instar 1.3.617 → 1.3.619

package/dashboard/subscriptions.js

@@ -172,6 +172,80 @@ export function renderAccounts(doc, target, accounts, now = Date.now(), inUseAcc
   }
 }
 
+/**
+ * Account Follow-Me — the ONE-TAP Approve card (ws52-operator-tap-not-text Part A).
+ * Renders a scan consent-offer as a plain-language card the operator APPROVES with a
+ * single PIN tap — never a JSON/fingerprint paste (the 2026-06-17 operator feedback:
+ * "operators act in taps, not text"). All operator-facing values are sanitized TEXT;
+ * the only machine-readable data on the card are the NON-SENSITIVE account/target ids
+ * as data-* attributes (used to find the offer on Approve). The agent fingerprints
+ * (FD2) are NEVER placed in the DOM — they live in the controller's offer state and
+ * are sent server-side at POST time. By construction this card carries zero raw
+ * technical text, so it PASSES the arm-1 operator-surface gate.
+ */
+export function renderFollowMeApproveCard(doc, offer) {
+  const card = el(doc, 'div', 'sub-followme-offer');
+  // Non-sensitive identifiers, for the Approve handler to resolve the offer. NOT
+  // operator-facing text; never a fingerprint/JSON.
+  card.setAttribute('data-account-id', sanitizeForDisplay(offer && offer.accountId, 'label'));
+  card.setAttribute('data-target-machine-id', sanitizeForDisplay(offer && offer.targetMachineId, 'label'));
+
+  const machine = sanitizeForDisplay(offer && offer.machineNickname, 'label');
+  const account = sanitizeForDisplay(offer && offer.accountLabel, 'label');
+  card.appendChild(el(doc, 'div', 'sub-followme-headline',
+    `Let ${machine} use your ${account} subscription`));
+  card.appendChild(el(doc, 'div', 'sub-followme-sub',
+    sanitizeForDisplay(offer && offer.expiryText, 'summary') || 'Authorizes this one setup, then expires.'));
+
+  const pin = doc.createElement('input');
+  pin.setAttribute('type', 'password');
+  pin.setAttribute('class', 'sub-followme-pin');
+  pin.setAttribute('placeholder', 'Your PIN'); // a PIN box, not a technical value
+  pin.setAttribute('autocomplete', 'off');
+  card.appendChild(pin);
+
+  const approve = el(doc, 'button', 'sub-followme-approve', 'Approve');
+  approve.setAttribute('data-followme-approve', '1');
+  card.appendChild(approve);
+  return card;
+}
+
+/** Render the list of follow-me consent offers as one-tap Approve cards (or nothing if none). */
+export function renderFollowMeOffers(doc, target, offers) {
+  if (!target) return;
+  target.replaceChildren();
+  if (!Array.isArray(offers) || offers.length === 0) return; // silent when nothing to offer
+  target.appendChild(el(doc, 'div', 'sub-followme-title', 'Let another machine use a subscription'));
+  for (const offer of offers) target.appendChild(renderFollowMeApproveCard(doc, offer));
+}
+
+/**
+ * Build the /mandate/issue-for-machine payload from a tapped Approve card + the
+ * held offers + the operator's PIN (ws52-operator-tap-not-text Part A). Pure: the
+ * card carries only the non-sensitive account/target ids; the agent fingerprints
+ * (FD2) come from the matched offer in controller state — the operator never typed
+ * them. Returns the payload, or `{ error }` for a missing PIN, or null when the
+ * card has no matching offer / the offer lacks its FD2 agent pair (fail-closed —
+ * never POST an under-specified mandate request).
+ */
+export function buildFollowMeIssuePayload(card, offers, pinValue) {
+  if (!card || typeof card.getAttribute !== 'function') return null;
+  const accountId = card.getAttribute('data-account-id');
+  const targetMachineId = card.getAttribute('data-target-machine-id');
+  if (!accountId || !targetMachineId) return null;
+  const offer = (Array.isArray(offers) ? offers : []).find(
+    (o) => o && o.accountId === accountId && o.targetMachineId === targetMachineId,
+  );
+  if (!offer) return null; // unknown/stale card — never POST
+  if (!Array.isArray(offer.agents) || offer.agents.length !== 2
+      || offer.agents.some((a) => typeof a !== 'string' || !a)) {
+    return null; // FD2 agent pair missing — fail-closed
+  }
+  const pin = typeof pinValue === 'string' ? pinValue.trim() : '';
+  if (!pin) return { error: 'pin-required' };
+  return { pin, accountId, targetMachineId, agents: [offer.agents[0], offer.agents[1]] };
+}
+
 /** Pending Logins panel: device code / verification URL (as TEXT) + TTL + reissues. */
 export function renderPendingLogins(doc, target, logins, now = Date.now()) {
   if (!target) return;

