@cotal-ai/auth 0.58.0 → 0.60.0

package/dist/service.js

@@ -61,15 +61,17 @@ import { Kvm } from "@nats-io/kv";
 import { contractRefToHex, contractStoreContext, fetchContractArtifact, verifyClusterManifest, verifyClusterRoot, admissionBucket, admissionMediatorGrants, assertDerivedOwnerToken, assertLifecycleToken, assertValidOwnerToken, authorizeTrustedServeSnapshot, commitSiblingIssuance, credsClaims, EpEnvelopeError, ensureAuthorityStores, epAuthBucket, isReachable, jwtFromCreds, managedRetirementOpId, mintCreds, mintPublicUserJwt, newIdentity, observeHostedRunAttempt, openRecordsBucket, parseEndpointGate, parseServiceSpec, parseServiceStatus, rawDigest, parseSecretStoreIdentity, readCheckpointStatus, readRunAdmission, readRunRecord, readSvcRecordLeader, reconcileEndpointGate, sameSecretStoreIdentity, recordSpecKey, recordStatusKey, RECORD_KINDS, recordsBucket, remoteManagerActors, retirementFrontierStreams, runDriverCaller, serveIssuanceGateKv, standaloneConnectOpts, STANDING_RENEWABLE_TTL_SEC, withIssuerSession, authorizeServeGrant, contractArtifactCanonicalBytes, DEV_OWNER, endpointRegistrationBarrier, mintLifecycleUid, principalKey, provisionEndpointGateOpen, publishContractArtifact, registerServiceInstance, SERVICE_READY, writeServiceStatus } from "@cotal-ai/core";
 import { findCotalRoot, loadManagerInstanceIdentity, userAuthStateDir, workspaceSecretStore, createAuthInstanceIdentity, loadAuthInstanceIdentity } from "@cotal-ai/workspace";
 import { decodeJwt } from "jose";
-import { deriveOwnerForIdpSubject } from "./derive.js";
+import { deriveOwnerForIdpSubject, platformControlOwner } from "./derive.js";
+import { makePlatformControlAuthority, requireManagerAuthorityHolder } from "./platform-control.js";
 import { startAuthCallout } from "./callout.js";
 import { createIdpBridge, verifyIdpToken } from "./idp.js";
 import { PUBLIC_EXCHANGE_VIEWS } from "./token.js";
+import { grantCoordinates, verifySessionRedemption } from "./session-redemption.js";
 import { pinnedJwksResolver } from "./issuer.js";
 import { calloutPermissions } from "./permissions.js";
 import { admitRemoteRun, authorizeRemoteManagerRenewal, authorizeRemoteRunAttempt, issueRemoteManagerAuthority, parseRemoteRunAdmissionRequest, parseRemoteRunAttemptRequest } from "./manager-authority.js";
 import { authorizeRemoteRetainedAgentValidation, completeRemoteRetainedAgentValidation, remoteManagerCurrentRegistrationProof } from "./retained-manager-validation.js";
-import { authorizeRemoteManagedAgentEnrollment, authorizeRemoteManagedAgentPrepareRetirement } from "./managed-agent-enrollment.js";
+import { authorizeRemoteManagedAgentEnrollment, authorizeRemoteManagedAgentPrepareRetirement, authorizeRemoteManagedAgentRuntimeCreate, authorizeRemoteManagedAgentRuntimeStatus } from "./managed-agent-enrollment.js";
 import { authorizeRemoteManagerGoalIndexScan, completeRemoteManagerGoalIndexScan } from "./manager-goal-index.js";
 import { authorizeRemoteManagerAdmin } from "./manager-admin-authorization.js";
 import { authorizeRemoteManagerMaintenance, completeRemoteManagerMaintenance } from "./manager-maintenance.js";
@@ -83,7 +85,7 @@ import { openAuthLedgerScannerCandidate } from "./ledger-scanner.js";
 import { openRecordsScannerCandidate } from "./records-scanner.js";
 import { acquirePlaneClaim, makeDeliveryAdminPlaneOracle, makeDeliveryAdminPrincipalOracle, scannerDeathCopy } from "./plane-claim.js";
 import { enumerateOperationIntents, resumeAgentTakeover } from "./credential-ledger.js";
-import { makeDeliveryAdminEvictor } from "./barrier-evict.js";
+import { makeDeliveryAdminEvictor, makeDeliveryAdminHolderEvictor } from "./barrier-evict.js";
 import { resumeAgentRetirement, runAgentRetirementBarrier } from "./retirement-barrier.js";
 import { makeRetirementCleaners } from "./retirement-cleaner.js";
 import { makeDrainRepairers } from "./drain-repair.js";
@@ -546,6 +548,18 @@ export async function openAuthAuthorityPlane(opts) {
             if (verdict !== "candidate")
                 throw new Error(`manager instance ${instanceId} is ${verdict} at the permission mint`);
         },
+        verifySession: async (principal, claim) => {
+            refuseIfFenced();
+            return verifySessionRedemption({
+                jsm: recordsJsm,
+                space,
+                managerGate: async (owner, instanceId) => {
+                    const verdict = await managerGate(owner, assertLifecycleToken(instanceId, "serving.instanceId"));
+                    const gate = await serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId }).observe();
+                    return { verdict, ...(gate ? { processEpoch: gate.processEpoch } : {}) };
+                },
+            }, principal, claim);
+        },
