@tpsdev-ai/flair 0.31.0 → 0.32.0

package/dist/resources/auth-middleware.js

@@ -4,6 +4,7 @@ import { getEmbedding } from "./embeddings-provider.js";
 import { isAdmin, FLAIR_AGENT_USERNAME } from "./agent-auth.js";
 import { WINDOW_MS, isNonceReplay, recordNonce, importEd25519Key, b64ToArrayBuffer, parseTpsEd25519Header } from "./ed25519-auth.js";
 import { resolveReadScope } from "./memory-read-scope.js";
+import { isForbiddenOwnerMutation, resolveGuardedRecord } from "./record-owner-guard.js";
 // --- Admin credentials ---
 // Admin auth is sourced exclusively from Harper's own environment variables
 // (HDB_ADMIN_PASSWORD / FLAIR_ADMIN_PASSWORD). No filesystem token file.
@@ -350,6 +351,37 @@ server.http(async (request, nextLayer) => {
     // ── Server-side permission guards ──────────────────────────────────────────
     const method = request.method.toUpperCase();
     const isMutation = method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE";
+    // ── THE record-ownership rule, for every table, on every mutating verb ─────
+    //
+    // One enforcement point rather than one per resource. See
+    // resources/record-owner-guard.ts for why this is not written into each
+    // resource's put(): Harper maps verbs to methods one-to-one, so a rule living
+    // in put() is enforced on PUT alone, and nearly every resource wrote its rules
+    // there. Doing this per-resource would be N chances to get one wrong and would
+    // still leave the next resource broken by default.
+    //
+    // Ownership is read from the STORED record named by the path — never from the
+    // request body, which is the caller's claim about who owns the row and was how
+    // a body that simply omitted the field passed unchecked.
+    //
+    // Deliberately scoped to records that ALREADY EXIST: creation is left to each
+    // resource's own no-forge attribution. That keeps this incapable of breaking a
+    // create, a self-write, or a legitimate cross-agent field like MemoryGrant's
+    // granteeId — it can only narrow mutation of another agent's stored row.
+    if (isMutation && !request.tpsAgentIsAdmin) {
+        const guarded = resolveGuardedRecord(url.pathname);
+        if (guarded) {
+            try {
+                const record = await databases.flair[guarded.table]?.get(guarded.id);
+                if (isForbiddenOwnerMutation(record, guarded.ownerField, agentId)) {
+                    return new Response(JSON.stringify({
+                        error: `forbidden: cannot modify ${guarded.table} owned by another principal`,
+                    }), { status: 403, headers: { "Content-Type": "application/json" } });
+                }
+            }
+            catch { /* unreadable row → fall through to the resource's own rules */ }
+        }
+    }
     if (isMutation) {
         // OrgEvent: authorId must match authenticated agent
         if ((url.pathname === "/OrgEvent" || url.pathname.startsWith("/OrgEvent/")) &&
@@ -419,19 +451,59 @@ server.http(async (request, nextLayer) => {
                 catch { }
             }
         }
-        // Soul PUT: only owner or admin
-        if (url.pathname.startsWith("/Soul") && (method === "PUT" || method === "POST")) {
+        // Soul mutations: only the owner or an admin may write a soul entry.
+        //
+        // This guard had two independent holes, either of which alone let one agent
+        // rewrite another's identity data:
+        //
+        //   1. THE VERB LIST enumerated PUT and POST only. Its three siblings above
+        //      (OrgEvent, WorkspaceState, Memory) all include PATCH, and Memory
+        //      includes DELETE; this one did neither. Harper routes PATCH to a
+        //      resource method that carries no ownership check of its own
+        //      (Soul.ts's enforceWriteAuth covers post()/put()), and DELETE reached
+        //      the table with no per-record check at all. Both were live.
+        //
+        //   2. IT COMPARED THE BODY, not the target. `body.agentId` is the owner
+        //      the CALLER claims, and the check only fired when that field was
+        //      present and mismatched — so a body omitting it, which a partial
+        //      write naturally does, was compared against nothing and passed
+        //      whatever record the URL pointed at. The resource-level check behind
+        //      it is "validate-truthy" attribution, which by design also passes an
+        //      ABSENT owner field, so nothing downstream caught it either. (A PUT
+        //      happened to fail anyway, but on `agentId: String!` schema
+        //      validation — a 400 for the wrong reason, not an authorization
+        //      decision, and not a defence to rely on.)
