@hivemagnus/magnus-server 0.0.0-stage → 1.0.2

package/dist/services/webhook-service.js

@@ -0,0 +1,494 @@
+import { recordMonitorPulse } from './monitor-pulse.js';
+import { redactUnknown } from '../utils/redact.js';
+import { createHmac, randomBytes, createCipheriv } from 'node:crypto';
+import { nanoid } from 'nanoid';
+import { Queue, Worker } from 'bullmq';
+import { addDurableJob } from '../queue/requeue.js';
+import { getDb } from '../db/index.js';
+import { isEncryptedWebhookCredential, decryptWebhookCredential, encryptWebhookCredential, postWebhook, validateWebhookTarget, } from './webhook-security.js';
+// ─── Webhook Service — dispatch, deliver, retry ───
+const REDIS_URL = process.env['REDIS_URL'] ?? 'redis://127.0.0.1:6379';
+const REDIS_PREFIX = process.env['REDIS_PREFIX'] ?? 'magnus-';
+const WEBHOOK_QUEUE = `${REDIS_PREFIX}webhooks`;
+const PROTECTED_HEADERS = new Set([
+    'connection', 'content-length', 'host', 'transfer-encoding', 'user-agent',
+    'x-magnus-delivery', 'x-magnus-encrypted', 'x-magnus-event', 'x-magnus-signature',
+]);
+let dispatchTimer;
+let dispatchBusy = false;
+let _webhookQueue = null;
+let _webhookWorker = null;
+/** Get the singleton webhook queue instance. */
+export function getWebhookQueue() {
+    if (!_webhookQueue) {
+        _webhookQueue = new Queue(WEBHOOK_QUEUE, { connection: { url: REDIS_URL } });
+    }
+    return _webhookQueue;
+}
+export async function closeWebhookQueue() {
+    if (dispatchTimer)
+        clearInterval(dispatchTimer);
+    dispatchTimer = undefined;
+    if (_webhookWorker) {
+        await _webhookWorker.close();
+        _webhookWorker = null;
+    }
+    if (_webhookQueue) {
+        await _webhookQueue.close();
+        _webhookQueue = null;
+    }
+}
+export function createWebhookJobPayload(endpointId) {
+    return { endpointId };
+}
+/**
+ * Dispatch a webhook event to all matching active endpoints.
+ * Enqueues deliveries to BullMQ for async processing with retries.
+ */
+/** Called in the same transaction as the notification. These pending rows are
+ * the delivery outbox, so a crash before Redis insertion cannot lose an alert. */
+export async function createWebhookDeliveries(tx, event, payload) {
+    const endpoints = await tx.webhookEndpoint.findMany({ where: { active: true } });
+    for (const ep of endpoints) {
+        const events = JSON.parse(ep.events || '[]');
+        if (events.length && !events.some(pattern => eventMatches(event, pattern)))
+            continue;
+        await tx.webhookDelivery.create({ data: { id: nanoid(), endpointId: ep.id, event,
+                payload: JSON.stringify(payload), status: 'pending' } });
+    }
+}
+export async function reconcileWebhookDeliveries() {
+    const pending = await getDb().webhookDelivery.findMany({
+        where: { status: 'pending', attempts: 0, endpoint: { active: true } },
+        include: { endpoint: true }, orderBy: { createdAt: 'asc' }, take: 1000,
+    });
+    for (const delivery of pending) {
+        // Only a completed job (e.g. skipped while its endpoint was inactive) is
+        // replaced; failed jobs are finalized by the worker's failure bookkeeping.
+        await addDurableJob(getWebhookQueue(), 'deliver', createWebhookJobPayload(delivery.endpointId), {
+            jobId: delivery.id,
+            attempts: delivery.endpoint.type === 'mattermost' ? 1 : Math.max(1, Math.min(11, delivery.endpoint.retries + 1)),
+            backoff: { type: 'exponential', delay: 1000 },
+            removeOnComplete: { age: 86400, count: 10000 }, removeOnFail: { age: 604800, count: 10000 },
+        }, ['completed']);
+    }
+}
+export async function dispatchWebhook(event, payload) {
+    await getDb().$transaction(tx => createWebhookDeliveries(tx, event, payload));
+    // The periodic dispatcher owns recovery; callers only depend on durable storage.
+}
+/** Check if an event string matches a pattern (supports * wildcard). */
+function eventMatches(event, pattern) {
+    if (pattern === '*')
+        return true;
+    if (pattern === event)
+        return true;
+    // Support prefix wildcards: "node.*" matches "node.offline"
+    if (pattern.endsWith('.*')) {
+        const prefix = pattern.slice(0, -2);
+        return event.startsWith(prefix + '.');
+    }
+    return false;
+}
+/** Sign a payload with HMAC-SHA256. */
