@hivemagnus/ardent-studio 0.2.1 → 0.4.0

package/README.md

@@ -80,6 +80,7 @@ when a required setting is missing or unsafe.
 | `OATHWEAVE_ISSUER` | yes | | Oathweave browser issuer (HTTPS). |
 | `OATHWEAVE_JWKS_URL` | yes | | Oathweave JWKS (HTTPS). |
 | `OATHWEAVE_USERINFO_URL` | yes | | Oathweave userinfo (HTTPS), for session revocation. |
+| `OATHWEAVE_NATIVE_ISSUERS` | no | | Comma-separated Oathweave native issuer ids (its `JWT_ISSUER`). Service tokens they sign are accepted on the audit export only. |
 | `ARDENT_STUDIO_OATHWEAVE_IDENTITIES_JSON` | yes | | Explicit account links; see [docs/OATHWEAVE.md](docs/OATHWEAVE.md). |
 | `ARDENT_STUDIO_OATHWEAVE_TOKEN_URL` | yes | | Oathweave token endpoint for `client_credentials`. |
 | `ARDENT_STUDIO_MAGNUS_URL` | yes | | Magnus control API origin. |
@@ -104,6 +105,12 @@ permission, except the health routes. Every mutation takes `x-idempotency-key`.
 [`src/shared/browser.ts`](src/shared/browser.ts) (also exported as
 `@hivemagnus/ardent-studio/browser`).
 
+`GET /api/ardentstudio/v1/audit/export` serves the audit log as suite `HiveAuditRecord` v1
+records for a collector such as Cindertrace. It needs the permission `ardentstudio:audit:read`,
+which an Oathweave service (client_credentials) token for the audience `ardentstudio` may carry,
+or a linked Studio admin (`ardentstudio:agents:admin`). See
+[docs/OATHWEAVE.md](docs/OATHWEAVE.md#audit-export).
+
 ## Container image
 
 ```bash

package/dist/audit/export.d.ts

@@ -0,0 +1,22 @@
+import type { AuditEntry, AuditRepository } from '../db/repos/audit.js';
+import { type HiveAuditRecord } from '../shared/browser.js';
+export declare const AUDIT_EXPORT_DEFAULT_LIMIT = 100;
+export declare const AUDIT_EXPORT_MAX_LIMIT = 200;
+export declare const AUDIT_DETAILS_MAX_BYTES = 4096;
+type Scalar = string | number | boolean | null;
+export interface AuditExportPage {
+    data: HiveAuditRecord[];
+    nextCursor: string | null;
+}
+/** The numeric id after a cursor; 0 for the first page. Throws a 400 HiveError for a malformed cursor. */
+export declare function cursorPosition(after: string | undefined): number;
+/** Flat scalars only: arrays of scalars are joined, other arrays become a count, objects are dropped. */
+export declare function flattenDetails(detail: Record<string, unknown>): Record<string, Scalar>;
+export declare function toAuditRecord(entry: AuditEntry, taskRefs?: Map<string, string>): HiveAuditRecord;
+/**
+ * One export page for `?after=&limit=`. Throws a 400 HiveError for a malformed query.
+ * `nextCursor` is the last record's cursor whenever the page has records, even when it is the
+ * last page, so a collector can store it and poll again; it is null only for an empty page.
+ */
+export declare function exportAuditPage(audit: AuditRepository, query: URLSearchParams | Readonly<Record<string, string | undefined>>): AuditExportPage;
+export {};

package/dist/audit/export.js

@@ -0,0 +1,115 @@
+// The suite audit export: Studio's append-only audit table as HiveAuditRecord v1, oldest first,
+// keyset-paged on the table's monotonic id. Details are flattened to scalars, redacted with the
+// suite's log redaction and capped at 4 KB; they never hold secrets or file contents.
