instar 1.3.537 → 1.3.539

package/dist/core/CredentialAuditEmit.d.ts

@@ -0,0 +1,82 @@
+/**
+ * CredentialAuditEmit — the SINGLE secret-scrub chokepoint for live credential re-pointing
+ * (spec §2.9, build-plan §7).
+ *
+ * Every `logs/credential-swaps.jsonl` audit write, every `/credentials/*` HTTP response body,
+ * and every attention-item this feature constructs routes through ONE `scrub(record)` funnel.
+ * The invariant the spec names — "no field of any persisted, audited, notified, or HTTP-served
+ * surface of this feature may contain token material" — is enforced STRUCTURALLY here, not by
+ * "remember to scrub at each of N callsites".
+ *
+ * ── Why a single chokepoint (spec §2.9, round-3) ──
+ * Node's `JSON.parse` error is position-only and does not echo bytes, so the real leak vector is
+ * developer-authored interpolation: a `${raw}`-bearing log line, a `security`/keychain stderr, a
+ * fetch error string that carries a token FRAGMENT inside a free-text `reason`/`error`/`message`.
+ * A FORBIDDEN_CREDENTIAL_FIELDS field-name scan does not catch a token hiding in free text. So
+ * this funnel deep-walks EVERY string in a record and runs each through `redactToken`-backed
+ * scrubbing before the record reaches any persisted/served/notified surface.
+ *
+ * ── The redaction (reuses CredentialProvider.redactToken — NOT re-authored) ──
+ * `redactToken(t)` → `[TOKEN:abc1****]`. We apply it to any token-shaped run: the `sk-ant-…`
+ * family (access/oauth/refresh tokens), and any long high-entropy base64url-ish run that could
+ * be a bearer/secret. Account ids, slot paths, emails-by-id, and ordinary prose pass through
+ * unchanged — the feature references accounts BY ID only, so a healthy record loses nothing.
+ *
+ * This module performs NO IO and NO credential access. It is a pure, deterministic, machine-local
+ * transform (Phase C: redaction is local-deterministic, no peer dependency).
+ */
+/**
+ * Scrub token material out of a single string. Reuses `redactToken` (the project's one redactor)
+ * on every token-shaped run. Idempotent: a `[TOKEN:…]` marker contains no token-shaped run that
+ * survives a second pass.
+ */
+export declare function scrubString(s: string): string;
+/**
+ * Deep-scrub an arbitrary JSON-able value: walks objects/arrays and scrubs every string leaf.
+ * Object KEYS are passed through unchanged (a key is a field name, never token material — and the
+ * §2.9 field-name scan covers forbidden keys separately). Non-string/number/bool/null leaves
+ * (functions, symbols) are dropped to a string form so nothing un-serializable rides along.
+ *
+ * THE chokepoint: `CredentialAuditEmit.scrub(record)` calls this. Every audit write, every
+ * `/credentials/*` response body, and every attention-item field passes through here.
+ */
+export declare function scrub<T>(record: T): T;
+/**
+ * The audit-emit handle the host wires into the swap executor + the routes. ONE instance per
+ * process; every emit path (jsonl, response, attention) calls the corresponding method, and each
+ * method scrubs BEFORE the value reaches its surface. Constructing the handle with an injected
+ * `writeLine` (the jsonl sink) and `emitAttention` keeps it IO-free + unit-testable.
+ */
+export interface CredentialAuditEmitDeps {
+    /** Append one already-stringified JSON line to `logs/credential-swaps.jsonl`. */
+    writeLine?: (line: string) => void;
+    /** Deliver one attention item (typically telegram.createAttentionItem). */
+    emitAttention?: (item: CredentialAttentionItem) => void | Promise<void>;
+    now?: () => string;
+}
+export interface CredentialAttentionItem {
+    id: string;
+    title: string;
+    summary: string;
+    description?: string;
+    category: string;
+    priority: 'URGENT' | 'HIGH' | 'NORMAL' | 'LOW';
+    sourceContext?: string;
+}
+export declare class CredentialAuditEmit {
+    private readonly writeLine?;
+    private readonly emitAttentionFn?;
+    private readonly now;
+    constructor(deps?: CredentialAuditEmitDeps);
+    /** Surface 1 — the jsonl audit write. Scrubs the record, stamps it, appends one line. */
+    audit(record: Record<string, unknown>): void;
+    /**
+     * Surface 2 — the `/credentials/*` HTTP response body. Returns the SCRUBBED body the route
+     * sends. The route MUST send `emit.response(body)`, never a raw body — this is the wiring the
+     * §2.9 chokepoint test asserts.
+     */
+    response<T>(body: T): T;
+    /** Surface 3 — the attention item. Scrubs every field, then delivers (best-effort). */
+    attention(item: CredentialAttentionItem): Promise<void>;
+}
+//# sourceMappingURL=CredentialAuditEmit.d.ts.map

