@legioncodeinc/hive 0.1.0

package/dist/daemon/gate.d.ts

@@ -0,0 +1,55 @@
+/**
+ * The server-side PORTAL LANDING GATE — PRD-003a, implementing ADR-0004's precedence.
+ *
+ * On landing on ANY non-exempt route hive evaluates ONE ordered precedence, health then auth,
+ * before deciding what to serve:
+ *
+ *   1. Fleet not healthy (per the EXISTING `isFleetReady()` projection, `fleet-status.ts`) →
+ *      redirect to `/buzzing` (g-AC-3). Checked FIRST: an unhealthy fleet makes every other screen
+ *      useless, so auth is never even evaluated in this branch.
+ *   2. Else not logged in (the EXISTING proxied honeycomb `/setup/state` `authenticated` bit,
+ *      `setup-auth.ts`) → redirect to `/login` (g-AC-4). A fetch failure/timeout reads as "not
+ *      logged in" (l-AC-6) — never a fail-soft into the dashboard.
+ *   3. Else serve the requested route as-is (g-AC-5 / g-AC-6): `next()` falls through to the
+ *      more specific route/catch-all registered after this middleware in `server.ts`.
+ *
+ * `/buzzing` and `/login` are a FIXED exemption set checked BEFORE the precedence above, so they
+ * are always served directly and the redirect can never loop (g-AC-7 / g-AC-8 / g-AC-9): the only
+ * two redirect destinations are themselves exempt from producing another redirect.
+ *
+ * This middleware also bypasses hive's own infra: `/health` (this daemon's own liveness, not a
+ * portal screen), the bundled asset routes (`/app.js`, `/styles.css`, the logo, `/fonts/*` — these
+ * must load even when the shell just redirected the BROWSER to `/buzzing` or `/login`, since the
+ * exempt screens are the same SPA bundle), and the `/api/*` / `/setup/*` data-plane proxy (that is
+ * an existing same-origin API surface, not a page navigation the gate should ever intercept or
+ * redirect — g-AC-11's "no open redirect" posture, plus l-AC-2's "all `/setup/*` traffic stays
+ * same-origin", both depend on the proxy handling its own requests untouched).
+ *
+ * SECURITY (g-AC-11, open-redirect defense): every redirect this middleware issues targets a
+ * FIXED, hard-coded literal (`/buzzing` or `/login`) — never a value derived from user input (no
+ * `?next=`, no `Referer`, no request path echoed back). This makes an open redirect structurally
+ * impossible here: there is no code path where an attacker-controlled string reaches `c.redirect`.
+ */
+import type { MiddlewareHandler } from "hono";
+import { type FetchImpl as FleetFetchImpl } from "./fleet-status.js";
+import { type SetupAuthFetchImpl } from "./setup-auth.js";
+/** The only two gate-exempt SCREENS (g-AC-7 / g-AC-8): always served directly, never redirected. */
+export declare const GATE_EXEMPT_ROUTES: readonly ["/buzzing", "/login"];
+export interface CreatePortalGateOptions {
+    /** The fetch used for the health check (defaults to the global `fetch`; a test injects a fake). */
+    readonly fleetStatusFetch?: FleetFetchImpl;
+    /** Override doctor's status URL (defaults to the fixed loopback constant). */
+    readonly doctorStatusUrl?: string;
+    /** The fetch used for the auth check (defaults to the global `fetch`; a test injects a fake). */
+    readonly setupAuthFetch?: SetupAuthFetchImpl;
+    /** Override the doctor registry file path the auth check resolves honeycomb's base from. */
+    readonly registryPath?: string;
+}
+/**
+ * Build the portal landing gate middleware (g-AC-1..11). Register it FIRST on hive's Hono app
+ * (`app.use("*", createPortalGate(...))`) so it runs ahead of every other route. It never renders
+ * a response itself for the passing case — it calls `next()` and lets the routes registered after
+ * it (the asset routes, `/health`, `/api/fleet-status`, the BFF proxy, and finally the SPA shell
+ * catch-all) serve the request, exactly as they do today for the paths this gate bypasses.
+ */
+export declare function createPortalGate(options?: CreatePortalGateOptions): MiddlewareHandler;