+function signPayload(payload, secret) {
+    return createHmac('sha256', secret).update(payload).digest('hex');
+}
+/**
+ * Encrypt a payload using AES-256-GCM.
+ * Returns Base64 envelope: iv (12B) + ciphertext + authTag (16B).
+ * The recipient derives the 256-bit key from the shared secret via SHA-256.
+ */
+function encryptPayload(payload, secret) {
+    const key = Buffer.from(createHmac('sha256', 'magnus-webhook-enc').update(secret).digest());
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+    const encrypted = Buffer.concat([cipher.update(payload, 'utf8'), cipher.final()]);
+    const authTag = cipher.getAuthTag();
+    return Buffer.concat([iv, encrypted, authTag]).toString('base64');
+}
+function parseStoredHeaders(endpointId, stored) {
+    const plaintext = decryptWebhookCredential(stored, endpointId, 'headers');
+    let parsed;
+    try {
+        parsed = JSON.parse(plaintext);
+    }
+    catch {
+        throw new Error('Webhook headers contain invalid encrypted JSON');
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('Webhook headers must decrypt to an object');
+    }
+    const headers = {};
+    for (const [rawName, rawValue] of Object.entries(parsed)) {
+        const name = rawName.trim().toLowerCase();
+        if (!name || !/^[!#$%&'*+.^_`|~0-9a-z-]+$/.test(name) || PROTECTED_HEADERS.has(name)) {
+            throw new Error('Webhook headers contain a forbidden header name');
+        }
+        if (typeof rawValue !== 'string' || rawValue.length > 8_192) {
+            throw new Error('Webhook headers contain an invalid value');
+        }
+        headers[name] = rawValue;
+    }
+    if (Object.keys(headers).length > 32)
+        throw new Error('Webhook headers exceed the configured limit');
+    return headers;
+}
+function encryptedSecret(endpoint) {
+    return endpoint.secret === null
+        ? null
+        : decryptWebhookCredential(endpoint.secret, endpoint.id, 'secret');
+}
+export function redactWebhookEndpoint(endpoint) {
+    const secret = encryptedSecret(endpoint);
+    const headers = parseStoredHeaders(endpoint.id, endpoint.headers);
+    const safe = { ...endpoint };
+    delete safe.secret;
+    delete safe.headers;
+    return {
+        ...safe,
+        ...(endpoint.url ? { url: new URL(webhookUrl(endpoint)).origin, urlConfigured: true } : {}),
+        secretConfigured: Boolean(secret),
+        headersConfigured: Object.keys(headers).length > 0,
+    };
+}
+function normalizeHeaders(headers) {
+    const temporaryEnvelope = encryptWebhookCredential(JSON.stringify(headers), 'validation', 'headers');
+    return parseStoredHeaders('validation', temporaryEnvelope);
+}
+function normalizeDeliveryOptions(retries = 3, timeoutMs = 10_000) {
+    if (!Number.isInteger(retries) || retries < 0 || retries > 10) {
+        throw new Error('Webhook retries must be an integer between 0 and 10');
+    }
+    if (!Number.isInteger(timeoutMs) || timeoutMs < 1_000 || timeoutMs > 60_000) {
+        throw new Error('Webhook timeoutMs must be an integer between 1000 and 60000');
+    }
+    return { retries, timeoutMs };
+}
+/** Format payload for Slack/Discord integrations. */
+export function formatPayload(type, event, payload) {
+    const data = JSON.parse(payload);
+    // Mattermost-compatible incoming webhook: redacted text, delivered at most once.
+    if (type === 'mattermost') {
+        const clean = (value) => String(redactUnknown(value) ?? '').replace(/@[a-z0-9_]+/gi, '[mention]').replace(/(?:https?:\/\/)[^\s]+/g, '[link omitted]').replace(/(?:password|token|secret|authorization)\s*[:=]\s*\S+/gi, '[credential omitted]').slice(0, 2000);
+        const origin = process.env['DASHBOARD_PUBLIC_ORIGIN'];
+        let link = '';
+        if (origin) {
+            try {
+                const parsed = new URL(origin);
+                if (parsed.protocol === 'https:' && !parsed.username && !parsed.password)
+                    link = `${parsed.origin}/incidents`;
+            }
+            catch { /* no link */ }
+        }
+        return { body: JSON.stringify({ text: `[Magnus] ${clean(event)} · ${clean(data.severity)}\n${clean(data.title)}\n${clean(data.message)}\nObserved: ${clean(data.createdAt ?? data.timestamp)}${link ? `\nReview: ${link}` : ''}` }), contentType: 'application/json' };
+    }
+    if (type === 'slack') {
