@hivemagnus/magnus-server 1.1.13 → 2.0.0

package/dist/security/native-completion-registry.js

@@ -2,6 +2,8 @@ import { createHash } from 'node:crypto';
 export const NATIVE_COMPLETION_REGISTRY = {
     version: 1,
     descriptors: [
+        { id: 'security-response', method: 'POST', pathMatcher: { kind: 'exact', path: '/security-response' },
+            completionMode: 'buffered-synchronous-http', timeoutCeilingSeconds: 120, resourceClassifier: 'node-filesystem' },
         { id: 'file-write', method: 'POST', pathMatcher: { kind: 'exact', path: '/files/write' },
             completionMode: 'buffered-synchronous-http', timeoutCeilingSeconds: 3600, resourceClassifier: 'node-filesystem' },
         { id: 'skill-install', method: 'POST', pathMatcher: { kind: 'exact', path: '/skills/install' },
@@ -43,4 +45,14 @@ export function nativeCompletionResourceKey(descriptor, nodeId) {
         throw new Error('Native completion resource cannot be classified');
     return descriptor.resourceClassifier === 'node-ardent' ? `node:${nodeId}:ardent` : `node:${nodeId}`;
 }
+/** Preserve settlement of pre-extraction leases without granting the new response boundary retroactively. */
+export function knownNativeCompletionIdentity(version, sha256, descriptorId) {
+    if (version !== 1 || !descriptorId)
+        return false;
+    const descriptor = NATIVE_COMPLETION_REGISTRY.descriptors.find(item => item.id === descriptorId);
+    if (!descriptor)
+        return false;
+    return sha256 === NATIVE_COMPLETION_REGISTRY_SHA256 || (descriptorId !== 'security-response'
+        && sha256 === 'b0f05a1eac40dba262ec5ff0cc0de8d2b7c9f119a6a2d7ed3a00d94dcb6b1d3d');
+}
 //# sourceMappingURL=native-completion-registry.js.map

package/dist/server.js

@@ -1,8 +1,8 @@
+import { cindertraceResponseRouter } from './routes/cindertrace-response.js';
 import { resourceLeasesRouter } from './routes/resource-leases.js';
 import { sharedResourceLeasesRouter } from './routes/shared-resource-leases.js';
 import { securityBackupRouter } from './routes/security-backup.js';
 import { securityIntegrationRouter } from './routes/security-integration.js';
-import { securityConsoleUrl, securityFusionMode } from './services/security-export.js';
 import { Hono } from 'hono';
 import { cors } from 'hono/cors';
 import { logger } from 'hono/logger';
@@ -85,6 +85,7 @@ app.use('/api/v1/*', requestLogger);
 app.use('/api/v1/security-fusion/ingest/events', bodyLimitMiddleware(Math.min(Math.max(Number(process.env['SECURITY_FUSION_INGEST_MAX_BYTES']) || 262_144, 1), 262_144)));
 app.use('/api/v1/security-fusion/ingest/source-status', bodyLimitMiddleware(32_768));
 app.route('/api/v1/security-integration/backups', securityBackupRouter);
+app.use('/api/v1/security-integration/response/*', bodyLimitMiddleware(16_384));
 app.use('/api/v1/*', async (c, next) => {
     const limit = c.req.path === '/api/v1/hermes-registry/capture' || c.req.path === '/api/v1/hermes-registry/revisions'
         ? 4_500_000 : Number(process.env['API_BODY_LIMIT_BYTES'] ?? 1_048_576);
@@ -159,20 +160,8 @@ v1.route('/assistant', assistantRouter);
 v1.route('/events/stream', eventsStreamRouter);
 v1.route('/ops', opsRouter);
 v1.route('/mcp', mcpRouter);
+v1.route('/security-integration/response', cindertraceResponseRouter);
 v1.route('/security-integration', securityIntegrationRouter);
-v1.use('/security-fusion/*', async (c, next) => {
-    const mode = securityFusionMode();
-    if (mode === 'remote') {
-        const url = securityConsoleUrl();
-        return c.json({ success: false, error: { code: 'SECURITY_FUSION_MOVED',
-                message: 'Security Fusion is served by the external security console', ...(url ? { url } : {}) } }, 410);
-    }
-    if (mode === 'off') {
-        return c.json({ success: false, error: { code: 'SECURITY_FUSION_DISABLED',
-                message: 'Security Fusion is disabled; set SECURITY_FUSION_MODE=local or remote to enable it' } }, 404);
-    }
-    await next();
-});
 v1.route('/security-fusion', securityFusionRouter);
 app.route('/api/v1', v1);
 // ── API documentation (Swagger UI + OpenAPI spec) ──

