@hivemagnus/magnus-server 0.0.0-stage → 1.0.2

package/dist/services/ssh-exec-service.js

@@ -0,0 +1,139 @@
+import { withApiSshOwnership } from './managed-ssh-admission.js';
+import { Client } from 'ssh2';
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { sshHostVerification } from './ssh-host-verification.js';
+/** Channel closure is transport evidence, not a remote execution result. */
+export class SshCommandOutcomeUnknownError extends Error {
+    code = 'SSH_COMMAND_OUTCOME_UNKNOWN';
+    outcome = 'unknown';
+    retryable = false;
+    constructor() {
+        super('SSH command closed without a valid exit status; outcome unknown. Reconcile remote effects before retrying.');
+        this.name = 'SshCommandOutcomeUnknownError';
+    }
+}
+/** A real SSH exit-status frame is an unsigned 32-bit integer. */
+export function requireSshExitStatus(value) {
+    if (typeof value !== 'number' || !Number.isInteger(value) || value < 0 || value > 0xffffffff)
+        throw new SshCommandOutcomeUnknownError();
+    return value;
+}
+const SENSITIVE_LINE_PATTERNS = [
+    /((?:api|access|refresh|bearer|jwt|node|iam|deploy|client)?[_-]?(?:key|token|secret|password)\s*[=:]\s*)[^\s'"`]+/gi,
+    /(Authorization:\s*Bearer\s+)[^\s'"`]+/gi,
+    /(-----BEGIN [A-Z ]*PRIVATE KEY-----)[\s\S]*?(-----END [A-Z ]*PRIVATE KEY-----)/g,
+];
+export function redactSensitiveText(value) {
+    let redacted = value;
+    for (const pattern of SENSITIVE_LINE_PATTERNS) {
+        redacted = redacted.replace(pattern, (_match, prefix, suffix) => {
+            if (suffix)
+                return `${prefix}\n[REDACTED]\n${suffix}`;
+            return `${prefix}[REDACTED]`;
+        });
+    }
+    return redacted;
+}
+export function escapeForSingleQuotes(value) {
+    return value.replace(/'/g, "'\\''");
+}
+export function resolveDeploySshCredentials() {
+    const username = process.env['SSH_USERNAME'];
+    const password = process.env['SSH_PASSWORD'] ?? '';
+    const privateKeyPath = process.env['SSH_PRIVATE_KEY_PATH'];
+    if (!username) {
+        throw new Error('SSH_USERNAME must be set in the server environment');
+    }
+    let privateKey;
+    if (privateKeyPath) {
+        const resolvedPath = resolve(privateKeyPath);
+        if (!existsSync(resolvedPath)) {
+            throw new Error(`SSH_PRIVATE_KEY_PATH does not exist: ${resolvedPath}`);
+        }
+        privateKey = readFileSync(resolvedPath, 'utf-8');
+    }
+    if (!password && !privateKey) {
+        throw new Error('SSH_PRIVATE_KEY_PATH or SSH_PASSWORD must be set in the server environment');
+    }
+    return { username, password, privateKey };
+}
+export function execRemote(conn, cmd, opts = {}) {
+    const maxOutputBytes = opts.maxOutputBytes ?? 256_000;
+    return new Promise((resolvePromise, reject) => {
+        conn.exec(cmd, (err, stream) => {
+            if (err) {
+                reject(err);
+                return;
+            }
+            let stdout = '';
+            const append = (chunk) => {
+                if (stdout.length < maxOutputBytes) {
+                    stdout += chunk.toString();
+                    if (stdout.length > maxOutputBytes) {
+                        stdout = `${stdout.slice(0, maxOutputBytes)}\n[output truncated]`;
+                    }
+                }
+            };
+            stream.on('data', append);
+            stream.stderr.on('data', append);
+            stream.on('close', (code) => {
+                // SSH exit-status is an unsigned 32-bit integer. A signal-only close or
+                // disconnected channel may supply null/undefined; neither proves success
+                // or even that the remote process stopped. Keep private output off errors.
