instar 1.3.610 → 1.3.612

package/dist/core/AccountFollowMeRevocation.d.ts

@@ -0,0 +1,178 @@
+/**
+ * WS5.2 R12 — Revocation / de-authorization data-plane executor (Mechanism B, the DEFAULT).
+ *
+ * "Stop following to machine X" is TWO things: a control-plane mandate revocation (PIN-gated on the
+ * Mandates tab; the agent CANNOT revoke — that authority stays with MandateGate) PLUS a real
+ * data-plane effect. This module is the data-plane half: it CONSUMES a revocation signal (the
+ * control-plane revoke already happened) and computes the honest data-plane outcome. It NEVER
+ * self-revokes the mandate and is NOT a new blocking authority — it is a deterministic planner +
+ * honest-state surface over INJECTED side-effect deps (logout, slot delete, SubscriptionPool.remove,
+ * attention emit, pending store). No direct I/O in the logic; every effect is injected so each is
+ * independently unit-testable (mirrors AccountFollowMeService / Grants / Orchestrator style).
+ *
+ * R12 has three honesty-load-bearing branches:
+ *
+ *   (i)  COOPERATIVE, still-paired target ONLINE (R12.i): the data-plane effect is local & total —
+ *        the target logs the account OUT of its config-home, deletes the per-account slot, and
+ *        SubscriptionPool.remove(accountId) fires on the target. End state: `removed`.
+ *
+ *   (ii) DE-PAIRED / HOSTILE / non-cooperative holder (S8 / R12.i corrected): a B-minted credential
+ *        is an independently-refreshable real OAuth login; instar CANNOT force the logout remotely.
+ *        The HONEST revocation path is provider-side de-authorization. We surface a phone-first
+ *        instruction ("machine X still holds its own live login for account Y — de-authorize/rotate
+ *        at <provider> to kill it"), NEVER a false "removed everywhere". End state:
+ *        `provider-rotation-required`. (When a machine de-pairs, MachineStatus flips to 'revoked' —
+ *        that flip is the caller's; this module READS that status and refuses to claim a wipe.)
+ *
+ *   (iii) OFFLINE-honest pending, BOUNDED (R12.iii): a still-paired target that is OFFLINE at revoke
+ *        time gets its control-plane revoke immediately, but the data-plane wipe becomes a DURABLE
+ *        pending action fired when it reconnects ("write it down durably, fire on return", the
+ *        cross-machine-secret-sync pattern). Dashboard shows `revocation-pending`, NEVER `removed`.
+ *        The pending wipe is NOT unbounded: after a fixed, operator-tunable reconnect-deadline it
+ *        ESCALATES to a LOUD `revocation-FAILED — rotate at provider NOW` aggregated HIGH attention
+ *        item (resume-queue give-up discipline). Honest end state of an offline-forever / terminated
+ *        VM is "rotate at provider", never a silently-aging "pending".
+ *
+ * FAIL CLOSED on uncertainty: if we cannot positively confirm the cooperative-online wipe path
+ * (unknown reachability, revoked status, the wipe effect threw), we NEVER report `removed` — we fall
+ * to pending or provider-rotation-required. Deny-by-default for the optimistic "removed" claim.
+ *
+ * Mechanism A (sealed-transport) is dark/refused-for-Anthropic; per R9 it is out of scope here
+ * beyond the minimal `mechanism` discriminator — a Mechanism-A revoke ALSO requires the wipe verb +
+ * an unconditional provider-rotation prompt (a delivered credential cannot be un-delivered), so this
+ * module flags `providerRotationRequired: true` for any Mechanism-A revoke regardless of branch.
+ */
+export type RevocationMechanism = 're-mint' | 'credential-transport';
+/** Target reachability/cooperation posture at revoke time — drives the R12 branch. */
+export type TargetPosture = 'cooperative-online' | 'offline' | 'revoked';
+/** Honest end-state of a revocation's DATA plane (never conflate with the control-plane revoke). */
+export type RevocationDataState = 'removed' | 'revocation-pending' | 'revocation-failed' | 'provider-rotation-required';
+export interface RevocationRequest {
+    accountId: string;
+    /** Operator-facing account email (shown in honest operator messaging). */
+    accountEmail: string;
+    targetMachineId: string;
+    /** Operator-facing nickname of the target machine (shown in honest operator messaging). */
+    targetMachineNickname: string;
+    /** Provider name for the provider-side de-authorization instruction (e.g. 'Anthropic'). */
+    provider: string;
+    /** The mandate id whose control-plane revoke triggered this data-plane effect (audit). */
+    mandateId: string;
+    /** Default 're-mint' (Mechanism B). 'credential-transport' ⇒ unconditional provider rotation. */
+    mechanism?: RevocationMechanism;
+}
+/** A phone-first provider-side de-authorization instruction — a real instruction, NOT a "handled" claim. */
+export interface ProviderRotationInstruction {
+    kind: 'provider-rotation-required';
+    accountId: string;
+    accountEmail: string;
+    targetMachineId: string;
+    targetMachineNickname: string;
+    provider: string;
+    /** Plain-English, honest message surfaced to the operator (never implies instar removed it). */
+    message: string;
+}
+/** A LOUD aggregated attention item for an offline target that gave up (R12.iii give-up). */