+        return {
+            body: JSON.stringify({
+                text: `*[Magnus]* ${event}`,
+                blocks: [
+                    {
+                        type: 'section',
+                        text: {
+                            type: 'mrkdwn',
+                            text: `*${event}*\n${data.title ?? data.message ?? JSON.stringify(data)}`,
+                        },
+                    },
+                ],
+            }),
+            contentType: 'application/json',
+        };
+    }
+    if (type === 'discord') {
+        return {
+            body: JSON.stringify({
+                content: `**[Magnus]** ${event}`,
+                embeds: [
+                    {
+                        title: data.title ?? event,
+                        description: data.message ?? JSON.stringify(data),
+                        color: data.severity === 'critical' ? 0xff0000 : data.severity === 'warning' ? 0xffaa00 : 0x00e5ff,
+                    },
+                ],
+            }),
+            contentType: 'application/json',
+        };
+    }
+    // Generic
+    return {
+        body: payload,
+        contentType: 'application/json',
+    };
+}
+/** Persist the non-replayable attempt before any Mattermost POST. A stalled
+ * queue job after process loss cannot post the same delivery a second time. */
+export async function claimMattermostAttempt(deliveryId) {
+    const claimed = await getDb().webhookDelivery.updateMany({ where: { id: deliveryId, status: 'pending' }, data: { status: 'sending', attempts: 1 } });
+    return claimed.count === 1;
+}
+/** Start the webhook delivery worker. */
+export function startWebhookWorker() {
+    if (_webhookWorker)
+        return _webhookWorker;
+    // Force the dedicated at-rest key to be present before accepting queued work.
+    encryptWebhookCredential('', 'startup-check', 'secret');
+    const worker = new Worker(WEBHOOK_QUEUE, async (job) => {
+        const db = getDb();
+        const deliveryId = job.id;
+        if (!deliveryId)
+            throw new Error('Webhook delivery job is missing its delivery ID');
+        const delivery = await db.webhookDelivery.findUnique({
+            where: { id: deliveryId },
+            include: { endpoint: true },
+        });
+        if (!delivery)
+            return;
+        if (delivery.endpointId !== job.data.endpointId) {
+            throw new Error('Webhook delivery endpoint binding mismatch');
+        }
+        const endpoint = delivery.endpoint;
+        if (!endpoint.active || delivery.status === 'success')
+            return;
+        const secret = encryptedSecret(endpoint);
+        const extraHeaders = parseStoredHeaders(endpoint.id, endpoint.headers);
+        const shouldEncrypt = extraHeaders['x-magnus-encrypt'] === 'true';
+        delete extraHeaders['x-magnus-encrypt'];
+        const { body: rawBody, contentType } = formatPayload(endpoint.type, delivery.event, delivery.payload);
+        // Optionally encrypt the payload with AES-256-GCM
+        const encrypted = shouldEncrypt && secret !== null && endpoint.type === 'generic';
+        const body = encrypted ? encryptPayload(rawBody, secret) : rawBody;
+        const headers = {
+            ...extraHeaders,
+            'Content-Type': encrypted ? 'application/octet-stream' : contentType,
+            'User-Agent': 'Magnus-Webhook/1.0',
+            'X-Magnus-Event': delivery.event,
+            'X-Magnus-Delivery': deliveryId,
+            ...(encrypted && { 'X-Magnus-Encrypted': 'aes-256-gcm' }),
+        };
+        if (secret) {
+            headers['X-Magnus-Signature'] = `sha256=${signPayload(body, secret)}`;
+        }
+        if (endpoint.type === 'mattermost' && !(await claimMattermostAttempt(deliveryId)))
+            return;
+        try {
+            const res = await postWebhook(webhookUrl(endpoint), { headers, body, timeoutMs: endpoint.timeoutMs });
+            const attempt = job.attemptsMade + 1;
+            await db.webhookDelivery.update({
+                where: { id: deliveryId },
+                data: {
+                    status: res.ok ? 'success' : 'failed',
+                    httpStatus: res.status,
+                    response: res.responseBody,
+                    attempts: attempt,
+                    deliveredAt: res.ok ? new Date() : undefined,
