@hivemagnus/magnus-server 1.1.13 → 2.1.0

package/dist/db/generated/prisma/internal/prismaNamespace.js

@@ -69,6 +69,7 @@ export const AnyNull = runtime.AnyNull;
 export const ModelName = {
     MagnusReleaseCanary: 'MagnusReleaseCanary',
     User: 'User',
+    ProductInitialization: 'ProductInitialization',
     Node: 'Node',
     ArdentInstallation: 'ArdentInstallation',
     ArdentProfile: 'ArdentProfile',
@@ -172,7 +173,8 @@ export const ModelName = {
     ResourceDrainParticipant: 'ResourceDrainParticipant',
     ResourceParticipantWork: 'ResourceParticipantWork',
     ManagedCronDefinition: 'ManagedCronDefinition',
-    ManagedCronOccurrence: 'ManagedCronOccurrence'
+    ManagedCronOccurrence: 'ManagedCronOccurrence',
+    CindertraceResponse: 'CindertraceResponse'
 };
 /**
  * Enums
@@ -201,6 +203,10 @@ export const UserScalarFieldEnum = {
     createdAt: 'createdAt',
     updatedAt: 'updatedAt'
 };
+export const ProductInitializationScalarFieldEnum = {
+    id: 'id',
+    completedAt: 'completedAt'
+};
 export const NodeScalarFieldEnum = {
     id: 'id',
     name: 'name',
@@ -1582,6 +1588,16 @@ export const ManagedCronOccurrenceScalarFieldEnum = {
     admissionJson: 'admissionJson',
     createdAt: 'createdAt'
 };
+export const CindertraceResponseScalarFieldEnum = {
+    id: 'id',
+    actionOperation: 'actionOperation',
+    nodeId: 'nodeId',
+    requestSha256: 'requestSha256',
+    requestJson: 'requestJson',
+    status: 'status',
+    responseJson: 'responseJson',
+    createdAt: 'createdAt'
+};
 export const SortOrder = {
     asc: 'asc',
     desc: 'desc'

package/dist/db/generated/prisma/internal/prismaNamespaceBrowser.js

@@ -41,6 +41,7 @@ export const AnyNull = runtime.AnyNull;
 export const ModelName = {
     MagnusReleaseCanary: 'MagnusReleaseCanary',
     User: 'User',
+    ProductInitialization: 'ProductInitialization',
     Node: 'Node',
     ArdentInstallation: 'ArdentInstallation',
     ArdentProfile: 'ArdentProfile',
@@ -144,7 +145,8 @@ export const ModelName = {
     ResourceDrainParticipant: 'ResourceDrainParticipant',
     ResourceParticipantWork: 'ResourceParticipantWork',
     ManagedCronDefinition: 'ManagedCronDefinition',
-    ManagedCronOccurrence: 'ManagedCronOccurrence'
+    ManagedCronOccurrence: 'ManagedCronOccurrence',
+    CindertraceResponse: 'CindertraceResponse'
 };
 /*
  * Enums
@@ -173,6 +175,10 @@ export const UserScalarFieldEnum = {
     createdAt: 'createdAt',
     updatedAt: 'updatedAt'
 };
+export const ProductInitializationScalarFieldEnum = {
+    id: 'id',
+    completedAt: 'completedAt'
+};
 export const NodeScalarFieldEnum = {
     id: 'id',
     name: 'name',
@@ -1554,6 +1560,16 @@ export const ManagedCronOccurrenceScalarFieldEnum = {
     admissionJson: 'admissionJson',
     createdAt: 'createdAt'
 };
+export const CindertraceResponseScalarFieldEnum = {
+    id: 'id',
+    actionOperation: 'actionOperation',
+    nodeId: 'nodeId',
+    requestSha256: 'requestSha256',
+    requestJson: 'requestJson',
+    status: 'status',
+    responseJson: 'responseJson',
+    createdAt: 'createdAt'
+};
 export const SortOrder = {
     asc: 'asc',
     desc: 'desc'

package/dist/db/generated/prisma/models/CindertraceResponse.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=CindertraceResponse.js.map

package/dist/db/generated/prisma/models/ProductInitialization.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ProductInitialization.js.map