+export interface RevocationFailedAttention {
+    /** Stable id so the item dedups per (account,target) — one running item, not a flood (P17). */
+    id: string;
+    title: string;
+    body: string;
+    priority: 'high';
+    source: 'agent';
+}
+/** A durable pending-wipe record — fired on the target's reconnect; bounded by the deadline. */
+export interface PendingWipeRecord {
+    accountId: string;
+    targetMachineId: string;
+    mandateId: string;
+    provider: string;
+    accountEmail: string;
+    targetMachineNickname: string;
+    mechanism: RevocationMechanism;
+    /** When the control-plane revoke fired — the deadline clock starts here. */
+    revokedAt: number;
+    /** Absolute deadline; after this a still-pending wipe escalates to revocation-failed. */
+    deadlineAt: number;
+}
+/** Durable persistence seam for pending wipes (production: JSON/SQLite; tests: in-memory). */
+export interface PendingWipeStore {
+    /** Upsert keyed on `${accountId}::${targetMachineId}`. */
+    put(record: PendingWipeRecord): void;
+    /** Resolve (the wipe fired) — remove the pending record. */
+    remove(accountId: string, targetMachineId: string): void;
+    get(accountId: string, targetMachineId: string): PendingWipeRecord | undefined;
+    all(): PendingWipeRecord[];
+}
+export declare function inMemoryPendingWipeStore(): PendingWipeStore;
+/** Outcome of an attempted cooperative-online data-plane wipe (each step injected). */
+export interface CooperativeWipeResult {
+    loggedOut: boolean;
+    slotDeleted: boolean;
+    poolRemoved: boolean;
+}
+export interface AccountFollowMeRevocationDeps {
+    /** Master gate: the whole feature is dark unless this is true (single-machine / flag-off ⇒ no-op). */
+    enabled: () => boolean;
+    /**
+     * Execute the cooperative data-plane wipe ON the (online, still-paired) target: framework logout
+     * against that CLAUDE_CONFIG_DIR + delete the per-account slot + SubscriptionPool.remove(accountId).
+     * MUST throw or return all-false on any failure — we then fail closed (never claim `removed`).
+     */
+    cooperativeWipe: (req: RevocationRequest) => CooperativeWipeResult;
+    /** Durable pending-wipe ledger (offline path). */
+    pendingStore: PendingWipeStore;
+    /** Raise ONE aggregated LOUD attention item (offline give-up). */
+    emitRevocationFailed: (item: RevocationFailedAttention) => void;
+    /** Reconnect-deadline before an offline pending wipe escalates to revocation-failed (ms). */
+    reconnectDeadlineMs: () => number;
+    now?: () => number;
+    log?: (msg: string) => void;
+}
+export type RevocationOutcome = {
+    state: RevocationDataState;
+    accountId: string;
+    targetMachineId: string;
+    /** True whenever provider-side rotation is the (only) complete revocation — caller surfaces it. */
+    providerRotationRequired: boolean;
+    /** Present for the de-paired/hostile and Mechanism-A paths — a real phone-first instruction. */
+    providerRotation?: ProviderRotationInstruction;
+    /** Present on the cooperative-online success path. */
+    wipe?: CooperativeWipeResult;
+    reason: string;
+};
+export declare class AccountFollowMeRevocation {
+    private readonly deps;
+    private readonly now;
+    constructor(deps: AccountFollowMeRevocationDeps);
+    private rotationInstruction;
+    /**
+     * Revoke account access on `targetMachineId` given the control-plane revoke already fired. The
+     * `posture` (computed by the caller from authoritative registry state — online flag, MachineStatus)
+     * selects the R12 branch. Returns the HONEST data-plane outcome; never claims `removed` it can't
+     * confirm. A no-op (`provider-rotation-required` with a no-op message) when the feature is dark.
+     */
+    revoke(req: RevocationRequest, posture: TargetPosture): RevocationOutcome;
+    /**
+     * A previously-offline target reconnected — fire its durable pending wipe (R12.iii). Drives the
+     * SAME cooperative wipe as the online path; on success the pending record is cleared and we report
+     * `removed`. On failure/partial we keep the record (it may still escalate at the deadline).
+     * A no-op if no pending record exists for (account, target) or the feature is dark.
+     */
+    onTargetReconnect(accountId: string, targetMachineId: string): RevocationOutcome | null;
+    /**
+     * Sweep durable pending wipes whose reconnect-deadline has passed and escalate each to a LOUD
+     * `revocation-FAILED — rotate at provider NOW` aggregated HIGH attention item (R12.iii give-up).
+     * Each escalated record is removed from the pending store (its honest end-state is now provider
+     * rotation, never a silently-aging "pending"). Returns the records that escalated. Caller runs
+     * this on a cadence (resume-queue drainer style). No-op when the feature is dark.
+     */
+    sweepDeadlines(): RevocationFailedAttention[];
+    /**
+     * Honest dashboard state for an (account, target) pair: a live pending record reports
+     * `revocation-pending` (or `revocation-failed` once past its deadline), else null (no pending
+     * revocation in flight). Read surface — never mutates.
