@hivemagnus/magnus-server 0.0.0-stage → 1.0.2

package/dist/services/security-fusion-verification.js

@@ -0,0 +1,50 @@
+import { getDb } from '../db/index.js';
+import { securityFusionActionSources } from './security-fusion-actions.js';
+/** Derive a durable verification deadline from the signed command's persisted
+ * completion, not a process-local timer or a heartbeat preceding the action. */
+export async function reconcileRestartVerification(now = new Date()) {
+    const db = getDb();
+    const actions = await db.securityFusionAction.findMany({
+        where: { kind: 'service_restart', status: { in: ['dispatch_pending', 'executing', 'verifying'] } },
+        orderBy: { createdAt: 'asc' }, take: 100,
+    });
+    for (const action of actions) {
+        const outbox = await db.securityFusionCommandOutbox.findFirst({ where: { actionId: action.id, operation: 'execute' } });
+        if (!outbox?.remoteCommandId)
+            continue;
+        const command = await db.remoteCommand.findUnique({ where: { id: outbox.remoteCommandId }, include: { result: true } });
+        if (!command || !['COMPLETED', 'FAILED', 'TIMEOUT', 'CANCELLED'].includes(command.status))
+            continue;
+        const completedAt = command.completedAt;
+        const successful = command.status === 'COMPLETED' && command.result?.exitCode === 0;
+        const snapshot = successful && completedAt ? await db.healthSnapshot.findFirst({
+            where: { nodeId: action.nodeId, timestamp: { gt: completedAt, gte: new Date(now.getTime() - 120_000), lte: now } },
+            orderBy: { timestamp: 'desc' },
+        }) : null;
+        let active = false;
+        try {
+            const services = snapshot ? JSON.parse(snapshot.services) : [];
+            const name = action.serviceName?.replace(/\.service$/, '');
+            active = Boolean(name && Array.isArray(services) && services.some(s => s && typeof s.name === 'string' && s.name.replace(/\.service$/, '') === name && s.status === 'active'));
+        }
+        catch { /* malformed evidence never proves recovery */ }
+        const expired = !completedAt || now.getTime() - completedAt.getTime() >= 180_000;
+        const status = !successful || expired ? 'failed' : active ? 'succeeded' : 'verifying';
+        await db.$transaction(async (tx) => {
+            const changed = await tx.securityFusionAction.updateMany({
+                where: { id: action.id, status: { in: securityFusionActionSources(status) } },
+                data: { status, resultJson: JSON.stringify({ commandId: command.id,
+                        commandCompletedAt: completedAt?.toISOString(), verificationDeadline: completedAt ? new Date(completedAt.getTime() + 180_000).toISOString() : null,
+                        serviceName: action.serviceName, serviceVerified: active, snapshotId: snapshot?.id ?? null,
+                        reason: !successful ? 'Command failed or outcome unknown' : expired ? 'Service recovery verification expired' : active ? 'Fresh service evidence passed' : 'Awaiting fresh service evidence',
+                    }) },
+            });
+            if (changed.count && status !== 'verifying')
+                await tx.securityFusionCaseActivity.create({ data: {
+                        caseId: action.caseId, kind: `containment.${status}`, actorId: 'system:command-reconciler',
+                        detailJson: JSON.stringify({ actionId: action.id, commandId: command.id, serviceVerified: active, snapshotId: snapshot?.id ?? null }),
+                    } });
+        });
+    }
+}
+//# sourceMappingURL=security-fusion-verification.js.map

package/dist/services/self-update-service.js

@@ -0,0 +1,200 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import path from 'node:path';
+import { readFile, access, constants } from 'node:fs/promises';
+import { reserveApiLocalWork, withApiLocalWork } from './api-local-work.js';
+const execAsync = promisify(execFile);
+/** Root of the magnus-api repo (two levels up from this file in dist/). */
+const REPO_ROOT = process.env['MAGNUS_REPO_ROOT'] ?? path.resolve(import.meta.dirname, '../../');
+/** Check whether the REPO_ROOT is inside a valid git repository. */
+export async function isGitRepo() {
+    try {
+        await access(path.join(REPO_ROOT, '.git'), constants.F_OK);
+        return true;
+    }
+    catch {
+        // Might be a subdirectory in a repo — ask git
+        try {
+            await git('rev-parse', '--git-dir');
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+let lastChecked = null;
+/** Read the current version directly from the version.ts source file on disk. */
+async function readVersionFromDisk() {
+    const versionFile = path.join(REPO_ROOT, 'src/config/version.ts');
+    const content = await readFile(versionFile, 'utf-8');
+    const agentMatch = content.match(/AGENT_VERSION\s*=\s*'([^']+)'/);
+    const controlMatch = content.match(/CONTROL_API_VERSION\s*=\s*'([^']+)'/);
+    return {
+        agent: agentMatch?.[1] ?? 'unknown',
+        controlApi: controlMatch?.[1] ?? 'unknown',
+    };
+}
+/** Run a git command in the repo root. */
+async function git(...args) {
+    const { stdout } = await execAsync('git', args, {
+        cwd: REPO_ROOT,
+        timeout: 60_000,
+    });
+    return stdout.trim();
+}
+/** Run a shell command in the repo root. */
+async function exec(cmd, args, timeoutMs = 300_000) {
+    const { stdout, stderr } = await execAsync(cmd, args, {
+        cwd: REPO_ROOT,
+        timeout: timeoutMs,
+    });
+    return `${stdout}\n${stderr}`.trim();
+}
+/** Get current git branch name. */
+async function getGitBranch() {
+    try {
+        return await git('rev-parse', '--abbrev-ref', 'HEAD');
+    }
+    catch {
+        return null;
+    }
+}
+/** Get current git commit hash. */
+async function getGitCommit() {
+    try {
+        return await git('rev-parse', '--short', 'HEAD');
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Check for updates by running `git fetch` and comparing local vs remote HEAD.
