@agenthippo-ai/agenthippo 1.110.9 → 1.110.19

package/out/test/lease-signature.test.js

@@ -1,357 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Signed leases, lease validation, and the staleness ceiling.
- *
- *  The whole governance story — kill switch, deny rules, caps, version pin, pack signing — was
- *  rooted in an UNSIGNED document fetched over an unauthenticated channel and `JSON.parse`d
- *  straight into policy. Anyone who could answer AGENTHIPPO_LEASE_URL could lift the kill switch;
- *  anyone who could drop packets to it could keep a revoked fleet running indefinitely.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-require("mocha");
-const assert = __importStar(require("assert"));
-const warrant_1 = require("../authority/warrant");
-const lease_1 = require("../pack/lease");
-const key = (0, warrant_1.generateWarrantKeypair)('lease-k1');
-const keys = { 'lease-k1': key.publicKeyPem };
-const NOW = 1_800_000_000;
-const lease = { pack: 'analyst', expiresAt: NOW + 3600, enabled: true };
-const bodyResponse = (text) => ({
-    ok: true,
-    status: 200,
-    text: async () => text,
-    json: async () => JSON.parse(text),
-});
-const collectLogs = () => {
-    const lines = [];
-    return { lines, logger: { info: (m) => lines.push(m), warn: (m) => lines.push(m) } };
-};
-suite('signed lease — envelope verification', () => {
-    test('a lease signed by a trusted key verifies, and the policy survives intact', () => {
-        const token = (0, lease_1.signLease)(lease, key, { instanceId: 'inst-1', nowSeconds: NOW });
-        const res = (0, lease_1.verifySignedLease)(token, keys, { instanceId: 'inst-1', nowSeconds: NOW });
-        assert.ok(res.ok, res.ok ? '' : res.reason);
-        assert.deepStrictEqual(res.lease, lease);
-    });
-    test('an empty keyring never verifies — the same rule packs get', () => {
-        const token = (0, lease_1.signLease)(lease, key, { nowSeconds: NOW });
-        const res = (0, lease_1.verifySignedLease)(token, {}, { nowSeconds: NOW });
-        assert.strictEqual(res.ok, false);
-    });
-    test('a key we do not trust is refused, never trusted-on-first-use', () => {
-        const stranger = (0, warrant_1.generateWarrantKeypair)('evil');
-        const token = (0, lease_1.signLease)({ ...lease, enabled: true }, stranger, { nowSeconds: NOW });
-        const res = (0, lease_1.verifySignedLease)(token, keys, { nowSeconds: NOW });
-        assert.strictEqual(res.ok, false);
-        assert.match(res.reason, /unknown kid/);
-    });
-    test('a tampered payload breaks the signature', () => {
-        const token = (0, lease_1.signLease)({ ...lease, enabled: false }, key, { nowSeconds: NOW });
-        const [h, , s] = token.split('.');
-        const forged = Buffer.from(JSON.stringify({
-            lease: { ...lease, enabled: true }, aud: '*', sub: 'analyst', iat: NOW, exp: NOW + 300,
-        })).toString('base64url');
-        const res = (0, lease_1.verifySignedLease)(`${h}.${forged}.${s}`, keys, { nowSeconds: NOW });
-        assert.strictEqual(res.ok, false);
-        assert.match(res.reason, /bad signature/);
-    });
-    test('a lease for another instance does not verify here (audience binding)', () => {
-        const token = (0, lease_1.signLease)(lease, key, { instanceId: 'inst-other', nowSeconds: NOW });
-        const res = (0, lease_1.verifySignedLease)(token, keys, { instanceId: 'inst-1', nowSeconds: NOW });
-        assert.strictEqual(res.ok, false);
-        assert.match(res.reason, /for instance inst-other/);
-    });
-    test('a fleet-wide (*) lease is accepted by any instance', () => {
-        const token = (0, lease_1.signLease)(lease, key, { nowSeconds: NOW });
-        assert.ok((0, lease_1.verifySignedLease)(token, keys, { instanceId: 'inst-1', nowSeconds: NOW }).ok);
-    });
-    test('an expired envelope is refused even though the LEASE has not expired', () => {
-        const token = (0, lease_1.signLease)(lease, key, { nowSeconds: NOW, ttlSeconds: 60 });
-        const res = (0, lease_1.verifySignedLease)(token, keys, { nowSeconds: NOW + 3600 });
-        assert.strictEqual(res.ok, false);
-        assert.match(res.reason, /envelope expired/);
-    });
-    test('envelope TTL is capped — a lease refresh must not become a credential', () => {
-        const token = (0, lease_1.signLease)(lease, key, { nowSeconds: NOW, ttlSeconds: 99_999 });
-        // The cap is applied at signing; verification also refuses anything longer.