package/dist/core/CredentialAuditEmit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialAuditEmit.d.ts","sourceRoot":"","sources":["../../src/core/CredentialAuditEmit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAkBH;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAS7C;AAED;;;;;;;;GAQG;AACH,wBAAgB,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAErC;AAgBD;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,iFAAiF;IACjF,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,2EAA2E;IAC3E,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,uBAAuB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAyB;IACpD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAA0D;IAC3F,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,IAAI,GAAE,uBAA4B;IAM9C,yFAAyF;IACzF,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAa5C;;;;OAIG;IACH,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC;IAIvB,uFAAuF;IACjF,SAAS,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;CAW9D"}

package/dist/core/CredentialAuditEmit.js

@@ -0,0 +1,132 @@
+/**
+ * CredentialAuditEmit — the SINGLE secret-scrub chokepoint for live credential re-pointing
+ * (spec §2.9, build-plan §7).
+ *
+ * Every `logs/credential-swaps.jsonl` audit write, every `/credentials/*` HTTP response body,
+ * and every attention-item this feature constructs routes through ONE `scrub(record)` funnel.
+ * The invariant the spec names — "no field of any persisted, audited, notified, or HTTP-served
+ * surface of this feature may contain token material" — is enforced STRUCTURALLY here, not by
+ * "remember to scrub at each of N callsites".
+ *
+ * ── Why a single chokepoint (spec §2.9, round-3) ──
+ * Node's `JSON.parse` error is position-only and does not echo bytes, so the real leak vector is
+ * developer-authored interpolation: a `${raw}`-bearing log line, a `security`/keychain stderr, a
+ * fetch error string that carries a token FRAGMENT inside a free-text `reason`/`error`/`message`.
+ * A FORBIDDEN_CREDENTIAL_FIELDS field-name scan does not catch a token hiding in free text. So
+ * this funnel deep-walks EVERY string in a record and runs each through `redactToken`-backed
+ * scrubbing before the record reaches any persisted/served/notified surface.
+ *
+ * ── The redaction (reuses CredentialProvider.redactToken — NOT re-authored) ──
+ * `redactToken(t)` → `[TOKEN:abc1****]`. We apply it to any token-shaped run: the `sk-ant-…`
+ * family (access/oauth/refresh tokens), and any long high-entropy base64url-ish run that could
+ * be a bearer/secret. Account ids, slot paths, emails-by-id, and ordinary prose pass through
+ * unchanged — the feature references accounts BY ID only, so a healthy record loses nothing.
+ *
+ * This module performs NO IO and NO credential access. It is a pure, deterministic, machine-local
+ * transform (Phase C: redaction is local-deterministic, no peer dependency).
+ */
+import { redactToken } from '../monitoring/CredentialProvider.js';
+/**
+ * The `sk-ant-…` token family Anthropic issues (oauth access `sk-ant-oat…`, api-key `sk-ant-api…`,
+ * refresh `sk-ant-ort…`, etc.). Matched first so the canonical leak vector is always redacted.
+ */
+const SK_ANT_RE = /sk-ant-[A-Za-z0-9_-]{8,}/g;
+/**
+ * A long high-entropy token-shaped run (≥32 chars of base64url/hex alphabet) that is NOT a
+ * recognizable non-secret. This catches a bearer/secret that does NOT carry the `sk-ant-` prefix
+ * (a keychain stderr could echo a raw blob). Deliberately conservative on the low end so ordinary
+ * ids / slot hashes / ISO timestamps are never mangled (an 8-hex slot suffix is far under 32).
+ */
+const LONG_TOKEN_RE = /\b[A-Za-z0-9_-]{32,}\b/g;
+/**
+ * Scrub token material out of a single string. Reuses `redactToken` (the project's one redactor)
+ * on every token-shaped run. Idempotent: a `[TOKEN:…]` marker contains no token-shaped run that
+ * survives a second pass.
+ */
+export function scrubString(s) {
+    if (!s)
+        return s;
+    let out = s.replace(SK_ANT_RE, (m) => redactToken(m));
+    out = out.replace(LONG_TOKEN_RE, (m) => {
+        // Never re-redact an already-emitted marker, and never touch the redactor's own output.
+        if (m.startsWith('TOKEN'))
+            return m;
+        return redactToken(m);
+    });
+    return out;
+}
+/**
+ * Deep-scrub an arbitrary JSON-able value: walks objects/arrays and scrubs every string leaf.
+ * Object KEYS are passed through unchanged (a key is a field name, never token material — and the
+ * §2.9 field-name scan covers forbidden keys separately). Non-string/number/bool/null leaves
+ * (functions, symbols) are dropped to a string form so nothing un-serializable rides along.
+ *
+ * THE chokepoint: `CredentialAuditEmit.scrub(record)` calls this. Every audit write, every
+ * `/credentials/*` response body, and every attention-item field passes through here.
+ */
+export function scrub(record) {
+    return deepScrub(record);
+}
+function deepScrub(v) {
+    if (typeof v === 'string')
+        return scrubString(v);
+    if (Array.isArray(v))
+        return v.map((x) => deepScrub(x));
+    if (v && typeof v === 'object') {
+        const out = {};
+        for (const [k, val] of Object.entries(v)) {
+            out[k] = deepScrub(val);
+        }
+        return out;
+    }
+    // number | boolean | null | undefined | bigint pass through unchanged (no token material).
+    return v;
+}
+export class CredentialAuditEmit {
+    writeLine;
+    emitAttentionFn;
+    now;
+    constructor(deps = {}) {
+        this.writeLine = deps.writeLine;
+        this.emitAttentionFn = deps.emitAttention;
+        this.now = deps.now ?? (() => new Date().toISOString());
+    }
+    /** Surface 1 — the jsonl audit write. Scrubs the record, stamps it, appends one line. */
+    audit(record) {
+        if (!this.writeLine)
+            return;
+        const scrubbed = scrub({ at: this.now(), ...record });
+        try {
+            this.writeLine(JSON.stringify(scrubbed) + '\n');
+        }
+        catch {
+            // @silent-fallback-ok — the audit jsonl is observability; a write failure (full disk, fs
+            // hiccup) must never throw into a swap/route. The actual credential operation is the
+            // load-bearing action and is unaffected; the next emit retries. (No token can leak here —
+            // the value was already scrubbed before the failing write.)
+        }
+    }
+    /**
+     * Surface 2 — the `/credentials/*` HTTP response body. Returns the SCRUBBED body the route
+     * sends. The route MUST send `emit.response(body)`, never a raw body — this is the wiring the
+     * §2.9 chokepoint test asserts.
+     */
+    response(body) {
+        return scrub(body);
+    }
+    /** Surface 3 — the attention item. Scrubs every field, then delivers (best-effort). */
+    async attention(item) {
+        if (!this.emitAttentionFn)
+            return;
+        const scrubbed = scrub(item);
+        try {
+            await this.emitAttentionFn(scrubbed);
+        }
+        catch {
+            // @silent-fallback-ok — attention delivery is best-effort; the swap/quarantine safety action
+            // it announces is already durably recorded in the ledger regardless of whether the notice
+            // lands. The item was already scrubbed before this call, so a delivery failure leaks nothing.
+        }
+    }
+}
+//# sourceMappingURL=CredentialAuditEmit.js.map

