@cotal-ai/auth 0.67.0 → 0.68.0

package/dist/service.js

@@ -57,9 +57,9 @@ import { createHash, randomBytes } from "node:crypto";
 import { createServer } from "node:http";
 import { resolve } from "node:path";
 import { connect, credsAuthenticator } from "@nats-io/transport-node";
-import { jetstreamManager } from "@nats-io/jetstream";
+import { jetstream, jetstreamManager } from "@nats-io/jetstream";
 import { Kvm } from "@nats-io/kv";
-import { CotalEndpoint, deprovisionAgent, isConcreteChannel, provisionAgentDurables, contractDigest, contractRefToHex, contractStoreContext, endpointToken, fetchContractArtifact, verifyClusterManifest, verifyClusterRoot, admissionBucket, admissionMediatorGrants, assertDerivedOwnerToken, assertLifecycleToken, assertValidOwnerToken, authorizeTrustedServeSnapshot, commitSiblingIssuance, credsClaims, EpEnvelopeError, ensureAuthorityStores, epAuthBucket, isReachable, jwtFromCreds, managedRetirementOpId, mintCreds, mintPublicUserJwt, newIdentity, observeHostedRunAttempt, openRecordsBucket, parseEndpointGate, parseServiceSpec, parseServiceStatus, rawDigest, parseSecretStoreIdentity, readCheckpointStatus, readRunAdmission, readRunRecord, readSvcRecordLeader, reconcileEndpointGate, sameSecretStoreIdentity, recordSpecKey, recordStatusKey, RECORD_KINDS, recordsBucket, remoteManagerActors, retirementFrontierStreams, runDriverCaller, serveIssuanceGateKv, standaloneConnectOpts, STANDING_RENEWABLE_TTL_SEC, withIssuerSession, acceptedReadGrant, actorLedgerSource, connectionAcceptedToken, importNativeSubjectPermissions, mintGeneration, parseActorLedgerSource, writeAcceptedRow, invokeCommand, resolveService, contractArtifactCanonicalBytes, DEV_OWNER, endpointRegistrationBarrier, mintLifecycleUid, principalKey, provisionEndpointGateOpen, publishContractArtifact, registerServiceInstance, registerServingInstance } from "@cotal-ai/core";
+import { CotalEndpoint, deprovisionAgent, isConcreteChannel, provisionAgentDurables, contractDigest, contractRefToHex, contractStoreContext, endpointToken, fetchContractArtifact, verifyClusterManifest, verifyClusterRoot, admissionBucket, admissionMediatorGrants, assertDerivedOwnerToken, assertLifecycleToken, assertValidOwnerToken, authorizeTrustedServeSnapshot, commitSiblingIssuance, credsClaims, EpEnvelopeError, ensureAuthorityStores, epAuthBucket, isReachable, jwtFromCreds, managedRetirementOpId, mintCreds, mintPublicUserJwt, newIdentity, newTakeoverId, observeHostedRunAttempt, openRecordsBucket, parseEndpointGate, parseServiceSpec, parseServiceStatus, rawDigest, parseSecretStoreIdentity, readCheckpointStatus, readRunAdmission, readRunRecord, readSvcRecordLeader, reconcileEndpointGate, replayRunJournal, sameSecretStoreIdentity, recordSpecKey, recordStatusKey, RECORD_KINDS, recordsBucket, remoteManagerActors, retirementFrontierStreams, runDriverCaller, serveIssuanceGateKv, standaloneConnectOpts, STANDING_RENEWABLE_TTL_SEC, withIssuerSession, acceptedReadGrant, actorLedgerSource, connectionAcceptedToken, importNativeSubjectPermissions, mintGeneration, parseActorLedgerSource, writeAcceptedRow, invokeCommand, resolveService, contractArtifactCanonicalBytes, DEV_OWNER, endpointRegistrationBarrier, mintLifecycleUid, principalKey, provisionEndpointGateOpen, publishContractArtifact, registerServiceInstance, registerServingInstance } from "@cotal-ai/core";
 import { findCotalRoot, loadManagerInstanceIdentity, userAuthStateDir, workspaceSecretStore, createAuthInstanceIdentity, loadAuthInstanceIdentity } from "@cotal-ai/workspace";
 import { decodeJwt } from "jose";
 import { deriveOwnerForIdpSubject, platformControlOwner } from "./derive.js";
@@ -447,6 +447,9 @@ export async function openAuthAuthorityPlane(opts) {
     }
     const fileArm = ledgerAuthorizeConnect(opts.dir);
     const recordsJsm = await jetstreamManager(remoteIssuer.nc);
+    const authKv = await new Kvm(remoteIssuer.nc).open(epAuthBucket(space));
+    const managerIssuanceGate = (instanceId) => serveIssuanceGateKv(authKv, space, { endpoint: "manager", instanceId });
+    const observeManagerGate = async (instanceId) => managerIssuanceGate(instanceId).observe();
     const loadLocalManager = opts.localManager ?? (() => undefined);
     // Standing renewal and a served resume or answer read the manager surface from the REGISTERED
     // service spec at the gate's registration revision: spec (leader read) -> closure manifest -> root
@@ -475,7 +478,7 @@ export async function openAuthAuthorityPlane(opts) {
     };
     const managerGate = async (owner, instanceId) => {
         const localManager = loadLocalManager();
-        const gate = await serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId }).observe();
+        const gate = await observeManagerGate(instanceId);
         if (!gate)
             return "unknown";
         if (gate.state !== "open")
@@ -590,7 +593,6 @@ export async function openAuthAuthorityPlane(opts) {
         observedRunRequests.delete(subject);
         return observed !== undefined && observed.expires > Date.now() ? observed.request : undefined;
     };