package/dist/services/command-resource-leases.js

@@ -17,7 +17,7 @@ import { RESULT_SIGNING_SECRET, RESULT_SIGNING_PREVIOUS_SECRET } from '../utils/
 import { getNodeBaseUrl } from '../utils/node-url.js';
 import { COMMAND_COMPLETION_REGISTRY, COMMAND_COMPLETION_REGISTRY_SHA256, commandCompletionDescriptor } from '../security/command-completion-registry.js';
 import { MANAGED_HTTP_COMMAND } from '../security/managed-http.js';
-import { NATIVE_COMPLETION_REGISTRY, NATIVE_COMPLETION_REGISTRY_SHA256, nativeCompletionDescriptor, nativeCompletionResourceKey } from '../security/native-completion-registry.js';
+import { NATIVE_COMPLETION_REGISTRY, NATIVE_COMPLETION_REGISTRY_SHA256, nativeCompletionDescriptor, nativeCompletionResourceKey, knownNativeCompletionIdentity } from '../security/native-completion-registry.js';
 import { logAuditEvent } from './audit-service.js';
 const HELD = ['reserved', 'running', 'unknown'];
 export class ResourceLeaseConflict extends HttpError {
@@ -382,9 +382,7 @@ export async function settleResourceResult(commandId, result) {
         && row.completionRegistrySha256 === COMMAND_COMPLETION_REGISTRY_SHA256
         && COMMAND_COMPLETION_REGISTRY.descriptors.some(descriptor => descriptor.id === row.completionDescriptorId);
     const native = row.completionClass === 'native-http'
-        && row.completionRegistryVersion === NATIVE_COMPLETION_REGISTRY.version
-        && row.completionRegistrySha256 === NATIVE_COMPLETION_REGISTRY_SHA256
-        && NATIVE_COMPLETION_REGISTRY.descriptors.some(descriptor => descriptor.id === row.completionDescriptorId);
+        && knownNativeCompletionIdentity(row.completionRegistryVersion, row.completionRegistrySha256, row.completionDescriptorId);
     const scheduler = row.completionClass === 'managed-scheduler'
         && /^[a-f0-9]{64}$/.test(row.completionOccurrenceId ?? '')
         && /^[a-f0-9]{64}$/.test(row.completionSpecSha256 ?? '')

