@legioncodeinc/hive 0.1.0

package/dist/service/index.js

@@ -0,0 +1,174 @@
+import { execFile } from "node:child_process";
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { installCommands, legacyUninstallCommands, uninstallCommands } from "./commands.js";
+import { legacyUnitPath, resolveServiceContext, resolveServicePlan } from "./platform.js";
+import { renderUnit } from "./templates.js";
+const SERVICE_COMMAND_TIMEOUT_MS = 15_000;
+export function createExecFileRunner() {
+    return {
+        run(command, args, options = {}) {
+            const timeout = options.timeoutMs ?? SERVICE_COMMAND_TIMEOUT_MS;
+            return new Promise((resolve) => {
+                execFile(command, [...args], { timeout }, (error, stdout, stderr) => {
+                    if (error === null) {
+                        resolve({ ok: true, code: 0, stdout, stderr });
+                        return;
+                    }
+                    const codeValue = typeof error.code === "number" ? error.code : null;
+                    resolve({
+                        ok: false,
+                        code: codeValue,
+                        stdout,
+                        stderr,
+                        detail: error.message
+                    });
+                });
+            });
+        }
+    };
+}
+export function createNodeServiceFs() {
+    return {
+        mkdirp(path) {
+            mkdirSync(path, { recursive: true });
+        },
+        writeFile(path, content) {
+            writeFileSync(path, content, "utf8");
+        },
+        removeFile(path) {
+            rmSync(path, { force: true });
+        }
+    };
+}
+function liveUid() {
+    try {
+        const getuid = process.getuid;
+        return typeof getuid === "function" ? getuid() : 0;
+    }
+    catch {
+        return 0;
+    }
+}
+function stagedWindowsTaskPath(home) {
+    return `${home}/.honeycomb/hive/hive-task.xml`;
+}
+function scopePhrase(plan) {
+    switch (plan.manager) {
+        case "launchd":
+            return "launchd";
+        case "systemd":
+            return "systemd";
+        case "schtasks":
+            return "schtasks";
+    }
+}
+async function runAll(runner, commands) {
+    let firstFailure = null;
+    for (const command of commands) {
+        const result = await runner.run(command.command, command.args, { timeoutMs: SERVICE_COMMAND_TIMEOUT_MS });
+        if (!result.ok && firstFailure === null) {
+            firstFailure = command;
+        }
+    }
+    return { allOk: firstFailure === null, firstFailure };
+}
+function withResolvedUnitPath(plan) {
+    if (plan.manager !== "schtasks" || plan.unitPath !== "")
+        return plan;
+    return {
+        ...plan,
+        unitPath: stagedWindowsTaskPath(plan.home)
+    };
+}
+export function createServiceModule(deps) {
+    const runner = deps.runner ?? createExecFileRunner();
+    const fs = deps.fs ?? createNodeServiceFs();
+    const uid = deps.uid ?? liveUid();
+    const environment = deps.environment ?? resolveServiceContext(deps.execPath);
+    function plan() {
+        return resolveServicePlan(environment);
+    }
+    return {
+        async install() {
+            let resolvedPlan;
+            try {
+                resolvedPlan = withResolvedUnitPath(plan());
+            }
+            catch (error) {
+                return {
+                    ok: false,
+                    message: `Could not register hive service: ${error instanceof Error ? error.message : "unknown error"}.`
+                };
+            }
+            // Decision #32 migration: best-effort deregister the legacy `hive` unit and
+            // remove its unit file, so a re-run never leaves two units racing over one daemon.
+            // Expected to fail harmlessly when no legacy unit exists; never blocks the install.
+            await runAll(runner, legacyUninstallCommands(resolvedPlan, uid));
+            try {
+                const legacyPath = legacyUnitPath(resolvedPlan);
+                if (legacyPath !== "")
+                    fs.removeFile(legacyPath);
+            }
+            catch {
+                // Best-effort migration cleanup only; a remove failure never blocks the install.
+            }
+            const needsUnitFile = resolvedPlan.unitPath !== "" || resolvedPlan.manager === "schtasks";
+            if (needsUnitFile) {
+                try {
+                    fs.mkdirp(dirname(resolvedPlan.unitPath));
+                    fs.writeFile(resolvedPlan.unitPath, renderUnit(resolvedPlan));
+                }
+                catch (error) {
+                    return {
+                        ok: false,
+                        message: `Could not write hive unit file at ${resolvedPlan.unitPath}: ${error instanceof Error ? error.message : "unknown error"}.`
+                    };
+                }
+            }
+            const { allOk, firstFailure } = await runAll(runner, installCommands(resolvedPlan, uid));
+            if (!allOk) {
+                return {
+                    ok: false,
+                    message: `Registered hive unit but a service-manager command failed (${firstFailure?.command ?? "unknown"}).`
+                };
+            }
+            return {
+                ok: true,
+                message: `hive registered as a ${scopePhrase(resolvedPlan)} service and started. It will restart on crash and start on boot/login.`
+            };
+        },
+        async uninstall() {
+            let resolvedPlan;
+            try {
+                resolvedPlan = withResolvedUnitPath(plan());
+            }
+            catch (error) {
+                return {
+                    ok: false,
+                    message: `Could not unregister hive service: ${error instanceof Error ? error.message : "unknown error"}.`
+                };
+            }
+            const { allOk, firstFailure } = await runAll(runner, uninstallCommands(resolvedPlan, uid));
+            try {
+                if (resolvedPlan.unitPath !== "")
+                    fs.removeFile(resolvedPlan.unitPath);
+            }
+            catch {
+                // A stale unit file should not block uninstall feedback.
+            }
+            if (!allOk) {
+                return {
+                    ok: false,
+                    message: `Removed hive unit file; a deregister command (${firstFailure?.command ?? "unknown"}) reported an error.`
+                };
+            }
+            return {
+                ok: true,
+                message: `hive service unregistered (${scopePhrase(resolvedPlan)}). It will not start on next boot/login.`
+            };
+        }
+    };
+}
+export { resolveServiceContext, resolveServicePlan } from "./platform.js";
+//# sourceMappingURL=index.js.map