package/dist/core/CredentialAuditEmit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialAuditEmit.js","sourceRoot":"","sources":["../../src/core/CredentialAuditEmit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAElE;;;GAGG;AACH,MAAM,SAAS,GAAG,2BAA2B,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,IAAI,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE;QACrC,wFAAwF;QACxF,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,CAAC;QACpC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,KAAK,CAAI,MAAS;IAChC,OAAO,SAAS,CAAC,MAAM,CAAM,CAAC;AAChC,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAA4B,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,2FAA2F;IAC3F,OAAO,CAAC,CAAC;AACX,CAAC;AA0BD,MAAM,OAAO,mBAAmB;IACb,SAAS,CAA0B;IACnC,eAAe,CAA2D;IAC1E,GAAG,CAAe;IAEnC,YAAY,OAAgC,EAAE;QAC5C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,aAAa,CAAC;QAC1C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,yFAAyF;IACzF,KAAK,CAAC,MAA+B;QACnC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,yFAAyF;YACzF,qFAAqF;YACrF,0FAA0F;YAC1F,4DAA4D;QAC9D,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAI,IAAO;QACjB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,SAAS,CAAC,IAA6B;QAC3C,IAAI,CAAC,IAAI,CAAC,eAAe;YAAE,OAAO;QAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,6FAA6F;YAC7F,0FAA0F;YAC1F,8FAA8F;QAChG,CAAC;IACH,CAAC;CACF"}

