@tpsdev-ai/flair 0.35.0 → 0.37.0

package/dist/resources/Credential.js

@@ -1,6 +1,7 @@
 import { databases } from "harper";
 import { resolveAgentAuth, allowVerified } from "./agent-auth.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
+import { stampAttribution, UNAUTH } from "./record-type-kit.js";
 /**
  * Credential resource — authentication surfaces for Principals.
  *
@@ -23,6 +24,50 @@ export class Credential extends databases.flair.Credential {
      * top of this for the paths they do see.
      */
     allowRead() { return allowVerified(this.getContext?.()); }
+    /**
+     * Self-authorize creation (same posture as allowRead).  Without this gate
+     * Harper routes POST /Credential to the base class's post() — which has
+     * no cross-principal check — letting an unauthenticated caller create
+     * credentials for any principal.
+     */
+    allowCreate() { return allowVerified(this.getContext?.()); }
+    /**
+     * Create a credential.  No-forge attribution via stampAttribution
+     * ("stamp-default" mode): a non-admin agent's credential is ALWAYS
+     * attributed to the authenticated identity — we never trust
+     * content.principalId from the body.  An admin may create on behalf of
+     * another principal (content.principalId honored if present, else
+     * defaults to the admin's own id).  Internal in-process callers keep
+     * whatever principalId they pass.
+     *
+     * Previously Credential had no post() override — the base class's post()
+     * ran with no cross-principal check, so any verified caller could create
+     * a credential for any principal by setting principalId in the body.
+     */
+    async post(content) {
+        const auth = await resolveAgentAuth(this.getContext?.());
+        if (auth.kind === "anonymous")
+            return UNAUTH();
+        // No-forge attribution: stamp principalId from the authenticated
+        // identity.  "stamp-default" unconditionally overwrites for non-admin;
+        // admin may supply their own value (defaults to admin's id if absent).
+        stampAttribution(auth, content, "principalId", "stamp-default", "forbidden: unreachable for stamp-default");
+        const rl = checkRateLimit(auth.kind === "agent" ? auth.agentId : "internal");
+        if (!rl.allowed)
+            return rateLimitResponse(rl.retryAfterMs, "credential");
+        // Validate kind
+        const validKinds = ["webauthn", "bearer-token", "ed25519", "idp"];
+        if (!content.kind || !validKinds.includes(content.kind)) {
+            return new Response(JSON.stringify({ error: `kind must be one of: ${validKinds.join(", ")}` }), {
+                status: 400, headers: { "content-type": "application/json" },
+            });
+        }
+        const now = new Date().toISOString();
+        content.status = content.status || "active";
+        content.createdAt = content.createdAt || now;
+        content.updatedAt = now;
+        return super.post(content);
+    }
     async search(query) {
         const auth = await resolveAgentAuth(this.getContext?.());
         // Anonymous HTTP must NOT read credentials. (Previously `!authAgent` was
@@ -71,22 +116,19 @@ export class Credential extends databases.flair.Credential {
         return safe;
     }
     async put(content) {
-        const ctx = this.getContext?.();
-        const request = ctx?.request ?? ctx;
-        const authAgent = request?.tpsAgent;
-        const isAdminAgent = request?.tpsAgentIsAdmin ?? false;
-        if (!authAgent) {
+        const auth = await resolveAgentAuth(this.getContext?.());
+        if (auth.kind === "anonymous") {
             return new Response(JSON.stringify({ error: "authentication required" }), {
                 status: 401, headers: { "content-type": "application/json" },
             });
         }
-        // Only admins can create credentials for other principals
-        if (!isAdminAgent && content.principalId && content.principalId !== authAgent) {
+        // Only admins can update credentials for other principals
+        if (auth.kind === "agent" && !auth.isAdmin && content.principalId && content.principalId !== auth.agentId) {
             return new Response(JSON.stringify({ error: "only admin principals can manage other principals' credentials" }), {
                 status: 403, headers: { "content-type": "application/json" },
             });
         }
-        const rl = checkRateLimit(authAgent);
+        const rl = checkRateLimit(auth.kind === "agent" ? auth.agentId : "internal");
         if (!rl.allowed)
             return rateLimitResponse(rl.retryAfterMs, "credential");
         // Validate kind
@@ -97,25 +139,22 @@ export class Credential extends databases.flair.Credential {
             });
         }
         const now = new Date().toISOString();
-        content.principalId = content.principalId || authAgent;
+        content.principalId = content.principalId || (auth.kind === "agent" ? auth.agentId : content.principalId);
         content.status = content.status || "active";
         content.createdAt = content.createdAt || now;
         content.updatedAt = now;
         return super.put(content);
     }
     async delete(_) {
-        const ctx = this.getContext?.();
-        const request = ctx?.request ?? ctx;
-        const authAgent = request?.tpsAgent;
-        const isAdminAgent = request?.tpsAgentIsAdmin ?? false;
-        if (!authAgent) {
+        const auth = await resolveAgentAuth(this.getContext?.());
+        if (auth.kind === "anonymous") {
             return new Response(JSON.stringify({ error: "authentication required" }), {
                 status: 401, headers: { "content-type": "application/json" },
             });
         }
-        if (!isAdminAgent) {
+        if (auth.kind === "agent" && !auth.isAdmin) {
             const existing = await super.get();
-            if (existing?.principalId && existing.principalId !== authAgent) {
+            if (existing?.principalId && existing.principalId !== auth.agentId) {
                 return new Response(JSON.stringify({ error: "only admin principals can revoke other principals' credentials" }), {
                     status: 403, headers: { "content-type": "application/json" },
                 });