+     */
+    pendingStateFor(accountId: string, targetMachineId: string): RevocationDataState | null;
+}
+//# sourceMappingURL=AccountFollowMeRevocation.d.ts.map

package/dist/core/AccountFollowMeRevocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountFollowMeRevocation.d.ts","sourceRoot":"","sources":["../../src/core/AccountFollowMeRevocation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,sBAAsB,CAAC;AAErE,sFAAsF;AACtF,MAAM,MAAM,aAAa,GACrB,oBAAoB,GACpB,SAAS,GACT,SAAS,CAAC;AAEd,oGAAoG;AACpG,MAAM,MAAM,mBAAmB,GAC3B,SAAS,GACT,oBAAoB,GACpB,mBAAmB,GACnB,4BAA4B,CAAC;AAEjC,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,2FAA2F;IAC3F,qBAAqB,EAAE,MAAM,CAAC;IAC9B,2FAA2F;IAC3F,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC;IAClB,iGAAiG;IACjG,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC;AAED,4GAA4G;AAC5G,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,4BAA4B,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,gGAAgG;IAChG,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,6FAA6F;AAC7F,MAAM,WAAW,yBAAyB;IACxC,+FAA+F;IAC/F,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,gGAAgG;AAChG,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,SAAS,EAAE,mBAAmB,CAAC;IAC/B,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,yFAAyF;IACzF,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,8FAA8F;AAC9F,MAAM,WAAW,gBAAgB;IAC/B,0DAA0D;IAC1D,GAAG,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACrC,4DAA4D;IAC5D,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACzD,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAAC;IAC/E,GAAG,IAAI,iBAAiB,EAAE,CAAC;CAC5B;AAED,wBAAgB,wBAAwB,IAAI,gBAAgB,CAS3D;AAED,uFAAuF;AACvF,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,6BAA6B;IAC5C,sGAAsG;IACtG,OAAO,EAAE,MAAM,OAAO,CAAC;IACvB;;;;OAIG;IACH,eAAe,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,qBAAqB,CAAC;IACnE,kDAAkD;IAClD,YAAY,EAAE,gBAAgB,CAAC;IAC/B,kEAAkE;IAClE,oBAAoB,EAAE,CAAC,IAAI,EAAE,yBAAyB,KAAK,IAAI,CAAC;IAChE,6FAA6F;IAC7F,mBAAmB,EAAE,MAAM,MAAM,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,mBAAmB,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,mGAAmG;IACnG,wBAAwB,EAAE,OAAO,CAAC;IAClC,gGAAgG;IAChG,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;IAC/C,sDAAsD;IACtD,IAAI,CAAC,EAAE,qBAAqB,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,qBAAa,yBAAyB;IAExB,OAAO,CAAC,QAAQ,CAAC,IAAI;IADjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBACN,IAAI,EAAE,6BAA6B;IAIhE,OAAO,CAAC,mBAAmB;IAe3B;;;;;OAKG;IACH,MAAM,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,aAAa,GAAG,iBAAiB;IAmJzE;;;;;OAKG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI;IAiBvF;;;;;;OAMG;IACH,cAAc,IAAI,yBAAyB,EAAE;IA2B7C;;;;OAIG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI;CAKxF"}

package/dist/core/AccountFollowMeRevocation.js

@@ -0,0 +1,279 @@
+/**
+ * WS5.2 R12 — Revocation / de-authorization data-plane executor (Mechanism B, the DEFAULT).
+ *
+ * "Stop following to machine X" is TWO things: a control-plane mandate revocation (PIN-gated on the
+ * Mandates tab; the agent CANNOT revoke — that authority stays with MandateGate) PLUS a real
+ * data-plane effect. This module is the data-plane half: it CONSUMES a revocation signal (the
+ * control-plane revoke already happened) and computes the honest data-plane outcome. It NEVER
+ * self-revokes the mandate and is NOT a new blocking authority — it is a deterministic planner +
+ * honest-state surface over INJECTED side-effect deps (logout, slot delete, SubscriptionPool.remove,
+ * attention emit, pending store). No direct I/O in the logic; every effect is injected so each is
+ * independently unit-testable (mirrors AccountFollowMeService / Grants / Orchestrator style).
+ *
+ * R12 has three honesty-load-bearing branches:
+ *
+ *   (i)  COOPERATIVE, still-paired target ONLINE (R12.i): the data-plane effect is local & total —
+ *        the target logs the account OUT of its config-home, deletes the per-account slot, and
+ *        SubscriptionPool.remove(accountId) fires on the target. End state: `removed`.
+ *
+ *   (ii) DE-PAIRED / HOSTILE / non-cooperative holder (S8 / R12.i corrected): a B-minted credential
+ *        is an independently-refreshable real OAuth login; instar CANNOT force the logout remotely.
+ *        The HONEST revocation path is provider-side de-authorization. We surface a phone-first
+ *        instruction ("machine X still holds its own live login for account Y — de-authorize/rotate
+ *        at <provider> to kill it"), NEVER a false "removed everywhere". End state:
+ *        `provider-rotation-required`. (When a machine de-pairs, MachineStatus flips to 'revoked' —
+ *        that flip is the caller's; this module READS that status and refuses to claim a wipe.)