package/dist/core/CredentialLocationGate.d.ts

@@ -0,0 +1,99 @@
+/**
+ * CredentialLocationGate — the SINGLE re-routing chokepoint for the §2.2 consumer census
+ * (Step 6 of live credential re-pointing).
+ *
+ * Spec: docs/specs/live-credential-repointing-rebalancer.md §2.2 (the consumer census table).
+ *
+ * ── What this is ──
+ * Every place in the live code that today treats a pool account's enrollment `configHome` as the
+ * LIVE location of its credential (the QuotaPoller token read / 401-refresh / email auto-patch /
+ * needs-reauth attribution; spawn placement + session attribution; the InUseAccountResolver
+ * default badge) is re-routed through ONE gate object instead of reaching into the ledger
+ * directly. Centralizing the gate keeps the load-bearing safety contract in a single auditable
+ * place — every consumer inherits the same flag-gating, back-compat-on-unknown, and
+ * fail-open-loud posture by construction (Structure > Willpower).
+ *
+ * ── The load-bearing safety contract (spec §2.2; build-prompt invariants 1, 5) ──
+ *   1. FLAG-GATED. With `enabled:false` (always, while the feature ships dark) every read returns
+ *      the caller's `enrollmentHome` (or null for tenant reads) — byte-for-byte today's behavior.
+ *   2. BACK-COMPAT ON UNKNOWN. With the flag ON but the ledger holding no record for that
+ *      account/slot (never-seeded), the gate ALSO falls back to today's behavior. The ledger only
+ *      ever ADDS truth, never removes the working path.
+ *   3. SYNC + FAIL-OPEN-LOUD. `ledger.slotOf/tenantOf` are in-memory sync reads that return null in
+ *      UNKNOWN mode (corrupt on-disk state). This gate NEVER throws into a hot path (QuotaPoller /
+ *      spawn): on UNKNOWN mode it returns the enrollment fallback AND raises ONE deduped HIGH
+ *      attention item naming the degradation, then the caller continues on today's behavior.
+ *
+ * The gate performs NO credential writes. It is a pure read-router over the ledger + flag.
+ */
+import type { CredentialLocationLedger } from './CredentialLocationLedger.js';
+/** Attention-item shape (mirrors CredentialLocationLedger.CredentialLedgerAttentionInput). */
+export interface CredentialGateAttentionInput {
+    id: string;
+    title: string;
+    summary: string;
+    description?: string;
+    category: string;
+    priority: 'URGENT' | 'HIGH' | 'NORMAL' | 'LOW';
+    sourceContext?: string;
+}
+export interface CredentialLocationGateDeps {
+    /**
+     * Reads the live `subscriptionPool.credentialRepointing.enabled` flag. Read EACH call (not
+     * cached) so a restartless config flip is honored on the next read — the same restartless
+     * posture the rest of the feature uses.
+     */
+    isEnabled: () => boolean;
+    /** The machine-local ledger (the single source of truth for "which account is in which slot"). */
+    ledger: CredentialLocationLedger;
+    /** Emit a deduped HIGH attention item on UNKNOWN-mode degradation (best-effort). */
+    emitAttention?: (item: CredentialGateAttentionInput) => void | Promise<void>;
+}
+/**
+ * Re-routes the §2.2 census consumers' `configHome`-as-location reads through the ledger.
+ *
+ * Construct ONE per process and hand it to each consumer (QuotaPoller, SessionManager spawn,
+ * InUseAccountResolver). The consumers stay dumb — they ask the gate "where does account X live
+ * now?" and "who tenants slot Y now?" and otherwise behave exactly as today.
+ */
+export declare class CredentialLocationGate {
+    private readonly isEnabledFn;
+    private readonly ledger;
+    private readonly emitAttention?;
+    /** Dedupe the UNKNOWN-mode attention item so a read storm raises it once per process. */
+    private unknownAttentionRaised;
+    constructor(deps: CredentialLocationGateDeps);
+    /** Live flag read — true only when re-pointing is enabled. */
+    isEnabled(): boolean;
+    /**
+     * The config-home SLOT where `accountId`'s credential CURRENTLY lives.
+     *
+     * - flag OFF                       → `enrollmentHome` (today's behavior, byte-identical).
+     * - flag ON + ledger has a record  → the ledger's current slot for the account.
+     * - flag ON + ledger UNKNOWN/empty → `enrollmentHome` (back-compat) AND, if UNKNOWN mode,
+     *   one deduped HIGH attention item (fail-open-LOUD). NEVER throws.
+     *
+     * The returned slot is in the SAME shape the caller passed (a config-home path); it is NOT
+     * canonicalized here so a caller that does its own `expandHome` keeps working unchanged.
+     */
+    slotForAccount(accountId: string, enrollmentHome: string): string;
+    /**
+     * The pool account id CURRENTLY tenanting `slot` per the ledger, or null.
+     *
+     * - flag OFF                       → null (caller keeps its existing attribution path).
+     * - flag ON + ledger has a record  → the ledger's tenant account id.
+     * - flag ON + ledger UNKNOWN/empty → null (back-compat) AND, if UNKNOWN mode, one deduped HIGH
+     *   attention item (fail-open-LOUD). NEVER throws.
+     *
+     * `slot` is matched against the ledger as-passed; pass the same shape the ledger stores (the
+     * consumers use `~/.claude` for the default badge, matching seedFromOracle's slot keys).
+     */
+    tenantForSlot(slot: string): string | null;
+    /**
+     * True iff `slot` (any spelling) canonicalizes to the DEFAULT `~/.claude` home. Used by the
+     * swap-commit cache-bust: only a swap touching the default slot need bust the in-use badge.
+     */
+    static touchesDefaultHome(slot: string): boolean;
+    private raiseUnknownModeAttention;
+}
+//# sourceMappingURL=CredentialLocationGate.d.ts.map

package/dist/core/CredentialLocationGate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialLocationGate.d.ts","sourceRoot":"","sources":["../../src/core/CredentialLocationGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAG9E,8FAA8F;AAC9F,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,SAAS,EAAE,MAAM,OAAO,CAAC;IACzB,kGAAkG;IAClG,MAAM,EAAE,wBAAwB,CAAC;IACjC,oFAAoF;IACpF,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,4BAA4B,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9E;AAED;;;;;;GAMG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgB;IAC5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAClD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAA+D;IAC9F,yFAAyF;IACzF,OAAO,CAAC,sBAAsB,CAAS;gBAE3B,IAAI,EAAE,0BAA0B;IAM5C,8DAA8D;IAC9D,SAAS,IAAI,OAAO;IAIpB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM;IASjE;;;;;;;;;;OAUG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAQ1C;;;OAGG;IACH,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIhD,OAAO,CAAC,yBAAyB;CAuBlC"}