+import { decodeCursor, encodeCursor, parseFeedQuery } from '@hivemagnus/hive-common/events';
+import { HiveError } from '@hivemagnus/hive-common/errors';
+import { redact } from '@hivemagnus/hive-common/log';
+import { agentRefSchema } from '../shared/browser.js';
+export const AUDIT_EXPORT_DEFAULT_LIMIT = 100;
+export const AUDIT_EXPORT_MAX_LIMIT = 200;
+export const AUDIT_DETAILS_MAX_BYTES = 4096;
+const MAX_STRING = 512;
+/** Detail keys that could carry content rather than metadata. None are recorded today; this keeps it so. */
+const CONTENT_KEYS = new Set(['body', 'body_md', 'content', 'text', 'prompt', 'brief', 'soul', 'identity', 'instructions', 'answer', 'message']);
+/** The numeric id after a cursor; 0 for the first page. Throws a 400 HiveError for a malformed cursor. */
+export function cursorPosition(after) {
+    if (after === undefined || after === '')
+        return 0;
+    const position = decodeCursor(after);
+    const id = position.id;
+    if (Object.keys(position).length !== 1 || typeof id !== 'number' || !Number.isSafeInteger(id) || id < 0) {
+        throw new HiveError('invalid_cursor', 'The cursor is not valid', { status: 400 });
+    }
+    return id;
+}
+function scalar(value) {
+    if (value === null || typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number')
+        return Number.isFinite(value) ? value : undefined;
+    if (typeof value === 'string')
+        return value.length > MAX_STRING ? `${value.slice(0, MAX_STRING)}…` : value;
+    return undefined;
+}
+/** Flat scalars only: arrays of scalars are joined, other arrays become a count, objects are dropped. */
+export function flattenDetails(detail) {
+    const redacted = redact(detail);
+    const flat = {};
+    for (const [key, value] of Object.entries(redacted)) {
+        if (CONTENT_KEYS.has(key.toLowerCase()))
+            continue;
+        const direct = scalar(value);
+        if (direct !== undefined) {
+            flat[key] = direct;
+            continue;
+        }
+        if (Array.isArray(value)) {
+            const items = value.map(item => scalar(item));
+            if (items.every(item => item !== undefined && item !== null && typeof item !== 'boolean')) {
+                const joined = scalar(items.join(','));
+                if (joined !== undefined)
+                    flat[key] = joined;
+            }
+            else
+                flat[`${key}_count`] = value.length;
+        }
+    }
+    // Keep the record bounded: drop the longest values until the details fit.
+    while (Buffer.byteLength(JSON.stringify(flat)) > AUDIT_DETAILS_MAX_BYTES) {
+        const longest = Object.entries(flat).sort(([, a], [, b]) => JSON.stringify(b).length - JSON.stringify(a).length)[0];
+        if (!longest)
+            break;
+        delete flat[longest[0]];
+        flat.truncated = true;
+    }
+    return flat;
+}
+function actorOf(entry) {
+    const userId = entry.actor_user_id;
+    if (userId === 'system')
+        return { type: 'system', id: 'system' };
+    if (userId.startsWith('service:')) {
+        return { type: 'service', id: entry.actor_subject ?? userId.slice('service:'.length), ...(entry.actor_issuer ? { issuer: entry.actor_issuer } : {}) };
+    }
+    return {
+        type: 'user',
+        id: entry.actor_subject ?? userId,
+        ...(entry.actor_issuer ? { issuer: entry.actor_issuer } : {}),
+        displayName: userId,
+    };
+}
+/** The agent a record is about: an agent target, a task that ran on an agent, or a detail agent_ref. */
+function agentRefOf(entry, taskRefs) {
+    const candidates = [
+        entry.target_type === 'agent' ? entry.target_id : undefined,
+        entry.target_type === 'task' ? taskRefs.get(entry.target_id) : undefined,
+        typeof entry.detail.agent_ref === 'string' ? entry.detail.agent_ref : undefined,
+    ];
+    return candidates.find(candidate => candidate !== undefined && agentRefSchema.safeParse(candidate).success);
+}
+export function toAuditRecord(entry, taskRefs = new Map()) {
+    const agentRef = agentRefOf(entry, taskRefs);
+    return {
+        id: `ardentstudio:audit:${entry.id}`,
+        product: 'ardentstudio',
+        occurredAt: new Date(entry.at).toISOString(),
+        action: entry.action.toLowerCase(),
+        outcome: 'success',
+        actor: actorOf(entry),
+        ...(entry.target_type || entry.target_id ? { target: { ...(entry.target_type ? { type: entry.target_type } : {}), ...(entry.target_id ? { id: entry.target_id } : {}) } } : {}),
+        ...(agentRef ? { subject: { agentRef, nodeId: agentRef.slice(0, agentRef.indexOf('~')) } } : {}),
+        details: flattenDetails(entry.detail),
+    };
+}
+/**
+ * One export page for `?after=&limit=`. Throws a 400 HiveError for a malformed query.
+ * `nextCursor` is the last record's cursor whenever the page has records, even when it is the
+ * last page, so a collector can store it and poll again; it is null only for an empty page.