+ * Returns true if there are new commits to pull.
+ * Gracefully returns "not available" when the deployment is not a git repo
+ * (e.g. deployed via tarball or docker) so callers never see a 500.
+ */
+export async function checkForUpdates() {
+    lastChecked = new Date().toISOString();
+    if (!(await isGitRepo())) {
+        const versions = await readVersionFromDisk().catch(() => ({ controlApi: 'unknown', agent: 'unknown' }));
+        return {
+            available: false,
+            behindBy: 0,
+            currentCommit: versions.controlApi,
+            remoteCommit: versions.controlApi,
+            error: `No git repository at ${REPO_ROOT}. Use manual deploy or set MAGNUS_REPO_ROOT.`,
+        };
+    }
+    return withApiLocalWork('self-update-check', async () => {
+        await git('fetch', 'origin');
+        const branch = await getGitBranch() ?? 'main';
+        const local = await git('rev-parse', 'HEAD');
+        const remote = await git('rev-parse', `origin/${branch}`);
+        if (local === remote) {
+            return { available: false, behindBy: 0, currentCommit: local.slice(0, 8), remoteCommit: remote.slice(0, 8) };
+        }
+        // Count how many commits behind
+        const countOutput = await git('rev-list', '--count', `HEAD..origin/${branch}`);
+        const behindBy = parseInt(countOutput, 10) || 0;
+        return { available: behindBy > 0, behindBy, currentCommit: local.slice(0, 8), remoteCommit: remote.slice(0, 8) };
+    });
+}
+/**
+ * Perform the self-update:
+ * 1. `git pull origin <branch>`
+ * 2. `npm ci` (in case deps changed)
+ * 3. `npm run build` (rebuild control-api)
+ * 4. Read the new version from disk
+ * 5. Schedule a process restart via systemd (if running as a service)
+ */
+export async function performSelfUpdate() {
+    const beforeVersions = await readVersionFromDisk().catch(() => ({ controlApi: 'unknown', agent: 'unknown' }));
+    if (!(await isGitRepo())) {
+        return {
+            success: false,
+            updated: false,
+            previousVersion: beforeVersions.controlApi,
+            currentVersion: beforeVersions.controlApi,
+            error: `No git repository at ${REPO_ROOT}. Self-update requires a git checkout. Set MAGNUS_REPO_ROOT or redeploy from source.`,
+        };
+    }
+    return withApiLocalWork('self-update-apply', async () => {
+        try {
+            const branch = await getGitBranch() ?? 'main';
+            // 1. Pull latest code
+            const gitOutput = await git('pull', 'origin', branch);
+            // 2. Install dependencies (in case lockfile changed)
+            const installOutput = await exec('npm', ['ci']);
+            // 3. Build everything
+            const buildOutput = await exec('npm', ['run', 'build']);
+            // 4. Read the new version from the freshly-pulled source
+            const afterVersions = await readVersionFromDisk();
+            const updated = beforeVersions.controlApi !== afterVersions.controlApi ||
+                beforeVersions.agent !== afterVersions.agent ||
+                !gitOutput.includes('Already up to date');
+            lastChecked = new Date().toISOString();
+            return {
+                success: true,
+                updated,
+                previousVersion: beforeVersions.controlApi,
+                currentVersion: afterVersions.controlApi,
+                gitOutput,
+                buildOutput: `${installOutput}\n---\n${buildOutput}`.slice(-2000),
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return {
+                success: false,
+                updated: false,
+                previousVersion: beforeVersions.controlApi,
+                currentVersion: beforeVersions.controlApi,
+                error: message.slice(0, 2000),
+            };
+        }
+    });
+}
+/**
+ * Schedule a restart of the control-api systemd service.