+        //
+        // Closing one hole leaves the other reachable through the remaining verbs,
+        // so both are closed here: every mutating verb is covered, and ownership is
+        // resolved from the STORED RECORD named by the path. That is the same shape
+        // as the Memory ownership guard below, which is the resource in this file
+        // that already had it right — worth copying rather than reinventing.
+        //
+        // The path test stays `startsWith("/Soul")` so sibling routes keep the
+        // body check they already had; the record lookup is scoped to the real
+        // `/Soul/<id>` collection so it never resolves an unrelated id.
+        if (url.pathname.startsWith("/Soul") &&
+            (method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE")) {
             if (!request.tpsAgentIsAdmin) {
-                let bodyAgentId = null;
-                try {
-                    const clone = request.clone();
-                    const body = await clone.json();
-                    bodyAgentId = body?.agentId ?? null;
-                }
-                catch { }
-                if (bodyAgentId && bodyAgentId !== agentId) {
-                    return new Response(JSON.stringify({ error: "forbidden: non-admin cannot modify another agent's soul" }), { status: 403 });
+                // (a) A PRESENT, mismatched body agentId is a forged attribution.
+                if (method !== "DELETE") {
+                    let bodyAgentId = null;
+                    try {
+                        const clone = request.clone();
+                        const body = await clone.json();
+                        bodyAgentId = body?.agentId ?? null;
+                    }
+                    catch { }
+                    if (bodyAgentId && bodyAgentId !== agentId) {
+                        return new Response(JSON.stringify({ error: "forbidden: non-admin cannot modify another agent's soul" }), { status: 403 });
+                    }
                 }
+                // (b) The owner of the record actually being written — the half that
+                // catches a body simply leaving agentId out — is now the shared
+                // record-ownership rule at the top of this block, which applies it to
+                // every table on every mutating verb. Deliberately NOT repeated here:
+                // one condition enforced in two places is how the two drift apart.
             }
         }
         // Memory promotion guard: only admin can approve or set durability=permanent
@@ -453,21 +525,22 @@ server.http(async (request, nextLayer) => {
                 catch { }
             }
         }
-        // Memory PUT/DELETE: ownership check (non-admin can only modify their own memories)
+        // Memory DELETE: permanent memories are admin-only to purge.
+        //
+        // The OWNERSHIP half of this guard — which was the model the shared
+        // record-ownership rule above was built from, and the only one in this file
+        // that already covered PATCH — now lives there and covers every table. What
+        // remains here is the part that is NOT about ownership: durability. An agent
+        // owning a permanent memory still may not purge it.
         if (((url.pathname === "/Memory" || url.pathname.startsWith("/Memory/") || url.pathname === "/memory" || url.pathname.startsWith("/memory/"))) &&
-            (method === "PUT" || method === "DELETE" || method === "PATCH")) {
+            method === "DELETE") {
             if (!request.tpsAgentIsAdmin) {
                 try {
                     const pathParts = url.pathname.split("/").filter(Boolean);
                     const memId = pathParts[1] ? decodeURIComponent(pathParts[1]) : null;
                     if (memId) {
                         const record = await databases.flair.Memory.get(memId);
-                        if (record && record.agentId && record.agentId !== agentId) {
-                            return new Response(JSON.stringify({
-                                error: `forbidden: cannot modify memory owned by ${record.agentId}`
-                            }), { status: 403 });
-                        }
-                        if (method === "DELETE" && record?.durability === "permanent") {
+                        if (record?.durability === "permanent") {
                             return new Response(JSON.stringify({
                                 error: "forbidden: only admins can purge permanent memories"
                             }), { status: 403 });

package/dist/resources/in-process-api.js

@@ -0,0 +1,382 @@
+/**
+ * ─── Public in-process API (flair#956) ───────────────────────────────────────
+ *
+ * The facade that hides four internal implementation details a Harper engineer
+ * should never have to learn:
+ *
+ *   1. A deep import path into our dist/
+ *   2. That server.resources is keyed by REST path with no leading slash
+ *   3. That the registry entry wraps the class in .Resource
+ *   4. That creates need collectionResource() while reads do not
+ *
+ * And collapses the agentId double-pass (context + body) into one.
