Agent permissions

cli/golem-cli/command-output-schema/command-output.schema.json

@@ -1093,6 +1093,35 @@
             }
           },
           "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "required": [
+            "type",
+            "environmentId",
+            "agentId",
+            "invocationKey",
+            "oplogIndex"
+          ],
+          "properties": {
+            "type": {
+              "const": "RuntimeDerived"
+            },
+            "environmentId": {
+              "type": "string"
+            },
+            "agentId": {
+              "$ref": "#/definitions/AgentId"
+            },
+            "invocationKey": {
+              "type": "string"
+            },
+            "oplogIndex": {
+              "type": "integer",
+              "minimum": 0
+            }
+          },
+          "additionalProperties": false
         }
       ]
     },
@@ -3367,6 +3396,34 @@
       "type": "string",
       "format": "uuid"
     },
+    "WalletVersionToken": {
+      "type": "object",
+      "required": ["walletIdHash", "generation"],
+      "properties": {
+        "walletIdHash": {
+          "type": "array",
+          "minItems": 32,
+          "maxItems": 32,
+          "items": { "type": "integer", "minimum": 0, "maximum": 255 }
+        },
+        "generation": { "type": "integer", "minimum": 0 }
+      },
+      "additionalProperties": false
+    },
+    "PublicInvocationWalletPin": {
+      "type": "object",
+      "required": ["walletToken", "scopeCardId"],
+      "properties": {
+        "walletToken": { "$ref": "#/definitions/WalletVersionToken" },
+        "scopeCardId": {
+          "oneOf": [
+            { "$ref": "#/definitions/CardId" },
+            { "type": "null" }
+          ]
+        }
+      },
+      "additionalProperties": false
+    },
     "PolymorphicCardPermissionPattern": {
       "type": "string",
       "description": "Rendered form of a card permission entry"
@@ -3709,7 +3766,17 @@
         { "$ref": "#/definitions/PublicOplogEntrySnapshot" },
         { "$ref": "#/definitions/PublicOplogEntryOplogProcessorCheckpoint" },
         { "$ref": "#/definitions/PublicOplogEntrySetRetryPolicy" },
-        { "$ref": "#/definitions/PublicOplogEntryRemoveRetryPolicy" }
+        { "$ref": "#/definitions/PublicOplogEntryRemoveRetryPolicy" },
+        { "$ref": "#/definitions/PublicOplogEntryCardEventQueued" },
+        { "$ref": "#/definitions/PublicOplogEntryCardInstalled" },
+        { "$ref": "#/definitions/PublicOplogEntryCardInstallFailed" },
+        { "$ref": "#/definitions/PublicOplogEntryCardRevoked" },
+        { "$ref": "#/definitions/PublicOplogEntryCardExpired" },
+        { "$ref": "#/definitions/PublicOplogEntryCardDerived" },
+        { "$ref": "#/definitions/PublicOplogEntryCardTransferStarted" },
+        { "$ref": "#/definitions/PublicOplogEntryCardTransferred" },
+        { "$ref": "#/definitions/PublicOplogEntryCardRevokedCascade" },
+        { "$ref": "#/definitions/PublicOplogEntryCardTransferConfirmed" }
       ]
     },
     "AgentId": {
@@ -3802,11 +3869,17 @@
     },
     "PublicOplogEntryAgentInvocationStarted": {
       "type": "object",
-      "required": ["type", "timestamp", "invocation"],
+      "required": ["type", "timestamp", "invocation", "walletPin"],
       "properties": {
         "type": { "const": "AgentInvocationStarted" },
         "timestamp": { "type": "string" },
-        "invocation": { "$ref": "#/definitions/PublicAgentInvocation" }
+        "invocation": { "$ref": "#/definitions/PublicAgentInvocation" },
+        "walletPin": {
+          "oneOf": [
+            { "$ref": "#/definitions/PublicInvocationWalletPin" },
+            { "type": "null" }
+          ]
+        }
       },
       "additionalProperties": false
     },
@@ -4019,6 +4092,129 @@
       "properties": { "type": { "const": "RemoveRetryPolicy" }, "timestamp": { "type": "string" }, "name": { "type": "string" } },
       "additionalProperties": false
     },
+    "CardHolder": {
+      "oneOf": [
+        {
+          "type": "object",
+          "required": ["type", "accountId"],
+          "properties": { "type": { "const": "Account" }, "accountId": { "type": "string", "format": "uuid" } },
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "required": ["type", "applicationId"],
+          "properties": { "type": { "const": "Application" }, "applicationId": { "type": "string", "format": "uuid" } },