package/dist/core/CredentialLocationGate.js

@@ -0,0 +1,127 @@
+/**
+ * CredentialLocationGate — the SINGLE re-routing chokepoint for the §2.2 consumer census
+ * (Step 6 of live credential re-pointing).
+ *
+ * Spec: docs/specs/live-credential-repointing-rebalancer.md §2.2 (the consumer census table).
+ *
+ * ── What this is ──
+ * Every place in the live code that today treats a pool account's enrollment `configHome` as the
+ * LIVE location of its credential (the QuotaPoller token read / 401-refresh / email auto-patch /
+ * needs-reauth attribution; spawn placement + session attribution; the InUseAccountResolver
+ * default badge) is re-routed through ONE gate object instead of reaching into the ledger
+ * directly. Centralizing the gate keeps the load-bearing safety contract in a single auditable
+ * place — every consumer inherits the same flag-gating, back-compat-on-unknown, and
+ * fail-open-loud posture by construction (Structure > Willpower).
+ *
+ * ── The load-bearing safety contract (spec §2.2; build-prompt invariants 1, 5) ──
+ *   1. FLAG-GATED. With `enabled:false` (always, while the feature ships dark) every read returns
+ *      the caller's `enrollmentHome` (or null for tenant reads) — byte-for-byte today's behavior.
+ *   2. BACK-COMPAT ON UNKNOWN. With the flag ON but the ledger holding no record for that
+ *      account/slot (never-seeded), the gate ALSO falls back to today's behavior. The ledger only
+ *      ever ADDS truth, never removes the working path.
+ *   3. SYNC + FAIL-OPEN-LOUD. `ledger.slotOf/tenantOf` are in-memory sync reads that return null in
+ *      UNKNOWN mode (corrupt on-disk state). This gate NEVER throws into a hot path (QuotaPoller /
+ *      spawn): on UNKNOWN mode it returns the enrollment fallback AND raises ONE deduped HIGH
+ *      attention item naming the degradation, then the caller continues on today's behavior.
+ *
+ * The gate performs NO credential writes. It is a pure read-router over the ledger + flag.
+ */
+import { credentialSlotKey } from './OAuthRefresher.js';
+/**
+ * Re-routes the §2.2 census consumers' `configHome`-as-location reads through the ledger.
+ *
+ * Construct ONE per process and hand it to each consumer (QuotaPoller, SessionManager spawn,
+ * InUseAccountResolver). The consumers stay dumb — they ask the gate "where does account X live
+ * now?" and "who tenants slot Y now?" and otherwise behave exactly as today.
+ */
+export class CredentialLocationGate {
+    isEnabledFn;
+    ledger;
+    emitAttention;
+    /** Dedupe the UNKNOWN-mode attention item so a read storm raises it once per process. */
+    unknownAttentionRaised = false;
+    constructor(deps) {
+        this.isEnabledFn = deps.isEnabled;
+        this.ledger = deps.ledger;
+        this.emitAttention = deps.emitAttention;
+    }
+    /** Live flag read — true only when re-pointing is enabled. */
+    isEnabled() {
+        return this.isEnabledFn();
+    }
+    /**
+     * The config-home SLOT where `accountId`'s credential CURRENTLY lives.
+     *
+     * - flag OFF                       → `enrollmentHome` (today's behavior, byte-identical).
+     * - flag ON + ledger has a record  → the ledger's current slot for the account.
+     * - flag ON + ledger UNKNOWN/empty → `enrollmentHome` (back-compat) AND, if UNKNOWN mode,
+     *   one deduped HIGH attention item (fail-open-LOUD). NEVER throws.
+     *
+     * The returned slot is in the SAME shape the caller passed (a config-home path); it is NOT
+     * canonicalized here so a caller that does its own `expandHome` keeps working unchanged.
+     */
+    slotForAccount(accountId, enrollmentHome) {
+        if (!this.isEnabledFn())
+            return enrollmentHome;
+        // ledger.slotOf is a sync in-memory read; null in UNKNOWN mode or when never-seeded.
+        const slot = this.ledger.slotOf(accountId);
+        if (slot)
+            return slot;
+        if (this.ledger.isUnknownMode())
+            this.raiseUnknownModeAttention();
+        return enrollmentHome;
+    }
+    /**
+     * The pool account id CURRENTLY tenanting `slot` per the ledger, or null.
+     *
+     * - flag OFF                       → null (caller keeps its existing attribution path).
+     * - flag ON + ledger has a record  → the ledger's tenant account id.
+     * - flag ON + ledger UNKNOWN/empty → null (back-compat) AND, if UNKNOWN mode, one deduped HIGH
+     *   attention item (fail-open-LOUD). NEVER throws.
+     *
+     * `slot` is matched against the ledger as-passed; pass the same shape the ledger stores (the
+     * consumers use `~/.claude` for the default badge, matching seedFromOracle's slot keys).
+     */
+    tenantForSlot(slot) {
+        if (!this.isEnabledFn())
+            return null;
+        const tenant = this.ledger.tenantOf(slot);
+        if (tenant)
+            return tenant;
+        if (this.ledger.isUnknownMode())
+            this.raiseUnknownModeAttention();
+        return null;
+    }
+    /**
+     * True iff `slot` (any spelling) canonicalizes to the DEFAULT `~/.claude` home. Used by the
+     * swap-commit cache-bust: only a swap touching the default slot need bust the in-use badge.
+     */
+    static touchesDefaultHome(slot) {
+        return credentialSlotKey(slot) === credentialSlotKey('~/.claude');
+    }
+    raiseUnknownModeAttention() {
+        if (this.unknownAttentionRaised || !this.emitAttention)
+            return;
+        this.unknownAttentionRaised = true;
+        try {
+            void this.emitAttention({
+                id: 'credential-location-gate-unknown-mode',
+                title: 'Credential location ledger UNKNOWN — consumers fell back to enrollment homes',
+                summary: 'A census consumer (quota poll / spawn placement / in-use badge) read the credential ' +
+                    'location ledger while it was in UNKNOWN mode (corrupt on-disk state). The read fell ' +
+                    'back to enrollment-home behavior (no path broke), but credential re-pointing is not ' +
+                    'authoritative until the ledger is re-seeded via the identity oracle.',
+                category: 'credential-repointing',
+                priority: 'HIGH',
+                sourceContext: 'credential-location-gate',
+            });
+        }
+        catch {
+            // @silent-fallback-ok — the attention emitter is best-effort; a delivery failure must never
+            // throw into the QuotaPoller / spawn hot path. The actual safety behavior (the enrollment-
+            // home fallback) is already in force regardless of whether the notice was delivered, so the
+            // path's correctness does not depend on this emit.
+        }
+    }
+}
+//# sourceMappingURL=CredentialLocationGate.js.map