+ */
+export function exportAuditPage(audit, query) {
+    const { after, limit } = parseFeedQuery(query, { defaultLimit: AUDIT_EXPORT_DEFAULT_LIMIT, maxLimit: AUDIT_EXPORT_MAX_LIMIT });
+    const entries = audit.listAfter(cursorPosition(after), limit);
+    const taskRefs = audit.taskAgentRefs(entries.filter(entry => entry.target_type === 'task').map(entry => entry.target_id));
+    const last = entries.at(-1);
+    return { data: entries.map(entry => toAuditRecord(entry, taskRefs)), nextCursor: last ? encodeCursor({ id: last.id }) : null };
+}

package/dist/auth/authenticator.d.ts

@@ -0,0 +1,72 @@
+import type { JWTVerifyGetKey } from 'jose';
+import { type ArdentStudioPermission } from '../shared/browser.js';
+import { type IdentityLink } from './links.js';
+export interface OathweaveOptions {
+    issuer: string;
+    jwksUrl: string;
+    userinfoUrl: string;
+    audience?: string;
+    /**
+     * Oathweave native issuer identifiers (its JWT issuer name, for example `hive-iam`). Accepted
+     * for service tokens only, so only on routes that accept services (the audit export).
+     */
+    nativeIssuers?: readonly string[];
+}
+export interface OathweaveIdentity {
+    kind: 'user' | 'service';
+    subject: string;
+    issuer: string;
+    sessionId: string;
+    permissions: string[];
+    displayName: string;
+    issuedAt: number;
+    expiresAt: number;
+}
+export interface VerifyOptions {
+    /** `any` also accepts service (client-credentials) tokens. The default is people only. */
+    accept?: 'user' | 'any';
+}
+export type OathweaveVerifier = (token: string, options?: VerifyOptions) => Promise<OathweaveIdentity>;
+/** The only permissions a service token can carry into Studio. */
+export declare const SERVICE_PERMISSIONS: readonly ArdentStudioPermission[];
+/** A verified, linked caller, or a verified service on a route that accepts services. */
+export interface Principal {
+    /** Absent means a person, as before services were accepted anywhere. */
+    kind?: 'user' | 'service';
+    /** The linked Studio user, or `service:<client id>` for a service. */
+    userId: string;
+    subject: string;
+    issuer: string;
+    displayName: string;
+    permissions: ArdentStudioPermission[];
+    /** Token expiry in epoch seconds. Streams close at this time. */
+    expiresAt: number;
+}
+/** The token is valid but its subject has no explicit link, so the person has no Studio access. */
+export declare class AccessDenied extends Error {
+    name: string;
+}
+/** How long a userinfo answer is reused, measured from when the request started. */
+export declare const SESSION_CACHE_TTL_MS = 10000;
+/** How often an open stream re-checks its token. */
+export declare const STREAM_RECHECK_MS = 5000;
+/**
+ * Studio has always checked token times exactly; the shared verifier would allow 30 s of skew.
+ * Kept at zero so this change does not widen what Studio accepts.
+ */
+export declare const CLOCK_TOLERANCE_SEC = 0;
+/**
+ * Build Studio's verifier on the shared one. Every refusal is an OathweaveError with a stable
+ * `reason`; the router maps all of them (including an unreachable JWKS or userinfo) to 401.
+ */
+export declare function createOathweaveVerifier(options: OathweaveOptions, overrides?: {
+    keys?: JWTVerifyGetKey;
+    fetch?: typeof fetch;
+    now?: () => number;
+}): OathweaveVerifier;
+export type Authenticator = (token: string, options?: VerifyOptions) => Promise<Principal>;
+/**
+ * Verify a bearer token and map a person through their one explicit identity link. A service
+ * (only with `accept: 'any'`) needs no link and keeps only SERVICE_PERMISSIONS.
+ */
+export declare function createAuthenticator(verify: OathweaveVerifier, links: readonly IdentityLink[]): Authenticator;

package/dist/auth/authenticator.js

@@ -0,0 +1,88 @@
+// Oathweave resource-token verification for ArdentStudio, using the suite's shared verifier
+// (@hivemagnus/hive-common/oathweave): RS256 only, exact issuer and audience, at most fifteen
+// minutes, USER actor with a session, and an online session check through userinfo.
+// Failure is closed. Studio accepts people only; service tokens are refused everywhere except on
+// routes that opt in (the audit export), where a service gets only SERVICE_PERMISSIONS.