package/dist/db/read-retry.js

@@ -29,7 +29,11 @@ export async function withReadRetry(label, fn, opts = {}) {
             await sleep(baseDelayMs * attempt);
         }
     }
+    // An error that retrying cannot help is not an outage: keep it, so its handler can classify it.
+    if (!isTransientReadError(lastErr))
+        throw lastErr;
     const message = lastErr instanceof Error ? lastErr.message : String(lastErr);
-    throw new Error(`${label} failed after ${attempts} read attempts: ${message}`);
+    console.error(`[db] ${label} failed after ${attempts} read attempts: ${message}`);
+    throw Object.assign(new Error('The database is temporarily unavailable. Try again shortly.'), { status: 503, code: 'DATABASE_UNAVAILABLE' });
 }
 //# sourceMappingURL=read-retry.js.map

package/dist/db/seed.js

@@ -18,6 +18,14 @@ async function hashPassword(password) {
 }
 /** Idempotently create the system actor, sentinel nodes and library content. */
 export async function seedDatabase(prisma, log = console.log) {
+    await prisma.$transaction(async (transaction) => {
+        await seedBaseData(transaction, log);
+        await transaction.productInitialization.upsert({
+            where: { id: 'base-data-v1' }, update: {}, create: { id: 'base-data-v1' },
+        });
+    }, { timeout: 60_000 });
+}
+async function seedBaseData(prisma, log) {
     log('🌱 Seeding database…');
     // ── System user (used by API-secret / agent auth) ──
     let systemUser = await prisma.user.findUnique({ where: { id: 'system' } });