+                    error: res.ok ? null : `HTTP ${res.status}`,
+                },
+            });
+            if (!res.ok)
+                throw new Error(`Webhook delivery failed with HTTP ${res.status}`);
+        }
+        catch (err) {
+            const errorMsg = err instanceof Error ? err.message : 'Unknown error';
+            await db.webhookDelivery.update({
+                where: { id: deliveryId },
+                data: {
+                    status: 'failed',
+                    attempts: job.attemptsMade + 1,
+                    error: errorMsg,
+                },
+            });
+            throw err;
+        }
+    }, {
+        connection: { url: REDIS_URL },
+        concurrency: 5,
+    });
+    worker.on('failed', (job, err) => {
+        console.error(`[webhook-worker] Job ${job?.id} failed: ${err.message}`);
+        if (job?.id && job.attemptsMade >= (job.opts.attempts ?? 1)) {
+            void getDb().webhookDelivery.updateMany({ where: { id: job.id, status: 'pending' },
+                data: { status: 'failed', error: 'Delivery validation or queue attempt failed', attempts: job.attemptsMade },
+            }).catch(() => console.error('[webhook] failed-attempt bookkeeping pending'));
+        }
+    });
+    const dispatch = async () => {
+        if (dispatchBusy)
+            return;
+        dispatchBusy = true;
+        try {
+            await reconcileWebhookDeliveries();
+            recordMonitorPulse('webhooks');
+        }
+        catch {
+            console.error('[webhook] durable dispatch pending');
+        }
+        finally {
+            dispatchBusy = false;
+        }
+    };
+    void dispatch();
+    dispatchTimer = setInterval(() => void dispatch(), 2000);
+    dispatchTimer.unref();
+    _webhookWorker = worker;
+    return worker;
+}
+export function webhookUrl(endpoint) {
+    return isEncryptedWebhookCredential(endpoint.url) ? decryptWebhookCredential(endpoint.url, endpoint.id, 'url') : endpoint.url;
+}
+// ─── CRUD helpers ───
+export async function listWebhookEndpoints() {
+    const db = getDb();
+    const endpoints = await db.webhookEndpoint.findMany({
+        orderBy: { createdAt: 'desc' },
+        include: { _count: { select: { deliveries: true } } },
+    });
+    return endpoints.map(redactWebhookEndpoint);
+}
+export async function getWebhookEndpoint(id) {
+    const db = getDb();
+    const endpoint = await db.webhookEndpoint.findUnique({
+        where: { id },
+        include: { _count: { select: { deliveries: true } } },
+    });
+    return endpoint ? redactWebhookEndpoint(endpoint) : null;
+}
+export async function createWebhookEndpoint(data) {
+    const db = getDb();
+    const id = nanoid();
+    if (!['generic', 'slack', 'discord', 'mattermost'].includes(data.type ?? 'generic'))
+        throw new Error('Unsupported webhook format');
+    await validateWebhookTarget(data.url);
+    const headers = normalizeHeaders(data.headers ?? {});
+    const { retries, timeoutMs } = normalizeDeliveryOptions(data.retries, data.timeoutMs);
+    const endpoint = await db.webhookEndpoint.create({
+        data: {
+            id,
+            name: data.name,
+            url: encryptWebhookCredential(data.url, id, 'url'),
+            type: data.type ?? 'generic',
+            secret: data.secret === undefined ? null : encryptWebhookCredential(data.secret, id, 'secret'),
+            events: JSON.stringify(data.events ?? []),
+            headers: encryptWebhookCredential(JSON.stringify(headers), id, 'headers'),
+            retries,
+            timeoutMs,
+            createdBy: data.createdBy ?? null,
+        },
+    });
+    return redactWebhookEndpoint(endpoint);
+}
+export async function updateWebhookEndpoint(id, data) {
+    const db = getDb();
+    const current = await db.webhookEndpoint.findUnique({ where: { id } });
+    if (!current)
+        return null;
+    const updateData = {};
+    if (data.name !== undefined)
+        updateData['name'] = data.name;
+    if (data.url !== undefined) {
+        await validateWebhookTarget(data.url);
+        updateData['url'] = encryptWebhookCredential(data.url, id, 'url');
+    }
+    if (data.type !== undefined) {
+        if (!['generic', 'slack', 'discord', 'mattermost'].includes(data.type))
+            throw new Error('Unsupported webhook format');