package/dist/resources/Memory.js

@@ -6,8 +6,9 @@ import { getEmbedding, getModelId } from "./embeddings-provider.js";
 import { scanFields, isStrictMode } from "./content-safety.js";
 import { invalidEntitiesResponse } from "./entity-vocab.js";
 import { checkRateLimit, rateLimitResponse } from "./rate-limiter.js";
+import { assertValidVisibility } from "./memory-visibility.js";
 import { DEDUP_COSINE_THRESHOLD_DEFAULT, DEDUP_LEXICAL_THRESHOLD_DEFAULT, DEDUP_MIN_CONTENT_LENGTH, computeMatchConfidence, cosineSimilarity, isConservativeMatch, } from "./dedup.js";
-import { buildProvenance, makeAuthGate, makeReadScope, makeByIdReadGate, resolveAuthGate, stampAttribution, FORBIDDEN, UNAUTH, } from "./record-type-kit.js";
+import { buildProvenance, makeAuthGate, makeReadScope, makeByIdReadGate, makeScopedSearch, resolveAuthGate, stampAttribution, FORBIDDEN, UNAUTH, } from "./record-type-kit.js";
 import { RECORD_TYPES } from "./record-types.js";
 import { attachTrust } from "./trust-block.js";
 import { recordCitations } from "./usage-recording.js";
@@ -53,6 +54,7 @@ function wantsTrust(target, opts) {
  */
 export const memoryReadScope = makeReadScope(RECORD_TYPES.Memory.readScope, RECORD_TYPES.Memory.ownerField);
 const memoryByIdReadGate = makeByIdReadGate(memoryReadScope);
+const memoryScopedSearch = makeScopedSearch(memoryReadScope);
 // See makeAuthGate's doc (record-type-kit.ts): must be wired as a genuine
 // prototype method below, never a class-field assignment — Harper's
 // relationship-traversal RBAC path reads allowRead off the prototype.
@@ -540,25 +542,12 @@ export class Memory extends databases.flair.Memory {
         // from RECORD_TYPES.Memory — see this file's header — delegating
         // "open-within-org" to memory-read-scope.ts's resolveReadScope()
         // unchanged) so get() above and search() here cannot drift.
-        const scope = await memoryReadScope(gate.agentId);
-        const agentIdCondition = scope.condition;
-        // Harper passes `query` as a RequestTarget (extends URLSearchParams) or a
-        // conditions array. For URL-based GET /Memory?... calls, URL params are no
-        // longer translated to conditions here — callers should use
-        // POST /Memory/search_by_conditions with an explicit conditions array.
-        // For programmatic calls with a conditions array, we wrap with the agentId scope.
-        if (query && typeof query === "object" && !Array.isArray(query)) {
-            if (Array.isArray(query.conditions) && query.conditions.length > 0) {
-                query.conditions = [agentIdCondition, ...query.conditions];
-                return withDetachedTxn(ctx, () => super.search(query));
-            }
-            // Fallback: no conditions array present — just scope and pass through
-        }
-        // Fallback: plain array or no query (internal calls)
-        const conditions = Array.isArray(query) && query.length > 0
-            ? [agentIdCondition, ...query]
-            : [agentIdCondition];
-        return withDetachedTxn(ctx, () => super.search(conditions));
+        //
+        // The scope condition is nested as the outermost AND block via
+        // makeScopedSearch (record-type-kit.ts) — same correct composition
+        // MemoryCandidate.search() already applies — so a caller-supplied
+        // `operator: "or"` cannot boolean-inject past the owner scope.
+        return memoryScopedSearch(gate.agentId, query, (q) => withDetachedTxn(ctx, () => super.search(q)));
     }
     async post(content, context) {
         // Rate limiting — use authenticated agent ID, not client-supplied body field
@@ -612,6 +601,23 @@ export class Memory extends databases.flair.Memory {
         // existing record's visibility" concern here. Explicit visibility on the
         // write ALWAYS overrides; only stamp the default when the caller left it
         // unset. permanent|persistent → shared; standard|ephemeral|absent → private.
+        // ── flair#1009: refuse an unrecognised visibility BEFORE defaulting ──
+        // isPrivateVisibility() is an exact match on "private", so on the READ
+        // side every other value (a typo, a wrong case, a retired tier like
+        // "office") resolves to non-private and is readable by every agent on the
+        // instance. #1006 closed that at the CLI flag and the MCP tool argument;
+        // REST and the in-process API reach here without passing either.
+        //
+        // Refusing, rather than dropping the key: dropping it falls through to the
+        // durability-keyed default below, which for a permanent or persistent
+        // write is "shared" - the same widening, arrived at silently. A misspelled
+        // argument must not decide who can read a memory.
+        {
+            const visibilityError = assertValidVisibility(content.visibility);
+            if (visibilityError) {
+                return new Response(JSON.stringify({ error: "invalid_visibility", message: visibilityError }), { status: 400, headers: { "content-type": "application/json" } });
+            }
+        }
         if (content.visibility === undefined || content.visibility === null) {
             content.visibility = defaultVisibilityForDurability(content.durability);
         }
@@ -796,6 +802,23 @@ export class Memory extends databases.flair.Memory {
         // Explicit visibility on the write ALWAYS overrides; only stamp the
         // default when the caller left it unset AND this is a fresh record.
         // permanent|persistent → shared; standard|ephemeral|absent → private.
+        // ── flair#1009: refuse an unrecognised visibility BEFORE defaulting ──
+        // isPrivateVisibility() is an exact match on "private", so on the READ
+        // side every other value (a typo, a wrong case, a retired tier like
+        // "office") resolves to non-private and is readable by every agent on the
+        // instance. #1006 closed that at the CLI flag and the MCP tool argument;
+        // REST and the in-process API reach here without passing either.
+        //
+        // Refusing, rather than dropping the key: dropping it falls through to the
+        // durability-keyed default below, which for a permanent or persistent
+        // write is "shared" - the same widening, arrived at silently. A misspelled
+        // argument must not decide who can read a memory.
+        {
+            const visibilityError = assertValidVisibility(content.visibility);
+            if (visibilityError) {
+                return new Response(JSON.stringify({ error: "invalid_visibility", message: visibilityError }), { status: 400, headers: { "content-type": "application/json" } });
+            }
+        }
         if (!preExisting && (content.visibility === undefined || content.visibility === null)) {
             content.visibility = defaultVisibilityForDurability(content.durability);
         }

