@tpsdev-ai/flair 0.11.0 → 0.13.0

package/dist/cli.js

@@ -510,35 +510,11 @@ export async function seedAgentViaOpsApi(opsPortOrUrl, agentId, pubKeyB64url, ad
         throw new Error(`Operations API insert failed (${res.status}): ${text}`);
     }
 }
-// Seed an agent record via the Harper REST API.
-// Uses localhost and the given HTTP port.
-export async function seedAgentViaRestApi(httpPort, agentId, pubKeyB64url, adminPass) {
-    const baseUrl = `http://127.0.0.1:${httpPort}`;
-    const body = {
-        operation: "insert",
-        database: "flair",
-        table: "Agent",
-        records: [{ id: agentId, name: agentId, publicKey: pubKeyB64url, createdAt: new Date().toISOString() }],
-    };
-    // Only send Authorization header if adminPass is provided.
-    // Matches the auth pattern in api() which respects authorizeLocal=true.
-    const headers = { "Content-Type": "application/json" };
-    if (adminPass) {
-        headers.Authorization = `Basic ${Buffer.from(`admin:${adminPass}`).toString("base64")}`;
-    }
-    const res = await fetch(`${baseUrl}/Agent`, {
-        method: "POST",
-        headers,
-        body: JSON.stringify(body),
-        signal: AbortSignal.timeout(10_000),
-    });
-    if (!res.ok) {
-        const text = await res.text().catch(() => "");
-        if (res.status === 409 || text.includes("duplicate") || text.includes("already exists"))
-            return;
-        throw new Error(`REST API insert failed (${res.status}): ${text}`);
-    }
-}
+// NOTE: agent records are seeded exclusively via the Harper operations API
+// (seedAgentViaOpsApi above). A former seedAgentViaRestApi() helper POSTed the
+// ops-insert body to the REST root, which Harper 405s as a collection POST to
+// /Agent (the Agent table resource has no POST handler). It was removed in the
+// #499 fix; do not reintroduce a REST-root insert path.
 // ─── FederationInstance seed via ops API ──────────────────────────────────────
 //
 // Remote init writes FederationInstance through the ops API (Basic auth with
@@ -736,25 +712,30 @@ export async function provisionFabric(target, opsTarget, clusterAdminUser, clust
 // FederationPair resource handler.  The role carries no table permissions itself
 // — the resource's own allowCreate bypass handles route-level access once the
 // request gets through the auth gate.
-/** Canonical permission spec for flair_pair_initiator. */
+/**
+ * Canonical permission spec for flair_pair_initiator.
+ *
+ * The role intentionally carries NO table permissions — its only job is to exist
+ * so bootstrap credentials can pass Harper platform auth before reaching the
+ * FederationPair resource handler (the resource's own allowCreate bypass handles
+ * route-level access). A bare role with both flags false is valid, grants nothing,
+ * and is exactly that intent.
+ *
+ * This previously carried an all-false `flair.tables` block, but Harper's add_role
+ * REJECTED the whole spec with a 400 (verified live against a spawned Harper):
+ *   - `cluster_user` is not a recognized top-level key — Harper reads unknown keys
+ *     as database names ("database 'cluster_user' does not exist");
+ *   - the table names were the logical shorthand, not the real @table names
+ *     ("Table 'flair.Workspace' does not exist" — it's WorkspaceState; "Event" is
+ *     OrgEvent; "OAuth" is OAuthClient);
+ *   - each grant omitted the required `attribute_permissions` array.
+ * The all-false block granted nothing anyway, so dropping it loses no capability
+ * and unbreaks fresh hub provisioning (where add_role runs and the 400 aborted
+ * `flair init --remote`). Only top-level booleans Harper recognizes remain.
+ */
 const PAIR_INITIATOR_PERMISSION = {
     super_user: false,
-    cluster_user: false,
     structure_user: false,
-    flair: {
-        tables: {
-            Memory: { read: false, insert: false, update: false, delete: false },
-            Soul: { read: false, insert: false, update: false, delete: false },
-            Agent: { read: false, insert: false, update: false, delete: false },
-            Workspace: { read: false, insert: false, update: false, delete: false },
-            Event: { read: false, insert: false, update: false, delete: false },
-            OAuth: { read: false, insert: false, update: false, delete: false },