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "required": ["type", "agentId"],
+          "properties": { "type": { "const": "Agent" }, "agentId": { "$ref": "#/definitions/AgentId" } },
+          "additionalProperties": false
+        }
+      ]
+    },
+    "PublicQueuedCardEvent": {
+      "oneOf": [
+        {
+          "type": "object",
+          "required": ["type", "cardId"],
+          "properties": { "type": { "const": "Install" }, "cardId": { "$ref": "#/definitions/CardId" } },
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "required": ["type", "cardId"],
+          "properties": { "type": { "const": "Revoke" }, "cardId": { "$ref": "#/definitions/CardId" } },
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "required": ["type", "transferId", "cardId", "targetHolder"],
+          "properties": {
+            "type": { "const": "TransferStarted" },
+            "transferId": { "type": "string", "format": "uuid" },
+            "cardId": { "$ref": "#/definitions/CardId" },
+            "targetHolder": { "$ref": "#/definitions/CardHolder" }
+          },
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "required": ["type", "transferId", "cardId"],
+          "properties": {
+            "type": { "const": "TransferReceived" },
+            "transferId": { "type": "string", "format": "uuid" },
+            "cardId": { "$ref": "#/definitions/CardId" }
+          },
+          "additionalProperties": false
+        }
+      ]
+    },
+    "CardInstallFailure": {
+      "type": "string",
+      "enum": ["cardRevoked", "notFound", "recipientMismatch", "notPermitted"]
+    },
+    "PublicOplogEntryCardEventQueued": {
+      "type": "object",
+      "required": ["type", "timestamp", "event"],
+      "properties": { "type": { "const": "CardEventQueued" }, "timestamp": { "type": "string" }, "event": { "$ref": "#/definitions/PublicQueuedCardEvent" } },
+      "additionalProperties": false
+    },
+    "PublicOplogEntryCardInstalled": {
+      "type": "object",
+      "required": ["type", "timestamp", "queuedEventIndex", "cardId", "walletGeneration"],
+      "properties": { "type": { "const": "CardInstalled" }, "timestamp": { "type": "string" }, "queuedEventIndex": { "type": ["integer", "null"], "minimum": 0 }, "cardId": { "$ref": "#/definitions/CardId" }, "walletGeneration": { "type": ["integer", "null"], "minimum": 0 } },
+      "additionalProperties": false
+    },
+    "PublicOplogEntryCardInstallFailed": {
+      "type": "object",
+      "required": ["type", "timestamp", "queuedEventIndex", "cardId", "reason"],
+      "properties": { "type": { "const": "CardInstallFailed" }, "timestamp": { "type": "string" }, "queuedEventIndex": { "type": "integer", "minimum": 0 }, "cardId": { "$ref": "#/definitions/CardId" }, "reason": { "$ref": "#/definitions/CardInstallFailure" } },
+      "additionalProperties": false
+    },
+    "PublicOplogEntryCardRevoked": {
+      "type": "object",
+      "required": ["type", "timestamp", "queuedEventIndex", "cardId", "walletGeneration"],
+      "properties": { "type": { "const": "CardRevoked" }, "timestamp": { "type": "string" }, "queuedEventIndex": { "type": "integer", "minimum": 0 }, "cardId": { "$ref": "#/definitions/CardId" }, "walletGeneration": { "type": ["integer", "null"], "minimum": 0 } },
+      "additionalProperties": false
+    },
+    "PublicOplogEntryCardExpired": {
+      "type": "object",
+      "required": ["type", "timestamp", "cardId", "walletGeneration"],
+      "properties": { "type": { "const": "CardExpired" }, "timestamp": { "type": "string" }, "cardId": { "$ref": "#/definitions/CardId" }, "walletGeneration": { "type": ["integer", "null"], "minimum": 0 } },
+      "additionalProperties": false
+    },
+    "PublicOplogEntryCardDerived": {
+      "type": "object",
+      "required": ["type", "timestamp", "cardId", "parentIds", "walletGeneration"],
+      "properties": { "type": { "const": "CardDerived" }, "timestamp": { "type": "string" }, "cardId": { "$ref": "#/definitions/CardId" }, "parentIds": { "type": "array", "items": { "$ref": "#/definitions/CardId" } }, "walletGeneration": { "type": ["integer", "null"], "minimum": 0 } },
+      "additionalProperties": false
+    },
+    "PublicOplogEntryCardTransferStarted": {
+      "type": "object",
+      "required": ["type", "timestamp", "transferId", "cardId", "targetHolder", "sourceWalletGeneration"],
