instar 1.3.611 → 1.3.613

package/dist/core/AccountFollowMeRevocation.d.ts

@@ -0,0 +1,178 @@
+/**
+ * WS5.2 R12 — Revocation / de-authorization data-plane executor (Mechanism B, the DEFAULT).
+ *
+ * "Stop following to machine X" is TWO things: a control-plane mandate revocation (PIN-gated on the
+ * Mandates tab; the agent CANNOT revoke — that authority stays with MandateGate) PLUS a real
+ * data-plane effect. This module is the data-plane half: it CONSUMES a revocation signal (the
+ * control-plane revoke already happened) and computes the honest data-plane outcome. It NEVER
+ * self-revokes the mandate and is NOT a new blocking authority — it is a deterministic planner +
+ * honest-state surface over INJECTED side-effect deps (logout, slot delete, SubscriptionPool.remove,
+ * attention emit, pending store). No direct I/O in the logic; every effect is injected so each is
+ * independently unit-testable (mirrors AccountFollowMeService / Grants / Orchestrator style).
+ *
+ * R12 has three honesty-load-bearing branches:
+ *
+ *   (i)  COOPERATIVE, still-paired target ONLINE (R12.i): the data-plane effect is local & total —
+ *        the target logs the account OUT of its config-home, deletes the per-account slot, and
+ *        SubscriptionPool.remove(accountId) fires on the target. End state: `removed`.
+ *
+ *   (ii) DE-PAIRED / HOSTILE / non-cooperative holder (S8 / R12.i corrected): a B-minted credential
+ *        is an independently-refreshable real OAuth login; instar CANNOT force the logout remotely.
+ *        The HONEST revocation path is provider-side de-authorization. We surface a phone-first
+ *        instruction ("machine X still holds its own live login for account Y — de-authorize/rotate
+ *        at <provider> to kill it"), NEVER a false "removed everywhere". End state:
+ *        `provider-rotation-required`. (When a machine de-pairs, MachineStatus flips to 'revoked' —
+ *        that flip is the caller's; this module READS that status and refuses to claim a wipe.)
+ *
+ *   (iii) OFFLINE-honest pending, BOUNDED (R12.iii): a still-paired target that is OFFLINE at revoke
+ *        time gets its control-plane revoke immediately, but the data-plane wipe becomes a DURABLE
+ *        pending action fired when it reconnects ("write it down durably, fire on return", the
+ *        cross-machine-secret-sync pattern). Dashboard shows `revocation-pending`, NEVER `removed`.
+ *        The pending wipe is NOT unbounded: after a fixed, operator-tunable reconnect-deadline it
+ *        ESCALATES to a LOUD `revocation-FAILED — rotate at provider NOW` aggregated HIGH attention
+ *        item (resume-queue give-up discipline). Honest end state of an offline-forever / terminated
+ *        VM is "rotate at provider", never a silently-aging "pending".
+ *
+ * FAIL CLOSED on uncertainty: if we cannot positively confirm the cooperative-online wipe path
+ * (unknown reachability, revoked status, the wipe effect threw), we NEVER report `removed` — we fall
+ * to pending or provider-rotation-required. Deny-by-default for the optimistic "removed" claim.
+ *
+ * Mechanism A (sealed-transport) is dark/refused-for-Anthropic; per R9 it is out of scope here
+ * beyond the minimal `mechanism` discriminator — a Mechanism-A revoke ALSO requires the wipe verb +
+ * an unconditional provider-rotation prompt (a delivered credential cannot be un-delivered), so this
+ * module flags `providerRotationRequired: true` for any Mechanism-A revoke regardless of branch.
+ */
+export type RevocationMechanism = 're-mint' | 'credential-transport';
+/** Target reachability/cooperation posture at revoke time — drives the R12 branch. */
+export type TargetPosture = 'cooperative-online' | 'offline' | 'revoked';
+/** Honest end-state of a revocation's DATA plane (never conflate with the control-plane revoke). */
+export type RevocationDataState = 'removed' | 'revocation-pending' | 'revocation-failed' | 'provider-rotation-required';
+export interface RevocationRequest {
+    accountId: string;
+    /** Operator-facing account email (shown in honest operator messaging). */
+    accountEmail: string;
+    targetMachineId: string;
+    /** Operator-facing nickname of the target machine (shown in honest operator messaging). */
+    targetMachineNickname: string;
+    /** Provider name for the provider-side de-authorization instruction (e.g. 'Anthropic'). */
+    provider: string;
+    /** The mandate id whose control-plane revoke triggered this data-plane effect (audit). */
+    mandateId: string;
+    /** Default 're-mint' (Mechanism B). 'credential-transport' ⇒ unconditional provider rotation. */
+    mechanism?: RevocationMechanism;
+}
+/** A phone-first provider-side de-authorization instruction — a real instruction, NOT a "handled" claim. */
+export interface ProviderRotationInstruction {
+    kind: 'provider-rotation-required';
+    accountId: string;
+    accountEmail: string;
+    targetMachineId: string;
+    targetMachineNickname: string;
+    provider: string;
+    /** Plain-English, honest message surfaced to the operator (never implies instar removed it). */
+    message: string;
+}
+/** A LOUD aggregated attention item for an offline target that gave up (R12.iii give-up). */