-            Instance: { read: false, insert: false, update: false, delete: false },
-            Peer: { read: false, insert: false, update: false, delete: false },
-            PairingToken: { read: false, insert: false, update: false, delete: false },
-            SyncLog: { read: false, insert: false, update: false, delete: false },
-        },
-    },
 };
 /**
  * Idempotently ensures the `flair_pair_initiator` role exists on the Harper
@@ -805,6 +786,174 @@ export async function ensureFlairPairInitiatorRole(opsUrl, adminUser, adminPass)
     }, adminUser, adminPass);
     console.log(`Role '${ROLE_NAME}' updated ✓`);
 }
+// ─── flair_agent role ────────────────────────────────────────────────────────
+//
+// The auth reshape replaces the global gate's "verified agent borrows admin
+// super_user" elevation with a real, least-privilege Harper role. After an
+// agent's Ed25519 signature verifies, resources resolve the request to the
+// shared `flair_agent`-roled user instead of admin — so agents get exactly the
+// table CRUD below and nothing more. Critically: with no `super_user` and no
+// operations grants, /sql and /graphql become NATIVELY 403 for agents (the
+// raw-query block the gate hand-rolled is now enforced by Harper itself).
+//
+// Row-level ownership (an agent touches only its OWN memories/soul/events) is
+// NOT expressible in Harper's role model — it stays in each resource's allow*,
+// keyed on the Ed25519-verified agentId. So these per-table grants are the
+// coarse CRUD envelope; allow* is the ownership boundary inside it.
+//
+// VALIDATION GATES (must confirm against a live Harper before this role goes
+// live — flagged for Sherlock + the PR, not assumed):
+//   1. HNSW/vector search (SemanticSearch over Memory) works with table `read`
+//      alone — the old elevation comment claimed admin perms were needed for
+//      "HNSW-capable" access; confirm `read` suffices or widen precisely.
+//   2. Role table keys must EXACTLY match the @table names (Memory, OrgEvent,
+//      WorkspaceState, OAuthClient — NOT the logical Memory/Event/Workspace/OAuth
+//      shorthand the flair_pair_initiator spec used, which was harmless only
+//      because every grant there is false).
+//   3. Obs* writes: if the presence-emitter writes ObsAgentSnapshot AS the agent
+//      it needs insert/update — currently read-only here; confirm the writer's
+//      identity (system vs agent) and widen only if it's the agent.
+// Harper 5.0.21 add_role requires an `attribute_permissions` array on EVERY table
+// grant (empty = no attribute-level restriction, so the table-level CRUD applies);
+// omitting it makes add_role reject the whole spec ("Missing 'attribute_permissions'
+// array"). Validated live against a spawned Harper. This helper guarantees the
+// array is never forgotten. Also: `cluster_user` is NOT a valid top-level key —
+// Harper reads unrecognized top-level keys as database names ("database
+// 'cluster_user' does not exist"); only super_user / structure_user are recognized.
+const grant = (read, insert, update, del) => ({ read, insert, update, delete: del, attribute_permissions: [] });
+/** Canonical permission spec for flair_agent (least-privilege; real @table names). */
+const FLAIR_AGENT_PERMISSION = {
+    super_user: false,
+    structure_user: false,
+    flair: {
+        tables: {
+            // Core agent-owned data — CRUD envelope; ownership enforced in allow*.
+            Memory: grant(true, true, true, true),
+            MemoryCandidate: grant(true, true, true, true),
+            MemoryGrant: grant(true, true, true, true),
+            Soul: grant(true, true, true, false),
+            OrgEvent: grant(true, true, true, true),
+            WorkspaceState: grant(true, true, true, true),
+            Relationship: grant(true, true, true, true),
+            Integration: grant(true, true, true, true),
+            Credential: grant(true, true, true, true),
+            Presence: grant(true, true, true, false),
+            // Agent: read for discovery, update own card; creation/removal is admin.
+            Agent: grant(true, false, true, false),
+            // Read-only reference data.
+            Instance: grant(true, false, false, false),
+            // Observatory read-models — public reads; writes are system-driven (gate 3).