package/dist/coordination/AccountFollowMeOperatorOutbox.d.ts

@@ -0,0 +1,42 @@
+export interface OperatorOutboxRecord {
+    /** `${ledgerKey}::${state}` — the dedup unit (one message per ledger state). */
+    dedupKey: string;
+    /** The event that first emitted for this (ledgerKey,state) — audit + idempotency. */
+    eventId: string;
+    ledgerKey: string;
+    state: string;
+    emittedAt: string;
+}
+export interface OperatorOutboxDeps {
+    filePath: string;
+    now?: () => number;
+}
+export declare class AccountFollowMeOperatorOutbox {
+    private readonly d;
+    constructor(deps: OperatorOutboxDeps);
+    private now;
+    private dedupKey;
+    private readAll;
+    private writeAll;
+    /**
+     * Atomically decide whether to emit an operator message for this (ledgerKey,state).
+     * Returns `{ emit:true }` exactly once per (ledgerKey,state) — the FIRST caller
+     * records and emits; every subsequent caller (redelivery/restart/retry, regardless
+     * of eventId) gets `{ emit:false }`. This is the "at most one message per ledger
+     * state" guarantee.
+     */
+    claimEmit(args: {
+        ledgerKey: string;
+        state: string;
+        eventId: string;
+    }): {
+        emit: boolean;
+        firstEventId: string;
+    };
+    /** Has a message already been emitted for this (ledgerKey,state)? (read-only) */
+    hasEmitted(ledgerKey: string, state: string): boolean;
+    /** Drop all outbox records for a ledger key (e.g. when the pair is removed/revoked). Idempotent. */
+    clearLedger(ledgerKey: string): void;
+    list(): OperatorOutboxRecord[];
+}
+//# sourceMappingURL=AccountFollowMeOperatorOutbox.d.ts.map

package/dist/coordination/AccountFollowMeOperatorOutbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountFollowMeOperatorOutbox.d.ts","sourceRoot":"","sources":["../../src/coordination/AccountFollowMeOperatorOutbox.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,oBAAoB;IACnC,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,qFAAqF;IACrF,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAqB;gBAC3B,IAAI,EAAE,kBAAkB;IAIpC,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,OAAO;IAUf,OAAO,CAAC,QAAQ;IAKhB;;;;;;OAMG;IACH,SAAS,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG;QACtE,IAAI,EAAE,OAAO,CAAC;QACd,YAAY,EAAE,MAAM,CAAC;KACtB;IAkBD,iFAAiF;IACjF,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAIrD,oGAAoG;IACpG,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAMpC,IAAI,IAAI,oBAAoB,EAAE;CAG/B"}

package/dist/coordination/AccountFollowMeOperatorOutbox.js

@@ -0,0 +1,81 @@
+/**
+ * WS5.2 (ws52-operator-tap-not-text Part B, R3.3) — durable operator-message outbox.
+ *
+ * The cross-model pass (codex) flagged that "exactly one tappable link / one failure
+ * message" is unachievable across mesh redelivery, fronting-machine restart, and
+ * retry WITHOUT a durable, idempotent outbox. This store guarantees AT MOST ONE
+ * visible operator message PER LEDGER STATE: the first claim for a
+ * (ledgerKey, state) pair emits; every later claim for the SAME (ledgerKey, state)
+ * — a redelivery, a restart replay, a retry — is suppressed. A genuine state
+ * TRANSITION (enroll-in-flight → login-issued → failed) is a new (ledgerKey, state)
+ * key, so each distinct state surfaces its own single message.
+ *
+ * fs-backed (the DeliveredMandateStore pattern), pure + unit-testable.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+export class AccountFollowMeOperatorOutbox {
+    d;
+    constructor(deps) {
+        this.d = deps;
+    }
+    now() {
+        return this.d.now ? this.d.now() : Date.now();
+    }
+    dedupKey(ledgerKey, state) {
+        return `${ledgerKey}::${state}`;
+    }
+    readAll() {
+        try {
+            const raw = JSON.parse(fs.readFileSync(this.d.filePath, 'utf8'));
+            return Array.isArray(raw) ? raw : [];
+        }
+        catch {
+            // @silent-fallback-ok — no outbox yet ⇒ nothing emitted ⇒ first claim should emit.
+            return [];
+        }
+    }
+    writeAll(records) {
+        fs.mkdirSync(path.dirname(this.d.filePath), { recursive: true });
+        fs.writeFileSync(this.d.filePath, JSON.stringify(records, null, 2));
+    }
+    /**
+     * Atomically decide whether to emit an operator message for this (ledgerKey,state).
+     * Returns `{ emit:true }` exactly once per (ledgerKey,state) — the FIRST caller
+     * records and emits; every subsequent caller (redelivery/restart/retry, regardless
+     * of eventId) gets `{ emit:false }`. This is the "at most one message per ledger
+     * state" guarantee.
+     */
+    claimEmit(args) {
+        const key = this.dedupKey(args.ledgerKey, args.state);
+        const all = this.readAll();
+        const existing = all.find((r) => r.dedupKey === key);
+        if (existing) {
+            return { emit: false, firstEventId: existing.eventId };
+        }
+        const record = {
+            dedupKey: key,
+            eventId: args.eventId,
+            ledgerKey: args.ledgerKey,
+            state: args.state,
+            emittedAt: new Date(this.now()).toISOString(),
+        };
+        this.writeAll([...all, record]);
+        return { emit: true, firstEventId: args.eventId };
+    }
+    /** Has a message already been emitted for this (ledgerKey,state)? (read-only) */
+    hasEmitted(ledgerKey, state) {
+        return this.readAll().some((r) => r.dedupKey === this.dedupKey(ledgerKey, state));
+    }
+    /** Drop all outbox records for a ledger key (e.g. when the pair is removed/revoked). Idempotent. */
+    clearLedger(ledgerKey) {
+        const all = this.readAll();
+        const next = all.filter((r) => r.ledgerKey !== ledgerKey);
+        if (next.length !== all.length)
+            this.writeAll(next);
+    }
+    list() {
+        return this.readAll();
+    }
+}
+//# sourceMappingURL=AccountFollowMeOperatorOutbox.js.map