+        updateData['type'] = data.type;
+    }
+    if (data.secret !== undefined) {
+        updateData['secret'] = data.secret === null ? null : encryptWebhookCredential(data.secret, id, 'secret');
+    }
+    if (data.events !== undefined)
+        updateData['events'] = JSON.stringify(data.events);
+    if (data.headers !== undefined) {
+        const headers = normalizeHeaders(data.headers);
+        updateData['headers'] = encryptWebhookCredential(JSON.stringify(headers), id, 'headers');
+    }
+    if (data.active !== undefined)
+        updateData['active'] = data.active;
+    if (data.retries !== undefined || data.timeoutMs !== undefined) {
+        const options = normalizeDeliveryOptions(data.retries ?? current.retries, data.timeoutMs ?? current.timeoutMs);
+        updateData['retries'] = options.retries;
+        updateData['timeoutMs'] = options.timeoutMs;
+    }
+    const endpoint = await db.webhookEndpoint.update({ where: { id }, data: updateData });
+    return redactWebhookEndpoint(endpoint);
+}
+export async function deleteWebhookEndpoint(id) {
+    const db = getDb();
+    await db.webhookEndpoint.delete({ where: { id } });
+}
+export async function listDeliveries(endpointId, page = 1, pageSize = 20) {
+    const db = getDb();
+    const skip = (page - 1) * pageSize;
+    const [deliveries, total] = await Promise.all([
+        db.webhookDelivery.findMany({
+            where: { endpointId },
+            orderBy: { createdAt: 'desc' },
+            skip,
+            take: pageSize,
+        }),
+        db.webhookDelivery.count({ where: { endpointId } }),
+    ]);
+    return { deliveries, total };
+}
+export async function testWebhookEndpoint(id) {
+    const db = getDb();
+    const endpoint = await db.webhookEndpoint.findUnique({ where: { id } });
+    if (!endpoint)
+        return { success: false, error: 'Endpoint not found' };
+    try {
+        const testPayload = {
+            event: 'webhook.test',
+            message: 'This is a test webhook delivery from Magnus',
+            timestamp: new Date().toISOString(),
+        };
+        const { body: rawBody, contentType } = formatPayload(endpoint.type, 'webhook.test', JSON.stringify(testPayload));
+        const secret = encryptedSecret(endpoint);
+        const extraHeaders = parseStoredHeaders(endpoint.id, endpoint.headers);
+        const shouldEncrypt = extraHeaders['x-magnus-encrypt'] === 'true';
+        delete extraHeaders['x-magnus-encrypt'];
+        const encrypted = shouldEncrypt && secret !== null && endpoint.type === 'generic';
+        const body = encrypted ? encryptPayload(rawBody, secret) : rawBody;
+        const headers = {
+            ...extraHeaders,
+            'Content-Type': encrypted ? 'application/octet-stream' : contentType,
+            'User-Agent': 'Magnus-Webhook/1.0',
+            'X-Magnus-Event': 'webhook.test',
+            ...(encrypted && { 'X-Magnus-Encrypted': 'aes-256-gcm' }),
+        };
+        if (secret) {
+            headers['X-Magnus-Signature'] = `sha256=${signPayload(body, secret)}`;
+        }
+        const res = await postWebhook(webhookUrl(endpoint), { headers, body, timeoutMs: endpoint.timeoutMs });
+        return { success: res.ok, error: res.ok ? undefined : `HTTP ${res.status}` };
+    }
+    catch (err) {
+        return { success: false, error: err instanceof Error ? err.message : 'Unknown error' };
+    }
+}
+/**
+ * Redeliver a failed webhook delivery by re-enqueuing it.
+ * Returns the new delivery ID, or null if the original delivery was not found.
+ */
+export async function redeliverWebhookDelivery(endpointId, deliveryId) {
+    const db = getDb();
+    const delivery = await db.webhookDelivery.findUnique({
+        where: { id: deliveryId },
+        include: { endpoint: true },
+    });
+    if (!delivery || delivery.endpointId !== endpointId)
+        return null;
+    const ep = delivery.endpoint;
+    // Create a new delivery record for the redeliver attempt
+    const newDelivery = await db.webhookDelivery.create({
+        data: {
+            id: nanoid(),
+            endpointId: ep.id,
+            event: delivery.event,
+            payload: delivery.payload,
+            status: 'pending',
+        },
+    });
+    return newDelivery.id;
+}
+//# sourceMappingURL=webhook-service.js.map