package/dist/resources/MemoryFeed.js

@@ -1,16 +1,51 @@
 import { Resource, databases } from "harper";
-import { allowVerified } from "./agent-auth.js";
+import { allowVerified, resolveAgentAuth } from "./agent-auth.js";
 import { computeContentHash, findExistingMemoryByContentHash } from "./memory-feed-lib.js";
+import { FORBIDDEN, UNAUTH, stampAttribution } from "./record-type-kit.js";
 export class FeedMemories extends Resource {
     // Self-authorize via the Ed25519 agent verify (the auth reshape removes the
-    // gate's admin elevation). NOTE: post() trusts content.agentId from the body —
-    // closing that create-spoofing gap is tracked with the table-resource
-    // create-ownership work (Memory.allowCreate), not in this auth-coverage pass.
+    // gate's admin elevation).
     async allowCreate() {
         return allowVerified(this.getContext?.());
     }
     async post(content) {
-        const agentId = String(content?.agentId ?? "");
+        const ctx = this.getContext?.();
+        const auth = await resolveAgentAuth(ctx);
+        // Anonymous HTTP must NOT write.
+        if (auth.kind === "anonymous") {
+            return UNAUTH();
+        }
+        // No-forge attribution: use the kit's stampAttribution to stamp agentId
+        // from the authenticated principal, never from the body.
+        //
+        // Mode choice: stamp-strict (reject 403 on mismatch) over stamp-default
+        // (silent overwrite). This endpoint is the ingestion path — callers are MCP
+        // clients and agent-side tool calls. The defect this fix addresses was
+        // trusting a body-supplied identity; the correction is to always stamp from
+        // the authenticated principal.
+        //
+        // Deciding point (adjudicated on PR #1071): a silent overwrite means a
+        // buggy client never learns it is buggy — it keeps sending the wrong
+        // agentId and keeps getting 200. A strict rejection surfaces the mismatch
+        // so the caller can fix it. The concern about breaking callers that
+        // harmlessly echo agentId back was checked: a full search of the repo and
+        // workspace for FeedMemories and /FeedMemories returns only the resource
+        // definition and its own tests — no SDK wrappers, no CLI commands, no
+        // internal callers construct requests with a body-supplied agentId. A
+        // caller echoing the correct agentId (matching the principal) passes
+        // through stamp-strict unchanged; a caller echoing a wrong one is exactly
+        // the bug this slice exists to prevent.
+        const attr = stampAttribution(auth, content, 'agentId', 'stamp-strict', 'forbidden: cannot attribute a feed memory to another agent');
+        if (attr.denied)
+            return attr.denied;
+        // Guard against body-supplied id targeting another agent's record.
+        if (content?.id) {
+            const existingRecord = await databases.flair.Memory.get(content.id);
+            if (existingRecord && existingRecord.agentId !== content.agentId) {
+                return FORBIDDEN("forbidden: cannot write a feed memory owned by another agent");
+            }
+        }
+        const agentId = content.agentId;
         const body = String(content?.content ?? "");
         if (!agentId || !body) {
             return new Response(JSON.stringify({ error: "agentId and content are required" }), {

package/dist/resources/Presence.js

@@ -31,7 +31,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createRequire } from "node:module";
-import { resolveAgentAuth, verifyAgentRequest } from "./agent-auth.js";
+import { resolveAgentAuth, verifyAgentRequest, isPrincipalDeactivated } from "./agent-auth.js";
 import { agentRecordIsAdmin } from "./agent-admin.js";
 import { WINDOW_MS, isNonceReplay, recordNonce, importEd25519Key, b64ToArrayBuffer, parseTpsEd25519Header } from "./ed25519-auth.js";
 // ─── Constants ────────────────────────────────────────────────────────────────
@@ -449,6 +449,13 @@ export class Presence extends databases.flair.Presence {
                 return new Response(JSON.stringify({ error: "signature_verification_failed", detail: e?.message }), { status: 401, headers: { "Content-Type": "application/json" } });
             }
             recordNonce(headerAgentId, nonce, ts);
+            // Deactivation guard — same predicate as the middleware Basic branches.
+            // A deactivated principal must not be allowed to heartbeat, even when
+            // the Ed25519 signature is valid.
+            const agentRecord = await databases.flair.Agent.get(headerAgentId).catch(() => null);
+            if (isPrincipalDeactivated(agentRecord)) {
+                return new Response(JSON.stringify({ error: "principal_deactivated" }), { status: 401 });
+            }
             agentId = headerAgentId;
         }
         // ── Validate body ────────────────────────────────────────────────────────

