@hivemagnus/magnus-server 0.0.0-stage → 1.0.2

package/dist/services/application-probes.js

@@ -0,0 +1,309 @@
+import { createHash } from 'node:crypto';
+import { recordMonitorPulse } from './monitor-pulse.js';
+import { getDb } from '../db/index.js';
+import { getApplicationConfigs } from './operations-config.js';
+import { createNotificationInTransaction } from './notification-service.js';
+import { matchingMaintenance } from './maintenance-service.js';
+import { engineeringMetricEvidenceSha256 } from './engineering-metric-evidence.js';
+export function applicationProbeContractDigest(config) {
+    return createHash('sha256').update(JSON.stringify({
+        version: 1, id: config.id, projectId: config.projectId, serviceId: config.serviceId,
+        nodeId: config.nodeId, baseUrl: config.baseUrl, healthPath: config.healthPath,
+        readinessPath: config.readinessPath ?? null, queuePath: config.queuePath ?? null,
+        maxQueueAgeMs: config.maxQueueAgeMs, tokenEnv: config.tokenEnv ?? null, kind: config.kind,
+    })).digest('hex');
+}
+export async function boundedJson(response, maxBytes = 65536) {
+    const reader = response.body?.getReader();
+    if (!reader)
+        throw new Error('Empty response');
+    const chunks = [];
+    let bytes = 0;
+    try {
+        for (;;) {
+            const part = await reader.read();
+            if (part.done)
+                break;
+            bytes += part.value.byteLength;
+            if (bytes > maxBytes)
+                throw new Error('Response limit exceeded');
+            chunks.push(part.value);
+        }
+    }
+    finally {
+        await reader.cancel();
+    }
+    return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+}
+export function summarizeProbeBody(body, kind) {
+    if (!body || typeof body !== 'object' || Array.isArray(body))
+        return { status: 'unknown', releaseRevision: null };
+    const value = body;
+    const status = String(value['status'] ?? '').toLowerCase();
+    const failed = ['fail', 'failed', 'degraded', 'unhealthy', 'error', 'unavailable'].includes(status) ||
+        value['ok'] === false;
+    const good = ['ok', 'ready', 'healthy', 'pass', 'online'].includes(status) || value['ok'] === true;
+    const revision = value['revision'] ?? value['commit'];
+    const result = {
+        status: failed ? 'fail' : good ? 'pass' : 'unknown',
+        releaseRevision: typeof revision === 'string' && /^[a-zA-Z0-9._-]{1,100}$/.test(revision) ? revision : null,
+    };
+    const nested = value['data'] && typeof value['data'] === 'object'
+        ? value['data']
+        : value;
+    // `workflow-queue`: a worker service that reports readiness and a workflow queue.
+    if (kind === 'workflow-queue' && typeof nested['ready'] === 'boolean')
+        result.status = nested['ready'] ? 'pass' : 'fail';
+    if (kind === 'workflow-queue' && value['workflows'] && typeof value['workflows'] === 'object') {
+        const queue = value['workflows'];
+        result.status =
+            typeof queue['workers'] !== 'number'
+                ? 'unknown'
+                : queue['workers'] < 1 || queue['paused'] === true
+                    ? 'fail'
+                    : 'pass';
+    }
+    // `backend-pool`: a gateway that reports a pool of backends and a draining flag.
+    if (kind === 'backend-pool' && Array.isArray(value['backends'])) {
+        result.status = value['backends'].some((b) => b && typeof b === 'object' && b.status === 'healthy')
+            ? 'pass'
+            : 'fail';
+    }
+    if (kind === 'backend-pool' && value['draining'] === true)
+        result.status = 'fail';
+    return result;
+}
+export async function probeApplication(config) {
+    const result = {
+        status: 'unknown',
+        observedAt: new Date().toISOString(),
+        checks: [],
+        releaseRevision: null,
+        probeContractSha256: applicationProbeContractDigest(config),
+    };
+    for (const [name, path, authenticated] of [
+        ['reachability', config.healthPath, false],
+        ...(config.readinessPath ? [['readiness', config.readinessPath, true]] : []),
+        ...(config.queuePath ? [['worker-queue', config.queuePath, true]] : []),
+    ]) {
+        const token = config.tokenEnv ? process.env[config.tokenEnv] : undefined;
+        if (authenticated && config.tokenEnv && !token) {
+            result.checks.push({
+                name,
+                status: 'unconfigured',
+                detail: 'Scoped credential is not configured',
+                method: 'GET',
+                path, httpStatus: null,
+            });
+            continue;
+        }
+        const probeStarted = Date.now();
+        try {
+            // Targets are operator-defined HTTPS origins; never follow a redirect with credentials.
