@cotal-ai/auth 0.78.1 → 0.81.1

package/dist/service.js

@@ -98,7 +98,7 @@ import { joinOrStartRetirement, openAuthAdminListener } from "./auth-admin.js";
 import { AUTH_SERVICE_ENDPOINT, authClusterArtifacts, authContractArtifactValues } from "./auth-service-contract.js";
 import { drainTargetForEndpoint, openAdmissionMediator } from "./admission-mediator.js";
 import { AGENT_BEARER_TTL_SEC, assertWithinSpawnerGrant, findInteractiveActor, findManagedActor, findActorUnified, grantManagedActor, ledgerAclResolver, ledgerActorSourceIsLive, ledgerAuthorizeAgentExchange, ledgerAuthorizeConnect, ledgerAuthorizeGrant, revokeManagedActorAt, } from "./ledger.js";
-import { AUTH_PROVIDER_NAME, claimAuthInstanceIdentity, clearAuthServiceInfo, loadCalloutAuth, loadIssuer, loadOwnerSecret, loadPinnedIdp, loadServiceKeys, saveAuthServiceInfo, spaceIssuer, } from "./store.js";
+import { AUTH_PROVIDER_NAME, claimAuthInstanceIdentity, clearAuthServiceInfo, dataAccountAuth, loadCalloutAuth, loadIssuer, loadOwnerSecret, loadPinnedIdp, loadServiceKeys, saveAuthServiceInfo, spaceIssuer, } from "./store.js";
 /** JWKS max-age seconds — the cache contract's knob. Exported so a rotation tool can compute the
  *  retire floor (max-age + max bearer TTL) from it. */
 export const JWKS_MAX_AGE_SEC = 300;
@@ -418,6 +418,12 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
     const authKv = await new Kvm(remoteIssuer.nc).open(epAuthBucket(space));
     const managerIssuanceGate = (instanceId) => serveIssuanceGateKv(authKv, space, { endpoint: "manager", instanceId });
     const observeManagerGate = async (instanceId) => managerIssuanceGate(instanceId).observe();
+    const observeLegacyManagerGate = async (instanceId) => {
+        const gate = await observeManagerGate(instanceId);
+        if (gate?.authorityFamily === "environment-manager")
+            throw new EpEnvelopeError("permission-denied", `manager instance ${instanceId} belongs to the environment-manager authority family`);
+        return gate;
+    };
     const loadLocalManager = opts.localManager ?? (() => undefined);
     // Standing renewal and a served resume or answer read the manager surface from the REGISTERED
     // service spec at the gate's registration revision: spec (leader read) -> closure manifest -> root
@@ -447,7 +453,7 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
     };
     const managerGate = async (owner, instanceId) => {
         const localManager = loadLocalManager();
-        const gate = await observeManagerGate(instanceId);
+        const gate = await observeLegacyManagerGate(instanceId);
         if (!gate)
             return "unknown";
         if (gate.state !== "open")
@@ -492,6 +498,8 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                 throw new EpEnvelopeError("internal", `the manager gate scan returned the malformed key ${raw.key}`);
             const instanceId = assertLifecycleToken(parts[2], "managerInstanceId");
             const row = parseEndpointGate(raw.data, raw.key);
+            if (row.authorityFamily === "environment-manager")
+                continue;
             if (row.principal === `${owner}.${remoteManagerActors(instanceId).serve}`) {
                 remoteInstances.push(instanceId);
                 if (await managerGate(owner, instanceId) === "candidate")
@@ -521,14 +529,7 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
         if (fatalReason !== undefined || closing)
             throw new EpEnvelopeError("unavailable", `the auth service for space "${space}" is momentarily unavailable (it detected a fault and is restarting); retry shortly`);
     };
-    // The plane holds only the data account's signing key. The operator and system halves stay blank
-    // because core's mint reads only the space, the account pub and the signing seed.