+ * A process-manager fallback is retained; both paths require fresh durable admission.
+ */
+export async function scheduleRestart() {
+    const work = await reserveApiLocalWork('self-update-restart');
+    let method = 'systemd';
+    try {
+        await execAsync('systemctl', ['is-active', 'magnus-control-api'], { timeout: 5_000 });
+    }
+    catch {
+        method = 'process.exit';
+    }
+    // Keep the reservation durable during the response delay. A drain that wins
+    // before this callback must deny the restart, including after lost replies.
+    setTimeout(() => {
+        void work.run(async () => {
+            if (method === 'systemd')
+                await execAsync('systemctl', ['restart', 'magnus-control-api'], { timeout: 30_000 });
+            else
+                process.exit(0);
+        }).catch(() => { console.warn('[SelfUpdate] Restart did not obtain verified completion; inspect its durable work receipt'); });
+    }, 3_000);
+    return { scheduled: true, method, workId: work.workId };
+}
+/** Get the current update status for reporting. */
+export async function getUpdateStatus() {
+    const { AGENT_VERSION, CONTROL_API_VERSION } = await import('../config/index.js');
+    const branch = await getGitBranch();
+    const commit = await getGitCommit();
+    const gitRepo = await isGitRepo();
+    return {
+        controlApiVersion: CONTROL_API_VERSION,
+        agentVersion: AGENT_VERSION,
+        repoRoot: REPO_ROOT,
+        gitBranch: branch,
+        gitCommit: commit,
+        lastChecked,
+        isGitRepo: gitRepo,
+    };
+}
+//# sourceMappingURL=self-update-service.js.map

package/dist/services/shared-resource-leases.js

@@ -0,0 +1,413 @@
+import { createHash, createHmac, createPublicKey, timingSafeEqual, verify } from 'node:crypto';
+import { nanoid } from 'nanoid';
+import { z } from 'zod';
+import { getDb } from '../db/index.js';
+import { HttpError } from '../middleware/error-handler.js';
+import { assertSharedAdmissionOpen, lockSharedAdmission } from './admission-fence.js';
+import { sharedResourceLeaseIdentitySchema, sharedResourceKeySchema, sharedResourceMissionSigningPayload, sharedResourceReconciliationSchema, sharedResourceReconciliationSigningPayload, sharedResourceReserveSchema, sharedResourceSettlementRecordSha256, sharedResourceTerminalEvidenceSchema, sharedResourceTerminalSigningPayload, } from '../schemas/shared-resource-lease.js';
+const HELD = ['reserved', 'running', 'unknown'];
+const MAX_DEADLINE_SECONDS = 24 * 60 * 60;
+const resultTrustSchema = z.array(z.object({
+    issuer: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/),
+    keyId: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/),
+    publicKeySpkiB64: z.string().min(40).max(4096),
+    resourceScopes: z.array(z.string().min(5).max(260)).min(1).max(64),
+}).strict()).min(1).max(32);
+const missionTrustSchema = z.array(z.object({
+    issuer: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/),
+    keyId: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/),
+    publicKeySpkiB64: z.string().min(40).max(4096),
+    ownerActors: z.array(z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/)).min(1).max(32),
+    callerKinds: z.array(z.enum(['direct', 'delegated'])).min(1).max(2),
+}).strict()).min(1).max(32);
+function fail(status, code, message) {
+    throw new HttpError(status, code, message);
+}
+function seconds(date) { return Math.floor(date.getTime() / 1000); }
+function loadResultTrust() {
+    let raw;
+    try {
+        raw = JSON.parse(process.env['SHARED_RESOURCE_RESULT_TRUST_JSON'] ?? '');
+    }
+    catch {
+        fail(503, 'SHARED_RESOURCE_TRUST_UNAVAILABLE', 'Shared resource result trust is unavailable');
+    }
+    const parsed = resultTrustSchema.safeParse(raw);
+    if (!parsed.success)
+        fail(503, 'SHARED_RESOURCE_TRUST_UNAVAILABLE', 'Shared resource result trust is unavailable');
+    const seen = new Set();
+    return parsed.data.map(entry => {
+        const identity = `${entry.issuer}\0${entry.keyId}`;
+        if (seen.has(identity))
+            fail(503, 'SHARED_RESOURCE_TRUST_UNAVAILABLE', 'Shared resource result trust contains duplicate identities');
+        seen.add(identity);
+        let publicKey;
+        try {
+            publicKey = createPublicKey({ key: Buffer.from(entry.publicKeySpkiB64, 'base64'), format: 'der', type: 'spki' });
+        }
+        catch {