package/dist/core/CredentialLocationGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialLocationGate.js","sourceRoot":"","sources":["../../src/core/CredentialLocationGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AA0BxD;;;;;;GAMG;AACH,MAAM,OAAO,sBAAsB;IAChB,WAAW,CAAgB;IAC3B,MAAM,CAA2B;IACjC,aAAa,CAAgE;IAC9F,yFAAyF;IACjF,sBAAsB,GAAG,KAAK,CAAC;IAEvC,YAAY,IAAgC;QAC1C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;IAC1C,CAAC;IAED,8DAA8D;IAC9D,SAAS;QACP,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;OAUG;IACH,cAAc,CAAC,SAAiB,EAAE,cAAsB;QACtD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,cAAc,CAAC;QAC/C,qFAAqF;QACrF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE;YAAE,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAClE,OAAO,cAAc,CAAC;IACxB,CAAC;IAED;;;;;;;;;;OAUG;IACH,aAAa,CAAC,IAAY;QACxB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,IAAI,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE;YAAE,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,kBAAkB,CAAC,IAAY;QACpC,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACpE,CAAC;IAEO,yBAAyB;QAC/B,IAAI,IAAI,CAAC,sBAAsB,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO;QAC/D,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC;QACnC,IAAI,CAAC;YACH,KAAK,IAAI,CAAC,aAAa,CAAC;gBACtB,EAAE,EAAE,uCAAuC;gBAC3C,KAAK,EAAE,8EAA8E;gBACrF,OAAO,EACL,sFAAsF;oBACtF,sFAAsF;oBACtF,sFAAsF;oBACtF,sEAAsE;gBACxE,QAAQ,EAAE,uBAAuB;gBACjC,QAAQ,EAAE,MAAM;gBAChB,aAAa,EAAE,0BAA0B;aAC1C,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,4FAA4F;YAC5F,2FAA2F;YAC3F,4FAA4F;YAC5F,mDAAmD;QACrD,CAAC;IACH,CAAC;CACF"}