+export interface RevocationFailedAttention {
+    /** Stable id so the item dedups per (account,target) — one running item, not a flood (P17). */
+    id: string;
+    title: string;
+    body: string;
+    priority: 'high';
+    source: 'agent';
+}
+/** A durable pending-wipe record — fired on the target's reconnect; bounded by the deadline. */
+export interface PendingWipeRecord {
+    accountId: string;
+    targetMachineId: string;
+    mandateId: string;
+    provider: string;
+    accountEmail: string;
+    targetMachineNickname: string;
+    mechanism: RevocationMechanism;
+    /** When the control-plane revoke fired — the deadline clock starts here. */
+    revokedAt: number;
+    /** Absolute deadline; after this a still-pending wipe escalates to revocation-failed. */
+    deadlineAt: number;
+}
+/** Durable persistence seam for pending wipes (production: JSON/SQLite; tests: in-memory). */
+export interface PendingWipeStore {
+    /** Upsert keyed on `${accountId}::${targetMachineId}`. */
+    put(record: PendingWipeRecord): void;
+    /** Resolve (the wipe fired) — remove the pending record. */
+    remove(accountId: string, targetMachineId: string): void;
+    get(accountId: string, targetMachineId: string): PendingWipeRecord | undefined;
+    all(): PendingWipeRecord[];
+}
+export declare function inMemoryPendingWipeStore(): PendingWipeStore;
+/** Outcome of an attempted cooperative-online data-plane wipe (each step injected). */
+export interface CooperativeWipeResult {
+    loggedOut: boolean;
+    slotDeleted: boolean;
+    poolRemoved: boolean;
+}
+export interface AccountFollowMeRevocationDeps {
+    /** Master gate: the whole feature is dark unless this is true (single-machine / flag-off ⇒ no-op). */
+    enabled: () => boolean;
+    /**
+     * Execute the cooperative data-plane wipe ON the (online, still-paired) target: framework logout
+     * against that CLAUDE_CONFIG_DIR + delete the per-account slot + SubscriptionPool.remove(accountId).
+     * MUST throw or return all-false on any failure — we then fail closed (never claim `removed`).
+     */
+    cooperativeWipe: (req: RevocationRequest) => CooperativeWipeResult;
+    /** Durable pending-wipe ledger (offline path). */
+    pendingStore: PendingWipeStore;
+    /** Raise ONE aggregated LOUD attention item (offline give-up). */
+    emitRevocationFailed: (item: RevocationFailedAttention) => void;
+    /** Reconnect-deadline before an offline pending wipe escalates to revocation-failed (ms). */
+    reconnectDeadlineMs: () => number;
+    now?: () => number;
+    log?: (msg: string) => void;
+}
+export type RevocationOutcome = {
+    state: RevocationDataState;
+    accountId: string;
+    targetMachineId: string;
+    /** True whenever provider-side rotation is the (only) complete revocation — caller surfaces it. */
+    providerRotationRequired: boolean;
+    /** Present for the de-paired/hostile and Mechanism-A paths — a real phone-first instruction. */
+    providerRotation?: ProviderRotationInstruction;
+    /** Present on the cooperative-online success path. */
+    wipe?: CooperativeWipeResult;
+    reason: string;
+};
+export declare class AccountFollowMeRevocation {
+    private readonly deps;
+    private readonly now;
+    constructor(deps: AccountFollowMeRevocationDeps);
+    private rotationInstruction;
+    /**
+     * Revoke account access on `targetMachineId` given the control-plane revoke already fired. The
+     * `posture` (computed by the caller from authoritative registry state — online flag, MachineStatus)
+     * selects the R12 branch. Returns the HONEST data-plane outcome; never claims `removed` it can't
+     * confirm. A no-op (`provider-rotation-required` with a no-op message) when the feature is dark.
+     */
+    revoke(req: RevocationRequest, posture: TargetPosture): RevocationOutcome;
+    /**
+     * A previously-offline target reconnected — fire its durable pending wipe (R12.iii). Drives the
+     * SAME cooperative wipe as the online path; on success the pending record is cleared and we report
+     * `removed`. On failure/partial we keep the record (it may still escalate at the deadline).
+     * A no-op if no pending record exists for (account, target) or the feature is dark.
+     */
+    onTargetReconnect(accountId: string, targetMachineId: string): RevocationOutcome | null;
+    /**
+     * Sweep durable pending wipes whose reconnect-deadline has passed and escalate each to a LOUD
+     * `revocation-FAILED — rotate at provider NOW` aggregated HIGH attention item (R12.iii give-up).
+     * Each escalated record is removed from the pending store (its honest end-state is now provider
+     * rotation, never a silently-aging "pending"). Returns the records that escalated. Caller runs
+     * this on a cadence (resume-queue drainer style). No-op when the feature is dark.
+     */
+    sweepDeadlines(): RevocationFailedAttention[];
+    /**
+     * Honest dashboard state for an (account, target) pair: a live pending record reports
+     * `revocation-pending` (or `revocation-failed` once past its deadline), else null (no pending
+     * revocation in flight). Read surface — never mutates.