+            fail(503, 'SHARED_RESOURCE_TRUST_UNAVAILABLE', 'Shared resource result trust contains an invalid key');
+        }
+        if (publicKey.asymmetricKeyType !== 'ed25519')
+            fail(503, 'SHARED_RESOURCE_TRUST_UNAVAILABLE', 'Shared resource result trust requires Ed25519 keys');
+        const resourceScopes = entry.resourceScopes.map(scope => sharedResourceKeySchema.parse(scope));
+        if (new Set(resourceScopes).size !== resourceScopes.length)
+            fail(503, 'SHARED_RESOURCE_TRUST_UNAVAILABLE', 'Shared resource result trust contains duplicate scopes');
+        return { ...entry, resourceScopes, publicKey };
+    });
+}
+function scopeCovers(scope, resourceKey) {
+    return resourceKey === scope || resourceKey.startsWith(`${scope}:`) || resourceKey.startsWith(`${scope}/`);
+}
+function verifyMissionAssertion(value, ownerActor) {
+    let raw;
+    try {
+        raw = JSON.parse(process.env['SHARED_RESOURCE_MISSION_TRUST_JSON'] ?? '');
+    }
+    catch {
+        fail(503, 'SHARED_RESOURCE_MISSION_TRUST_UNAVAILABLE', 'Hermes mission authority trust is unavailable');
+    }
+    const parsed = missionTrustSchema.safeParse(raw);
+    if (!parsed.success)
+        fail(503, 'SHARED_RESOURCE_MISSION_TRUST_UNAVAILABLE', 'Hermes mission authority trust is unavailable');
+    const identities = parsed.data.map(entry => `${entry.issuer}\0${entry.keyId}`);
+    if (new Set(identities).size !== identities.length
+        || parsed.data.some(entry => new Set(entry.ownerActors).size !== entry.ownerActors.length
+            || new Set(entry.callerKinds).size !== entry.callerKinds.length))
+        fail(503, 'SHARED_RESOURCE_MISSION_TRUST_UNAVAILABLE', 'Hermes mission authority trust contains duplicate bindings');
+    const assertion = value.missionAssertion;
+    const trust = parsed.data.find(entry => entry.issuer === assertion.issuer && entry.keyId === assertion.keyId);
+    if (!trust || !trust.ownerActors.includes(ownerActor) || !trust.callerKinds.includes(value.caller.kind))
+        fail(403, 'SHARED_RESOURCE_MISSION_INVALID', 'Hermes mission authority is not trusted for this actor and caller kind');
+    const now = Math.floor(Date.now() / 1000);
+    if (assertion.issuedAt > now + 30 || assertion.issuedAt < now - 300
+        || assertion.expiresAt <= now || assertion.expiresAt > assertion.issuedAt + 300)
+        fail(409, 'SHARED_RESOURCE_MISSION_INVALID', 'Hermes mission authority assertion is stale or too broad');
+    const { missionAssertion: _missionAssertion, ...reservation } = value;
+    const { signature, ...authority } = assertion;
+    let publicKey;
+    try {
+        publicKey = createPublicKey({ key: Buffer.from(trust.publicKeySpkiB64, 'base64'), format: 'der', type: 'spki' });
+    }
+    catch {
+        fail(503, 'SHARED_RESOURCE_MISSION_TRUST_UNAVAILABLE', 'Hermes mission authority trust contains an invalid key');
+    }
+    if (publicKey.asymmetricKeyType !== 'ed25519')
+        fail(503, 'SHARED_RESOURCE_MISSION_TRUST_UNAVAILABLE', 'Hermes mission authority trust requires Ed25519 keys');
+    let valid = false;
+    try {
+        valid = verify(null, sharedResourceMissionSigningPayload({ reservation, ownerActor, authority }), publicKey, Buffer.from(signature, 'base64'));
+    }
+    catch {
+        valid = false;
+    }
+    if (!valid)
+        fail(403, 'SHARED_RESOURCE_MISSION_INVALID', 'Hermes mission authority assertion is invalid');
+}
+function verifyTerminalEvidence(value) {
+    const trust = loadResultTrust().find(entry => entry.issuer === value.issuer && entry.keyId === value.keyId);
+    if (!trust || value.resources.some(resource => !trust.resourceScopes.some(scope => scopeCovers(scope, resource.resourceKey))))
+        fail(403, 'SHARED_RESOURCE_EVIDENCE_INVALID', 'Terminal evidence issuer is not trusted for every resource');
+    const { signature, ...unsigned } = value;
+    let valid = false;
+    try {
+        valid = verify(null, sharedResourceTerminalSigningPayload(unsigned), trust.publicKey, Buffer.from(signature, 'base64'));
+    }
+    catch {
+        valid = false;
+    }
+    if (!valid)
+        fail(403, 'SHARED_RESOURCE_EVIDENCE_INVALID', 'Terminal evidence signature is invalid');
+}
+function reconciliationSecret() {
+    const value = process.env['SHARED_RESOURCE_RECONCILIATION_SECRET'] ?? '';
+    const conflicting = [
+        'API_SECRET', 'JWT_SECRET', 'NODE_MANAGER_SECRET', 'RESULT_SIGNING_SECRET', 'RESULT_SIGNING_PREVIOUS_SECRET',