-        const res = (0, lease_1.verifySignedLease)(token, keys, { nowSeconds: NOW + lease_1.MAX_LEASE_ENVELOPE_TTL_SECONDS - 1 });
-        assert.ok(res.ok, 'inside the capped lifetime it is still valid');
-        assert.strictEqual((0, lease_1.verifySignedLease)(token, keys, { nowSeconds: NOW + lease_1.MAX_LEASE_ENVELOPE_TTL_SECONDS + 120 }).ok, false);
-    });
-    /**
-     * The binding that matters most. `governor.checkLease` treats a restored lease as "lease
-     * restored — accepting turns again", so replaying an older `enabled: true` envelope does not
-     * merely delay a kill: it LIFTS one that has already latched.
-     */
-    test('an older envelope is refused as a rollback replay', () => {
-        const older = (0, lease_1.signLease)(lease, key, { nowSeconds: NOW });
-        const newer = (0, lease_1.signLease)({ ...lease, enabled: false }, key, { nowSeconds: NOW + 100 });
-        assert.ok((0, lease_1.verifySignedLease)(newer, keys, { nowSeconds: NOW + 100 }).ok);
-        const replay = (0, lease_1.verifySignedLease)(older, keys, { nowSeconds: NOW + 120, minIat: NOW + 100 });
-        assert.strictEqual(replay.ok, false);
-        assert.match(replay.reason, /replay\/rollback/);
-    });
-    test('a pack signature cannot be replayed as a lease under the same key (typ binding)', () => {
-        // A JWT-typed token signed by the same key must not pass as a lease envelope.
-        const notALease = require('../authority/warrant').signCompactJws({ typ: 'JWT', kid: 'lease-k1' }, { lease, aud: '*', sub: 'analyst', iat: NOW, exp: NOW + 300 }, key.privateKeyPem);
-        const res = (0, lease_1.verifySignedLease)(notALease, keys, { nowSeconds: NOW });
-        assert.strictEqual(res.ok, false);
-        assert.match(res.reason, /unexpected token type/);
-    });
-    test('a signed lease carrying a malformed policy is refused, not half-adopted', () => {
-        const token = (0, lease_1.signLease)({ ...lease, caps: { maxTurnsPerSession: 'lots' } }, key, { nowSeconds: NOW });
-        const res = (0, lease_1.verifySignedLease)(token, keys, { nowSeconds: NOW });
-        assert.strictEqual(res.ok, false);
-        assert.match(res.reason, /malformed/);
-    });
-});
-suite('requireSignedLease is tighten-only', () => {
-    test('either side may demand it; neither may waive the other', () => {
-        assert.strictEqual((0, lease_1.requireSignedLease)(undefined, undefined), false);
-        assert.strictEqual((0, lease_1.requireSignedLease)(true, undefined), true);
-        assert.strictEqual((0, lease_1.requireSignedLease)(undefined, true), true);
-        assert.strictEqual((0, lease_1.requireSignedLease)(false, true), true);
-    });
-});
-suite('lease source — signature enforcement', () => {
-    test('a signed lease is accepted and reported as signed', async () => {
-        const token = (0, lease_1.signLease)(lease, key, { instanceId: 'inst-1', nowSeconds: NOW });
-        const src = (0, lease_1.createLeaseSource)({
-            url: 'https://plane.example/lease',
-            cacheSeconds: 0,
-            instanceId: 'inst-1',
-            signingKeys: () => keys,
-            fetchImpl: (async () => bodyResponse(JSON.stringify({ lease: token }))),
-        });
-        assert.deepStrictEqual(await src.get(NOW), lease);
-        assert.strictEqual(src.status(NOW).signed, true);
-    });
-    test('a bare compact-JWS body works too', async () => {
-        const token = (0, lease_1.signLease)(lease, key, { nowSeconds: NOW });
-        const src = (0, lease_1.createLeaseSource)({
-            url: 'https://plane.example/lease',
-            cacheSeconds: 0,
-            signingKeys: () => keys,
-            fetchImpl: (async () => bodyResponse(token)),
-        });
-        assert.deepStrictEqual(await src.get(NOW), lease);
-    });
-    test('an unsigned lease still works, and says so LOUDLY, when signing is not required', async () => {
-        const { lines, logger } = collectLogs();
-        const src = (0, lease_1.createLeaseSource)({
-            url: 'https://plane.example/lease',
-            cacheSeconds: 0,
-            logger,
-            fetchImpl: (async () => bodyResponse(JSON.stringify(lease))),
-        });
-        assert.deepStrictEqual(await src.get(NOW), lease);
-        assert.ok(lines.some((l) => /UNSIGNED lease/.test(l)), 'back-compat must not be silent');