package/dist/daemon/gate.js

@@ -0,0 +1,128 @@
+/**
+ * The server-side PORTAL LANDING GATE — PRD-003a, implementing ADR-0004's precedence.
+ *
+ * On landing on ANY non-exempt route hive evaluates ONE ordered precedence, health then auth,
+ * before deciding what to serve:
+ *
+ *   1. Fleet not healthy (per the EXISTING `isFleetReady()` projection, `fleet-status.ts`) →
+ *      redirect to `/buzzing` (g-AC-3). Checked FIRST: an unhealthy fleet makes every other screen
+ *      useless, so auth is never even evaluated in this branch.
+ *   2. Else not logged in (the EXISTING proxied honeycomb `/setup/state` `authenticated` bit,
+ *      `setup-auth.ts`) → redirect to `/login` (g-AC-4). A fetch failure/timeout reads as "not
+ *      logged in" (l-AC-6) — never a fail-soft into the dashboard.
+ *   3. Else serve the requested route as-is (g-AC-5 / g-AC-6): `next()` falls through to the
+ *      more specific route/catch-all registered after this middleware in `server.ts`.
+ *
+ * `/buzzing` and `/login` are a FIXED exemption set checked BEFORE the precedence above, so they
+ * are always served directly and the redirect can never loop (g-AC-7 / g-AC-8 / g-AC-9): the only
+ * two redirect destinations are themselves exempt from producing another redirect.
+ *
+ * This middleware also bypasses hive's own infra: `/health` (this daemon's own liveness, not a
+ * portal screen), the bundled asset routes (`/app.js`, `/styles.css`, the logo, `/fonts/*` — these
+ * must load even when the shell just redirected the BROWSER to `/buzzing` or `/login`, since the
+ * exempt screens are the same SPA bundle), and the `/api/*` / `/setup/*` data-plane proxy (that is
+ * an existing same-origin API surface, not a page navigation the gate should ever intercept or
+ * redirect — g-AC-11's "no open redirect" posture, plus l-AC-2's "all `/setup/*` traffic stays
+ * same-origin", both depend on the proxy handling its own requests untouched).
+ *
+ * SECURITY (g-AC-11, open-redirect defense): every redirect this middleware issues targets a
+ * FIXED, hard-coded literal (`/buzzing` or `/login`) — never a value derived from user input (no
+ * `?next=`, no `Referer`, no request path echoed back). This makes an open redirect structurally
+ * impossible here: there is no code path where an attacker-controlled string reaches `c.redirect`.
+ */
+import { DOCTOR_STATUS_URL } from "../shared/constants.js";
+import { isFleetReady } from "../shared/fleet-readiness.js";
+import { fetchFleetStatus } from "./fleet-status.js";
+import { fetchSetupAuthenticated } from "./setup-auth.js";
+/** The fixed redirect target for an unhealthy fleet (g-AC-3). A hard-coded literal, never derived. */
+const BUZZING_ROUTE = "/buzzing";
+/** The fixed redirect target for a logged-out operator (g-AC-4). A hard-coded literal, never derived. */
+const LOGIN_ROUTE = "/login";
+/** The only two gate-exempt SCREENS (g-AC-7 / g-AC-8): always served directly, never redirected. */
+export const GATE_EXEMPT_ROUTES = [BUZZING_ROUTE, LOGIN_ROUTE];
+/**
+ * hive's OWN liveness route + the bundled SPA asset routes — never a page navigation to gate.
+ * `/health` is deliberately NOT in this set (see {@link isInfraPath}): PRD-005b claims that same
+ * literal path for the operator-facing `/health` page, so it needs content-negotiated handling
+ * rather than a blanket exemption.
+ */
+const GATE_EXEMPT_INFRA_PATHS = new Set(["/app.js", "/styles.css", "/honeycomb-memory-cluster.svg"]);
+/** Path PREFIXES that are data-plane traffic (the BFF proxy, fonts), never a gated page route. */
+const GATE_EXEMPT_INFRA_PREFIXES = ["/api/", "/setup/", "/fonts/"];
+/**
+ * hive's own machine-liveness path. Ambiguous on purpose (PRD-005b): a health-probe/monitoring
+ * caller (doctor's own `/health` probe, an ops tool) never sends `Accept: text/html`, while a
+ * browser navigating to the new `/health` OPERATOR page always does. `server.ts`'s `/health`
+ * handler makes the SAME distinction so the two behaviors stay in lockstep.