package/dist/resources/WorkspaceState.js

@@ -10,7 +10,7 @@
 import { databases } from "harper";
 import { resolveAgentAuth } from "./agent-auth.js";
 import { invalidEntitiesResponse } from "./entity-vocab.js";
-import { makeAuthGate, makeReadScope, makeByIdReadGate, resolveAuthGate, stampAttribution, FORBIDDEN, UNAUTH, } from "./record-type-kit.js";
+import { makeAuthGate, makeReadScope, makeByIdReadGate, makeScopedSearch, resolveAuthGate, stampAttribution, FORBIDDEN, UNAUTH, } from "./record-type-kit.js";
 import { RECORD_TYPES } from "./record-types.js";
 // Parameterized from RECORD_TYPES.WorkspaceState (record-types slice 2,
 // flair#520) rather than a hand-typed "owner-only" literal — the registry is
@@ -21,6 +21,7 @@ import { RECORD_TYPES } from "./record-types.js";
 // runtime consumer.
 export const workspaceReadScope = makeReadScope(RECORD_TYPES.WorkspaceState.readScope, RECORD_TYPES.WorkspaceState.ownerField);
 const workspaceByIdReadGate = makeByIdReadGate(workspaceReadScope);
+const workspaceScopedSearch = makeScopedSearch(workspaceReadScope);
 // See makeAuthGate's doc (record-type-kit.ts): must be wired as a genuine
 // prototype method below, never a class-field assignment — Harper's
 // relationship-traversal RBAC path reads allowRead off the prototype.
@@ -78,21 +79,11 @@ export class WorkspaceState extends databases.flair.WorkspaceState {
             return gate.response;
         if (gate.kind === "unfiltered")
             return super.search(query);
-        const scope = await workspaceReadScope(gate.agentId);
-        const agentIdCondition = scope.condition;
-        // Harper passes `query` as a request target object (pathname, id, isCollection…).
-        // Inject the scope condition into its `.conditions` array.
-        if (query && typeof query === "object" && !Array.isArray(query)) {
-            const existing = query.conditions ?? [];
-            query.conditions = Array.isArray(existing)
-                ? [agentIdCondition, ...existing]
-                : [agentIdCondition, existing];
-            return super.search(query);
-        }
-        const conditions = Array.isArray(query) && query.length > 0
-            ? [agentIdCondition, ...query]
-            : [agentIdCondition];
-        return super.search(conditions);
+        // Non-admin agent: scope to own records only.  The scope condition is
+        // nested as the outermost AND block via makeScopedSearch (record-type-kit.ts)
+        // — same correct composition MemoryCandidate.search() already applies — so a
+        // caller-supplied `operator: "or"` cannot boolean-inject past the owner scope.
+        return workspaceScopedSearch(gate.agentId, query, (q) => super.search(q));
     }
     async post(content) {
         const auth = await this._auth();