-    const observeManagerGate = async (instanceId) => serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId }).observe();
     // A managed lifecycle's broker footprint, released under a deprovisioner pinned to that uid, so
     // no call here can reach a same-name successor's durables.
     const deprovisionManagedFootprint = async (owner, actor, lifecycleUid, memberChannels) => {
@@ -656,7 +658,7 @@ export async function openAuthAuthorityPlane(opts) {
                 space,
                 managerGate: async (owner, instanceId) => {
                     const verdict = await managerGate(owner, assertLifecycleToken(instanceId, "serving.instanceId"));
-                    const gate = await serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId }).observe();
+                    const gate = await observeManagerGate(instanceId);
                     return { verdict, ...(gate ? { processEpoch: gate.processEpoch } : {}) };
                 },
             }, principal, claim);
@@ -731,7 +733,6 @@ export async function openAuthAuthorityPlane(opts) {
         issueManagerServiceAuthority: async (holder) => {
             refuseIfFenced();
             const { owner } = holder;
-            const observeManagerGate = async (instanceId) => (await serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId }).observe()) ?? null;
             return issueRemoteManagerAuthority({
                 ...holder,
                 authorizeRenewal: ({ owner: o, request: r }) => authorizeRemoteManagerRenewal({
@@ -746,7 +747,8 @@ export async function openAuthAuthorityPlane(opts) {
                     },
                 }),
                 issue: async ({ actors, request: r }) => {
-                    const credential = async (key, profile, actor, opts) => mintPublicUserJwt({ space, account: { pub: dataAccount.pub, signingSeed: dataAccount.signingSeed } }, r.identities[key].id, profile, { ...opts, principal: { owner, actor }, lifecycleUid: r.managerLifecycleUid });
+                    const signer = { space, account: dataAccount };
+                    const credential = async (key, profile, actor, opts) => mintPublicUserJwt(signer, r.identities[key].id, profile, { ...opts, principal: { owner, actor }, lifecycleUid: r.managerLifecycleUid });
                     const credentials = {};
                     const siblingOn = (gate, observed) => async (key, profile, actor) => {
                         const issued = await credential(key, profile, actor, profile === "goal-writer" ? { goalWriter: { endpoint: "manager" }, expiresInSeconds: standingTtl } : { expiresInSeconds: standingTtl });
@@ -767,7 +769,7 @@ export async function openAuthAuthorityPlane(opts) {
                         return issued;
                     };
                     if (r.operation === "renew") {
-                        const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId: r.instanceId });
+                        const gate = managerIssuanceGate(r.instanceId);
                         const observed = await gate.observe();
                         if (!observed || observed.state !== "open")
                             throw new EpEnvelopeError("failed-precondition", "manager-service renewal found no current open manager gate");
@@ -798,7 +800,7 @@ export async function openAuthAuthorityPlane(opts) {
                             throw new EpEnvelopeError("permission-denied", "manager-service session proof does not match this owner/lifecycle");
                         const session = r.session;
                         const exp = Math.min(session.exp, Math.floor(Date.now() / 1000) + 24 * 60 * 60);
-                        credentials.sessionServing = await mintPublicUserJwt({ space, account: { pub: dataAccount.pub, signingSeed: dataAccount.signingSeed } }, session.id, "session-serving", {
+                        credentials.sessionServing = await mintPublicUserJwt(signer, session.id, "session-serving", {
                             principal: { owner, actor: actors.serve },
                             lifecycleUid: r.managerLifecycleUid,
                             sessionServing: { endpoint: "manager", sessionId: session.sessionId, epoch: session.epoch },
@@ -810,7 +812,7 @@ export async function openAuthAuthorityPlane(opts) {
                         const expectedProof = remoteManagerRegistrationProof(owner, r);
                         if (r.registrationProof !== expectedProof)
                             throw new EpEnvelopeError("permission-denied", "manager-service transfer reader proof does not match this owner/lifecycle");
-                        credentials.transferReader = await mintPublicUserJwt({ space, account: { pub: dataAccount.pub, signingSeed: dataAccount.signingSeed } }, r.transferReader.id, "transfer-reader", { principal: { owner, actor: actors.serve }, lifecycleUid: r.managerLifecycleUid, transferReader: { instanceId: r.instanceId } });
+                        credentials.transferReader = await mintPublicUserJwt(signer, r.transferReader.id, "transfer-reader", { principal: { owner, actor: actors.serve }, lifecycleUid: r.managerLifecycleUid, transferReader: { instanceId: r.instanceId } });