+            ObsOffice: grant(true, false, false, false),
+            ObsAgentSnapshot: grant(true, false, false, false),
+            ObsEventFeed: grant(true, false, false, false),
+            // Federation / OAuth / IdP / internal — system + admin only; agents get none.
+            Peer: grant(false, false, false, false),
+            PairingToken: grant(false, false, false, false),
+            SyncLog: grant(false, false, false, false),
+            OAuthClient: grant(false, false, false, false),
+            OAuthToken: grant(false, false, false, false),
+            OAuthAuthCode: grant(false, false, false, false),
+            IdpConfig: grant(false, false, false, false),
+            IdJagReplay: grant(false, false, false, false),
+        },
+    },
+};
+/**
+ * Idempotently ensures the `flair_agent` role exists on the Harper instance at
+ * `opsUrl` with the canonical least-privilege spec. Same list/add/alter shape as
+ * ensureFlairPairInitiatorRole.
+ *
+ * - absent → `add_role`
+ * - exists with different permissions → `alter_role`
+ * - already matches → no-op
+ */
+export async function ensureFlairAgentRole(opsUrl, adminUser, adminPass) {
+    const ROLE_NAME = "flair_agent";
+    let roles = [];
+    try {
+        const result = await callOpsApi(opsUrl, { operation: "list_roles" }, adminUser, adminPass);
+        roles = Array.isArray(result) ? result : [];
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`ensureFlairAgentRole: list_roles failed: ${msg}`);
+    }
+    const existing = roles.find((r) => r.role === ROLE_NAME || r.name === ROLE_NAME);
+    if (!existing) {
+        console.log(`Creating role '${ROLE_NAME}'...`);
+        await callOpsApi(opsUrl, {
+            operation: "add_role",
+            role: ROLE_NAME,
+            permission: FLAIR_AGENT_PERMISSION,
+        }, adminUser, adminPass);
+        console.log(`Role '${ROLE_NAME}' created ✓`);
+        return;
+    }
+    const existingPerm = existing.permission ?? existing.role?.permission;
+    const canonicalStr = JSON.stringify(FLAIR_AGENT_PERMISSION);
+    const existingStr = JSON.stringify(existingPerm);
+    if (existingStr === canonicalStr) {
+        console.log(`Role '${ROLE_NAME}' already exists with correct permissions — skipping`);
+        return;
+    }
+    console.log(`Role '${ROLE_NAME}' exists but permissions differ — updating...`);
+    await callOpsApi(opsUrl, {
+        operation: "alter_role",
+        role: ROLE_NAME,
+        permission: FLAIR_AGENT_PERMISSION,
+    }, adminUser, adminPass);
+    console.log(`Role '${ROLE_NAME}' updated ✓`);
+}
+/**
+ * Shared Harper user that verified Ed25519 agents are resolved to.
+ * MUST match FLAIR_AGENT_USERNAME in resources/agent-auth.ts (the gate side).
+ * Not imported from there because cli.ts is standalone and that module pulls in
+ * Harper's native bindings — kept as a cross-referenced literal instead.
+ */
+export const FLAIR_AGENT_USERNAME = "flair-agent";
+/**
+ * Idempotently ensures the shared `flair-agent` Harper user exists with the
+ * `flair_agent` role. Verified Ed25519 agents are resolved to THIS user
+ * (`getUser("flair-agent", null)` — no password check, identity already proven
+ * cryptographically), replacing the old `getUser("admin")` super_user elevation.
+ *
+ * The password is random and never used for authentication: the agent path
+ * resolves the user without it, and the auth gate's Basic path only accepts
+ * super_user / pair-bootstrap (a flair_agent Basic login is rejected there), so
+ * a Basic login as this user can't reach anything. Random + unused = safe.
+ *
+ * Row-level ownership stays in each resource's allow* (keyed on the verified
+ * agentId); this shared user only carries the flair_agent role's table grants.
+ */
+export async function ensureFlairAgentUser(opsUrl, adminUser, adminPass) {
+    const unusedPassword = randomBytes(32).toString("base64url");
+    try {
+        await callOpsApi(opsUrl, {
+            operation: "add_user",
+            username: FLAIR_AGENT_USERNAME,
+            password: unusedPassword,
+            role: "flair_agent",
+            active: true,
+        }, adminUser, adminPass);
+        console.log(`User '${FLAIR_AGENT_USERNAME}' created ✓`);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (msg.includes("already exists") || msg.includes("duplicate")) {