package/dist/services/security-export.js

@@ -1,19 +1,17 @@
 import { createHash, createHmac, randomBytes } from 'node:crypto';
 import { getDb } from '../db/index.js';
 import { incMetric, setMetricGauge } from '../routes/metrics.js';
-/** Security Fusion is optional: `off` unless explicitly set to `local` or `remote`. */
+/** Security Fusion is optional: `off` unless explicitly set to `remote`. */
 export function securityFusionMode() {
     const mode = process.env['SECURITY_FUSION_MODE'];
-    return mode === 'local' || mode === 'remote' ? mode : 'off';
+    if (mode === 'local')
+        throw new Error('Embedded Security Fusion is retired. Export its state with the Cindertrace migration tool, verify the import, then configure SECURITY_FUSION_MODE=remote. See docs/CINDERTRACE_MIGRATION.md');
+    return mode === 'remote' ? mode : 'off';
 }
 /** Observations are exported to an external security console. */
 export function securityFusionRemote() {
     return securityFusionMode() === 'remote';
 }
-/** Security Fusion cases, evidence and receipts are kept in this server's database. */
-export function securityFusionLocal() {
-    return securityFusionMode() === 'local';
-}
 /** Optional external security console URL shown to operators in remote mode. */
 export function securityConsoleUrl() {
     const raw = process.env['MAGNUS_SECURITY_CONSOLE_URL'];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hivemagnus/magnus-server",
-  "version": "1.1.13",
+  "version": "2.0.0",
   "description": "Magnus server: the fleet control plane API (Hono, PostgreSQL, Redis) for nodes running magnus-agent, with optional Hive IAM, Hive Router, HiveMem, Hermes Agent and external security console integrations.",
   "keywords": [
     "magnus",
@@ -84,7 +84,7 @@
     "prepublishOnly": "npm run db:generate && npm run clean && npm run build"
   },
   "dependencies": {
-    "@hivemagnus/magnus-contracts": "1.1.13",
+    "@hivemagnus/magnus-contracts": "2.0.0",
     "@hono/node-server": "^2.1.5",
     "@hono/swagger-ui": "^0.6.2",
     "@prisma/adapter-pg": "7.10.1",
@@ -102,7 +102,7 @@
     "ws": "^8.22.0",
     "yaml": "2.9.1",
     "zod": "^4.6.7",
-    "@hivemagnus/magnus-skills": "1.1.13",
+    "@hivemagnus/magnus-skills": "2.0.0",
     "prisma": "^7.10.1"
   },
   "devDependencies": {

package/prisma/migrations/20261103000000_cindertrace_response_bridge/migration-impact.json