+ *
+ * ```ts
+ * import { Flair } from "@tpsdev-ai/flair";
+ * const flair = new Flair(server);
+ * const planner = flair.as("planner");
+ * await planner.memory.write("deploy runs at 0200 UTC");
+ * ```
+ *
+ * The facade does NOT hide the security boundary. In-process identity is
+ * asserted, not verified — co-location IS the grant. flair.as(id) requires a
+ * non-empty id (runtime throw). flair.admin and flair.internal are separate,
+ * greppable properties. The docs say plainly: build the context from your own
+ * server-side state, never from request data.
+ *
+ * ── Internal implementation ─────────────────────────────────────────────────
+ * Every operation delegates to the existing primitives in ./in-process.js
+ * (agentContext, adminContext, internalContext, collectionResource). The facade
+ * is additive — existing code using the raw seam continues to work.
+ */
+import { agentContext, adminContext, internalContext, collectionResource, InProcessContextError, } from "./in-process.js";
+// ─── Re-export for the "./server" entry point ────────────────────────────────
+export { agentContext, adminContext, internalContext, collectionResource, InProcessContextError };
+// ─── Resource resolution ─────────────────────────────────────────────────────
+/**
+ * Resolve a Flair resource class from the Harper server registry.
+ * Throws with a helpful message listing available resources if not found.
+ */
+function resolveResource(server, name) {
+    const entry = server.resources.get?.(name) ?? server.resources.getMatch?.(name);
+    if (!entry?.Resource) {
+        const keys = [...server.resources.keys()].sort();
+        const available = keys.length > 0 ? keys.join(", ") : "(none)";
+        throw new Error(`Flair is not loaded in this Harper instance.\n` +
+            `The '${name}' resource was not found in the registry.\n` +
+            `Available: [${available}]\n` +
+            `Make sure @tpsdev-ai/flair is installed as a component of this instance.`);
+    }
+    return entry.Resource;
+}
+// ─── AgentHandle ─────────────────────────────────────────────────────────────
+/**
+ * A handle that carries agent identity and scopes every operation to that agent.
+ *
+ * Returned by {@link Flair.as}. The agentId is validated at construction time
+ * (runtime, not types) — missing, empty, blank, or non-string throws
+ * {@link InProcessContextError}.
+ *
+ * **Security:** in-process identity is asserted, not verified. Build the
+ * agentId from your own server-side state, never from request data.
+ */
+export class AgentHandle {
+    agentId;
+    #server;
+    #ctx;
+    constructor(server, agentId) {
+        this.#server = server;
+        this.agentId = agentId;
+        // Throws InProcessContextError on missing/empty/blank id — see
+        // resources/in-process.ts's safety-design block for why this is
+        // not merely defensive.
+        this.#ctx = agentContext(agentId);
+    }
+    /** Memory operations scoped to this agent. */
+    get memory() {
+        return new AgentMemory(this.#server, this.#ctx, this.agentId);
+    }
+    /**
+     * Semantic search scoped to this agent.
+     *
+     * ```ts
+     * const hits = await planner.recall("deploy schedule", { limit: 5 });
+     * ```
+     */
+    async recall(query, opts) {
+        const Cls = resolveResource(this.#server, "SemanticSearch");
+        const h = new Cls(undefined, this.#ctx);
+        const body = { q: query, limit: opts?.limit ?? 5 };
+        if (opts?.includeTrust === true)
+            body.includeTrust = true;
+        if (opts?.abstain === true)
+            body.abstain = true;
+        if (opts?.scoring)
+            body.scoring = opts.scoring;
+        if (opts?.minScore !== undefined)
+            body.minScore = opts.minScore;
+        if (opts?.since)
+            body.since = opts.since;
+        if (opts?.asOf)
+            body.asOf = opts.asOf;
+        if (opts?.tag)
+            body.tag = opts.tag;
+        if (opts?.subject)
+            body.subject = opts.subject;
+        if (opts?.subjects)
+            body.subjects = opts.subjects;
+        return unwrap(await h.post(body));
+    }
+}
+// ─── AgentMemory (per-agent memory operations) ───────────────────────────────
+class AgentMemory {
+    #server;
+    #ctx;
+    #agentId;
+    constructor(server, ctx, agentId) {
+        this.#server = server;
+        this.#ctx = ctx;
+        this.#agentId = agentId;
+    }
+    /**
+     * Write a memory as this agent.