+ *
+ *   (iii) OFFLINE-honest pending, BOUNDED (R12.iii): a still-paired target that is OFFLINE at revoke
+ *        time gets its control-plane revoke immediately, but the data-plane wipe becomes a DURABLE
+ *        pending action fired when it reconnects ("write it down durably, fire on return", the
+ *        cross-machine-secret-sync pattern). Dashboard shows `revocation-pending`, NEVER `removed`.
+ *        The pending wipe is NOT unbounded: after a fixed, operator-tunable reconnect-deadline it
+ *        ESCALATES to a LOUD `revocation-FAILED — rotate at provider NOW` aggregated HIGH attention
+ *        item (resume-queue give-up discipline). Honest end state of an offline-forever / terminated
+ *        VM is "rotate at provider", never a silently-aging "pending".
+ *
+ * FAIL CLOSED on uncertainty: if we cannot positively confirm the cooperative-online wipe path
+ * (unknown reachability, revoked status, the wipe effect threw), we NEVER report `removed` — we fall
+ * to pending or provider-rotation-required. Deny-by-default for the optimistic "removed" claim.
+ *
+ * Mechanism A (sealed-transport) is dark/refused-for-Anthropic; per R9 it is out of scope here
+ * beyond the minimal `mechanism` discriminator — a Mechanism-A revoke ALSO requires the wipe verb +
+ * an unconditional provider-rotation prompt (a delivered credential cannot be un-delivered), so this
+ * module flags `providerRotationRequired: true` for any Mechanism-A revoke regardless of branch.
+ */
+export function inMemoryPendingWipeStore() {
+    const map = new Map();
+    const key = (a, t) => `${a}::${t}`;
+    return {
+        put: (r) => { map.set(key(r.accountId, r.targetMachineId), r); },
+        remove: (a, t) => { map.delete(key(a, t)); },
+        get: (a, t) => map.get(key(a, t)),
+        all: () => [...map.values()],
+    };
+}
+export class AccountFollowMeRevocation {
+    deps;
+    now;
+    constructor(deps) {
+        this.deps = deps;
+        this.now = deps.now ?? Date.now;
+    }
+    rotationInstruction(req, lead) {
+        return {
+            kind: 'provider-rotation-required',
+            accountId: req.accountId,
+            accountEmail: req.accountEmail,
+            targetMachineId: req.targetMachineId,
+            targetMachineNickname: req.targetMachineNickname,
+            provider: req.provider,
+            message: `${lead} "${req.targetMachineNickname}" still holds its own live, refreshable login for ` +
+                `${req.accountEmail}. instar cannot revoke it remotely — de-authorize that session/device ` +
+                `or rotate the credential at ${req.provider} to kill it.`,
+        };
+    }
+    /**
+     * Revoke account access on `targetMachineId` given the control-plane revoke already fired. The
+     * `posture` (computed by the caller from authoritative registry state — online flag, MachineStatus)
+     * selects the R12 branch. Returns the HONEST data-plane outcome; never claims `removed` it can't
+     * confirm. A no-op (`provider-rotation-required` with a no-op message) when the feature is dark.
+     */
+    revoke(req, posture) {
+        const mechanism = req.mechanism ?? 're-mint';
+        // Dark / single-machine ⇒ strict no-op (deny-by-default; never act).
+        if (!this.deps.enabled()) {
+            return {
+                state: 'provider-rotation-required',
+                accountId: req.accountId,
+                targetMachineId: req.targetMachineId,
+                providerRotationRequired: false,
+                reason: 'feature-disabled',
+            };
+        }
+        // Mechanism A relocated a real credential — provider rotation is ALWAYS required regardless of
+        // branch (a delivered credential cannot be un-delivered, R12.ii). We still attempt the wipe for
+        // a cooperative-online A target, but the rotation instruction is unconditional.
+        const mechARotation = mechanism === 'credential-transport';
+        // (ii) De-paired / hostile / MachineStatus==='revoked' — provider-side ONLY (S8/R12.i corrected).
+        if (posture === 'revoked') {
+            const rotation = this.rotationInstruction(req, 'Machine');
+            this.deps.log?.(`[account-follow-me] revoke ${req.accountId}→${req.targetMachineId}: de-paired/hostile — ` +
+                `provider-side de-authorization required (no remote wipe possible)`);
+            return {
+                state: 'provider-rotation-required',
+                accountId: req.accountId,
+                targetMachineId: req.targetMachineId,
+                providerRotationRequired: true,
+                providerRotation: rotation,
+                reason: 'de-paired-non-cooperative',
+            };
+        }
+        // (iii) Offline still-paired target — durable pending wipe, fired on reconnect (BOUNDED).
+        if (posture === 'offline') {
+            const t = this.now();
+            const record = {
+                accountId: req.accountId,
+                targetMachineId: req.targetMachineId,
+                mandateId: req.mandateId,
+                provider: req.provider,
+                accountEmail: req.accountEmail,
+                targetMachineNickname: req.targetMachineNickname,
+                mechanism,
+                revokedAt: t,
+                deadlineAt: t + this.deps.reconnectDeadlineMs(),
+            };
+            this.deps.pendingStore.put(record);
+            this.deps.log?.(`[account-follow-me] revoke ${req.accountId}→${req.targetMachineId}: target offline — ` +
+                `durable pending wipe (deadline +${this.deps.reconnectDeadlineMs()}ms)`);
+            return {
+                state: 'revocation-pending',
+                accountId: req.accountId,
+                targetMachineId: req.targetMachineId,
+                // For Mechanism A, rotate at provider NOW even while pending (the blob already landed).
