instar 1.3.608 → 1.3.609

package/dist/coordination/AccountFollowMeMandateBridge.d.ts

@@ -0,0 +1,56 @@
+/**
+ * WS5.2 §5.2 + R4a — cross-machine delivery of an `account-follow-me` mandate.
+ *
+ * Coordination mandates are issued (PIN-gated) and verified LOCALLY today; their authorship proof
+ * is a SYMMETRIC HMAC over the per-machine issuance secret, which a PEER cannot verify (§3.1a).
+ * For account-follow-me the mandate is issued on the OPERATOR machine but must be acted on by the
+ * TARGET machine — so it has to cross the mesh and be verified there WITHOUT a shared secret.
+ *
+ * This bridge wires PR1's asymmetric primitives (CrossMachineMandate.signMandateIssuance /
+ * verifyMandateIssuance, R4a) onto the mandate's canonical bytes:
+ *   - on the operator machine: sign the canonical mandate with the machine's Ed25519 IDENTITY key,
+ *     bound to its fingerprint, producing a portable issuance signature;
+ *   - on the target machine: verify that signature against the REGISTERED operator-machine's
+ *     Ed25519 public key + expected fingerprint (verified-operator binding) BEFORE acting. A
+ *     forged/edited/wrong-issuer mandate is rejected (deny-by-default; reach ≠ authority, L15).
+ *
+ * The bridge does NOT itself grant anything — a verified mandate still flows through MandateGate
+ * (via AccountFollowMeOrchestrator) for the exact (account, target, mechanism) bounds check. This
+ * is the transport+authenticity layer only. Pure logic + injected crypto; PR2 increment 3b.
+ */
+import crypto from 'node:crypto';
+import { type CrossMachineIssuanceSignature } from './CrossMachineMandate.js';
+import type { CoordinationMandate } from './types.js';
+/** A mandate packaged for cross-machine delivery: the mandate + its asymmetric issuance signature. */
+export interface PortableMandate {
+    mandate: CoordinationMandate;
+    issuanceSignature: CrossMachineIssuanceSignature;
+}
+/**
+ * Sign an issued mandate for cross-machine delivery (operator machine side). The canonical bytes
+ * are the SAME authored-field projection the local authProof covers, so the asymmetric signature
+ * and the local HMAC proof attest to identical content.
+ */
+export declare function packageMandateForDelivery(mandate: CoordinationMandate, issuerFingerprint: string, ed25519PrivateKey: crypto.KeyObject): PortableMandate;
+export type MandateAcceptResult = {
+    accepted: true;
+    mandate: CoordinationMandate;
+} | {
+    accepted: false;
+    reason: string;
+};
+/**
+ * Verify a delivered mandate on the TARGET machine (R4a). FAILS CLOSED: the asymmetric issuance
+ * signature must verify against the EXPECTED registered operator-machine's Ed25519 key + fingerprint
+ * (a name in the payload is never trusted — only the cryptographic + verified-operator binding).
+ * On success the mandate is returned for the orchestrator/gate to evaluate the exact bounds; this
+ * layer asserts ONLY "this mandate was genuinely issued by my trusted operator machine."
+ */
+export declare function acceptDeliveredMandate(args: {
+    portable: PortableMandate | undefined | null;
+    /** The trusted operator-machine's Ed25519 public key (registered MachineIdentity key). */
+    operatorEd25519PublicKey: crypto.KeyObject | string | Buffer;
+    /** The fingerprint the target TRUSTS as its operator machine (verified-operator binding). */
+    expectedOperatorMachineFingerprint: string;
+}): MandateAcceptResult;
+//# sourceMappingURL=AccountFollowMeMandateBridge.d.ts.map

package/dist/coordination/AccountFollowMeMandateBridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountFollowMeMandateBridge.d.ts","sourceRoot":"","sources":["../../src/coordination/AccountFollowMeMandateBridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAA8C,KAAK,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AAC1H,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,sGAAsG;AACtG,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,mBAAmB,CAAC;IAC7B,iBAAiB,EAAE,6BAA6B,CAAC;CAClD;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,mBAAmB,EAC5B,iBAAiB,EAAE,MAAM,EACzB,iBAAiB,EAAE,MAAM,CAAC,SAAS,GAClC,eAAe,CAIjB;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,GAChD;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,QAAQ,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI,CAAC;IAC7C,0FAA0F;IAC1F,wBAAwB,EAAE,MAAM,CAAC,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IAC7D,6FAA6F;IAC7F,kCAAkC,EAAE,MAAM,CAAC;CAC5C,GAAG,mBAAmB,CActB"}