+                let exitCode;
+                try {
+                    exitCode = requireSshExitStatus(code);
+                }
+                catch (error) {
+                    reject(error);
+                    return;
+                }
+                resolvePromise({
+                    code: exitCode,
+                    stdout,
+                    redactedStdout: redactSensitiveText(stdout),
+                });
+            });
+            stream.on('error', reject);
+        });
+    });
+}
+export async function runRemoteCommand(target, command, opts = {}) {
+    return withApiSshOwnership(target.hostname, 'ssh-command', () => new Promise((resolvePromise, reject) => {
+        const conn = new Client();
+        let settled = false;
+        const finish = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            fn();
+        };
+        conn.on('error', (err) => {
+            finish(() => reject(err));
+        });
+        conn.on('ready', () => {
+            void (async () => {
+                try {
+                    const result = await execRemote(conn, command, { maxOutputBytes: opts.maxOutputBytes });
+                    finish(() => resolvePromise(result));
+                }
+                catch (err) {
+                    finish(() => reject(err));
+                }
+                finally {
+                    conn.end();
+                }
+            })();
+        });
+        conn.connect({
+            ...sshHostVerification(target.hostname, target.port ?? 22),
+            host: target.hostname,
+            port: target.port ?? 22,
+            username: target.username,
+            ...(target.privateKey ? { privateKey: target.privateKey } : { password: target.password ?? '' }),
+            readyTimeout: opts.readyTimeoutMs ?? 30_000,
+        });
+    }));
+}
+//# sourceMappingURL=ssh-exec-service.js.map

package/dist/services/ssh-host-verification.js

@@ -0,0 +1,27 @@
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { z } from 'zod';
+const pinsSchema = z.record(z.string(), z.array(z.string().regex(/^SHA256:[A-Za-z0-9+/]{43}$/)).min(1));
+/** A trusted pin must exist before SSH can send any authentication credential. */
+export function sshHostVerification(hostname, port = 22) {
+    const file = process.env['SSH_HOST_KEY_PINS_FILE'];
+    if (!file)
+        throw new Error('SSH_HOST_KEY_PINS_FILE is required for SSH operations');
+    let pins;
+    try {
+        pins = pinsSchema.parse(JSON.parse(readFileSync(file, 'utf8')));
+    }
+    catch {
+        throw new Error('SSH host-key pin configuration is unreadable or invalid');
+    }
+    const accepted = pins[`${hostname.toLowerCase()}:${port}`];
+    if (!accepted?.length)
+        throw new Error('No trusted SSH host-key pin for this destination');
+    return {
+        hostVerifier: (key) => {
+            const fingerprint = `SHA256:${createHash('sha256').update(key).digest('base64').replace(/=+$/, '')}`;
+            return accepted.includes(fingerprint);
+        },
+    };
+}
+//# sourceMappingURL=ssh-host-verification.js.map

package/dist/services/tailscale-node-key-service.js

@@ -0,0 +1,75 @@
+export const TAILSCALE_RENEWAL_WARNING_DAYS = 30;
+const DAY_MS = 24 * 60 * 60 * 1000;
+function parseDetails(value) {
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+        return value;
+    }
+    if (typeof value !== 'string')
+        return null;
+    try {
+        const parsed = JSON.parse(value);
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function parseTailscaleNodeKeyPosture(serializedServices, nowMs = Date.now(), warningDays = TAILSCALE_RENEWAL_WARNING_DAYS) {
+    let services;
+    try {
+        const parsed = JSON.parse(serializedServices);
+        if (!Array.isArray(parsed))
+            return null;
+        services = parsed;
+    }
+    catch {
+        return null;
+    }
+    const service = services.find((item) => item?.name === 'tailscale-node-key');
+    const details = parseDetails(service?.details);
+    if (!service || typeof service.status !== 'string' || !details)
+        return null;
+    const backendState = details['backendState'];
+    const expiryEnabled = details['expiryEnabled'];
+    const rawExpiry = details['keyExpiry'];
+    if (typeof backendState !== 'string' || typeof expiryEnabled !== 'boolean')
+        return null;
+    if (!(rawExpiry === null || typeof rawExpiry === 'string'))
+        return null;
+    const dnsName = typeof details['dnsName'] === 'string' ? details['dnsName'] : null;
+    const online = typeof details['online'] === 'boolean' ? details['online'] : null;