+            const response = await fetch(new URL(path, config.baseUrl), {
+                method: 'GET',
+                redirect: 'error',
+                signal: AbortSignal.timeout(8000),
+                headers: {
+                    ...(authenticated && token ? { Authorization: `Bearer ${token}` } : {}),
+                },
+            });
+            if (!response.ok) {
+                await response.body?.cancel();
+                result.checks.push({
+                    name,
+                    status: 'fail',
+                    method: 'GET', path, httpStatus: response.status,
+                    durationMs: Date.now() - probeStarted,
+                    detail: response.status === 401 || response.status === 403
+                        ? 'Credential rejected'
+                        : `HTTP ${response.status}`,
+                });
+                continue;
+            }
+            const body = await boundedJson(response);
+            const summary = summarizeProbeBody(body, config.kind);
+            let gpuQueueDepth;
+            if (config.kind === 'hive-router' && name === 'readiness') {
+                summary.status =
+                    body &&
+                        typeof body === 'object' &&
+                        Array.isArray(body['data'])
+                        ? 'pass'
+                        : 'unknown';
+            }
+            if (config.kind === 'workflow-queue' && body && typeof body === 'object') {
+                const queue = body.workflows;
+                if (typeof queue?.latencyMsP50 === 'number' && queue.latencyMsP50 > config.maxQueueAgeMs)
+                    summary.status = 'fail';
+                if (name === 'worker-queue' && queue?.counts && typeof queue.counts === 'object') {
+                    const values = ['waiting', 'delayed', 'paused'].map(key => queue.counts?.[key]);
+                    if (values.every(value => typeof value === 'number' && Number.isInteger(value) && value >= 0))
+                        gpuQueueDepth = values.reduce((total, value) => total + value, 0);
+                }
+            }
+            result.checks.push({
+                name,
+                status: summary.status,
+                method: 'GET', path, httpStatus: response.status,
+                durationMs: Date.now() - probeStarted,
+                ...(gpuQueueDepth === undefined ? {} : { gpuQueueDepth }),
+                detail: summary.status === 'pass'
+                    ? 'Application contract passed'
+                    : 'Application readiness not proven',
+            });
+            result.releaseRevision = summary.releaseRevision ?? result.releaseRevision;
+        }
+        catch {
+            result.checks.push({
+                name,
+                status: 'fail',
+                detail: 'Transport, timeout, or response-contract failure',
+                method: 'GET',
+                path, httpStatus: null, durationMs: Date.now() - probeStarted,
+            });
+        }
+    }
+    result.status = result.checks.some((c) => c.status === 'fail')
+        ? 'fail'
+        : result.checks.some((c) => c.status === 'unconfigured')
+            ? 'unconfigured'
+            : result.checks.length && result.checks.every((c) => c.status === 'pass')
+                ? 'pass'
+                : 'unknown';
+    return result;
+}
+const collector = { startedAt: null, completedAt: null, durationMs: 0, configured: 0, errors: 0 };
+export function getApplicationProbeCollectorStatus() { return { ...collector, running }; }
+export async function collectApplicationProbes() {
+    const configs = getApplicationConfigs();
+    const started = Date.now();
+    collector.startedAt = new Date(started).toISOString();
+    collector.configured = configs.length;
+    collector.errors = 0;
+    let next = 0;
+    // At most 25 requests at once. Even 100 applications with three eight-second
+    // timeouts fit in 96 seconds, leaving room inside the 180-second freshness TTL.