-    });
-    test('an unsigned lease is REFUSED when signing is required — and the last good lease stands', async () => {
-        const token = (0, lease_1.signLease)(lease, key, { nowSeconds: NOW });
-        let signed = true;
-        const src = (0, lease_1.createLeaseSource)({
-            url: 'https://plane.example/lease',
-            cacheSeconds: 0,
-            requireSignedLease: true,
-            signingKeys: () => keys,
-            fetchImpl: (async () => bodyResponse(signed ? token : JSON.stringify({ ...lease, enabled: true }))),
-        });
-        assert.deepStrictEqual(await src.get(NOW), lease);
-        signed = false;
-        // A downgrade to unsigned must not install new policy.
-        const after = await src.get(NOW + 1);
-        assert.deepStrictEqual(after, lease, 'the verified lease is kept; the unsigned one is rejected');
-    });
-    test('lease.requireSignedLease LATCHES — a later unsigned response cannot undo it', async () => {
-        const demanding = (0, lease_1.signLease)({ ...lease, requireSignedLease: true }, key, { nowSeconds: NOW });
-        let phase = 'signed';
-        const { lines, logger } = collectLogs();
-        const src = (0, lease_1.createLeaseSource)({
-            url: 'https://plane.example/lease',
-            cacheSeconds: 0,
-            logger,
-            signingKeys: () => keys,
-            fetchImpl: (async () => bodyResponse(phase === 'signed' ? demanding : JSON.stringify({ ...lease, enabled: true, version: '9.9.9' }))),
-        });
-        const first = await src.get(NOW);
-        assert.strictEqual(first?.requireSignedLease, true);
-        phase = 'unsigned';
-        const second = await src.get(NOW + 1);
-        assert.strictEqual(second?.version, undefined, 'the unsigned downgrade must not take effect');
-        assert.ok(lines.some((l) => /signed lease is required/.test(l)));
-    });
-});
-/**
- * The insecure-channel warning, which for one shape did not exist.
- *
- * `createLeaseSource` carried a `leaseUrlRefused` flag, declared and read but never assigned — its
- * comment promised "we never poll it at all", a refusal the file elsewhere argues explicitly
- * against (refusing to poll a plaintext lease URL disables the kill switch, which fails OPEN).
- * Worse, the warning next to it was guarded by `else if (!signingRequired())`, so the one operator
- * who most needed to hear it — one who has demanded signed leases and therefore believes the
- * channel is accounted for — was the only one who heard nothing at all.
- */
-suite('lease source — a plaintext lease URL warns, always, and never stops the poll', () => {
-    // An explicit empty env: the ambient ALLOW_INSECURE_TRUST_ROOT escape hatch must not decide
-    // what these tests observe.
-    const noEnv = {};
-    test('http + signing NOT required — warns, and keeps polling', async () => {
-        const { lines, logger } = collectLogs();
-        const src = (0, lease_1.createLeaseSource)({
-            url: 'http://plane.example/lease',
-            cacheSeconds: 0,
-            env: noEnv,
-            logger,
-            fetchImpl: (async () => bodyResponse(JSON.stringify(lease))),
-        });
-        assert.deepStrictEqual(await src.get(NOW), lease, 'refusing to poll would disable the kill switch');
-        assert.ok(lines.some((l) => /INSECURE LEASE CHANNEL/.test(l)));
-    });
-    test('http + signing REQUIRED — still warns; this was the silent case', async () => {
-        const token = (0, lease_1.signLease)(lease, key, { nowSeconds: NOW });
-        const { lines, logger } = collectLogs();
-        const src = (0, lease_1.createLeaseSource)({
-            url: 'http://plane.example/lease',
-            cacheSeconds: 0,
-            env: noEnv,
-            logger,
-            requireSignedLease: true,
-            signingKeys: () => keys,
-            fetchImpl: (async () => bodyResponse(token)),
-        });
-        assert.deepStrictEqual(await src.get(NOW), lease, 'a signed lease over http is still polled');
-        const warning = lines.find((l) => /INSECURE LEASE CHANNEL/.test(l));
-        assert.ok(warning, 'signing-required over plaintext must not be the quiet case');
-        // And it must say what signing does NOT buy, rather than repeating "set requireSignedLease"
-        // at an operator who already did.