+     */
+    pendingStateFor(accountId: string, targetMachineId: string): RevocationDataState | null;
+}
+//# sourceMappingURL=AccountFollowMeRevocation.d.ts.map

package/dist/core/AccountFollowMeRevocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountFollowMeRevocation.d.ts","sourceRoot":"","sources":["../../src/core/AccountFollowMeRevocation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,sBAAsB,CAAC;AAErE,sFAAsF;AACtF,MAAM,MAAM,aAAa,GACrB,oBAAoB,GACpB,SAAS,GACT,SAAS,CAAC;AAEd,oGAAoG;AACpG,MAAM,MAAM,mBAAmB,GAC3B,SAAS,GACT,oBAAoB,GACpB,mBAAmB,GACnB,4BAA4B,CAAC;AAEjC,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,2FAA2F;IAC3F,qBAAqB,EAAE,MAAM,CAAC;IAC9B,2FAA2F;IAC3F,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC;IAClB,iGAAiG;IACjG,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC;AAED,4GAA4G;AAC5G,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,4BAA4B,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,gGAAgG;IAChG,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,6FAA6F;AAC7F,MAAM,WAAW,yBAAyB;IACxC,+FAA+F;IAC/F,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,gGAAgG;AAChG,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,SAAS,EAAE,mBAAmB,CAAC;IAC/B,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,yFAAyF;IACzF,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,8FAA8F;AAC9F,MAAM,WAAW,gBAAgB;IAC/B,0DAA0D;IAC1D,GAAG,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACrC,4DAA4D;IAC5D,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACzD,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAAC;IAC/E,GAAG,IAAI,iBAAiB,EAAE,CAAC;CAC5B;AAED,wBAAgB,wBAAwB,IAAI,gBAAgB,CAS3D;AAED,uFAAuF;AACvF,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,6BAA6B;IAC5C,sGAAsG;IACtG,OAAO,EAAE,MAAM,OAAO,CAAC;IACvB;;;;OAIG;IACH,eAAe,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,qBAAqB,CAAC;IACnE,kDAAkD;IAClD,YAAY,EAAE,gBAAgB,CAAC;IAC/B,kEAAkE;IAClE,oBAAoB,EAAE,CAAC,IAAI,EAAE,yBAAyB,KAAK,IAAI,CAAC;IAChE,6FAA6F;IAC7F,mBAAmB,EAAE,MAAM,MAAM,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,mBAAmB,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,mGAAmG;IACnG,wBAAwB,EAAE,OAAO,CAAC;IAClC,gGAAgG;IAChG,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;IAC/C,sDAAsD;IACtD,IAAI,CAAC,EAAE,qBAAqB,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,qBAAa,yBAAyB;IAExB,OAAO,CAAC,QAAQ,CAAC,IAAI;IADjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBACN,IAAI,EAAE,6BAA6B;IAIhE,OAAO,CAAC,mBAAmB;IAe3B;;;;;OAKG;IACH,MAAM,CAAC,GAAG,EAAE,iBAAiB,EAAE,OAAO,EAAE,aAAa,GAAG,iBAAiB;IAmJzE;;;;;OAKG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI;IAiBvF;;;;;;OAMG;IACH,cAAc,IAAI,yBAAyB,EAAE;IA2B7C;;;;OAIG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI;CAKxF"}

package/dist/core/AccountFollowMeRevocation.js

@@ -0,0 +1,279 @@
+/**
+ * WS5.2 R12 — Revocation / de-authorization data-plane executor (Mechanism B, the DEFAULT).
+ *
+ * "Stop following to machine X" is TWO things: a control-plane mandate revocation (PIN-gated on the
+ * Mandates tab; the agent CANNOT revoke — that authority stays with MandateGate) PLUS a real
+ * data-plane effect. This module is the data-plane half: it CONSUMES a revocation signal (the
+ * control-plane revoke already happened) and computes the honest data-plane outcome. It NEVER
+ * self-revokes the mandate and is NOT a new blocking authority — it is a deterministic planner +
+ * honest-state surface over INJECTED side-effect deps (logout, slot delete, SubscriptionPool.remove,
+ * attention emit, pending store). No direct I/O in the logic; every effect is injected so each is
+ * independently unit-testable (mirrors AccountFollowMeService / Grants / Orchestrator style).
+ *
+ * R12 has three honesty-load-bearing branches:
+ *
+ *   (i)  COOPERATIVE, still-paired target ONLINE (R12.i): the data-plane effect is local & total —
+ *        the target logs the account OUT of its config-home, deletes the per-account slot, and
+ *        SubscriptionPool.remove(accountId) fires on the target. End state: `removed`.
+ *
+ *   (ii) DE-PAIRED / HOSTILE / non-cooperative holder (S8 / R12.i corrected): a B-minted credential
+ *        is an independently-refreshable real OAuth login; instar CANNOT force the logout remotely.
+ *        The HONEST revocation path is provider-side de-authorization. We surface a phone-first
+ *        instruction ("machine X still holds its own live login for account Y — de-authorize/rotate
+ *        at <provider> to kill it"), NEVER a false "removed everywhere". End state:
+ *        `provider-rotation-required`. (When a machine de-pairs, MachineStatus flips to 'revoked' —
+ *        that flip is the caller's; this module READS that status and refuses to claim a wipe.)
+ *
+ *   (iii) OFFLINE-honest pending, BOUNDED (R12.iii): a still-paired target that is OFFLINE at revoke
+ *        time gets its control-plane revoke immediately, but the data-plane wipe becomes a DURABLE
+ *        pending action fired when it reconnects ("write it down durably, fire on return", the
+ *        cross-machine-secret-sync pattern). Dashboard shows `revocation-pending`, NEVER `removed`.