package/dist/types/auth.js

@@ -0,0 +1,3 @@
+// ─── Auth and Audit ───
+export {};
+//# sourceMappingURL=auth.js.map

package/dist/types/index.js

@@ -0,0 +1,3 @@
+// ─── @magnus/contracts — barrel export ───
+export {};
+//# sourceMappingURL=index.js.map

package/dist/types/library.js

@@ -0,0 +1,3 @@
+// ─── Library: local document & asset management ───
+export {};
+//# sourceMappingURL=library.js.map

package/dist/types/notifications.js

@@ -0,0 +1,3 @@
+// ─── Notifications ───
+export {};
+//# sourceMappingURL=notifications.js.map

package/dist/types/roles.js

@@ -0,0 +1,3 @@
+// ─── Roles: reusable node configuration bundles ───
+export {};
+//# sourceMappingURL=roles.js.map

package/dist/types/shared-contracts.js

@@ -0,0 +1,3 @@
+// ─── Local Magnus contracts formerly provided by the retired shared package ───
+export {};
+//# sourceMappingURL=shared-contracts.js.map

package/dist/utils/env.js

@@ -0,0 +1,141 @@
+/**
+ * Centralized, validated environment secrets for control-api.
+ *
+ * Import secrets from this module instead of reading process.env directly.
+ * Secrets are read from process.env at import time. Ensure dotenv has loaded
+ * before any module that imports this is evaluated (use dynamic imports in
+ * the entry point — index.ts already does this).
+ *
+ * At startup, `validateSecrets()` performs both fail-fast missing-secret
+ * checks AND full Zod schema validation via `config/env.ts`.
+ */
+import { loadEnv } from '../config/env.js';
+import { resolveCredentialSecret } from '../services/credential-rotation-service.js';
+// ── Exported resolved secrets ──
+// JWT_SECRET kept for backward-compat with non-IAM environments.
+// When IAM_CORE_URL is set, RS256 tokens from IAM Core are used instead.
+export const JWT_SECRET = process.env['JWT_SECRET'] ?? '';
+export const API_SECRET = process.env['API_SECRET'] ?? '';
+export const NODE_MANAGER_SECRET = process.env['NODE_MANAGER_SECRET'] ?? '';
+export const CONTROL_API_URL = process.env['CONTROL_API_URL'] ?? 'https://localhost:4000';
+export const ENABLE_AGENT_DISCOVERY = (process.env['ENABLE_AGENT_DISCOVERY'] ?? 'false').toLowerCase() === 'true';
+export const AGENT_DISCOVERY_SECRET = process.env['AGENT_DISCOVERY_SECRET'] ?? '';
+/** SHA-256 digest of an optional external collector's read-only bearer token. */
+export const MAGNUS_COLLECTOR_TOKEN_SHA256 = process.env['MAGNUS_COLLECTOR_TOKEN_SHA256'] ?? '';
+/** Dedicated audit-chain HMAC key; deliberately has no master-secret fallback. */
+export const AUDIT_HMAC_SECRET = process.env['AUDIT_HMAC_SECRET'] ?? '';
+/** IAM Core API URL — when set, enables RS256 JWT verification via IAM. */
+export const IAM_CORE_URL = process.env['IAM_CORE_URL'] ?? '';
+/** Exact registered claims required for every IAM access token. */
+export const IAM_TOKEN_ISSUER = process.env['IAM_TOKEN_ISSUER'] ?? '';
+export const IAM_TOKEN_AUDIENCE = process.env['IAM_TOKEN_AUDIENCE'] ?? '';
+/** HMAC secret for verifying agent command result signatures. */
+export const RESULT_SIGNING_SECRET = process.env['RESULT_SIGNING_SECRET'] ?? '';