+    const expiryMs = typeof rawExpiry === 'string' ? Date.parse(rawExpiry) : Number.NaN;
+    const hasValidExpiry = Number.isFinite(expiryMs);
+    if (expiryEnabled && !hasValidExpiry)
+        return null;
+    const daysRemaining = expiryEnabled && hasValidExpiry
+        ? Math.ceil((expiryMs - nowMs) / DAY_MS)
+        : null;
+    const expired = expiryEnabled && hasValidExpiry && expiryMs <= nowMs;
+    const requiresRenewal = expired || (expiryEnabled && daysRemaining !== null && daysRemaining <= warningDays);
+    return {
+        status: service.status,
+        backendState,
+        dnsName,
+        online,
+        keyExpiry: hasValidExpiry ? rawExpiry : null,
+        daysRemaining,
+        expiryEnabled,
+        expired,
+        requiresRenewal,
+    };
+}
+export function summarizeTailscaleNodeKeys(nodes, warningDays = TAILSCALE_RENEWAL_WARNING_DAYS) {
+    return {
+        total: nodes.length,
+        reporting: nodes.filter((node) => node.tailscale !== null).length,
+        expiryEnabled: nodes.filter((node) => node.tailscale?.expiryEnabled).length,
+        expiringSoon: nodes.filter((node) => node.tailscale?.requiresRenewal && !node.tailscale.expired).length,
+        expired: nodes.filter((node) => node.tailscale?.expired).length,
+        warningDays,
+        nodes,
+    };
+}
+//# sourceMappingURL=tailscale-node-key-service.js.map

package/dist/services/team-approvals.js

@@ -0,0 +1,118 @@
+import { z } from 'zod';
+import { getDb } from '../db/index.js';
+import { HttpError } from '../middleware/error-handler.js';
+import { approvalDigest, requireFreshApproval, verifyApprovalAssertion } from '../security/approval-assertion.js';
+import { forwardSecurityFusionApproval, getSecurityFusionApprovalPlan, listSecurityFusionApprovalPlans } from './security-fusion-approvals.js';
+const planSchema = z.object({
+    runbookVersion: z.enum(['diagnostics.v1', 'restart-service.v1']), nodeId: z.string().min(1).max(160),
+    applicationId: z.string().min(1).max(160).optional(), command: z.string().min(1).max(500),
+    args: z.array(z.string().max(500)).max(16), expiresAt: z.string().datetime(), timeoutSeconds: z.number().int().min(1).max(3600),
+    catalogRunbookId: z.string().min(1).max(160).optional(), catalogRunbookVersion: z.string().min(1).max(160).optional(),
+    catalogPlanSha256: z.string().regex(/^[a-f0-9]{64}$/).optional(),
+}).strict().superRefine((value, ctx) => {
+    const catalogFields = [value.catalogRunbookId, value.catalogRunbookVersion, value.catalogPlanSha256];
+    if (catalogFields.some(Boolean) && !catalogFields.every(Boolean))
+        ctx.addIssue({ code: 'custom', message: 'Catalog plan identity must be complete', path: ['catalogPlanSha256'] });
+});
+function remediationId(planId) {
+    const match = /^remediation:([a-zA-Z0-9][a-zA-Z0-9_-]{0,127})$/.exec(planId);
+    if (!match)
+        throw new HttpError(400, 'PLAN_TYPE_UNAVAILABLE', 'Select an existing versioned Magnus remediation plan; containment belongs to Security Fusion');
+    return match[1];
+}
+export function describeRemediationPlan(row) {
+    let raw;
+    try {
+        raw = JSON.parse(row.input);
+    }
+    catch {
+        throw new HttpError(409, 'INVALID_PLAN', 'Stored remediation plan is invalid');
+    }
+    const parsed = planSchema.safeParse(raw);
+    if (!parsed.success || parsed.data.nodeId !== row.nodeId)
+        throw new HttpError(409, 'INVALID_PLAN', 'Stored remediation plan is invalid');
+    const p = parsed.data;
+    const view = {
+        plan_id: `remediation:${row.id}`, revision: 1, action: 'remediation.runbook', targets: [p.nodeId],
+        steps: [`Runbook: ${p.runbookVersion}`, `Command: ${JSON.stringify([p.command, ...p.args])}`,
+            `Timeout: ${p.timeoutSeconds} seconds`, ...(p.applicationId ? [`Application: ${p.applicationId}`] : []),
+            ...(p.catalogPlanSha256 ? [`Catalog: ${p.catalogRunbookId}@${p.catalogRunbookVersion}`, `Catalog plan: ${p.catalogPlanSha256}`] : [])],
+        risk: p.runbookVersion === 'diagnostics.v1' ? 'Read-only host uptime diagnostic.' : 'Service restart interrupts availability and can lose in-memory work.',
+        rollback: p.runbookVersion === 'diagnostics.v1' ? 'No target state change; retain the result.' : 'A restart cannot be undone. Verify service/application health; any further recovery needs a new approved plan.',
+        evidence: [`anomaly:${row.anomalyEventId}`], expires_at: Date.parse(p.expiresAt),
+    };
+    return { ...view, plan_sha256: approvalDigest(view) };
+}
+/** Bounded discovery exposes only validated, unexpired backend-owned pending plans. */
+export async function listTeamApprovalPlans() {