+            // Idempotent: ensure the role is correct without churning the password.
+            await callOpsApi(opsUrl, {
+                operation: "alter_user",
+                username: FLAIR_AGENT_USERNAME,
+                role: "flair_agent",
+                active: true,
+            }, adminUser, adminPass);
+            console.log(`User '${FLAIR_AGENT_USERNAME}' already exists — role ensured ✓`);
+        }
+        else {
+            throw err;
+        }
+    }
+}
 // ─── Upgrade presence probes ──────────────────────────────────────────────────
 //
 // `flair upgrade` previously called `npm list -g <pkg>` to detect the installed
@@ -1126,6 +1275,16 @@ program
             if (opts.remote) {
                 await ensureFlairPairInitiatorRole(opsUrl, DEFAULT_ADMIN_USER, flairAdminPass);
             }
+            // Every flair instance has agents, so provision the least-privilege
+            // flair_agent role (idempotent, harmless until a user is assigned to it).
+            await ensureFlairAgentRole(opsUrl, DEFAULT_ADMIN_USER, flairAdminPass);
+            // THE FLIP (auth-rbac): provision the shared least-privilege flair-agent user.
+            // This ACTIVATES the gate's per-agent de-elevation (verified non-admin agents
+            // resolve to flair-agent instead of admin super_user). Safe now: #487 gave
+            // every agent-facing resource its own allow* + resolveAgentAuth, so they no
+            // longer rely on the admin super_user bypass. The gate also falls back to
+            // admin if this user is ever absent, so de-elevation degrades gracefully.
+            await ensureFlairAgentUser(opsUrl, DEFAULT_ADMIN_USER, flairAdminPass);
         }
         else {
             // ── Existing behavior: --admin-pass required for already-running Flair ──
@@ -1797,8 +1956,21 @@ program
         writeConfig(httpPort);
     }
     else {
-        // Flair already initialized — resolve admin pass from env or running instance
+        // Flair already initialized — resolve admin pass from env, falling back to
+        // the persisted ~/.flair/admin-pass written at first install. Agent
+        // seeding now goes through the ops API (#499), which always requires Basic
+        // admin auth (it does NOT honor authorizeLocal), so a re-run of
+        // `flair install --agent <new-id>` against an already-initialized local
+        // Flair needs a real pass even when no env var is set.
         adminPass = process.env.FLAIR_ADMIN_PASS ?? process.env.HDB_ADMIN_PASSWORD ?? "";
+        if (!adminPass) {
+            try {
+                const persisted = join(homedir(), ".flair", "admin-pass");
+                if (existsSync(persisted))
+                    adminPass = readFileSync(persisted, "utf-8").trim();
+            }
+            catch { /* fall through with empty pass */ }
+        }
     }
     const httpUrl = `http://127.0.0.1:${httpPort}`;
     // ── Step 2: Detect MCP clients ──
@@ -1857,17 +2029,16 @@ program
         writeFileSync(pubPath, Buffer.from(kp.publicKey));
         const pubKeyB64url = b64url(kp.publicKey);
         console.log(`Keypair written: ${privPath} ✓`);
-        // Seed agent - use REST API for local Harper, Ops API only when --ops-target is specified
-        if (opts.opsTarget) {
-            // Remote Harper via explicit ops target
-            console.log(`Seeding agent '${agentId}' via operations API (--ops-target)...`);
-            await seedAgentViaOpsApi(opts.opsTarget, agentId, pubKeyB64url, adminUser, adminPass);
-        }
-        else {
-            // Local Harper - use REST API
-            console.log(`Seeding agent '${agentId}' via REST API...`);
-            await seedAgentViaRestApi(httpPort, agentId, pubKeyB64url, adminPass);
-        }
+        // Seed agent via the Harper operations API. The Agent table is a REST
+        // resource without a POST handler, so the insert body must go to the ops
+        // API (POST <opsUrl>/ with {operation:"insert",...}), NOT the REST root
+        // (which 405s the body as a collection POST to /Agent). This is the same
+        // path `flair agent add` uses. (#499)
+        const seedOpsTarget = opts.opsTarget ?? opsPort;
+        console.log(opts.opsTarget