package/dist/resources/agent-auth.js

@@ -25,6 +25,33 @@ import { ADMIN_ROLE, agentRecordIsAdmin } from "./agent-admin.js";
  * provisions it (ensureFlairAgentUser); they MUST agree on the name.
  */
 export const FLAIR_AGENT_USERNAME = "flair-agent";
+// ─── Principal deactivation guard (authz hardening slice 1) ─────────────────
+//
+// ONE predicate, called from BOTH verify paths (Ed25519 in doVerify + the
+// gate's own verify, and Basic/agent-auth in resolveAgentAuth) so the
+// deactivation check cannot drift between them.  Two independent checks would
+// inevitably diverge — one path tightened, the other forgotten — and this is
+// exactly the kind of control that must not.
+//
+// KNOWN LIMIT (slice 1b, NOT this slice): Harper's Bearer validation never
+// calls Agent.get(principalId), so already-issued Bearer tokens SURVIVE
+// deactivation.  This slice buys "deactivation stops new authentications" and
+// nothing more.  Existing tokens live until expiry or explicit revocation.
+// Do not read this as "deactivation now works" — it works for NEW auth only.
+/**
+ * Single shared predicate: is this principal deactivated?
+ *
+ * Called from BOTH verify paths (Ed25519 and Basic/agent-auth) so the
+ * deactivation check cannot drift.  A nonexistent agent is not "deactivated" —
+ * it will fail on other checks (missing publicKey, unknown user, etc.).
+ */
+export function isPrincipalDeactivated(agent) {
+    if (agent == null)
+        return false;
+    if (agent.status === undefined)
+        return false;
+    return agent.status !== "active";
+}
 // ─── Crypto + replay-guard helpers ────────────────────────────────────────────
 // WINDOW_MS, isNonceReplay/recordNonce (the ONE shared nonce store), and
 // importEd25519Key all live in ./ed25519-auth.ts — the single
@@ -103,6 +130,10 @@ async function doVerify(request) {
     const agent = await databases.flair.Agent.get(agentId).catch(() => null);
     if (!agent?.publicKey)
         return null;
+    // Deactivation guard — ONE predicate, same check as the Basic/agent-auth path
+    // in resolveAgentAuth below.  A deactivated principal cannot authenticate.
+    if (isPrincipalDeactivated(agent))
+        return null;
     // Canonical signed payload: id:ts:nonce:METHOD:pathname+search (must match the
     // TPS CLI signer exactly — changing this breaks every agent's auth).
     const url = new URL(request.url, "http://localhost");
@@ -310,10 +341,18 @@ export async function resolveAgentAuth(context) {
     const credentialed = hasCredentialEvidence(c);
     const user = context?.user ?? c.user;
     if (credentialed && user?.role?.permission?.super_user === true) {
-        return { kind: "agent", agentId: String(user.username ?? "admin"), isAdmin: true };
+        const agentId = String(user.username ?? "admin");
+        const agent = await databases.flair.Agent.get(agentId).catch(() => null);
+        if (isPrincipalDeactivated(agent))
+            return { kind: "anonymous" };
+        return { kind: "agent", agentId, isAdmin: true };
     }
     if (credentialed && user?.username && user.username !== FLAIR_AGENT_USERNAME) {
-        return { kind: "agent", agentId: String(user.username), isAdmin: false };
+        const agentId = String(user.username);
+        const agent = await databases.flair.Agent.get(agentId).catch(() => null);
+        if (isPrincipalDeactivated(agent))
+            return { kind: "anonymous" };
+        return { kind: "agent", agentId, isAdmin: false };
     }
     // A raw request with headers is present → verify it; an HTTP request that
     // yields no agent is anonymous (NOT internal).