+    const rows = await getDb().remediationExecution.findMany({
+        where: { status: 'pending_approval', triggeredAt: { gte: new Date(Date.now() - 24 * 3600_000) } },
+        orderBy: { triggeredAt: 'desc' }, take: 100,
+    });
+    const plans = [];
+    for (const row of rows) {
+        try {
+            const plan = describeRemediationPlan(row);
+            if (plan.expires_at > Date.now())
+                plans.push(plan);
+        }
+        catch (error) {
+            if (!(error instanceof HttpError))
+                throw error;
+        }
+        if (plans.length === 20)
+            break;
+    }
+    const containment = await listSecurityFusionApprovalPlans();
+    return { plans: [...plans, ...containment].sort((a, b) => Number(a.expires_at) - Number(b.expires_at)).slice(0, 20) };
+}
+export async function getTeamApprovalPlan(planId) {
+    if (planId.startsWith('containment:'))
+        return getSecurityFusionApprovalPlan(planId);
+    const row = await getDb().remediationExecution.findUnique({ where: { id: remediationId(planId) } });
+    if (!row)
+        throw new HttpError(404, 'NOT_FOUND', 'Remediation plan not found');
+    if (row.status !== 'pending_approval')
+        throw new HttpError(409, 'PLAN_ALREADY_HANDLED', 'Plan is no longer awaiting permission');
+    const plan = describeRemediationPlan(row);
+    if (plan.expires_at <= Date.now())
+        throw new HttpError(409, 'PLAN_EXPIRED', 'Create a fresh remediation proposal');
+    return plan;
+}
+export async function recordTeamApproval(raw) {
+    const { payload: p, assertionSha256 } = verifyApprovalAssertion(raw);
+    if (p.proposal_id.startsWith('containment:'))
+        return forwardSecurityFusionApproval(raw);
+    const id = remediationId(p.proposal_id);
+    return getDb().$transaction(async (tx) => {
+        // Locks are scoped to immutable proposal identity and survive API replicas.
+        await tx.$executeRaw `SELECT pg_advisory_xact_lock(hashtextextended(${`team-approval:${p.proposal_id}`}, 0))`;
+        const prior = await tx.teamApprovalDecision.findUnique({ where: { proposalId: p.proposal_id } });
+        if (prior) {
+            if (prior.decisionId !== p.decision_id || prior.assertionSha256 !== assertionSha256)
+                throw new HttpError(409, 'APPROVAL_CONFLICT', 'Proposal already has a different decision');
+            return { decision_id: prior.decisionId, proposal_id: prior.proposalId, decision: prior.decision, execution_id: prior.executionId, accepted: true, replay: true };
+        }
+        requireFreshApproval(p);
+        const row = await tx.remediationExecution.findUnique({ where: { id } });
+        if (!row || row.status !== 'pending_approval')
+            throw new HttpError(409, 'PLAN_ALREADY_HANDLED', 'Plan is not awaiting permission');
+        const plan = describeRemediationPlan(row);
+        if (plan.revision !== p.proposal_revision || plan.plan_sha256 !== p.plan_sha256 || p.expires_at > plan.expires_at)
+            throw new HttpError(409, 'APPROVAL_PLAN_CHANGED', 'Telegram permission does not match the current immutable plan');
+        const actor = `telegram:${p.actor_binding_sha256}`;
+        const changed = await tx.remediationExecution.updateMany({
+            where: { id, status: 'pending_approval', input: row.input },
+            data: p.decision === 'approve' ? { status: 'approving', output: JSON.stringify({ approvedBy: actor,
+                    telegramDecisionId: p.decision_id, telegramPlanSha256: p.plan_sha256, telegramExpiresAt: p.expires_at,
+                    telegramExecutionId: p.execution_id }) } : { status: 'skipped', completedAt: new Date(), output: 'Operator rejected the exact proposal through Telegram' },
+        });
+        if (changed.count !== 1)
+            throw new HttpError(409, 'APPROVAL_PLAN_CHANGED', 'Plan changed before permission could be recorded');
+        await tx.teamApprovalDecision.create({ data: { decisionId: p.decision_id, proposalId: p.proposal_id,
+                proposalRevision: p.proposal_revision, planSha256: p.plan_sha256, decision: p.decision, assertionSha256,
+                actorBindingSha256: p.actor_binding_sha256, executionId: p.execution_id, decidedAt: new Date(p.decided_at), expiresAt: new Date(p.expires_at) } });
+        return { decision_id: p.decision_id, proposal_id: p.proposal_id, decision: p.decision, execution_id: p.execution_id, accepted: true, replay: false };
+    });
+}
+//# sourceMappingURL=team-approvals.js.map

package/dist/services/topology-service.js

@@ -0,0 +1,138 @@
+/**
+ * topology-service.ts — Fleet network topology autodiscovery.