+ *        The pending wipe is NOT unbounded: after a fixed, operator-tunable reconnect-deadline it
+ *        ESCALATES to a LOUD `revocation-FAILED — rotate at provider NOW` aggregated HIGH attention
+ *        item (resume-queue give-up discipline). Honest end state of an offline-forever / terminated
+ *        VM is "rotate at provider", never a silently-aging "pending".
+ *
+ * FAIL CLOSED on uncertainty: if we cannot positively confirm the cooperative-online wipe path
+ * (unknown reachability, revoked status, the wipe effect threw), we NEVER report `removed` — we fall
+ * to pending or provider-rotation-required. Deny-by-default for the optimistic "removed" claim.
+ *
+ * Mechanism A (sealed-transport) is dark/refused-for-Anthropic; per R9 it is out of scope here
+ * beyond the minimal `mechanism` discriminator — a Mechanism-A revoke ALSO requires the wipe verb +
+ * an unconditional provider-rotation prompt (a delivered credential cannot be un-delivered), so this
+ * module flags `providerRotationRequired: true` for any Mechanism-A revoke regardless of branch.
+ */
+export function inMemoryPendingWipeStore() {
+    const map = new Map();
+    const key = (a, t) => `${a}::${t}`;
+    return {
+        put: (r) => { map.set(key(r.accountId, r.targetMachineId), r); },
+        remove: (a, t) => { map.delete(key(a, t)); },
+        get: (a, t) => map.get(key(a, t)),
+        all: () => [...map.values()],
+    };
+}
+export class AccountFollowMeRevocation {
+    deps;
+    now;
+    constructor(deps) {
+        this.deps = deps;
+        this.now = deps.now ?? Date.now;
+    }
+    rotationInstruction(req, lead) {
+        return {
+            kind: 'provider-rotation-required',
+            accountId: req.accountId,
+            accountEmail: req.accountEmail,
+            targetMachineId: req.targetMachineId,
+            targetMachineNickname: req.targetMachineNickname,
+            provider: req.provider,
+            message: `${lead} "${req.targetMachineNickname}" still holds its own live, refreshable login for ` +
+                `${req.accountEmail}. instar cannot revoke it remotely — de-authorize that session/device ` +
+                `or rotate the credential at ${req.provider} to kill it.`,
+        };
+    }
+    /**
+     * Revoke account access on `targetMachineId` given the control-plane revoke already fired. The
+     * `posture` (computed by the caller from authoritative registry state — online flag, MachineStatus)
+     * selects the R12 branch. Returns the HONEST data-plane outcome; never claims `removed` it can't
+     * confirm. A no-op (`provider-rotation-required` with a no-op message) when the feature is dark.
+     */
+    revoke(req, posture) {
+        const mechanism = req.mechanism ?? 're-mint';
+        // Dark / single-machine ⇒ strict no-op (deny-by-default; never act).
+        if (!this.deps.enabled()) {
+            return {
+                state: 'provider-rotation-required',
+                accountId: req.accountId,
+                targetMachineId: req.targetMachineId,
+                providerRotationRequired: false,
+                reason: 'feature-disabled',
+            };
+        }
+        // Mechanism A relocated a real credential — provider rotation is ALWAYS required regardless of
+        // branch (a delivered credential cannot be un-delivered, R12.ii). We still attempt the wipe for
+        // a cooperative-online A target, but the rotation instruction is unconditional.
+        const mechARotation = mechanism === 'credential-transport';
+        // (ii) De-paired / hostile / MachineStatus==='revoked' — provider-side ONLY (S8/R12.i corrected).
+        if (posture === 'revoked') {
+            const rotation = this.rotationInstruction(req, 'Machine');
+            this.deps.log?.(`[account-follow-me] revoke ${req.accountId}→${req.targetMachineId}: de-paired/hostile — ` +
+                `provider-side de-authorization required (no remote wipe possible)`);
+            return {
+                state: 'provider-rotation-required',
+                accountId: req.accountId,
+                targetMachineId: req.targetMachineId,
+                providerRotationRequired: true,
+                providerRotation: rotation,
+                reason: 'de-paired-non-cooperative',
+            };
+        }
+        // (iii) Offline still-paired target — durable pending wipe, fired on reconnect (BOUNDED).
+        if (posture === 'offline') {
+            const t = this.now();
+            const record = {
+                accountId: req.accountId,
+                targetMachineId: req.targetMachineId,
+                mandateId: req.mandateId,
+                provider: req.provider,
+                accountEmail: req.accountEmail,
+                targetMachineNickname: req.targetMachineNickname,
+                mechanism,
+                revokedAt: t,
+                deadlineAt: t + this.deps.reconnectDeadlineMs(),
+            };
+            this.deps.pendingStore.put(record);
+            this.deps.log?.(`[account-follow-me] revoke ${req.accountId}→${req.targetMachineId}: target offline — ` +
+                `durable pending wipe (deadline +${this.deps.reconnectDeadlineMs()}ms)`);
+            return {
+                state: 'revocation-pending',
+                accountId: req.accountId,
+                targetMachineId: req.targetMachineId,
+                // For Mechanism A, rotate at provider NOW even while pending (the blob already landed).