package/dist/resources/auth-middleware.js

@@ -1,7 +1,7 @@
 import { patchRecord } from "./table-helpers.js";
 import { server, databases } from "harper";
 import { getEmbedding } from "./embeddings-provider.js";
-import { isAdmin, FLAIR_AGENT_USERNAME } from "./agent-auth.js";
+import { isAdmin, isPrincipalDeactivated, FLAIR_AGENT_USERNAME } from "./agent-auth.js";
 import { WINDOW_MS, isNonceReplay, recordNonce, importEd25519Key, b64ToArrayBuffer, parseTpsEd25519Header } from "./ed25519-auth.js";
 import { resolveReadScope } from "./memory-read-scope.js";
 import { isForbiddenOwnerMutation, resolveGuardedRecord } from "./record-owner-guard.js";
@@ -163,15 +163,24 @@ server.http(async (request, nextLayer) => {
     // ambient elevation alone. (The root-cause gate lives in resolveAgentAuth; see
     // agent-auth.ts hasCredentialEvidence.)
     if (header && request.user?.role?.permission?.super_user === true) {
-        request.tpsAgent = request.user.username ?? "admin";
-        request.tpsAgentIsAdmin = true;
-        try {
-            request.headers.set("x-tps-agent", request.tpsAgent);
-            if (request.headers.asObject)
-                request.headers.asObject["x-tps-agent"] = request.tpsAgent;
+        const username = request.user.username ?? "admin";
+        // Deactivation guard — same predicate as the Ed25519 path.
+        // A deactivated principal must not receive a tpsAgent annotation, even
+        // when Harper's ambient auth already verified the credential.
+        const agentRecord = await databases.flair.Agent.get(username).catch(() => null);
+        if (!isPrincipalDeactivated(agentRecord)) {
+            request.tpsAgent = username;
+            request.tpsAgentIsAdmin = true;
+            try {
+                request.headers.set("x-tps-agent", request.tpsAgent);
+                if (request.headers.asObject)
+                    request.headers.asObject["x-tps-agent"] = request.tpsAgent;
+            }
+            catch { /* frozen headers — annotation on request object still applies */ }
+            return nextLayer(request);
         }
-        catch { /* frozen headers — annotation on request object still applies */ }
-        return nextLayer(request);
+        // Deactivated — fall through. The request continues through the
+        // middleware chain (Basic block → Ed25519 → anonymous) without tpsAgent.
     }
     // Skip re-entry: if we already swapped auth to Basic, pass through
     if (request._tpsAuthVerified)
@@ -191,18 +200,23 @@ server.http(async (request, nextLayer) => {
             // with exact HDB_ADMIN_PASSWORD. Non-match falls through to Path 2.
             const adminPass = getAdminPass();
             if (adminPass !== null && user === "admin" && pass === adminPass) {
-                // Mark as verified and set Harper user directly
-                request._tpsAuthVerified = true;
-                try {
-                    request.user = await server.getUser("admin", null, request);
+                // Deactivation guard — same predicate, called before tpsAgent is stamped.
+                const agentRecord = await databases.flair.Agent.get("admin").catch(() => null);
+                if (!isPrincipalDeactivated(agentRecord)) {
+                    // Mark as verified and set Harper user directly
+                    request._tpsAuthVerified = true;
+                    try {
+                        request.user = await server.getUser("admin", null, request);
+                    }
+                    catch { /* fallback: let original Basic header pass through */ }
+                    request.headers.set("x-tps-agent", "admin");
+                    if (request.headers.asObject)
+                        request.headers.asObject["x-tps-agent"] = "admin";
+                    request.tpsAgent = "admin";
+                    request.tpsAgentIsAdmin = true;
+                    return nextLayer(request);
                 }
-                catch { /* fallback: let original Basic header pass through */ }
-                request.headers.set("x-tps-agent", "admin");
-                if (request.headers.asObject)
-                    request.headers.asObject["x-tps-agent"] = "admin";