package/dist/core/CredentialManualLevers.d.ts

@@ -0,0 +1,57 @@
+/**
+ * CredentialManualLevers — the detective-control bookkeeping for the manual swap/set-default
+ * levers (spec §2.4 manual levers + §0.g force budget). Machine-local, in-memory, pure.
+ *
+ * The levers stay agent-callable (single-operator autonomy directive), so the control is
+ * DETECTIVE + structural + non-suppressible, not a PIN gate:
+ *   - per-PAIR cooldown      — a manual swap respects the per-pair cooldown by default; `force:true`
+ *                              overrides it, and the override is FLAGGED in the audit + notification.
+ *   - force budget (§0.g)    — the `force:true` bypass carries its OWN bounded budget:
+ *                              `maxForcedManualSwapsPerWindow`. Exhaustion refuses further FORCED
+ *                              manual swaps until the window rolls — `force` is not the one uncapped
+ *                              bypass left in the spec. A non-forced swap is never blocked by it.
+ *
+ * Every guard here makes "no safe action available" a SURFACED refusal (a named reason returned to
+ * the caller), never a silent drop and never an unbounded retry (§0.g(c)).
+ */
+export interface CredentialManualLeversDeps {
+    /** Per-pair cooldown ms (≥1× poll interval). */
+    pairCooldownMs?: number;
+    /** §0.g force budget: max FORCED manual swaps per window. */
+    maxForcedPerWindow?: number;
+    /** §0.g force budget window length ms. */
+    forcedWindowMs?: number;
+    now?: () => number;
+}
+/** A cooldown/budget verdict — allow, or a named refusal (surfaced, never silent). */
+export type LeverVerdict = {
+    allowed: true;
+    forced: boolean;
+} | {
+    allowed: false;
+    reason: string;
+    code: 'pair-cooldown' | 'force-budget-exhausted';
+};
+export declare class CredentialManualLevers {
+    private readonly pairCooldownMs;
+    private readonly maxForcedPerWindow;
+    private readonly forcedWindowMs;
+    private readonly now;
+    /** pairKey → last actuation epoch ms. */
+    private readonly lastActuation;
+    /** Forced-swap timestamps within the rolling window. */
+    private forcedTimestamps;
+    constructor(deps?: CredentialManualLeversDeps);
+    /**
+     * Evaluate whether a manual swap of (slotA, slotB) may proceed. `force` overrides the per-pair
+     * cooldown BUT is itself bounded by the force budget. Read-only — call `recordSwap` after a
+     * swap actually commits so the cooldown/budget advance only on real actuation.
+     */
+    evaluateSwap(slotA: string, slotB: string, force: boolean): LeverVerdict;
+    /** Record an actually-committed swap: advances the pair cooldown and (if forced) the budget. */
+    recordSwap(slotA: string, slotB: string, forced: boolean): void;
+    /** Forced swaps remaining in the current window (for observability). */
+    forcedBudgetRemaining(): number;
+    private pruneForcedWindow;
+}
+//# sourceMappingURL=CredentialManualLevers.d.ts.map

package/dist/core/CredentialManualLevers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialManualLevers.d.ts","sourceRoot":"","sources":["../../src/core/CredentialManualLevers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,MAAM,WAAW,0BAA0B;IACzC,gDAAgD;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6DAA6D;IAC7D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,0CAA0C;IAC1C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,sFAAsF;AACtF,MAAM,MAAM,YAAY,GACpB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAClC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,eAAe,GAAG,wBAAwB,CAAA;CAAE,CAAC;AAOzF,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IAEnC,yCAAyC;IACzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;IAC3D,wDAAwD;IACxD,OAAO,CAAC,gBAAgB,CAAgB;gBAE5B,IAAI,GAAE,0BAA+B;IAOjD;;;;OAIG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,YAAY;IA8BxE,gGAAgG;IAChG,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI;IAS/D,wEAAwE;IACxE,qBAAqB,IAAI,MAAM;IAK/B,OAAO,CAAC,iBAAiB;CAI1B"}

package/dist/core/CredentialManualLevers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialManualLevers.js","sourceRoot":"","sources":["../../src/core/CredentialManualLevers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,6CAA6C;AAC9F,MAAM,6BAA6B,GAAG,EAAE,CAAC,CAAC,iDAAiD;AAC3F,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,oBAAoB;AAiBrE,wDAAwD;AACxD,SAAS,OAAO,CAAC,CAAS,EAAE,CAAS;IACnC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,OAAO,sBAAsB;IAChB,cAAc,CAAS;IACvB,kBAAkB,CAAS;IAC3B,cAAc,CAAS;IACvB,GAAG,CAAe;IAEnC,yCAAyC;IACxB,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3D,wDAAwD;IAChD,gBAAgB,GAAa,EAAE,CAAC;IAExC,YAAY,OAAmC,EAAE;QAC/C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAC;QACtE,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,IAAI,6BAA6B,CAAC;QACnF,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAC;QACtE,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,KAAa,EAAE,KAAa,EAAE,KAAc;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,IAAI,KAAK,SAAS,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC;QAE1E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,GAAG,CAAC,GAAG,GAAG,IAAK,CAAC,CAAC;gBACrD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,IAAI,EAAE,eAAe;oBACrB,MAAM,EAAE,wBAAwB,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,2CAA2C;iBACtG,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC1C,CAAC;QAED,oFAAoF;QACpF,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5D,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,wCAAwC,IAAI,CAAC,kBAAkB,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,kEAAkE;aACzL,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IAED,gGAAgG;IAChG,UAAU,CAAC,KAAa,EAAE,KAAa,EAAE,MAAe;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;QACnD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,qBAAqB;QACnB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC7E,CAAC;IAEO,iBAAiB,CAAC,GAAW;QACnC,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC;QACzC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;IAC1E,CAAC;CACF"}