+      "properties": { "type": { "const": "CardTransferStarted" }, "timestamp": { "type": "string" }, "transferId": { "type": "string", "format": "uuid" }, "cardId": { "$ref": "#/definitions/CardId" }, "targetHolder": { "$ref": "#/definitions/CardHolder" }, "sourceWalletGeneration": { "type": ["integer", "null"], "minimum": 0 } },
+      "additionalProperties": false
+    },
+    "PublicOplogEntryCardTransferred": {
+      "type": "object",
+      "required": ["type", "timestamp", "transferId", "sourceCardId", "installedCardId", "targetHolder", "targetWalletGeneration"],
+      "properties": { "type": { "const": "CardTransferred" }, "timestamp": { "type": "string" }, "transferId": { "type": "string", "format": "uuid" }, "sourceCardId": { "oneOf": [{ "$ref": "#/definitions/CardId" }, { "type": "null" }] }, "installedCardId": { "$ref": "#/definitions/CardId" }, "targetHolder": { "$ref": "#/definitions/CardHolder" }, "targetWalletGeneration": { "type": ["integer", "null"], "minimum": 0 } },
+      "additionalProperties": false
+    },
+    "PublicOplogEntryCardRevokedCascade": {
+      "type": "object",
+      "required": ["type", "timestamp", "revokedCardIds", "localWalletGeneration"],
+      "properties": { "type": { "const": "CardRevokedCascade" }, "timestamp": { "type": "string" }, "revokedCardIds": { "type": "array", "items": { "$ref": "#/definitions/CardId" } }, "localWalletGeneration": { "type": ["integer", "null"], "minimum": 0 } },
+      "additionalProperties": false
+    },
+    "PublicOplogEntryCardTransferConfirmed": {
+      "type": "object",
+      "required": ["type", "timestamp", "transferId", "sourceCardId", "installedCardId", "targetHolder"],
+      "properties": { "type": { "const": "CardTransferConfirmed" }, "timestamp": { "type": "string" }, "transferId": { "type": "string", "format": "uuid" }, "sourceCardId": { "$ref": "#/definitions/CardId" }, "installedCardId": { "$ref": "#/definitions/CardId" }, "targetHolder": { "$ref": "#/definitions/CardHolder" } },
+      "additionalProperties": false
+    },
     "PublicDurableFunctionType": {
       "oneOf": [
         { "type": "object", "required": ["type"], "properties": { "type": { "const": "ReadLocal" } }, "additionalProperties": false },
@@ -5954,6 +6150,20 @@
           },
           "additionalProperties": false
         },
+        {
+          "type": "object",
+          "required": ["kind", "value"],
+          "properties": {
+            "kind": { "const": "permission-card" },
+            "value": {
+              "type": "object",
+              "required": ["spec"],
+              "properties": { "spec": { "$ref": "#/definitions/PermissionCardSpec" }, "metadata": { "$ref": "#/definitions/MetadataEnvelope" } },
+              "additionalProperties": false
+            }
+          },
+          "additionalProperties": false
+        },
         {
           "type": "object",
           "required": ["kind", "value"],
@@ -6147,6 +6357,12 @@
       "properties": { "resourceName": { "type": "string" } },
       "additionalProperties": false
     },
+    "PermissionCardSpec": {
+      "type": "object",
+      "required": ["polymorphic"],
+      "properties": { "polymorphic": { "type": "boolean" } },
+      "additionalProperties": false
+    },
     "MetadataEnvelope": {
       "type": "object",
       "properties": {
@@ -6326,6 +6542,12 @@
           "required": ["kind", "value"],
           "properties": { "kind": { "const": "quota-token" }, "value": { "$ref": "#/definitions/QuotaTokenValuePayload" } },
           "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "required": ["kind", "value"],
+          "properties": { "kind": { "const": "permission-card" }, "value": { "$ref": "#/definitions/PermissionCardValuePayload" } },
+          "additionalProperties": false
         }
       ]
     },
@@ -6411,6 +6633,17 @@
       },
       "additionalProperties": false
     },
+    "PermissionCardValuePayload": {
+      "type": "object",
+      "required": ["cardId", "polymorphic"],
+      "properties": {
+        "cardId": { "type": "string", "format": "uuid" },
+        "parentIds": { "type": "array", "items": { "type": "string", "format": "uuid" } },
+        "expiresAt": { "type": "string" },
+        "polymorphic": { "type": "boolean" }
+      },
+      "additionalProperties": false
+    },
     "EnvironmentId": {
       "type": "object",
       "required": ["uuid"],