package/dist/service/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/service/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,iBAAiB,EAAuB,MAAM,eAAe,CAAC;AACjH,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAGnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAsC1C,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,EAAE;YAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,0BAA0B,CAAC;YAChE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC7B,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;oBAClE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;wBACnB,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;wBAC/C,OAAO;oBACT,CAAC;oBAED,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;oBACrE,OAAO,CAAC;wBACN,EAAE,EAAE,KAAK;wBACT,IAAI,EAAE,SAAS;wBACf,MAAM;wBACN,MAAM;wBACN,MAAM,EAAE,KAAK,CAAC,OAAO;qBACtB,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,MAAM,CAAC,IAAY;YACjB,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,SAAS,CAAC,IAAY,EAAE,OAAe;YACrC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,UAAU,CAAC,IAAY;YACrB,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,OAAO;IACd,IAAI,CAAC;QACH,MAAM,MAAM,GAAI,OAAsD,CAAC,MAAM,CAAC;QAC9E,OAAO,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IACzC,OAAO,GAAG,IAAI,gCAAgC,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,IAAiB;IACpC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;IACtB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,MAAM,CACnB,MAAqB,EACrB,QAAmC;IAEnC,IAAI,YAAY,GAA0B,IAAI,CAAC;IAC/C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC1G,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YACxC,YAAY,GAAG,OAAO,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,YAAY,KAAK,IAAI,EAAE,YAAY,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAiB;IAC7C,IAAI,IAAI,CAAC,OAAO,KAAK,UAAU,IAAI,IAAI,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO;QACL,GAAG,IAAI;QACP,QAAQ,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACrD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,mBAAmB,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE7E,SAAS,IAAI;QACX,OAAO,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC;IAED,OAAO;QACL,KAAK,CAAC,OAAO;YACX,IAAI,YAAyB,CAAC;YAC9B,IAAI,CAAC;gBACH,YAAY,GAAG,oBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,GAAG;iBACzG,CAAC;YACJ,CAAC;YAED,4EAA4E;YAC5E,mFAAmF;YACnF,oFAAoF;YACpF,MAAM,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;gBAChD,IAAI,UAAU,KAAK,EAAE;oBAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,iFAAiF;YACnF,CAAC;YAED,MAAM,aAAa,GAAG,YAAY,CAAC,QAAQ,KAAK,EAAE,IAAI,YAAY,CAAC,OAAO,KAAK,UAAU,CAAC;YAC1F,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC;oBACH,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAC1C,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;gBAChE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,OAAO,EAAE,qCAAqC,YAAY,CAAC,QAAQ,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,GAAG;qBACpI,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;YACzF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,8DAA8D,YAAY,EAAE,OAAO,IAAI,SAAS,IAAI;iBAC9G,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,OAAO,EAAE,wBAAwB,WAAW,CAAC,YAAY,CAAC,yEAAyE;aACpI,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,SAAS;YACb,IAAI,YAAyB,CAAC;YAC9B,IAAI,CAAC;gBACH,YAAY,GAAG,oBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,sCAAsC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,GAAG;iBAC3G,CAAC;YACJ,CAAC;YAED,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;YAC3F,IAAI,CAAC;gBACH,IAAI,YAAY,CAAC,QAAQ,KAAK,EAAE;oBAAE,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACzE,CAAC;YAAC,MAAM,CAAC;gBACP,yDAAyD;YAC3D,CAAC;YAED,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,iDAAiD,YAAY,EAAE,OAAO,IAAI,SAAS,sBAAsB;iBACnH,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,OAAO,EAAE,8BAA8B,WAAW,CAAC,YAAY,CAAC,0CAA0C;aAC3G,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC"}