-    const issuerAuth = () => ({
-        space,
-        operator: { seed: "", jwt: "" },
-        account: { pub: dataAccount.pub, seed: "", jwt: "", signingSeed: dataAccount.signingSeed, signingPub: "" },
-        sys: { pub: "", jwt: "" },
-    });
+    const issuerAuth = () => dataAccountAuth(space, dataAccount);
     // The source check the issuing host resolves with: an actor-ledger row is attested here, from the
     // ledger this service owns; every other coordinate goes to core's check (SPEC 13.15).
     const composedSourceIsLive = (session) => (source) => parseActorLedgerSource(source) ? Promise.resolve(ledgerActorSourceIsLive(opts.dir)(source)) : session.sourceIsLive(source);
@@ -628,7 +629,7 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                 space,
                 managerGate: async (owner, instanceId) => {
                     const verdict = await managerGate(owner, assertLifecycleToken(instanceId, "serving.instanceId"));
-                    const gate = await observeManagerGate(instanceId);
+                    const gate = await observeLegacyManagerGate(instanceId);
                     return { verdict, ...(gate ? { processEpoch: gate.processEpoch } : {}) };
                 },
             }, principal, claim);
@@ -706,7 +707,7 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
             // The ended-assignment fence (SPEC 13.16): read on every call, before anything is signed. The
             // retired gate and the retired generations are terminal rows, so no host view reopens them.
             if (holder.supervisorExpiresAt !== undefined) {
-                const gate = await observeManagerGate(holder.request.instanceId);
+                const gate = await observeLegacyManagerGate(holder.request.instanceId);
                 if (gate?.state === "retired")
                     throw platformSupervisorEnded(owner);
                 await withIssuerSession({ servers: server, space, auth: issuerAuth(), tls: false }, async (session) => {
@@ -728,11 +729,16 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                 ...holder,
                 authorizeRenewal: ({ owner: o, request: r }) => authorizeRemoteManagerRenewal({
                     request: r, owner: o, space, accountPublicKey: dataAccount.pub, proofSecret: dataAccount.signingSeed,
-                    observeManagerGate,
+                    observeManagerGate: observeLegacyManagerGate,
                     observeRun: (runId) => observeManagerRun(r, runId),
                 }),
                 issue: async ({ actors, request: r }) => {
-                    const signer = { space, account: dataAccount };
+                    const existing = await observeLegacyManagerGate(r.instanceId);
+                    if (r.operation === "prepare" && existing === null) {
+                        await provisionEndpointGateOpen(authKv, {
+                            endpoint: "manager", instanceId: r.instanceId, principal: `${owner}.${actors.serve}`,
+                        });
+                    }
                     const bounded = (opts) => {
                         if (holder.supervisorExpiresAt === undefined)
                             return opts;
@@ -743,7 +749,7 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                         return { ...rest, expiresAt: Math.min(holder.supervisorExpiresAt, expiresAt ?? now + (expiresInSeconds ?? standingTtl)) };
                     };
                     const registration = { space: r.space, instanceId: r.instanceId, lifecycleUid: r.managerLifecycleUid, identities: r.identities };
-                    const credential = async (key, profile, actor, opts) => mintPublicUserJwt(signer, r.identities[key].id, profile, bounded({ ...opts, principal: { owner, actor }, lifecycleUid: r.managerLifecycleUid }));
+                    const credential = async (key, profile, actor, opts) => mintPublicUserJwt(issuerAuth(), r.identities[key].id, profile, bounded({ ...opts, principal: { owner, actor }, lifecycleUid: r.managerLifecycleUid }));
                     const credentials = {};
                     const siblingOn = (gate, observed) => async (key, profile, actor) => {
                         const issued = await credential(key, profile, actor, profile === "goal-writer" ? { goalWriter: { endpoint: "manager" }, expiresInSeconds: standingTtl } : { expiresInSeconds: standingTtl });
@@ -794,7 +800,7 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                             throw new EpEnvelopeError("permission-denied", "manager-service session proof does not match this owner/lifecycle");
                         const session = r.session;
                         const exp = Math.min(session.exp, Math.floor(Date.now() / 1000) + 24 * 60 * 60);
-                        credentials.sessionServing = await mintPublicUserJwt(signer, session.id, "session-serving", {
+                        credentials.sessionServing = await mintPublicUserJwt(issuerAuth(), session.id, "session-serving", {
                             principal: { owner, actor: actors.serve },