+import { createOathweaveVerifier as createSharedVerifier, OATHWEAVE_SESSION_CACHE_TTL_MS, OATHWEAVE_STREAM_RECHECK_MS, } from '@hivemagnus/hive-common/oathweave';
+import { ARDENT_STUDIO_AUDIENCE } from '../shared/browser.js';
+import { effectivePermissions, linkFor } from './links.js';
+/** The only permissions a service token can carry into Studio. */
+export const SERVICE_PERMISSIONS = ['ardentstudio:audit:read'];
+/** The token is valid but its subject has no explicit link, so the person has no Studio access. */
+export class AccessDenied extends Error {
+    name = 'AccessDenied';
+}
+/** How long a userinfo answer is reused, measured from when the request started. */
+export const SESSION_CACHE_TTL_MS = OATHWEAVE_SESSION_CACHE_TTL_MS;
+/** How often an open stream re-checks its token. */
+export const STREAM_RECHECK_MS = OATHWEAVE_STREAM_RECHECK_MS;
+/**
+ * Studio has always checked token times exactly; the shared verifier would allow 30 s of skew.
+ * Kept at zero so this change does not widen what Studio accepts.
+ */
+export const CLOCK_TOLERANCE_SEC = 0;
+/**
+ * Build Studio's verifier on the shared one. Every refusal is an OathweaveError with a stable
+ * `reason`; the router maps all of them (including an unreachable JWKS or userinfo) to 401.
+ */
+export function createOathweaveVerifier(options, overrides = {}) {
+    const verifier = createSharedVerifier({
+        issuer: options.issuer,
+        audience: options.audience ?? ARDENT_STUDIO_AUDIENCE,
+        jwksUrl: options.jwksUrl,
+        userinfoUrl: options.userinfoUrl,
+        ...(options.nativeIssuers?.length ? { nativeIssuers: options.nativeIssuers, nativeIssuerAccept: 'service' } : {}),
+        accept: 'user',
+        clockToleranceSec: CLOCK_TOLERANCE_SEC,
+        ...(overrides.keys ? { keys: overrides.keys } : {}),
+        ...(overrides.fetch ? { fetch: overrides.fetch } : {}),
+        ...(overrides.now ? { now: overrides.now } : {}),
+    });
+    return async (token, verifyOptions = {}) => {
+        const principal = verifyOptions.accept === 'any' ? await verifier.verify(token, { accept: 'any' }) : await verifier.verifyUser(token);
+        return {
+            kind: principal.kind,
+            subject: principal.subject,
+            issuer: principal.issuer,
+            sessionId: principal.kind === 'user' ? principal.sessionId : '',
+            permissions: [...principal.permissions],
+            displayName: principal.kind === 'user' ? principal.displayName : principal.subject,
+            issuedAt: principal.issuedAt,
+            expiresAt: principal.expiresAt,
+        };
+    };
+}
+/**
+ * Verify a bearer token and map a person through their one explicit identity link. A service
+ * (only with `accept: 'any'`) needs no link and keeps only SERVICE_PERMISSIONS.
+ */
+export function createAuthenticator(verify, links) {
+    return async (token, options = {}) => {
+        const identity = await verify(token, options);
+        if (identity.kind === 'service') {
+            if (options.accept !== 'any')
+                throw new Error('Service tokens are not accepted here');
+            return {
+                kind: 'service',
+                userId: `service:${identity.subject}`,
+                subject: identity.subject,
+                issuer: identity.issuer,
+                displayName: identity.subject,
+                permissions: SERVICE_PERMISSIONS.filter(permission => identity.permissions.includes(permission)),
+                expiresAt: identity.expiresAt,
+            };
+        }
+        const link = linkFor(links, identity.issuer, identity.subject);
+        if (!link)
+            throw new AccessDenied('An explicit unique account link is required');
+        return {
+            kind: 'user',
+            userId: link.localUserId,
+            subject: identity.subject,
+            issuer: identity.issuer,
+            displayName: link.displayName ?? identity.displayName,
+            permissions: effectivePermissions(link, identity.permissions),
+            expiresAt: identity.expiresAt,
+        };
+    };
+}

package/dist/auth/links.d.ts

@@ -15,6 +15,7 @@ declare const linkSchema: z.ZodObject<{
         "ardentstudio:templates:write": "ardentstudio:templates:write";
         "ardentstudio:review:write": "ardentstudio:review:write";
         "ardentstudio:agents:admin": "ardentstudio:agents:admin";
+        "ardentstudio:audit:read": "ardentstudio:audit:read";
     }>>>;
 }, z.core.$strict>;
 export type IdentityLink = z.infer<typeof linkSchema>;

package/dist/clients/hivemem.d.ts

@@ -53,11 +53,12 @@ export interface HiveMemClientOptions {
     tokens: Pick<ServiceTokenProvider, 'token' | 'invalidate'>;
     fetch?: typeof fetch;
     timeoutMs?: number;
+    /** Extra headers per request; defaults to the current request context (x-request-id, traceparent). */
+    headers?: () => Record<string, string>;
 }
 export declare class HiveMemClient {
-    private readonly options;
-    private readonly request;
-    private readonly baseUrl;
+    private readonly sdk;
+    private readonly probe;
     constructor(options: HiveMemClientOptions);
     /** Unauthenticated liveness of the HiveMem service. */
     health(): Promise<{
@@ -81,5 +82,4 @@ export declare class HiveMemClient {
         preview: KnowledgeSyncResponse;
         applied: KnowledgeSyncResponse;
     }>;
-    private call;
 }

package/dist/clients/hivemem.js

@@ -2,7 +2,10 @@
 // as a revision-aware source (POST /v1/knowledge/sources/sync). ArdentStudio calls it with its
 // own Oathweave service identity (audience `hivemem`), linked in HiveMem's
 // HIVEMEM_OATHWEAVE_SERVICES_JSON with the memories:write and workspaces:write scopes.