+     *
+     * The agentId is stamped from the handle's context — the caller never
+     * passes it, and any agentId in opts is overwritten. This collapses the
+     * double-pass (context + body) into one.
+     */
+    async write(content, opts) {
+        const Cls = resolveResource(this.#server, "Memory");
+        const h = await collectionResource(Cls, this.#ctx);
+        const body = {
+            agentId: this.#agentId,
+            content,
+        };
+        if (opts?.durability)
+            body.durability = opts.durability;
+        if (opts?.visibility)
+            body.visibility = opts.visibility;
+        if (opts?.tags)
+            body.tags = opts.tags;
+        if (opts?.type)
+            body.type = opts.type;
+        if (opts?.id)
+            body.id = opts.id;
+        return unwrap(await h.post(body));
+    }
+    /** Get a memory by id, scoped to this agent. */
+    async get(id) {
+        const Cls = resolveResource(this.#server, "Memory");
+        const h = new Cls(undefined, this.#ctx);
+        return unwrap(await h.get(id));
+    }
+    /**
+     * Search memories scoped to this agent.
+     *
+     * Delegates to Memory.search() which applies the agent's read scope
+     * (own memories + granted owners' shared memories).
+     */
+    async search(opts) {
+        const Cls = resolveResource(this.#server, "Memory");
+        const h = new Cls(undefined, this.#ctx);
+        const conditions = [];
+        if (opts?.tags) {
+            for (const tag of opts.tags) {
+                conditions.push({ search_attribute: "tags", search_type: "contains", search_value: tag });
+            }
+        }
+        if (opts?.type) {
+            conditions.push({ search_attribute: "type", search_type: "equals", search_value: opts.type });
+        }
+        if (opts?.durability) {
+            conditions.push({ search_attribute: "durability", search_type: "equals", search_value: opts.durability });
+        }
+        if (opts?.visibility) {
+            conditions.push({ search_attribute: "visibility", search_type: "equals", search_value: opts.visibility });
+        }
+        const query = conditions.length > 0 ? { conditions, operator: "and" } : undefined;
+        return unwrap(await h.search(query));
+    }
+}
+// ─── AdminHandle ─────────────────────────────────────────────────────────────
+/**
+ * Flair-admin operations — unfiltered reads, cross-agent writes.
+ *
+ * **This is a root shell.** Every call site is greppable via
+ * `git grep "flair.admin"`. Use for provisioning and maintenance only,
+ * never as a request handler's default.
+ *
+ * The admin agentId is validated at construction time (same guard as
+ * {@link AgentHandle}).
+ */
+export class AdminHandle {
+    agentId;
+    #server;
+    #ctx;
+    constructor(server, agentId) {
+        this.#server = server;
+        this.agentId = agentId;
+        this.#ctx = adminContext(agentId);
+    }
+    /**
+     * Register an agent through the Agent resource (full Principal shape).
+     *
+     * ```ts
+     * await flair.admin.registerAgent("planner", { publicKey: "pending" });
+     * ```
+     */
+    async registerAgent(id, opts) {
+        const Cls = resolveResource(this.#server, "Agent");
+        const h = await collectionResource(Cls, this.#ctx);
+        const body = {
+            id,
+            name: id,
+            displayName: opts?.displayName ?? id,
+            publicKey: opts?.publicKey ?? "pending",
+            runtime: opts?.runtime ?? "headless",
+        };
+        if (opts?.admin === true)
+            body.admin = true;
+        return unwrap(await h.post(body));
+    }
+    /** Memory operations with admin authority (unfiltered reads, cross-agent writes). */
+    get memory() {
+        return new AdminMemory(this.#server, this.#ctx, this.agentId);
+    }
+}
+// ─── AdminMemory ─────────────────────────────────────────────────────────────
+class AdminMemory {
+    #server;
+    #ctx;
+    #agentId;
+    constructor(server, ctx, agentId) {
+        this.#server = server;
+        this.#ctx = ctx;
+        this.#agentId = agentId;
+    }
+    /** Read any memory by id, unfiltered. */
+    async get(id) {
+        const Cls = resolveResource(this.#server, "Memory");
+        const h = new Cls(undefined, this.#ctx);
+        return unwrap(await h.get(id));
+    }
+    /**
+     * Write a memory attributed to another agent.