package/dist/service/platform.d.ts

@@ -0,0 +1,37 @@
+export type ServicePlatform = "darwin" | "linux" | "win32";
+export type ServiceManager = "launchd" | "systemd" | "schtasks";
+/**
+ * Decision #32 (2026-07-02, nectar `library/requirements/PRD-DECISIONS-AND-DEFAULTS.md`):
+ * fleet-wide OS service naming uses the product short name `hive` with a
+ * reverse-DNS launchd label, superseding the shipped `thehive` names.
+ */
+export declare const SERVICE_LABEL: "com.legioncode.hive";
+export declare const SYSTEMD_UNIT_NAME: "hive.service";
+export declare const WINDOWS_TASK_NAME: "hive";
+/** The pre-decision-#32 names, deregistered on install (migration path). */
+export declare const LEGACY_SERVICE_LABEL: "thehive";
+export declare const LEGACY_SYSTEMD_UNIT_NAME: "thehive.service";
+export declare const LEGACY_WINDOWS_TASK_NAME: "thehive";
+export interface ServiceEnvironment {
+    readonly platform: NodeJS.Platform;
+    readonly home: string;
+    readonly execPath: string;
+}
+export interface ServicePlan {
+    readonly platform: ServicePlatform;
+    readonly manager: ServiceManager;
+    readonly unitPath: string;
+    readonly label: string;
+    readonly execPath: string;
+    readonly home: string;
+}
+export declare function resolveServiceContext(execPath: string): ServiceEnvironment;
+export declare function normalizePlatform(platform: NodeJS.Platform): ServicePlatform | null;
+/**
+ * The on-disk unit path the PRE-decision-#32 install would have used for this
+ * plan's platform. Install removes it (best-effort) so a re-run migrates a
+ * legacy unit instead of leaving two units racing over one daemon. Empty when
+ * the platform keeps no unit file (Windows).
+ */
+export declare function legacyUnitPath(plan: ServicePlan): string;
+export declare function resolveServicePlan(environment: ServiceEnvironment): ServicePlan;