package/dist/coordination/AccountFollowMeOperatorOutbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountFollowMeOperatorOutbox.js","sourceRoot":"","sources":["../../src/coordination/AccountFollowMeOperatorOutbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAiB7B,MAAM,OAAO,6BAA6B;IACvB,CAAC,CAAqB;IACvC,YAAY,IAAwB;QAClC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAChB,CAAC;IAEO,GAAG;QACT,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IAChD,CAAC;IAEO,QAAQ,CAAC,SAAiB,EAAE,KAAa;QAC/C,OAAO,GAAG,SAAS,KAAK,KAAK,EAAE,CAAC;IAClC,CAAC;IAEO,OAAO;QACb,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;YACjE,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAA8B,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,mFAAmF;YACnF,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,OAA+B;QAC9C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,IAA2D;QAInE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC;QACrD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QACzD,CAAC;QACD,MAAM,MAAM,GAAyB;YACnC,QAAQ,EAAE,GAAG;YACb,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;SAC9C,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACpD,CAAC;IAED,iFAAiF;IACjF,UAAU,CAAC,SAAiB,EAAE,KAAa;QACzC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,oGAAoG;IACpG,WAAW,CAAC,SAAiB;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;YAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/coordination/AccountFollowMeSingleFlight.d.ts

@@ -0,0 +1,68 @@
+export type SingleFlightState = 'enroll-in-flight' | 'login-issued' | 'completed' | 'failed';
+export interface SingleFlightRecord {
+    /** `${accountId}::${targetMachineId}` (canonical account id). */
+    key: string;
+    state: SingleFlightState;
+    /** The fronting machine that owns this enroll loop (provenance; this store is per-machine). */
+    frontingMachineId: string;
+    /** The mandate authorizing this enrollment. */
+    mandateId: string;
+    /** Opaque holder token (e.g. a process/run id) for dead-holder auto-heal. */
+    holder: string;
+    updatedAt: string;
+    /** While ACTIVE, the wall-clock (ms) past which the holder is presumed dead and the pair is reclaimable. */
+    ttlExpiresAt: number;
+}
+export interface SingleFlightDeps {
+    /** Absolute path to the ledger JSON file. */
+    filePath: string;
+    /** Injectable clock (ms) for tests. */
+    now?: () => number;
+}
+export declare function singleFlightKey(accountId: string, targetMachineId: string): string;
+export interface ClaimInput {
+    accountId: string;
+    targetMachineId: string;
+    frontingMachineId: string;
+    mandateId: string;
+    holder: string;
+    /** How long the enroll-in-flight claim is valid before a dead-holder reclaim is allowed. */
+    ttlMs: number;
+}
+export declare class AccountFollowMeSingleFlight {
+    private readonly d;
+    constructor(deps: SingleFlightDeps);
+    private now;
+    private readAll;
+    private writeAll;
+    get(key: string): SingleFlightRecord | undefined;
+    /** A pair is LIVE (refuse re-claim, suppress scan re-offer) iff it is in an active state AND not past its TTL. */
+    isActive(key: string): boolean;
+    /**
+     * The single-flight gate. Atomically claims (account,target) → `enroll-in-flight`
+     * iff no LIVE record exists. Returns `{ claimed:false }` while another enroll is
+     * genuinely in flight (the duplicate-login guard). A dead-holder (TTL lapsed) or a
+     * terminal record (completed/failed/absent) is re-claimable.
+     */
+    tryClaim(input: ClaimInput): {
+        claimed: boolean;
+        record: SingleFlightRecord;
+    };
+    /**
+     * Move a claimed pair to a new state. Refreshes the TTL for the still-active
+     * `login-issued` state (the operator now has a window to tap the link); terminal
+     * states clear the TTL window. Refuses to transition a key the caller does not
+     * hold (holder mismatch) so a stale actor can't stomp a live claim. No-op if absent.
+     */
+    transition(key: string, to: SingleFlightState, holder: string, opts?: {
+        ttlMs?: number;
+    }): {
+        ok: boolean;
+        reason?: string;
+        record?: SingleFlightRecord;
+    };
+    /** Drop a record entirely (e.g. on revocation of the pair's mandate). Idempotent. */
+    remove(key: string): void;
+    list(): SingleFlightRecord[];
+}
+//# sourceMappingURL=AccountFollowMeSingleFlight.d.ts.map

