@tpsdev-ai/flair 0.10.1 → 0.12.0

package/dist/cli.js

@@ -736,25 +736,30 @@ export async function provisionFabric(target, opsTarget, clusterAdminUser, clust
 // FederationPair resource handler.  The role carries no table permissions itself
 // — the resource's own allowCreate bypass handles route-level access once the
 // request gets through the auth gate.
-/** Canonical permission spec for flair_pair_initiator. */
+/**
+ * Canonical permission spec for flair_pair_initiator.
+ *
+ * The role intentionally carries NO table permissions — its only job is to exist
+ * so bootstrap credentials can pass Harper platform auth before reaching the
+ * FederationPair resource handler (the resource's own allowCreate bypass handles
+ * route-level access). A bare role with both flags false is valid, grants nothing,
+ * and is exactly that intent.
+ *
+ * This previously carried an all-false `flair.tables` block, but Harper's add_role
+ * REJECTED the whole spec with a 400 (verified live against a spawned Harper):
+ *   - `cluster_user` is not a recognized top-level key — Harper reads unknown keys
+ *     as database names ("database 'cluster_user' does not exist");
+ *   - the table names were the logical shorthand, not the real @table names
+ *     ("Table 'flair.Workspace' does not exist" — it's WorkspaceState; "Event" is
+ *     OrgEvent; "OAuth" is OAuthClient);
+ *   - each grant omitted the required `attribute_permissions` array.
+ * The all-false block granted nothing anyway, so dropping it loses no capability
+ * and unbreaks fresh hub provisioning (where add_role runs and the 400 aborted
+ * `flair init --remote`). Only top-level booleans Harper recognizes remain.
+ */
 const PAIR_INITIATOR_PERMISSION = {
     super_user: false,
-    cluster_user: false,
     structure_user: false,
-    flair: {
-        tables: {
-            Memory: { read: false, insert: false, update: false, delete: false },
-            Soul: { read: false, insert: false, update: false, delete: false },
-            Agent: { read: false, insert: false, update: false, delete: false },
-            Workspace: { read: false, insert: false, update: false, delete: false },
-            Event: { read: false, insert: false, update: false, delete: false },
-            OAuth: { read: false, insert: false, update: false, delete: false },
-            Instance: { read: false, insert: false, update: false, delete: false },
-            Peer: { read: false, insert: false, update: false, delete: false },
-            PairingToken: { read: false, insert: false, update: false, delete: false },
-            SyncLog: { read: false, insert: false, update: false, delete: false },
-        },
-    },
 };
 /**
  * Idempotently ensures the `flair_pair_initiator` role exists on the Harper
@@ -805,6 +810,174 @@ export async function ensureFlairPairInitiatorRole(opsUrl, adminUser, adminPass)
     }, adminUser, adminPass);
     console.log(`Role '${ROLE_NAME}' updated ✓`);
 }
+// ─── flair_agent role ────────────────────────────────────────────────────────
+//
+// The auth reshape replaces the global gate's "verified agent borrows admin
+// super_user" elevation with a real, least-privilege Harper role. After an
+// agent's Ed25519 signature verifies, resources resolve the request to the
+// shared `flair_agent`-roled user instead of admin — so agents get exactly the
+// table CRUD below and nothing more. Critically: with no `super_user` and no
+// operations grants, /sql and /graphql become NATIVELY 403 for agents (the
+// raw-query block the gate hand-rolled is now enforced by Harper itself).
+//
+// Row-level ownership (an agent touches only its OWN memories/soul/events) is
+// NOT expressible in Harper's role model — it stays in each resource's allow*,
+// keyed on the Ed25519-verified agentId. So these per-table grants are the
+// coarse CRUD envelope; allow* is the ownership boundary inside it.
+//
+// VALIDATION GATES (must confirm against a live Harper before this role goes
+// live — flagged for Sherlock + the PR, not assumed):
+//   1. HNSW/vector search (SemanticSearch over Memory) works with table `read`
+//      alone — the old elevation comment claimed admin perms were needed for
+//      "HNSW-capable" access; confirm `read` suffices or widen precisely.