-        assert.match(warning, /not a substitute for https/i);
-    });
-    test('https warns about nothing', async () => {
-        const { lines, logger } = collectLogs();
-        const src = (0, lease_1.createLeaseSource)({
-            url: 'https://plane.example/lease',
-            cacheSeconds: 0,
-            env: noEnv,
-            logger,
-            fetchImpl: (async () => bodyResponse(JSON.stringify(lease))),
-        });
-        assert.deepStrictEqual(await src.get(NOW), lease);
-        assert.ok(!lines.some((l) => /INSECURE LEASE CHANNEL/.test(l)));
-    });
-});
-suite('lease source — a garbled document is not policy', () => {
-    const badBodies = [
-        ['non-numeric cap', JSON.stringify({ ...lease, caps: { maxTurnsPerSession: 'lots' } })],
-        ['negative cap', JSON.stringify({ ...lease, caps: { maxSessionSeconds: -5 } })],
-        ['string enabled', JSON.stringify({ ...lease, enabled: 'false' })],
-        ['unknown deny scope', JSON.stringify({ ...lease, deny: [{ scope: 'tenant', match: 'x', mode: 'kill' }] })],
-        ['not an object', '"hello"'],
-        ['not JSON at all', '<html>502</html>'],
-    ];
-    for (const [name, body] of badBodies) {
-        test(`${name} is rejected and the previous lease is kept`, async () => {
-            let good = true;
-            const { lines, logger } = collectLogs();
-            const src = (0, lease_1.createLeaseSource)({
-                url: 'https://plane.example/lease',
-                cacheSeconds: 0,
-                logger,
-                fetchImpl: (async () => bodyResponse(good ? JSON.stringify(lease) : body)),
-            });
-            assert.deepStrictEqual(await src.get(NOW), lease);
-            good = false;
-            assert.deepStrictEqual(await src.get(NOW + 1), lease, 'junk must never replace a validated lease');
-            assert.ok(lines.some((l) => /fetch failed/.test(l)), 'and the rejection must be logged');
-        });
-    }
-    test('a NaN cap cannot reach the meter — where every comparison would be false', async () => {
-        const src = (0, lease_1.createLeaseSource)({
-            url: 'https://plane.example/lease',
-            cacheSeconds: 0,
-            fetchImpl: (async () => bodyResponse(JSON.stringify({ ...lease, caps: { maxTurnsPerSession: null } }))),
-        });
-        const got = await src.get(NOW);
-        assert.strictEqual(got?.caps?.maxTurnsPerSession, undefined, 'null is dropped, never carried through as a cap');
-    });
-});
-suite('lease source — staleness ceiling (kill switch under network denial)', () => {
-    test('past the ceiling, the instance fails CLOSED with an actionable reason', async () => {
-        let alive = true;
-        const { lines, logger } = collectLogs();
-        const src = (0, lease_1.createLeaseSource)({
-            url: 'https://plane.example/lease',
-            cacheSeconds: 0,
-            maxStalenessSeconds: 100,
-            logger,
-            fetchImpl: (async () => {
-                if (!alive) {
-                    throw new Error('control plane unreachable');
-                }
-                return bodyResponse(JSON.stringify(lease));
-            }),
-        });
-        assert.deepStrictEqual(await src.get(NOW), lease);
-        alive = false;
-        assert.strictEqual((await src.get(NOW + 50))?.enabled, true, 'inside the ceiling we still fail OPEN on transport');
-        const stale = await src.get(NOW + 200);
-        assert.strictEqual(stale?.enabled, false, 'past the ceiling the kill switch can no longer be starved out');
-        assert.match(stale?.reason ?? '', /staleness ceiling/);
-        assert.ok(lines.some((l) => /STALENESS CEILING PASSED/.test(l)));
-        assert.strictEqual(src.status(NOW + 200).failClosed, true);
-    });
-    test('0 disables the ceiling — an operator can explicitly accept unbounded staleness', async () => {
-        let alive = true;
-        const src = (0, lease_1.createLeaseSource)({
-            url: 'https://plane.example/lease',
-            cacheSeconds: 0,
-            maxStalenessSeconds: 0,
-            fetchImpl: (async () => {
-                if (!alive) {
-                    throw new Error('down');
-                }
-                return bodyResponse(JSON.stringify(lease));
-            }),
-        });
-        await src.get(NOW);
-        alive = false;
-        assert.strictEqual((await src.get(NOW + 10_000_000))?.enabled, true);
-    });
-    test('an unmanaged deployment (no lease URL) is untouched by any of this', async () => {
-        const src = (0, lease_1.createLeaseSource)({ maxStalenessSeconds: 1 });
-        assert.strictEqual(await src.get(NOW + 1_000_000), undefined);
-    });
-});

package/out/test/lease-trust-root.test.js

@@ -1,273 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  The LEASE trust root — the keyring that decides which policy this instance obeys.