package/dist/coordination/AccountFollowMeSingleFlight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountFollowMeSingleFlight.d.ts","sourceRoot":"","sources":["../../src/coordination/AccountFollowMeSingleFlight.ts"],"names":[],"mappings":"AAiCA,MAAM,MAAM,iBAAiB,GACzB,kBAAkB,GAClB,cAAc,GACd,WAAW,GACX,QAAQ,CAAC;AAKb,MAAM,WAAW,kBAAkB;IACjC,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,iBAAiB,CAAC;IACzB,+FAA+F;IAC/F,iBAAiB,EAAE,MAAM,CAAC;IAC1B,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,4GAA4G;IAC5G,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAElF;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAmB;gBACzB,IAAI,EAAE,gBAAgB;IAIlC,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,OAAO;IAUf,OAAO,CAAC,QAAQ;IAKhB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIhD,kHAAkH;IAClH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAM9B;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,kBAAkB,CAAA;KAAE;IAsB7E;;;;;OAKG;IACH,UAAU,CACR,GAAG,EAAE,MAAM,EACX,EAAE,EAAE,iBAAiB,EACrB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACxB;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,kBAAkB,CAAA;KAAE;IAoBhE,qFAAqF;IACrF,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAMzB,IAAI,IAAI,kBAAkB,EAAE;CAG7B"}

