run402 4.48.0 → 4.50.0

package/gitvault-surface.json

@@ -1,5 +1,5 @@
 {
-  "surface_version": "4.48.0",
+  "surface_version": "4.50.0",
   "verbs": [
     "repos create",
     "repos list",

package/lib/credentials.mjs

@@ -26,8 +26,10 @@ Usage:
   run402 credentials <subcommand> [args...]
 
 Project credentials (on the gateway — named, revocable, rotatable):
-  issue --kind <anon|service> --name <name> [--project <id>] [--expires <iso8601>]
+  issue --kind <anon|service> --name <name> [--project <id>] [--expires <iso8601>] [--import]
                                 Mint one. The secret is printed ONCE.
+                                --import also writes it into this machine's
+                                local key cache (the cold-restart re-key path).
   list [--project <id>] [--include-revoked]
                                 List credentials (metadata only, never secrets)
   status [--project <id>]       Are you still on the retiring legacy key?
@@ -87,7 +89,7 @@ const SUB_HELP = {
   issue: `run402 credentials issue — mint a named project credential
 
 Usage:
-  run402 credentials issue --kind <anon|service> --name <name> [--project <id>]
+  run402 credentials issue --kind <anon|service> --name <name> [--project <id>] [--import]
                            [--expires <iso8601>]
 
 --kind    "anon" is the tenant-facing key; "service" is the privileged one.
@@ -95,6 +97,11 @@ Usage:
           returns 409 CREDENTIAL_NAME_TAKEN — that collision is the idempotency
           story, so a retried create never mints a second credential by accident.
 --expires Optional; must be in the future and within one year.
+--import  Also write the minted secret into this machine's local key cache
+          (what deploys and data-plane commands read) — the cold-restart
+          re-key path in ONE step instead of issue-then-project-keys-import.
+          A first --kind anon --import on a machine with no cached entry
+          still needs a service key first, same as project-keys import.
 
 The secret is printed ONCE, on stdout, inside the JSON. Pipe it:
   run402 credentials issue --kind service --name ci | jq -r .secret
@@ -407,7 +414,8 @@ const ISSUE_VALUE_FLAGS = ["--project", "--kind", "--name", "--expires"];
 
 async function issue(args) {
   const a = normalizeArgv(args);
-  assertKnownFlags(a, [...ISSUE_VALUE_FLAGS, "--help", "-h"], ISSUE_VALUE_FLAGS);
+  assertKnownFlags(a, [...ISSUE_VALUE_FLAGS, "--import", "--help", "-h"], ISSUE_VALUE_FLAGS);
+  const importToCache = a.includes("--import");
   const kind = flagValue(a, "--kind");
   const name = flagValue(a, "--name");
   const expiresAt = flagValue(a, "--expires");
@@ -415,7 +423,7 @@ async function issue(args) {
   requirePositionalCount(rest, ISSUE_VALUE_FLAGS, {
     min: 0,
     max: 0,
-    command: "run402 credentials issue --kind <anon|service> --name <name> [--project <id>]",
+    command: "run402 credentials issue --kind <anon|service> --name <name> [--project <id>] [--import]",
     missing: "",
   });
   if (kind !== "anon" && kind !== "service") {
@@ -432,8 +440,39 @@ async function issue(args) {
       hint: "The name identifies this credential in 'list' and is how you rotate it later, e.g. --name ci-deploy",
     });
   }
+  // Validate the --import precondition BEFORE minting: refusing after the
+  // mint would burn a show-once secret on a usage error.
+  const existing = importToCache ? getProject(projectId) : undefined;
+  if (importToCache && kind === "anon" && !existing?.service_key) {
+    fail({
+      code: "BAD_USAGE",
+      message: `--import for an anon key writes the whole cache entry, and no service key is cached for ${projectId} yet.`,
+      hint: "Run 'run402 credentials issue --kind service --name <name> --import' first (same rule as project-keys import).",
+      details: { project_id: projectId },
+    });
+  }
   try {
-    emitIssued(await getSdk().credentials.issue(projectId, { kind, name, expiresAt: expiresAt || undefined }));
+    const res = await getSdk().credentials.issue(projectId, { kind, name, expiresAt: expiresAt || undefined });
+    if (importToCache && res?.secret) {
+      // The cold-restart re-key path (gitvault-deploy-lane 6.5a): the minted
+      // secret goes straight into the local cache the deploy and data-plane
+      // commands read, so a fresh machine re-keys in one command per kind
+      // instead of the four-command issue-then-project-keys-import dance.
+      // The secret never rides argv; it came back on the mint response.
+      saveProject(projectId, {
+        anon_key: kind === "anon" ? res.secret : existing?.anon_key ?? "",
+        service_key: kind === "service" ? res.secret : existing?.service_key ?? "",
+        site_url: existing?.site_url,
+        deployed_at: existing?.deployed_at,
+        last_deployment_id: existing?.last_deployment_id,
+        org_id: existing?.org_id,
+        source: "credentials_issue_import",
+        cached_at: new Date().toISOString(),
+      });
+      emitIssued({ ...res, imported_to_local_cache: true });
+      return;
+    }
+    emitIssued(res);
   } catch (err) {
     reportSdkError(err);
   }