+                providerRotationRequired: mechARotation,
+                providerRotation: mechARotation
+                    ? this.rotationInstruction(req, 'Offline machine')
+                    : undefined,
+                reason: 'target-offline-pending',
+            };
+        }
+        // (i) Cooperative, still-paired, ONLINE target — local & total wipe. Fail closed on any error.
+        let wipe;
+        try {
+            wipe = this.deps.cooperativeWipe(req);
+        }
+        catch (err) {
+            // The wipe threw — we CANNOT claim removed. Fail closed to a durable pending retry.
+            const t = this.now();
+            this.deps.pendingStore.put({
+                accountId: req.accountId,
+                targetMachineId: req.targetMachineId,
+                mandateId: req.mandateId,
+                provider: req.provider,
+                accountEmail: req.accountEmail,
+                targetMachineNickname: req.targetMachineNickname,
+                mechanism,
+                revokedAt: t,
+                deadlineAt: t + this.deps.reconnectDeadlineMs(),
+            });
+            this.deps.log?.(`[account-follow-me] revoke ${req.accountId}→${req.targetMachineId}: cooperative wipe THREW ` +
+                `(${err instanceof Error ? err.message : String(err)}) — fail-closed to pending`);
+            return {
+                state: 'revocation-pending',
+                accountId: req.accountId,
+                targetMachineId: req.targetMachineId,
+                providerRotationRequired: mechARotation,
+                providerRotation: mechARotation ? this.rotationInstruction(req, 'Machine') : undefined,
+                reason: 'cooperative-wipe-error',
+            };
+        }
+        const fullyWiped = wipe.loggedOut && wipe.slotDeleted && wipe.poolRemoved;
+        if (!fullyWiped) {
+            // Partial wipe — fail closed: do NOT claim removed; keep a durable pending so it retries.
+            const t = this.now();
+            this.deps.pendingStore.put({
+                accountId: req.accountId,
+                targetMachineId: req.targetMachineId,
+                mandateId: req.mandateId,
+                provider: req.provider,
+                accountEmail: req.accountEmail,
+                targetMachineNickname: req.targetMachineNickname,
+                mechanism,
+                revokedAt: t,
+                deadlineAt: t + this.deps.reconnectDeadlineMs(),
+            });
+            this.deps.log?.(`[account-follow-me] revoke ${req.accountId}→${req.targetMachineId}: partial wipe ` +
+                `(logout=${wipe.loggedOut} slot=${wipe.slotDeleted} pool=${wipe.poolRemoved}) — pending`);
+            return {
+                state: 'revocation-pending',
+                accountId: req.accountId,
+                targetMachineId: req.targetMachineId,
+                providerRotationRequired: mechARotation,
+                providerRotation: mechARotation ? this.rotationInstruction(req, 'Machine') : undefined,
+                wipe,
+                reason: 'cooperative-wipe-partial',
+            };
+        }
+        // Confirmed local & total. The pending record (if any earlier offline/error attempt) is cleared.
+        this.deps.pendingStore.remove(req.accountId, req.targetMachineId);
+        this.deps.log?.(`[account-follow-me] revoke ${req.accountId}→${req.targetMachineId}: removed (logout + slot + pool)`);
+        return {
+            state: mechARotation ? 'provider-rotation-required' : 'removed',
+            accountId: req.accountId,
+            targetMachineId: req.targetMachineId,
+            // Even a clean Mechanism-A wipe still requires provider rotation (blob was delivered).
+            providerRotationRequired: mechARotation,
+            providerRotation: mechARotation ? this.rotationInstruction(req, 'Machine') : undefined,
+            wipe,
+            reason: mechARotation ? 'wiped-but-mechanism-a-rotate' : 'wiped-local-and-total',
+        };
+    }
+    /**
+     * A previously-offline target reconnected — fire its durable pending wipe (R12.iii). Drives the
+     * SAME cooperative wipe as the online path; on success the pending record is cleared and we report
+     * `removed`. On failure/partial we keep the record (it may still escalate at the deadline).
+     * A no-op if no pending record exists for (account, target) or the feature is dark.
+     */
+    onTargetReconnect(accountId, targetMachineId) {
+        if (!this.deps.enabled())
+            return null;
+        const record = this.deps.pendingStore.get(accountId, targetMachineId);
+        if (!record)
+            return null;
+        const req = {
+            accountId: record.accountId,
+            accountEmail: record.accountEmail,
+            targetMachineId: record.targetMachineId,
+            targetMachineNickname: record.targetMachineNickname,
+            provider: record.provider,
+            mandateId: record.mandateId,
+            mechanism: record.mechanism,
+        };
+        // Reconnected ⇒ treat as cooperative-online and run the same wipe (revoke clears the record on success).
+        return this.revoke(req, 'cooperative-online');
+    }
+    /**
+     * Sweep durable pending wipes whose reconnect-deadline has passed and escalate each to a LOUD
+     * `revocation-FAILED — rotate at provider NOW` aggregated HIGH attention item (R12.iii give-up).