package/dist/index.js

@@ -4,6 +4,7 @@ import { fileURLToPath } from 'url';
 import { readFileSync, existsSync } from 'node:fs';
 import { createServer } from 'node:https';
 import { resolveListenerSecurity } from './config/listener-security.js';
+import { rehearsalEnabled, startLiveBackgroundServices } from './config/rehearsal.js';
 // Load the env file before any other imports read process.env. The CLI passes
 // `--env-file` through MAGNUS_ENV_FILE; otherwise the package-level .env is used
 // when present. Variables already set in the environment always win.
@@ -11,10 +12,11 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 const envFile = process.env['MAGNUS_ENV_FILE'] ? resolve(process.env['MAGNUS_ENV_FILE']) : resolve(__dirname, '../.env');
 if (existsSync(envFile))
     config({ path: envFile, quiet: true });
+rehearsalEnabled(); // Invalid safety flags fail before opening any listener.
 // Validate required secrets before starting anything
 const { validateSecrets } = await import('./utils/env.js');
 validateSecrets();
-const { securityFusionLocal, securityFusionMode, startSecurityExporter, stopSecurityExporter } = await import('./services/security-export.js');
+const { securityFusionMode, startSecurityExporter, stopSecurityExporter } = await import('./services/security-export.js');
 const { featureFlags } = await import('./config/features.js');
 const { serve } = await import('@hono/node-server');
 const { app } = await import('./server.js');
@@ -30,9 +32,6 @@ const { stopLogRetention } = await import('./services/log-retention.js');
 const { startHealthRetention } = await import('./services/health-retention.js');
 const { stopHealthRetention } = await import('./services/health-retention.js');
 const { startNotificationRetention, stopNotificationRetention } = await import('./services/notification-retention.js');
-const { startSecurityFusionRetention, stopSecurityFusionRetention } = await import('./services/security-fusion-service.js');
-const { reconcileSecurityFusionEvidence } = await import('./services/security-fusion-evidence-integrity.js');
-const { startSecurityFusionOutboxDispatcher, stopSecurityFusionOutboxDispatcher, } = await import('./services/security-fusion-outbox.js');
 const { startCommandWorker, closeCommandQueue } = await import('./queue/workers.js');
 const { startUpdateCheck, stopUpdateCheck } = await import('./services/update-check-service.js');
 const { startWebhookWorker, closeWebhookQueue } = await import('./services/webhook-service.js');
@@ -47,38 +46,32 @@ const port = Number(process.env['CONTROL_API_PORT'] ?? 4000);
 const features = featureFlags();
 console.log(`[startup] security-fusion=${securityFusionMode()} hermes-registry=${features.hermesRegistry ? 'on' : 'off'} `
     + `plugin-api=${features.pluginApi ? 'on' : 'off'} iam=${features.iam ? 'on' : 'off'}`);
-if (securityFusionLocal()) {
-    const evidenceReconciliation = await reconcileSecurityFusionEvidence();
-    console.log(`[security-fusion] evidence reconciliation checked=${evidenceReconciliation.checked} `
-        + `updated=${evidenceReconciliation.updated} quarantined=${evidenceReconciliation.quarantined} `
-        + `mismatched_cases=${evidenceReconciliation.mismatchedCases}`);
-}
 const { writeRuntimeFile } = await import('./utils/runtime-file.js');
 const { CONTROL_API_VERSION } = await import('./config/version.js');
 /** Background services shared by the TLS and development listeners. */
 function startBackgroundServices(listenPort) {
-    writeRuntimeFile({ version: CONTROL_API_VERSION, port: listenPort, host: listener.hostname });
-    startNodeIssueMonitor();
-    startUpgradeReadinessMonitor();
-    startApplicationProbes();
-    startLogRetention();
-    startHealthRetention();
-    startNotificationRetention();
-    if (securityFusionLocal()) {
-        startSecurityFusionRetention();
-        startSecurityFusionOutboxDispatcher();
-    }
-    startSecurityExporter();
-    startCommandWorker();
-    startRolloutReconciler();
-    startWebhookWorker();
-    startCodexFleetMonitor();
-    startUpdateCheck();
-    if (features.hermesRegistry) {
-        startExtensionSourceMonitor();
-        void importPackageSkills().then(result => console.log(`[hermes-registry] catalog import: ${JSON.stringify(result)}`))
-            .catch(error => console.error('[hermes-registry] catalog import failed', error));
-    }
+    const started = startLiveBackgroundServices(() => {
+        writeRuntimeFile({ version: CONTROL_API_VERSION, port: listenPort, host: listener.hostname });
+        startNodeIssueMonitor();
+        startUpgradeReadinessMonitor();
+        startApplicationProbes();
+        startLogRetention();
+        startHealthRetention();
+        startNotificationRetention();
+        startSecurityExporter();
+        startCommandWorker();
+        startRolloutReconciler();
+        startWebhookWorker();
+        startCodexFleetMonitor();
+        startUpdateCheck();
+        if (features.hermesRegistry) {
+            startExtensionSourceMonitor();
+            void importPackageSkills().then(result => console.log(`[hermes-registry] catalog import: ${JSON.stringify(result)}`))
+                .catch(error => console.error('[hermes-registry] catalog import failed', error));
+        }
+    });
+    if (!started)
+        console.log('[startup] isolated rehearsal: background consumers and queue activation disabled');
 }
 // Relative TLS paths resolve against the working directory; prefer absolute paths.
 const repoRoot = process.cwd();
@@ -114,7 +107,7 @@ const server = listener.useTls
         console.log(`🚀 Magnus server listening on http://${listener.hostname}:${info.port} (development opt-in)`);
         startBackgroundServices(info.port);
     });
-const terminalWss = setupTerminalWebSocket(server);
+const terminalWss = rehearsalEnabled() ? undefined : setupTerminalWebSocket(server);
 // ── Graceful shutdown ──
 let shuttingDown = false;
 async function shutdown(signal) {
@@ -137,17 +130,15 @@ async function shutdown(signal) {
                 stopLogRetention();
                 stopHealthRetention();
                 stopNotificationRetention();
-                stopSecurityFusionRetention();
                 stopSecurityExporter();
-                stopSecurityFusionOutboxDispatcher();
                 stopCodexFleetMonitor();
                 stopUpdateCheck();
                 stopExtensionSourceMonitor();
-                for (const client of terminalWss.clients)
+                for (const client of terminalWss?.clients ?? [])
                     client.terminate();
                 const httpClosed = new Promise((resolvePromise) => server.close(() => resolvePromise()));
                 server.closeAllConnections?.();
-                const webSocketsClosed = new Promise((resolvePromise) => terminalWss.close(() => resolvePromise()));
+                const webSocketsClosed = terminalWss ? new Promise((resolvePromise) => terminalWss.close(() => resolvePromise())) : Promise.resolve();
                 await Promise.all([httpClosed, webSocketsClosed]);
                 await closeCommandQueue();
                 await closeWebhookQueue();