+ *
+ * Builds a topology map from registered nodes:
+ * - Subnet grouping (by /24 CIDR)
+ * - Node reachability (TCP probe on agent port)
+ * - Latency measurement between control-api and each node
+ * - Gateway detection (subnet with most cross-subnet connections)
+ */
+import { getDb } from '../db/index.js';
+import { connect } from 'node:net';
+// ── Helpers ──
+function getSubnet(ip) {
+    const parts = ip.split('.');
+    if (parts.length !== 4)
+        return 'unknown/24';
+    return `${parts[0]}.${parts[1]}.${parts[2]}.0/24`;
+}
+/**
+ * TCP probe — attempt to connect to host:port with timeout.
+ * Returns latency in ms on success, null on failure.
+ */
+function probeNode(host, port, timeoutMs = 3000) {
+    return new Promise((resolve) => {
+        const start = performance.now();
+        let resolved = false;
+        const socket = connect({ host, port, timeout: timeoutMs }, () => {
+            if (!resolved) {
+                resolved = true;
+                const latency = Math.round(performance.now() - start);
+                socket.destroy();
+                resolve(latency);
+            }
+        });
+        socket.on('error', () => {
+            if (!resolved) {
+                resolved = true;
+                resolve(null);
+            }
+        });
+        socket.on('timeout', () => {
+            if (!resolved) {
+                resolved = true;
+                socket.destroy();
+                resolve(null);
+            }
+        });
+        setTimeout(() => {
+            if (!resolved) {
+                resolved = true;
+                socket.destroy();
+                resolve(null);
+            }
+        }, timeoutMs);
+    });
+}
+// ── Core ──
+/**
+ * Scan all registered nodes and build a topology map.
+ */
+export async function scanTopology(probeTimeoutMs = 3000) {
+    const db = getDb();
+    const nodes = await db.node.findMany({
+        where: { status: { not: 'DECOMMISSIONED' } },
+        select: { id: true, name: true, hostname: true, ipAddress: true, port: true, status: true, lastHeartbeatAt: true },
+    });
+    // Probe all nodes concurrently
+    const probeResults = await Promise.allSettled(nodes.map(async (n) => {
+        const latency = await probeNode(n.ipAddress, n.port, probeTimeoutMs);
+        return { nodeId: n.id, reachable: latency !== null, latencyMs: latency };
+    }));
+    const probeMap = new Map();
+    for (const r of probeResults) {
+        if (r.status === 'fulfilled') {
+            probeMap.set(r.value.nodeId, { reachable: r.value.reachable, latencyMs: r.value.latencyMs });
+        }
+    }
+    // Build topology nodes
+    const topoNodes = nodes.map((n) => {
+        const probe = probeMap.get(n.id) ?? { reachable: false, latencyMs: null };
+        return {
+            id: n.id,
+            name: n.name,
+            hostname: n.hostname,
+            ip: n.ipAddress,
+            port: n.port,
+            status: n.status,
+            subnet: getSubnet(n.ipAddress),
+            reachable: probe.reachable,
+            latencyMs: probe.latencyMs,
+            lastHeartbeatAt: n.lastHeartbeatAt?.toISOString() ?? null,
+        };
+    });
+    // Group by subnet
+    const subnetMap = new Map();
+    for (const n of topoNodes) {