+    await Promise.all(Array.from({ length: Math.min(25, configs.length) }, async () => {
+        for (;;) {
+            const config = configs[next++];
+            if (!config)
+                return;
+            try {
+                await collectApplicationProbe(config);
+            }
+            catch {
+                collector.errors++;
+                console.error('[applications] observation persistence failed');
+            }
+        }
+    }));
+    collector.durationMs = Date.now() - started;
+    collector.completedAt = new Date().toISOString();
+}
+async function collectApplicationProbe(config) {
+    const result = await probeApplication(config);
+    await persistApplicationProbeResult(config, result);
+}
+export async function persistApplicationProbeResult(config, result, afterObservation) {
+    const db = getDb();
+    const retainedResult = { ...result, probeContractSha256: applicationProbeContractDigest(config) };
+    const maintenance = await matchingMaintenance(config.nodeId, config.serviceId);
+    await db.$transaction(async (tx) => {
+        await tx.$executeRaw `SELECT pg_advisory_xact_lock(hashtextextended(${`application:${config.id}`}, 0))`;
+        const previous = await tx.applicationObservation.findUnique({ where: { id: config.id } });
+        await tx.applicationObservation.upsert({
+            where: { id: config.id },
+            create: {
+                id: config.id,
+                projectId: config.projectId,
+                serviceId: config.serviceId,
+                nodeId: config.nodeId,
+                status: result.status,
+                resultJson: JSON.stringify(retainedResult),
+                observedAt: new Date(result.observedAt),
+            },
+            update: {
+                projectId: config.projectId,
+                serviceId: config.serviceId,
+                nodeId: config.nodeId,
+                status: result.status,
+                resultJson: JSON.stringify(retainedResult),
+                observedAt: new Date(result.observedAt),
+            },
+        });
+        const observedAt = new Date(result.observedAt);
+        const metricRows = result.checks.flatMap(check => {
+            const rows = [];
+            if (check.status === 'pass' && check.httpStatus !== null && check.httpStatus !== undefined
+                && check.method && check.path && check.durationMs !== undefined && Number.isFinite(check.durationMs) && check.durationMs >= 0) {
+                const sample = { applicationId: config.id, nodeId: config.nodeId, metric: 'dependency_latency',
+                    sourceKey: check.name, unit: 'ms', value: check.durationMs, observedAt,
+                    probeContractSha256: applicationProbeContractDigest(config), method: check.method, path: check.path,
+                    httpStatus: check.httpStatus };
+                rows.push({ ...sample, evidenceSha256: engineeringMetricEvidenceSha256(sample) });
+            }
+            if (check.status === 'pass' && check.gpuQueueDepth !== undefined
+                && check.method && check.path && check.httpStatus !== null && check.httpStatus !== undefined
+                && Number.isInteger(check.gpuQueueDepth) && check.gpuQueueDepth >= 0) {
+                const sample = { applicationId: config.id, nodeId: config.nodeId, metric: 'gpu_queue',
+                    sourceKey: check.name, unit: 'jobs', value: check.gpuQueueDepth, observedAt,
+                    probeContractSha256: applicationProbeContractDigest(config), method: check.method, path: check.path,
+                    httpStatus: check.httpStatus };
+                rows.push({ ...sample, evidenceSha256: engineeringMetricEvidenceSha256(sample) });
+            }
+            return rows;
+        });
+        if (metricRows.length)
+            await tx.engineeringMetricSample.createMany({ data: metricRows, skipDuplicates: true });
+        await afterObservation?.();
+        if (result.status !== previous?.status &&
+            (result.status === 'fail' || (previous?.status === 'fail' && result.status === 'pass'))) {
+            await createNotificationInTransaction(tx, {
+                type: `application.${result.status === 'fail' ? 'failed' : 'recovered'}`,
+                severity: result.status === 'fail' ? 'warning' : 'info',
+                title: `${config.serviceId}: ${result.status === 'fail' ? 'readiness failed' : 'recovered'}`,
+                message: result.checks.map((c) => `${c.name}: ${c.detail}`).join('; '),
+                nodeId: config.nodeId,
+                sourceRef: config.id,
+                metadata: {
+                    serviceId: config.serviceId,