package/dist/middleware/auth.js

@@ -6,6 +6,9 @@
  * happens in Hive IAM itself.
  *
  * If IAM_CORE_URL is not set, local Magnus HS256/API-secret auth remains active.
+ *
+ * When OATHWEAVE_ISSUER is configured instead, RS256 bearer tokens are Oathweave
+ * resource tokens (see oathweave.ts). The two RS256 verifiers refuse to coexist.
  */
 import { createHash } from 'node:crypto';
 import * as jose from 'jose';
@@ -15,6 +18,7 @@ import { verifyWithRotation } from '../services/credential-rotation-service.js';
 import { verifyIamAccessToken } from './iam-token.js';
 import { getCurrentUserStatus } from './user-status.js';
 import { safeEqual } from '../utils/safe-equal.js';
+import { OathweaveAccessDenied, oathweaveAuthentication } from './oathweave.js';
 /** Constant-time string comparison (re-exported for existing callers). */
 export { safeEqual };
 let cachedPublicKey = null;
@@ -260,6 +264,23 @@ export async function authMiddleware(c, next) {
             return;
         }
     }
+    // ── Oathweave resource tokens: RS256 ──────────────────
+    // A token this verifier claims is decided here. Failure never falls through.
+    let oathweaveUser;
+    try {
+        oathweaveUser = await oathweaveAuthentication(token);
+    }
+    catch (error) {
+        if (error instanceof OathweaveAccessDenied) {
+            throw new HttpError(403, 'FORBIDDEN', 'This identity has no linked Magnus account or permission');
+        }
+        throw new HttpError(401, 'UNAUTHORIZED', 'Invalid or inactive identity session');
+    }
+    if (oathweaveUser) {
+        c.set('user', oathweaveUser);
+        await next();
+        return;
+    }
     // ── External Hive IAM verification mode: RS256 ────────
     if (IAM_CORE_URL) {
         let payload;

package/dist/middleware/error-handler.js

@@ -1,18 +1,18 @@
 import { redactSecretText } from '../utils/redact.js';
+import { containsDatabaseText, databaseFailure } from '../utils/safe-errors.js';
 /** Global error handler for Hono — returns structured ApiError JSON. */
 export function errorHandler(err, c) {
-    const status = 'status' in err ? err.status : 500;
-    const code = 'code' in err ? err.code : 'INTERNAL_ERROR';
+    const database = databaseFailure(err);
+    const status = database?.status ?? ('status' in err ? err.status : 500);
+    const code = database?.code ?? ('code' in err ? err.code : 'INTERNAL_ERROR');
     // Log only the error message and code — never the full error object,
     // which may contain request bodies, tokens, or other secrets.
-    console.error(`[ERROR] ${c.req.method} ${c.req.url} [${code}] ${redactSecretText(err.message)}`);
-    const body = {
-        success: false,
-        error: {
-            code: String(code),
-            message: redactSecretText(err.message || 'An unexpected error occurred'),
-        },
-    };
+    const loggedCode = 'code' in err ? err.code : code;
+    console.error(`[ERROR] ${c.req.method} ${c.req.url} [${loggedCode}] ${redactSecretText(err.message)}`);
+    // Database text quotes queries, arguments and addresses, so it stays in the log.
+    const message = database?.message
+        ?? (containsDatabaseText(err.message) ? 'An unexpected error occurred' : redactSecretText(err.message || 'An unexpected error occurred'));
+    const body = { success: false, error: { code: String(code), message } };
     return c.json(body, status);
 }
 /** Throw an HTTP error with a code. */

package/dist/middleware/oathweave-verifier.js

@@ -0,0 +1,23 @@
+import { createOathweaveVerifier, OATHWEAVE_AUDIENCE, } from '@hivemagnus/magnus-oathweave';
+export { createOathweaveVerifier, OATHWEAVE_SESSION_CACHE_TTL_MS, OATHWEAVE_STREAM_RECHECK_MS, } from '@hivemagnus/magnus-oathweave';
+let verifier;
+/** Whether this server accepts Oathweave tokens. A partial configuration counts, and then fails closed. */
+export function oathweaveConfigured() {
+    return Boolean(process.env['OATHWEAVE_ISSUER'] || process.env['OATHWEAVE_JWKS_URL'] || process.env['OATHWEAVE_USERINFO_URL']);
+}
+export function configuredOathweaveVerifier() {
+    if (verifier)
+        return verifier;
+    const issuer = process.env['OATHWEAVE_ISSUER'];
+    const jwksUrl = process.env['OATHWEAVE_JWKS_URL'];
+    const userinfoUrl = process.env['OATHWEAVE_USERINFO_URL'];
+    if (!issuer || !jwksUrl || !userinfoUrl)
+        throw new Error('Oathweave configuration is incomplete');
+    verifier = createOathweaveVerifier({ issuer, jwksUrl, userinfoUrl, audience: OATHWEAVE_AUDIENCE });
+    return verifier;
+}
+/** Drop the memoized verifier so a test can reconfigure the environment. */
+export function resetOathweaveVerifier() {
+    verifier = undefined;
+}
+//# sourceMappingURL=oathweave-verifier.js.map