package/dist/service/platform.js

@@ -0,0 +1,67 @@
+import { homedir } from "node:os";
+/**
+ * Decision #32 (2026-07-02, nectar `library/requirements/PRD-DECISIONS-AND-DEFAULTS.md`):
+ * fleet-wide OS service naming uses the product short name `hive` with a
+ * reverse-DNS launchd label, superseding the shipped `thehive` names.
+ */
+export const SERVICE_LABEL = "com.legioncode.hive";
+export const SYSTEMD_UNIT_NAME = "hive.service";
+export const WINDOWS_TASK_NAME = "hive";
+/** The pre-decision-#32 names, deregistered on install (migration path). */
+export const LEGACY_SERVICE_LABEL = "thehive";
+export const LEGACY_SYSTEMD_UNIT_NAME = "thehive.service";
+export const LEGACY_WINDOWS_TASK_NAME = "thehive";
+export function resolveServiceContext(execPath) {
+    return {
+        platform: process.platform,
+        home: homedir(),
+        execPath
+    };
+}
+export function normalizePlatform(platform) {
+    if (platform === "darwin" || platform === "linux" || platform === "win32")
+        return platform;
+    return null;
+}
+function unitPathFor(plan) {
+    switch (plan.platform) {
+        case "darwin":
+            return `${plan.home}/Library/LaunchAgents/${SERVICE_LABEL}.plist`;
+        case "linux":
+            return `${plan.home}/.config/systemd/user/${SYSTEMD_UNIT_NAME}`;
+        case "win32":
+            return "";
+    }
+}
+/**
+ * The on-disk unit path the PRE-decision-#32 install would have used for this
+ * plan's platform. Install removes it (best-effort) so a re-run migrates a
+ * legacy unit instead of leaving two units racing over one daemon. Empty when
+ * the platform keeps no unit file (Windows).
+ */
+export function legacyUnitPath(plan) {
+    switch (plan.platform) {
+        case "darwin":
+            return `${plan.home}/Library/LaunchAgents/${LEGACY_SERVICE_LABEL}.plist`;
+        case "linux":
+            return `${plan.home}/.config/systemd/user/${LEGACY_SYSTEMD_UNIT_NAME}`;
+        case "win32":
+            return "";
+    }
+}
+export function resolveServicePlan(environment) {
+    const platform = normalizePlatform(environment.platform);
+    if (platform === null) {
+        throw new Error(`unsupported platform: ${environment.platform}`);
+    }
+    const manager = platform === "darwin" ? "launchd" : platform === "linux" ? "systemd" : "schtasks";
+    return {
+        platform,
+        manager,
+        unitPath: unitPathFor({ platform, home: environment.home }),
+        label: SERVICE_LABEL,
+        execPath: environment.execPath,
+        home: environment.home
+    };
+}
+//# sourceMappingURL=platform.js.map

package/dist/service/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/service/platform.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAKlC;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,qBAA8B,CAAC;AAC5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAuB,CAAC;AACzD,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAe,CAAC;AAEjD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAkB,CAAC;AACvD,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAA0B,CAAC;AACnE,MAAM,CAAC,MAAM,wBAAwB,GAAG,SAAkB,CAAC;AAiB3D,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,EAAE;QACf,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAyB;IACzD,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC3F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,IAAiD;IACpE,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,KAAK,QAAQ;YACX,OAAO,GAAG,IAAI,CAAC,IAAI,yBAAyB,aAAa,QAAQ,CAAC;QACpE,KAAK,OAAO;YACV,OAAO,GAAG,IAAI,CAAC,IAAI,yBAAyB,iBAAiB,EAAE,CAAC;QAClE,KAAK,OAAO;YACV,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAiB;IAC9C,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,KAAK,QAAQ;YACX,OAAO,GAAG,IAAI,CAAC,IAAI,yBAAyB,oBAAoB,QAAQ,CAAC;QAC3E,KAAK,OAAO;YACV,OAAO,GAAG,IAAI,CAAC,IAAI,yBAAyB,wBAAwB,EAAE,CAAC;QACzE,KAAK,OAAO;YACV,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,WAA+B;IAChE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,yBAAyB,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,OAAO,GAAmB,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IAClH,OAAO;QACL,QAAQ;QACR,OAAO;QACP,QAAQ,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;QAC3D,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,IAAI,EAAE,WAAW,CAAC,IAAI;KACvB,CAAC;AACJ,CAAC"}

package/dist/service/templates.d.ts

@@ -0,0 +1,10 @@
+import { type ServicePlan } from "./platform.js";
+export declare const HIVE_START_COMMAND: "start";
+export declare const RESTART_SEC: 5;
+export declare const WINDOWS_RESTART_INTERVAL: "PT1M";
+export declare function quoteSystemdToken(value: string): string;
+export declare function escapeXml(value: string): string;
+export declare function renderLaunchdPlist(plan: ServicePlan): string;
+export declare function renderSystemdUnit(plan: ServicePlan): string;
+export declare function renderScheduledTaskXml(plan: ServicePlan): string;
+export declare function renderUnit(plan: ServicePlan): string;