+                    applicationId: config.id,
+                    observedAt: result.observedAt,
+                },
+            }, maintenance?.id ?? null);
+        }
+    });
+}
+let timer;
+let running = false;
+export function startApplicationProbes() {
+    if (timer)
+        return;
+    const tick = async () => {
+        if (running)
+            return;
+        running = true;
+        try {
+            await collectApplicationProbes();
+            if (!collector.errors)
+                recordMonitorPulse('applications');
+            await (await import('./incident-lessons.js')).reconcileLessonInvalidations();
+        }
+        catch {
+            console.error('[applications] collection failed');
+        }
+        finally {
+            running = false;
+        }
+    };
+    timer = setInterval(() => void tick(), 60000);
+    timer.unref();
+    void tick();
+}
+export function stopApplicationProbes() {
+    if (timer)
+        clearInterval(timer);
+    timer = undefined;
+}
+//# sourceMappingURL=application-probes.js.map

package/dist/services/ardent-scope-enrollment.js

@@ -0,0 +1,123 @@
+/** One-way Ardent-only authority, independent of the node enrollment state. */
+import { createHash, createHmac, timingSafeEqual } from 'node:crypto';
+import { z } from 'zod';
+import { getDb } from '../db/index.js';
+import { HttpError } from '../middleware/error-handler.js';
+import { apiDrainAttestationSchema, apiDrainAttestationSigningPayload, canonical, dashboardEnrollmentSecret, drainReceiptSchema, enrollmentSigningPayload } from './resource-enrollment.js';
+import { lockResourceNode, resourceNodeIdentity } from './resource-node-lock.js';
+import { reconciliationSecret } from './resource-participant-work.js';
+import { RESULT_SIGNING_SECRET } from '../utils/env.js';
+const PARTICIPANTS = ['agent', 'api', 'dashboard'];
+const HELD = ['reserved', 'running', 'unknown'];
+const sha256 = (value) => createHash('sha256').update(value).digest('hex');
+const hex = z.string().regex(/^[a-f0-9]{64}$/);
+export const ardentScopeActivationSchema = z.object({
+    version: z.literal(1), scope: z.literal('managed-ardent-actions-only'),
+    excludedParticipant: z.literal('scheduler'),
+    nodeId: z.string().min(1).max(128), nodeFqdn: z.string().min(1).max(253),
+    epoch: z.number().int().positive(), barrierId: z.string().guid(),
+    decisionId: z.string().guid(), approvalRef: z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9:._/-]{0,199}$/),
+    reviewSha256: hex, schedulerSnapshotSha256: hex,
+    receiptSha256: z.object({ agent: hex, api: hex, dashboard: hex }).strict(),
+    expiresAt: z.number().int().positive(), signature: hex,
+}).strict();
+export function ardentScopeSigningPayload(value) {
+    return 'magnus.ardent-scope-activation.v1\n' + canonical(value);
+}
+function fail() {
+    throw new HttpError(409, 'ARDENT_SCOPE_EVIDENCE_INVALID', 'Current reviewed Ardent scope evidence is required');
+}
+export async function assertArdentScope(tx, nodeId, nodeFqdn) {
+    const [scope, whole] = await Promise.all([
+        tx.ardentScopeEnrollment.findUnique({ where: { nodeId } }),
+        tx.resourceEnrollment.findUnique({ where: { nodeId } }),
+    ]);
+    if (!scope || !whole || scope.nodeFqdn !== nodeFqdn || whole.nodeFqdn !== nodeFqdn
+        || whole.epoch !== scope.epoch || whole.barrierId !== scope.barrierId || !['draining', 'enrolled'].includes(whole.state))
+        throw new HttpError(409, 'ARDENT_SCOPE_REQUIRED', 'Reviewed Ardent-only claim is required');
+}
+async function receiptHashes(tx, nodeId, nodeFqdn, epoch, barrierId) {
+    const hashes = { agent: '', api: '', dashboard: '' };
+    for (const participant of PARTICIPANTS) {
+        const ack = await tx.resourceDrainParticipant.findUnique({ where: { nodeId_participant: { nodeId, participant } } });
+        if (!ack || ack.status !== 'verified' || ack.epoch !== epoch || ack.barrierId !== barrierId
+            || ack.challengeExpiresAt.getTime() <= Date.now() || !ack.receiptJson)
+            fail();
+        let receipt;
+        try {
+            receipt = participant === 'api' ? apiDrainAttestationSchema.parse(JSON.parse(ack.receiptJson))
+                : drainReceiptSchema.parse(JSON.parse(ack.receiptJson));
+        }
+        catch {
+            fail();
+        }
+        const { signature, ...unsigned } = receipt;
+        const key = participant === 'api' ? reconciliationSecret()
+            : participant === 'dashboard' ? dashboardEnrollmentSecret() : RESULT_SIGNING_SECRET;
+        const payload = participant === 'api'
+            ? apiDrainAttestationSigningPayload(unsigned)
+            : enrollmentSigningPayload(unsigned);
