@hivemagnus/magnus-server 0.0.0-stage → 1.0.2

package/dist/schemas/shared-resource-lease.js

@@ -0,0 +1,132 @@
+import { createHash } from 'node:crypto';
+import { z } from 'zod';
+const identifier = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/);
+export const sharedResourceOperationIdSchema = identifier;
+const sha256 = z.string().regex(/^[a-f0-9]{64}$/);
+const unixSeconds = z.number().int().positive().max(253_402_300_799);
+const actionClass = z.enum([
+    'observe', 'analyze', 'create_artifact', 'create_draft', 'reversible_change',
+    'deploy', 'external_publish', 'destructive_response',
+]);
+const repoKey = /^repo:[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9][a-z0-9._-]*)*$/;
+const providerKey = /^provider:[a-z0-9][a-z0-9._-]*(?::[a-z0-9][a-z0-9._-]*)*$/;
+const gpuKey = /^gpu:[a-z0-9][a-z0-9._-]*$/;
+export const sharedResourceKeySchema = z.string().min(5).max(260).superRefine((value, context) => {
+    if (!repoKey.test(value) && !providerKey.test(value) && !gpuKey.test(value)) {
+        context.addIssue({ code: z.ZodIssueCode.custom,
+            message: 'Expected canonical lowercase repo:, provider:, provider:new:, or gpu: resource key' });
+    }
+});
+const resourceKeys = z.array(sharedResourceKeySchema).min(1).max(8).superRefine((values, context) => {
+    if (new Set(values).size !== values.length)
+        context.addIssue({ code: z.ZodIssueCode.custom, message: 'Resource keys must be unique' });
+    if (values.some((value, index) => index > 0 && values[index - 1] >= value))
+        context.addIssue({ code: z.ZodIssueCode.custom, message: 'Resource keys must be canonical-sorted' });
+});
+export const sharedResourceCallerSchema = z.discriminatedUnion('kind', [
+    z.object({ kind: z.literal('direct') }).strict(),
+    z.object({ kind: z.literal('delegated'), delegationId: identifier }).strict(),
+]);
+const sharedResourceReserveUnsignedSchema = z.object({
+    version: z.literal(1),
+    resourceKeys,
+    missionRootId: identifier,
+    missionRevision: z.number().int().positive().max(2_147_483_647),
+    taskId: identifier,
+    operationId: identifier,
+    requestSha256: sha256,
+    actionClass,
+    deadline: unixSeconds,
+    caller: sharedResourceCallerSchema,
+}).strict();
+export const sharedResourceMissionAssertionSchema = z.object({
+    issuer: identifier,
+    keyId: identifier,
+    issuedAt: unixSeconds,
+    expiresAt: unixSeconds,
+    signature: z.string().regex(/^[A-Za-z0-9+/]+={0,2}$/).min(80).max(128),
+}).strict();
+export const sharedResourceReserveSchema = sharedResourceReserveUnsignedSchema.extend({
+    missionAssertion: sharedResourceMissionAssertionSchema,
+}).strict();
+export const sharedResourceFenceSchema = z.object({
+    resourceKey: sharedResourceKeySchema,
+    fenceGeneration: z.string().regex(/^[1-9][0-9]{0,19}$/),
+}).strict();
+const fences = z.array(sharedResourceFenceSchema).min(1).max(8).superRefine((values, context) => {
+    if (new Set(values.map(value => value.resourceKey)).size !== values.length)
+        context.addIssue({ code: z.ZodIssueCode.custom, message: 'Resource fences must be unique' });
+    if (values.some((value, index) => index > 0 && values[index - 1].resourceKey >= value.resourceKey))
+        context.addIssue({ code: z.ZodIssueCode.custom, message: 'Resource fences must be canonical-sorted' });
+});
+export const sharedResourceLeaseIdentitySchema = z.object({
+    version: z.literal(1),
+    resources: fences,
+    missionRootId: identifier,
+    missionRevision: z.number().int().positive().max(2_147_483_647),
+    taskId: identifier,
+    operationId: identifier,
+    requestSha256: sha256,
+    actionClass,
+    deadline: unixSeconds,
+    caller: sharedResourceCallerSchema,
+    ownerActor: identifier,
+}).strict();
+const terminalUnsigned = sharedResourceLeaseIdentitySchema.extend({
+    outcome: z.enum(['succeeded', 'failed', 'no_effect']),
+    evidenceSha256: sha256,
+    completedAt: unixSeconds,
+    issuer: identifier,
+    keyId: identifier,
+}).strict();
+export const sharedResourceTerminalEvidenceSchema = terminalUnsigned.extend({
+    signature: z.string().regex(/^[A-Za-z0-9+/]+={0,2}$/).min(80).max(128),
+}).strict();
+export const sharedResourceReconciliationSchema = sharedResourceLeaseIdentitySchema.extend({
+    disposition: z.enum(['effects_verified', 'no_effect_verified']),
+    evidenceSha256: sha256,
+    approvalRef: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9:._/-]{0,199}$/),
+    decisionId: identifier,
+    expiresAt: unixSeconds,
+    signature: sha256,
+}).strict();
+export const sharedResourceLeaseViewSchema = sharedResourceLeaseIdentitySchema.extend({
+    leaseId: z.string().regex(/^[A-Za-z0-9_-]{16,64}$/),
+    state: z.enum(['reserved', 'running', 'unknown', 'released']),
+    acquiredAt: unixSeconds,
+    startedAt: unixSeconds.nullable(),
+    settledAt: unixSeconds.nullable(),
+    settlement: z.enum([
+        'signed-terminal:succeeded',
+        'signed-terminal:failed',
+        'signed-terminal:no_effect',
+        'signed-reconciliation:effects_verified',
+        'signed-reconciliation:no_effect_verified',
+    ]).nullable(),
+    evidenceSha256: sha256.nullable(),
+    settlementRecordSha256: sha256.nullable(),
+    terminalEvidence: sharedResourceTerminalEvidenceSchema.nullable(),
+    reconciliationDecisionId: identifier.nullable(),
+    reconciliation: sharedResourceReconciliationSchema.nullable(),
+}).strict();
+function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(',')}]`;
+    if (value !== null && typeof value === 'object')
+        return `{${Object.keys(value).sort()
+            .map(key => `${JSON.stringify(key)}:${canonical(value[key])}`).join(',')}}`;
+    return JSON.stringify(value);
+}
+export function sharedResourceTerminalSigningPayload(value) {
+    return Buffer.from(canonical({ domain: 'magnus.shared-resource-terminal.v1', ...value }));
+}
+export function sharedResourceMissionSigningPayload(value) {
+    return Buffer.from(canonical({ domain: 'magnus.shared-resource-mission.v1', ...value }));
+}
+export function sharedResourceReconciliationSigningPayload(value) {
+    return canonical({ domain: 'magnus.shared-resource-reconciliation.v1', ...value });
+}
+export function sharedResourceSettlementRecordSha256(value) {
+    return createHash('sha256').update(canonical(value)).digest('hex');
+}
+//# sourceMappingURL=shared-resource-lease.js.map