@@ -0,0 +1,128 @@
+{
+  "schemaVersion": 1,
+  "migration": "20261103000000_cindertrace_response_bridge",
+  "classification": "schema-only",
+  "effects": [
+    {
+      "table": "cindertrace_responses",
+      "operation": "create-empty-table",
+      "expectedRows": 0
+    }
+  ],
+  "schemaEffects": [
+    {
+      "type": "column",
+      "identity": "public.cindertrace_responses.actionOperation",
+      "operation": "create",
+      "afterSha256": "457481149eb42973ffc9ff8d2ef366d76f86c86b67060944b7ed71e7fade4dee"
+    },
+    {
+      "type": "column",
+      "identity": "public.cindertrace_responses.createdAt",
+      "operation": "create",
+      "afterSha256": "c738ae7d397b6458fb77e1a5c5d0e45c176da1f1b23dff5c8e0287ac32657cfb"
+    },
+    {
+      "type": "column",
+      "identity": "public.cindertrace_responses.id",
+      "operation": "create",
+      "afterSha256": "457481149eb42973ffc9ff8d2ef366d76f86c86b67060944b7ed71e7fade4dee"
+    },
+    {
+      "type": "column",
+      "identity": "public.cindertrace_responses.nodeId",
+      "operation": "create",
+      "afterSha256": "457481149eb42973ffc9ff8d2ef366d76f86c86b67060944b7ed71e7fade4dee"
+    },
+    {
+      "type": "column",
+      "identity": "public.cindertrace_responses.requestJson",
+      "operation": "create",
+      "afterSha256": "457481149eb42973ffc9ff8d2ef366d76f86c86b67060944b7ed71e7fade4dee"
+    },
+    {
+      "type": "column",
+      "identity": "public.cindertrace_responses.requestSha256",
+      "operation": "create",
+      "afterSha256": "457481149eb42973ffc9ff8d2ef366d76f86c86b67060944b7ed71e7fade4dee"
+    },
+    {
+      "type": "column",
+      "identity": "public.cindertrace_responses.responseJson",
+      "operation": "create",
+      "afterSha256": "2a7dfe10f0d53943c328aa5aff320e3d46ef00ea7e9a6e1185909912cc2b4b49"
+    },
+    {
+      "type": "column",
+      "identity": "public.cindertrace_responses.status",
+      "operation": "create",
+      "afterSha256": "222458c4b395fd8478e5c334ec5485250ada4b47e6f57591e7c030d65834bf8a"
+    },
+    {
+      "type": "constraint",
+      "identity": "public.cindertrace_responses.cindertrace_responses_actionOperation_not_null",
+      "operation": "create",
+      "afterSha256": "8183f6cdc869d43ebb2f34fe24a356b179b2c82be296b0dc164e16a28b51ed0e"
+    },
+    {
+      "type": "constraint",
+      "identity": "public.cindertrace_responses.cindertrace_responses_createdAt_not_null",
+      "operation": "create",
+      "afterSha256": "217cb343ac8189a729cd1f07d448627a4ae74f8afdb99362b2e3ce0097372798"
+    },
+    {
+      "type": "constraint",
+      "identity": "public.cindertrace_responses.cindertrace_responses_id_not_null",
+      "operation": "create",
+      "afterSha256": "e7b643243977e7692df3d6151aecafb3ee916f1612593c7c35b0272fb315a145"
+    },
+    {
+      "type": "constraint",
+      "identity": "public.cindertrace_responses.cindertrace_responses_nodeId_not_null",
+      "operation": "create",
+      "afterSha256": "ff5bd491bcd090deecd11bc37c2de364b38abe9277d34f7a6acacf7cfe9c5515"
+    },
+    {
+      "type": "constraint",
+      "identity": "public.cindertrace_responses.cindertrace_responses_pkey",
+      "operation": "create",
+      "afterSha256": "660693e78c67ae23c6f23d327b4747fdcae396a2df9561bf5378c3169d0e9644"
+    },
+    {
+      "type": "constraint",
+      "identity": "public.cindertrace_responses.cindertrace_responses_requestJson_not_null",
+      "operation": "create",
+      "afterSha256": "75d1cc8be180d0f79c7b7524765de3939264fe158a1677ef9d876dfd7baebdef"
+    },
+    {
+      "type": "constraint",
+      "identity": "public.cindertrace_responses.cindertrace_responses_requestSha256_not_null",
+      "operation": "create",
+      "afterSha256": "76fc856b52c0d2b2ba3d3a3199e82079d108fd73840a75bd8b94e3e71119d451"
+    },
+    {
+      "type": "constraint",
+      "identity": "public.cindertrace_responses.cindertrace_responses_status_not_null",
+      "operation": "create",
+      "afterSha256": "f7237f3a7c1ae5d7fa369cffdbd200e599219726332e0882a791a2c78de56f36"
+    },
+    {
+      "type": "index",
+      "identity": "public.cindertrace_responses_actionOperation_key",
+      "operation": "create",
+      "afterSha256": "9c4741fba6da61618aec19957c4dedbd66767cb7a40200b798026e58a5b27bdd"
+    },
+    {
+      "type": "index",
+      "identity": "public.cindertrace_responses_pkey",
+      "operation": "create",
+      "afterSha256": "3a9cc34672b45d3dcc05d7f6760ffce281eec29f433711982e6cadd460d79f27"
+    },
+    {
+      "type": "table",
+      "identity": "public.cindertrace_responses",
+      "operation": "create",
+      "afterSha256": "577938e54f94a986377167fe24c850e59d65f8ec8df6eb9c8059bde0c3e156d2"
+    }
+  ]
+}

package/prisma/migrations/20261103000000_cindertrace_response_bridge/migration.sql

@@ -0,0 +1,6 @@
+CREATE TABLE "cindertrace_responses" (
+ "id" TEXT NOT NULL PRIMARY KEY, "actionOperation" TEXT NOT NULL, "nodeId" TEXT NOT NULL,
+ "requestSha256" TEXT NOT NULL, "requestJson" TEXT NOT NULL, "status" TEXT NOT NULL DEFAULT 'claimed',
+ "responseJson" TEXT, "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE UNIQUE INDEX "cindertrace_responses_actionOperation_key" ON "cindertrace_responses"("actionOperation");

package/prisma/schema.prisma

@@ -2183,3 +2183,16 @@ model ManagedCronOccurrence {
   @@index([nodeId, state])
   @@map("managed_cron_occurrences")
 }
+
+/// Narrow Cindertrace bridge ledger; never replays an uncertain response.
+model CindertraceResponse {
+  id String @id
+  actionOperation String @unique
+  nodeId String
+  requestSha256 String
+  requestJson String
+  status String @default("claimed")
+  responseJson String?
+  createdAt DateTime @default(now())
+  @@map("cindertrace_responses")
+}