+/** Optional Control API-only authority for reviewed participant reconciliation. */
+export const RESOURCE_PARTICIPANT_RECONCILIATION_SECRET = process.env['RESOURCE_PARTICIPANT_RECONCILIATION_SECRET'] ?? '';
+/** Optional bounded rollout key; remove after every active agent proves the new signer. */
+export const RESULT_SIGNING_PREVIOUS_SECRET = process.env['RESULT_SIGNING_PREVIOUS_SECRET'] ?? '';
+export const LOG_INGEST_SIGNING_SECRET = process.env['LOG_INGEST_SIGNING_SECRET'] ?? '';
+export const LOG_INGEST_PREVIOUS_SIGNING_SECRET = process.env['LOG_INGEST_PREVIOUS_SIGNING_SECRET'] ?? '';
+/** Dedicated encrypted-rotation store key. */
+export const CREDENTIAL_ROTATION_KEY = process.env['CREDENTIAL_ROTATION_KEY'] ?? '';
+/**
+ * Optional Hermes Agent plugin API. When disabled (the default) plugin
+ * credentials are ignored and the plugin-scoped routes are unreachable.
+ */
+export const MAGNUS_PLUGIN_API_ENABLED = (process.env['MAGNUS_PLUGIN_API_ENABLED'] ?? 'false').toLowerCase() === 'true';
+/** Per-installation SHA-256 digests for read-only Magnus plugins. */
+export const MAGNUS_PLUGIN_READ_TOKEN_DIGESTS_JSON = process.env['MAGNUS_PLUGIN_READ_TOKEN_DIGESTS_JSON'] ?? '{}';
+/** Server-local plugin operator token digest; keep it off every agent host. */
+export const MAGNUS_PLUGIN_OPERATOR_TOKEN_SHA256 = process.env['MAGNUS_PLUGIN_OPERATOR_TOKEN_SHA256'] ?? '';
+/** Plugin read consumer allowed to relay signed team-approval decisions (optional). */
+export const MAGNUS_APPROVAL_BRIDGE_CONSUMER = process.env['MAGNUS_APPROVAL_BRIDGE_CONSUMER'] ?? '';
+/** Purpose-scoped bearer accepted only by the shared-resource lease API. */
+export const MAGNUS_SHARED_RESOURCE_TOKEN_SHA256 = process.env['MAGNUS_SHARED_RESOURCE_TOKEN_SHA256'] ?? '';
+/** Preferred per-client shared-resource bearer digests for exact actor ownership. */
+export const MAGNUS_SHARED_RESOURCE_TOKEN_DIGESTS_JSON = process.env['MAGNUS_SHARED_RESOURCE_TOKEN_DIGESTS_JSON'] ?? '{}';
+export const MAGNUS_FLEET_CHECK_TOKEN_SHA256 = process.env['MAGNUS_FLEET_CHECK_TOKEN_SHA256'] ?? '';
+export const SECURITY_FUSION_RECEIPT_SIGNING_KEY = process.env['SECURITY_FUSION_RECEIPT_SIGNING_KEY'] ?? '';
+/** Security Fusion mode: `off` (default), `local` (in-process) or `remote` (external console). */
+export const SECURITY_FUSION_MODE = process.env['SECURITY_FUSION_MODE'] ?? 'off';
+export const METRICS_TOKEN = process.env['METRICS_TOKEN'] ?? '';
+export const WEBHOOK_ENCRYPTION_KEY = process.env['WEBHOOK_ENCRYPTION_KEY'] ?? '';
+let validatedEnv = null;
+/** Return the single validated runtime configuration consumed by services. */
+export function getValidatedEnv() {
+    validatedEnv ??= loadEnv();
+    return validatedEnv;
+}
+/** Active node-manager secret, including durable rotations. */
+export function getNodeManagerSecret() {
+    return resolveCredentialSecret('NODE_MANAGER_SECRET', NODE_MANAGER_SECRET);
+}
+// ── Startup validation ──
+/**
+ * Return a description of every missing or too-short required secret.
+ * Optional integrations only contribute when their feature is enabled.
+ */
+export function listMissingSecrets() {