package/dist/service/templates.js

@@ -0,0 +1,120 @@
+import { WINDOWS_TASK_NAME } from "./platform.js";
+export const HIVE_START_COMMAND = "start";
+export const RESTART_SEC = 5;
+export const WINDOWS_RESTART_INTERVAL = "PT1M";
+export function quoteSystemdToken(value) {
+    return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+export function escapeXml(value) {
+    return value
+        .replaceAll("&", "&")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;")
+        .replaceAll("'", "&apos;");
+}
+export function renderLaunchdPlist(plan) {
+    const node = escapeXml(process.execPath);
+    const exec = escapeXml(plan.execPath);
+    const home = escapeXml(plan.home);
+    const label = escapeXml(plan.label);
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>Label</key>
+	<string>${label}</string>
+	<key>ProgramArguments</key>
+	<array>
+		<string>${node}</string>
+		<string>${exec}</string>
+		<string>${HIVE_START_COMMAND}</string>
+	</array>
+	<key>RunAtLoad</key>
+	<true/>
+	<key>KeepAlive</key>
+	<true/>
+	<key>ThrottleInterval</key>
+	<integer>${RESTART_SEC}</integer>
+	<key>ProcessType</key>
+	<string>Background</string>
+	<key>StandardOutPath</key>
+	<string>${home}/.honeycomb/hive/launchd.out.log</string>
+	<key>StandardErrorPath</key>
+	<string>${home}/.honeycomb/hive/launchd.err.log</string>
+</dict>
+</plist>
+`;
+}
+export function renderSystemdUnit(plan) {
+    const execStart = `${quoteSystemdToken(process.execPath)} ${quoteSystemdToken(plan.execPath)} ${HIVE_START_COMMAND}`;
+    return `[Unit]
+Description=hive portal daemon
+After=network.target
+
+[Service]
+Type=simple
+ExecStart=${execStart}
+Restart=always
+RestartSec=${RESTART_SEC}
+StartLimitIntervalSec=0
+
+[Install]
+WantedBy=default.target
+`;
+}
+export function renderScheduledTaskXml(plan) {
+    const node = escapeXml(process.execPath);
+    const exec = escapeXml(plan.execPath);
+    return `<?xml version="1.0" encoding="UTF-16"?>
+<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
+  <RegistrationInfo>
+    <Description>hive portal daemon</Description>
+    <URI>\\${escapeXml(WINDOWS_TASK_NAME)}</URI>
+  </RegistrationInfo>
+  <Triggers>
+    <LogonTrigger>
+      <Enabled>true</Enabled>
+    </LogonTrigger>
+  </Triggers>
+  <Principals>
+    <Principal id="Author">
+      <LogonType>InteractiveToken</LogonType>
+      <RunLevel>LeastPrivilege</RunLevel>
+    </Principal>
+  </Principals>
+  <Settings>
+    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
+    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
+    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
+    <AllowHardTerminate>true</AllowHardTerminate>
+    <StartWhenAvailable>true</StartWhenAvailable>
+    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
+    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>
+    <Enabled>true</Enabled>
+    <Hidden>false</Hidden>
+    <RestartOnFailure>
+      <Interval>${WINDOWS_RESTART_INTERVAL}</Interval>
+      <Count>999</Count>
+    </RestartOnFailure>
+  </Settings>
+  <Actions Context="Author">
+    <Exec>
+      <Command>${node}</Command>
+      <Arguments>"${exec}" ${HIVE_START_COMMAND}</Arguments>
+    </Exec>
+  </Actions>
+</Task>
+`;
+}
+export function renderUnit(plan) {
+    switch (plan.manager) {
+        case "launchd":
+            return renderLaunchdPlist(plan);
+        case "systemd":
+            return renderSystemdUnit(plan);
+        case "schtasks":
+            return renderScheduledTaskXml(plan);
+    }
+}
+//# sourceMappingURL=templates.js.map

package/dist/service/templates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../src/service/templates.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAoB,MAAM,eAAe,CAAC;AAEpE,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAgB,CAAC;AACnD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAU,CAAC;AACtC,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAe,CAAC;AAExD,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAiB;IAClD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO;;;;;WAKE,KAAK;;;YAGJ,IAAI;YACJ,IAAI;YACJ,kBAAkB;;;;;;;YAOlB,WAAW;;;;WAIZ,IAAI;;WAEJ,IAAI;;;CAGd,CAAC;AACF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAiB;IACjD,MAAM,SAAS,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACrH,OAAO;;;;;;YAMG,SAAS;;aAER,WAAW;;;;;CAKvB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAiB;IACtD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO;;;;aAII,SAAS,CAAC,iBAAiB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;kBAwBvB,wBAAwB;;;;;;iBAMzB,IAAI;oBACD,IAAI,KAAK,kBAAkB;;;;CAI9C,CAAC;AACF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAiB;IAC1C,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAClC,KAAK,SAAS;YACZ,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACjC,KAAK,UAAU;YACb,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;AACH,CAAC"}