                             lifecycleUid: r.managerLifecycleUid,
                             sessionServing: { endpoint: "manager", sessionId: session.sessionId, epoch: session.epoch },
@@ -806,7 +812,7 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                         const expectedProof = remoteManagerRegistrationProof(owner, registration);
                         if (r.registrationProof !== expectedProof)
                             throw new EpEnvelopeError("permission-denied", "manager-service transfer reader proof does not match this owner/lifecycle");
-                        credentials.transferReader = await mintPublicUserJwt(signer, r.transferReader.id, "transfer-reader", { principal: { owner, actor: actors.serve }, lifecycleUid: r.managerLifecycleUid, transferReader: { instanceId: r.instanceId } });
+                        credentials.transferReader = await mintPublicUserJwt(issuerAuth(), r.transferReader.id, "transfer-reader", { principal: { owner, actor: actors.serve }, lifecycleUid: r.managerLifecycleUid, transferReader: { instanceId: r.instanceId } });
                         return { credentials };
                     }
                     if (r.operation === "retire") {
@@ -820,7 +826,7 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                             owner, serveActor: actors.serve, instanceId: r.instanceId,
                             targetOwner: retirement.target.owner, serveEpoch: retirement.serveEpoch, gate: observed,
                         });
-                        credentials.retirementRequester = await mintPublicUserJwt(signer, retirement.id, "retirement-requester", {
+                        credentials.retirementRequester = await mintPublicUserJwt(issuerAuth(), retirement.id, "retirement-requester", {
                             principal: { owner, actor: actors.serve },
                             lifecycleUid: r.managerLifecycleUid,
                             retirementRequester: {
@@ -847,7 +853,7 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                             remoteManager: { instanceId: r.instanceId, owner, actor: actors.executor },
                             expiresInSeconds: 5 * 60,
                         });
-                        credentials.serve = await mintPublicUserJwt(signer, r.identities.serve.id, "endpoint-serve", bounded({
+                        credentials.serve = await mintPublicUserJwt(issuerAuth(), r.identities.serve.id, "endpoint-serve", bounded({
                             principal: { owner, actor: actors.serve },
                             lifecycleUid: r.managerLifecycleUid,
                             expiresInSeconds: standingTtl,
@@ -875,13 +881,13 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                             epoch: r.run.epoch,
                             owner,
                         };
-                        credentials.runDriver = await mintPublicUserJwt(signer, r.run.driverId, "run-driver", bounded({
+                        credentials.runDriver = await mintPublicUserJwt(issuerAuth(), r.run.driverId, "run-driver", bounded({
                             principal: { owner, actor: caller.actor },
                             lifecycleUid: r.managerLifecycleUid,
                             runDriver: binding,
                             expiresInSeconds: standingTtl,
                         }));
-                        credentials.runMediator = await mintPublicUserJwt(signer, r.run.mediatorId, "run-mediator", bounded({
+                        credentials.runMediator = await mintPublicUserJwt(issuerAuth(), r.run.mediatorId, "run-mediator", bounded({
                             principal: { owner, actor: caller.actor },
                             lifecycleUid: r.managerLifecycleUid,
                             // Renewed with the placement the attempt was issued with (authorizeRemoteRunAttempt).
@@ -903,7 +909,7 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                         const observed = await gate.observe();
                         if (!observed)
                             throw new EpEnvelopeError("failed-precondition", "manager-service activation found no issuance gate");
-                        credentials.serve = await mintPublicUserJwt(signer, r.identities.serve.id, "endpoint-serve", bounded({
+                        credentials.serve = await mintPublicUserJwt(issuerAuth(), r.identities.serve.id, "endpoint-serve", bounded({
                             principal: { owner, actor: actors.serve },
                             lifecycleUid: r.managerLifecycleUid,
                             expiresInSeconds: standingTtl,
@@ -954,6 +960,7 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
         },
         endPlatformSupervisor: async ({ owner, instanceId, lifecycleUid }) => {
             refuseIfFenced();
+            await observeLegacyManagerGate(instanceId);
             // Retire the issued generations first, then the gate. Each step is idempotent, so a retry after
             // a partial end completes it. The retired gate alone refuses a lifecycle that issued nothing.