+     *
+     * ```ts
+     * await flair.admin.memory.write("researcher", "provisioned memory", { visibility: "shared" });
+     * ```
+     */
+    async write(asAgentId, content, opts) {
+        const Cls = resolveResource(this.#server, "Memory");
+        // Use adminContext for the acting admin, but stamp the target agentId
+        // on the body so the memory is owned by the target agent.
+        const h = await collectionResource(Cls, this.#ctx);
+        const body = {
+            agentId: asAgentId,
+            content,
+        };
+        if (opts?.durability)
+            body.durability = opts.durability;
+        if (opts?.visibility)
+            body.visibility = opts.visibility;
+        if (opts?.tags)
+            body.tags = opts.tags;
+        if (opts?.type)
+            body.type = opts.type;
+        if (opts?.id)
+            body.id = opts.id;
+        return unwrap(await h.post(body));
+    }
+}
+// ─── InternalHandle ──────────────────────────────────────────────────────────
+/**
+ * Trusted, unattributed, unfiltered operations — Flair's `internal` verdict.
+ *
+ * Reads see every agent's private records; writes are owned by nobody.
+ * This exists for work that is genuinely infrastructure: provisioning a
+ * principal, a migration, a maintenance sweep.
+ *
+ * Every call site is greppable via `git grep "flair.internal"`.
+ */
+export class InternalHandle {
+    #server;
+    #ctx;
+    constructor(server) {
+        this.#server = server;
+        this.#ctx = internalContext();
+    }
+    /** Raw Agent table access for provisioning. */
+    get agentTable() {
+        return new InternalAgentTable(this.#server, this.#ctx);
+    }
+}
+// ─── InternalAgentTable ──────────────────────────────────────────────────────
+class InternalAgentTable {
+    #server;
+    #ctx;
+    constructor(server, ctx) {
+        this.#server = server;
+        this.#ctx = ctx;
+    }
+    /** Write directly to the Agent resource (bypasses admin gate via internal context). */
+    async put(record) {
+        const Cls = resolveResource(this.#server, "Agent");
+        const h = await collectionResource(Cls, this.#ctx);
+        return unwrap(await h.post(record));
+    }
+}
+// ─── Flair (the facade) ──────────────────────────────────────────────────────
+/**
+ * The public in-process API for Flair embedded in a Harper app.
+ *
+ * One handle per Harper instance. Resolves resources lazily on first use.
+ *
+ * ```ts
+ * import { Flair } from "@tpsdev-ai/flair";
+ * const flair = new Flair(server);
+ * const planner = flair.as("planner");
+ * await planner.memory.write("deploy runs at 0200 UTC");
+ * ```
+ *
+ * **Security:** In-process identity is asserted, not verified — co-location
+ * IS the grant. Build the agentId from your own server-side state, never
+ * from request data. `flair.as(id)` requires a non-empty id (runtime throw).
+ * `flair.admin` and `flair.internal` are separate, greppable properties for
+ * deliberate escalation.
+ */
+export class Flair {
+    #server;
+    constructor(server) {
+        this.#server = server;
+    }
+    /**
+     * Return a handle that acts as the given agent.
+     *
+     * The agentId is runtime-validated: missing, empty, blank, or non-string
+     * throws {@link InProcessContextError}. Build it from your own server-side
+     * state, never from request data.
+     */
+    as(agentId) {
+        return new AgentHandle(this.#server, agentId);
+    }
+    /**
+     * Admin operations — unfiltered reads, cross-agent writes.
+     *
+     * **This is a root shell.** Every call site is greppable via
+     * `git grep "flair.admin"`. Use for provisioning and maintenance only.
+     */
+    get admin() {
+        // AdminHandle requires an agentId for attribution. We use a sentinel
+        // that makes the admin identity visible in audit logs. The caller
+        // should use a real admin agent id when possible.
+        return new AdminHandle(this.#server, "_admin");
+    }
+    /**
+     * Internal operations — trusted, unattributed, unfiltered.
+     *
+     * Every call site is greppable via `git grep "flair.internal"`.
+     * Use for infrastructure work only: provisioning, migrations, maintenance.