-                request.tpsAgent = "admin";
-                request.tpsAgentIsAdmin = true;
-                return nextLayer(request);
+                // Deactivated — fall through to anonymous (end of Basic block).
             }
             // Path 2: Harper super_user check — any user with super_user:true
             let harperUser = null;
@@ -211,14 +225,19 @@ server.http(async (request, nextLayer) => {
             }
             catch { /* fall through — invalid creds, non-existent user, etc. */ }
             if (harperUser?.role?.permission?.super_user === true) {
-                request._tpsAuthVerified = true;
-                request.user = harperUser;
-                request.headers.set("x-tps-agent", user);
-                if (request.headers.asObject)
-                    request.headers.asObject["x-tps-agent"] = user;
-                request.tpsAgent = user;
-                request.tpsAgentIsAdmin = true;
-                return nextLayer(request);
+                // Deactivation guard — same predicate, called before tpsAgent is stamped.
+                const agentRecord = await databases.flair.Agent.get(user).catch(() => null);
+                if (!isPrincipalDeactivated(agentRecord)) {
+                    request._tpsAuthVerified = true;
+                    request.user = harperUser;
+                    request.headers.set("x-tps-agent", user);
+                    if (request.headers.asObject)
+                        request.headers.asObject["x-tps-agent"] = user;
+                    request.tpsAgent = user;
+                    request.tpsAgentIsAdmin = true;
+                    return nextLayer(request);
+                }
+                // Deactivated — fall through to anonymous (end of Basic block).
             }
             // Path 3: flair_pair_initiator — restricted to /FederationPair only.
             // Bootstrap credentials (pair-bootstrap-<id>) may only be used on this
@@ -231,14 +250,19 @@ server.http(async (request, nextLayer) => {
                 catch { /* fall through */ }
                 if (pairUser?.role?.role === "flair_pair_initiator" &&
                     pairUser?.active === true) {
-                    request._tpsAuthVerified = true;
-                    request.user = pairUser;
-                    request.headers.set("x-tps-agent", user);
-                    if (request.headers.asObject)
-                        request.headers.asObject["x-tps-agent"] = user;
-                    request.tpsAgent = user;
-                    request.tpsAgentIsAdmin = false;
-                    return nextLayer(request);
+                    // Deactivation guard — same predicate, called before tpsAgent is stamped.
+                    const agentRecord = await databases.flair.Agent.get(user).catch(() => null);
+                    if (!isPrincipalDeactivated(agentRecord)) {
+                        request._tpsAuthVerified = true;
+                        request.user = pairUser;
+                        request.headers.set("x-tps-agent", user);
+                        if (request.headers.asObject)
+                            request.headers.asObject["x-tps-agent"] = user;
+                        request.tpsAgent = user;
+                        request.tpsAgentIsAdmin = false;
+                        return nextLayer(request);
+                    }
+                    // Deactivated — fall through to anonymous (end of Basic block).
                 }
             }
         }
@@ -297,6 +321,11 @@ server.http(async (request, nextLayer) => {
     const agent = await databases.flair.Agent.get(agentId);
     if (!agent)
         return new Response(JSON.stringify({ error: "unknown_agent" }), { status: 401 });
+    // Deactivation guard — same predicate as the per-resource verify path in
+    // agent-auth.ts.  A deactivated principal cannot authenticate.
+    if (isPrincipalDeactivated(agent)) {
+        return new Response(JSON.stringify({ error: "principal_deactivated" }), { status: 401 });
+    }
     try {
         const payload = `${agentId}:${tsRaw}:${nonce}:${request.method}:${url.pathname}${url.search}`;
         const key = await importEd25519Key(agent.publicKey);