package/dist/middleware/oathweave.js

@@ -0,0 +1,115 @@
+import { createHash } from 'node:crypto';
+import { decodeProtectedHeader } from 'jose';
+import { parseOathweaveLinks } from '../config/oathweave.js';
+import { configuredOathweaveVerifier, OATHWEAVE_STREAM_RECHECK_MS, oathweaveConfigured, } from './oathweave-verifier.js';
+/** Grants the web terminal, only to a person whose account link is ADMIN. No other route reads it. */
+export const OATHWEAVE_TERMINAL_PERMISSION = 'magnus:terminal';
+/** The token proved who the caller is, but that person has no access to Magnus. */
+export class OathweaveAccessDenied extends Error {
+}
+let parsedLinks;
+function identityLinks(raw) {
+    if (parsedLinks?.raw !== raw)
+        parsedLinks = { raw, links: parseOathweaveLinks(raw) };
+    return parsedLinks.links;
+}
+/**
+ * Map a verified identity through its one explicit account link. The link's role
+ * is a ceiling and the token's permissions grant within it, so neither alone
+ * confers privilege. IAM role names and email addresses are never consulted.
+ */
+export function linkedMagnusIdentity(identity, raw = process.env['MAGNUS_OATHWEAVE_IDENTITIES_JSON'] ?? '[]') {
+    let links;
+    try {
+        links = identityLinks(raw);
+    }
+    catch {
+        throw new OathweaveAccessDenied('Identity links are unreadable');
+    }
+    const matches = links.filter((link) => link.issuer === identity.issuer && link.subject === identity.subject);
+    if (matches.length !== 1)
+        throw new OathweaveAccessDenied('An explicit unique account link is required');
+    const link = matches[0];
+    let role;
+    if (link.role === 'ADMIN' && identity.permissions.includes('magnus:admin'))
+        role = 'ADMIN';
+    else if (link.role !== 'VIEWER' && identity.permissions.includes('magnus:operate'))
+        role = 'OPERATOR';
+    else if (identity.permissions.includes('magnus:view'))
+        role = 'VIEWER';
+    else
+        throw new OathweaveAccessDenied('Magnus permission required');
+    // `email` is an audit actor label across this server (often read as
+    // `user.email ?? user.userId`, and `??` keeps a blank), so it must not be empty.
+    return {
+        userId: link.localUserId, email: link.localUserId, role, iat: identity.issuedAt, exp: identity.expiresAt,
+        // The fleet gateway applies the same rule, and also requires recent identity verification.
+        terminal: link.role === 'ADMIN' && identity.permissions.includes(OATHWEAVE_TERMINAL_PERMISSION),
+    };
+}
+function isOathweaveToken(token) {
+    if (!oathweaveConfigured())
+        return false;
+    try {
+        return decodeProtectedHeader(token).alg === 'RS256';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Authenticate an Oathweave bearer token. Undefined means the token is not this
+ * verifier's to judge (Oathweave is off, or it is not an RS256 JWT). Any throw is
+ * final: the caller must reject the request rather than try another verifier.
+ */
+export async function oathweaveAuthentication(token) {
+    if (!isOathweaveToken(token))
+        return undefined;
+    return linkedMagnusIdentity(await configuredOathweaveVerifier()(token));
+}
+/**
+ * A stable rate-limit identity for a fully verified token, or undefined. Rate
+ * limiters run before route authentication, so they cannot read the context user
+ * and must not trust an unverified `sub` a caller could rotate. The answer comes
+ * from the same session cache authentication uses, so it adds no identity traffic.
+ */
+export async function oathweaveRateLimitSubject(token) {
+    if (!isOathweaveToken(token))
+        return undefined;
+    try {
+        const identity = await configuredOathweaveVerifier()(token);
+        return createHash('sha256').update(JSON.stringify([identity.issuer, identity.subject])).digest('hex');
+    }
+    catch {
+        return undefined;
+    }
+}
+/** How often an open stream re-checks its token. See OATHWEAVE_SESSION_CACHE_TTL_MS. */
+export { OATHWEAVE_STREAM_RECHECK_MS };
+/**
+ * Authentication runs once when a stream opens, so a long-lived stream would
+ * otherwise outlive logout and token expiry. Calls onRevoked once the bearer
+ * token stops authenticating; the browser reconnects with a fresh token.
+ * Returns a function that stops watching. Other credentials are not watched.
+ */
+export function watchOathweaveStream(authorization, onRevoked) {
+    const token = authorization?.startsWith('Bearer ') ? authorization.slice(7) : '';
+    if (!isOathweaveToken(token))
+        return () => undefined;
+    let stopped = false;
+    const stop = () => {
+        stopped = true;
+        clearInterval(timer);
+    };
+    const timer = setInterval(() => {
+        oathweaveAuthentication(token).catch(() => {
+            if (stopped)
+                return;
+            stop();
+            onRevoked();
+        });
+    }, OATHWEAVE_STREAM_RECHECK_MS);
+    timer.unref();
+    return stop;
+}
+//# sourceMappingURL=oathweave.js.map