         retireInteractiveLifecycle: async (args) => {
             refuseIfFenced();
             const owner = assertDerivedOwnerToken(args.owner);
@@ -604,13 +618,12 @@ export async function openAuthAuthorityPlane(opts) {
             await flight;
             return { retired: true, lifecycleUid };
         },
-        issueManagerServiceAuthority: async ({ owner, scope, request }) => {
+        issueManagerServiceAuthority: async (holder) => {
             refuseIfFenced();
+            const { owner } = holder;
             const observeManagerGate = async (instanceId) => (await serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId }).observe()) ?? null;
             return issueRemoteManagerAuthority({
-                owner,
-                scope,
-                request,
+                ...holder,
                 authorizeRenewal: ({ owner: o, request: r }) => authorizeRemoteManagerRenewal({
                     request: r, owner: o, space, accountPublicKey: dataAccount.pub, proofSecret: dataAccount.signingSeed,
                     observeManagerGate,
@@ -808,14 +821,13 @@ export async function openAuthAuthorityPlane(opts) {
                 },
             });
         },
-        maintainRemoteManager: async ({ owner, scope, request }) => {
+        maintainRemoteManager: async (holder) => {
             refuseIfFenced();
+            const { owner } = holder;
             const gateKv = await new Kvm(remoteIssuer.nc).open(epAuthBucket(space));
             const authorized = await authorizeRemoteManagerMaintenance({
-                owner,
-                scope,
+                ...holder,
                 space,
-                request,
                 scanner,
                 observeManagerGate: async (instanceId) => serveIssuanceGateKv(gateKv, space, { endpoint: "manager", instanceId }).observe(),
             });
@@ -854,7 +866,7 @@ export async function openAuthAuthorityPlane(opts) {
                         const result = await principalOracle(principal);
                         return { state: result.state, detail: result.note ?? `delivery-daemon principal sweep, sweepComplete=${String(result.sweepComplete)}` };
                     },
-                    evict: async (principal) => (await evict(principal)).verifiedGone,
+                    evictHolders: makeDeliveryAdminHolderEvictor({ space, server, dataAccount, log }),
                     log,
                 });
             }
@@ -863,14 +875,12 @@ export async function openAuthAuthorityPlane(opts) {
             }
             return completeRemoteManagerMaintenance(authorized, owner, { reconciliation: report });
         },
-        validateRetainedAgent: async ({ owner, scope, request }) => {
+        validateRetainedAgent: async (holder) => {
             refuseIfFenced();
             return authorizeRemoteRetainedAgentValidation({
-                owner,
-                scope,
+                ...holder,
                 proofSecret: dataAccount.signingSeed,
                 space,
-                request,
                 observeManagerGate: async (instanceId) => {
                     const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId });
                     return gate.observe();
@@ -905,10 +915,27 @@ export async function openAuthAuthorityPlane(opts) {
                 },
             });
         },
-        scanManagerGoalIndex: async ({ owner, scope, request }) => {
+        verifyManagedAgentRuntime: async ({ owner, request }) => {
+            refuseIfFenced();
+            const args = {
+                owner,
+                dir: opts.dir,
+                proofSecret: dataAccount.signingSeed,
+                space,
+                observeManagerGate: async (instanceId) => {
+                    const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId });
+                    return gate.observe();
+                },
+            };
+            return request.kind === "manager-managed-agent-runtime-status"
+                ? authorizeRemoteManagedAgentRuntimeStatus({ ...args, request })
+                : authorizeRemoteManagedAgentRuntimeCreate({ ...args, request });
+        },
+        scanManagerGoalIndex: async (holder) => {
             refuseIfFenced();
+            const { owner } = holder;
             const authorized = await authorizeRemoteManagerGoalIndexScan({
-                owner, scope, proofSecret: dataAccount.signingSeed, space, request,
+                ...holder, proofSecret: dataAccount.signingSeed, space,
                 observeManagerGate: async (instanceId) => {
                     const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId });
                     return gate.observe();
@@ -916,11 +943,11 @@ export async function openAuthAuthorityPlane(opts) {
             });