+                providerRotationRequired: mechARotation,
+                providerRotation: mechARotation
+                    ? this.rotationInstruction(req, 'Offline machine')
+                    : undefined,
+                reason: 'target-offline-pending',
+            };
+        }
+        // (i) Cooperative, still-paired, ONLINE target — local & total wipe. Fail closed on any error.
+        let wipe;
+        try {
+            wipe = this.deps.cooperativeWipe(req);
+        }
+        catch (err) {
+            // The wipe threw — we CANNOT claim removed. Fail closed to a durable pending retry.
+            const t = this.now();
+            this.deps.pendingStore.put({
+                accountId: req.accountId,
+                targetMachineId: req.targetMachineId,
+                mandateId: req.mandateId,
+                provider: req.provider,
+                accountEmail: req.accountEmail,
+                targetMachineNickname: req.targetMachineNickname,
+                mechanism,
+                revokedAt: t,
+                deadlineAt: t + this.deps.reconnectDeadlineMs(),
+            });
+            this.deps.log?.(`[account-follow-me] revoke ${req.accountId}→${req.targetMachineId}: cooperative wipe THREW ` +
+                `(${err instanceof Error ? err.message : String(err)}) — fail-closed to pending`);
+            return {
+                state: 'revocation-pending',
+                accountId: req.accountId,
+                targetMachineId: req.targetMachineId,
+                providerRotationRequired: mechARotation,
+                providerRotation: mechARotation ? this.rotationInstruction(req, 'Machine') : undefined,
+                reason: 'cooperative-wipe-error',
+            };
+        }
+        const fullyWiped = wipe.loggedOut && wipe.slotDeleted && wipe.poolRemoved;
+        if (!fullyWiped) {
+            // Partial wipe — fail closed: do NOT claim removed; keep a durable pending so it retries.
+            const t = this.now();
+            this.deps.pendingStore.put({
+                accountId: req.accountId,
+                targetMachineId: req.targetMachineId,
+                mandateId: req.mandateId,
+                provider: req.provider,
+                accountEmail: req.accountEmail,
+                targetMachineNickname: req.targetMachineNickname,
+                mechanism,
+                revokedAt: t,
+                deadlineAt: t + this.deps.reconnectDeadlineMs(),
+            });
+            this.deps.log?.(`[account-follow-me] revoke ${req.accountId}→${req.targetMachineId}: partial wipe ` +
+                `(logout=${wipe.loggedOut} slot=${wipe.slotDeleted} pool=${wipe.poolRemoved}) — pending`);
+            return {
+                state: 'revocation-pending',
+                accountId: req.accountId,
+                targetMachineId: req.targetMachineId,
+                providerRotationRequired: mechARotation,
+                providerRotation: mechARotation ? this.rotationInstruction(req, 'Machine') : undefined,
+                wipe,
+                reason: 'cooperative-wipe-partial',
+            };
+        }
+        // Confirmed local & total. The pending record (if any earlier offline/error attempt) is cleared.
+        this.deps.pendingStore.remove(req.accountId, req.targetMachineId);
+        this.deps.log?.(`[account-follow-me] revoke ${req.accountId}→${req.targetMachineId}: removed (logout + slot + pool)`);
+        return {
+            state: mechARotation ? 'provider-rotation-required' : 'removed',
+            accountId: req.accountId,
+            targetMachineId: req.targetMachineId,
+            // Even a clean Mechanism-A wipe still requires provider rotation (blob was delivered).
+            providerRotationRequired: mechARotation,
+            providerRotation: mechARotation ? this.rotationInstruction(req, 'Machine') : undefined,
+            wipe,
+            reason: mechARotation ? 'wiped-but-mechanism-a-rotate' : 'wiped-local-and-total',
+        };
+    }
+    /**
+     * A previously-offline target reconnected — fire its durable pending wipe (R12.iii). Drives the
+     * SAME cooperative wipe as the online path; on success the pending record is cleared and we report
+     * `removed`. On failure/partial we keep the record (it may still escalate at the deadline).
+     * A no-op if no pending record exists for (account, target) or the feature is dark.
+     */
+    onTargetReconnect(accountId, targetMachineId) {
+        if (!this.deps.enabled())
+            return null;
+        const record = this.deps.pendingStore.get(accountId, targetMachineId);
+        if (!record)
+            return null;
+        const req = {
+            accountId: record.accountId,
+            accountEmail: record.accountEmail,
+            targetMachineId: record.targetMachineId,
+            targetMachineNickname: record.targetMachineNickname,
+            provider: record.provider,
+            mandateId: record.mandateId,
+            mechanism: record.mechanism,
+        };
+        // Reconnected ⇒ treat as cooperative-online and run the same wipe (revoke clears the record on success).
+        return this.revoke(req, 'cooperative-online');
+    }
+    /**
+     * Sweep durable pending wipes whose reconnect-deadline has passed and escalate each to a LOUD
+     * `revocation-FAILED — rotate at provider NOW` aggregated HIGH attention item (R12.iii give-up).
+     * Each escalated record is removed from the pending store (its honest end-state is now provider
+     * rotation, never a silently-aging "pending"). Returns the records that escalated. Caller runs
+     * this on a cadence (resume-queue drainer style). No-op when the feature is dark.