                         return { credentials };
                     }
                     if (r.operation === "retire") {
@@ -818,13 +820,13 @@ export async function openAuthAuthorityPlane(opts) {
                         if (r.registrationProof !== expectedProof)
                             throw new EpEnvelopeError("permission-denied", "manager-service retirement proof does not match this owner/lifecycle");
                         const retirement = r.retirement;
-                        const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId: r.instanceId });
+                        const gate = managerIssuanceGate(r.instanceId);
                         const observed = await gate.observe();
                         authorizeRemoteManagerRetirement({
                             owner, serveActor: actors.serve, instanceId: r.instanceId,
                             targetOwner: retirement.target.owner, serveEpoch: retirement.serveEpoch, gate: observed,
                         });
-                        credentials.retirementRequester = await mintPublicUserJwt({ space, account: { pub: dataAccount.pub, signingSeed: dataAccount.signingSeed } }, retirement.id, "retirement-requester", {
+                        credentials.retirementRequester = await mintPublicUserJwt(signer, retirement.id, "retirement-requester", {
                             principal: { owner, actor: actors.serve },
                             lifecycleUid: r.managerLifecycleUid,
                             retirementRequester: {
@@ -839,7 +841,7 @@ export async function openAuthAuthorityPlane(opts) {
                     if (r.operation === "renewStandingBundle") {
                         // authorizeRenewal fresh-checked account, owner, epoch and the current-registration proof
                         // (which binds the held nkeys and lifecycle). Re-observe so every row binds one revision.
-                        const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId: r.instanceId });
+                        const gate = managerIssuanceGate(r.instanceId);
                         const observed = await gate.observe();
                         if (!observed || observed.state !== "open" || observed.processEpoch !== r.processEpoch)
                             throw new EpEnvelopeError("conflict", "manager-service standing renewal gate moved before issuance");
@@ -851,7 +853,7 @@ export async function openAuthAuthorityPlane(opts) {
                             remoteManager: { instanceId: r.instanceId, owner, actor: actors.executor },
                             expiresInSeconds: 5 * 60,
                         });
-                        credentials.serve = await mintPublicUserJwt({ space, account: { pub: dataAccount.pub, signingSeed: dataAccount.signingSeed } }, r.identities.serve.id, "endpoint-serve", {
+                        credentials.serve = await mintPublicUserJwt(signer, r.identities.serve.id, "endpoint-serve", {
                             principal: { owner, actor: actors.serve },
                             lifecycleUid: r.managerLifecycleUid,
                             expiresInSeconds: standingTtl,
@@ -864,7 +866,7 @@ export async function openAuthAuthorityPlane(opts) {
                         return { credentials };
                     }
                     if (r.operation === "renewRunDriver") {
-                        const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId: r.instanceId });
+                        const gate = managerIssuanceGate(r.instanceId);
                         const observed = await gate.observe();
                         if (!observed || observed.state !== "open" || observed.processEpoch !== r.processEpoch)
                             throw new EpEnvelopeError("conflict", "manager-service run renewal gate moved before issuance");
@@ -886,14 +888,13 @@ export async function openAuthAuthorityPlane(opts) {
                             epoch: r.run.epoch,
                             owner,
                         };
-                        const auth = { space, account: { pub: dataAccount.pub, signingSeed: dataAccount.signingSeed } };
-                        credentials.runDriver = await mintPublicUserJwt(auth, r.run.driverId, "run-driver", {
+                        credentials.runDriver = await mintPublicUserJwt(signer, r.run.driverId, "run-driver", {
                             principal: { owner, actor: caller.actor },
                             lifecycleUid: r.managerLifecycleUid,
                             runDriver: binding,
                             expiresInSeconds: standingTtl,
                         });
-                        credentials.runMediator = await mintPublicUserJwt(auth, r.run.mediatorId, "run-mediator", {
+                        credentials.runMediator = await mintPublicUserJwt(signer, r.run.mediatorId, "run-mediator", {
                             principal: { owner, actor: caller.actor },
                             lifecycleUid: r.managerLifecycleUid,
                             // Renewed with the placement the attempt was issued with (authorizeRemoteRunAttempt).