+// The HTTP layer is @hivemagnus/hivemem-sdk; this module keeps Studio's own interface on top of it.
 import { createHash } from 'node:crypto';
+import { outboundHeaders } from '@hivemagnus/hive-common/context';
+import { HiveMem, HiveMemHTTPError } from '@hivemagnus/hivemem-sdk';
 import { z } from 'zod';
 import { trimTrailingSlashes } from '../url.js';
 export class HiveMemError extends Error {
@@ -32,32 +35,72 @@ export const HIVEMEM_MAX_SYNC_BYTES = 4 * 1024 * 1024;
 export function chunkHash(content) {
     return createHash('sha256').update(content).digest('hex');
 }
+/** Studio's errors: the server's `detail` (or `error`), else the HTTP status. */
+function translate(error) {
+    if (!(error instanceof HiveMemHTTPError))
+        return error;
+    const details = error.details;
+    const message = typeof details?.detail === 'string' ? details.detail : typeof details?.error === 'string' ? details.error : `HiveMem answered HTTP ${error.statusCode}`;
+    return new HiveMemError(message.slice(0, 300), error.statusCode);
+}
+async function sdkCall(call) {
+    try {
+        return await call();
+    }
+    catch (error) {
+        throw translate(error);
+    }
+}
+/**
+ * The SDK reads an error body as JSON and then as text, which fails on a non-JSON body (a proxy
+ * page, for example). Hand it an empty JSON body instead so the error still carries its status.
+ */
+function jsonErrorBodies(request) {
+    return async (input, init) => {
+        const response = await request(input, init);
+        if (response.ok || response.headers.get('content-type')?.includes('json'))
+            return response;
+        await response.body?.cancel().catch(() => undefined);
+        return new Response('null', { status: response.status, statusText: response.statusText, headers: { 'content-type': 'application/json' } });
+    };
+}
 export class HiveMemClient {
-    options;
-    request;
-    baseUrl;
+    sdk;
+    probe;
     constructor(options) {
-        this.options = options;
-        this.request = options.fetch ?? ((input, init) => fetch(input, init));
-        this.baseUrl = trimTrailingSlashes(options.baseUrl);
+        const request = options.fetch ?? ((input, init) => fetch(input, init));
+        const fetchImpl = jsonErrorBodies(request);
+        const headers = options.headers ?? (() => outboundHeaders());
+        this.sdk = new HiveMem({
+            baseUrl: trimTrailingSlashes(options.baseUrl),
+            fetchImpl,
+            headers,
+            // Studio keeps its own retry schedule for knowledge sync; the SDK only retries once after a 401.
+            maxRetries: 0,
+            timeoutMs: options.timeoutMs ?? 30_000,
+            tokenProvider: async ({ forceRefresh }) => {
+                if (forceRefresh)
+                    options.tokens.invalidate();
+                return options.tokens.token();
+            },
+        });
+        // Health is unauthenticated: an empty token keeps the SDK from reading one from the environment.