package/dist/coordination/AccountFollowMeMandateBridge.js

@@ -0,0 +1,56 @@
+/**
+ * WS5.2 §5.2 + R4a — cross-machine delivery of an `account-follow-me` mandate.
+ *
+ * Coordination mandates are issued (PIN-gated) and verified LOCALLY today; their authorship proof
+ * is a SYMMETRIC HMAC over the per-machine issuance secret, which a PEER cannot verify (§3.1a).
+ * For account-follow-me the mandate is issued on the OPERATOR machine but must be acted on by the
+ * TARGET machine — so it has to cross the mesh and be verified there WITHOUT a shared secret.
+ *
+ * This bridge wires PR1's asymmetric primitives (CrossMachineMandate.signMandateIssuance /
+ * verifyMandateIssuance, R4a) onto the mandate's canonical bytes:
+ *   - on the operator machine: sign the canonical mandate with the machine's Ed25519 IDENTITY key,
+ *     bound to its fingerprint, producing a portable issuance signature;
+ *   - on the target machine: verify that signature against the REGISTERED operator-machine's
+ *     Ed25519 public key + expected fingerprint (verified-operator binding) BEFORE acting. A
+ *     forged/edited/wrong-issuer mandate is rejected (deny-by-default; reach ≠ authority, L15).
+ *
+ * The bridge does NOT itself grant anything — a verified mandate still flows through MandateGate
+ * (via AccountFollowMeOrchestrator) for the exact (account, target, mechanism) bounds check. This
+ * is the transport+authenticity layer only. Pure logic + injected crypto; PR2 increment 3b.
+ */
+import { canonicalMandate } from './MandateStore.js';
+import { signMandateIssuance, verifyMandateIssuance } from './CrossMachineMandate.js';
+/**
+ * Sign an issued mandate for cross-machine delivery (operator machine side). The canonical bytes
+ * are the SAME authored-field projection the local authProof covers, so the asymmetric signature
+ * and the local HMAC proof attest to identical content.
+ */
+export function packageMandateForDelivery(mandate, issuerFingerprint, ed25519PrivateKey) {
+    const canonical = canonicalMandate(mandate);
+    const issuanceSignature = signMandateIssuance(canonical, issuerFingerprint, ed25519PrivateKey);
+    return { mandate, issuanceSignature };
+}
+/**
+ * Verify a delivered mandate on the TARGET machine (R4a). FAILS CLOSED: the asymmetric issuance
+ * signature must verify against the EXPECTED registered operator-machine's Ed25519 key + fingerprint
+ * (a name in the payload is never trusted — only the cryptographic + verified-operator binding).
+ * On success the mandate is returned for the orchestrator/gate to evaluate the exact bounds; this
+ * layer asserts ONLY "this mandate was genuinely issued by my trusted operator machine."
+ */
+export function acceptDeliveredMandate(args) {
+    const { portable, operatorEd25519PublicKey, expectedOperatorMachineFingerprint } = args;
+    if (!portable || !portable.mandate || !portable.issuanceSignature) {
+        return { accepted: false, reason: 'malformed-portable-mandate' };
+    }
+    const canonical = canonicalMandate(portable.mandate);
+    const v = verifyMandateIssuance({
+        canonical,
+        signature: portable.issuanceSignature,
+        issuerEd25519PublicKey: operatorEd25519PublicKey,
+        expectedIssuerFingerprint: expectedOperatorMachineFingerprint,
+    });
+    if (!v.ok)
+        return { accepted: false, reason: `issuance-verify-failed:${v.reason ?? 'unknown'}` };
+    return { accepted: true, mandate: portable.mandate };
+}
+//# sourceMappingURL=AccountFollowMeMandateBridge.js.map

package/dist/coordination/AccountFollowMeMandateBridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountFollowMeMandateBridge.js","sourceRoot":"","sources":["../../src/coordination/AccountFollowMeMandateBridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAsC,MAAM,0BAA0B,CAAC;AAS1H;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAA4B,EAC5B,iBAAyB,EACzB,iBAAmC;IAEnC,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,SAAS,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;IAC/F,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AACxC,CAAC;AAMD;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAMtC;IACC,MAAM,EAAE,QAAQ,EAAE,wBAAwB,EAAE,kCAAkC,EAAE,GAAG,IAAI,CAAC;IACxF,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAClE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IACnE,CAAC;IACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,CAAC,GAAG,qBAAqB,CAAC;QAC9B,SAAS;QACT,SAAS,EAAE,QAAQ,CAAC,iBAAiB;QACrC,sBAAsB,EAAE,wBAAwB;QAChD,yBAAyB,EAAE,kCAAkC;KAC9D,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,CAAC,CAAC,MAAM,IAAI,SAAS,EAAE,EAAE,CAAC;IACjG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;AACvD,CAAC"}