@@ -911,19 +912,17 @@ export async function openAuthAuthorityPlane(opts) {
                         // cross HTTP, so the host independently validates the deterministic proof + canonical
                         // artifact set and scopes the JWT to the already-registered instance rails. The grant
                         // rows are reconstructed from the canonical manager command set by the host protocol.
-                        const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId: r.instanceId });
+                        const gate = managerIssuanceGate(r.instanceId);
                         const observed = await gate.observe();
                         if (!observed)
                             throw new EpEnvelopeError("failed-precondition", "manager-service activation found no issuance gate");
-                        credentials.serve = await mintPublicUserJwt({ space, account: { pub: dataAccount.pub, signingSeed: dataAccount.signingSeed } }, r.identities.serve.id, "endpoint-serve", {
+                        credentials.serve = await mintPublicUserJwt(signer, r.identities.serve.id, "endpoint-serve", {
                             principal: { owner, actor: actors.serve },
                             lifecycleUid: r.managerLifecycleUid,
                             expiresInSeconds: standingTtl,
-                            endpointServe: reconstructRemoteManagerServeGrant(r, owner, actors.serve, observed),
+                            endpointServe: reconstructRemoteManagerServeGrant(r, owner, observed),
                             serveIssuance: gate,
                         });
-                        if (!observed)
-                            throw new EpEnvelopeError("failed-precondition", "manager-service activation found no issuance gate");
                         const sibling = siblingOn(gate, observed);
                         credentials.goalWriter = await sibling("goalWriter", "goal-writer", actors.goalWriter);
                         credentials.sessionLedger = await sibling("sessionLedger", "session-ledger", actors.sessionLedger);
@@ -942,12 +941,11 @@ export async function openAuthAuthorityPlane(opts) {
         maintainRemoteManager: async (holder) => {
             refuseIfFenced();
             const { owner } = holder;
-            const gateKv = await new Kvm(remoteIssuer.nc).open(epAuthBucket(space));
             const authorized = await authorizeRemoteManagerMaintenance({
                 ...holder,
                 space,
                 scanner,
-                observeManagerGate: async (instanceId) => serveIssuanceGateKv(gateKv, space, { endpoint: "manager", instanceId }).observe(),
+                observeManagerGate,
             });
             const evict = makeDeliveryAdminEvictor({ space, server, dataAccount, log });
             if (authorized.operation === "evict-family-principal") {
@@ -999,10 +997,7 @@ export async function openAuthAuthorityPlane(opts) {
                 ...holder,
                 proofSecret: dataAccount.signingSeed,
                 space,
-                observeManagerGate: async (instanceId) => {
-                    const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId });
-                    return gate.observe();
-                },
+                observeManagerGate,
             });
         },
         verifyManagedAgentEnrollment: async ({ owner, scope, request }) => {
@@ -1013,10 +1008,7 @@ export async function openAuthAuthorityPlane(opts) {
                 proofSecret: dataAccount.signingSeed,
                 space,
                 request,
-                observeManagerGate: async (instanceId) => {
-                    const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId });
-                    return gate.observe();
-                },
+                observeManagerGate,
             });
         },
         verifyManagedAgentPrepareRetirement: async ({ owner, scope, request }) => {
@@ -1027,10 +1019,7 @@ export async function openAuthAuthorityPlane(opts) {
                 proofSecret: dataAccount.signingSeed,
                 space,
                 request,
-                observeManagerGate: async (instanceId) => {
-                    const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId });
-                    return gate.observe();
-                },
+                observeManagerGate,
             });
         },
         enrollManagedAgent: async ({ owner, scope, request, sentinelCreds, agentBearerExchangeUrl }) => {
@@ -1155,10 +1144,7 @@ export async function openAuthAuthorityPlane(opts) {
                 dir: opts.dir,
                 proofSecret: dataAccount.signingSeed,
                 space,
-                observeManagerGate: async (instanceId) => {
-                    const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId });
-                    return gate.observe();
-                },
+                observeManagerGate,
             };
             return request.kind === "manager-managed-agent-runtime-status"
                 ? authorizeRemoteManagedAgentRuntimeStatus({ ...args, request })