+     */
+    get internal() {
+        return new InternalHandle(this.#server);
+    }
+}
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+/**
+ * Unwrap a handler return value into a plain object.
+ * Handlers may return a `Response` (the 401/403/400 guards) — surface its
+ * JSON body so the caller sees the structured error rather than an opaque object.
+ */
+async function unwrap(value) {
+    if (value && typeof value === "object" && typeof value.json === "function" && "status" in value) {
+        try {
+            const body = await value.json();
+            return { error: body?.error ?? "request failed", status: value.status, ...body };
+        }
+        catch {
+            return { error: "request failed", status: value.status };
+        }
+    }
+    return value;
+}

package/dist/resources/in-process.js

@@ -208,6 +208,15 @@ export function internalContext() {
  * Reads do not need this — `Cls.get(id, context)` and `Cls.search(query,
  * context)` (Harper's static resource methods) already thread the context and
  * start their own transaction.
+ *
+ * **They do still need the CONTEXT.** Only the collection binding is
+ * unnecessary for a read, not the identity. `Cls.search(query)` with the second
+ * argument left off does not read "as nobody" — outside a Harper request scope
+ * (a boot hook, a timer, a queue worker, a detached promise) it resolves to the
+ * same trusted `internal` verdict this module exists to keep out of reach, and
+ * returns every agent's private records unfiltered. On that path the resource's
+ * own `allow*` gate is not consulted at all, so nothing else stands in the way.
+ * Pass the context to every call, read or write (flair#936).
  */
 export async function collectionResource(Cls, context) {
     if (context == null || typeof context !== "object") {

package/dist/resources/mcp-handler.js

@@ -26,6 +26,7 @@
 import { databases } from "harper";
 import { randomBytes } from "node:crypto";
 import { TOOLS, listToolDefs } from "./mcp-tools.js";
+import { agentRecordIsAdmin } from "./agent-admin.js";
 // The MCP protocol revision we implement (initialize handshake).
 const PROTOCOL_VERSION = "2025-06-18";
 const JSON_HEADERS = { "content-type": "application/json" };
@@ -157,14 +158,23 @@ async function jitProvisionPrincipal(sub) {
     return principalId;
 }
 /**
- * Is this Principal a flair admin? Reads the Agent record's `admin`/`role`
- * fields. A MCP-OAuth agent is NON-admin unless an operator has explicitly
- * marked its Agent record admin — the MCP surface never elevates on its own.
+ * Is this Principal a flair admin? A MCP-OAuth agent is NON-admin unless an
+ * operator has explicitly marked its Agent record admin — the MCP surface never
+ * elevates on its own.
+ *
+ * flair#941: this used to OR the two admin fields together while the primary
+ * HTTP gate (resources/agent-auth.ts's isAdmin) read only `role`, so the same
+ * record could be an administrator here and an ordinary agent there. It now
+ * resolves through the one shared predicate, so both surfaces answer
+ * identically. A record carrying `admin: true` alone — which no flair write
+ * path produces, and which was never an admin on the HTTP gate — is no longer
+ * an admin here either; see resources/agent-admin.ts for the remedy. This
+ * surface is gated behind FLAIR_MCP_OAUTH and is default-OFF.
  */
 async function isAgentAdmin(principalId) {
     try {
         const agent = await databases.flair.Agent.get(principalId);
-        return agent?.admin === true || agent?.role === "admin";
+        return agentRecordIsAdmin(agent);
     }
     catch {
         return false;

package/dist/resources/presence-internal.js

@@ -2,7 +2,12 @@ function presenceDelegationContext(auth) {
     const agentAuth = auth.kind === "agent"
         ? { agentId: auth.agentId, isAdmin: auth.isAdmin }
         : { agentId: "internal", isAdmin: true };
-    return { request: { _flairAgentAuth: agentAuth } };
+    // `__flairInternal` marks the `internal` branch as DELIBERATE (flair#936) —
+    // an "internal" verdict relayed here is a trusted in-process call this file
+    // has already established, not a caller who forgot to pass a context. It is
+    // read only by resources/agent-auth.ts's accidental-omission warning; it
+    // grants nothing and is never consulted for an authorization decision.
+    return { request: { _flairAgentAuth: agentAuth }, __flairInternal: true };
 }
 /**
  * The full presence roster (one row per agent — bounded, per the K&S