             return completeRemoteManagerGoalIndexScan(authorized, owner, await recordsScanner.scanManagerGoalIndex(owner));
         },
-        authorizeManagerAdmin: async ({ owner, scope, request }) => {
+        authorizeManagerAdmin: async ({ request, ...holder }) => {
             refuseIfFenced();
             return authorizeRemoteManagerAdmin({
-                managerOwner: owner,
-                managerScope: scope,
+                managerOwner: holder.owner,
+                ...(holder.holder === "platform" ? { managerAssignment: holder.assignment } : { managerScope: holder.scope }),
                 proofSecret: dataAccount.signingSeed,
                 space,
                 dir: opts.dir,
@@ -931,10 +958,10 @@ export async function openAuthAuthorityPlane(opts) {
                 },
             });
         },
-        admitManagerRun: async ({ owner, scope, request }) => {
+        admitManagerRun: async ({ request, ...holder }) => {
             refuseIfFenced();
-            if (!scope.includes("supervise"))
-                throw new EpEnvelopeError("permission-denied", 'manager run admission needs scope "supervise"; spawn/admin do not imply it');
+            const { owner } = holder;
+            requireManagerAuthorityHolder(holder, String(request?.instanceId), 'manager run admission needs scope "supervise"; spawn/admin do not imply it');
             const runId = parseRemoteRunAdmissionRequest(request).run.runId;
             const hostAuth = {
                 space,
@@ -968,10 +995,10 @@ export async function openAuthAuthorityPlane(opts) {
                 }
             });
         },
-        issueManagerRunAttempt: async ({ owner, scope, request }) => {
+        issueManagerRunAttempt: async ({ request, ...holder }) => {
             refuseIfFenced();
-            if (!scope.includes("supervise"))
-                throw new EpEnvelopeError("permission-denied", 'manager run attempt needs scope "supervise"; spawn/admin do not imply it');
+            const { owner } = holder;
+            requireManagerAuthorityHolder(holder, String(request?.instanceId), 'manager run attempt needs scope "supervise"; spawn/admin do not imply it');
             const req = parseRemoteRunAttemptRequest(request);
             const recordsKv = await openRecordsBucket(remoteIssuer.nc, space);
             const grant = await authorizeRemoteRunAttempt({
@@ -1049,6 +1076,12 @@ export async function openAuthAuthorityPlane(opts) {
                 credentials: { operator },
             };
         },
+        observeManagerInstance: async (instanceId) => {
+            refuseIfFenced();
+            const gate = await serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId }).observe();
+            const rec = await readSvcRecordLeader(recordsJsm, space, recordSpecKey(RECORD_KINDS.svc, ["manager", instanceId]));
+            return { registered: rec !== undefined && !("deleted" in rec), gate: gate ?? null };
+        },
         fenced,
         close: async () => {
             // Clean-close order (SPEC 13.13): the rail stops answering first, then scan-capable
@@ -1259,6 +1292,8 @@ export async function startAuthService(inputs) {
     const port = inputs.port ?? 0;
     if (!Number.isInteger(port) || port < 0 || port > 65535)
         throw new Error(`auth-service: port must be a port number, got ${port}`);
+    if (inputs.platformControl !== undefined && typeof inputs.platformControl?.observeAssignment !== "function")
+        throw new Error("auth-service: platformControl requires an observeAssignment function");
     const started = await startAuthContext({
         space: inputs.space,
         server: inputs.servers,
@@ -1268,6 +1303,8 @@ export async function startAuthService(inputs) {
         hostedStore: true,
         localManager: () => undefined,
         context: inputs.context,
+        ...(inputs.platformControl !== undefined ? { platformControl: inputs.platformControl } : {}),
+        ...(inputs.standingRenewableTtlSeconds !== undefined ? { standingRenewableTtlSeconds: inputs.standingRenewableTtlSeconds } : {}),
     });
     return started.handle;
 }
@@ -1303,6 +1340,7 @@ async function startAuthContext(o) {
         dataAccount: { pub: keys.dataAccount.pub, signingSeed: keys.dataAccount.signingSeed },
         log: (l) => console.error(l),
         localManager: o.localManager,
+        ...(o.standingRenewableTtlSeconds !== undefined ? { standingRenewableTtlSeconds: o.standingRenewableTtlSeconds } : {}),
     });
     let nc;
     let http;
@@ -1333,7 +1371,7 @@ async function startAuthContext(o) {
             space,
             token: { key: issuer.localKeySet(), issuer: issuer.issuer },
             authorizeActor: plane.authorizeConnect,