package/dist/core/AccountFollowMeDetector.d.ts

@@ -0,0 +1,53 @@
+/**
+ * WS5.2 §5.2 + R7 — depth-zero enrollment-offer detector.
+ *
+ * Decides WHICH (account → target-machine) enrollment offers to surface, from the pool's
+ * per-machine account state. A "depth-zero" machine has NO usable account for an operator
+ * subscription; the agent should OFFER (never auto-do) to enroll one there. This is the pure
+ * decision layer that feeds AccountFollowMeOrchestrator (§5.2) — it decides the candidate offers;
+ * the orchestrator still requires an operator mandate before anything happens.
+ *
+ * R7 bounds (so adding the Mth machine can't multiply traffic):
+ *   - only machines with ZERO usable accounts are candidates;
+ *   - per-account **max-follow-machines cap** — never offer an account to more targets than the cap
+ *     (counting machines that ALREADY hold it);
+ *   - **one offer per (account, target)** — an offer already in-flight (a pending mandate/consent)
+ *     is not re-emitted;
+ *   - the caller raises ONE AGGREGATED consent item over the returned list (P17), never one per offer.
+ *
+ * Pure + deterministic (no I/O); unit-tested. PR2 increment 3a.
+ */
+export interface PoolMachineDepth {
+    machineId: string;
+    nickname: string;
+    /** Count of accounts this machine can actually serve from (a real local login). 0 = depth-zero. */
+    usableAccountCount: number;
+}
+export interface OperatorAccount {
+    accountId: string;
+    email: string;
+    /** Machine ids that ALREADY hold a usable login for this account (re-mint instances). */
+    heldByMachineIds: string[];
+}
+export interface EnrollmentOffer {
+    accountId: string;
+    accountEmail: string;
+    targetMachineId: string;
+    targetMachineNickname: string;
+}
+export interface DetectInput {
+    machines: PoolMachineDepth[];
+    accounts: OperatorAccount[];
+    /** Per-account cap on total machines that may hold it (R7; small default e.g. 5). */
+    maxFollowMachines: number;
+    /** (account, target) pairs with an offer/mandate already in flight — never re-offered. */
+    inFlight?: ReadonlySet<string>;
+}
+/**
+ * Compute the enrollment offers to surface. Deterministic: candidates are depth-zero machines,
+ * each offered the operator's "primary" account (the most-held one, stable tie-break by accountId),
+ * subject to the per-account cap and the in-flight dedup. Returns at most ONE offer per target
+ * machine (a machine needs only one account to stop being depth-zero).
+ */
+export declare function detectEnrollmentOffers(input: DetectInput): EnrollmentOffer[];
+//# sourceMappingURL=AccountFollowMeDetector.d.ts.map

package/dist/core/AccountFollowMeDetector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountFollowMeDetector.d.ts","sourceRoot":"","sources":["../../src/core/AccountFollowMeDetector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,mGAAmG;IACnG,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,yFAAyF;IACzF,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,qFAAqF;IACrF,iBAAiB,EAAE,MAAM,CAAC;IAC1B,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAChC;AAID;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,WAAW,GAAG,eAAe,EAAE,CA4B5E"}

package/dist/core/AccountFollowMeDetector.js

@@ -0,0 +1,56 @@
+/**
+ * WS5.2 §5.2 + R7 — depth-zero enrollment-offer detector.
+ *
+ * Decides WHICH (account → target-machine) enrollment offers to surface, from the pool's
+ * per-machine account state. A "depth-zero" machine has NO usable account for an operator
+ * subscription; the agent should OFFER (never auto-do) to enroll one there. This is the pure
+ * decision layer that feeds AccountFollowMeOrchestrator (§5.2) — it decides the candidate offers;
+ * the orchestrator still requires an operator mandate before anything happens.
+ *
+ * R7 bounds (so adding the Mth machine can't multiply traffic):
+ *   - only machines with ZERO usable accounts are candidates;
+ *   - per-account **max-follow-machines cap** — never offer an account to more targets than the cap
+ *     (counting machines that ALREADY hold it);
+ *   - **one offer per (account, target)** — an offer already in-flight (a pending mandate/consent)
+ *     is not re-emitted;
+ *   - the caller raises ONE AGGREGATED consent item over the returned list (P17), never one per offer.
+ *
+ * Pure + deterministic (no I/O); unit-tested. PR2 increment 3a.
+ */
+const key = (accountId, targetMachineId) => `${accountId}::${targetMachineId}`;
+/**
+ * Compute the enrollment offers to surface. Deterministic: candidates are depth-zero machines,
+ * each offered the operator's "primary" account (the most-held one, stable tie-break by accountId),
+ * subject to the per-account cap and the in-flight dedup. Returns at most ONE offer per target
+ * machine (a machine needs only one account to stop being depth-zero).
+ */
+export function detectEnrollmentOffers(input) {
+    const inFlight = input.inFlight ?? new Set();
+    const cap = Number.isFinite(input.maxFollowMachines) && input.maxFollowMachines > 0 ? input.maxFollowMachines : 5;
+    // Mutable copy of how many machines each account is committed to (held + offers we emit this pass).
+    const committed = new Map();
+    for (const a of input.accounts)
+        committed.set(a.accountId, new Set(a.heldByMachineIds).size);
+    // Prefer the account already on the most machines (the operator's "main"), stable by accountId.
+    const ranked = [...input.accounts].sort((x, y) => y.heldByMachineIds.length - x.heldByMachineIds.length || x.accountId.localeCompare(y.accountId));
+    const offers = [];
+    for (const m of input.machines) {
+        if (m.usableAccountCount > 0)
+            continue; // not depth-zero
+        // Pick the first ranked account that (a) this machine doesn't already hold, (b) is under cap,
+        // (c) has no in-flight offer for this (account, target).
+        for (const a of ranked) {
+            if (a.heldByMachineIds.includes(m.machineId))
+                continue;
+            if ((committed.get(a.accountId) ?? 0) >= cap)
+                continue;
+            if (inFlight.has(key(a.accountId, m.machineId)))
+                continue;
+            offers.push({ accountId: a.accountId, accountEmail: a.email, targetMachineId: m.machineId, targetMachineNickname: m.nickname });
+            committed.set(a.accountId, (committed.get(a.accountId) ?? 0) + 1);
+            break; // one offer per target machine
+        }
+    }
+    return offers;
+}
+//# sourceMappingURL=AccountFollowMeDetector.js.map