+        'COMMAND_RECONCILIATION_SECRET', 'RESOURCE_PARTICIPANT_RECONCILIATION_SECRET', 'SECURITY_APPROVAL_BRIDGE_TOKEN',
+    ];
+    if (!/^[A-Za-z0-9._~+/=-]{32,4096}$/.test(value)
+        || conflicting.some(name => process.env[name] && process.env[name] === value))
+        fail(503, 'SHARED_RESOURCE_RECONCILIATION_UNAVAILABLE', 'Dedicated shared resource reconciliation authority is unavailable');
+    return value;
+}
+function verifyReconciliation(value) {
+    const { signature, ...unsigned } = value;
+    const actual = Buffer.from(signature, 'hex');
+    const expected = createHmac('sha256', reconciliationSecret())
+        .update(sharedResourceReconciliationSigningPayload(unsigned)).digest();
+    if (actual.length !== expected.length || !timingSafeEqual(actual, expected))
+        fail(403, 'SHARED_RESOURCE_EVIDENCE_INVALID', 'Shared resource reconciliation signature is invalid');
+}
+async function lockOperation(tx, operationId) {
+    await tx.$executeRaw `SELECT pg_advisory_xact_lock(hashtextextended(${`shared-resource-operation:${operationId}`}, 0))`;
+}
+async function lockResources(tx, keys) {
+    for (const key of [...keys].sort())
+        await tx.$executeRaw `SELECT pg_advisory_xact_lock(hashtextextended(${`shared-resource:${key}`}, 0))`;
+}
+async function loadLease(id) {
+    return getDb().sharedResourceLease.findUnique({ where: { id }, include: { resources: { orderBy: { resourceKey: 'asc' } } } });
+}
+function leaseIdentity(row) {
+    return sharedResourceLeaseIdentitySchema.parse({
+        version: 1,
+        resources: row.resources.map(resource => ({ resourceKey: resource.resourceKey,
+            fenceGeneration: resource.fenceGeneration.toString() })),
+        missionRootId: row.missionRootId,
+        missionRevision: row.missionRevision,
+        taskId: row.taskId,
+        operationId: row.operationId,
+        requestSha256: row.requestSha256,
+        actionClass: row.actionClass,
+        deadline: seconds(row.deadline),
+        caller: row.callerKind === 'direct'
+            ? { kind: 'direct' }
+            : { kind: 'delegated', delegationId: row.delegationId },
+        ownerActor: row.ownerActor,
+    });
+}
+function suppliedIdentity(value) {
+    return {
+        version: value.version, resources: value.resources, missionRootId: value.missionRootId,
+        missionRevision: value.missionRevision, taskId: value.taskId, operationId: value.operationId,
+        requestSha256: value.requestSha256, actionClass: value.actionClass, deadline: value.deadline,
+        caller: value.caller, ownerActor: value.ownerActor,
+    };
+}
+function exactIdentity(row, value) {
+    return JSON.stringify(leaseIdentity(row)) === JSON.stringify(suppliedIdentity(value));
+}
+function leaseView(row) {
+    return {
+        leaseId: row.id,
+        state: row.state,
+        ...leaseIdentity(row),
+        acquiredAt: seconds(row.acquiredAt),
+        startedAt: row.startedAt ? seconds(row.startedAt) : null,
+        settledAt: row.settledAt ? seconds(row.settledAt) : null,
+        settlement: row.settlement,
+        evidenceSha256: row.evidenceSha256,
+        settlementRecordSha256: row.settlementRecordSha256,
+        terminalEvidence: row.terminalEvidenceJson ? JSON.parse(row.terminalEvidenceJson) : null,
+        reconciliationDecisionId: row.reconciliationDecisionId,
+        reconciliation: row.reconciliationJson ? JSON.parse(row.reconciliationJson) : null,
+    };
+}
+function exactReserve(row, value, actorId) {
+    return row.ownerActor === actorId
+        && row.missionRootId === value.missionRootId && row.missionRevision === value.missionRevision
+        && row.taskId === value.taskId && row.operationId === value.operationId
+        && row.requestSha256 === value.requestSha256 && row.actionClass === value.actionClass
+        && row.missionIssuer === value.missionAssertion.issuer && row.missionKeyId === value.missionAssertion.keyId
+        && seconds(row.deadline) === value.deadline && row.callerKind === value.caller.kind
+        && row.delegationId === (value.caller.kind === 'delegated' ? value.caller.delegationId : null)
+        && JSON.stringify(row.resources.map(resource => resource.resourceKey)) === JSON.stringify(value.resourceKeys);
+}
+function exactStoredMissionAssertion(row, value) {
+    const serialized = JSON.stringify(value.missionAssertion);
+    return row.missionAssertionJson === serialized