package/dist/core/CredentialRestoreEnrollment.d.ts

@@ -0,0 +1,76 @@
+/**
+ * CredentialRestoreEnrollment — the teardown lever (spec §2.8, build-plan §7).
+ *
+ * `POST /credentials/restore-enrollment` moves every slot back to its enrollment layout (N
+ * ordinary §2.3 swaps back), then the operator darks the feature — at which point ledger ==
+ * enrollment and raw `configHome` reads are truthful again (the ordered-rollback the spec names).
+ *
+ * This module owns the ONE piece the plain swap executor does not: the per-slot DECISION of
+ * whether a slot's current blob may be EXCHANGED back into a healthy enrollment slot, or must be
+ * PARKED ONE-DIRECTIONALLY (moved out / the slot vacated for operator re-auth, NEVER exchanged in).
+ *
+ * ── Why a quarantine bypass that retains everything else (spec §0.g + §2.8) ──
+ * restore-enrollment is a TEARDOWN, not a balancing move, so it carries a QUARANTINE BYPASS — it
+ * must operate ON quarantined slots (the degraded state rollback exists for), or §2.3 step-1 would
+ * hard-block it exactly when it is needed. Per §0.g a bypass drops ONLY the named guard: it RETAINS
+ *   1. parse                       (an unparseable blob is parked, never exchanged)
+ *   2. refresh-token-present       (a refresh-token-less blob is parked, never exchanged)
+ *   3. IDENTITY-COHERENCE          (access-tenant == refresh-lineage; the §2.7 Frankenstein gap)
+ *
+ * ── The Frankenstein gap (spec §2.8 round-4) ──
+ * "Parses + has a refresh token" is NOT sufficient. A legacy `AccountSwitcher` slip can leave
+ * B's access token grafted onto A's PRESERVED refresh token: the blob parses, carries a refresh
+ * token, and the oracle (on B's still-valid access token) resolves it to B — yet on first refresh
+ * the client exchanges A's refresh token and silently resurrects A (a §0.d violation). So before
+ * any exchange, the blob's access-token identity (oracle) MUST equal its refresh-token lineage's
+ * expected account. A blob that fails coherence — Frankenstein, revoked-grant, access/refresh
+ * tenant mismatch — is parked ONE-DIRECTIONALLY exactly like an unparseable one, NEVER exchanged
+ * into a healthy slot (a teardown that exchanges garbage into a good slot, then post-commit-verify
+ * quarantines THAT slot, would spread corruption during the exact degraded state rollback is for).
+ *
+ * This module is the DECISION (coherence classification + the park plan). It performs NO keychain
+ * writes itself — the route drives the actual exchange through the §2.3 CredentialSwapExecutor and
+ * the actual park through the ledger quarantine + an attention item. Pure + injectable.
+ */
+import type { ClaudeOauth } from './OAuthRefresher.js';
+/** The expected refresh-lineage tenant of a slot's blob, and the oracle's access-token identity. */
+export interface CoherenceProbe {
+    /**
+     * The account the blob's ACCESS token resolves to via the identity oracle, or null when the
+     * oracle could not confirm it (timeout/401/5xx/etc — §2.11 unavailable, never a guess).
+     */
+    accessTenant: string | null;
+    /**
+     * The account the blob's REFRESH-token lineage is EXPECTED to belong to. When the oracle is
+     * reachable this is derived from the recorded provenance; when it is down the spec's named cheap
+     * proxy applies: the ledger's expected tenant for the slot. null = no expectation available.
+     */
+    refreshLineage: string | null;
+}
+export type CoherenceVerdict = {
+    coherent: true;
+    tenant: string;
+} | {
+    coherent: false;
+    reason: string;
+    park: 'one-directional';
+};
+/** A parsed blob to classify (the raw is round-tripped by the caller; we only read fields). */
+export interface RestoreBlob {
+    raw: string;
+    oauth: ClaudeOauth | null;
+}
+/**
+ * Classify a slot's current blob for restore-enrollment. Returns a COHERENT verdict (safe to
+ * EXCHANGE back to its enrollment slot) ONLY when ALL THREE retained preconditions hold:
+ *   parse + refresh-token-present + identity-coherence (accessTenant === refreshLineage).
+ * Any failure → an INCOHERENT verdict with `park: 'one-directional'` and a named reason — the
+ * caller must vacate the slot for operator re-auth and NEVER exchange this blob into a healthy slot.
+ *
+ * The oracle-down cheap proxy is the caller's job: it supplies `refreshLineage` from the ledger's
+ * expected tenant for the slot, and `accessTenant` may be null (oracle unavailable). When BOTH are
+ * known and equal → coherent; when the oracle is down (accessTenant null) we CANNOT certify
+ * coherence → one-directional park (the safe direction: never exchange an unverifiable blob).
+ */
+export declare function classifyRestoreCoherence(blob: RestoreBlob, probe: CoherenceProbe): CoherenceVerdict;
+//# sourceMappingURL=CredentialRestoreEnrollment.d.ts.map

package/dist/core/CredentialRestoreEnrollment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialRestoreEnrollment.d.ts","sourceRoot":"","sources":["../../src/core/CredentialRestoreEnrollment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,oGAAoG;AACpG,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;OAIG;IACH,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAEjE,+FAA+F;AAC/F,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,GAAG,gBAAgB,CA4BnG"}