+     * Each escalated record is removed from the pending store (its honest end-state is now provider
+     * rotation, never a silently-aging "pending"). Returns the records that escalated. Caller runs
+     * this on a cadence (resume-queue drainer style). No-op when the feature is dark.
+     */
+    sweepDeadlines() {
+        if (!this.deps.enabled())
+            return [];
+        const t = this.now();
+        const escalated = [];
+        for (const record of this.deps.pendingStore.all()) {
+            if (record.deadlineAt > t)
+                continue; // still within the deadline — stays pending.
+            const item = {
+                id: `agent:account-follow-me-revoke-failed:${record.accountId}::${record.targetMachineId}`,
+                title: `Revocation FAILED on "${record.targetMachineNickname}" — rotate at ${record.provider} NOW`,
+                body: `I revoked access for ${record.accountEmail} on "${record.targetMachineNickname}", but that ` +
+                    `machine never reconnected to confirm its copy was destroyed. Its login may still be live. ` +
+                    `Rotate or de-authorize the credential at ${record.provider} now to be certain.`,
+                priority: 'high',
+                source: 'agent',
+            };
+            this.deps.emitRevocationFailed(item);
+            this.deps.pendingStore.remove(record.accountId, record.targetMachineId);
+            this.deps.log?.(`[account-follow-me] revoke ${record.accountId}→${record.targetMachineId}: pending wipe ` +
+                `EXCEEDED deadline — escalated to revocation-FAILED (rotate at ${record.provider})`);
+            escalated.push(item);
+        }
+        return escalated;
+    }
+    /**
+     * Honest dashboard state for an (account, target) pair: a live pending record reports
+     * `revocation-pending` (or `revocation-failed` once past its deadline), else null (no pending
+     * revocation in flight). Read surface — never mutates.
+     */
+    pendingStateFor(accountId, targetMachineId) {
+        const record = this.deps.pendingStore.get(accountId, targetMachineId);
+        if (!record)
+            return null;
+        return record.deadlineAt > this.now() ? 'revocation-pending' : 'revocation-failed';
+    }
+}
+//# sourceMappingURL=AccountFollowMeRevocation.js.map

package/dist/core/AccountFollowMeRevocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountFollowMeRevocation.js","sourceRoot":"","sources":["../../src/core/AccountFollowMeRevocation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AA+EH,MAAM,UAAU,wBAAwB;IACtC,MAAM,GAAG,GAAG,IAAI,GAAG,EAA6B,CAAC;IACjD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;IACnD,OAAO;QACL,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;KAC7B,CAAC;AACJ,CAAC;AAyCD,MAAM,OAAO,yBAAyB;IAEP;IADZ,GAAG,CAAe;IACnC,YAA6B,IAAmC;QAAnC,SAAI,GAAJ,IAAI,CAA+B;QAC9D,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,CAAC;IAEO,mBAAmB,CAAC,GAAsB,EAAE,IAAY;QAC9D,OAAO;YACL,IAAI,EAAE,4BAA4B;YAClC,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,eAAe,EAAE,GAAG,CAAC,eAAe;YACpC,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;YAChD,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,OAAO,EACL,GAAG,IAAI,KAAK,GAAG,CAAC,qBAAqB,oDAAoD;gBACzF,GAAG,GAAG,CAAC,YAAY,wEAAwE;gBAC3F,+BAA+B,GAAG,CAAC,QAAQ,cAAc;SAC5D,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,GAAsB,EAAE,OAAsB;QACnD,MAAM,SAAS,GAAwB,GAAG,CAAC,SAAS,IAAI,SAAS,CAAC;QAElE,qEAAqE;QACrE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YACzB,OAAO;gBACL,KAAK,EAAE,4BAA4B;gBACnC,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,wBAAwB,EAAE,KAAK;gBAC/B,MAAM,EAAE,kBAAkB;aAC3B,CAAC;QACJ,CAAC;QAED,+FAA+F;QAC/F,gGAAgG;QAChG,gFAAgF;QAChF,MAAM,aAAa,GAAG,SAAS,KAAK,sBAAsB,CAAC;QAE3D,kGAAkG;QAClG,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CACb,8BAA8B,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,eAAe,wBAAwB;gBACxF,mEAAmE,CACtE,CAAC;YACF,OAAO;gBACL,KAAK,EAAE,4BAA4B;gBACnC,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,wBAAwB,EAAE,IAAI;gBAC9B,gBAAgB,EAAE,QAAQ;gBAC1B,MAAM,EAAE,2BAA2B;aACpC,CAAC;QACJ,CAAC;QAED,0FAA0F;QAC1F,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACrB,MAAM,MAAM,GAAsB;gBAChC,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;gBAChD,SAAS;gBACT,SAAS,EAAE,CAAC;gBACZ,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE;aAChD,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CACb,8BAA8B,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,eAAe,qBAAqB;gBACrF,mCAAmC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,CAC1E,CAAC;YACF,OAAO;gBACL,KAAK,EAAE,oBAAoB;gBAC3B,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,wFAAwF;gBACxF,wBAAwB,EAAE,aAAa;gBACvC,gBAAgB,EAAE,aAAa;oBAC7B,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