+//   2. Role table keys must EXACTLY match the @table names (Memory, OrgEvent,
+//      WorkspaceState, OAuthClient — NOT the logical Memory/Event/Workspace/OAuth
+//      shorthand the flair_pair_initiator spec used, which was harmless only
+//      because every grant there is false).
+//   3. Obs* writes: if the presence-emitter writes ObsAgentSnapshot AS the agent
+//      it needs insert/update — currently read-only here; confirm the writer's
+//      identity (system vs agent) and widen only if it's the agent.
+// Harper 5.0.21 add_role requires an `attribute_permissions` array on EVERY table
+// grant (empty = no attribute-level restriction, so the table-level CRUD applies);
+// omitting it makes add_role reject the whole spec ("Missing 'attribute_permissions'
+// array"). Validated live against a spawned Harper. This helper guarantees the
+// array is never forgotten. Also: `cluster_user` is NOT a valid top-level key —
+// Harper reads unrecognized top-level keys as database names ("database
+// 'cluster_user' does not exist"); only super_user / structure_user are recognized.
+const grant = (read, insert, update, del) => ({ read, insert, update, delete: del, attribute_permissions: [] });
+/** Canonical permission spec for flair_agent (least-privilege; real @table names). */
+const FLAIR_AGENT_PERMISSION = {
+    super_user: false,
+    structure_user: false,
+    flair: {
+        tables: {
+            // Core agent-owned data — CRUD envelope; ownership enforced in allow*.
+            Memory: grant(true, true, true, true),
+            MemoryCandidate: grant(true, true, true, true),
+            MemoryGrant: grant(true, true, true, true),
+            Soul: grant(true, true, true, false),
+            OrgEvent: grant(true, true, true, true),
+            WorkspaceState: grant(true, true, true, true),
+            Relationship: grant(true, true, true, true),
+            Integration: grant(true, true, true, true),
+            Credential: grant(true, true, true, true),
+            Presence: grant(true, true, true, false),
+            // Agent: read for discovery, update own card; creation/removal is admin.
+            Agent: grant(true, false, true, false),
+            // Read-only reference data.
+            Instance: grant(true, false, false, false),
+            // Observatory read-models — public reads; writes are system-driven (gate 3).
+            ObsOffice: grant(true, false, false, false),
+            ObsAgentSnapshot: grant(true, false, false, false),
+            ObsEventFeed: grant(true, false, false, false),
+            // Federation / OAuth / IdP / internal — system + admin only; agents get none.
+            Peer: grant(false, false, false, false),
+            PairingToken: grant(false, false, false, false),
+            SyncLog: grant(false, false, false, false),
+            OAuthClient: grant(false, false, false, false),
+            OAuthToken: grant(false, false, false, false),
+            OAuthAuthCode: grant(false, false, false, false),
+            IdpConfig: grant(false, false, false, false),
+            IdJagReplay: grant(false, false, false, false),
+        },
+    },
+};
+/**
+ * Idempotently ensures the `flair_agent` role exists on the Harper instance at
+ * `opsUrl` with the canonical least-privilege spec. Same list/add/alter shape as
+ * ensureFlairPairInitiatorRole.
+ *
+ * - absent → `add_role`
+ * - exists with different permissions → `alter_role`
+ * - already matches → no-op
+ */
+export async function ensureFlairAgentRole(opsUrl, adminUser, adminPass) {
+    const ROLE_NAME = "flair_agent";
+    let roles = [];
+    try {
+        const result = await callOpsApi(opsUrl, { operation: "list_roles" }, adminUser, adminPass);
+        roles = Array.isArray(result) ? result : [];
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`ensureFlairAgentRole: list_roles failed: ${msg}`);
+    }
+    const existing = roles.find((r) => r.role === ROLE_NAME || r.name === ROLE_NAME);
+    if (!existing) {
+        console.log(`Creating role '${ROLE_NAME}'...`);
+        await callOpsApi(opsUrl, {
+            operation: "add_role",
+            role: ROLE_NAME,
+            permission: FLAIR_AGENT_PERMISSION,
+        }, adminUser, adminPass);