package/dist/coordination/AccountFollowMeSingleFlight.js

@@ -0,0 +1,135 @@
+/**
+ * WS5.2 (ws52-operator-tap-not-text Part B) — DURABLE single-flight ledger for the
+ * account-follow-me cross-machine enroll connector.
+ *
+ * The convergence pass found that the live "single-flight per (account,target)"
+ * guarantee was wired as `inFlight: () => new Set()` — a fresh empty set every
+ * call, i.e. a NO-OP. A re-delivery, a restart, or a double-tap each spawned a new
+ * device-code login. This store is the real, durable, restart-surviving guarantee.
+ *
+ * It is a small state machine keyed `${accountId}::${targetMachineId}` (R3.1: the
+ * CANONICAL pool account id, owned within THIS fronting machine's ledger — the
+ * store is per-machine, so the frontingMachineId is recorded for provenance and a
+ * different fronting context cannot suppress this one's offers):
+ *
+ *   (absent) --tryClaim--> enroll-in-flight --markLoginIssued--> login-issued
+ *                                |                                    |
+ *                                v                                    v
+ *                              failed <----markFailed------------ completed
+ *
+ * `tryClaim` is the single-flight gate: it succeeds ONLY when there is no LIVE
+ * in-flight record (absent / completed / failed / a dead-holder whose TTL lapsed).
+ * While a pair is `enroll-in-flight` or `login-issued`, a second claim is REFUSED —
+ * so a re-delivery/restart/double-tap collapses to one login. A crash mid-enroll is
+ * self-healed: a claim past `ttlExpiresAt` reclaims the dead holder (PR-hand-lease
+ * pattern). `completed`/`failed` are terminal-but-re-armable: a genuinely fresh
+ * delivery can re-claim the pair (a new mandate, after the prior cycle closed).
+ *
+ * Pure + fs-backed (the DeliveredMandateStore pattern) so both sides of every
+ * transition are unit-testable without a server.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+/** The states in which a pair is LIVE — re-claim is refused and the scan must not re-offer. */
+const ACTIVE_STATES = new Set(['enroll-in-flight', 'login-issued']);
+export function singleFlightKey(accountId, targetMachineId) {
+    return `${accountId}::${targetMachineId}`;
+}
+export class AccountFollowMeSingleFlight {
+    d;
+    constructor(deps) {
+        this.d = deps;
+    }
+    now() {
+        return this.d.now ? this.d.now() : Date.now();
+    }
+    readAll() {
+        try {
+            const raw = JSON.parse(fs.readFileSync(this.d.filePath, 'utf8'));
+            return Array.isArray(raw) ? raw : [];
+        }
+        catch {
+            // @silent-fallback-ok — no ledger yet; an empty ledger means "nothing in flight" (safe).
+            return [];
+        }
+    }
+    writeAll(records) {
+        fs.mkdirSync(path.dirname(this.d.filePath), { recursive: true });
+        fs.writeFileSync(this.d.filePath, JSON.stringify(records, null, 2));
+    }
+    get(key) {
+        return this.readAll().find((r) => r.key === key);
+    }
+    /** A pair is LIVE (refuse re-claim, suppress scan re-offer) iff it is in an active state AND not past its TTL. */
+    isActive(key) {
+        const r = this.get(key);
+        if (!r || !ACTIVE_STATES.has(r.state))
+            return false;
+        return this.now() <= r.ttlExpiresAt; // a lapsed holder is NOT live (reclaimable)
+    }
+    /**
+     * The single-flight gate. Atomically claims (account,target) → `enroll-in-flight`
+     * iff no LIVE record exists. Returns `{ claimed:false }` while another enroll is
+     * genuinely in flight (the duplicate-login guard). A dead-holder (TTL lapsed) or a
+     * terminal record (completed/failed/absent) is re-claimable.
+     */
+    tryClaim(input) {
+        const key = singleFlightKey(input.accountId, input.targetMachineId);
+        const all = this.readAll();
+        const existing = all.find((r) => r.key === key);
+        const now = this.now();
+        const live = existing && ACTIVE_STATES.has(existing.state) && now <= existing.ttlExpiresAt;
+        if (live) {
+            return { claimed: false, record: existing };
+        }
+        const record = {
+            key,
+            state: 'enroll-in-flight',
+            frontingMachineId: input.frontingMachineId,
+            mandateId: input.mandateId,
+            holder: input.holder,
+            updatedAt: new Date(now).toISOString(),
+            ttlExpiresAt: now + Math.max(0, input.ttlMs),
+        };
+        this.writeAll([...all.filter((r) => r.key !== key), record]);
+        return { claimed: true, record };
+    }
+    /**
+     * Move a claimed pair to a new state. Refreshes the TTL for the still-active
+     * `login-issued` state (the operator now has a window to tap the link); terminal
+     * states clear the TTL window. Refuses to transition a key the caller does not
+     * hold (holder mismatch) so a stale actor can't stomp a live claim. No-op if absent.
+     */
+    transition(key, to, holder, opts) {
+        const all = this.readAll();
+        const idx = all.findIndex((r) => r.key === key);
+        if (idx < 0)
+            return { ok: false, reason: 'absent' };
+        if (all[idx].holder !== holder)
+            return { ok: false, reason: 'holder-mismatch' };
+        const now = this.now();
+        const ttlExpiresAt = ACTIVE_STATES.has(to)
+            ? now + Math.max(0, opts?.ttlMs ?? 0)
+            : 0;
+        const next = {
+            ...all[idx],
+            state: to,
+            updatedAt: new Date(now).toISOString(),
+            ttlExpiresAt,
+        };
+        all[idx] = next;
+        this.writeAll(all);
+        return { ok: true, record: next };
+    }
+    /** Drop a record entirely (e.g. on revocation of the pair's mandate). Idempotent. */
+    remove(key) {
+        const all = this.readAll();
+        const next = all.filter((r) => r.key !== key);
+        if (next.length !== all.length)
+            this.writeAll(next);
+    }
+    list() {
+        return this.readAll();
+    }
+}
+//# sourceMappingURL=AccountFollowMeSingleFlight.js.map