- *
- *  Signed leases were unreachable end to end. serve verified lease envelopes with
- *  `signingKeys: () => packTrust.keys` — the PACK trust root — while the control plane publishes
- *  the lease public key under purpose `lease-signing` and refuses to register one kid under two
- *  purposes. So a correctly-configured plane and a correctly-configured serve could not name the
- *  same key, and `requireSignedLease` (sticky, with no plane-side undo) would latch an instance
- *  into refusing turns with no way back from the console.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-require("mocha");
-const assert = __importStar(require("assert"));
-const warrant_1 = require("../authority/warrant");
-const lease_1 = require("../pack/lease");
-const signature_1 = require("../pack/signature");
-const leaseKey = (0, warrant_1.generateWarrantKeypair)('lease-2026');
-const packKey = (0, warrant_1.generateWarrantKeypair)('pack-2026');
-const NOW = 1_800_000_000;
-const lease = { pack: 'analyst', expiresAt: NOW + 3600, enabled: true };
-const okResponse = (body) => ({
-    ok: true,
-    status: 200,
-    json: async () => body,
-});
-const fetchReturning = (body) => (async () => okResponse(body));
-const bodyResponse = (text) => ({
-    ok: true,
-    status: 200,
-    text: async () => text,
-    json: async () => JSON.parse(text),
-});
-const collectLogs = () => {
-    const lines = [];
-    return { lines, logger: { info: (m) => lines.push(m), warn: (m) => lines.push(m) } };
-};
-/** A trust root shaped like one nobody configured. */
-const unconfigured = { status: 'unconfigured', keys: {}, warnings: [] };
-suite('lease trust root — sources and precedence', () => {
-    test('an explicit lease JWKS URL is used, and is marked as named outright', async () => {
-        let asked = '';
-        const root = await (0, signature_1.loadLeaseTrustRoot)({
-            env: { [signature_1.LEASE_JWKS_URL_ENV]: 'https://plane.example/.well-known/lease-jwks.json' },
-            leaseUrl: 'https://elsewhere.example/lease',
-            fetchImpl: (async (u) => { asked = u; return okResponse({ pemsByKid: { 'lease-2026': leaseKey.publicKeyPem } }); }),
-        });
-        assert.strictEqual(asked, 'https://plane.example/.well-known/lease-jwks.json');
-        assert.strictEqual(root.status, 'configured');
-        assert.strictEqual(root.explicitlyConfigured, true);
-        assert.deepStrictEqual(Object.keys(root.keys), ['lease-2026']);
-    });
-    test('inline keys need no network at all (air-gapped), same as the pack root', async () => {
-        const root = await (0, signature_1.loadLeaseTrustRoot)({
-            env: { [signature_1.LEASE_SIGNING_KEYS_ENV]: JSON.stringify({ 'lease-2026': leaseKey.publicKeyPem }) },
-            fetchImpl: (async () => { throw new Error('must not be called'); }),
-        });
-        assert.strictEqual(root.status, 'configured');
-        assert.strictEqual(root.explicitlyConfigured, true);
-    });
-    test('the derived URL asks for the lease-signing purpose, not the plane\'s default document', async () => {
-        let asked = '';
-        const root = await (0, signature_1.loadLeaseTrustRoot)({
-            env: {},
-            leaseUrl: 'https://plane.example/lease',
-            fetchImpl: (async (u) => { asked = u; return okResponse({ pemsByKid: { 'lease-2026': leaseKey.publicKeyPem } }); }),
-        });
-        // The bare path serves PACK-signing keys on a plane that splits by purpose. Deriving without
-        // the query string would hand the lease verifier a keyring that can never verify a lease —
-        // and, worse, one that can authorise code execution.