+        console.log(`Role '${ROLE_NAME}' created ✓`);
+        return;
+    }
+    const existingPerm = existing.permission ?? existing.role?.permission;
+    const canonicalStr = JSON.stringify(FLAIR_AGENT_PERMISSION);
+    const existingStr = JSON.stringify(existingPerm);
+    if (existingStr === canonicalStr) {
+        console.log(`Role '${ROLE_NAME}' already exists with correct permissions — skipping`);
+        return;
+    }
+    console.log(`Role '${ROLE_NAME}' exists but permissions differ — updating...`);
+    await callOpsApi(opsUrl, {
+        operation: "alter_role",
+        role: ROLE_NAME,
+        permission: FLAIR_AGENT_PERMISSION,
+    }, adminUser, adminPass);
+    console.log(`Role '${ROLE_NAME}' updated ✓`);
+}
+/**
+ * Shared Harper user that verified Ed25519 agents are resolved to.
+ * MUST match FLAIR_AGENT_USERNAME in resources/agent-auth.ts (the gate side).
+ * Not imported from there because cli.ts is standalone and that module pulls in
+ * Harper's native bindings — kept as a cross-referenced literal instead.
+ */
+export const FLAIR_AGENT_USERNAME = "flair-agent";
+/**
+ * Idempotently ensures the shared `flair-agent` Harper user exists with the
+ * `flair_agent` role. Verified Ed25519 agents are resolved to THIS user
+ * (`getUser("flair-agent", null)` — no password check, identity already proven
+ * cryptographically), replacing the old `getUser("admin")` super_user elevation.
+ *
+ * The password is random and never used for authentication: the agent path
+ * resolves the user without it, and the auth gate's Basic path only accepts
+ * super_user / pair-bootstrap (a flair_agent Basic login is rejected there), so
+ * a Basic login as this user can't reach anything. Random + unused = safe.
+ *
+ * Row-level ownership stays in each resource's allow* (keyed on the verified
+ * agentId); this shared user only carries the flair_agent role's table grants.
+ */
+export async function ensureFlairAgentUser(opsUrl, adminUser, adminPass) {
+    const unusedPassword = randomBytes(32).toString("base64url");
+    try {
+        await callOpsApi(opsUrl, {
+            operation: "add_user",
+            username: FLAIR_AGENT_USERNAME,
+            password: unusedPassword,
+            role: "flair_agent",
+            active: true,
+        }, adminUser, adminPass);
+        console.log(`User '${FLAIR_AGENT_USERNAME}' created ✓`);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (msg.includes("already exists") || msg.includes("duplicate")) {
+            // Idempotent: ensure the role is correct without churning the password.
+            await callOpsApi(opsUrl, {
+                operation: "alter_user",
+                username: FLAIR_AGENT_USERNAME,
+                role: "flair_agent",
+                active: true,
+            }, adminUser, adminPass);
+            console.log(`User '${FLAIR_AGENT_USERNAME}' already exists — role ensured ✓`);
+        }
+        else {
+            throw err;
+        }
+    }
+}
 // ─── Upgrade presence probes ──────────────────────────────────────────────────
 //
 // `flair upgrade` previously called `npm list -g <pkg>` to detect the installed
@@ -1126,6 +1299,16 @@ program
             if (opts.remote) {
                 await ensureFlairPairInitiatorRole(opsUrl, DEFAULT_ADMIN_USER, flairAdminPass);
             }
+            // Every flair instance has agents, so provision the least-privilege
+            // flair_agent role (idempotent, harmless until a user is assigned to it).
+            await ensureFlairAgentRole(opsUrl, DEFAULT_ADMIN_USER, flairAdminPass);
+            // THE FLIP (auth-rbac): provision the shared least-privilege flair-agent user.
+            // This ACTIVATES the gate's per-agent de-elevation (verified non-admin agents
+            // resolve to flair-agent instead of admin super_user). Safe now: #487 gave
+            // every agent-facing resource its own allow* + resolveAgentAuth, so they no
+            // longer rely on the admin super_user bypass. The gate also falls back to
+            // admin if this user is ever absent, so de-elevation degrades gracefully.
+            await ensureFlairAgentUser(opsUrl, DEFAULT_ADMIN_USER, flairAdminPass);
         }
         else {
             // ── Existing behavior: --admin-pass required for already-running Flair ──