package/dist/core/AccountFollowMeDetector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountFollowMeDetector.js","sourceRoot":"","sources":["../../src/core/AccountFollowMeDetector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAgCH,MAAM,GAAG,GAAG,CAAC,SAAiB,EAAE,eAAuB,EAAE,EAAE,CAAC,GAAG,SAAS,KAAK,eAAe,EAAE,CAAC;AAE/F;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAkB;IACvD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,GAAG,EAAU,CAAC;IACrD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;IAElH,oGAAoG;IACpG,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC;IAE7F,gGAAgG;IAChG,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CACrC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAC1G,CAAC;IAEF,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,kBAAkB,GAAG,CAAC;YAAE,SAAS,CAAC,iBAAiB;QACzD,8FAA8F;QAC9F,yDAAyD;QACzD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;gBAAE,SAAS;YACvD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG;gBAAE,SAAS;YACvD,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;gBAAE,SAAS;YAC1D,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,SAAS,EAAE,qBAAqB,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YAChI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAClE,MAAM,CAAC,+BAA+B;QACxC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/core/AccountFollowMeEmailGate.d.ts

@@ -0,0 +1,51 @@
+/**
+ * WS5.2 §5.3 step 3 / S7 — email-validation-before-selectable.
+ *
+ * When an operator-authorized follow-me enrollment COMPLETES on a target machine, the freshly
+ * minted login's account email MUST be validated against the operator's expectation BEFORE the
+ * account becomes selectable. A surprise email (the operator approved account A on their phone,
+ * but the login that completed is a DIFFERENT account B) must NOT be auto-used — it raises an
+ * attention item for the operator instead. This closes S7: "the target is trusted with a live
+ * credential; host+email validated" — a wrong/unexpected account never silently becomes the one
+ * the agent serves from.
+ *
+ * Standalone gate (NOT a mutation of the shared EnrollmentWizard.complete): the follow-me path
+ * calls this with the completed email + the operator-expected email; only on a verified match
+ * does it call SubscriptionPool.add() and mark the account selectable.
+ *
+ * PR2 increment 2: the gate + its tests. Wired into the §5.3 completion path in a later increment.
+ */
+export interface EmailValidationInput {
+    /** The account email the COMPLETED login actually authenticated as (from the provider). */
+    completedEmail: string | null | undefined;
+    /** The account email the operator EXPECTED (the mandate's account; what they approved). */
+    expectedEmail: string | null | undefined;
+    /** The account id being enrolled (for the attention item). */
+    accountId: string;
+    /** Operator-facing nickname of the target machine (for the attention item). */
+    targetMachineNickname: string;
+}
+export interface EmailMismatchAttentionItem {
+    id: string;
+    title: string;
+    body: string;
+    priority: 'high';
+    source: 'agent';
+}
+export type EmailValidationResult = {
+    selectable: true;
+    email: string;
+} | {
+    selectable: false;
+    reason: 'email-mismatch' | 'missing-completed-email' | 'missing-expected-email';
+    expected: string | null;
+    got: string | null;
+    attentionItem: EmailMismatchAttentionItem;
+};
+/**
+ * Validate a completed follow-me enrollment's email against operator expectation (S7).
+ * FAILS CLOSED (selectable:false) on any mismatch OR on a missing completed/expected email —
+ * an account is NEVER auto-selected unless its email provably matches what the operator approved.
+ */
+export declare function validateEnrolledAccountEmail(input: EmailValidationInput): EmailValidationResult;
+//# sourceMappingURL=AccountFollowMeEmailGate.d.ts.map

package/dist/core/AccountFollowMeEmailGate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountFollowMeEmailGate.d.ts","sourceRoot":"","sources":["../../src/core/AccountFollowMeEmailGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,oBAAoB;IACnC,2FAA2F;IAC3F,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC1C,2FAA2F;IAC3F,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACzC,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,UAAU,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACnC;IACE,UAAU,EAAE,KAAK,CAAC;IAClB,MAAM,EAAE,gBAAgB,GAAG,yBAAyB,GAAG,wBAAwB,CAAC;IAChF,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,aAAa,EAAE,0BAA0B,CAAC;CAC3C,CAAC;AAON;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,oBAAoB,GAAG,qBAAqB,CAyB/F"}