package/lib/repos.mjs

@@ -174,6 +174,12 @@ Subcommands:
            normal writing mode, so a budget-exceeded run resumes). \`--mirror\`
            additionally runs the keyless mirror integrity probe — it proves
            the mirror's VALIDITY, never its FRESHNESS, and says so.
+           In write mode (not \`--no-write\`), when this keystore holds a
+           local encryption identity, fsck ALSO submits its own
+           chain-verified/decryptable generations as a proof-of-open receipt
+           (\`recipient_open_receipt\`, D210) — best-effort: it never changes
+           fsck's own verdict, and its outcome rides the result's
+           \`open_proof\` block (also surfaced on \`--human\`).
            \`--human\` renders a short summary instead of JSON.
   gc       \`git gc\`'s own two halves — checkpoint publication (compact) and
            prune planning — in one verb, NOT described as "exactly git gc":
@@ -1437,6 +1443,21 @@ async function mirror(args) {
 
 // ─── fsck (verify the head chain + materialize refs) ──────────────────
 
+/**
+ * D210 (rev 44): one line describing `fsck`'s best-effort proof-of-open
+ * submission outcome — never blank, so a reader always knows whether
+ * `open_proof` is silence (audit mode / no local identity) or a real
+ * attempt (submitted, or a caught failure). Shared by `--human` and the
+ * default JSON-mode stderr summary.
+ */
+function formatOpenProofLine(openProof) {
+  if (!openProof || !openProof.attempted) return null;
+  if (openProof.submitted) {
+    return `proof-of-open: ${openProof.deduplicated ? "already on file" : "submitted"} (${openProof.receipt.object_id}, decryptable through ${openProof.receipt.decryptable_to_generation}).`;
+  }
+  return `proof-of-open: not submitted — ${openProof.error.code}: ${openProof.error.message}`;
+}
+
 /** `repos fsck --human`: the same verdict the stderr lines already carry, condensed into one block. */
 function formatFsckHuman(result, mirrorRequested) {
   const lines = [`Repo: ${result.repo_id}`];
@@ -1471,6 +1492,8 @@ function formatFsckHuman(result, mirrorRequested) {
   } else if (result.retained_refs) {
     lines.push(`refs/r402/retain: ${result.retained_refs.retained_count} retained tip(s) referenced (+${result.retained_refs.written.length} -${result.retained_refs.deleted.length} this run).`);
   }
+  const openProofLine = formatOpenProofLine(result.open_proof);
+  if (openProofLine) lines.push(openProofLine);
   return lines.join("\n");
 }
 
@@ -1522,6 +1545,12 @@ async function fsck(args) {
     } else if (result.retained_refs && (result.retained_refs.written.length > 0 || result.retained_refs.deleted.length > 0)) {
       console.error(`refs/r402/retain: +${result.retained_refs.written.length} -${result.retained_refs.deleted.length} (${result.retained_refs.retained_count} retained tip(s) total).`);
     }
+    // D210 (rev 44): the best-effort proof-of-open submission's own outcome
+    // — informational only, printed regardless of whether it succeeded (a
+    // failure here is exactly as uninteresting to this command's own exit
+    // status as a mirror probe's failure would be).
+    const openProofLine = formatOpenProofLine(result.open_proof);
+    if (openProofLine) console.error(openProofLine);
     if (mirrorRequested && result.mirror) {
       console.error(`mirror: recoverable generation ${result.mirror.recovered_generation}${result.mirror.chain_break ? ` (chain break at ${result.mirror.chain_break.generation}: ${result.mirror.chain_break.reason})` : ""}.`);
       if (result.mirror.data_loss_detected) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402",
-  "version": "4.48.0",
+  "version": "4.50.0",
   "description": "CLI for Run402 — full-stack backend infrastructure for AI agents: Postgres, auth, storage, serverless functions and atomic deploys. Paid with x402/MPP. Includes $0.03 image generation.",
   "type": "module",
   "bin": {