+        const list = subnetMap.get(n.subnet) ?? [];
+        list.push(n.id);
+        subnetMap.set(n.subnet, list);
+    }
+    // Detect gateway subnet (largest or most varied connectivity)
+    const maxSubnetSize = Math.max(...[...subnetMap.values()].map((v) => v.length), 0);
+    const subnets = [...subnetMap.entries()].map(([cidr, nodeIds]) => ({
+        cidr,
+        nodeCount: nodeIds.length,
+        nodes: nodeIds,
+        isGateway: nodeIds.length === maxSubnetSize && subnetMap.size > 1,
+    }));
+    // Build edges: nodes within same subnet are same-subnet edges, across subnets are cross-subnet
+    const edges = [];
+    const nodeSubnet = new Map(topoNodes.map((n) => [n.id, n.subnet]));
+    for (let i = 0; i < topoNodes.length; i++) {
+        for (let j = i + 1; j < topoNodes.length; j++) {
+            const a = topoNodes[i];
+            const b = topoNodes[j];
+            const sameSubnet = nodeSubnet.get(a.id) === nodeSubnet.get(b.id);
+            // Only create edges within same subnet automatically;
+            // cross-subnet edges only between reachable nodes
+            if (sameSubnet || (a.reachable && b.reachable)) {
+                edges.push({
+                    from: a.id,
+                    to: b.id,
+                    latencyMs: a.latencyMs !== null && b.latencyMs !== null
+                        ? Math.round((a.latencyMs + b.latencyMs) / 2)
+                        : null,
+                    type: sameSubnet ? 'same-subnet' : 'cross-subnet',
+                });
+            }
+        }
+    }
+    return {
+        nodes: topoNodes,
+        subnets,
+        edges,
+        scannedAt: new Date().toISOString(),
+    };
+}
+//# sourceMappingURL=topology-service.js.map

package/dist/services/transfer-authority-snapshot.js

@@ -0,0 +1,151 @@
+/** Read-only lease inventory. It is an observation, never a drain receipt.
+ * Shared leases are counted globally because their mission issuer is not an
+ * exclusive host owner. No zero count here closes admission or covers writers
+ * outside the Control API.
+ */
+import { getDb } from '../db/index.js';
+import { HttpError } from '../middleware/error-handler.js';
+import { lockSharedAdmission } from './admission-fence.js';
+import { lockResourceNode } from './resource-node-lock.js';
+import { fetchHostLocalWriterProof, verifyHostLocalWriterProof } from './host-local-writer.js';
+import { fetchOsSchedulerWriterProof, verifyOsSchedulerWriterProof } from './os-scheduler-writer.js';
+const HELD = ['reserved', 'running', 'unknown'];
+// These are separate owning-service boundaries. A Control API node fence or a
+// zero lease count cannot attest to any of them. Keep the names stable so a
+// future receipt verifier must cover the complete set before C11 can pass.
+export const INDEPENDENT_WRITER_CLASSES = [
+    'host-local-mutations', 'os-schedulers', 'native-hermes',
+    'external-webhook-writers', 'peer-and-channel-writers',
+];
+const SHA256 = /^[a-f0-9]{64}$/;
+function empty(counts) {
+    return Number.isSafeInteger(counts.active) && counts.active === 0
+        && Number.isSafeInteger(counts.unknown) && counts.unknown === 0;
+}
+/** Shape and identity checks are necessary, but are not an owner signature.