@@ -3454,24 +3637,35 @@ export async function runFederationSyncOnce(opts) {
         }
         let totalBatches = 0;
         for (const table of tables) {
-            let res;
-            try {
-                res = await fetch(`${opsEndpoint}/`, {
-                    method: "POST",
-                    headers: { "Content-Type": "application/json", Authorization: auth },
-                    body: JSON.stringify({ operation: "search_by_conditions", schema: "flair", table, operator: "and", conditions: [{ search_attribute: "updatedAt", search_type: "greater_than", search_value: since }], get_attributes: ["*"] }),
-                    signal: AbortSignal.timeout(15_000),
-                });
-            }
-            catch (err) {
-                return { pushed: totalMerged, skipped: totalSkipped, error: err instanceof Error ? err : new Error(String(err)) };
-            }
-            if (!res.ok) {
-                const text = await res.text().catch(() => "");
-                return { pushed: totalMerged, skipped: totalSkipped, error: new Error(`SQL query failed (${res.status}): ${text}`) };
+            let rows = [];
+            for (const query of [
+                { search_attribute: "updatedAt", search_type: "greater_than", search_value: since },
+                // Rows with null updatedAt (legacy direct-insert rows) use createdAt.
+                // COALESCE(updatedAt, createdAt) > since → pick up null-updatedAt rows
+                // whose createdAt > since. Filtered in JS below.
+                { search_attribute: "updatedAt", search_type: "equals", search_value: null },
+            ]) {
+                let res;
+                try {
+                    res = await fetch(`${opsEndpoint}/`, {
+                        method: "POST",
+                        headers: { "Content-Type": "application/json", Authorization: auth },
+                        body: JSON.stringify({ operation: "search_by_conditions", schema: "flair", table, operator: "and", conditions: [query], get_attributes: ["*"] }),
+                        signal: AbortSignal.timeout(15_000),
+                    });
+                }
+                catch (err) {
+                    return { pushed: totalMerged, skipped: totalSkipped, error: err instanceof Error ? err : new Error(String(err)) };
+                }
+                if (!res.ok) {
+                    const text = await res.text().catch(() => "");
+                    return { pushed: totalMerged, skipped: totalSkipped, error: new Error(`SQL query failed (${res.status}): ${text}`) };
+                }
+                const batch = await res.json();
+                // For null-updatedAt rows, use createdAt as the effective timestamp.
+                // Skip rows created before the last sync cursor.
+                rows = rows.concat(batch.filter((r) => r.updatedAt !== null || r.createdAt > since));
             }
-            // Stream-collect records into batches
-            const rows = await res.json();
             if (rows.length === 0)
                 continue;
             let batch = [];
@@ -3528,6 +3722,31 @@ export async function runFederationSyncOnce(opts) {
             console.warn(`⚠️  Local hub.lastSyncAt advance error: ${advErr?.message ?? advErr}. Next poll will re-send memories.`);
         }
         if (totalBatches === 0) {
+            // ops-c7t9: no-change syncs must still ping the hub so it updates the
+            // spoke's lastSyncAt (liveness). Without this, idle-but-alive spokes
+            // look indistinguishable from dead ones on the hub dashboard.
+            try {
+                if (!secretKey)
+                    secretKey = await loadInstanceSecretKey(instance.id, opts);
+                const pingBody = signBodyFresh({
+                    instanceId: instance.id,
+                    records: [],
+                    lamportClock: Date.now(),
+                }, secretKey);
+                const pingRes = await fetch(`${hubUrl}/FederationSync`, {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json" },
+                    body: JSON.stringify(pingBody),
+                    signal: AbortSignal.timeout(10_000),
+                });
+                if (!pingRes.ok) {