package/sdk/dist/namespaces/deploy.js

@@ -3873,10 +3873,21 @@ async function uploadInlineCas(client, projectId, bytes, contentType) {
  * `/apply/v1/plans*` use SIWX, which the kernel's getAuth provides
  * automatically — only the apikey-gated paths need this helper.
  *
- * Returns an empty object when the credentials provider doesn't know the
- * project (the request will then go out without an apikey and the gateway
- * will reject with 401 — matches the failure mode for unconfigured
- * projects in any of today's other apikey-auth tools).
+ * COLD-RESTART RECOVERY (gitvault-deploy-lane 6.5a, the #624 class one layer
+ * in): when the local credential cache has no entry for the project — the
+ * returning-agent case, where the wallet survives but the once-issued project
+ * keys did not — this helper mints a SHORT-LIVED anon token via
+ * `POST /projects/v1/:project_id/tokens` (the route the platform built as
+ * exactly this recovery path; the gateway's own 401 envelope names it as the
+ * `mint_token` next_action) and uses it as the apikey, memoized in-process
+ * until shortly before it expires. A wallet-holding agent on a fresh machine
+ * deploys with zero extra commands; nothing durable is written anywhere.
+ *
+ * The mint is attempted only on a cache miss and never retried within a
+ * process on failure; a client that cannot mint (no signer, no authority)
+ * falls through to the pre-existing behavior — the request goes out without
+ * an apikey and the gateway rejects with 401, whose envelope names the
+ * recovery.
  */
 async function apikeyHeaders(client, projectId) {
     // A CI session and a delegate both already authorize these routes via
@@ -3886,9 +3897,55 @@ async function apikeyHeaders(client, projectId) {
     if (isCiClient(client) || isDelegateClient(client))
         return {};
     const project = await client.getProject(projectId);
-    if (!project)
-        return {};
-    return { apikey: project.anon_key };
+    if (project?.anon_key)
+        return { apikey: project.anon_key };
+    const minted = await mintedAnonToken(client, projectId);
+    return minted ? { apikey: minted } : {};
+}
+/**
+ * Per-client, per-project memo of short-lived minted anon tokens (plus a
+ * one-shot "minting failed, don't hammer" marker). Held only in process
+ * memory — a short-lived token must never land in a durable cache.
+ */
+const mintedTokenMemo = new WeakMap();
+/** Refresh margin: stop using a minted token this long before it expires. */
+const MINTED_TOKEN_REFRESH_MARGIN_MS = 30_000;
+async function mintedAnonToken(client, projectId) {
+    let perProject = mintedTokenMemo.get(client);
+    if (!perProject) {
+        perProject = new Map();
+        mintedTokenMemo.set(client, perProject);
+    }
+    const memo = perProject.get(projectId);
+    if (memo) {
+        if ("failed" in memo)
+            return null;
+        if (Date.now() < memo.expiresAtMs - MINTED_TOKEN_REFRESH_MARGIN_MS)
+            return memo.token;
+    }
+    try {
+        const issued = await client.request(`/projects/v1/${encodeURIComponent(projectId)}/tokens`, {
+            method: "POST",
+            // Least authority: the apikey-gated deploy legs need exactly what the
+            // anon key carries, never the service key's power.
+            body: { kind: "anon" },
+            context: "minting a short-lived anon token for deploy (local project keys not cached)",
+        });
+        if (!issued?.secret) {
+            perProject.set(projectId, { failed: true });
+            return null;
+        }
+        const ttlMs = (typeof issued.expires_in === "number" && issued.expires_in > 0 ? issued.expires_in : 300) * 1000;
+        perProject.set(projectId, { token: issued.secret, expiresAtMs: Date.now() + ttlMs });
+        return issued.secret;
+    }
+    catch {
+        // No signer, no authority, or the route is unavailable: fall through to
+        // the pre-existing no-apikey behavior. Marked so one deploy's many
+        // apikey-gated legs don't each re-attempt a doomed mint.
+        perProject.set(projectId, { failed: true });
+        return null;
+    }
 }
 function isCiClient(client) {
     return isCiSessionCredentials(client.credentials);