+    const missing = [];
+    const usingIam = !!IAM_CORE_URL;
+    if (!usingIam && JWT_SECRET.length < 32)
+        missing.push('JWT_SECRET (dedicated, min 32 chars)');
+    if (usingIam && !IAM_TOKEN_ISSUER)
+        missing.push('IAM_TOKEN_ISSUER');
+    if (usingIam && !IAM_TOKEN_AUDIENCE)
+        missing.push('IAM_TOKEN_AUDIENCE');
+    if (API_SECRET.length < 32)
+        missing.push('API_SECRET (dedicated, min 32 chars)');
+    if (NODE_MANAGER_SECRET.length < 32)
+        missing.push('NODE_MANAGER_SECRET (dedicated, min 32 chars)');
+    if (AUDIT_HMAC_SECRET.length < 32)
+        missing.push('AUDIT_HMAC_SECRET (dedicated, min 32 chars)');
+    if (RESULT_SIGNING_SECRET.length < 32)
+        missing.push('RESULT_SIGNING_SECRET (dedicated, min 32 chars)');
+    if (LOG_INGEST_SIGNING_SECRET.length < 32)
+        missing.push('LOG_INGEST_SIGNING_SECRET (dedicated, min 32 chars)');
+    if (CREDENTIAL_ROTATION_KEY.length < 32)
+        missing.push('CREDENTIAL_ROTATION_KEY (dedicated, min 32 chars)');
+    if (METRICS_TOKEN.length < 32)
+        missing.push('METRICS_TOKEN (dedicated, min 32 chars)');
+    if (WEBHOOK_ENCRYPTION_KEY.length < 32)
+        missing.push('WEBHOOK_ENCRYPTION_KEY (dedicated, min 32 chars)');
+    if (SECURITY_FUSION_MODE === 'local' && SECURITY_FUSION_RECEIPT_SIGNING_KEY.length < 32) {
+        missing.push('SECURITY_FUSION_RECEIPT_SIGNING_KEY (dedicated, min 32 chars; required when SECURITY_FUSION_MODE=local)');
+    }
+    if (MAGNUS_PLUGIN_API_ENABLED && MAGNUS_PLUGIN_READ_TOKEN_DIGESTS_JSON === '{}') {
+        missing.push('MAGNUS_PLUGIN_READ_TOKEN_DIGESTS_JSON (per-installation read credentials; required when MAGNUS_PLUGIN_API_ENABLED=true)');
+    }
+    if (MAGNUS_PLUGIN_API_ENABLED && !/^[a-f0-9]{64}$/.test(MAGNUS_PLUGIN_OPERATOR_TOKEN_SHA256)) {
+        missing.push('MAGNUS_PLUGIN_OPERATOR_TOKEN_SHA256 (server-local operator credential digest; required when MAGNUS_PLUGIN_API_ENABLED=true)');
+    }
+    if (process.env['NODE_ENV'] === 'production' && !process.env['DATABASE_URL']) {
+        missing.push('DATABASE_URL (PostgreSQL connection string; required in production)');
+    }
+    return missing;
+}
+/**
+ * Fail fast if required secrets are missing, then run full Zod validation.
+ * Call once at startup, after dotenv has loaded.
+ * Skipped when NODE_ENV === 'test'.
+ */
+export function validateSecrets() {
+    if (process.env['NODE_ENV'] === 'test')
+        return;
+    const missing = listMissingSecrets();
+    if (missing.length > 0) {
+        const hint = 'Set independent purpose-specific credentials of at least 32 characters; MAGNUS_SECRET is retired';
+        console.error(`\n❌ Missing required secrets: ${missing.join(', ')}\n   ${hint}\n`);
+        process.exit(1);
+    }
+    // Full Zod schema validation — catches type errors, invalid ports, etc.
+    try {
+        getValidatedEnv();
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        console.error(`\n❌ Environment validation failed:\n${message}\n`);
+        process.exit(1);
+    }
+}
+//# sourceMappingURL=env.js.map