package/dist/coordination/AccountFollowMeSingleFlight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountFollowMeSingleFlight.js","sourceRoot":"","sources":["../../src/coordination/AccountFollowMeSingleFlight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAQ7B,+FAA+F;AAC/F,MAAM,aAAa,GAAmC,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC,CAAC;AAwBpG,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,eAAuB;IACxE,OAAO,GAAG,SAAS,KAAK,eAAe,EAAE,CAAC;AAC5C,CAAC;AAYD,MAAM,OAAO,2BAA2B;IACrB,CAAC,CAAmB;IACrC,YAAY,IAAsB;QAChC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAChB,CAAC;IAEO,GAAG;QACT,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IAChD,CAAC;IAEO,OAAO;QACb,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;YACjE,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,yFAAyF;YACzF,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,OAA6B;QAC5C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACnD,CAAC;IAED,kHAAkH;IAClH,QAAQ,CAAC,GAAW;QAClB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACpD,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,4CAA4C;IACnF,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,KAAiB;QACxB,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,QAAQ,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,QAAQ,CAAC,YAAY,CAAC;QAC3F,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAS,EAAE,CAAC;QAC/C,CAAC;QACD,MAAM,MAAM,GAAuB;YACjC,GAAG;YACH,KAAK,EAAE,kBAAkB;YACzB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YACtC,YAAY,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC;SAC7C,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC;IAED;;;;;OAKG;IACH,UAAU,CACR,GAAW,EACX,EAAqB,EACrB,MAAc,EACd,IAAyB;QAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QAChD,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACpD,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QAChF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC;YACrC,CAAC,CAAC,CAAC,CAAC;QACN,MAAM,IAAI,GAAuB;YAC/B,GAAG,GAAG,CAAC,GAAG,CAAC;YACX,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YACtC,YAAY;SACb,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QAChB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC;IAED,qFAAqF;IACrF,MAAM,CAAC,GAAW;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;YAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/coordination/driveFollowMeEnrollment.d.ts

@@ -0,0 +1,80 @@
+/**
+ * WS5.2 (ws52-operator-tap-not-text Part B) — the durable enroll CONSUMER's
+ * orchestration: drive ONE delivered account-follow-me mandate through enrollment,
+ * fail-closed, single-flight-guarded, with honest single-emission operator
+ * surfacing. This is the heart of the connector — the piece whose absence
+ * (`onMandateDelivered` had no callers) made the proof stall silently.
+ *
+ * It is dependency-INJECTED so the risky orchestration logic (the sequence, the
+ * fail-closed branches, the "exactly one operator message" surfacing, the
+ * no-silent-stall guarantee) is unit-testable without the real EnrollmentWizard,
+ * stores, or mesh. The real-dep wiring (the actual wizard / single-flight /
+ * outbox / mesh status verb) is mechanical and lands at integration.
+ *
+ * Invariants enforced here (from the convergence):
+ *  - Point-of-use re-verify (bounds+expiry+revocation) BEFORE any enroll (#3).
+ *  - Single-flight: a second drive for a LIVE pair is a no-op (#2).
+ *  - Honest surfacing: EVERY terminal outcome (login-issued OR failed) produces
+ *    exactly one operator message via the outbox (R3.3) — no silent stall.
+ *  - Fail-closed: any thrown dependency ⇒ a recorded `failed` + one failure message,
+ *    never an unrecorded crash.
+ */
+import type { AccountFollowMeSingleFlight } from './AccountFollowMeSingleFlight.js';
+import type { AccountFollowMeOperatorOutbox } from './AccountFollowMeOperatorOutbox.js';
+export interface LoginArtifact {
+    verificationUrl: string;
+    userCode: string;
+    ttlMs: number;
+}
+export interface DriveEnrollDeps {
+    singleFlight: AccountFollowMeSingleFlight;
+    outbox: AccountFollowMeOperatorOutbox;
+    /** Live revocation oracle (local flag + durable record); a throw ⇒ fail-closed. */
+    isRevoked: (mandateId: string) => boolean;
+    /** Drive the local re-mint; resolves a LoginArtifact (URL+code, never a token) or throws. */
+    startEnrollment: (args: {
+        accountId: string;
+        mandateId: string;
+    }) => Promise<LoginArtifact>;
+    /** Surface to the operator on the FRONTING machine (fail-closed if no verified topic). Returns delivered?. */
+    surfaceToOperator: (msg: {
+        kind: 'login-link' | 'failure';
+        accountId: string;
+        targetMachineId: string;
+        login?: LoginArtifact;
+        reason?: string;
+    }) => Promise<boolean>;
+    now: () => number;
+    frontingMachineId: string;
+    /** This drive's holder token (process/run id) for single-flight ownership. */
+    holder: string;
+    /** Single-flight claim TTL (dead-holder reclaim window). */
+    claimTtlMs: number;
+    /** Login-link visibility window written onto the login-issued ledger state. */
+    loginTtlMs: number;
+}
+export interface DriveEnrollInput {
+    mandateId: string;
+    expiresAt: string;
+    bounds: {
+        accountId: string;
+        targetMachineId: string;
+    };
+    requested: {
+        accountId: string;
+        targetMachineId: string;
+    };
+    /** A stable id for THIS delivery event (drives outbox idempotency). */
+    eventId: string;
+}
+export type DriveEnrollOutcome = {
+    ok: true;
+    state: 'login-issued';
+    login: LoginArtifact;
+} | {
+    ok: false;
+    state: 'denied' | 'in-flight' | 'failed';
+    reason: string;
+};
+export declare function driveFollowMeEnrollment(deps: DriveEnrollDeps, input: DriveEnrollInput): Promise<DriveEnrollOutcome>;
+//# sourceMappingURL=driveFollowMeEnrollment.d.ts.map