package/dist/shared/constants.d.ts

@@ -0,0 +1,15 @@
+export declare const HIVE_HOST: "127.0.0.1";
+export declare const HIVE_PORT: 3853;
+export declare const HIVE_VERSION: string;
+/** Hard-pinned loopback origin for doctor's status page (fs-AC-2). Never derived from registry or env. */
+export declare const DOCTOR_STATUS_URL: "http://127.0.0.1:3852/status.json";
+/**
+ * Hard-pinned loopback origin for doctor's fleet-telemetry SSE stream (hive PRD-004/005;
+ * doctor ADR-0001 decision 3). Same status page (`:3852`), the `/events` route. Never derived
+ * from the registry or env — mirrors {@link DOCTOR_STATUS_URL}'s fixed-constant posture so the
+ * server-side relay (`daemon/telemetry-proxy.ts`) can never be pointed at an attacker-chosen origin.
+ */
+export declare const DOCTOR_EVENTS_URL: "http://127.0.0.1:3852/events";
+export declare const HONEYCOMB_HOME_DIR: string;
+export declare const HIVE_PID_PATH: string;
+export declare const HIVE_LOCK_PATH: string;

package/dist/shared/constants.js

@@ -0,0 +1,19 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+import packageJson from "../../package.json" with { type: "json" };
+export const HIVE_HOST = "127.0.0.1";
+export const HIVE_PORT = 3853;
+export const HIVE_VERSION = packageJson.version;
+/** Hard-pinned loopback origin for doctor's status page (fs-AC-2). Never derived from registry or env. */
+export const DOCTOR_STATUS_URL = "http://127.0.0.1:3852/status.json";
+/**
+ * Hard-pinned loopback origin for doctor's fleet-telemetry SSE stream (hive PRD-004/005;
+ * doctor ADR-0001 decision 3). Same status page (`:3852`), the `/events` route. Never derived
+ * from the registry or env — mirrors {@link DOCTOR_STATUS_URL}'s fixed-constant posture so the
+ * server-side relay (`daemon/telemetry-proxy.ts`) can never be pointed at an attacker-chosen origin.
+ */
+export const DOCTOR_EVENTS_URL = "http://127.0.0.1:3852/events";
+export const HONEYCOMB_HOME_DIR = join(homedir(), ".honeycomb");
+export const HIVE_PID_PATH = join(HONEYCOMB_HOME_DIR, "hive.pid");
+export const HIVE_LOCK_PATH = join(HONEYCOMB_HOME_DIR, "hive.lock");
+//# sourceMappingURL=constants.js.map

package/dist/shared/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/shared/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,WAAW,MAAM,oBAAoB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAEnE,MAAM,CAAC,MAAM,SAAS,GAAG,WAAoB,CAAC;AAC9C,MAAM,CAAC,MAAM,SAAS,GAAG,IAAa,CAAC;AACvC,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC;AAEhD,0GAA0G;AAC1G,MAAM,CAAC,MAAM,iBAAiB,GAAG,mCAA4C,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,8BAAuC,CAAC;AAEzE,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;AAChE,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;AAClE,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC"}

package/dist/shared/daemon-routing.d.ts

@@ -0,0 +1,11 @@
+export declare const DEFAULT_DAEMON_BASES: Readonly<{
+    readonly honeycomb: "http://127.0.0.1:3850";
+    readonly nectar: "http://127.0.0.1:3854";
+}>;
+export type DaemonName = keyof typeof DEFAULT_DAEMON_BASES;
+export type DaemonBases = Record<DaemonName, string>;
+export declare function resolveEndpointOwner(endpointPath: string): DaemonName;
+export declare function normalizeBaseUrl(baseUrl: string): string;
+/** True iff `baseUrl` parses as an absolute URL whose host is a trusted loopback name. */
+export declare function isLoopbackBaseUrl(baseUrl: string): boolean;
+export declare function normalizeDaemonBases(bases?: Partial<Record<DaemonName, string>>): DaemonBases;