+     */
+    sweepDeadlines() {
+        if (!this.deps.enabled())
+            return [];
+        const t = this.now();
+        const escalated = [];
+        for (const record of this.deps.pendingStore.all()) {
+            if (record.deadlineAt > t)
+                continue; // still within the deadline — stays pending.
+            const item = {
+                id: `agent:account-follow-me-revoke-failed:${record.accountId}::${record.targetMachineId}`,
+                title: `Revocation FAILED on "${record.targetMachineNickname}" — rotate at ${record.provider} NOW`,
+                body: `I revoked access for ${record.accountEmail} on "${record.targetMachineNickname}", but that ` +
+                    `machine never reconnected to confirm its copy was destroyed. Its login may still be live. ` +
+                    `Rotate or de-authorize the credential at ${record.provider} now to be certain.`,
+                priority: 'high',
+                source: 'agent',
+            };
+            this.deps.emitRevocationFailed(item);
+            this.deps.pendingStore.remove(record.accountId, record.targetMachineId);
+            this.deps.log?.(`[account-follow-me] revoke ${record.accountId}→${record.targetMachineId}: pending wipe ` +
+                `EXCEEDED deadline — escalated to revocation-FAILED (rotate at ${record.provider})`);
+            escalated.push(item);
+        }
+        return escalated;
+    }
+    /**
+     * Honest dashboard state for an (account, target) pair: a live pending record reports
+     * `revocation-pending` (or `revocation-failed` once past its deadline), else null (no pending
+     * revocation in flight). Read surface — never mutates.
+     */
+    pendingStateFor(accountId, targetMachineId) {
+        const record = this.deps.pendingStore.get(accountId, targetMachineId);
+        if (!record)
+            return null;
+        return record.deadlineAt > this.now() ? 'revocation-pending' : 'revocation-failed';
+    }
+}
+//# sourceMappingURL=AccountFollowMeRevocation.js.map

package/dist/core/AccountFollowMeRevocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountFollowMeRevocation.js","sourceRoot":"","sources":["../../src/core/AccountFollowMeRevocation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AA+EH,MAAM,UAAU,wBAAwB;IACtC,MAAM,GAAG,GAAG,IAAI,GAAG,EAA6B,CAAC;IACjD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;IACnD,OAAO;QACL,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;KAC7B,CAAC;AACJ,CAAC;AAyCD,MAAM,OAAO,yBAAyB;IAEP;IADZ,GAAG,CAAe;IACnC,YAA6B,IAAmC;QAAnC,SAAI,GAAJ,IAAI,CAA+B;QAC9D,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,CAAC;IAEO,mBAAmB,CAAC,GAAsB,EAAE,IAAY;QAC9D,OAAO;YACL,IAAI,EAAE,4BAA4B;YAClC,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,eAAe,EAAE,GAAG,CAAC,eAAe;YACpC,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;YAChD,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,OAAO,EACL,GAAG,IAAI,KAAK,GAAG,CAAC,qBAAqB,oDAAoD;gBACzF,GAAG,GAAG,CAAC,YAAY,wEAAwE;gBAC3F,+BAA+B,GAAG,CAAC,QAAQ,cAAc;SAC5D,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,GAAsB,EAAE,OAAsB;QACnD,MAAM,SAAS,GAAwB,GAAG,CAAC,SAAS,IAAI,SAAS,CAAC;QAElE,qEAAqE;QACrE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YACzB,OAAO;gBACL,KAAK,EAAE,4BAA4B;gBACnC,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,wBAAwB,EAAE,KAAK;gBAC/B,MAAM,EAAE,kBAAkB;aAC3B,CAAC;QACJ,CAAC;QAED,+FAA+F;QAC/F,gGAAgG;QAChG,gFAAgF;QAChF,MAAM,aAAa,GAAG,SAAS,KAAK,sBAAsB,CAAC;QAE3D,kGAAkG;QAClG,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CACb,8BAA8B,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,eAAe,wBAAwB;gBACxF,mEAAmE,CACtE,CAAC;YACF,OAAO;gBACL,KAAK,EAAE,4BAA4B;gBACnC,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,wBAAwB,EAAE,IAAI;gBAC9B,gBAAgB,EAAE,QAAQ;gBAC1B,MAAM,EAAE,2BAA2B;aACpC,CAAC;QACJ,CAAC;QAED,0FAA0F;QAC1F,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACrB,MAAM,MAAM,GAAsB;gBAChC,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;gBAChD,SAAS;gBACT,SAAS,EAAE,CAAC;gBACZ,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE;aAChD,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CACb,8BAA8B,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,eAAe,qBAAqB;gBACrF,mCAAmC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,CAC1E,CAAC;YACF,OAAO;gBACL,KAAK,EAAE,oBAAoB;gBAC3B,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,wFAAwF;gBACxF,wBAAwB,EAAE,aAAa;gBACvC,gBAAgB,EAAE,aAAa;oBAC7B,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,iBAAiB,CAAC;oBAClD,CAAC,CAAC,SAAS;gBACb,MAAM,EAAE,wBAAwB;aACjC,CAAC;QACJ,CAAC;QAED,+FAA+F;QAC/F,IAAI,IAA2B,CAAC;QAChC,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oFAAoF;YACpF,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;gBACzB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;gBAChD,SAAS;gBACT,SAAS,EAAE,CAAC;gBACZ,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE;aAChD,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CACb,8BAA8B,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,eAAe,2BAA2B;gBAC3F,IAAI,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CACnF,CAAC;YACF,OAAO;gBACL,KAAK,EAAE,oBAAoB;gBAC3B,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,wBAAwB,EAAE,aAAa;gBACvC,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;gBACtF,MAAM,EAAE,wBAAwB;aACjC,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,0FAA0F;YAC1F,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;gBACzB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;gBAChD,SAAS;gBACT,SAAS,EAAE,CAAC;gBACZ,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE;aAChD,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CACb,8BAA8B,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,eAAe,iBAAiB;gBACjF,WAAW,IAAI,CAAC,SAAS,SAAS,IAAI,CAAC,WAAW,SAAS,IAAI,CAAC,WAAW,aAAa,CAC3F,CAAC;YACF,OAAO;gBACL,KAAK,EAAE,oBAAoB;gBAC3B,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,wBAAwB,EAAE,aAAa;gBACvC,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;gBACtF,IAAI;gBACJ,MAAM,EAAE,0BAA0B;aACnC,CAAC;QACJ,CAAC;QAED,iGAAiG;QACjG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CACb,8BAA8B,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,eAAe,kCAAkC,CACrG,CAAC;QACF,OAAO;YACL,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,SAAS;YAC/D,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,eAAe,EAAE,GAAG,CAAC,eAAe;YACpC,uFAAuF;YACvF,wBAAwB,EAAE,aAAa;YACvC,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;YACtF,IAAI;YACJ,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,uBAAuB;SACjF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,SAAiB,EAAE,eAAuB;QAC1D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,GAAG,GAAsB;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;YACnD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;QACF,yGAAyG;QACzG,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;OAMG;IACH,cAAc;QACZ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YAAE,OAAO,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,MAAM,SAAS,GAAgC,EAAE,CAAC;QAClD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC;YAClD,IAAI,MAAM,CAAC,UAAU,GAAG,CAAC;gBAAE,SAAS,CAAC,6CAA6C;YAClF,MAAM,IAAI,GAA8B;gBACtC,EAAE,EAAE,yCAAyC,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,eAAe,EAAE;gBAC1F,KAAK,EAAE,yBAAyB,MAAM,CAAC,qBAAqB,iBAAiB,MAAM,CAAC,QAAQ,MAAM;gBAClG,IAAI,EACF,wBAAwB,MAAM,CAAC,YAAY,QAAQ,MAAM,CAAC,qBAAqB,cAAc;oBAC7F,4FAA4F;oBAC5F,4CAA4C,MAAM,CAAC,QAAQ,qBAAqB;gBAClF,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE,OAAO;aAChB,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;YACxE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CACb,8BAA8B,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,eAAe,iBAAiB;gBACvF,iEAAiE,MAAM,CAAC,QAAQ,GAAG,CACtF,CAAC;YACF,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,SAAiB,EAAE,eAAuB;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,mBAAmB,CAAC;IACrF,CAAC;CACF"}

package/dist/core/resolveFollowMeEnrollTarget.d.ts

@@ -0,0 +1,54 @@
+/**
+ * WS5.2 §5.3 / S7 — resolve the OPERATOR-APPROVED enrollment target for an account, AUTHORITATIVELY,
+ * from real pool state — NEVER from the request body. This is the keystone of the email-safety gate:
+ * `expectedEmail` MUST be what the operator approved (the account's known email across the mesh), so
+ * `completeFollowMe` can later validate the freshly-minted login against it. A self-asserted email in
+ * the request body would defeat the gate entirely (S7), so this function only ever reads from the same
+ * authoritative source the scan uses: the local SubscriptionPool + the per-peer pool views (which
+ * carry each account's id + email from the replicated `subscription-account-meta` projection).
+ *
+ * FAIL-CLOSED by construction: if the account's email cannot be resolved from any holder, this returns
+ * `{ resolved: false }` and the caller MUST refuse (409) rather than starting an enrollment with a
+ * blank/wrong expectedEmail. Pure (no I/O) ⇒ unit-testable; the route supplies the fetched views.
+ */
+import type { MachinePoolView } from './accountFollowMeDepth.js';
+/** A local SubscriptionPool account row, as the resolver needs it. */
+export interface LocalAccountRow {
+    id: string;
+    email?: string;
+    nickname?: string;
+    provider?: string;
+    framework?: string;
+}
+export interface ResolveFollowMeEnrollTargetInput {
+    accountId: string;
+    /** This machine's local SubscriptionPool accounts (authoritative when the account is held here). */
+    localAccounts: LocalAccountRow[];
+    /** Cross-machine per-peer pool views (the same source the scan uses — carries id + email). */
+    peerViews: MachinePoolView[];
+    /** Fallbacks when the meta does not carry provider/framework (it usually does). */
+    defaultProvider?: string;
+    defaultFramework?: string;
+}
+export type ResolveFollowMeEnrollTargetResult = {
+    resolved: true;
+    /** The OPERATOR-APPROVED account email (authoritative; never from the request body). */
+    expectedEmail: string;
+    provider: string;
+    framework: string;
+    /** Operator-facing label for the new pending login. */
+    label: string;
+} | {
+    resolved: false;
+    reason: string;
+};
+/**
+ * Resolve the approved email + provider/framework + label for `accountId`.