+                    const txt = await pingRes.text().catch(() => "");
+                    console.warn(`⚠️  Liveness ping to hub failed (${pingRes.status}): ${txt.slice(0, 200)}. Hub won't update spoke liveness.`);
+                }
+            }
+            catch (pingErr) {
+                console.warn(`⚠️  Liveness ping error: ${pingErr?.message ?? pingErr}. Hub won't update spoke liveness.`);
+            }
             console.log("No changes since last sync.");
             return { pushed: 0, skipped: 0 };
         }
@@ -8815,9 +9034,74 @@ program
         process.exit(1);
     }
 });
+// ─── flair presence ─────────────────────────────────────────────────────────
+const VALID_PRESENCE_ACTIVITIES = ["coding", "reviewing", "planning", "idle"];
+const MAX_TASK_LENGTH = 120;
+const presence = program.command("presence").description("Manage agent presence (The Office Space)");
+presence
+    .command("set")
+    .description("Set your agent's current activity and task (POST /Presence)")
+    .option("--activity <activity>", `Activity type (${VALID_PRESENCE_ACTIVITIES.join("|")})`)
+    .option("--task <text>", "Short description of what you're working on")
+    .option("--agent <id>", "Agent ID (env: FLAIR_AGENT_ID)")
+    .option("--port <port>", "Harper HTTP port")
+    .option("--target <url>", "Remote Flair URL (env: FLAIR_TARGET)")
+    .action(async (opts) => {
+    const agentId = resolveAgentIdOrEnv(opts);
+    if (!agentId) {
+        console.error("Error: agent ID required. Pass --agent <id> or set FLAIR_AGENT_ID environment variable.");
+        process.exit(1);
+    }
+    // Validate activity
+    if (!opts.activity) {
+        console.error("Error: --activity is required.");
+        process.exit(1);
+    }
+    const activity = opts.activity;
+    if (!VALID_PRESENCE_ACTIVITIES.includes(activity)) {
+        console.error(`Error: invalid activity '${activity}'. Must be one of: ${VALID_PRESENCE_ACTIVITIES.join(", ")}`);
+        process.exit(1);
+    }
+    // Validate task length
+    const task = opts.task ?? undefined;
+    if (task && task.length > MAX_TASK_LENGTH) {
+        console.error(`Error: --task exceeds ${MAX_TASK_LENGTH} character limit (got ${task.length}).`);
+        process.exit(1);
+    }
+    // Resolve key path
+    const keyPath = resolveKeyPath(agentId);
+    if (!keyPath) {
+        console.error(`Error: private key not found for agent '${agentId}'. Check ~/.flair/keys/ or set FLAIR_KEY_DIR.`);
+        process.exit(1);
+    }
+    // Build auth + POST
+    const baseUrl = resolveBaseUrl(opts).replace(/\/$/, "");
+    const auth = buildEd25519Auth(agentId, "POST", "/Presence", keyPath);
+    const body = { activity };
+    if (task)
+        body.currentTask = task;
+    const res = await fetch(`${baseUrl}/Presence`, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            Authorization: auth,
+        },
+        body: JSON.stringify(body),
+    });
+    if (!res.ok) {
+        const text = await res.text().catch(() => "");
+        console.error(`Error: POST /Presence failed (${res.status}): ${text}`);
+        process.exit(1);
+    }
+    const data = await res.json().catch(() => null);
+    console.log(`✓ Presence updated for '${agentId}': activity=${activity}${task ? `, task="${task}"` : ""}`);
+    if (data?.presenceStatus) {
+        console.log(`  Status: ${data.presenceStatus}`);
+    }
+});
 // Run CLI only when this is the entry point (not when imported for testing)
 if (import.meta.main) {
     await program.parseAsync();
 }
 // ─── Exported for testing ─────────────────────────────────────────────────────
-export { resolveKeyPath, buildEd25519Auth, readPortFromConfig, resolveHttpPort, resolveOpsPort, resolveTarget, resolveOpsTarget, resolveEffectiveOpsUrl, resolveOpsUrlFromTarget, signRequestBody, b64, b64url, program, api, isLocalBase, isLikelyRealSecret, shouldShowInlineSecretWarning, parseTokenFromFile, };
+export { resolveKeyPath, buildEd25519Auth, readPortFromConfig, resolveHttpPort, resolveOpsPort, resolveTarget, resolveOpsTarget, resolveEffectiveOpsUrl, resolveOpsUrlFromTarget, signRequestBody, b64, b64url, program, api, VALID_PRESENCE_ACTIVITIES, MAX_TASK_LENGTH, isLocalBase, isLikelyRealSecret, shouldShowInlineSecretWarning, parseTokenFromFile, };