+            ? `Seeding agent '${agentId}' via operations API (--ops-target)...`
+            : `Seeding agent '${agentId}' via operations API...`);
+        await seedAgentViaOpsApi(seedOpsTarget, agentId, pubKeyB64url, adminUser, adminPass);
         console.log(`Agent '${agentId}' registered ✓`);
     }
     // ── Step 4: Wire MCP clients ──
@@ -2026,10 +2197,16 @@ agent
     if (adminPass) {
         const opsPort = resolveOpsPort(opts);
         const auth = Buffer.from(`${DEFAULT_ADMIN_USER}:${adminPass}`).toString("base64");
+        // List every Agent without null-scanning the primary key. A
+        // `starts_with ""` on `id` makes Harper search the index for nulls, which
+        // the bundled Harper (5.0.21) rejects with "id is not indexed for nulls".
+        // Use `createdAt > 1970-01-01` as the total "select all" predicate: every
+        // Agent row has a non-null createdAt (schema: createdAt: String!), and its
+        // index is built — same pattern as the `flair reembed` Memory scan. (#500)
         const res = await fetch(`http://127.0.0.1:${opsPort}/`, {
             method: "POST",
             headers: { "Content-Type": "application/json", Authorization: `Basic ${auth}` },
-            body: JSON.stringify({ operation: "search_by_value", schema: "flair", table: "Agent", search_attribute: "id", search_type: "starts_with", search_value: "", get_attributes: ["id", "name", "createdAt"] }),
+            body: JSON.stringify({ operation: "search_by_conditions", schema: "flair", table: "Agent", operator: "and", conditions: [{ search_attribute: "createdAt", search_type: "greater_than", search_value: "1970-01-01" }], get_attributes: ["id", "name", "createdAt"] }),
         });
         if (!res.ok) {
             const text = await res.text().catch(() => "");
@@ -4015,7 +4192,7 @@ rem
         console.log(result.prompt ?? "(no prompt returned)");
         console.log("--- End Prompt ---\n");
         console.log("Feed the prompt above to your LLM, then write insights back with:");
-        console.log("  flair memory add --agent <id> --content <insight> --durability persistent");
+        console.log("  flair memory add --agent <id> --content <insight> --durability persistent --derived-from <source-ids>");
     }
     catch (err) {
         console.error(`Error: ${err.message}`);
@@ -6827,6 +7004,7 @@ memory.command("add [content]").requiredOption("--agent <id>")
     .option("--durability <d>", "standard").option("--tags <csv>")
     .option("--summary <text>", "agent-set multi-sentence dense compression (3-tier chain: subject → summary → content; ops-wkoh)")
     .option("--subject <text>", "one-line title / entity this memory is about")
+    .option("--derived-from <csv>", "Comma-separated source Memory IDs this memory was distilled/reflected from (sets Memory.derivedFrom; used by the `rem rapid` reflection loop)")
     .action(async (contentArg, opts) => {
     const content = contentArg ?? opts.content;
     if (!content) {
@@ -6843,6 +7021,9 @@ memory.command("add [content]").requiredOption("--agent <id>")
         body.summary = opts.summary;
     if (opts.subject)
         body.subject = opts.subject;
+    if (opts.derivedFrom) {
+        body.derivedFrom = String(opts.derivedFrom).split(",").map((x) => x.trim()).filter(Boolean);
+    }
     const out = await api("PUT", `/Memory/${memId}`, body);
     console.log(JSON.stringify(out, null, 2));
 });
@@ -7466,12 +7647,17 @@ soul.command("set")
     .option("--durability <d>", "permanent")
     .option("--json", "Emit raw JSON response (also: pipe + FLAIR_OUTPUT=json)")
     .action(async (opts) => {
-    const out = await api("POST", "/Soul", {
-        id: `${opts.agent}:${opts.key}`,
+    // PUT /Soul/{agentId:key} (upsert by id), matching flair-client's soul.set().
+    // The Soul table resource has no POST handler, so a collection POST /Soul
+    // 405s; the record must be written by its primary key. (#498)
+    const id = `${opts.agent}:${opts.key}`;
+    const out = await api("PUT", `/Soul/${encodeURIComponent(id)}`, {
+        id,
         agentId: opts.agent,
         key: opts.key,
         value: opts.value,
         durability: opts.durability,
+        createdAt: new Date().toISOString(),
     });
     const mode = render.resolveOutputMode(opts);
     if (mode === "json") {