package/dist/middleware/rate-limit.js

@@ -1,6 +1,7 @@
 import { Redis } from 'ioredis';
 import { incMetric } from '../routes/metrics.js';
 import { heartbeatPeerAddress } from '../utils/heartbeat-peer.js';
+import { oathweaveRateLimitSubject } from './oathweave.js';
 const REDIS_URL = process.env['REDIS_URL'] ?? 'redis://127.0.0.1:6379';
 const REDIS_PREFIX = process.env['REDIS_PREFIX'] ?? 'magnus-';
 let _redis = null;
@@ -17,7 +18,8 @@ function getRedis() {
 }
 /**
  * Sliding-window rate limiter backed by Redis.
- * Keyed by client IP address. Falls through (allows) if Redis is unavailable.
+ * Keyed by the verified subject of an Oathweave token, otherwise by client IP
+ * address. Falls through (allows) if Redis is unavailable.
  *
  * @param opts.windowMs  Time window in milliseconds (default: 60_000 = 1 minute)
  * @param opts.max       Maximum requests per window (default: 100)
@@ -32,8 +34,15 @@ export function rateLimitMiddleware(opts = {}) {
         // forwarding header must not let login or mutation clients rotate their
         // rate-limit identity. The helper prefers the Node socket peer and only
         // falls back to forwarded metadata in adapter-free/test contexts.
-        const ip = heartbeatPeerAddress(c) || 'unknown-peer';
-        const key = `${REDIS_PREFIX}${prefix}:${ip}`;
+        const authorization = c.req.header('Authorization');
+        const subject = authorization?.startsWith('Bearer ')
+            ? await oathweaveRateLimitSubject(authorization.slice(7))
+            : undefined;
+        // Behind a same-origin ingress every browser shares one peer address, so a
+        // verified subject gets its own bucket. Anything else, including a token
+        // that failed verification, stays on the peer bucket.
+        const identity = subject ? `subject:${subject}` : heartbeatPeerAddress(c) || 'unknown-peer';
+        const key = `${REDIS_PREFIX}${prefix}:${identity}`;
         const now = Date.now();
         const windowStart = now - windowMs;
         try {