package/dist/resources/Agent.js

@@ -1,4 +1,5 @@
 import { databases } from "@harperfast/harper";
+import { resolveAgentAuth, allowVerified, allowAdmin } from "./agent-auth.js";
 /**
  * Agent resource — serves as the Principal table in 1.0.
  *
@@ -16,6 +17,14 @@ import { databases } from "@harperfast/harper";
  *   - subjects: soul-level subject interests
  */
 export class Agent extends databases.flair.Agent {
+    // Self-authorize now that the global gate is non-rejecting. Verified agents read
+    // the principal table for discovery; an agent updates only its OWN record (put
+    // handler enforces ownership). Creating/deleting principals is admin-only
+    // (flair_agent grant: insert=false, delete=false). Anonymous denied throughout.
+    allowRead() { return allowVerified(this.getContext?.()); }
+    allowCreate() { return allowAdmin(this.getContext?.()); }
+    allowUpdate() { return allowVerified(this.getContext?.()); }
+    allowDelete() { return allowAdmin(this.getContext?.()); }
     async post(content, context) {
         const now = new Date().toISOString();
         // Backward compat: set type for legacy code
@@ -34,14 +43,18 @@ export class Agent extends databases.flair.Agent {
         return super.post(content, context);
     }
     async put(content) {
-        const ctx = this.getContext?.();
-        const request = ctx?.request ?? ctx;
-        const authAgent = request?.tpsAgent;
-        const isAdminAgent = request?.tpsAgentIsAdmin ?? false;
-        // Only admin principals can modify other principals
-        if (authAgent && !isAdminAgent) {
+        const auth = await resolveAgentAuth(this.getContext?.());
+        // Anonymous denied (defense-in-depth alongside allowUpdate; the old check read
+        // tpsAgent and treated a missing agent as trusted, so anonymous slipped through).
+        if (auth.kind === "anonymous") {
+            return new Response(JSON.stringify({ error: "authentication required" }), {
+                status: 401, headers: { "content-type": "application/json" },
+            });
+        }
+        // Only admin principals can modify OTHER principals; an agent updates its own.
+        if (auth.kind === "agent" && !auth.isAdmin) {
             const existing = await super.get();
-            if (existing && existing.id !== authAgent) {
+            if (existing && existing.id !== auth.agentId) {
                 return new Response(JSON.stringify({ error: "only admin principals can modify other principals" }), {
                     status: 403, headers: { "content-type": "application/json" },
                 });

package/dist/resources/AgentCard.js

@@ -1,6 +1,12 @@
 import { Resource, databases } from "@harperfast/harper";
 import { selectPublicDescription, selectPublicSkills } from "./agentcard-fields.js";
 export class AgentCard extends Resource {
+    // Public discovery metadata (per A2A spec, agent cards are intentionally
+    // public). Self-gates as public so it survives the global gate's removal — and
+    // its get() already returns only field-allowlisted public-safe data.
+    allowRead() {
+        return true;
+    }
     async get(pathInfo) {
         const agentId = (typeof pathInfo === "string" ? pathInfo : null) ??
             this.getId?.() ??