,iBAAiB,CAAC;oBAClD,CAAC,CAAC,SAAS;gBACb,MAAM,EAAE,wBAAwB;aACjC,CAAC;QACJ,CAAC;QAED,+FAA+F;QAC/F,IAAI,IAA2B,CAAC;QAChC,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oFAAoF;YACpF,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;gBACzB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;gBAChD,SAAS;gBACT,SAAS,EAAE,CAAC;gBACZ,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE;aAChD,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CACb,8BAA8B,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,eAAe,2BAA2B;gBAC3F,IAAI,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CACnF,CAAC;YACF,OAAO;gBACL,KAAK,EAAE,oBAAoB;gBAC3B,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,wBAAwB,EAAE,aAAa;gBACvC,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;gBACtF,MAAM,EAAE,wBAAwB;aACjC,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,0FAA0F;YAC1F,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;gBACzB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;gBAChD,SAAS;gBACT,SAAS,EAAE,CAAC;gBACZ,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE;aAChD,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CACb,8BAA8B,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,eAAe,iBAAiB;gBACjF,WAAW,IAAI,CAAC,SAAS,SAAS,IAAI,CAAC,WAAW,SAAS,IAAI,CAAC,WAAW,aAAa,CAC3F,CAAC;YACF,OAAO;gBACL,KAAK,EAAE,oBAAoB;gBAC3B,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,wBAAwB,EAAE,aAAa;gBACvC,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;gBACtF,IAAI;gBACJ,MAAM,EAAE,0BAA0B;aACnC,CAAC;QACJ,CAAC;QAED,iGAAiG;QACjG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CACb,8BAA8B,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,eAAe,kCAAkC,CACrG,CAAC;QACF,OAAO;YACL,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,SAAS;YAC/D,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,eAAe,EAAE,GAAG,CAAC,eAAe;YACpC,uFAAuF;YACvF,wBAAwB,EAAE,aAAa;YACvC,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;YACtF,IAAI;YACJ,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,uBAAuB;SACjF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,SAAiB,EAAE,eAAuB;QAC1D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,GAAG,GAAsB;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;YACnD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;QACF,yGAAyG;QACzG,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;OAMG;IACH,cAAc;QACZ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YAAE,OAAO,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,MAAM,SAAS,GAAgC,EAAE,CAAC;QAClD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC;YAClD,IAAI,MAAM,CAAC,UAAU,GAAG,CAAC;gBAAE,SAAS,CAAC,6CAA6C;YAClF,MAAM,IAAI,GAA8B;gBACtC,EAAE,EAAE,yCAAyC,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,eAAe,EAAE;gBAC1F,KAAK,EAAE,yBAAyB,MAAM,CAAC,qBAAqB,iBAAiB,MAAM,CAAC,QAAQ,MAAM;gBAClG,IAAI,EACF,wBAAwB,MAAM,CAAC,YAAY,QAAQ,MAAM,CAAC,qBAAqB,cAAc;oBAC7F,4FAA4F;oBAC5F,4CAA4C,MAAM,CAAC,QAAQ,qBAAqB;gBAClF,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE,OAAO;aAChB,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;YACxE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CACb,8BAA8B,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,eAAe,iBAAiB;gBACvF,iEAAiE,MAAM,CAAC,QAAQ,GAAG,CACtF,CAAC;YACF,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,SAAiB,EAAE,eAAuB;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,mBAAmB,CAAC;IACrF,CAAC;CACF"}

package/dist/core/EnrollmentWizard.d.ts

@@ -21,6 +21,7 @@
  */
 import { PendingLoginStore, type PendingLogin, type LoginFlowKind, type LoginProvider } from './PendingLoginStore.js';
 import { type EnsureInteractiveReadyResult } from './ensureInteractiveReady.js';
+import type { IdentityOracle } from './CredentialLocationLedger.js';
 /** The public artifact a framework login yields (no secret). */
 export interface LoginArtifact {
     verificationUrl: string;
@@ -52,6 +53,26 @@ export interface EnrollmentWizardConfig {
      * Injectable for hermetic tests; production uses the real util.
      */
     ensureReady?: (configHome: string) => EnsureInteractiveReadyResult;
+    /**
+     * WS5.2 §5.3/S7 — identity oracle used by `completeFollowMe` to read the freshly-minted
+     * login's account email from its config-home slot, for validation against operator
+     * expectation. Absent ⇒ the follow-me gate fails CLOSED (the account is HELD, never
+     * auto-selected). The plain `complete()` path never touches it.
+     */
+    oracle?: IdentityOracle;
+    /**
+     * WS5.2 §5.3/S7 — emit a HIGH attention item when a follow-me completion is HELD
+     * (surprise/mismatched/unverifiable email). Best-effort; absence does not change the
+     * fail-closed verdict (the account is still NOT selected), only whether the operator
+     * is paged.