-            permissionsFor: calloutPermissions(ledgerAclResolver(dir), plane.authorizeManagerCaller),
+            permissionsFor: calloutPermissions(ledgerAclResolver(dir), plane.authorizeManagerCaller, plane.verifySession),
             log: (l) => console.error(l),
         });
         // The subscription must be ON the broker before readiness is signaled — an `up` that recorded a
@@ -1362,6 +1400,7 @@ async function startAuthContext(o) {
             validateRetainedAgent: plane.validateRetainedAgent,
             verifyManagedAgentEnrollment: plane.verifyManagedAgentEnrollment,
             verifyManagedAgentPrepareRetirement: plane.verifyManagedAgentPrepareRetirement,
+            verifyManagedAgentRuntime: plane.verifyManagedAgentRuntime,
             scanManagerGoalIndex: plane.scanManagerGoalIndex,
             authorizeManagerAdmin: plane.authorizeManagerAdmin,
             admitManagerRun: plane.admitManagerRun,
@@ -1376,6 +1415,7 @@ async function startAuthContext(o) {
             dir,
             mintConnectCredential: plane.mintConnectCredential,
             selectManagerInstance: plane.selectManagerInstance,
+            verifySession: plane.verifySession,
         };
         const loopback = createServer((req, res) => void handle(req, res, ctx));
         http = loopback;
@@ -1445,9 +1485,46 @@ async function startAuthContext(o) {
             return end;
         });
         const context = o.context ?? { accountPublicKey: keys.dataAccount.pub, lifecycleUid: "" };
+        const platformControl = o.platformControl;
+        // The human route's retained-validation composition, for the platform holder.
+        const validateRetainedForHolder = async (holder, request) => {
+            const retained = await plane.validateRetainedAgent({ ...holder, request });
+            const authority = await validateRetainedManagedAgent({
+                store: secrets,
+                dir,
+                space,
+                owner: retained.target.owner,
+                actor: retained.target.actor,
+                actorToken: retained.actorToken,
+                sentinelCreds: retained.sentinelCreds,
+            });
+            return completeRemoteRetainedAgentValidation(retained, holder.owner, authority);
+        };
         const service = {
             url,
             ...(publicUrl !== undefined ? { publicUrl } : {}),
+            ...(platformControl !== undefined ? {
+                platformControlAuthority: makePlatformControlAuthority({
+                    space,
+                    accountPublicKey: keys.dataAccount.pub,
+                    owner: platformControlOwner(ownerSecret, space, keys.dataAccount.pub),
+                    observeAssignment: (s, a) => platformControl.observeAssignment(s, a),
+                    observeManagerInstance: plane.observeManagerInstance,
+                    dispatch: (holder, request) => {
+                        if (state !== "ready" || closePromise !== undefined)
+                            throw new EpEnvelopeError("unavailable", "auth-service context is not ready");
+                        switch (request.kind) {
+                            case "manager-service-authority": return plane.issueManagerServiceAuthority({ ...holder, request });
+                            case "manager-service-maintenance": return plane.maintainRemoteManager({ ...holder, request });
+                            case "manager-goal-index-scan": return plane.scanManagerGoalIndex({ ...holder, request });
+                            case "manager-admin-authorization": return plane.authorizeManagerAdmin({ ...holder, request });
+                            case "manager-run-admission": return plane.admitManagerRun({ ...holder, request });
+                            case "manager-run-attempt": return plane.issueManagerRunAttempt({ ...holder, request });
+                            case "manager-retained-agent-validation": return validateRetainedForHolder(holder, request);
+                        }
+                    },
+                }),
+            } : {}),
             readiness() {
                 if (state === "unavailable")
                     return { state, context, cause: cause ?? "auth-service context is unavailable" };
@@ -1482,6 +1559,9 @@ export async function dispatchManagerAuthorityRequest(ctx, owner, body) {
     // would answer a manager-lifecycle phase for an agent-lifecycle request.
     if (request.kind === "manager-managed-agent-enrollment" || request.kind === "manager-managed-agent-prepare-retirement")
         throw new EpEnvelopeError("unimplemented", "managed agent enrollment and retirement preparation must be handled by host platform interception");
+    // The hosted runtime kinds read and drive host-owned intent state that stock does not hold.