+ *
+ * Resolution order (authoritative-first):
+ *   1. the LOCAL SubscriptionPool (if this machine already holds/knows the account) — most trustworthy;
+ *   2. any PEER pool view that reports the account with a non-empty email (the replicated meta).
+ * The email MUST be a non-empty string for the result to be `resolved` — otherwise fail-closed.
+ */
+export declare function resolveFollowMeEnrollTarget(input: ResolveFollowMeEnrollTargetInput): ResolveFollowMeEnrollTargetResult;
+//# sourceMappingURL=resolveFollowMeEnrollTarget.d.ts.map

package/dist/core/resolveFollowMeEnrollTarget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveFollowMeEnrollTarget.d.ts","sourceRoot":"","sources":["../../src/core/resolveFollowMeEnrollTarget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAEjE,sEAAsE;AACtE,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gCAAgC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,aAAa,EAAE,eAAe,EAAE,CAAC;IACjC,8FAA8F;IAC9F,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,iCAAiC,GACzC;IACE,QAAQ,EAAE,IAAI,CAAC;IACf,wFAAwF;IACxF,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;CACf,GACD;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,gCAAgC,GACtC,iCAAiC,CAoCnC"}

package/dist/core/resolveFollowMeEnrollTarget.js

@@ -0,0 +1,57 @@
+/**
+ * WS5.2 §5.3 / S7 — resolve the OPERATOR-APPROVED enrollment target for an account, AUTHORITATIVELY,
+ * from real pool state — NEVER from the request body. This is the keystone of the email-safety gate:
+ * `expectedEmail` MUST be what the operator approved (the account's known email across the mesh), so
+ * `completeFollowMe` can later validate the freshly-minted login against it. A self-asserted email in
+ * the request body would defeat the gate entirely (S7), so this function only ever reads from the same
+ * authoritative source the scan uses: the local SubscriptionPool + the per-peer pool views (which
+ * carry each account's id + email from the replicated `subscription-account-meta` projection).
+ *
+ * FAIL-CLOSED by construction: if the account's email cannot be resolved from any holder, this returns
+ * `{ resolved: false }` and the caller MUST refuse (409) rather than starting an enrollment with a
+ * blank/wrong expectedEmail. Pure (no I/O) ⇒ unit-testable; the route supplies the fetched views.
+ */
+/**
+ * Resolve the approved email + provider/framework + label for `accountId`.
+ *
+ * Resolution order (authoritative-first):
+ *   1. the LOCAL SubscriptionPool (if this machine already holds/knows the account) — most trustworthy;
+ *   2. any PEER pool view that reports the account with a non-empty email (the replicated meta).
+ * The email MUST be a non-empty string for the result to be `resolved` — otherwise fail-closed.
+ */
+export function resolveFollowMeEnrollTarget(input) {
+    const { accountId } = input;
+    const defaultProvider = input.defaultProvider ?? 'anthropic';
+    const defaultFramework = input.defaultFramework ?? 'claude-code';
+    // 1) Local pool — most authoritative when present.
+    const local = input.localAccounts.find((a) => a.id === accountId);
+    if (local && typeof local.email === 'string' && local.email.trim().length > 0) {
+        return {
+            resolved: true,
+            expectedEmail: local.email.trim(),
+            provider: (local.provider && local.provider.length > 0) ? local.provider : defaultProvider,
+            framework: (local.framework && local.framework.length > 0) ? local.framework : defaultFramework,
+            label: (local.nickname && local.nickname.trim().length > 0) ? local.nickname.trim() : accountId,
+        };
+    }
+    // 2) Peer views — the replicated meta projection (carries id + email).
+    for (const view of input.peerViews) {
+        for (const row of view.accounts) {
+            if (row.accountId !== accountId)
+                continue;
+            if (typeof row.email === 'string' && row.email.trim().length > 0) {
+                return {
+                    resolved: true,
+                    expectedEmail: row.email.trim(),
+                    // Peer view rows carry only id/email/status; provider/framework default for a re-mint
+                    // (the target machine logs in with its own framework — claude-code/anthropic by default).
+                    provider: defaultProvider,
+                    framework: defaultFramework,
+                    label: accountId,
+                };
+            }
+        }
+    }
+    return { resolved: false, reason: 'cannot resolve approved account email' };
+}
+//# sourceMappingURL=resolveFollowMeEnrollTarget.js.map

package/dist/core/resolveFollowMeEnrollTarget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveFollowMeEnrollTarget.js","sourceRoot":"","sources":["../../src/core/resolveFollowMeEnrollTarget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAoCH;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAAuC;IAEvC,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IAC5B,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,WAAW,CAAC;IAC7D,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,IAAI,aAAa,CAAC;IAEjE,mDAAmD;IACnD,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;IAClE,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9E,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE;YACjC,QAAQ,EAAE,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe;YAC1F,SAAS,EAAE,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB;YAC/F,KAAK,EAAE,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;SAChG,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACnC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChC,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS;gBAAE,SAAS;YAC1C,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjE,OAAO;oBACL,QAAQ,EAAE,IAAI;oBACd,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;oBAC/B,sFAAsF;oBACtF,0FAA0F;oBAC1F,QAAQ,EAAE,eAAe;oBACzB,SAAS,EAAE,gBAAgB;oBAC3B,KAAK,EAAE,SAAS;iBACjB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;AAC9E,CAAC"}