package/dist/openapi/spec.js

@@ -1,3 +1,4 @@
+import { skillJobRequest } from '../routes/hiveskills.js';
 import { z as zSchema } from 'zod';
 import { dashboardReserveSchema, dashboardStartSchema, dashboardFinishSchema, apiDrainAttestationSchema, schedulerBoundaryAttestationSchema } from '../services/resource-enrollment.js';
 import { ardentScopeActivationSchema } from '../services/ardent-scope-enrollment.js';
@@ -5,7 +6,7 @@ import { participantWorkReconciliationSchema, historicalParticipantWorkReconcili
 import { sharedResourceLeaseIdentitySchema, sharedResourceLeaseViewSchema, sharedResourceReconciliationSchema, sharedResourceReserveSchema, sharedResourceTerminalEvidenceSchema, } from '../schemas/shared-resource-lease.js';
 import { managedCronRegistrationSchema, schedulerSourceSettlementSchema } from '../schemas/managed-cron.js';
 import { legacyAdmissionRequestSchema, resourceClaimSchema } from '../security/managed-http.js';
-import { magnusObservationSchema } from '@hivemagnus/magnus-contracts';
+import { magnusObservationSchema, responseRequestSchema } from '@hivemagnus/magnus-contracts';
 import { maintenanceSchema } from '../services/maintenance-service.js';
 import { rolloutInputSchema } from '../services/rollout-service.js';
 import { lessonSchema } from '../services/incident-lessons.js';
@@ -217,6 +218,7 @@ const componentSchemas = {
             createdAt: { type: 'string', format: 'date-time' },
             updatedAt: { type: 'string', format: 'date-time' },
             agent: { type: 'object', nullable: true, properties: { version: { type: 'string' }, status: { type: 'string' } } },
+            health: { type: 'object', nullable: true, description: 'GET /nodes only: headline figures of the newest snapshot, null until the node reports one', properties: { timestamp: { type: 'string', format: 'date-time' }, cpuUsagePercent: { type: 'number' }, cpuCores: { type: 'integer' }, memoryTotalBytes: { type: 'number' }, memoryUsedBytes: { type: 'number' }, memoryPercent: { type: 'number' }, swapTotalBytes: { type: 'number' }, swapUsedBytes: { type: 'number' }, disks: { type: 'string', description: 'JSON-encoded disk array' } } },
         },
     },
     User: {
@@ -655,7 +657,7 @@ const paths = {
         get: {
             tags: ['Nodes'],
             summary: 'List nodes',
-            description: 'Returns all fleet nodes with agent info and health metadata. Supports pagination and status filtering. Each node has `upgradeReadiness`: `status` (ok, not-ready, or unknown for agents that do not report it) and `problems` with a code, a detail, a cause and a remedy, such as an enrollment stuck draining, a marker the server does not share, a fence ahead of the server, an unresolved ledger, low disk or missing npm.',
+            description: 'Returns all fleet nodes with agent info and health metadata. Supports pagination and status filtering. Each node has `upgradeReadiness`: `status` (ok, not-ready, or unknown for agents that do not report it) and `problems` with a code, a detail, a cause and a remedy, such as an enrollment stuck draining, a marker the server does not share, a fence ahead of the server, an unresolved ledger, low disk or missing npm. Each node also has `health`, the headline figures of its newest snapshot, or null when it has none, so a list needs no request per row.',
             security: apiSecretAuth,
             parameters: [
                 qp('page', 'Page number (1-based)', { type: 'integer' }),
@@ -2106,6 +2108,36 @@ const paths = {
         },
     },
     // ──────────────── Stats ────────────────
+    '/console/session': {
+        get: {
+            tags: ['Stats'],
+            summary: 'Role and capabilities of the signed-in browser console user',
+            security: [{ bearerAuth: [] }, { apiSecret: [] }],
+            responses: {
+                '200': success('Mapped role and console capabilities', {
+                    type: 'object',
+                    required: ['userId', 'role', 'capabilities'],
+                    properties: {
+                        userId: { type: 'string' },
+                        role: { type: 'string', enum: ['ADMIN', 'OPERATOR', 'VIEWER'] },
+                        capabilities: {
+                            type: 'object',
+                            required: ['hermes', 'terminal', 'agentVersion', 'magnusVersion', 'securityConsoleUrl'],
+                            properties: {
+                                hermes: { type: 'boolean' },
+                                terminal: { type: 'boolean', description: 'The fleet gateway is deployed and this person may use it.' },
+                                agentVersion: { type: 'string' },
+                                magnusVersion: { type: 'string' },
+                                securityConsoleUrl: { type: ['string', 'null'] },
+                            },
+                        },
+                    },
+                }),
+                '401': err401,