cli/golem-cli/src/agent_id_display/parse_common.rs

@@ -17,8 +17,8 @@ use chrono::DateTime;
 use golem_common::schema::agent::NamedField;
 use golem_common::schema::canonical::{
     binary as canon_binary, datetime as canon_datetime, duration as canon_duration,
-    path as canon_path, quantity as canon_quantity, quota_token as canon_quota_token,
-    secret as canon_secret, text as canon_text, url as canon_url,
+    path as canon_path, permission_card as canon_permission_card, quantity as canon_quantity,
+    quota_token as canon_quota_token, secret as canon_secret, text as canon_text, url as canon_url,
 };
 use golem_common::schema::graph::SchemaGraph;
 use golem_common::schema::schema_type::{
@@ -281,6 +281,16 @@ fn parse_cm_value_inner<D: Dialect>(
                 .map_err(|e| perr(lexer.position(), &format!("invalid quota-token value: {e}")))?;
             Ok(SchemaValue::QuotaToken(payload))
         }
+        SchemaType::PermissionCard { .. } => {
+            let s = parse_rich_constructor(lexer, "PermissionCard")?;
+            let payload = canon_permission_card::from_text(&s).map_err(|e| {
+                perr(
+                    lexer.position(),
+                    &format!("invalid permission-card value: {e}"),
+                )
+            })?;
+            Ok(SchemaValue::PermissionCard(payload))
+        }
         SchemaType::Union { spec, .. } => parse_union::<D>(lexer, graph, spec),
         SchemaType::FixedList {
             element, length, ..