package/dist/resources/Agent.js

@@ -1,4 +1,5 @@
 import { databases } from "@harperfast/harper";
+import { resolveAgentAuth, allowVerified, allowAdmin } from "./agent-auth.js";
 /**
  * Agent resource — serves as the Principal table in 1.0.
  *
@@ -16,6 +17,14 @@ import { databases } from "@harperfast/harper";
  *   - subjects: soul-level subject interests
  */
 export class Agent extends databases.flair.Agent {
+    // Self-authorize now that the global gate is non-rejecting. Verified agents read
+    // the principal table for discovery; an agent updates only its OWN record (put
+    // handler enforces ownership). Creating/deleting principals is admin-only
+    // (flair_agent grant: insert=false, delete=false). Anonymous denied throughout.
+    allowRead() { return allowVerified(this.getContext?.()); }
+    allowCreate() { return allowAdmin(this.getContext?.()); }
+    allowUpdate() { return allowVerified(this.getContext?.()); }
+    allowDelete() { return allowAdmin(this.getContext?.()); }
     async post(content, context) {
         const now = new Date().toISOString();
         // Backward compat: set type for legacy code
@@ -34,14 +43,18 @@ export class Agent extends databases.flair.Agent {
         return super.post(content, context);
     }
     async put(content) {
-        const ctx = this.getContext?.();
-        const request = ctx?.request ?? ctx;
-        const authAgent = request?.tpsAgent;
-        const isAdminAgent = request?.tpsAgentIsAdmin ?? false;
-        // Only admin principals can modify other principals
-        if (authAgent && !isAdminAgent) {
+        const auth = await resolveAgentAuth(this.getContext?.());
+        // Anonymous denied (defense-in-depth alongside allowUpdate; the old check read
+        // tpsAgent and treated a missing agent as trusted, so anonymous slipped through).
+        if (auth.kind === "anonymous") {
+            return new Response(JSON.stringify({ error: "authentication required" }), {
+                status: 401, headers: { "content-type": "application/json" },
+            });
+        }
+        // Only admin principals can modify OTHER principals; an agent updates its own.
+        if (auth.kind === "agent" && !auth.isAdmin) {
             const existing = await super.get();
-            if (existing && existing.id !== authAgent) {
+            if (existing && existing.id !== auth.agentId) {
                 return new Response(JSON.stringify({ error: "only admin principals can modify other principals" }), {
                     status: 403, headers: { "content-type": "application/json" },
                 });

package/dist/resources/AgentCard.js

@@ -1,6 +1,12 @@
 import { Resource, databases } from "@harperfast/harper";
 import { selectPublicDescription, selectPublicSkills } from "./agentcard-fields.js";
 export class AgentCard extends Resource {
+    // Public discovery metadata (per A2A spec, agent cards are intentionally
+    // public). Self-gates as public so it survives the global gate's removal — and
+    // its get() already returns only field-allowlisted public-safe data.
+    allowRead() {
+        return true;
+    }
     async get(pathInfo) {
         const agentId = (typeof pathInfo === "string" ? pathInfo : null) ??
             this.getId?.() ??