+ */
+const LIVENESS_PATH = "/health";
+/** True iff `accept` prefers HTML — the signal that distinguishes a page navigation from a machine probe. */
+function prefersHtml(accept) {
+    return accept.includes("text/html");
+}
+/**
+ * True for hive's own infra/asset/proxy surface — bypasses the gate entirely (see module doc).
+ * `/health` is infra ONLY when the caller is not asking for HTML (a liveness probe); an
+ * HTML-accepting request to `/health` is treated as a normal page route so it gets the same
+ * buzzing/login precedence as every other SPA route (PRD-005b).
+ */
+function isInfraPath(pathname, accept) {
+    if (pathname === LIVENESS_PATH)
+        return !prefersHtml(accept);
+    if (GATE_EXEMPT_INFRA_PATHS.has(pathname))
+        return true;
+    return GATE_EXEMPT_INFRA_PREFIXES.some((prefix) => pathname.startsWith(prefix));
+}
+/** True for the two gate-exempt screens (`/buzzing`, `/login`) — always served directly. */
+function isExemptRoute(pathname) {
+    return GATE_EXEMPT_ROUTES.includes(pathname);
+}
+/**
+ * Build the portal landing gate middleware (g-AC-1..11). Register it FIRST on hive's Hono app
+ * (`app.use("*", createPortalGate(...))`) so it runs ahead of every other route. It never renders
+ * a response itself for the passing case — it calls `next()` and lets the routes registered after
+ * it (the asset routes, `/health`, `/api/fleet-status`, the BFF proxy, and finally the SPA shell
+ * catch-all) serve the request, exactly as they do today for the paths this gate bypasses.
+ */
+export function createPortalGate(options = {}) {
+    const fleetStatusFetch = options.fleetStatusFetch ?? fetch;
+    const doctorStatusUrl = options.doctorStatusUrl ?? DOCTOR_STATUS_URL;
+    const setupAuthFetch = options.setupAuthFetch ?? fetch;
+    const registryPath = options.registryPath;
+    return async (c, next) => {
+        const pathname = new URL(c.req.url).pathname;
+        const accept = c.req.header("accept") ?? "";
+        // hive's own infra/asset/proxy surface: never a page navigation, never gated.
+        if (isInfraPath(pathname, accept)) {
+            await next();
+            return undefined;
+        }
+        // g-AC-7 / g-AC-8: the exemption set is checked BEFORE the precedence, so `/buzzing` and
+        // `/login` are ALWAYS served directly — this is what guarantees the redirect below can never
+        // loop (g-AC-9): the only two redirect targets are themselves exempt from producing another.
+        if (isExemptRoute(pathname)) {
+            await next();
+            return undefined;
+        }
+        // g-AC-3: health first, before auth is even evaluated. Reuses the SAME `isFleetReady()`
+        // predicate `/buzzing`'s own readiness view will read (PRD-002a), so "healthy" means one
+        // thing across the gate and the screen it redirects to.
+        const fleetStatus = await fetchFleetStatus(fleetStatusFetch, doctorStatusUrl);
+        if (!isFleetReady(fleetStatus)) {
+            return c.redirect(BUZZING_ROUTE, 302);
+        }
+        // g-AC-4 / l-AC-4 / l-AC-6: auth second. A fetch failure/timeout resolves to `false` inside
+        // `fetchSetupAuthenticated`, so a transient proxy fault falls to `/login`, never the dashboard.
+        // The incoming request's abort signal is threaded through so a client disconnect aborts the
+        // upstream `/setup/state` fetch instead of pinning it (an abort also reads as fail-closed).
+        const authenticated = await fetchSetupAuthenticated(setupAuthFetch, { registryPath, signal: c.req.raw.signal });
+        if (!authenticated) {
+            return c.redirect(LOGIN_ROUTE, 302);
+        }
+        // g-AC-5 / g-AC-6 / g-AC-10: healthy + authenticated — serve the requested route as-is (the
+        // SPA shell catch-all defaults `/` to the dashboard; nothing here re-derives a fallback path).
+        await next();
+        return undefined;
+    };
+}
+//# sourceMappingURL=gate.js.map