cli/golem-cli/src/agent_id_display/render_moonbit.rs

@@ -352,6 +352,7 @@ fn render_type_moonbit_inner(
         SchemaType::Quantity { .. } => "quantity".to_string(),
         SchemaType::Secret { .. } => "secret".to_string(),
         SchemaType::QuotaToken { .. } => "quota-token".to_string(),
+        SchemaType::PermissionCard { .. } => "permission-card".to_string(),
         SchemaType::Union { spec, .. } => {
             let inner = spec
                 .branches

cli/golem-cli/src/agent_id_display/render_rust.rs

@@ -367,6 +367,7 @@ fn render_type_rust_inner(
         SchemaType::Quantity { .. } => "quantity".to_string(),
         SchemaType::Secret { .. } => "secret".to_string(),
         SchemaType::QuotaToken { .. } => "quota-token".to_string(),
+        SchemaType::PermissionCard { .. } => "permission-card".to_string(),
         SchemaType::Union { spec, .. } => {
             let inner = spec
                 .branches

cli/golem-cli/src/agent_id_display/render_scala.rs

@@ -372,6 +372,7 @@ fn render_type_scala_inner(
         SchemaType::Quantity { .. } => "quantity".to_string(),
         SchemaType::Secret { .. } => "secret".to_string(),
         SchemaType::QuotaToken { .. } => "quota-token".to_string(),
+        SchemaType::PermissionCard { .. } => "permission-card".to_string(),
         SchemaType::Union { spec, .. } => {
             let inner = spec
                 .branches

cli/golem-cli/src/agent_id_display/render_ts.rs

@@ -358,6 +358,7 @@ fn render_type_ts_inner(
         SchemaType::Quantity { .. } => "quantity".to_string(),
         SchemaType::Secret { .. } => "secret".to_string(),
         SchemaType::QuotaToken { .. } => "quota-token".to_string(),
+        SchemaType::PermissionCard { .. } => "permission-card".to_string(),
         SchemaType::Union { spec, .. } => {
             let inner = spec
                 .branches

cli/golem-cli/src/bridge_gen/moonbit/mod.rs

@@ -2398,6 +2398,7 @@ fn guest_decode_unstructured_binary(value : @model.SchemaValue, allowed : Array[
             SchemaType::Quantity { .. }
             | SchemaType::Secret { .. }
             | SchemaType::QuotaToken { .. }
+            | SchemaType::PermissionCard { .. }
             | SchemaType::Future { .. }
             | SchemaType::Stream { .. } => {
                 bail!(
@@ -2549,6 +2550,7 @@ fn guest_decode_unstructured_binary(value : @model.SchemaValue, allowed : Array[
             SchemaType::Quantity { .. }
             | SchemaType::Secret { .. }
             | SchemaType::QuotaToken { .. }
+            | SchemaType::PermissionCard { .. }
             | SchemaType::Future { .. }
             | SchemaType::Stream { .. } => {
                 bail!(
@@ -2719,6 +2721,7 @@ fn guest_decode_unstructured_binary(value : @model.SchemaValue, allowed : Array[
             SchemaType::Quantity { .. }
             | SchemaType::Secret { .. }
             | SchemaType::QuotaToken { .. }
+            | SchemaType::PermissionCard { .. }
             | SchemaType::Future { .. }
             | SchemaType::Stream { .. } => bail!(
                 "Cannot emit MoonBit type reference for unsupported schema variant: {resolved:?}"
@@ -3067,6 +3070,10 @@ fn emit_schema_type(ty: &SchemaType) -> String {
             "@model.QuotaToken(@types.QuotaTokenSpec::{{ resource_name: {} }})",
             mb_opt_str(spec.resource_name.as_deref())
         ),
+        PermissionCard { spec, .. } => format!(
+            "@model.PermissionCard(@types.PermissionCardSpec::{{ polymorphic: {} }})",
+            spec.polymorphic
+        ),
         Future { inner, .. } => format!("@model.Future({})", mb_opt_type(inner.as_deref())),
         Stream { inner, .. } => format!("@model.Stream({})", mb_opt_type(inner.as_deref())),
     };