package/dist/shared/daemon-routing.js

@@ -0,0 +1,38 @@
+export const DEFAULT_DAEMON_BASES = Object.freeze({
+    honeycomb: "http://127.0.0.1:3850",
+    nectar: "http://127.0.0.1:3854"
+});
+const HIVE_GRAPH_PREFIX = "/api/hive-graph";
+export function resolveEndpointOwner(endpointPath) {
+    return endpointPath === HIVE_GRAPH_PREFIX || endpointPath.startsWith(`${HIVE_GRAPH_PREFIX}/`)
+        ? "nectar"
+        : "honeycomb";
+}
+export function normalizeBaseUrl(baseUrl) {
+    return baseUrl.endsWith("/") ? baseUrl.slice(0, -1) : baseUrl;
+}
+/**
+ * The only hostnames a daemon base is trusted to resolve to. hive aggregates every workload
+ * daemon over loopback HTTP by construction (`DAEMON_HOST`/`HIVE_HOST` are always
+ * `127.0.0.1`); a registry entry naming any other host is rejected rather than trusted, so a
+ * tampered `doctor.daemons.json` (or a compromised daemon registration) cannot redirect the
+ * server-side proxy (`src/daemon/proxy.ts`) — and the session/memory data it carries in request
+ * bodies — to an attacker-controlled origin.
+ */
+const LOOPBACK_HOSTNAMES = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
+/** True iff `baseUrl` parses as an absolute URL whose host is a trusted loopback name. */
+export function isLoopbackBaseUrl(baseUrl) {
+    try {
+        return LOOPBACK_HOSTNAMES.has(new URL(baseUrl).hostname);
+    }
+    catch {
+        return false;
+    }
+}
+export function normalizeDaemonBases(bases = {}) {
+    return {
+        honeycomb: normalizeBaseUrl(bases.honeycomb ?? DEFAULT_DAEMON_BASES.honeycomb),
+        nectar: normalizeBaseUrl(bases.nectar ?? DEFAULT_DAEMON_BASES.nectar)
+    };
+}
+//# sourceMappingURL=daemon-routing.js.map

package/dist/shared/daemon-routing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-routing.js","sourceRoot":"","sources":["../../src/shared/daemon-routing.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IAChD,SAAS,EAAE,uBAAuB;IAClC,MAAM,EAAE,uBAAuB;CACvB,CAAC,CAAC;AAKZ,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAE5C,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,OAAO,YAAY,KAAK,iBAAiB,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,iBAAiB,GAAG,CAAC;QAC3F,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,WAAW,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAE/E,0FAA0F;AAC1F,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAA6C,EAAE;IAClF,OAAO;QACL,SAAS,EAAE,gBAAgB,CAAC,KAAK,CAAC,SAAS,IAAI,oBAAoB,CAAC,SAAS,CAAC;QAC9E,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,MAAM,IAAI,oBAAoB,CAAC,MAAM,CAAC;KACtE,CAAC;AACJ,CAAC"}

package/dist/shared/fleet-readiness.d.ts

@@ -0,0 +1,18 @@
+export type FleetHealth = "ok" | "degraded" | "unreachable" | "unknown";
+export type FleetDaemonStatus = {
+    readonly name: string;
+    readonly health: FleetHealth;
+    /** Opaque pass-through of doctor's per-daemon escalation record; hive does not interpret it. */
+    readonly escalation: unknown;
+};
+export type FleetStatusResponse = {
+    readonly supervisor: "reachable";
+    readonly health: FleetHealth;
+    readonly daemons: ReadonlyArray<FleetDaemonStatus>;
+    readonly asOf: string;
+} | {
+    readonly supervisor: "unreachable";
+    readonly daemons: readonly [];
+};
+export declare const V1_REQUIRED_PEERS: readonly ["honeycomb"];
+export declare function isFleetReady(status: FleetStatusResponse): boolean;

package/dist/shared/fleet-readiness.js

@@ -0,0 +1,9 @@
+export const V1_REQUIRED_PEERS = ["honeycomb"];
+export function isFleetReady(status) {
+    if (status.supervisor !== "reachable")
+        return false;
+    if (status.health !== "ok")
+        return false;
+    return V1_REQUIRED_PEERS.every((name) => status.daemons.some((daemon) => daemon.name === name && daemon.health === "ok"));
+}
+//# sourceMappingURL=fleet-readiness.js.map

package/dist/shared/fleet-readiness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet-readiness.js","sourceRoot":"","sources":["../../src/shared/fleet-readiness.ts"],"names":[],"mappings":"AAkBA,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,WAAW,CAAU,CAAC;AAExD,MAAM,UAAU,YAAY,CAAC,MAA2B;IACtD,IAAI,MAAM,CAAC,UAAU,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CACtC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAChF,CAAC;AACJ,CAAC"}