+        && row.missionAssertionSha256 === createHash('sha256').update(serialized).digest('hex');
+}
+function assertLeaseOwner(row, actorId) {
+    if (row.ownerActor !== actorId)
+        fail(403, 'SHARED_RESOURCE_OWNER_REQUIRED', 'Only the exact lease owner may perform this lifecycle action');
+}
+function resourceSetBinding(resources) {
+    return resources.map(resource => `${resource.resourceKey}=${resource.fenceGeneration}`).join('\n');
+}
+async function assertCurrentFences(tx, row) {
+    const fences = await tx.sharedResourceFence.findMany({ where: { resourceKey: { in: row.resources.map(resource => resource.resourceKey) } } });
+    const current = new Map(fences.map(fence => [fence.resourceKey, fence.generation]));
+    if (row.resources.some(resource => current.get(resource.resourceKey) !== resource.fenceGeneration))
+        fail(409, 'SHARED_RESOURCE_FENCE_STALE', 'A resource fence generation is stale');
+}
+/** Atomically reserve every key or none. Exact operation replay returns the original durable lease. */
+export async function reserveSharedResources(raw, actorId) {
+    const value = sharedResourceReserveSchema.parse(raw);
+    const db = getDb();
+    return db.$transaction(async (tx) => {
+        await lockOperation(tx, value.operationId);
+        // Exact replay is durable recovery: assertion freshness and the operation deadline
+        // gate only the first acquisition, never retrieval of ownership already recorded.
+        const prior = await tx.sharedResourceLease.findUnique({ where: { operationId: value.operationId },
+            include: { resources: { orderBy: { resourceKey: 'asc' } } } });
+        if (prior) {
+            if (!exactReserve(prior, value, actorId))
+                fail(409, 'SHARED_RESOURCE_OPERATION_CONFLICT', 'Operation identity already binds different ownership');
+            // The exact assertion accepted at acquisition remains valid for durable
+            // replay. Any replacement assertion must be freshly verified over the
+            // unchanged reservation and actor.
+            if (!exactStoredMissionAssertion(prior, value))
+                verifyMissionAssertion(value, actorId);
+            return leaseView(prior);
+        }
+        await lockSharedAdmission(tx);
+        await assertSharedAdmissionOpen(tx);
+        verifyMissionAssertion(value, actorId);
+        const nowSeconds = Math.floor(Date.now() / 1000);
+        if (value.deadline <= nowSeconds || value.deadline > nowSeconds + MAX_DEADLINE_SECONDS)
+            fail(409, 'SHARED_RESOURCE_DEADLINE_INVALID', 'Shared resource deadline must be future and no more than 24 hours');
+        await lockResources(tx, value.resourceKeys);
+        const conflict = await tx.sharedResourceLeaseResource.findFirst({ where: {
+                resourceKey: { in: value.resourceKeys }, state: { in: [...HELD] },
+            }, select: { resourceKey: true, leaseId: true } });
+        if (conflict)
+            fail(409, 'SHARED_RESOURCE_BUSY', `Resource ${conflict.resourceKey} retains durable ownership`);
+        const resources = [];
+        for (const resourceKey of value.resourceKeys) {
+            const fence = await tx.sharedResourceFence.upsert({ where: { resourceKey },
+                create: { resourceKey, generation: 1n }, update: { generation: { increment: 1n } } });
+            resources.push({ resourceKey, fenceGeneration: fence.generation });
+        }
+        const lease = await tx.sharedResourceLease.create({ data: {
+                id: nanoid(), missionRootId: value.missionRootId, missionRevision: value.missionRevision,
+                taskId: value.taskId, operationId: value.operationId, requestSha256: value.requestSha256,
+                actionClass: value.actionClass, ownerActor: actorId, callerKind: value.caller.kind,
+                delegationId: value.caller.kind === 'delegated' ? value.caller.delegationId : null,
+                missionIssuer: value.missionAssertion.issuer, missionKeyId: value.missionAssertion.keyId,
+                missionAssertionSha256: createHash('sha256').update(JSON.stringify(value.missionAssertion)).digest('hex'),
+                missionAssertionJson: JSON.stringify(value.missionAssertion), resourceSetBinding: resourceSetBinding(resources),
+                deadline: new Date(value.deadline * 1000), resources: { create: resources },
+            }, include: { resources: { orderBy: { resourceKey: 'asc' } } } });
+        return leaseView(lease);