package/dist/resources/AgentSeed.js

@@ -17,7 +17,7 @@
  * Auth: admin only.
  */
 import { Resource, databases } from "@harperfast/harper";
-import { isAdmin } from "./auth-middleware.js";
+import { isAdmin, allowAdmin } from "./agent-auth.js";
 const DEFAULT_SOUL_KEYS = (agentId, displayName, role, now) => ({
     name: displayName,
     role,
@@ -32,6 +32,12 @@ const DEFAULT_MEMORIES = (agentId, now) => [
     },
 ];
 export class AgentSeed extends Resource {
+    // Admin-only: permit verified ADMIN agents (Basic-admin is super_user and
+    // bypasses allow*); non-admin agents denied. Real authorization now that the
+    // gate no longer elevates agents to admin.
+    async allowCreate() {
+        return allowAdmin(this.getContext?.());
+    }
     async post(data) {
         const actorId = this.request?.tpsAgent;
         if (!actorId || !(await isAdmin(actorId))) {

package/dist/resources/Credential.js

@@ -1,4 +1,5 @@
 import { databases } from "@harperfast/harper";
+import { resolveAgentAuth } from "./agent-auth.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
 /**
  * Credential resource — authentication surfaces for Principals.
@@ -13,15 +14,21 @@ import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
  */
 export class Credential extends databases.flair.Credential {
     async search(query) {
-        const ctx = this.getContext?.();
-        const request = ctx?.request ?? ctx;
-        const authAgent = request?.tpsAgent;
-        const isAdminAgent = request?.tpsAgentIsAdmin ?? false;
-        if (!authAgent || isAdminAgent) {
+        const auth = await resolveAgentAuth(this.getContext?.());
+        // Anonymous HTTP must NOT read credentials. (Previously `!authAgent` was
+        // treated as trusted/unfiltered — which leaked every credential to an
+        // unauthenticated caller once the gate stopped rejecting.)
+        if (auth.kind === "anonymous") {
+            return new Response(JSON.stringify({ error: "authentication required" }), {
+                status: 401, headers: { "content-type": "application/json" },
+            });
+        }
+        // Trusted internal call or admin agent → unfiltered.
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
             return super.search(query);
         }
-        // Non-admin: scope to own credentials
-        const condition = { attribute: "principalId", comparator: "equals", value: authAgent };
+        // Non-admin agent: scope to own credentials.
+        const condition = { attribute: "principalId", comparator: "equals", value: auth.agentId };
         if (!query?.conditions) {
             return super.search({ conditions: [condition], ...(query || {}) });
         }
@@ -35,12 +42,16 @@ export class Credential extends databases.flair.Credential {
         const result = await super.get();
         if (!result)
             return result;
-        const ctx = this.getContext?.();
-        const request = ctx?.request ?? ctx;
-        const authAgent = request?.tpsAgent;
-        const isAdminAgent = request?.tpsAgentIsAdmin ?? false;
-        // Non-admin can only see their own credentials
-        if (authAgent && !isAdminAgent && result.principalId !== authAgent) {
+        const auth = await resolveAgentAuth(this.getContext?.());
+        // Anonymous HTTP must NOT read a credential (previously it fell through the
+        // ownership check and returned the record sans tokenHash — a metadata leak).
+        if (auth.kind === "anonymous") {
+            return new Response(JSON.stringify({ error: "forbidden" }), {
+                status: 403, headers: { "content-type": "application/json" },
+            });
+        }
+        // Non-admin agent can only see their own credentials. (Internal + admin pass.)
+        if (auth.kind === "agent" && !auth.isAdmin && result.principalId !== auth.agentId) {
             return new Response(JSON.stringify({ error: "forbidden" }), {
                 status: 403, headers: { "content-type": "application/json" },
             });

package/dist/resources/IngestEvents.js

@@ -55,6 +55,13 @@ function verifyEd25519Signature(publicKeyHex, authHeader, officeId) {
     }
 }
 export class IngestEvents extends Resource {
+    // Public POST by design: the handler self-verifies the OFFICE's Ed25519
+    // signature against ObsOffice.publicKey (not an agent identity), so it can't use
+    // agent auth. allowCreate=true lets the request reach post() where that
+    // verification happens — same self-gating pattern as FederationPair/FederationSync.
+    allowCreate() {
+        return true;
+    }
     async post(body, context) {
         const request = this.request;
         const authHeader = request?.headers?.get?.("authorization") ?? request?.headers?.authorization;