package/dist/core/AccountFollowMeEmailGate.js

@@ -0,0 +1,50 @@
+/**
+ * WS5.2 §5.3 step 3 / S7 — email-validation-before-selectable.
+ *
+ * When an operator-authorized follow-me enrollment COMPLETES on a target machine, the freshly
+ * minted login's account email MUST be validated against the operator's expectation BEFORE the
+ * account becomes selectable. A surprise email (the operator approved account A on their phone,
+ * but the login that completed is a DIFFERENT account B) must NOT be auto-used — it raises an
+ * attention item for the operator instead. This closes S7: "the target is trusted with a live
+ * credential; host+email validated" — a wrong/unexpected account never silently becomes the one
+ * the agent serves from.
+ *
+ * Standalone gate (NOT a mutation of the shared EnrollmentWizard.complete): the follow-me path
+ * calls this with the completed email + the operator-expected email; only on a verified match
+ * does it call SubscriptionPool.add() and mark the account selectable.
+ *
+ * PR2 increment 2: the gate + its tests. Wired into the §5.3 completion path in a later increment.
+ */
+/** Normalize an email for comparison (trim + lowercase). Returns '' for nullish/non-string. */
+function normEmail(v) {
+    return typeof v === 'string' ? v.trim().toLowerCase() : '';
+}
+/**
+ * Validate a completed follow-me enrollment's email against operator expectation (S7).
+ * FAILS CLOSED (selectable:false) on any mismatch OR on a missing completed/expected email —
+ * an account is NEVER auto-selected unless its email provably matches what the operator approved.
+ */
+export function validateEnrolledAccountEmail(input) {
+    const got = normEmail(input.completedEmail);
+    const expected = normEmail(input.expectedEmail);
+    const attention = (reason) => ({
+        id: `agent:account-follow-me-email:${input.accountId}:${input.targetMachineNickname.replace(/[^a-z0-9]+/gi, '-').toLowerCase()}`,
+        title: `Account enrollment needs your check on "${input.targetMachineNickname}"`,
+        body: `An account-follow-me enrollment on "${input.targetMachineNickname}" ${reason}. ` +
+            `Expected ${input.expectedEmail || '(unspecified)'}, got ${input.completedEmail || '(none)'}. ` +
+            `The account was NOT auto-selected — review before it is used.`,
+        priority: 'high',
+        source: 'agent',
+    });
+    if (!got) {
+        return { selectable: false, reason: 'missing-completed-email', expected: expected || null, got: null, attentionItem: attention('completed without a verifiable account email') };
+    }
+    if (!expected) {
+        return { selectable: false, reason: 'missing-expected-email', expected: null, got: input.completedEmail ?? null, attentionItem: attention('has no operator-expected email to validate against') };
+    }
+    if (got !== expected) {
+        return { selectable: false, reason: 'email-mismatch', expected: input.expectedEmail ?? null, got: input.completedEmail ?? null, attentionItem: attention('authenticated as a DIFFERENT account than approved') };
+    }
+    return { selectable: true, email: input.completedEmail.trim() };
+}
+//# sourceMappingURL=AccountFollowMeEmailGate.js.map

package/dist/core/AccountFollowMeEmailGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountFollowMeEmailGate.js","sourceRoot":"","sources":["../../src/core/AccountFollowMeEmailGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA+BH,+FAA+F;AAC/F,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAA2B;IACtE,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAEhD,MAAM,SAAS,GAAG,CAAC,MAAc,EAA8B,EAAE,CAAC,CAAC;QACjE,EAAE,EAAE,iCAAiC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,qBAAqB,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;QAChI,KAAK,EAAE,2CAA2C,KAAK,CAAC,qBAAqB,GAAG;QAChF,IAAI,EACF,uCAAuC,KAAK,CAAC,qBAAqB,KAAK,MAAM,IAAI;YACjF,YAAY,KAAK,CAAC,aAAa,IAAI,eAAe,SAAS,KAAK,CAAC,cAAc,IAAI,QAAQ,IAAI;YAC/F,+DAA+D;QACjE,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,OAAO;KAChB,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC,8CAA8C,CAAC,EAAE,CAAC;IACnL,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC,oDAAoD,CAAC,EAAE,CAAC;IACpM,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC,oDAAoD,CAAC,EAAE,CAAC;IACnN,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,cAAe,CAAC,IAAI,EAAE,EAAE,CAAC;AACnE,CAAC"}