+        this.probe = new HiveMem({ baseUrl: this.sdk.baseUrl, fetchImpl, headers, token: '', maxRetries: 0, timeoutMs: 5_000 });
     }
     /** Unauthenticated liveness of the HiveMem service. */
     async health() {
-        const response = await this.request(`${this.baseUrl}/v1/health`, { redirect: 'error', signal: AbortSignal.timeout(5_000) });
-        if (!response.ok)
-            throw new HiveMemError(`HiveMem health answered HTTP ${response.status}`, response.status);
-        return z.object({ status: z.string() }).loose().parse(await response.json());
+        return z.object({ status: z.string() }).loose().parse(await sdkCall(() => this.probe.health()));
     }
     /** Create the project workspace. HiveMem returns the existing workspace when it already exists. */
     async ensureWorkspace(input) {
-        return workspaceSchema.parse(await this.call('POST', '/v1/workspaces', {
-            workspace_id: input.workspace_id, title: input.title.slice(0, 200), description: input.description ?? null, metadata: input.metadata ?? {},
-        }));
+        return workspaceSchema.parse(await sdkCall(() => this.sdk.createWorkspace(input.workspace_id, {
+            title: input.title.slice(0, 200), description: input.description ?? null, metadata: input.metadata ?? {},
+        })));
     }
     async syncKnowledgeSource(body) {
         if (body.chunks.length > HIVEMEM_MAX_CHUNKS)
             throw new HiveMemError(`A source sync holds at most ${HIVEMEM_MAX_CHUNKS} chunks`, 400);
-        return knowledgeSyncResponseSchema.parse(await this.call('POST', '/v1/knowledge/sources/sync', body));
+        return knowledgeSyncResponseSchema.parse(await sdkCall(() => this.sdk.syncKnowledgeSource({ ...body })));
     }
     /** Validate, then write: a preview proves the request before anything changes. */
     async syncKnowledgeSourceChecked(body) {
@@ -65,25 +108,4 @@ export class HiveMemClient {
         const applied = await this.syncKnowledgeSource({ ...body, mode: 'apply' });
         return { preview, applied };
     }
-    async call(method, path, body) {
-        const attempt = async () => this.request(`${this.baseUrl}${path}`, {
-            method,
-            headers: { authorization: `Bearer ${await this.options.tokens.token()}`, accept: 'application/json', ...(body !== undefined ? { 'content-type': 'application/json' } : {}) },
-            ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
-            redirect: 'error',
-            signal: AbortSignal.timeout(this.options.timeoutMs ?? 30_000),
-        });
-        let response = await attempt();
-        if (response.status === 401) {
-            await response.body?.cancel();
-            this.options.tokens.invalidate();
-            response = await attempt();
-        }
-        if (!response.ok) {
-            const detail = await response.json().catch(() => null);
-            const message = typeof detail?.detail === 'string' ? detail.detail : typeof detail?.error === 'string' ? detail.error : `HiveMem answered HTTP ${response.status}`;
-            throw new HiveMemError(message.slice(0, 300), response.status);
-        }
-        return response.status === 204 ? null : response.json();
-    }
 }

package/dist/config.d.ts

@@ -22,6 +22,8 @@ export interface Config {
         userinfoUrl: string;
         tokenUrl: string;
         identities: IdentityLink[];
+        /** OATHWEAVE_NATIVE_ISSUERS: native issuer ids accepted for service tokens on the audit export. */
+        nativeIssuers: string[];
     };
     magnus: ServiceClientConfig;
     hivemem: ServiceClientConfig;

package/dist/config.js

@@ -1,5 +1,6 @@
 import { isAbsolute, resolve } from 'node:path';
 import { z } from 'zod';
+import { OATHWEAVE_NATIVE_ISSUER_PATTERN } from '@hivemagnus/hive-common/oathweave';
 import { parseIdentityLinks } from './auth/links.js';
 import { trimTrailingSlashes } from './url.js';
 export const DEFAULT_PORT = 8097;
@@ -24,6 +25,7 @@ export const ENV_CATALOG = [
     { name: 'OATHWEAVE_ISSUER', required: true, secret: false, description: 'Oathweave browser issuer (HTTPS).' },
     { name: 'OATHWEAVE_JWKS_URL', required: true, secret: false, description: 'Oathweave JWKS URL (HTTPS).' },