+    if (request.kind === "manager-managed-agent-runtime-create" || request.kind === "manager-managed-agent-runtime-status")
+        throw new EpEnvelopeError("unimplemented", "managed agent runtime create and status must be handled by host platform interception");
     if (request.kind === "manager-retained-agent-validation") {
         const retained = await ctx.validateRetainedAgent({
             owner,
@@ -1731,8 +1811,9 @@ async function handleVerifyManagedAgentEnrollment(req, res, ctx) {
     if (typeof raw.owner !== "string" || raw.request === null || typeof raw.request !== "object" || Array.isArray(raw.request))
         return send(res, 400, { error: "managed agent enrollment verification needs a string owner and an object request" });
     const request = raw.request;
-    if (request.kind !== "manager-managed-agent-enrollment" && request.kind !== "manager-managed-agent-prepare-retirement")
-        return send(res, 400, { error: 'managed agent enrollment verification serves only kind "manager-managed-agent-enrollment" or "manager-managed-agent-prepare-retirement"' });
+    const runtimeKind = request.kind === "manager-managed-agent-runtime-create" || request.kind === "manager-managed-agent-runtime-status";
+    if (request.kind !== "manager-managed-agent-enrollment" && request.kind !== "manager-managed-agent-prepare-retirement" && !runtimeKind)
+        return send(res, 400, { error: 'managed agent enrollment verification serves only kind "manager-managed-agent-enrollment", "manager-managed-agent-prepare-retirement", "manager-managed-agent-runtime-create" or "manager-managed-agent-runtime-status"' });
     if (typeof request.actor !== "string")
         return send(res, 400, { error: "managed agent enrollment verification request requires an actor" });
     try {
@@ -1742,6 +1823,14 @@ async function handleVerifyManagedAgentEnrollment(req, res, ctx) {
         // caller. An ungranted actor throws the ledger's own operator-exact sentence.
         const row = ledgerAuthorizeGrant(ctx.dir)(owner, request.actor);
         const scope = row.scope ?? [];
+        if (runtimeKind) {
+            // The plane re-reads the same ledger row itself: the runtime decision never takes a scope.
+            const decision = await ctx.verifyManagedAgentRuntime({
+                owner,
+                request: raw.request,
+            });
+            return send(res, 200, { authorized: true, ...decision });
+        }
         if (request.kind === "manager-managed-agent-enrollment") {
             const verified = await ctx.verifyManagedAgentEnrollment({
                 owner,
@@ -1819,7 +1908,9 @@ async function handleExchange(req, res, ctx, policy) {
     const peer = policy.peerKey(req);
     const peerThrottled = policy.throttled(ctx, peer);
     const body = await readJsonBody(req);
-    const { idpToken, actor, actorToken, owner, ttlSec, view, managerInstanceId } = body;
+    const { idpToken, actor, actorToken, owner, ttlSec, view, managerInstanceId, sessionGrant } = body;
+    if ((view === "session-caller") !== (sessionGrant !== undefined))
+        return send(res, 400, { error: 'view "session-caller" and sessionGrant come together or not at all' });
     if (ttlSec !== undefined && typeof ttlSec !== "number")
         return send(res, 400, { error: "ttlSec must be a number" });
     if (view !== undefined && typeof view !== "string")
@@ -1898,11 +1989,16 @@ async function handleExchange(req, res, ctx, policy) {
         const selectedManagerInstanceId = view === "manager-caller"
             ? await ctx.selectManagerInstance(deriveOwnerForIdpSubject(ctx.ownerSecret, ctx.bridgeIdp.issuer, (await verifyIdpToken(idpToken, ctx.bridgeIdp)).sub), managerInstanceId)
             : undefined;
+        // #2312: a session-caller bearer is signed only once the identity plane has decided that THIS
+        // principal holds THAT redeemed session. The bridge's `verifySession` hook runs the decision on
+        // the principal it derived, before signing; the callout re-runs it at the mint.
+        const session = view === "session-caller" ? grantCoordinates(sessionGrant) : undefined;
         const r = await ctx.bridge.exchange(idpToken, {
             actor,
             ttlSec,
             view: view,
             managerInstanceId: selectedManagerInstanceId,
+            ...(session ? { verifySession: (p) => ctx.verifySession(p, session) } : {}),
         });
         return send(res, 200, r);
     }