package/dist/services/security-fusion-actions.js

@@ -1,22 +0,0 @@
-export const SECURITY_FUSION_ACTION_TRANSITIONS = {
-    previewed: ['pending_approval', 'cancelled'],
-    pending_approval: ['dispatch_pending', 'rejected', 'cancelled'],
-    dispatch_pending: ['executing', 'verifying', 'succeeded', 'failed'],
-    executing: ['verifying', 'succeeded', 'failed', 'release_pending'],
-    verifying: ['succeeded', 'failed'],
-    succeeded: ['release_pending'],
-    release_pending: ['releasing', 'released', 'failed'],
-    releasing: ['released', 'failed'],
-    rejected: [],
-    cancelled: [],
-    failed: [],
-    released: [],
-};
-export function canTransitionSecurityFusionAction(from, to) {
-    return SECURITY_FUSION_ACTION_TRANSITIONS[from].includes(to);
-}
-export function securityFusionActionSources(to) {
-    return Object.keys(SECURITY_FUSION_ACTION_TRANSITIONS)
-        .filter((from) => canTransitionSecurityFusionAction(from, to));
-}
-//# sourceMappingURL=security-fusion-actions.js.map

package/dist/services/security-fusion-evidence-integrity.js

@@ -1,144 +0,0 @@
-import { createHash } from 'node:crypto';
-import { createReadStream } from 'node:fs';
-import { lstat, mkdir, rename } from 'node:fs/promises';
-import { basename, isAbsolute, join, relative, resolve } from 'node:path';
-import { getDb } from '../db/index.js';
-import { setMetricGauge } from '../routes/metrics.js';
-function evidenceBase() {
-    return resolve(process.env['SECURITY_FUSION_EVIDENCE_DIR'] ?? './state/security-fusion/evidence');
-}
-function pathInside(base, candidate) {
-    const rel = relative(base, resolve(candidate));
-    return rel.length > 0 && !rel.startsWith('..') && !isAbsolute(rel);
-}
-async function hashFile(path) {
-    const hash = createHash('sha256');
-    await new Promise((resolvePromise, reject) => {
-        const stream = createReadStream(path);
-        stream.on('data', (chunk) => hash.update(chunk));
-        stream.on('error', reject);
-        stream.on('end', resolvePromise);
-    });
-    return hash.digest('hex');
-}
-export async function ensurePrivateEvidenceDirectory(path) {
-    await mkdir(path, { recursive: true, mode: 0o700 });
-    const info = await lstat(path);
-    const expectedUid = typeof process.geteuid === 'function' ? process.geteuid() : info.uid;
-    if (!info.isDirectory() || info.isSymbolicLink()
-        || info.uid !== expectedUid || (info.mode & 0o077) !== 0) {
-        throw new Error(`Security Fusion evidence directory is unsafe: ${path}`);
-    }
-}
-async function quarantineEvidence(row, status, reason, actualBytes) {
-    const base = evidenceBase();
-    let storagePath = row.storagePath;
-    if (status === 'quarantined_hash_mismatch' && pathInside(base, row.storagePath)) {
-        const quarantineDir = join(base, 'quarantine');
-        await ensurePrivateEvidenceDirectory(quarantineDir);
-        const target = join(quarantineDir, `${row.id}.${basename(row.storagePath)}`);
-        await rename(row.storagePath, target);
-        storagePath = target;
-    }
-    await getDb().securityFusionEvidence.update({
-        where: { id: row.id },
-        data: {
-            byteSize: actualBytes,
-            integrityStatus: status,
-            quarantinedAt: new Date(),
-            quarantineReason: reason,
-            storagePath,
-        },
-    });
-}
-/**
- * Reconcile every retained artifact before byte admission and retention start.
- * Missing, unsafe, non-regular, and hash-mismatched evidence remains recorded