     { name: 'OATHWEAVE_USERINFO_URL', required: true, secret: false, description: 'Oathweave userinfo URL (HTTPS), used for online session revocation.' },
+    { name: 'OATHWEAVE_NATIVE_ISSUERS', required: false, secret: false, description: 'Optional comma-separated Oathweave native issuer ids (its JWT issuer name). Service tokens they sign are accepted on the audit export only; never for people.' },
     { name: 'ARDENT_STUDIO_OATHWEAVE_IDENTITIES_JSON', required: true, secret: false, description: 'JSON array of explicit account links: [{issuer, subject, localUserId, displayName?, permissions?}].' },
     { name: 'ARDENT_STUDIO_OATHWEAVE_TOKEN_URL', required: true, secret: false, description: 'Oathweave OAuth token endpoint for the client_credentials grant.' },
     { name: 'ARDENT_STUDIO_MAGNUS_URL', required: true, secret: false, description: 'Magnus control API base URL (the origin that serves /api/v1).' },
@@ -105,6 +107,10 @@ export function loadConfig(env = process.env) {
     const jwksUrl = url('OATHWEAVE_JWKS_URL', true);
     const userinfoUrl = url('OATHWEAVE_USERINFO_URL', true);
     const tokenUrl = url('ARDENT_STUDIO_OATHWEAVE_TOKEN_URL', false);
+    const nativeIssuers = (value('OATHWEAVE_NATIVE_ISSUERS') ?? '').split(',').map(item => item.trim()).filter(Boolean);
+    if (nativeIssuers.some(item => !OATHWEAVE_NATIVE_ISSUER_PATTERN.test(item))) {
+        issues.push({ name: 'OATHWEAVE_NATIVE_ISSUERS', message: 'must be comma-separated Oathweave native issuer ids ([a-z][a-z0-9-], at most 64 each)' });
+    }
     let identities = [];
     const identitiesRaw = required('ARDENT_STUDIO_OATHWEAVE_IDENTITIES_JSON');
     if (identitiesRaw) {
@@ -152,7 +158,7 @@ export function loadConfig(env = process.env) {
         maxBlobBytes: numeric('ARDENT_STUDIO_MAX_BLOB_BYTES', DEFAULT_MAX_BLOB_BYTES, 1024, 1024 * 1024 * 1024),
         eventRetentionDays: numeric('ARDENT_STUDIO_EVENT_RETENTION_DAYS', DEFAULT_EVENT_RETENTION_DAYS, 1, 3650),
         logLevel: logLevel,
-        oathweave: { issuer, jwksUrl, userinfoUrl, tokenUrl, identities },
+        oathweave: { issuer, jwksUrl, userinfoUrl, tokenUrl, identities, nativeIssuers },
         magnus,
         hivemem,
         chattermost,

package/dist/db/repos/audit.d.ts

@@ -34,4 +34,8 @@ export declare class AuditRepository {
         targetId?: string;
         limit?: number;
     }): AuditEntry[];
+    /** Oldest first, strictly after `afterId`. The id is the table's monotonic key, so pages never skip or repeat. */
+    listAfter(afterId: number, limit: number): AuditEntry[];
+    /** The Ardent agent each task ran on, for the tasks that have one. */
+    taskAgentRefs(taskIds: readonly string[]): Map<string, string>;
 }

package/dist/db/repos/audit.js

@@ -17,4 +17,20 @@ export class AuditRepository {
             : this.db.prepare('SELECT * FROM audit ORDER BY id DESC LIMIT ?').all(filter.limit ?? 100));
         return rows.map(({ detail_json, ...row }) => ({ ...row, detail: readJson(detail_json, {}) }));
     }
+    /** Oldest first, strictly after `afterId`. The id is the table's monotonic key, so pages never skip or repeat. */
+    listAfter(afterId, limit) {
+        const rows = this.db.prepare('SELECT * FROM audit WHERE id > ? ORDER BY id ASC LIMIT ?').all(afterId, limit);
+        return rows.map(({ detail_json, ...row }) => ({ ...row, detail: readJson(detail_json, {}) }));
+    }
+    /** The Ardent agent each task ran on, for the tasks that have one. */
+    taskAgentRefs(taskIds) {
+        const refs = new Map();
+        if (!taskIds.length)
+            return refs;
+        const rows = this.db.prepare(`SELECT id, ardent_agent_ref FROM tasks WHERE ardent_agent_ref IS NOT NULL AND id IN (${taskIds.map(() => '?').join(', ')})`)
+            .all(...taskIds);
+        for (const row of rows)
+            refs.set(row.id, row.ardent_agent_ref);
+        return refs;
+    }
 }

package/dist/db/repos/team.d.ts

@@ -43,6 +43,8 @@ export declare class TeamRepository {
         role_key: string;
         role_name: string;
     }>;
+    /** Ids of the projects where an agent is bound to a role in the published or the draft team. */
+    projectsForAgent(agentRef: string): Set<string>;