package/dist/resources/Instance.js

@@ -0,0 +1,13 @@
+import { databases } from "@harperfast/harper";
+import { allowVerified, allowAdmin } from "./agent-auth.js";
+/**
+ * Instance is read-only reference data for agents (flair_agent grant: read only).
+ * Verified agents + admin may read; writes are admin/internal only. Self-authorizes
+ * now that the global gate is non-rejecting (anonymous denied).
+ */
+export class Instance extends databases.flair.Instance {
+    allowRead() { return allowVerified(this.getContext?.()); }
+    allowCreate() { return allowAdmin(this.getContext?.()); }
+    allowUpdate() { return allowAdmin(this.getContext?.()); }
+    allowDelete() { return allowAdmin(this.getContext?.()); }
+}

package/dist/resources/Integration.js

@@ -1,6 +1,40 @@
 import { databases } from "@harperfast/harper";
+import { resolveAgentAuth } from "./agent-auth.js";
+const FORBIDDEN = (msg) => new Response(JSON.stringify({ error: msg }), { status: 403, headers: { "Content-Type": "application/json" } });
+const UNAUTH = () => new Response(JSON.stringify({ error: "authentication required" }), { status: 401, headers: { "Content-Type": "application/json" } });
+/**
+ * Integration records are agent-owned. Auth: the non-rejecting gate annotates the
+ * request; this resource self-enforces (resolveAgentAuth → internal/agent/anonymous).
+ * Anonymous HTTP is denied on every path; non-admin agents are scoped to their own
+ * agentId. Mirrors the WorkspaceState pattern.
+ */
 export class Integration extends databases.flair.Integration {
+    _auth() {
+        return resolveAgentAuth(this.getContext?.());
+    }
+    async search(query) {
+        const auth = await this._auth();
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
+            return super.search(query);
+        }
+        const agentIdCondition = { attribute: "agentId", comparator: "equals", value: auth.agentId };
+        if (query && typeof query === "object" && !Array.isArray(query)) {
+            const existing = query.conditions ?? [];
+            query.conditions = Array.isArray(existing) ? [agentIdCondition, ...existing] : [agentIdCondition, existing];
+            return super.search(query);
+        }
+        const conditions = Array.isArray(query) && query.length > 0 ? [agentIdCondition, ...query] : [agentIdCondition];
+        return super.search(conditions);
+    }
     async post(content, context) {
+        const auth = await this._auth();
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "agent" && !auth.isAdmin && content?.agentId && content.agentId !== auth.agentId) {
+            return FORBIDDEN("forbidden: cannot write integration for another agent");
+        }
         // S31-A: API never accepts plaintext credentials.
         if (typeof content?.credential === "string" || typeof content?.token === "string") {
             return new Response(JSON.stringify({ error: "plaintext_credentials_forbidden" }), {
@@ -10,4 +44,34 @@ export class Integration extends databases.flair.Integration {
         }
         return super.post(content, context);
     }
+    async put(content, context) {
+        const auth = await this._auth();
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "agent" && !auth.isAdmin && content?.agentId && content.agentId !== auth.agentId) {
+            return FORBIDDEN("forbidden: cannot write integration for another agent");
+        }
+        if (typeof content?.credential === "string" || typeof content?.token === "string") {
+            return new Response(JSON.stringify({ error: "plaintext_credentials_forbidden" }), {
+                status: 400,
+                headers: { "Content-Type": "application/json" },
+            });
+        }
+        return super.put(content, context);
+    }
+    async delete(id) {
+        const auth = await this._auth();
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        if (auth.kind === "internal" || (auth.kind === "agent" && auth.isAdmin)) {
+            return super.delete(id);
+        }
+        const record = await this.get(id);
+        if (!record)
+            return super.delete(id);
+        if (record.agentId !== auth.agentId) {
+            return FORBIDDEN("forbidden: cannot delete integration for another agent");
+        }
+        return super.delete(id);
+    }
 }