package/dist/resources/memory-visibility.js

@@ -29,9 +29,53 @@
  * missing/null/anything-other-than-'private' all count as non-private.
  */
 export const PRIVATE_VISIBILITY = "private";
+export const SHARED_VISIBILITY = "shared";
+/** The only values a WRITER may supply. Deliberately not derived from the read
+ *  predicate below — see the asymmetry note on assertValidVisibility. */
+export const WRITABLE_VISIBILITIES = [PRIVATE_VISIBILITY, SHARED_VISIBILITY];
 /** True only when visibility is the literal string "private". Null, undefined,
  *  "shared", or any other value are all non-private (see migration invariant
  *  above) — never invert this to an allowlist of "shared". */
 export function isPrivateVisibility(visibility) {
     return visibility === PRIVATE_VISIBILITY;
 }
+/**
+ * Reject a visibility a writer supplied that is not one of the two valid values.
+ * Returns an error message, or null when the value is acceptable.
+ *
+ * ── Why this is NOT the inverse of isPrivateVisibility (flair#1009) ──────────
+ *
+ * The read predicate above must stay "is this exactly 'private'", because a row
+ * written before the field existed has no visibility and must keep reading as it
+ * always did. That is a MIGRATION rule about stored data, and it is correct.
+ *
+ * The consequence is that on the read side every unrecognised value — a typo, a
+ * wrong case, a retired tier — resolves to non-private and is readable by every
+ * agent on the instance. #1006 closed that at the two writer-intent boundaries
+ * (the CLI flag, the MCP tool argument); REST and the in-process API still
+ * accepted anything, so `PUT /Memory/<id> {"visibility":"prvate"}` wrote a
+ * memory the caller believed was owner-only and everyone could read.
+ *
+ * So the two directions need different rules, and conflating them breaks one or
+ * the other:
+ *   - READING an unknown value must be permissive, or old rows break.
+ *   - WRITING an unknown value must be refused, or a typo silently widens who
+ *     can read a memory.
+ *
+ * Refusing is also the only safe option at write time. Silently dropping the key
+ * would fall back to the durability-keyed default, which for a permanent or
+ * persistent write is `shared` — the same wrong outcome, arrived at quietly.
+ *
+ * `undefined`/`null` are accepted: omitting the field is how a caller asks for
+ * the durability-keyed default, and that is a documented, intentional path.
+ */
+export function assertValidVisibility(visibility) {
+    if (visibility === undefined || visibility === null)
+        return null;
+    if (typeof visibility === "string" && WRITABLE_VISIBILITIES.includes(visibility)) {
+        return null;
+    }
+    return (`visibility must be ${WRITABLE_VISIBILITIES.map((v) => `"${v}"`).join(" or ")} ` +
+        `(got: ${JSON.stringify(visibility)}). Omit it to use the durability-keyed default: ` +
+        `permanent/persistent -> shared, standard/ephemeral -> private.`);
+}