-        assert.strictEqual(asked, 'https://plane.example/.well-known/jwks.json?purpose=lease-signing');
-        assert.strictEqual(root.status, 'configured');
-        assert.strictEqual(root.derivedFromLease, true);
-        assert.strictEqual(root.explicitlyConfigured, false, 'derived is not "named outright"');
-    });
-    test('nothing configured at all is UNCONFIGURED, not an error', async () => {
-        const root = await (0, signature_1.loadLeaseTrustRoot)({ env: {} });
-        assert.strictEqual(root.status, 'unconfigured');
-        assert.deepStrictEqual(root.keys, {});
-    });
-});
-suite('lease trust root — the pack root\'s properties, unchanged', () => {
-    test('http is refused unless the documented escape hatch is set, and the hatch is LOUD', async () => {
-        const env = { [signature_1.LEASE_JWKS_URL_ENV]: 'http://plane.example/lease-jwks.json' };
-        const refused = await (0, signature_1.loadLeaseTrustRoot)({ env, fetchImpl: fetchReturning({ pemsByKid: { 'lease-2026': leaseKey.publicKeyPem } }) });
-        assert.strictEqual(refused.status, 'unavailable');
-        assert.match(refused.reason ?? '', /must be https/);
-        const allowed = await (0, signature_1.loadLeaseTrustRoot)({
-            env: { ...env, [signature_1.ALLOW_INSECURE_TRUST_ROOT_ENV]: '1' },
-            fetchImpl: fetchReturning({ pemsByKid: { 'lease-2026': leaseKey.publicKeyPem } }),
-        });
-        assert.strictEqual(allowed.status, 'configured');
-        assert.ok(allowed.warnings.some((w) => /INSECURE/.test(w)));
-    });
-    test('a fetch failure is UNAVAILABLE, never an empty keyring (finding A4)', async () => {
-        const root = await (0, signature_1.loadLeaseTrustRoot)({
-            env: { [signature_1.LEASE_JWKS_URL_ENV]: 'https://plane.example/j' },
-            fetchImpl: (async () => { throw new Error('ECONNREFUSED'); }),
-        });
-        assert.strictEqual(root.status, 'unavailable');
-        assert.match(root.reason ?? '', /ECONNREFUSED/);
-        // Still "named outright", so serve must NOT quietly fall back to the pack keyring here.
-        assert.strictEqual(root.explicitlyConfigured, true);
-    });
-    test('a garbled inline keyring names the variable an operator has to fix', async () => {
-        const root = await (0, signature_1.loadLeaseTrustRoot)({ env: { [signature_1.LEASE_SIGNING_KEYS_ENV]: '{not json' } });
-        assert.strictEqual(root.status, 'unavailable');
-        assert.match(root.reason ?? '', new RegExp(`${signature_1.LEASE_SIGNING_KEYS_ENV} is set but is not valid JSON`));
-    });
-    test('thumbprint pins refuse a key the plane did not previously publish', async () => {
-        const tp = (0, signature_1.publicKeyThumbprints)(leaseKey.publicKeyPem);
-        const root = await (0, signature_1.loadLeaseTrustRoot)({
-            env: { [signature_1.LEASE_JWKS_URL_ENV]: 'https://plane.example/j', [signature_1.LEASE_JWKS_PINS_ENV]: tp.spki },
-            fetchImpl: fetchReturning({ pemsByKid: { 'lease-2026': leaseKey.publicKeyPem, 'stranger': packKey.publicKeyPem } }),
-        });
-        assert.strictEqual(root.status, 'configured');
-        assert.deepStrictEqual(Object.keys(root.keys), ['lease-2026']);
-        assert.ok(root.warnings.some((w) => /lease trust root: key stranger does not match any pin/.test(w)));
-    });
-    test('a standard JWKS document (what the plane publishes) is accepted', async () => {
-        const root = await (0, signature_1.loadLeaseTrustRoot)({
-            env: { [signature_1.LEASE_JWKS_URL_ENV]: 'https://plane.example/j' },
-            fetchImpl: fetchReturning((0, warrant_1.jwks)([leaseKey])),
-        });
-        assert.strictEqual(root.status, 'configured');
-        assert.deepStrictEqual(Object.keys(root.keys), ['lease-2026']);
-    });
-});
-suite('lease trust root — which keyring verifies a lease', () => {