package/dist/resources/AgentSeed.js

@@ -17,7 +17,7 @@
  * Auth: admin only.
  */
 import { Resource, databases } from "@harperfast/harper";
-import { isAdmin } from "./auth-middleware.js";
+import { isAdmin, allowAdmin } from "./agent-auth.js";
 const DEFAULT_SOUL_KEYS = (agentId, displayName, role, now) => ({
     name: displayName,
     role,
@@ -32,6 +32,12 @@ const DEFAULT_MEMORIES = (agentId, now) => [
     },
 ];
 export class AgentSeed extends Resource {
+    // Admin-only: permit verified ADMIN agents (Basic-admin is super_user and
+    // bypasses allow*); non-admin agents denied. Real authorization now that the
+    // gate no longer elevates agents to admin.
+    async allowCreate() {
+        return allowAdmin(this.getContext?.());
+    }
     async post(data) {
         const actorId = this.request?.tpsAgent;
         if (!actorId || !(await isAdmin(actorId))) {

package/dist/resources/Credential.js

@@ -1,4 +1,5 @@
 import { databases } from "@harperfast/harper";
+import { resolveAgentAuth } from "./agent-auth.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
 /**
  * Credential resource — authentication surfaces for Principals.
@@ -13,15 +14,21 @@ import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
  */
 export class Credential extends databases.flair.Credential {
     async search(query) {
-        const ctx = this.getContext?.();
-        const request = ctx?.request ?? ctx;
-        const authAgent = request?.tpsAgent;
-        const isAdminAgent = request?.tpsAgentIsAdmin ?? false;
-        if (!authAgent || isAdminAgent) {
+        const auth = await resolveAgentAuth(this.getContext?.());
+        // Anonymous HTTP must NOT read credentials. (Previously `!authAgent` was
+        // treated as trusted/unfiltered — which leaked every credential to an
+        // unauthenticated caller once the gate stopped rejecting.)
+        if (auth.kind === "anonymous") {
+            return new Response(JSON.stringify({ error: "authentication required" }), {
+                status: 401, headers: { "content-type": "application/json" },
+            });
+        }
+        // Trusted internal call or admin agent → unfiltered.
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
             return super.search(query);
         }
-        // Non-admin: scope to own credentials
-        const condition = { attribute: "principalId", comparator: "equals", value: authAgent };
+        // Non-admin agent: scope to own credentials.
+        const condition = { attribute: "principalId", comparator: "equals", value: auth.agentId };
         if (!query?.conditions) {
             return super.search({ conditions: [condition], ...(query || {}) });
         }
@@ -35,12 +42,16 @@ export class Credential extends databases.flair.Credential {
         const result = await super.get();
         if (!result)
             return result;
-        const ctx = this.getContext?.();
-        const request = ctx?.request ?? ctx;
-        const authAgent = request?.tpsAgent;
-        const isAdminAgent = request?.tpsAgentIsAdmin ?? false;
-        // Non-admin can only see their own credentials
-        if (authAgent && !isAdminAgent && result.principalId !== authAgent) {
+        const auth = await resolveAgentAuth(this.getContext?.());
+        // Anonymous HTTP must NOT read a credential (previously it fell through the
+        // ownership check and returned the record sans tokenHash — a metadata leak).
+        if (auth.kind === "anonymous") {
+            return new Response(JSON.stringify({ error: "forbidden" }), {
+                status: 403, headers: { "content-type": "application/json" },
+            });
+        }
+        // Non-admin agent can only see their own credentials. (Internal + admin pass.)
+        if (auth.kind === "agent" && !auth.isAdmin && result.principalId !== auth.agentId) {
             return new Response(JSON.stringify({ error: "forbidden" }), {
                 status: 403, headers: { "content-type": "application/json" },
             });