+                '403': err403,
+            },
+        },
+    },
     '/stats/overview': {
         get: {
             tags: ['Stats'],
@@ -2387,7 +2419,8 @@ const paths = {
                         enabled: { type: 'boolean' },
                         host: { type: 'string' },
                         port: { type: 'integer', nullable: true },
-                        keyFingerprint: { type: 'string', nullable: true },
+                        keyConfigured: { type: 'boolean' },
+                        keyFingerprint: { type: 'string', nullable: true, description: 'Present for ADMIN only.' },
                         lastSyncedAt: { type: 'string', format: 'date-time', nullable: true },
                     },
                 }),
@@ -2703,6 +2736,8 @@ export function buildOpenApiSpec() {
         tags,
         components: {
             securitySchemes: {
+                skillsExecutorBearer: { type: 'http', scheme: 'bearer', bearerFormat: 'opaque', description: 'Dedicated endpoint-scoped registry credential; only configured targets and exact native sync operations, never general commands.' },
+                cindertraceSignature: { type: 'apiKey', in: 'header', name: 'x-cindertrace-signature', description: 'Dedicated response HMAC bound to method, path, exact body, x-cindertrace-time and x-cindertrace-nonce. Responses are signed against the same request binding.' },
                 apiSecret: {
                     type: 'apiKey',
                     in: 'header',
@@ -2734,7 +2769,13 @@ export function buildOpenApiSpec() {
             },
             schemas: componentSchemas,
         },
-        paths,
+        paths: { ...paths,
+            '/api/v1/hiveskills/targets/{target}': { get: { summary: 'Verify exact enrolled native target and immutable client without dispatch', tags: ['Skills'], security: [{ skillsExecutorBearer: [] }], parameters: [{ name: 'target', in: 'path', required: true, schema: { type: 'string' } }], responses: { 200: { description: 'Read-only enrolled target posture; ready false retains operator review' }, 401: { description: 'Dedicated executor credential required' }, 403: { description: 'Target outside exact registry grant' } } } },
+            '/api/v1/hiveskills/jobs/{id}': { post: { summary: 'Execute one exact approved HiveSkills publication through enrolled native admission', tags: ['Skills'], requestBody: { required: true, content: { 'application/json': { schema: zSchema.toJSONSchema(skillJobRequest) } } }, security: [{ skillsExecutorBearer: [] }], parameters: [{ name: 'id', in: 'path', required: true, schema: { type: 'string', format: 'uuid' } }], responses: { 200: { description: 'Bounded durable outcome; admitted operations are never replayed' }, 409: { description: 'Publication conflict, not admitted or uncertain' } } }, get: { summary: 'Reconcile only the original signed HiveSkills operation receipt', tags: ['Skills'], security: [{ skillsExecutorBearer: [] }], parameters: [{ name: 'id', in: 'path', required: true, schema: { type: 'string', format: 'uuid' } }, { name: 'target', in: 'query', required: true, schema: { type: 'string' } }], responses: { 200: { description: 'Existing durable outcome' } } } },
+            '/api/v1/security-integration/response/execute': { post: { summary: 'Execute an exact Cindertrace-approved response through managed node admission', tags: ['Cindertrace'], security: [{ cindertraceSignature: [] }], requestBody: { required: true, content: { 'application/json': { schema: zSchema.toJSONSchema(responseRequestSchema) } } }, responses: { 200: { description: 'Signed completion receipt' }, 409: { description: 'Expired, already claimed, blocked, or uncertain execution' } } } },
+            '/api/v1/security-integration/response/{id}': { get: { summary: 'Read an existing Cindertrace execution without replay', tags: ['Cindertrace'], security: [{ cindertraceSignature: [] }], parameters: [{ name: 'id', in: 'path', required: true, schema: { type: 'string' } }], responses: { 200: { description: 'Signed existing execution status' } } } },
+            '/api/v1/security-integration/response/targets/{id}/health': { get: { summary: 'Read fresh target health for Cindertrace', tags: ['Cindertrace'], security: [{ cindertraceSignature: [] }], parameters: [{ name: 'id', in: 'path', required: true, schema: { type: 'string' } }], responses: { 200: { description: 'Signed minimal health snapshot' } } } },
+        },
     };
 }
 //# sourceMappingURL=spec.js.map

package/dist/queue/names.js

@@ -0,0 +1,9 @@
+/** BullMQ rejects colons in queue names. Split the legacy logical name without
+ * changing a single Redis key: default "bull:<logical>:<suffix>" stays identical. */
+export function bullQueueIdentity(namespace, queue) {
+    const logical = namespace + queue, index = logical.lastIndexOf(':');
+    return index < 0
+        ? { name: logical, prefix: 'bull' }
+        : { name: logical.slice(index + 1), prefix: 'bull:' + logical.slice(0, index) };
+}
+//# sourceMappingURL=names.js.map