@@ -1169,10 +1155,7 @@ export async function openAuthAuthorityPlane(opts) {
             const { owner } = holder;
             const authorized = await authorizeRemoteManagerGoalIndexScan({
                 ...holder, proofSecret: dataAccount.signingSeed, space,
-                observeManagerGate: async (instanceId) => {
-                    const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId });
-                    return gate.observe();
-                },
+                observeManagerGate,
             });
             return completeRemoteManagerGoalIndexScan(authorized, owner, await recordsScanner.scanManagerGoalIndex(owner));
         },
@@ -1185,10 +1168,7 @@ export async function openAuthAuthorityPlane(opts) {
                 space,
                 dir: opts.dir,
                 request,
-                observeManagerGate: async (instanceId) => {
-                    const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId });
-                    return gate.observe();
-                },
+                observeManagerGate,
             });
         },
         admitManagerRun: async ({ request, ...holder }) => {
@@ -1214,10 +1194,7 @@ export async function openAuthAuthorityPlane(opts) {
                 try {
                     return await admitRemoteRun({
                         request, owner, space, accountPublicKey: dataAccount.pub, proofSecret: dataAccount.signingSeed, endpoint: "manager",
-                        observeManagerGate: async (instanceId) => {
-                            const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId });
-                            return gate.observe();
-                        },
+                        observeManagerGate,
                         issued: session.store,
                         sourceIsLive: composedSourceIsLive(session),
                         admissions: await new Kvm(admitterNc).open(admissionBucket(space)),
@@ -1253,12 +1230,28 @@ export async function openAuthAuthorityPlane(opts) {
                 accountPublicKey: dataAccount.pub,
                 proofSecret: dataAccount.signingSeed,
                 endpoint: "manager",
-                observeManagerGate: async (instanceId) => {
-                    const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId });
-                    return gate.observe();
-                },
+                observeManagerGate,
                 readAdmission: (runId) => readRunAdmission(recordsJsm, space, "manager", runId),
                 readRunStatus: async (runId) => (await readRunRecord(recordsKv, "manager", runId))?.status?.value,
+                // Replayed under a read operator minted for that one run, the rows the manager's own read rides.
+                readJournal: async (runId) => {
+                    const takeoverId = newTakeoverId();
+                    const readerNc = await connect({
+                        servers: server,
+                        ...standaloneConnectOpts({
+                            creds: await mintCreds(issuerAuth(), newIdentity(), "run-operator", { runOperator: { endpoint: "manager", takeoverId, runId }, expiresInSeconds: 60 }),
+                            tls: false,
+                        }),
+                        maxReconnectAttempts: 0,
+                    });
+                    try {
+                        const replay = await replayRunJournal(jetstream(readerNc), await jetstreamManager(readerNc), space, runId, takeoverId);
+                        return replay.records.flatMap((stored) => stored.record.kind === "step" ? [stored.record.entry] : []);
+                    }
+                    finally {
+                        await readerNc.drain().catch(() => readerNc.close());
+                    }
+                },
                 checkpointWaiting: async (token) => (await readCheckpointStatus(recordsKv, { endpoint: "manager", token }))?.value.state === "waiting",
                 checkpointSettled: async (token) => {
                     const status = (await readCheckpointStatus(recordsKv, { endpoint: "manager", token }))?.value;
@@ -1331,7 +1324,7 @@ export async function openAuthAuthorityPlane(opts) {
         },
         observeManagerInstance: async (instanceId) => {
             refuseIfFenced();
-            const gate = await serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId }).observe();
+            const gate = await observeManagerGate(instanceId);
             const rec = await readSvcRecordLeader(recordsJsm, space, recordSpecKey(RECORD_KINDS.svc, ["manager", instanceId]));
             return { registered: rec !== undefined && !("deleted" in rec), gate: gate ?? null };
         },
@@ -1356,7 +1349,7 @@ export async function openAuthAuthorityPlane(opts) {
         },
         observeEndpointGate: async (endpoint, instanceId) => {
             refuseIfFenced();
-            return await serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint, instanceId }).observe();
+            return await serveIssuanceGateKv(authKv, space, { endpoint, instanceId }).observe();
         },
         fenced,
         close: async () => {