+        const expected = createHmac('sha256', key).update(payload).digest();
+        if (receipt.participant !== participant || receipt.nodeId !== nodeId || receipt.nodeFqdn !== nodeFqdn
+            || receipt.epoch !== epoch || receipt.barrierId !== barrierId
+            || receipt.challengeId !== ack.challengeId || receipt.expiresAt !== ack.challengeExpiresAt.getTime()
+            || receipt.status !== 'drained' || receipt.activeCount !== 0 || receipt.unknownCount !== 0
+            || receipt.evidenceSha256 !== ack.evidenceSha256 || !timingSafeEqual(expected, Buffer.from(signature, 'hex')))
+            fail();
+        hashes[participant] = sha256(ack.receiptJson);
+    }
+    return hashes;
+}
+async function schedulerSnapshot(tx, nodeId) {
+    const [ack, definitions, unsettled] = await Promise.all([
+        tx.resourceDrainParticipant.findUnique({ where: { nodeId_participant: { nodeId, participant: 'scheduler' } },
+            select: { status: true, epoch: true, barrierId: true, evidenceSha256: true } }),
+        tx.managedCronDefinition.count({ where: { nodeId, enabled: true } }),
+        tx.managedCronOccurrence.count({ where: { nodeId, state: { not: 'completed' } } }),
+    ]);
+    return sha256(canonical({ ack, definitions, unsettled }));
+}
+export async function inspectArdentScope(nodeId) {
+    return getDb().$transaction(async (tx) => {
+        await lockResourceNode(tx, nodeId);
+        const { node, row } = await resourceNodeIdentity(tx, nodeId);
+        const scope = await tx.ardentScopeEnrollment.findUnique({ where: { nodeId } });
+        return { nodeId, nodeFqdn: node.hostname, wholeNodeState: row?.state ?? 'legacy',
+            epoch: row?.epoch ?? 0, barrierId: row?.barrierId ?? null, schedulerSnapshotSha256: await schedulerSnapshot(tx, nodeId),
+            scope: scope ? { state: 'active', decisionId: scope.decisionId, evidenceSha256: scope.evidenceSha256,
+                activatedAt: scope.activatedAt } : { state: 'pending' } };
+    });
+}
+export async function activateArdentScope(nodeId, raw) {
+    const assertion = ardentScopeActivationSchema.parse(raw);
+    const { signature, ...unsigned } = assertion;
+    const key = reconciliationSecret();
+    const expected = createHmac('sha256', key).update(ardentScopeSigningPayload(unsigned)).digest();
+    if (!timingSafeEqual(expected, Buffer.from(signature, 'hex'))
+        || assertion.expiresAt <= Date.now() || assertion.expiresAt > Date.now() + 300_000)
+        fail();
+    return getDb().$transaction(async (tx) => {
+        await lockResourceNode(tx, nodeId);
+        const { node, row } = await resourceNodeIdentity(tx, nodeId);
+        const existing = await tx.ardentScopeEnrollment.findUnique({ where: { nodeId } });
+        if (existing) {
+            if (existing.assertionJson !== JSON.stringify(assertion))
+                fail();
+            return { nodeId, nodeFqdn: node.hostname, state: 'active', decisionId: existing.decisionId };
+        }
+        if (row?.state !== 'draining' || !row.barrierId || assertion.nodeId !== nodeId || assertion.nodeFqdn !== node.hostname
+            || assertion.epoch !== row.epoch || assertion.barrierId !== row.barrierId)
+            fail();
+        const hashes = await receiptHashes(tx, nodeId, node.hostname, row.epoch, row.barrierId);
+        if (canonical(hashes) !== canonical(assertion.receiptSha256)
+            || assertion.schedulerSnapshotSha256 !== await schedulerSnapshot(tx, nodeId)
+            || await tx.commandResourceLease.count({ where: { nodeId, state: { in: HELD } } })
+            || await tx.resourceParticipantWork.count({ where: { nodeId, participant: { in: [...PARTICIPANTS] }, state: { in: HELD } } }))
+            fail();
+        await tx.ardentScopeEnrollment.create({ data: { nodeId, nodeFqdn: node.hostname,
+                epoch: row.epoch, barrierId: row.barrierId, decisionId: assertion.decisionId,
+                assertionJson: JSON.stringify(assertion), evidenceSha256: sha256(ardentScopeSigningPayload(unsigned)) } });
+        return { nodeId, nodeFqdn: node.hostname, state: 'active', decisionId: assertion.decisionId };
+    });
+}
+//# sourceMappingURL=ardent-scope-enrollment.js.map

package/dist/services/ardent-service.js

@@ -0,0 +1,86 @@
+import { ArdentNodeStateSchema } from '@hivemagnus/magnus-contracts';
+import { getDb } from '../db/index.js';
+import { NodeApiClient } from '../sdk/index.js';
+import { getNodeBaseUrl } from '../utils/node-url.js';
+import { getNodeManagerSecret } from '../utils/env.js';
+import { SENTINEL_NODE_IDS } from '../utils/sentinel-nodes.js';
+function clientFor(node) {