     ensureBinding(agentRef: string, displayName?: string | null): AgentBinding;
     binding(agentRef: string): AgentBinding | undefined;
     bindings(): AgentBinding[];

package/dist/db/repos/team.js

@@ -77,6 +77,13 @@ export class TeamRepository {
             .filter(role => role.agent_ref)
             .map(role => ({ agent_ref: role.agent_ref, project_id: row.project_id, project_name: row.project_name, role_key: role.key, role_name: role.name })));
     }
+    /** Ids of the projects where an agent is bound to a role in the published or the draft team. */
+    projectsForAgent(agentRef) {
+        const rows = this.db.prepare(`SELECT DISTINCT r.project_id FROM team_assignments a
+      JOIN team_assignment_revisions r ON r.project_id = a.project_id AND r.revision IN (a.current_revision, a.draft_revision)
+      WHERE EXISTS (SELECT 1 FROM json_each(r.body_json, '$.roles') role WHERE json_extract(role.value, '$.agent_ref') = ?)`).all(agentRef);
+        return new Set(rows.map(row => row.project_id));
+    }
     // ── Agent bindings: a stable Studio id per Magnus-managed agent ──
     ensureBinding(agentRef, displayName) {
         const now = this.clock.now().toISOString();

package/dist/index.d.ts

@@ -10,7 +10,7 @@ export { MagnusClient, MagnusError, parseAgentRef, agentRef, STUDIO_ACTIONS, REL
 export { HiveMemClient, HiveMemError } from './clients/hivemem.js';
 export { ChatterMostClient } from './clients/chattermost.js';
 export { ServiceTokenProvider } from './clients/service-token.js';
-export { createOathweaveVerifier, createAuthenticator, AccessDenied, type Principal } from './auth/oathweave.js';
+export { createOathweaveVerifier, createAuthenticator, AccessDenied, type Principal } from './auth/authenticator.js';
 export { parseIdentityLinks, type IdentityLink } from './auth/links.js';
 export { validateTeam, type ValidationInput, type ValidationResult } from './team/validation.js';
 export { TEAM_SEEDS, loadSeedTemplates } from './templates/seeds.js';

package/dist/index.js

@@ -9,7 +9,7 @@ export { MagnusClient, MagnusError, parseAgentRef, agentRef, STUDIO_ACTIONS, REL
 export { HiveMemClient, HiveMemError } from './clients/hivemem.js';
 export { ChatterMostClient } from './clients/chattermost.js';
 export { ServiceTokenProvider } from './clients/service-token.js';
-export { createOathweaveVerifier, createAuthenticator, AccessDenied } from './auth/oathweave.js';
+export { createOathweaveVerifier, createAuthenticator, AccessDenied } from './auth/authenticator.js';
 export { parseIdentityLinks } from './auth/links.js';
 export { validateTeam } from './team/validation.js';
 export { TEAM_SEEDS, loadSeedTemplates } from './templates/seeds.js';

package/dist/logger.d.ts

@@ -1,5 +1,5 @@
 export type LogLevel = 'debug' | 'info' | 'warn' | 'error';
 export type Logger = Record<LogLevel, (message: string, fields?: Record<string, unknown>) => void>;
-/** JSON lines on stderr. Callers never pass secrets, tokens or file contents. */
+/** JSON lines on stderr, with the request ID inside a request. Callers never pass secrets, tokens or file contents. */
 export declare function createLogger(level?: LogLevel, write?: (line: string) => void): Logger;
 export declare const silentLogger: Logger;

package/dist/logger.js

@@ -1,10 +1,12 @@
+import { getRequestContext } from '@hivemagnus/hive-common/context';
 const ORDER = { debug: 10, info: 20, warn: 30, error: 40 };
-/** JSON lines on stderr. Callers never pass secrets, tokens or file contents. */
+/** JSON lines on stderr, with the request ID inside a request. Callers never pass secrets, tokens or file contents. */
 export function createLogger(level = 'info', write = line => process.stderr.write(`${line}\n`)) {
     const log = (at) => (message, fields = {}) => {
         if (ORDER[at] < ORDER[level])
             return;
-        write(JSON.stringify({ at: new Date().toISOString(), level: at, message, ...fields }));
+        const requestId = getRequestContext()?.requestId;
+        write(JSON.stringify({ at: new Date().toISOString(), level: at, message, ...(requestId ? { requestId } : {}), ...fields }));
     };
     return { debug: log('debug'), info: log('info'), warn: log('warn'), error: log('error') };
 }