package/dist/schemas/skills.js

@@ -0,0 +1,44 @@
+/**
+ * Zod schemas for skill routes.
+ */
+import { z } from 'zod';
+// ── POST /skills ──
+export const createSkillSchema = z.object({
+    name: z.string().min(1, 'name is required'),
+    version: z.string().min(1, 'version is required'),
+    description: z.string().optional(),
+    entryPoint: z.string().optional(),
+    dependencies: z.array(z.string()).optional(),
+    tags: z.array(z.string()).optional(),
+});
+// ── PATCH /skills/:name ──
+export const updateSkillSchema = z.object({
+    version: z.string().optional(),
+    description: z.string().optional(),
+    entryPoint: z.string().optional(),
+    tags: z.array(z.string()).optional(),
+    dependencies: z.array(z.string()).optional(),
+});
+// ── PUT /skills/:name/files/:fileName ──
+export const updateSkillFileSchema = z.object({
+    content: z.string(),
+});
+// ── POST /skills/push ──
+export const pushSkillSchema = z.object({
+    nodeIds: z.array(z.string().min(1)).min(1, 'At least one nodeId is required')
+        .max(100).refine(values => new Set(values).size === values.length, 'nodeIds must be unique'),
+    skillName: z.string().min(1, 'skillName is required'),
+    version: z.string().min(1).max(128).optional(),
+});
+// ── POST /skills/registry/:slug/publish ──
+export const publishVersionSchema = z.object({
+    version: z.string().min(1, 'version is required'),
+    changelog: z.string().optional(),
+    tags: z.array(z.string()).optional(),
+});
+// ── POST /skills/registry/:slug/tags ──
+export const setTagSchema = z.object({
+    tag: z.string().min(1, 'tag is required'),
+    versionId: z.string().min(1, 'versionId is required'),
+});
+//# sourceMappingURL=skills.js.map