package/dist/core/AccountFollowMeOrchestrator.d.ts

@@ -0,0 +1,98 @@
+/**
+ * WS5.2 §5.2 — Account Follow-Me: the agent's role is REQUEST, never self-authorize.
+ *
+ * When the agent detects a machine with no usable account for an operator's subscription
+ * (depth-zero; WS5.1 already detects this), it must NOT enroll that machine on its own. The
+ * ONLY authorizer is a PIN-gated operator mandate (`action: 'account-follow-me'`). This
+ * orchestrator runs the deny-by-default flow:
+ *
+ *   - evaluate the mandate gate for (accountId, targetMachineId, mechanism);
+ *   - DENY (no mandate yet, or bounds/expiry/revocation/forgery) → surface a PHONE-FIRST
+ *     consent request (a deep-link to the pre-filled Mandates form) and DO NOT proceed;
+ *   - ALLOW → return proceed:true so the caller drives Mechanism B (§5.3).
+ *
+ * Load-bearing safety (reach ≠ authority, L15): a peer mesh message claiming "the operator said
+ * enroll me" carries NO authority — with no operator-issued mandate the gate denies, and this
+ * orchestrator surfaces consent instead of proceeding. The consent surface is NEVER a CLI
+ * instruction ("run instar …") — it is a dashboard deep-link the operator taps (parent spec
+ * B2). Mechanism defaults to 're-mint' (ToS-safe); 'credential-transport' is only ever reached
+ * when an explicit mandate authorizes it AND the provider is allowlisted (refused for Anthropic).
+ *
+ * PR2 increment 1: this orchestrator + its tests. Later increments wire the depth-zero detector
+ * to it and drive the EnrollmentWizard on allow (§5.3, per-server transport per OQ6).
+ */
+export type FollowMeMechanism = 're-mint' | 'credential-transport';
+export interface FollowMeRequest {
+    /** SubscriptionAccount.id the operator would extend to the target machine. */
+    accountId: string;
+    /** Account email (operator-facing; shown in the consent prompt). */
+    accountEmail: string;
+    /** The machine that has no usable account (the enrollment target). */
+    targetMachineId: string;
+    /** Operator-facing nickname of the target machine (shown in the consent prompt). */
+    targetMachineNickname: string;
+    /** Default 're-mint' (ToS-safe). 'credential-transport' needs an explicit allowlisted mandate. */
+    mechanism?: FollowMeMechanism;
+    /** The operator mandate id, if one has been issued for this (account, target). Absent ⇒ deny. */
+    mandateId?: string;
+}
+/** A phone-first consent request — a dashboard deep-link, NEVER a CLI instruction. */
+export interface FollowMeConsentRequest {
+    kind: 'account-follow-me-consent';
+    accountId: string;
+    accountEmail: string;
+    targetMachineId: string;
+    targetMachineNickname: string;
+    mechanism: FollowMeMechanism;
+    /** Pre-filled Mandates-form deep link (account + target pre-selected). */
+    dashboardDeepLink: string;
+    /** The plain-English message to surface to the operator. */
+    message: string;
+}
+export type FollowMeDecision = {
+    proceed: true;
+    accountId: string;
+    targetMachineId: string;
+    mechanism: FollowMeMechanism;
+    reason: string;
+} | {
+    proceed: false;
+    outcome: 'consent-required';
+    consent: FollowMeConsentRequest;
+    reason: string;
+};
+export interface MandateGateLike {
+    evaluate(ev: {
+        action: string;
+        params: Record<string, unknown>;
+        agentFp: string;
+        mandateId: string;
+    }): {
+        decision: 'allow' | 'deny';
+        reason: string;
+    };
+}
+export interface AccountFollowMeOrchestratorDeps {
+    /** The operator-mandate gate (MandateGate.evaluate). */
+    gate: MandateGateLike;
+    /** This agent's routing fingerprint (the named-party check in the gate). */
+    agentFp: () => string;
+    /** Build the pre-filled Mandates-form deep link (account + target pre-selected). */
+    mandatesDeepLink: (args: {
+        accountId: string;
+        targetMachineId: string;
+        mechanism: FollowMeMechanism;
+    }) => string;
+    log?: (msg: string) => void;
+}
+export declare class AccountFollowMeOrchestrator {
+    private readonly deps;
+    constructor(deps: AccountFollowMeOrchestratorDeps);
+    /**
+     * §5.2 request-never-self-authorize. Returns proceed:true ONLY when a real operator mandate
+     * authorizes this exact (account, target, mechanism); otherwise returns a phone-first consent
+     * request and DOES NOT proceed. Never self-authorizes.
+     */
+    requestEnrollment(req: FollowMeRequest): FollowMeDecision;
+}
+//# sourceMappingURL=AccountFollowMeOrchestrator.d.ts.map

package/dist/core/AccountFollowMeOrchestrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountFollowMeOrchestrator.d.ts","sourceRoot":"","sources":["../../src/core/AccountFollowMeOrchestrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,sBAAsB,CAAC;AAEnE,MAAM,WAAW,eAAe;IAC9B,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,YAAY,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,eAAe,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,qBAAqB,EAAE,MAAM,CAAC;IAC9B,kGAAkG;IAClG,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,iGAAiG;IACjG,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,sFAAsF;AACtF,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,2BAA2B,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,SAAS,EAAE,iBAAiB,CAAC;IAC7B,0EAA0E;IAC1E,iBAAiB,EAAE,MAAM,CAAC;IAC1B,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3G;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,sBAAsB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAErG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE;QACX,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG;QAAE,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACpD;AAED,MAAM,WAAW,+BAA+B;IAC9C,wDAAwD;IACxD,IAAI,EAAE,eAAe,CAAC;IACtB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,MAAM,CAAC;IACtB,oFAAoF;IACpF,gBAAgB,EAAE,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,iBAAiB,CAAA;KAAE,KAAK,MAAM,CAAC;IACjH,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,qBAAa,2BAA2B;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,+BAA+B;IAElE;;;;OAIG;IACH,iBAAiB,CAAC,GAAG,EAAE,eAAe,GAAG,gBAAgB;CA+C1D"}