- * but is quarantined from normal evidence use.
- */
-export async function reconcileSecurityFusionEvidence() {
-    const base = evidenceBase();
-    await ensurePrivateEvidenceDirectory(base);
-    const mismatchedCases = new Set();
-    let checked = 0;
-    let updated = 0;
-    let quarantined = 0;
-    let cursor;
-    while (true) {
-        const rows = await getDb().securityFusionEvidence.findMany({
-            select: {
-                id: true,
-                caseId: true,
-                sha256: true,
-                storagePath: true,
-                byteSize: true,
-                integrityStatus: true,
-            },
-            orderBy: { id: 'asc' },
-            take: 250,
-            ...(cursor ? { cursor: { id: cursor }, skip: 1 } : {}),
-        });
-        for (const row of rows) {
-            checked += 1;
-            if (row.integrityStatus.startsWith('quarantined_')) {
-                mismatchedCases.add(row.caseId);
-                quarantined += 1;
-                continue;
-            }
-            if (!pathInside(base, row.storagePath)) {
-                mismatchedCases.add(row.caseId);
-                quarantined += 1;
-                await quarantineEvidence(row, 'quarantined_unsafe_path', 'storage path is outside the evidence root', row.byteSize);
-                continue;
-            }
-            let info;
-            try {
-                info = await lstat(row.storagePath);
-            }
-            catch (error) {
-                if (error.code !== 'ENOENT')
-                    throw error;
-                mismatchedCases.add(row.caseId);
-                quarantined += 1;
-                await quarantineEvidence(row, 'quarantined_missing', 'retained evidence file is missing', 0);
-                continue;
-            }
-            if (!info.isFile() || info.isSymbolicLink()) {
-                mismatchedCases.add(row.caseId);
-                quarantined += 1;
-                await quarantineEvidence(row, 'quarantined_unsafe_file', 'retained evidence is not a regular file', row.byteSize);
-                continue;
-            }
-            const actualBytes = info.size;
-            const actualSha256 = await hashFile(row.storagePath);
-            if (actualBytes !== row.byteSize)
-                mismatchedCases.add(row.caseId);
-            if (actualSha256 !== row.sha256) {
-                mismatchedCases.add(row.caseId);
-                quarantined += 1;
-                await quarantineEvidence(row, 'quarantined_hash_mismatch', 'retained evidence hash does not match its manifest', actualBytes);
-                continue;
-            }
-            if (actualBytes !== row.byteSize)
-                updated += 1;
-            await getDb().securityFusionEvidence.update({
-                where: { id: row.id },
-                data: {
-                    byteSize: actualBytes,
-                    integrityStatus: 'verified',
-                    quarantinedAt: null,
-                    quarantineReason: null,
-                },
-            });
-        }
-        if (rows.length < 250)
-            break;
-        cursor = rows.at(-1)?.id;
-        if (!cursor)
-            break;
-    }
-    setMetricGauge('securityFusionEvidenceReconciliationMismatchedCases', mismatchedCases.size);
-    setMetricGauge('securityFusionEvidenceQuarantinedArtifacts', quarantined);
-    return { checked, updated, quarantined, mismatchedCases: mismatchedCases.size };
-}
-//# sourceMappingURL=security-fusion-evidence-integrity.js.map