+     */
+    emitAttention?: (item: {
+        id: string;
+        title: string;
+        body: string;
+        priority: 'high';
+        source: 'agent';
+    }) => void;
 }
 export interface StartEnrollmentInput {
     id: string;
@@ -62,12 +83,17 @@ export interface StartEnrollmentInput {
     kind?: LoginFlowKind;
     /** The new account's CLAUDE_CONFIG_DIR — isolates the login to its own slot. */
     configHome?: string;
+    /** WS5.2 §5.3/S7 — the operator-expected account email (follow-me path only). Carried
+     *  onto the pending login so `completeFollowMe` can validate the minted account. */
+    expectedEmail?: string;
 }
 export declare class EnrollmentWizard {
     private readonly store;
     private readonly driveLogin;
     private readonly logger;
     private readonly ensureReady;
+    private readonly oracle?;
+    private readonly emitAttention?;
     constructor(cfg: EnrollmentWizardConfig);
     /** Default flow kind per provider: Codex/OpenAI = device-code (its endorsed
      *  flow); everyone else = url-code-paste (the phone-friendly Claude path). */
@@ -106,6 +132,30 @@ export declare class EnrollmentWizard {
      * logged, never blocks completion (the launch paths re-ensure defensively).
      */
     complete(id: string): PendingLogin | null;
+    /**
+     * WS5.2 §5.3 step 3 / S7 — the FOLLOW-ME completion path. Completes the pending login
+     * (reusing the sync `complete()` so claude-code interactive-readiness still runs), then
+     * validates the freshly-minted account's email against the operator's expectation BEFORE
+     * the account is allowed to become selectable. Only a verified match returns 'validated'
+     * (the caller — the route — then adds it to the SubscriptionPool); everything else FAILS
+     * CLOSED to 'held' (a HIGH attention item is emitted, the account is NOT added to the pool).
+     *
+     * Fail-closed by construction: a missing oracle, an unreadable/missing config-home, an
+     * unavailable identity probe, or a missing operator-expected email all resolve to 'held'
+     * — an account is NEVER auto-selected unless its email provably matches what the operator
+     * approved (this is the FOLLOW-ME path, so the email gate ALWAYS runs).
+     */
+    completeFollowMe(id: string, targetMachineNickname: string): Promise<{
+        outcome: 'validated';
+        login: PendingLogin;
+        email: string;
+    } | {
+        outcome: 'held';
+        login: PendingLogin;
+        reason: string;
+    } | {
+        outcome: 'not-found';
+    }>;
     /** The phone surface: still-valid logins awaiting approval. */
     pending(): PendingLogin[];
 }

package/dist/core/EnrollmentWizard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"EnrollmentWizard.d.ts","sourceRoot":"","sources":["../../src/core/EnrollmentWizard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,aAAa,EACnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,6BAA6B,CAAC;AAErC,gEAAgE;AAChE,MAAM,WAAW,aAAa;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,8EAA8E;AAC9E,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE;IAC9B,QAAQ,EAAE,aAAa,CAAC;IACxB,SAAS,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,EAAE,aAAa,CAAC;IACpB;6DACyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAE7B,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,iBAAiB,CAAC;IACzB,UAAU,EAAE,WAAW,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;IACjE;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,4BAA4B,CAAC;CACpE;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,aAAa,CAAC;IACxB,SAAS,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC;IACrC,6EAA6E;IAC7E,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAc;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0D;IACjF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuD;gBAEvE,GAAG,EAAE,sBAAsB;IAOvC;kFAC8E;IAC9E,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,aAAa,GAAG,aAAa;IAI1D;;;;;;;;;OASG;IACH,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS;IAW1D;;;;OAIG;IACG,KAAK,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,CAAC;IAwB/D;;;;;;OAMG;IACG,cAAc,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IA4B/C;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAazC,+DAA+D;IAC/D,OAAO,IAAI,YAAY,EAAE;CAG1B"}
+{"version":3,"file":"EnrollmentWizard.d.ts","sourceRoot":"","sources":["../../src/core/EnrollmentWizard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,aAAa,EACnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAGpE,gEAAgE;AAChE,MAAM,WAAW,aAAa;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,8EAA8E;AAC9E,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE;IAC9B,QAAQ,EAAE,aAAa,CAAC;IACxB,SAAS,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,EAAE,aAAa,CAAC;IACpB;6DACyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAE7B,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,iBAAiB,CAAC;IACzB,UAAU,EAAE,WAAW,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;IACjE;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,4BAA4B,CAAC;IACnE;;;;;OAKG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;CAChH;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,aAAa,CAAC;IACxB,SAAS,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC;IACrC,6EAA6E;IAC7E,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;wFACoF;IACpF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAc;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0D;IACjF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuD;IACnF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAiG;gBAEpH,GAAG,EAAE,sBAAsB;IASvC;kFAC8E;IAC9E,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,aAAa,GAAG,aAAa;IAI1D;;;;;;;;;OASG;IACH,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS;IAW1D;;;;OAIG;IACG,KAAK,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,CAAC;IAyB/D;;;;;;OAMG;IACG,cAAc,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IA4B/C;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAazC;;;;;;;;;;;;OAYG;IACG,gBAAgB,CACpB,EAAE,EAAE,MAAM,EACV,qBAAqB,EAAE,MAAM,GAC5B,OAAO,CACN;QAAE,OAAO,EAAE,WAAW,CAAC;QAAC,KAAK,EAAE,YAAY,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAC5D;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,YAAY,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GACxD;QAAE,OAAO,EAAE,WAAW,CAAA;KAAE,CAC3B;IAoCD,+DAA+D;IAC/D,OAAO,IAAI,YAAY,EAAE;CAG1B"}