package/dist/resources/IngestEvents.js

@@ -55,6 +55,13 @@ function verifyEd25519Signature(publicKeyHex, authHeader, officeId) {
     }
 }
 export class IngestEvents extends Resource {
+    // Public POST by design: the handler self-verifies the OFFICE's Ed25519
+    // signature against ObsOffice.publicKey (not an agent identity), so it can't use
+    // agent auth. allowCreate=true lets the request reach post() where that
+    // verification happens — same self-gating pattern as FederationPair/FederationSync.
+    allowCreate() {
+        return true;
+    }
     async post(body, context) {
         const request = this.request;
         const authHeader = request?.headers?.get?.("authorization") ?? request?.headers?.authorization;

package/dist/resources/Instance.js

@@ -0,0 +1,13 @@
+import { databases } from "@harperfast/harper";
+import { allowVerified, allowAdmin } from "./agent-auth.js";
+/**
+ * Instance is read-only reference data for agents (flair_agent grant: read only).
+ * Verified agents + admin may read; writes are admin/internal only. Self-authorizes
+ * now that the global gate is non-rejecting (anonymous denied).
+ */
+export class Instance extends databases.flair.Instance {
+    allowRead() { return allowVerified(this.getContext?.()); }
+    allowCreate() { return allowAdmin(this.getContext?.()); }
+    allowUpdate() { return allowAdmin(this.getContext?.()); }
+    allowDelete() { return allowAdmin(this.getContext?.()); }
+}

package/dist/resources/Integration.js

@@ -1,6 +1,40 @@
 import { databases } from "@harperfast/harper";
+import { resolveAgentAuth } from "./agent-auth.js";
+const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
+const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
+/**
+ * Integration records are agent-owned. Auth: the non-rejecting gate annotates the
+ * request; this resource self-enforces (resolveAgentAuth → internal/agent/anonymous).
+ * Anonymous HTTP is denied on every path; non-admin agents are scoped to their own
+ * agentId. Mirrors the WorkspaceState pattern.
+ */
 export class Integration extends databases.flair.Integration {
+    _auth() {
+        return resolveAgentAuth(this.getContext?.());
+    }
+    async search(query) {
+        const auth = await this._auth();
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
+            return super.search(query);
+        }
+        const agentIdCondition = { attribute: "agentId", comparator: "equals", value: auth.agentId };
+        if (query && typeof query === "object" && !Array.isArray(query)) {
+            const existing = query.conditions ?? [];
+            query.conditions = Array.isArray(existing) ? [agentIdCondition, ...existing] : [agentIdCondition, existing];
+            return super.search(query);
+        }
+        const conditions = Array.isArray(query) && query.length > 0 ? [agentIdCondition, ...query] : [agentIdCondition];
+        return super.search(conditions);
+    }
     async post(content, context) {
+        const auth = await this._auth();
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "agent" && !auth.isAdmin && content?.agentId && content.agentId !== auth.agentId) {
+            return FORBIDDEN("forbidden: cannot write integration for another agent");
+        }
         // S31-A: API never accepts plaintext credentials.
         if (typeof content?.credential === "string" || typeof content?.token === "string") {
             return new Response(JSON.stringify({ error: "plaintext_credentials_forbidden" }), {
@@ -10,4 +44,34 @@ export class Integration extends databases.flair.Integration {
         }
         return super.post(content, context);
     }
+    async put(content, context) {
+        const auth = await this._auth();
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "agent" && !auth.isAdmin && content?.agentId && content.agentId !== auth.agentId) {
+            return FORBIDDEN("forbidden: cannot write integration for another agent");
+        }
+        if (typeof content?.credential === "string" || typeof content?.token === "string") {
+            return new Response(JSON.stringify({ error: "plaintext_credentials_forbidden" }), {
+                status: 400,
+                headers: { "Content-Type": "application/json" },
+            });
+        }
+        return super.put(content, context);
+    }
+    async delete(id) {
+        const auth = await this._auth();
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
+            return super.delete(id);
+        }
+        const record = await this.get(id);
+        if (!record)
+            return super.delete(id);
+        if (record.agentId !== auth.agentId) {
+            return FORBIDDEN("forbidden: cannot delete integration for another agent");
+        }
+        return super.delete(id);
+    }
 }