package/dist/services/security-fusion-ingest.js

@@ -1,101 +0,0 @@
-import { createHash } from 'node:crypto';
-import { securityFusionSourceSchema } from '@hivemagnus/magnus-contracts';
-import { HttpError } from '../middleware/error-handler.js';
-export const SECURITY_FUSION_MAX_BATCH_BYTES = 262_144;
-export const SECURITY_FUSION_MAX_EVENT_BYTES = 32_768;
-export const SECURITY_FUSION_MAX_EVENTS = 100;
-export const SECURITY_FUSION_MAX_NESTING_DEPTH = 8;
-function sources(value) {
-    const candidates = Array.isArray(value)
-        ? value
-        : typeof value === 'string'
-            ? value.split(',').map((item) => item.trim()).filter(Boolean)
-            : [];
-    const parsed = securityFusionSourceSchema.array().min(1).safeParse(candidates);
-    if (!parsed.success)
-        throw new Error('collector allowedSources must contain recognized Security Fusion sources');
-    return [...new Set(parsed.data)];
-}
-export function configuredCollectorCredentials(env = process.env) {
-    const credentials = new Map();
-    const encoded = env['SECURITY_FUSION_COLLECTOR_CREDENTIALS_JSON'];
-    if (encoded) {
-        const value = JSON.parse(encoded);
-        if (!value || typeof value !== 'object' || Array.isArray(value)) {
-            throw new Error('SECURITY_FUSION_COLLECTOR_CREDENTIALS_JSON must be an object');
-        }
-        for (const [collectorId, raw] of Object.entries(value)) {
-            if (!/^[a-zA-Z0-9._:-]{1,160}$/u.test(collectorId)) {
-                throw new Error('collector IDs must be 1-160 safe identifier characters');
-            }
-            const config = typeof raw === 'string' ? { secret: raw } : raw;
-            if (!config || typeof config !== 'object' || typeof config['secret'] !== 'string' || config['secret'].length < 16) {
-                throw new Error(`collector ${collectorId} must have a secret of at least 16 characters`);
-            }
-            credentials.set(collectorId, {
-                collectorId,
-                secret: config['secret'],
-                allowedSources: sources(config['allowedSources'] ?? securityFusionSourceSchema.options),
-                displayName: typeof config['displayName'] === 'string' ? config['displayName'] : collectorId,
-                schemaVersion: '1.0',
-                dataClassification: typeof config['dataClassification'] === 'string'
-                    ? config['dataClassification']
-                    : 'restricted',
-            });
-        }
-    }
-    const legacySecret = env['SECURITY_FUSION_INGEST_SECRET'];
-    if (legacySecret) {
-        const collectorId = env['SECURITY_FUSION_COLLECTOR_ID'] ?? 'magnus-security-collector';
-        if (!/^[a-zA-Z0-9._:-]{1,160}$/u.test(collectorId) || legacySecret.length < 16) {
-            throw new Error('legacy collector ID or credential is invalid');
-        }
-        if (!credentials.has(collectorId)) {
-            credentials.set(collectorId, {
-                collectorId,
-                secret: legacySecret,
-                allowedSources: sources(env['SECURITY_FUSION_COLLECTOR_ALLOWED_SOURCES'] ?? securityFusionSourceSchema.options),
-                displayName: collectorId,
-                schemaVersion: '1.0',
-                dataClassification: env['SECURITY_FUSION_DATA_CLASSIFICATION'] ?? 'restricted',
-            });
-        }
-    }
-    return credentials;
-}
-export function collectorCredentialFingerprint(secret) {
-    return createHash('sha256').update(secret).digest('hex').slice(0, 16);
-}
-function assertDepth(value, depth) {
-    if (depth > SECURITY_FUSION_MAX_NESTING_DEPTH) {
-        throw new HttpError(400, 'INGEST_NESTING_TOO_DEEP', 'Event nesting exceeds the permitted depth');
-    }
-    if (Array.isArray(value)) {
-        for (const item of value)
-            assertDepth(item, depth + 1);
-    }
-    else if (value !== null && typeof value === 'object') {
-        for (const item of Object.values(value))
-            assertDepth(item, depth + 1);
-    }
-}
-export function validateSecurityFusionBatchEnvelope(value, rawBytes) {
-    if (rawBytes > SECURITY_FUSION_MAX_BATCH_BYTES) {
-        throw new HttpError(413, 'PAYLOAD_TOO_LARGE', 'Security Fusion batch exceeds the byte limit');
-    }
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return;
-    const events = value['events'];
-    if (!Array.isArray(events))
-        return;
-    if (events.length > SECURITY_FUSION_MAX_EVENTS) {
-        throw new HttpError(400, 'INGEST_EVENT_LIMIT', `A batch may contain at most ${SECURITY_FUSION_MAX_EVENTS} events`);
-    }
-    for (const event of events) {
-        assertDepth(event, 1);
-        if (Buffer.byteLength(JSON.stringify(event), 'utf8') > SECURITY_FUSION_MAX_EVENT_BYTES) {
-            throw new HttpError(400, 'INGEST_EVENT_TOO_LARGE', 'An individual event exceeds the byte limit');
-        }
-    }
-}
-//# sourceMappingURL=security-fusion-ingest.js.map