package/dist/coordination/driveFollowMeEnrollment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"driveFollowMeEnrollment.d.ts","sourceRoot":"","sources":["../../src/coordination/driveFollowMeEnrollment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACpF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AAIxF,MAAM,WAAW,aAAa;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,2BAA2B,CAAC;IAC1C,MAAM,EAAE,6BAA6B,CAAC;IACtC,mFAAmF;IACnF,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IAC1C,6FAA6F;IAC7F,eAAe,EAAE,CAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5F,8GAA8G;IAC9G,iBAAiB,EAAE,CAAC,GAAG,EAAE;QACvB,IAAI,EAAE,YAAY,GAAG,SAAS,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,MAAM,CAAC;QACxB,KAAK,CAAC,EAAE,aAAa,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvB,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,SAAS,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAE,GACzD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,QAAQ,GAAG,WAAW,GAAG,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,kBAAkB,CAAC,CA+D7B"}

package/dist/coordination/driveFollowMeEnrollment.js

@@ -0,0 +1,64 @@
+import { checkDeliveredMandateUsableForEnroll } from './enrollPointOfUseCheck.js';
+import { singleFlightKey } from './AccountFollowMeSingleFlight.js';
+export async function driveFollowMeEnrollment(deps, input) {
+    const key = singleFlightKey(input.requested.accountId, input.requested.targetMachineId);
+    // 1. Point-of-use re-verify (#3) — bounds + expiry + LIVE revocation, fail-closed.
+    const check = checkDeliveredMandateUsableForEnroll({
+        mandateId: input.mandateId,
+        expiresAt: input.expiresAt,
+        bounds: input.bounds,
+        requested: input.requested,
+        now: deps.now(),
+        isRevoked: deps.isRevoked,
+    });
+    if (!check.ok) {
+        // A denied mandate is NOT an in-flight failure — it never enrolled. No operator
+        // spam (a revoked/expired mandate the operator already knows about); just deny.
+        return { ok: false, state: 'denied', reason: check.reason };
+    }
+    // 2. Single-flight (#2) — refuse a duplicate drive for a LIVE pair.
+    const claim = deps.singleFlight.tryClaim({
+        accountId: input.requested.accountId,
+        targetMachineId: input.requested.targetMachineId,
+        frontingMachineId: deps.frontingMachineId,
+        mandateId: input.mandateId,
+        holder: deps.holder,
+        ttlMs: deps.claimTtlMs,
+    });
+    if (!claim.claimed) {
+        return { ok: false, state: 'in-flight', reason: 'enrollment already in flight for this pair' };
+    }
+    // 3. Drive the re-mint. ANY throw ⇒ recorded failed + ONE honest failure message
+    //    (the no-silent-stall guarantee — the exact bug this connector fixes).
+    let login;
+    try {
+        login = await deps.startEnrollment({ accountId: input.requested.accountId, mandateId: input.mandateId });
+    }
+    catch (err) {
+        deps.singleFlight.transition(key, 'failed', deps.holder);
+        const reason = err instanceof Error ? err.message : 'enrollment drive failed';
+        const emit = deps.outbox.claimEmit({ ledgerKey: key, state: 'failed', eventId: input.eventId });
+        if (emit.emit) {
+            await deps.surfaceToOperator({
+                kind: 'failure',
+                accountId: input.requested.accountId,
+                targetMachineId: input.requested.targetMachineId,
+                reason,
+            }).catch(() => { });
+        }
+        return { ok: false, state: 'failed', reason };
+    }
+    // 4. login-issued + ONE login-link message (outbox-deduped across redelivery/restart).
+    deps.singleFlight.transition(key, 'login-issued', deps.holder, { ttlMs: deps.loginTtlMs });
+    const emit = deps.outbox.claimEmit({ ledgerKey: key, state: 'login-issued', eventId: input.eventId });
+    if (emit.emit) {
+        await deps.surfaceToOperator({
+            kind: 'login-link',
+            accountId: input.requested.accountId,
+            targetMachineId: input.requested.targetMachineId,
+            login,
+        }).catch(() => { });
+    }
+    return { ok: true, state: 'login-issued', login };
+}
+//# sourceMappingURL=driveFollowMeEnrollment.js.map