             await withIssuerSession({ servers: server, space, auth: issuerAuth(), tls: false }, async (session) => {
@@ -984,6 +991,8 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                 if (entry.operation !== "PUT")
                     throw new EpEnvelopeError("failed-precondition", `the manager gate ${key} carries a ${entry.operation} marker; a gate is never deleted (SPEC 13.12)`);
                 const row = parseEndpointGate(entry.value, key);
+                if (row.authorityFamily === "environment-manager")
+                    throw new EpEnvelopeError("permission-denied", `manager instance ${instanceId} belongs to the environment-manager authority family`);
                 if (row.principal !== `${owner}.${remoteManagerActors(instanceId).serve}`)
                     throw new EpEnvelopeError("permission-denied", `the manager gate ${key} belongs to ${row.principal}, not owner ${owner}`);
                 if (row.state === "retired")
@@ -1004,11 +1013,12 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
         maintainRemoteManager: async (holder) => {
             refuseIfFenced();
             const { owner } = holder;
+            await observeLegacyManagerGate(holder.request.instanceId);
             const authorized = await authorizeRemoteManagerMaintenance({
                 ...holder,
                 space,
                 scanner,
-                observeManagerGate,
+                observeManagerGate: observeLegacyManagerGate,
             });
             const evictHolders = makeDeliveryAdminHolderEvictor({ onConnection, space, server, dataAccount, log });
             if (authorized.operation === "evict-family-principal") {
@@ -1055,7 +1065,7 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                 ...holder,
                 proofSecret: dataAccount.signingSeed,
                 space,
-                observeManagerGate,
+                observeManagerGate: observeLegacyManagerGate,
             });
         },
         verifyManagedAgentEnrollment: async ({ owner, scope, request }) => {
@@ -1066,7 +1076,7 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                 proofSecret: dataAccount.signingSeed,
                 space,
                 request,
-                observeManagerGate,
+                observeManagerGate: observeLegacyManagerGate,
             });
         },
         verifyManagedAgentPrepareRetirement: async ({ owner, scope, request }) => {
@@ -1077,12 +1087,12 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                 proofSecret: dataAccount.signingSeed,
                 space,
                 request,
-                observeManagerGate,
+                observeManagerGate: observeLegacyManagerGate,
             });
         },
         enrollManagedAgent: async ({ owner, scope, request, sentinelCreds, agentBearerExchangeUrl }) => {
             refuseIfFenced();
-            const r = await authorizeRemoteManagedAgentEnrollment({ owner, scope, proofSecret: dataAccount.signingSeed, space, request, observeManagerGate });
+            const r = await authorizeRemoteManagedAgentEnrollment({ owner, scope, proofSecret: dataAccount.signingSeed, space, request, observeManagerGate: observeLegacyManagerGate });
             const t = r.target;
             const subscribe = t.subscribe ?? [];
             const { lifecycleUid, row } = await serializedForAlias(opts.dir, owner, t.actor, async () => {
@@ -1170,7 +1180,7 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
         },
         prepareManagedAgentRetirement: async ({ owner, scope, request }) => {
             refuseIfFenced();
-            const r = await authorizeRemoteManagedAgentPrepareRetirement({ owner, scope, proofSecret: dataAccount.signingSeed, space, request, observeManagerGate });
+            const r = await authorizeRemoteManagedAgentPrepareRetirement({ owner, scope, proofSecret: dataAccount.signingSeed, space, request, observeManagerGate: observeLegacyManagerGate });
             const { actor, lifecycleUid } = r.target;
             await serializedForAlias(opts.dir, owner, actor, async () => {
                 // Only a grant still at the target uid is this lifecycle's. A row at another uid belongs to a
@@ -1203,7 +1213,7 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                 dir: opts.dir,
                 proofSecret: dataAccount.signingSeed,
                 space,
-                observeManagerGate,
+                observeManagerGate: observeLegacyManagerGate,
             };
             return request.kind === "manager-managed-agent-runtime-status"