+    });
+}
+async function mutateHeldLease(id, raw, actorId, action) {
+    const value = sharedResourceLeaseIdentitySchema.parse(raw);
+    const found = await loadLease(id);
+    if (!found)
+        fail(404, 'SHARED_RESOURCE_LEASE_NOT_FOUND', 'Shared resource lease not found');
+    const db = getDb();
+    return db.$transaction(async (tx) => {
+        await lockOperation(tx, found.operationId);
+        if (action === 'start')
+            await lockSharedAdmission(tx);
+        await lockResources(tx, found.resources.map(resource => resource.resourceKey));
+        const row = await tx.sharedResourceLease.findUniqueOrThrow({ where: { id }, include: { resources: { orderBy: { resourceKey: 'asc' } } } });
+        assertLeaseOwner(row, actorId);
+        if (!exactIdentity(row, value))
+            fail(409, 'SHARED_RESOURCE_IDENTITY_INVALID', 'Lease identity changed or does not match');
+        await assertCurrentFences(tx, row);
+        if (action === 'start') {
+            await assertSharedAdmissionOpen(tx);
+            if (row.state === 'running')
+                return leaseView(row);
+            if (row.state !== 'reserved')
+                fail(409, 'SHARED_RESOURCE_STATE_INVALID', 'Only a reserved lease can start');
+            if (row.deadline.getTime() <= Date.now())
+                fail(409, 'SHARED_RESOURCE_DEADLINE_INVALID', 'Expired ownership is retained and cannot start');
+            const startedAt = new Date();
+            await tx.sharedResourceLeaseResource.updateMany({ where: { leaseId: id, state: 'reserved' }, data: { state: 'running' } });
+            const updated = await tx.sharedResourceLease.update({ where: { id }, data: { state: 'running', startedAt },
+                include: { resources: { orderBy: { resourceKey: 'asc' } } } });
+            return leaseView(updated);
+        }
+        if (row.state === 'unknown')
+            return leaseView(row);
+        if (row.state !== 'running')
+            fail(409, 'SHARED_RESOURCE_STATE_INVALID', 'Only started work can become unknown');
+        await tx.sharedResourceLeaseResource.updateMany({ where: { leaseId: id, state: 'running' }, data: { state: 'unknown' } });
+        const updated = await tx.sharedResourceLease.update({ where: { id }, data: { state: 'unknown' },
+            include: { resources: { orderBy: { resourceKey: 'asc' } } } });
+        return leaseView(updated);
+    });
+}
+export async function startSharedResourceLease(id, raw, actorId) { return mutateHeldLease(id, raw, actorId, 'start'); }
+export async function retainUnknownSharedResourceLease(id, raw, actorId) { return mutateHeldLease(id, raw, actorId, 'unknown'); }
+export async function settleSharedResourceLease(id, raw, actorId) {
+    const value = sharedResourceTerminalEvidenceSchema.parse(raw);
+    verifyTerminalEvidence(value);
+    const found = await loadLease(id);
+    if (!found)
+        fail(404, 'SHARED_RESOURCE_LEASE_NOT_FOUND', 'Shared resource lease not found');
+    assertLeaseOwner(found, actorId);
+    if (!exactIdentity(found, value))
+        fail(409, 'SHARED_RESOURCE_EVIDENCE_INVALID', 'Terminal evidence does not bind the exact lease');
+    if (value.completedAt < seconds(found.startedAt ?? found.acquiredAt)
+        || value.completedAt > Math.floor(Date.now() / 1000) + 30)
+        fail(409, 'SHARED_RESOURCE_EVIDENCE_INVALID', 'Terminal evidence completion time is invalid');
+    const serialized = JSON.stringify(value);
+    const recordSha256 = sharedResourceSettlementRecordSha256(value);
+    const db = getDb();
+    return db.$transaction(async (tx) => {
+        await lockOperation(tx, found.operationId);
+        await lockResources(tx, found.resources.map(resource => resource.resourceKey));
+        const row = await tx.sharedResourceLease.findUniqueOrThrow({ where: { id }, include: { resources: { orderBy: { resourceKey: 'asc' } } } });
+        if (!exactIdentity(row, value))
+            fail(409, 'SHARED_RESOURCE_EVIDENCE_INVALID', 'Terminal evidence does not bind the exact lease');
+        if (row.state === 'released') {
+            if (row.terminalEvidenceJson !== serialized || row.settlementRecordSha256 !== recordSha256)
+                fail(409, 'SHARED_RESOURCE_SETTLEMENT_CONFLICT', 'Lease already has different terminal evidence');
+            return leaseView(row);
+        }
+        await assertCurrentFences(tx, row);
+        if (row.state !== 'running' && row.state !== 'unknown')