+    return new NodeApiClient({ baseUrl: getNodeBaseUrl(node.ipAddress, node.port), resourceNodeId: node.id,
+        resourceScope: 'ardent-managed-http', nodeToken: getNodeManagerSecret() });
+}
+async function nodeTarget(id) {
+    const node = await getDb().node.findFirst({ where: { id, status: { not: 'DECOMMISSIONED' } },
+        select: { id: true, name: true, hostname: true, ipAddress: true, port: true } });
+    if (!node || SENTINEL_NODE_IDS.includes(node.id))
+        throw new Error('Managed node not found');
+    return node;
+}
+async function persistObservation(nodeId, state) {
+    const observedAt = state.reachable ? new Date(state.checkedAt) : undefined;
+    await getDb().$transaction(async (tx) => {
+        const installation = await tx.ardentInstallation.upsert({ where: { nodeId },
+            create: { nodeId, owner: state.reachable ? state.owner : null, version: state.version,
+                installed: state.installed, reachable: state.reachable, error: state.error,
+                ...(observedAt ? { observedAt } : {}) },
+            update: { reachable: state.reachable, error: state.error, checkedAt: new Date(),
+                ...(state.reachable ? { owner: state.owner, version: state.version, installed: state.installed, observedAt } : {}) } });
+        if (!state.reachable)
+            return;
+        const names = state.profiles.map(profile => profile.id);
+        await tx.ardentProfile.deleteMany({ where: { installationId: installation.id, ...(names.length ? { name: { notIn: names } } : {}) } });
+        for (const profile of state.profiles) {
+            const channels = profile.channels;
+            const summary = { displayName: profile.name, backend: profile.backend, apiPort: profile.apiPort,
+                running: profile.running, a2aEnabled: profile.a2aEnabled,
+                telegramEnabled: channels['telegram'] === true,
+                error: profile.error, observedAt: observedAt ?? new Date() };
+            await tx.ardentProfile.upsert({ where: { installationId_name: { installationId: installation.id, name: profile.id } },
+                create: { installationId: installation.id, name: profile.id, ...summary }, update: summary });
+        }
+    });
+}
+async function inspect(node, timeoutMs = 15_000) {
+    let state;
+    try {
+        const response = await clientFor(node).getArdentState(timeoutMs);
+        if (!response.success)
+            throw new Error('Node did not return Ardent inventory');
+        const parsed = ArdentNodeStateSchema.parse(response.data);
+        state = { ...parsed, nodeId: node.id, nodeName: node.name, hostname: node.hostname, reachable: true, error: null };
+    }
+    catch (error) {
+        state = { nodeId: node.id, nodeName: node.name, hostname: node.hostname, reachable: false,
+            installed: false, version: null, owner: '', profiles: [], checkedAt: new Date().toISOString(),
+            error: error instanceof Error ? error.message.slice(0, 300) : 'Node inventory unavailable' };
+    }
+    try {
+        await persistObservation(node.id, state);
+    }
+    catch {
+        return { ...state, error: 'Ardent inventory observed, but its central reference could not be stored' };
+    }
+    return state;
+}
+export async function listArdentInstallations() {
+    const db = getDb();
+    const nodes = await db.node.findMany({ where: { id: { notIn: SENTINEL_NODE_IDS }, status: { not: 'DECOMMISSIONED' } },
+        orderBy: { name: 'asc' }, select: { id: true, name: true, hostname: true, ipAddress: true, port: true } });
+    const known = await db.ardentInstallation.findMany({ where: { nodeId: { in: nodes.map(node => node.id) }, installed: true }, select: { nodeId: true } });
+    const installed = new Set(known.map(row => row.nodeId));
+    // Probe the bounded inventory concurrently. Uninstalled/offline candidates
+    // must not hold the entire management page beyond the dashboard proxy limit.
+    return Promise.all(nodes.map(node => inspect(node, installed.has(node.id) ? 5_000 : 1_500)));
+}
+export async function getArdentInstallation(id) {
+    return inspect(await nodeTarget(id));
+}
+export async function getArdentProfileResource(nodeId, profile, resource, query) {
+    return clientFor(await nodeTarget(nodeId)).getArdentProfileResource(profile, resource, query);
+}
+export async function getArdentArtifact(nodeId, profile, artifactId) {
+    return clientFor(await nodeTarget(nodeId)).getArdentArtifact(profile, artifactId);
+}
+export async function performArdentAction(nodeId, profile, action, target, body) {
+    return clientFor(await nodeTarget(nodeId)).performArdentAction(profile, action, target, body);
+}
+//# sourceMappingURL=ardent-service.js.map