-    test('a lease root named outright is the WHOLE answer: the pack keyring is not consulted', async () => {
-        const leaseTrust = await (0, signature_1.loadLeaseTrustRoot)({
-            env: { [signature_1.LEASE_SIGNING_KEYS_ENV]: JSON.stringify({ 'lease-2026': leaseKey.publicKeyPem }) },
-        });
-        const packTrust = await (0, signature_1.loadPackTrustRoot)({
-            env: { [signature_1.PACK_JWKS_URL_ENV]: 'https://plane.example/j' },
-            fetchImpl: fetchReturning({ pemsByKid: { 'pack-2026': packKey.publicKeyPem } }),
-        });
-        const selected = (0, signature_1.selectLeaseSigningKeys)(leaseTrust, packTrust);
-        assert.deepStrictEqual(Object.keys(selected.keys), ['lease-2026']);
-        assert.strictEqual(selected.packFallback, false);
-        // A key that can vouch for a lease must not thereby be able to vouch for CODE, and the
-        // converse matters just as much: the pack key must stop being a lease key.
-        assert.ok(!('pack-2026' in selected.keys));
-    });
-    test('with no lease root named, the pack keyring stays in play and the caller is told to warn', async () => {
-        const packTrust = await (0, signature_1.loadPackTrustRoot)({
-            env: { [signature_1.PACK_JWKS_URL_ENV]: 'https://plane.example/j' },
-            fetchImpl: fetchReturning({ pemsByKid: { 'pack-2026': packKey.publicKeyPem } }),
-        });
-        const selected = (0, signature_1.selectLeaseSigningKeys)(unconfigured, packTrust);
-        assert.strictEqual(selected.packFallback, true, 'the caller must warn, naming the new variable');
-        assert.deepStrictEqual(Object.keys(selected.keys), ['pack-2026']);
-    });
-    test('during a rollover both halves are live, and the lease key wins a kid collision', async () => {
-        const derived = { status: 'configured', keys: { shared: leaseKey.publicKeyPem }, warnings: [], derivedFromLease: true, explicitlyConfigured: false };
-        const packTrust = { status: 'configured', keys: { shared: packKey.publicKeyPem, 'pack-2026': packKey.publicKeyPem }, warnings: [] };
-        const selected = (0, signature_1.selectLeaseSigningKeys)(derived, packTrust);
-        assert.deepStrictEqual(Object.keys(selected.keys).sort(), ['pack-2026', 'shared']);
-        assert.strictEqual(selected.keys.shared, leaseKey.publicKeyPem);
-    });
-});
-suite('signed leases end to end through the lease trust root', () => {
-    /** Exactly what serve wires: the lease source reads its keys through the selection above. */
-    const sourceOver = (leaseTrust, packTrust, body, logger) => (0, lease_1.createLeaseSource)({
-        url: 'https://plane.example/lease',
-        cacheSeconds: 0,
-        env: {},
-        instanceId: 'inst-1',
-        ...(logger ? { logger } : {}),
-        signingKeys: () => (0, signature_1.selectLeaseSigningKeys)(leaseTrust, packTrust).keys,
-        fetchImpl: (async () => bodyResponse(body)),
-    });
-    test('a lease signed with the plane\'s lease-signing key verifies', async () => {
-        const leaseTrust = await (0, signature_1.loadLeaseTrustRoot)({
-            env: { [signature_1.LEASE_JWKS_URL_ENV]: 'https://plane.example/.well-known/lease-jwks.json' },
-            fetchImpl: fetchReturning((0, warrant_1.jwks)([leaseKey])),
-        });
-        const packTrust = await (0, signature_1.loadPackTrustRoot)({
-            env: { [signature_1.PACK_JWKS_URL_ENV]: 'https://plane.example/j' },
-            fetchImpl: fetchReturning({ pemsByKid: { 'pack-2026': packKey.publicKeyPem } }),
-        });
-        const token = (0, lease_1.signLease)(lease, leaseKey, { instanceId: 'inst-1', nowSeconds: NOW });
-        const src = sourceOver(leaseTrust, packTrust, JSON.stringify({ lease: token }));
-        assert.deepStrictEqual(await src.get(NOW), lease);