package/dist/coordination/driveFollowMeEnrollment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"driveFollowMeEnrollment.js","sourceRoot":"","sources":["../../src/coordination/driveFollowMeEnrollment.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AA8CnE,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAqB,EACrB,KAAuB;IAEvB,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAExF,mFAAmF;IACnF,MAAM,KAAK,GAAG,oCAAoC,CAAC;QACjD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;QACf,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,gFAAgF;QAChF,gFAAgF;QAChF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAC9D,CAAC;IAED,oEAAoE;IACpE,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC;QACvC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,SAAS;QACpC,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe;QAChD,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,UAAU;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;IACjG,CAAC;IAED,iFAAiF;IACjF,2EAA2E;IAC3E,IAAI,KAAoB,CAAC;IACzB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAC3G,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC;QAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAChG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,iBAAiB,CAAC;gBAC3B,IAAI,EAAE,SAAS;gBACf,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,SAAS;gBACpC,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe;gBAChD,MAAM;aACP,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAA8E,CAAC,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC;IAED,uFAAuF;IACvF,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACtG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,IAAI,CAAC,iBAAiB,CAAC;YAC3B,IAAI,EAAE,YAAY;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,SAAS;YACpC,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe;YAChD,KAAK;SACN,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAiF,CAAC,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AACpD,CAAC"}

package/dist/coordination/enrollPointOfUseCheck.d.ts

@@ -0,0 +1,48 @@
+/**
+ * WS5.2 (ws52-operator-tap-not-text Part B, R3.4) — point-of-use re-verification for
+ * the cross-machine enroll connector.
+ *
+ * Convergence critical #3: the delivered-mandate enroll path re-verified ONLY the
+ * R4a issuance signature + bounds (`verifyDeliveredMandate`) — it checked NEITHER
+ * expiry NOR revocation, and revoke never purged the delivered store. So the
+ * auto-enroll connector would honor a REVOKED or EXPIRED cross-machine mandate and
+ * mint a fresh login the operator had killed. This pure predicate is the temporal +
+ * revocation gate the convergence requires, run BEFORE every state transition that
+ * could start or continue an enrollment ("never trust the stored flag").
+ *
+ * It is deliberately decoupled from the concrete mandate/store types: the caller
+ * supplies the minimal facts (the mandate's id, expiry, and account-follow-me
+ * bounds; the requested pair; the clock; and a LIVE revocation oracle). Fail-closed
+ * on every uncertainty — an unknown/throwing revocation oracle is treated as
+ * "revoked" (the safe direction), never "allow".
+ */
+export type EnrollDenyReason = 'expired' | 'revoked' | 'bounds-mismatch' | 'revocation-unknown' | 'bad-expiry';
+export interface EnrollPointOfUseInput {
+    mandateId: string;
+    /** The mandate's ISO expiry (R4a-signed). */
+    expiresAt: string;
+    /** The account-follow-me bounds the mandate was signed for. */
+    bounds: {
+        accountId: string;
+        targetMachineId: string;
+    };
+    /** What this enrollment is about to do — MUST equal the signed bounds. */
+    requested: {
+        accountId: string;
+        targetMachineId: string;
+    };
+    /** Wall-clock ms (injectable). */
+    now: number;
+    /**
+     * LIVE revocation oracle: true ⇒ revoked. It MUST reflect both the local
+     * `mandate.revoked` flag and the durable revocation record. A throw is treated
+     * as revocation-unknown ⇒ DENY (fail-closed) — never silently allowed.
+     */
+    isRevoked: (mandateId: string) => boolean;
+}
+export interface EnrollPointOfUseResult {
+    ok: boolean;
+    reason: EnrollDenyReason | 'ok';
+}
+export declare function checkDeliveredMandateUsableForEnroll(input: EnrollPointOfUseInput): EnrollPointOfUseResult;
+//# sourceMappingURL=enrollPointOfUseCheck.d.ts.map

package/dist/coordination/enrollPointOfUseCheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enrollPointOfUseCheck.d.ts","sourceRoot":"","sources":["../../src/coordination/enrollPointOfUseCheck.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,MAAM,gBAAgB,GACxB,SAAS,GACT,SAAS,GACT,iBAAiB,GACjB,oBAAoB,GACpB,YAAY,CAAC;AAEjB,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,0EAA0E;IAC1E,SAAS,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACjC;AAED,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,qBAAqB,GAC3B,sBAAsB,CA0BxB"}