package/dist/shared/fleet-telemetry.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Shared fleet-TELEMETRY shapes — hive PRD-004/PRD-005, mirroring doctor's
+ * `src/telemetry/schema.ts` (Contract C in `library/ledger/EXECUTION_LEDGER.md`).
+ *
+ * hive does not depend on the doctor package (each fleet member is its own published
+ * npm package), so this module is a hand-kept, browser-and-server-safe COPY of the wire shape
+ * doctor's SSE stream (`GET http://127.0.0.1:3852/events`, event `fleet-telemetry`) actually
+ * emits. Keep it in lockstep with doctor's schema.ts if that contract ever changes.
+ *
+ * `metrics` is deliberately `Readonly<Record<string, number>>`: honeycomb ships three counters
+ * (`actionsTaken`, `filesProcessed`, `memoriesCreated`), nectar ships five
+ * (`filesRegistered`, `nectarsMinted`, `descriptionsGenerated`, `hiveGraphVersions`,
+ * `embeddingsComputed`) — every reader built on this module (PRD-005b's metrics render, PRD-004c's
+ * derivation) is schema-tolerant by construction: it never hardcodes one service's key names.
+ */
+/** Coarse fleet-visible health for one service (matches `../daemon/fleet-status.ts`'s `FleetHealth`). */
+export type FleetHealth = "ok" | "degraded" | "unreachable" | "unknown";
+/** A schema-tolerant metrics snapshot: whatever counters a service's telemetry DB reports, camelCased. */
+export type ServiceMetrics = Readonly<Record<string, number>>;
+/** Why a service's telemetry read was skipped this doctor poll tick (fault isolation, sd-AC-9). */
+export type TelemetryFaultReason = "missing" | "locked" | "malformed" | "read-error";
+/** Deep Lake connection/stats fields carried on one service's fleet model (PRD-005b hm-AC-5/hm-AC-6). */
+export interface FleetDeeplakeStats {
+    readonly connected: boolean | null;
+    readonly lastCommunicationAt: string | null;
+}
+/**
+ * One service's merged fleet-model row, as doctor's poll loop emits it: the static
+ * "should exist" registry entry plus its live runtime status. A registered-but-silent service
+ * appears here with `health: "unknown"` and `lastSeen: null` (never omitted, never a false
+ * `active` — sd-AC-2).
+ */
+export interface FleetServiceModel {
+    readonly name: string;
+    readonly health: FleetHealth;
+    /** ISO-8601 of the last confirmed check-in, or `null` when never seen. Stops advancing (not cleared) on disconnect. */
+    readonly lastSeen: string | null;
+    readonly metrics: ServiceMetrics;
+    /** `null` when the service has no telemetry DB, or has one but never checked in. */
+    readonly deeplake: FleetDeeplakeStats | null;
+    /** Non-null when this service's telemetry DB was skipped THIS tick, isolated from the rest of the fleet. */
+    readonly telemetryFault: TelemetryFaultReason | null;
+}
+/** One forwarded log line, tagged with its originating service (PRD-005c). */
+export interface FleetLogEntry {
+    readonly service: string;
+    readonly ts: string;
+    readonly level: string;
+    readonly message: string;
+}
+/**
+ * The single `fleet-telemetry` SSE event payload. `logs` is a BOUNDED SLICE of only the new rows
+ * since the previous tick (never a full history), so every consumer built on this stays
+ * memory-bounded by construction (PRD-005 parent index's hard constraint).
+ */
+export interface FleetTelemetryEvent {
+    readonly asOf: string;
+    readonly services: readonly FleetServiceModel[];
+    readonly logs: readonly FleetLogEntry[];
+}
+/** The one SSE event name doctor's stream ever emits (mirrors doctor's `ingestion/sse.ts`). */
+export declare const FLEET_TELEMETRY_EVENT_NAME: "fleet-telemetry";
+/**
+ * Defensively parse one `fleet-telemetry` SSE frame's `data:` JSON (or the same shape from any
+ * future JSON transport). Returns `null` on anything malformed rather than throwing, so one bad
+ * frame never crashes the consuming hook (mirrors `fleet-status.ts`'s `safeParse`-and-degrade posture).
+ */
+export declare function parseFleetTelemetryEvent(raw: string): FleetTelemetryEvent | null;