                 ? authorizeRemoteManagedAgentRuntimeStatus({ ...args, request })
@@ -1214,7 +1224,7 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
             const { owner } = holder;
             const authorized = await authorizeRemoteManagerGoalIndexScan({
                 ...holder, proofSecret: dataAccount.signingSeed, space,
-                observeManagerGate,
+                observeManagerGate: observeLegacyManagerGate,
             });
             return completeRemoteManagerGoalIndexScan(authorized, owner, await recordsScanner.scanManagerGoalIndex(owner));
         },
@@ -1227,14 +1237,16 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                 space,
                 dir: opts.dir,
                 request,
-                observeManagerGate,
+                observeManagerGate: observeLegacyManagerGate,
             });
         },
         admitManagerRun: async ({ request, ...holder }) => {
             refuseIfFenced();
             const { owner } = holder;
             requireManagerAuthorityHolder(holder, String(request?.instanceId), 'manager run admission needs scope "supervise"; spawn/admin do not imply it');
-            const runId = parseRemoteRunAdmissionRequest(request).run.runId;
+            const parsed = parseRemoteRunAdmissionRequest(request);
+            await observeLegacyManagerGate(parsed.instanceId);
+            const runId = parsed.run.runId;
             return withIssuerSession({ servers: server, space, auth: issuerAuth(), tls: false }, async (session) => {
                 const admitterNc = await connect({
                     servers: server,
@@ -1248,7 +1260,7 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                 try {
                     return await admitRemoteRun({
                         request, owner, space, accountPublicKey: dataAccount.pub, proofSecret: dataAccount.signingSeed, endpoint: "manager",
-                        observeManagerGate,
+                        observeManagerGate: observeLegacyManagerGate,
                         issued: session.store,
                         sourceIsLive: composedSourceIsLive(session),
                         takeObserved: takeObservedRunRequest,
@@ -1263,6 +1275,7 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
         revokeManagerRun: async ({ request, ...holder }) => {
             refuseIfFenced();
             const req = parseRemoteRunRevokeRequest(request);
+            await observeLegacyManagerGate(req.instanceId);
             const admitterNc = await connect({
                 servers: server,
                 ...standaloneConnectOpts({
@@ -1275,7 +1288,7 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
             try {
                 return await revokeRemoteRun({
                     ...holder, request: req, space, accountPublicKey: dataAccount.pub, proofSecret: dataAccount.signingSeed, endpoint: "manager",
-                    observeManagerGate,
+                    observeManagerGate: observeLegacyManagerGate,
                     readAdmission: (runId) => readRunAdmission(recordsJsm, space, "manager", runId),
                     readRevocation: (runId) => readRunRevocation(recordsJsm, space, "manager", runId),
                     admissions: await new Kvm(admitterNc).open(admissionBucket(space)),
@@ -1290,6 +1303,7 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
             const { owner } = holder;
             requireManagerAuthorityHolder(holder, String(request?.instanceId), 'manager run attempt needs scope "supervise"; spawn/admin do not imply it');
             const req = parseRemoteRunAttemptRequest(request);
+            await observeLegacyManagerGate(req.instanceId);
             const recordsKv = await openRecordsBucket(remoteIssuer.nc, space);
             const authorize = (session) => authorizeRemoteRunAttempt({
                 ...(session ? { issued: session.store, sourceIsLive: composedSourceIsLive(session) } : {}),
@@ -1310,7 +1324,7 @@ async function buildAuthAuthorityPlane(opts, unwind, onConnection) {
                 accountPublicKey: dataAccount.pub,
                 proofSecret: dataAccount.signingSeed,
                 endpoint: "manager",
-                observeManagerGate,
+                observeManagerGate: observeLegacyManagerGate,
                 readAdmission: (runId) => readRunAdmission(recordsJsm, space, "manager", runId),
                 readRunStatus: async (runId) => (await readRunRecord(recordsKv, "manager", runId))?.status?.value,
                 // Replayed under a read operator minted for that one run, the rows the manager's own read rides.