package/dist/schemas/users.js

@@ -0,0 +1,28 @@
+/**
+ * Zod schemas for user and auth routes.
+ */
+import { z } from 'zod';
+// ── POST /auth/login ──
+export const loginSchema = z.object({
+    email: z.string().email('Valid email required'),
+    password: z.string().min(1, 'Password is required'),
+});
+// ── POST /users ──
+export const createUserSchema = z.object({
+    email: z.string().email('Valid email required'),
+    name: z.string().min(1, 'Name is required'),
+    password: z.string().min(8, 'Password must be at least 8 characters'),
+    role: z.enum(['ADMIN', 'OPERATOR', 'VIEWER']).optional().default('VIEWER'),
+});
+// ── PATCH /users/:id ──
+export const updateUserSchema = z.object({
+    name: z.string().min(1).optional(),
+    role: z.enum(['ADMIN', 'OPERATOR', 'VIEWER']).optional(),
+    active: z.boolean().optional(),
+});
+// ── PUT /users/:id/password ──
+export const changePasswordSchema = z.object({
+    currentPassword: z.string().min(1).optional(),
+    newPassword: z.string().min(8, 'New password must be at least 8 characters'),
+});
+//# sourceMappingURL=users.js.map

package/dist/scripts/run-disposable-recovery-exercise.js

@@ -0,0 +1,39 @@
+import { assertDedicatedRecoveryDatabaseUrl, reapOrphanedDisposableRecoveryFixtures, runDisposableRecoveryExercise } from '../services/disposable-recovery-runner.js';
+import { disconnectDb } from '../db/index.js';
+const scenario = process.argv[2];
+const root = process.env['MAGNUS_RECOVERY_RUNNER_ROOT'];
+const privateKeyFile = process.env['MAGNUS_RECOVERY_RUNNER_PRIVATE_KEY_FILE'];
+const publicKeyFile = process.env['MAGNUS_RECOVERY_RUNNER_PUBLIC_KEY_FILE'];
+if (scenario === '--reap-orphans' && root) {
+    try {
+        const result = reapOrphanedDisposableRecoveryFixtures(root);
+        process.stdout.write(`${JSON.stringify(result)}\n`);
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : 'Disposable recovery fixture reaping failed');
+        process.exitCode = 1;
+    }
+}
+else if (!scenario || !root || !privateKeyFile || !publicKeyFile || !process.env['DATABASE_URL']) {
+    console.error('Usage: MAGNUS_RECOVERY_RUNNER_ROOT=/absolute/path run-disposable-recovery-exercise --reap-orphans\n  or: DATABASE_URL=postgresql://magnus_recovery_runner:... MAGNUS_RECOVERY_RUNNER_ROOT=/absolute/path MAGNUS_RECOVERY_RUNNER_PRIVATE_KEY_FILE=/absolute/path MAGNUS_RECOVERY_RUNNER_PUBLIC_KEY_FILE=/absolute/path run-disposable-recovery-exercise <backup_restore|rollback|specialist_loss|coordinator_loss>');
+    process.exitCode = 64;
+}
+else {
+    try {
+        assertDedicatedRecoveryDatabaseUrl(process.env['DATABASE_URL']);
+        const record = await runDisposableRecoveryExercise(scenario, { root, privateKeyFile, publicKeyFile });
+        process.stdout.write(`${JSON.stringify({ exerciseId: record.id, targetId: record.targetId,
+            scenario: record.scenario, recordSha256: record.recordSha256 })}\n`);
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : 'Disposable recovery exercise failed');
+        process.exitCode = 1;
+    }
+    finally {
+        await disconnectDb().catch(error => {
+            console.error(error instanceof Error ? error.message : 'Recovery runner database disconnect failed');
+            process.exitCode = 1;
+        });
+    }
+}
+//# sourceMappingURL=run-disposable-recovery-exercise.js.map

package/dist/sdk/index.js

@@ -0,0 +1,2 @@
+export { NodeApiClient } from './node-api-client.js';
+//# sourceMappingURL=index.js.map