-        assert.strictEqual(src.status(NOW).signed, true);
-    });
-    test('the back-compat path still verifies: a lease signed with the PACK key, no lease root named', async () => {
-        const packTrust = await (0, signature_1.loadPackTrustRoot)({
-            env: { [signature_1.PACK_JWKS_URL_ENV]: 'https://plane.example/j' },
-            fetchImpl: fetchReturning({ pemsByKid: { 'pack-2026': packKey.publicKeyPem } }),
-        });
-        const token = (0, lease_1.signLease)(lease, packKey, { instanceId: 'inst-1', nowSeconds: NOW });
-        const selected = (0, signature_1.selectLeaseSigningKeys)(unconfigured, packTrust);
-        assert.strictEqual(selected.packFallback, true, 'and the operator is told, once');
-        const src = sourceOver(unconfigured, packTrust, JSON.stringify({ lease: token }));
-        assert.deepStrictEqual(await src.get(NOW), lease, 'a deployment that works today must keep working');
-    });
-    test('a lease signed by a kid nobody trusts is refused', async () => {
-        const leaseTrust = await (0, signature_1.loadLeaseTrustRoot)({
-            env: { [signature_1.LEASE_SIGNING_KEYS_ENV]: JSON.stringify({ 'lease-2026': leaseKey.publicKeyPem }) },
-        });
-        const stranger = (0, warrant_1.generateWarrantKeypair)('stranger');
-        const { lines, logger } = collectLogs();
-        const src = sourceOver(leaseTrust, unconfigured, JSON.stringify({ lease: (0, lease_1.signLease)(lease, stranger, { nowSeconds: NOW }) }), logger);
-        assert.strictEqual(await src.get(NOW), undefined, 'nothing unverifiable is installed as policy');
-        assert.ok(lines.some((l) => /unknown kid/.test(l)));
-    });
-    test('a pack-key-signed lease is refused once a lease root IS named — silently trusting it would undo the split', async () => {
-        const leaseTrust = await (0, signature_1.loadLeaseTrustRoot)({
-            env: { [signature_1.LEASE_SIGNING_KEYS_ENV]: JSON.stringify({ 'lease-2026': leaseKey.publicKeyPem }) },
-        });
-        const packTrust = { status: 'configured', keys: { 'pack-2026': packKey.publicKeyPem }, warnings: [] };
-        const src = sourceOver(leaseTrust, packTrust, JSON.stringify({ lease: (0, lease_1.signLease)(lease, packKey, { nowSeconds: NOW }) }));
-        assert.strictEqual(await src.get(NOW), undefined);
-    });
-    test('fail-open on a SIGNATURE failure survives: the last good lease stands', async () => {
-        const leaseTrust = await (0, signature_1.loadLeaseTrustRoot)({
-            env: { [signature_1.LEASE_SIGNING_KEYS_ENV]: JSON.stringify({ 'lease-2026': leaseKey.publicKeyPem }) },
-        });
-        const good = (0, lease_1.signLease)(lease, leaseKey, { instanceId: 'inst-1', nowSeconds: NOW });
-        const forged = (0, lease_1.signLease)({ ...lease, enabled: false, version: '9.9.9' }, (0, warrant_1.generateWarrantKeypair)('stranger'), { nowSeconds: NOW + 1 });
-        let phase = 'good';
-        const { lines, logger } = collectLogs();
-        const src = (0, lease_1.createLeaseSource)({
-            url: 'https://plane.example/lease',
-            cacheSeconds: 0,
-            env: {},
-            instanceId: 'inst-1',
-            logger,
-            signingKeys: () => (0, signature_1.selectLeaseSigningKeys)(leaseTrust, unconfigured).keys,
-            fetchImpl: (async () => bodyResponse(JSON.stringify({ lease: phase === 'good' ? good : forged }))),
-        });
-        assert.deepStrictEqual(await src.get(NOW), lease);
-        phase = 'forged';
-        // An unverifiable document is treated exactly like a transport failure — never installed as
-        // policy, and never allowed to take a fleet down by being publishable junk.
-        assert.deepStrictEqual(await src.get(NOW + 1), lease);
-        assert.ok(lines.some((l) => /fetch failed/.test(l)));
-    });
-});