+ * Callers may set ownerVerified only after an owning-service verifier has
+ * authenticated every receipt. The current snapshot has no such verifier. */
+export function evaluateIndependentWriterCoverage(coverage, ownerVerified) {
+    const sources = coverage.sourceClasses;
+    const required = [...INDEPENDENT_WRITER_CLASSES];
+    const missing = required.filter(source => {
+        const entry = sources[source];
+        return entry?.status !== 'verified' || !entry.ownerReceiptSha256 || !SHA256.test(entry.ownerReceiptSha256)
+            || !entry.admissionFenceSha256 || !SHA256.test(entry.admissionFenceSha256);
+    });
+    const receipts = required.map(source => sources[source]?.ownerReceiptSha256);
+    const fences = required.map(source => sources[source]?.admissionFenceSha256);
+    const exactClasses = Object.keys(sources).length === required.length
+        && Object.keys(sources).every(source => required.includes(source));
+    const unique = new Set(receipts).size === required.length && new Set(fences).size === required.length;
+    const inventoriesBound = Boolean(coverage.mutationInventorySha256 && SHA256.test(coverage.mutationInventorySha256)
+        && coverage.scheduleInventorySha256 && SHA256.test(coverage.scheduleInventorySha256));
+    return { complete: ownerVerified && exactClasses && unique && inventoriesBound && missing.length === 0,
+        missingClasses: missing, ownerVerified, inventoriesBound };
+}
+/** A read-only decision summary. Every prerequisite is independently visible;
+ * this cannot close admission, settle unknown effects, or transfer a route. */
+export function evaluateTransferAuthority(input) {
+    const gates = {
+        exactArdentScope: input.enrollment.state === 'enrolled' && input.enrollment.ardentScopeActive
+            && Boolean(input.enrollment.barrierId) && input.scope?.epoch === input.enrollment.epoch
+            && input.scope?.barrierId === input.enrollment.barrierId,
+        nodeAdmissionClosed: input.nodeAdmissionClosed,
+        sharedAdmissionClosed: input.sharedAdmissionClosed,
+        commandLeasesSettled: empty(input.commandLeases),
+        participantWritersSettled: empty(input.participantWriters),
+        sharedLeasesSettled: empty(input.globalSharedLeases),
+        managedCronSettled: Number.isSafeInteger(input.managedCronUnsettled) && input.managedCronUnsettled === 0,
+        independentWritersCovered: input.independentWritersCovered,
+    };
+    const blockers = Object.entries(gates).filter(([, passed]) => !passed).map(([name]) => name);
+    return { complete: blockers.length === 0, gates, blockers };
+}
+export async function transferAuthoritySnapshot(nodeFqdn, nonce) {
+    const db = getDb();
+    const nodes = await db.node.findMany({ where: { hostname: nodeFqdn },
+        select: { id: true, hostname: true, ipAddress: true, port: true }, take: 2 });
+    if (nodes.length !== 1)
+        throw new HttpError(409, 'RESOURCE_TARGET_INVALID', 'Canonical managed node identity required');
+    const node = nodes[0];
+    // Network evidence is fetched before the database locks. The node's
+    // admission drain is one-way; the signed proof is re-bound to the current
+    // enrollment identity while holding the locks below.
+    const [rawHostLocalProof, rawSchedulerProof] = await Promise.all([
+        fetchHostLocalWriterProof(node, nodeFqdn, nonce), fetchOsSchedulerWriterProof(node, nodeFqdn, nonce),
+    ]);
+    return db.$transaction(async (tx) => {
+        // Use the same lock order as fence close/release. A shared reserve/start
+        // cannot cross this snapshot between its lease count and fence read.
+        await lockSharedAdmission(tx);
+        await lockResourceNode(tx, node.id);
+        const current = await tx.node.findUnique({ where: { id: node.id }, select: { hostname: true } });
+        if (current?.hostname !== nodeFqdn)
+            throw new HttpError(409, 'RESOURCE_TARGET_INVALID', 'managed node identity changed');
+        const [commands, participants, cron, shared, enrollment, ardentScope, admissionFence, anyAdmissionFence] = await Promise.all([
+            tx.commandResourceLease.groupBy({ by: ['state'], where: { nodeId: node.id, state: { in: HELD } }, _count: { _all: true } }),
+            tx.resourceParticipantWork.groupBy({ by: ['state'], where: { nodeId: node.id, state: { in: HELD } }, _count: { _all: true } }),
+            tx.managedCronOccurrence.count({ where: { nodeId: node.id, state: { not: 'completed' } } }),