+            fail(409, 'SHARED_RESOURCE_STATE_INVALID', 'Only started or unknown work accepts terminal evidence');
+        const settledAt = new Date();
+        await tx.sharedResourceLeaseResource.updateMany({ where: { leaseId: id, state: { in: ['running', 'unknown'] } }, data: { state: 'released' } });
+        const updated = await tx.sharedResourceLease.update({ where: { id }, data: { state: 'released', settledAt,
+                settlement: `signed-terminal:${value.outcome}`, evidenceSha256: value.evidenceSha256,
+                settlementRecordSha256: recordSha256, terminalEvidenceJson: serialized },
+            include: { resources: { orderBy: { resourceKey: 'asc' } } } });
+        return leaseView(updated);
+    });
+}
+export async function reconcileSharedResourceLease(id, raw) {
+    const value = sharedResourceReconciliationSchema.parse(raw);
+    verifyReconciliation(value);
+    const found = await loadLease(id);
+    if (!found)
+        fail(404, 'SHARED_RESOURCE_LEASE_NOT_FOUND', 'Shared resource lease not found');
+    if (!exactIdentity(found, value))
+        fail(409, 'SHARED_RESOURCE_EVIDENCE_INVALID', 'Reconciliation does not bind the exact lease');
+    const serialized = JSON.stringify(value);
+    const recordSha256 = sharedResourceSettlementRecordSha256(value);
+    const db = getDb();
+    return db.$transaction(async (tx) => {
+        await lockOperation(tx, found.operationId);
+        await lockResources(tx, found.resources.map(resource => resource.resourceKey));
+        const row = await tx.sharedResourceLease.findUniqueOrThrow({ where: { id }, include: { resources: { orderBy: { resourceKey: 'asc' } } } });
+        if (!exactIdentity(row, value))
+            fail(409, 'SHARED_RESOURCE_EVIDENCE_INVALID', 'Reconciliation does not bind the exact lease');
+        if (row.state === 'released') {
+            if (row.reconciliationDecisionId !== value.decisionId || row.reconciliationJson !== serialized
+                || row.settlementRecordSha256 !== recordSha256)
+                fail(409, 'SHARED_RESOURCE_SETTLEMENT_CONFLICT', 'Lease already has another terminal settlement');
+            return leaseView(row);
+        }
+        const now = Math.floor(Date.now() / 1000);
+        if (value.expiresAt <= now || value.expiresAt > now + 300)
+            fail(409, 'SHARED_RESOURCE_EVIDENCE_INVALID', 'Reconciliation validity is stale or too broad');
+        await assertCurrentFences(tx, row);
+        const reused = await tx.sharedResourceLease.findFirst({ where: { reconciliationDecisionId: value.decisionId }, select: { id: true } });
+        if (reused && reused.id !== id)
+            fail(409, 'SHARED_RESOURCE_SETTLEMENT_CONFLICT', 'Reconciliation decision is already bound to another lease');
+        await tx.sharedResourceLeaseResource.updateMany({ where: { leaseId: id, state: { in: [...HELD] } }, data: { state: 'released' } });
+        const updated = await tx.sharedResourceLease.update({ where: { id }, data: { state: 'released', settledAt: new Date(),
+                settlement: `signed-reconciliation:${value.disposition}`, evidenceSha256: value.evidenceSha256,
+                settlementRecordSha256: recordSha256, reconciliationDecisionId: value.decisionId,
+                reconciliationJson: serialized }, include: { resources: { orderBy: { resourceKey: 'asc' } } } });
+        return leaseView(updated);
+    });
+}
+export async function inspectSharedResourceLease(id, actorId, allowAdministrator = false) {
+    const row = await loadLease(id);
+    if (!row)
+        fail(404, 'SHARED_RESOURCE_LEASE_NOT_FOUND', 'Shared resource lease not found');
+    if (!allowAdministrator)
+        assertLeaseOwner(row, actorId);
+    return leaseView(row);
+}
+export async function recoverSharedResourceLease(operationId, actorId, allowAdministrator = false) {
+    const row = await getDb().sharedResourceLease.findUnique({ where: { operationId },
+        include: { resources: { orderBy: { resourceKey: 'asc' } } } });
+    if (!row)
+        fail(404, 'SHARED_RESOURCE_LEASE_NOT_FOUND', 'Shared resource lease not found');
+    if (!allowAdministrator)
+        assertLeaseOwner(row, actorId);
+    return leaseView(row);
+}
+export function sharedResourceResultTrustDigest() {
+    return createHash('sha256').update(process.env['SHARED_RESOURCE_RESULT_TRUST_JSON'] ?? '').digest('hex');
+}
+//# sourceMappingURL=shared-resource-leases.js.map