package/dist/core/AccountFollowMeOrchestrator.js

@@ -0,0 +1,76 @@
+/**
+ * WS5.2 §5.2 — Account Follow-Me: the agent's role is REQUEST, never self-authorize.
+ *
+ * When the agent detects a machine with no usable account for an operator's subscription
+ * (depth-zero; WS5.1 already detects this), it must NOT enroll that machine on its own. The
+ * ONLY authorizer is a PIN-gated operator mandate (`action: 'account-follow-me'`). This
+ * orchestrator runs the deny-by-default flow:
+ *
+ *   - evaluate the mandate gate for (accountId, targetMachineId, mechanism);
+ *   - DENY (no mandate yet, or bounds/expiry/revocation/forgery) → surface a PHONE-FIRST
+ *     consent request (a deep-link to the pre-filled Mandates form) and DO NOT proceed;
+ *   - ALLOW → return proceed:true so the caller drives Mechanism B (§5.3).
+ *
+ * Load-bearing safety (reach ≠ authority, L15): a peer mesh message claiming "the operator said
+ * enroll me" carries NO authority — with no operator-issued mandate the gate denies, and this
+ * orchestrator surfaces consent instead of proceeding. The consent surface is NEVER a CLI
+ * instruction ("run instar …") — it is a dashboard deep-link the operator taps (parent spec
+ * B2). Mechanism defaults to 're-mint' (ToS-safe); 'credential-transport' is only ever reached
+ * when an explicit mandate authorizes it AND the provider is allowlisted (refused for Anthropic).
+ *
+ * PR2 increment 1: this orchestrator + its tests. Later increments wire the depth-zero detector
+ * to it and drive the EnrollmentWizard on allow (§5.3, per-server transport per OQ6).
+ */
+export class AccountFollowMeOrchestrator {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /**
+     * §5.2 request-never-self-authorize. Returns proceed:true ONLY when a real operator mandate
+     * authorizes this exact (account, target, mechanism); otherwise returns a phone-first consent
+     * request and DOES NOT proceed. Never self-authorizes.
+     */
+    requestEnrollment(req) {
+        const mechanism = req.mechanism ?? 're-mint';
+        const consent = () => ({
+            kind: 'account-follow-me-consent',
+            accountId: req.accountId,
+            accountEmail: req.accountEmail,
+            targetMachineId: req.targetMachineId,
+            targetMachineNickname: req.targetMachineNickname,
+            mechanism,
+            dashboardDeepLink: this.deps.mandatesDeepLink({
+                accountId: req.accountId,
+                targetMachineId: req.targetMachineId,
+                mechanism,
+            }),
+            message: `Machine "${req.targetMachineNickname}" has no account for ${req.accountEmail} yet. ` +
+                `Want it to use that subscription? Authorize on the dashboard.`,
+        });
+        // No mandate id at all ⇒ deny-by-default: never self-authorize, surface consent.
+        if (!req.mandateId) {
+            this.deps.log?.(`[account-follow-me] no mandate for ${req.accountId}→${req.targetMachineId}; surfacing consent`);
+            return { proceed: false, outcome: 'consent-required', consent: consent(), reason: 'no-mandate' };
+        }
+        const result = this.deps.gate.evaluate({
+            action: 'account-follow-me',
+            params: { accountId: req.accountId, targetMachineId: req.targetMachineId, mechanism },
+            agentFp: this.deps.agentFp(),
+            mandateId: req.mandateId,
+        });
+        if (result.decision !== 'allow') {
+            this.deps.log?.(`[account-follow-me] gate denied (${result.reason}); surfacing consent`);
+            return { proceed: false, outcome: 'consent-required', consent: consent(), reason: `denied:${result.reason}` };
+        }
+        this.deps.log?.(`[account-follow-me] gate allowed ${req.accountId}→${req.targetMachineId} (${mechanism})`);
+        return {
+            proceed: true,
+            accountId: req.accountId,
+            targetMachineId: req.targetMachineId,
+            mechanism,
+            reason: result.reason,
+        };
+    }
+}
+//# sourceMappingURL=AccountFollowMeOrchestrator.js.map

package/dist/core/AccountFollowMeOrchestrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountFollowMeOrchestrator.js","sourceRoot":"","sources":["../../src/core/AccountFollowMeOrchestrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAwDH,MAAM,OAAO,2BAA2B;IACT;IAA7B,YAA6B,IAAqC;QAArC,SAAI,GAAJ,IAAI,CAAiC;IAAG,CAAC;IAEtE;;;;OAIG;IACH,iBAAiB,CAAC,GAAoB;QACpC,MAAM,SAAS,GAAsB,GAAG,CAAC,SAAS,IAAI,SAAS,CAAC;QAEhE,MAAM,OAAO,GAAG,GAA2B,EAAE,CAAC,CAAC;YAC7C,IAAI,EAAE,2BAA2B;YACjC,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,eAAe,EAAE,GAAG,CAAC,eAAe;YACpC,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;YAChD,SAAS;YACT,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;gBAC5C,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,SAAS;aACV,CAAC;YACF,OAAO,EACL,YAAY,GAAG,CAAC,qBAAqB,wBAAwB,GAAG,CAAC,YAAY,QAAQ;gBACrF,+DAA+D;SAClE,CAAC,CAAC;QAEH,iFAAiF;QACjF,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,sCAAsC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,eAAe,qBAAqB,CAAC,CAAC;YACjH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QACnG,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;YACrC,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,EAAE,GAAG,CAAC,eAAe,EAAE,SAAS,EAAE;YACrF,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,oCAAoC,MAAM,CAAC,MAAM,sBAAsB,CAAC,CAAC;YACzF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAChH,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,oCAAoC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,eAAe,KAAK,SAAS,GAAG,CAAC,CAAC;QAC3G,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,eAAe,EAAE,GAAG,CAAC,eAAe;YACpC,SAAS;YACT,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC;IACJ,CAAC;CACF"}