+            tx.sharedResourceLease.groupBy({ by: ['state'], where: { state: { in: HELD } }, _count: { _all: true } }),
+            tx.resourceEnrollment.findUnique({ where: { nodeId: node.id }, select: { state: true, epoch: true, barrierId: true } }),
+            tx.ardentScopeEnrollment.findUnique({ where: { nodeId: node.id }, select: { epoch: true, barrierId: true } }),
+            tx.admissionFence.findUnique({ where: { nodeId: node.id }, select: { releaseId: true, closedAt: true } }),
+            tx.admissionFence.findFirst({ select: { nodeId: true } }),
+        ]);
+        const counts = (rows) => ({
+            active: rows.filter(row => row.state !== 'unknown').reduce((sum, row) => sum + row._count._all, 0),
+            unknown: rows.filter(row => row.state === 'unknown').reduce((sum, row) => sum + row._count._all, 0),
+        });
+        const observedAt = Date.now();
+        const sourceClasses = Object.fromEntries(INDEPENDENT_WRITER_CLASSES.map(source => [source, { status: 'unverified', ownerReceiptSha256: null, admissionFenceSha256: null }]));
+        const hostLocal = verifyHostLocalWriterProof(rawHostLocalProof, { nodeId: node.id, nodeFqdn,
+            nonce, epoch: enrollment?.epoch ?? 0, barrierId: enrollment?.barrierId ?? null }, observedAt);
+        if (hostLocal && enrollment?.state === 'enrolled')
+            sourceClasses['host-local-mutations'] = {
+                status: 'verified', ownerReceiptSha256: hostLocal.ownerReceiptSha256,
+                admissionFenceSha256: hostLocal.admissionFenceSha256,
+            };
+        const osScheduler = verifyOsSchedulerWriterProof(rawSchedulerProof, { nodeId: node.id, nodeFqdn,
+            nonce, epoch: enrollment?.epoch ?? 0, barrierId: enrollment?.barrierId ?? null }, observedAt);
+        if (osScheduler && enrollment?.state === 'enrolled')
+            sourceClasses['os-schedulers'] = {
+                status: 'verified', ownerReceiptSha256: osScheduler.ownerReceiptSha256,
+                admissionFenceSha256: osScheduler.admissionFenceSha256,
+            };
+        const coverageDecision = evaluateIndependentWriterCoverage({ sourceClasses,
+            mutationInventorySha256: hostLocal?.mutationInventorySha256 ?? null,
+            scheduleInventorySha256: osScheduler?.scheduleInventorySha256 ?? null }, false);
+        const independentWriterCoverage = {
+            version: 1, nodeId: node.id, nodeFqdn,
+            epoch: enrollment?.epoch ?? 0, barrierId: enrollment?.barrierId ?? null,
+            releaseId: admissionFence?.releaseId ?? null, observedAt,
+            mutationInventorySha256: hostLocal?.mutationInventorySha256 ?? null,
+            scheduleInventorySha256: osScheduler?.scheduleInventorySha256 ?? null,
+            sourceClasses, ...coverageDecision,
+        };
+        const commandLeases = counts(commands);
+        const participantWriters = counts(participants);
+        const globalSharedLeases = counts(shared);
+        const transferAuthority = evaluateTransferAuthority({
+            enrollment: { state: enrollment?.state ?? 'legacy', epoch: enrollment?.epoch ?? 0,
+                barrierId: enrollment?.barrierId ?? null, ardentScopeActive: Boolean(ardentScope) },
+            scope: ardentScope, nodeAdmissionClosed: Boolean(admissionFence),
+            sharedAdmissionClosed: Boolean(anyAdmissionFence), commandLeases,
+            participantWriters, globalSharedLeases, managedCronUnsettled: cron,
+            independentWritersCovered: coverageDecision.complete,
+        });
+        return { version: 1, nodeId: node.id, nodeFqdn, nonce, observedAt,
+            commandLeases, participantWriters,
+            managedCronUnsettled: cron, globalSharedLeases,
+            enrollment: { state: enrollment?.state ?? 'legacy', epoch: enrollment?.epoch ?? 0,
+                barrierId: enrollment?.barrierId ?? null, ardentScopeActive: Boolean(ardentScope) },
+            controlApiNodeAdmission: { closed: Boolean(admissionFence), releaseId: admissionFence?.releaseId ?? null,
+                closedAt: admissionFence?.closedAt ?? null },
+            controlApiSharedAdmission: { closed: Boolean(anyAdmissionFence), coverage: 'control-api-shared-leases' },
+            admissionFenced: Boolean(admissionFence) && Boolean(anyAdmissionFence) && coverageDecision.complete,
+            independentWriterCoverage,
+            independentWritersCovered: independentWriterCoverage.complete,
+            transferAuthority, transferAuthorityComplete: transferAuthority.complete };
+    });
+}
+//# sourceMappingURL=transfer-authority-snapshot.js.map