enablement }
+                : { kind: "not_granted" };
         },
         async revoke(apiUrl, pat) {
-            const res = await apiFetch(`${strip(apiUrl)}/me/dx-consent`, {
-                method: "DELETE",
-                headers: { ...clientHeaders(), authorization: `Bearer ${pat}` },
-            });
+            const res = await call(apiUrl, pat, "/me/dx-consent", { method: "DELETE" });
             if (!res.ok) {
                 throw new Error(authFailureMessage("Could not revoke consent", res.status, await safeText(res)));
             }

package/dist/dx/enablement.d.ts

@@ -11,21 +11,21 @@
  */
 export declare const DX_UNATTENDED_SUNSET: number;
 /**
- * WHERE the grant was made. Consent can now be given in the console (per-ACCOUNT, so it
- * covers every machine the creator signs in on) or at this terminal (per-MACHINE).
- *
- * The source is carried rather than inferred because the two have different blast radii
- * and different places to revoke. A creator reading `ENABLED` on a machine they never
- * ran `dx enable` on has no way to act on it without being told the grant lives in their
- * account — they would go looking for a local flag that is not there.
+ * WHERE the answer came from. The account is the authority whenever GET /me answers;
+ * `machine` means this machine's cached copy was used because the account could not be
+ * read. The two are reported differently because only one of them was checked just now.
  */
-export type EnablementSource = "console" | "machine";
+export type EnablementSource = "account" | "machine";
+/** Where the person answered the account grant, as the api recorded it. */
+export type EnablementVia = "cli" | "console";
 export interface Enablement {
     enabled: boolean;
     /** The raw ISO8601 grant time. Present only when `enabled` is true. */
     at?: string;
-    /** Where the grant came from. Present only when `enabled` is true. */
+    /** Where the answer came from. Present only when `enabled` is true. */
     source?: EnablementSource;
+    /** Account grants only, and only when the api recorded it. */
+    via?: EnablementVia;
 }
 /**
  * Decide enablement from an already-parsed config object. Pure, and STRICT:
@@ -49,7 +49,57 @@ export declare function readEnablement(cfg: unknown, now: number): Enablement;
  * stops being honored too, or "forgetting the sunset turns the feature off" would only be
  * true of the local half.
  */
-export declare function readAccountConsent(raw: unknown, now: number): Enablement;
+export declare function readAccountEnablement(raw: unknown, now: number): Enablement;
+/** GET /me, as the consent gate and the visibility surfaces need it. */
+export type AccountRead = {
+    kind: "granted";
+    enablement: Enablement;
+} | {
+    kind: "not_granted";
+} | {
+    kind: "unreadable";
+};
+/**
+ * What the consent surfaces show: the answer that decides (`shown`), this machine's copy
+ * (`local`, after any clear), and where the answer was checked.
+ */
+export interface ConsentView {
+    shown: Enablement;
+    local: Enablement;
+    checked: "account" | "machine";
+    signedIn: boolean;
+}
+export interface ConsentViewDeps {
+    auth: {
+        apiUrl: string;
+        pat: string;
+    } | undefined;
+    /** Allowed to throw; a throw reads as unreadable. */
+    readAccount?: (auth: {
+        apiUrl: string;
+        pat: string;
+    }) => Promise<AccountRead>;
+    local: () => Promise<Enablement> | Enablement;
+    /** Clears this machine's copy. Allowed to throw; see below. */
+    clearLocal: () => Promise<unknown>;
+    /** Bounds the account read from outside, so a backend that hangs cannot hang the caller. */
+    timeoutMs?: number;
+}
+/**
+ * The account-first read shared by the send gate, `vincentt dx` and `vincentt version`
+ * (f7 Scenario 3, 3c). The account decides when it answers; a "not granted" answer clears
+ * this machine's copy so a revoke made elsewhere reaches it. Only when the account cannot
+ * be read does the local flag stand on its own.
+ */
+export declare function resolveConsentView(deps: ConsentViewDeps): Promise<ConsentView>;
+/** `dxConsent` in `vincentt dx --json` (f7 Scenario 3c). */
+export interface DxConsentJson {
+    state: "on" | "off" | "unknown";
+    checked: "account" | "machine";
+    at?: string;
+    via?: EnablementVia;
+}
+export declare function dxConsentJson(view: ConsentView): DxConsentJson;
 /**
  * Read enablement from the real machine config.
  *
@@ -66,8 +116,10 @@ export declare function grantedOn(at: string): string;
 /**
  * The one visibility line, in the single pinned shape every human surface uses:
  *
+ *   Unattended send: ENABLED since 2026-04-01 (145 days) · granted from the CLI
  *   Unattended send: ENABLED since 2026-04-01 (145 days) · granted in the console
- *   Unattended send: ENABLED since 2026-04-01 (145 days) · granted on this machine
+ *   Unattended send: ENABLED since 2026-04-01 (145 days) · on your account
+ *   Unattended send: ENABLED since 2026-04-01 (145 days) · this machine (account not checked)
  *
  * Returns undefined when not enabled. Nothing is printed in that case, on
  * purpose: a line that prints unconditionally is a line readers learn to skip,