package/dist/core/AccountFollowMeService.d.ts

@@ -0,0 +1,84 @@
+/**
+ * WS5.2 §5.2 — Account Follow-Me service: composes the primitives into the depth-zero → consent
+ * flow, and the mandate-delivered → proceed flow. Pure orchestration over INJECTED deps (pool
+ * reader, consent emitter, enroll driver) so it is unit-testable WITHOUT spawning a server; the
+ * HTTP route / scheduler tick later just constructs it with real deps.
+ *
+ * Two entry points:
+ *   - scanAndOffer(): detect depth-zero enrollment candidates (R7-bounded), run each through the
+ *     orchestrator (no operator mandate yet → consent-required), and emit ONE AGGREGATED consent
+ *     item (P17 Bounded Notification Surface) — never one per machine. Never enrolls anything.
+ *   - onMandateDelivered(): a portable account-follow-me mandate arrived from the operator machine
+ *     → verify it (R4a bridge) → run the orchestrator with it → on allow, return an enroll-drive
+ *     instruction for the caller to execute (per-server, OQ6). Still never self-authorizes.
+ *
+ * The service decides; the side effects (raising the attention item, driving the EnrollmentWizard,
+ * SubscriptionPool.add) are injected so each is independently testable + swappable. PR2 increment 3b.
+ */
+import { type PoolMachineDepth, type OperatorAccount } from './AccountFollowMeDetector.js';
+import { AccountFollowMeOrchestrator, type FollowMeConsentRequest, type FollowMeMechanism } from './AccountFollowMeOrchestrator.js';
+import { type PortableMandate } from '../coordination/AccountFollowMeMandateBridge.js';
+import type crypto from 'node:crypto';
+export interface AggregatedConsent {
+    /** Stable id so the attention item dedups per scan-set (one running item, not a flood). */
+    id: string;
+    title: string;
+    body: string;
+    priority: 'medium';
+    source: 'agent';
+    offers: FollowMeConsentRequest[];
+}
+export interface EnrollDriveInstruction {
+    accountId: string;
+    targetMachineId: string;
+    mechanism: FollowMeMechanism;
+    /** The verified mandate id authorizing this drive (audit). */
+    mandateId: string;
+}
+export interface AccountFollowMeServiceDeps {
+    /** Read the pool's per-machine account depth + the operator's accounts (WS5.1 / SubscriptionPool). */
+    readPoolDepth: () => {
+        machines: PoolMachineDepth[];
+        accounts: OperatorAccount[];
+    };
+    /** Per-account max-follow-machines cap (R7). */
+    maxFollowMachines: () => number;
+    /** (account,target) pairs already offered/in-flight — never re-offered (`${accountId}::${targetMachineId}`). */
+    inFlight: () => ReadonlySet<string>;
+    /** The §5.2 orchestrator (request-never-self-authorize). */
+    orchestrator: AccountFollowMeOrchestrator;
+    /** Raise ONE aggregated consent attention item. */
+    emitAggregatedConsent: (consent: AggregatedConsent) => void;
+    log?: (msg: string) => void;
+}
+export declare class AccountFollowMeService {
+    private readonly deps;
+    constructor(deps: AccountFollowMeServiceDeps);
+    /**
+     * §5.2 scan: surface (never act on) the depth-zero enrollment offers. Runs each candidate through
+     * the orchestrator — with no mandate yet, each yields consent-required — and emits ONE aggregated
+     * consent item over all of them. Returns the consent requests surfaced (empty if none).
+     */
+    scanAndOffer(): {
+        offered: FollowMeConsentRequest[];
+    };
+    /**
+     * A portable account-follow-me mandate was delivered from the operator machine. Verify it (R4a),
+     * then run the orchestrator with it. On allow, return an enroll-drive instruction; otherwise null
+     * (verification failed, or the gate denied — never proceed, never self-authorize).
+     */
+    onMandateDelivered(args: {
+        portable: PortableMandate;
+        operatorEd25519PublicKey: crypto.KeyObject | string | Buffer;
+        expectedOperatorMachineFingerprint: string;
+        /** The (account,target,mechanism,email,nickname) this mandate is expected to authorize. */
+        request: {
+            accountId: string;
+            accountEmail: string;
+            targetMachineId: string;
+            targetMachineNickname: string;
+            mechanism?: FollowMeMechanism;
+        };
+    }): EnrollDriveInstruction | null;
+}
+//# sourceMappingURL=AccountFollowMeService.d.ts.map

package/dist/core/AccountFollowMeService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountFollowMeService.d.ts","sourceRoot":"","sources":["../../src/core/AccountFollowMeService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAA0B,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACnH,OAAO,EACL,2BAA2B,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAA0B,KAAK,eAAe,EAAE,MAAM,iDAAiD,CAAC;AAC/G,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC,MAAM,WAAW,iBAAiB;IAChC,2FAA2F;IAC3F,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,sBAAsB,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,sGAAsG;IACtG,aAAa,EAAE,MAAM;QAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;QAAC,QAAQ,EAAE,eAAe,EAAE,CAAA;KAAE,CAAC;IACnF,gDAAgD;IAChD,iBAAiB,EAAE,MAAM,MAAM,CAAC;IAChC,gHAAgH;IAChH,QAAQ,EAAE,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,4DAA4D;IAC5D,YAAY,EAAE,2BAA2B,CAAC;IAC1C,mDAAmD;IACnD,qBAAqB,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAC5D,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,qBAAa,sBAAsB;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,0BAA0B;IAE7D;;;;OAIG;IACH,YAAY,IAAI;QAAE,OAAO,EAAE,sBAAsB,EAAE,CAAA;KAAE;IAyCrD;;;;OAIG;IACH,kBAAkB,CAAC,IAAI,EAAE;QACvB,QAAQ,EAAE,eAAe,CAAC;QAC1B,wBAAwB,EAAE,MAAM,CAAC,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;QAC7D,kCAAkC,EAAE,MAAM,CAAC;QAC3C,2FAA2F;QAC3F,OAAO,EAAE;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAC;YAAC,eAAe,EAAE,MAAM,CAAC;YAAC,qBAAqB,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,iBAAiB,CAAA;SAAE,CAAC;KAC7I,GAAG,sBAAsB,GAAG,IAAI;CA6BlC"}