package/dist/daemon/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/daemon/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAoC,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,uBAAuB,EAA2B,MAAM,iBAAiB,CAAC;AAEnF,sGAAsG;AACtG,MAAM,aAAa,GAAG,UAAmB,CAAC;AAE1C,yGAAyG;AACzG,MAAM,WAAW,GAAG,QAAiB,CAAC;AAEtC,oGAAoG;AACpG,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,aAAa,EAAE,WAAW,CAAU,CAAC;AAExE;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,EAAE,aAAa,EAAE,+BAA+B,CAAC,CAAC,CAAC;AAE7G,kGAAkG;AAClG,MAAM,0BAA0B,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAU,CAAC;AAE5E;;;;;GAKG;AACH,MAAM,aAAa,GAAG,SAAkB,CAAC;AAEzC,6GAA6G;AAC7G,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,QAAgB,EAAE,MAAc;IACnD,IAAI,QAAQ,KAAK,aAAa;QAAE,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,4FAA4F;AAC5F,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAQ,kBAAwC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACtE,CAAC;AAaD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAmC,EAAE;IACpE,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC3D,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,iBAAiB,CAAC;IACrE,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC;IACvD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAE1C,OAAO,KAAK,EAAE,CAAU,EAAE,IAAyB,EAA4B,EAAE;QAC/E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC7C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE5C,8EAA8E;QAC9E,IAAI,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,EAAE,CAAC;YACb,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,yFAAyF;QACzF,6FAA6F;QAC7F,6FAA6F;QAC7F,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,EAAE,CAAC;YACb,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,wFAAwF;QACxF,yFAAyF;QACzF,wDAAwD;QACxD,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;QAC9E,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;QAED,4FAA4F;QAC5F,gGAAgG;QAChG,4FAA4F;QAC5F,4FAA4F;QAC5F,MAAM,aAAa,GAAG,MAAM,uBAAuB,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAChH,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;QAED,4FAA4F;QAC5F,+FAA+F;QAC/F,MAAM,IAAI,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC"}

package/dist/daemon/proxy.d.ts

@@ -0,0 +1,38 @@
+/**
+ * hive server-side API proxy: the BFF (backend-for-frontend) federation layer.
+ *
+ * The dashboard browser talks ONLY to hive's own origin (same-origin `/api/*` and
+ * `/setup/*`). hive's SERVER resolves the daemon that owns each request from doctor's
+ * registry, then fetches that daemon over loopback and streams the response straight back.
+ * This replaces the earlier client-side federation (the browser fetching each workload
+ * daemon's origin directly via `/api/daemon-bases`), which required the workload daemons to
+ * emit CORS headers and exposed their ports to a browser context.
+ *
+ * Auth model: TRANSPARENT PASS-THROUGH. hive forwards the browser's own request headers
+ * (session headers + any auth) verbatim to the workload daemon; it stores no credential of its
+ * own. This preserves honeycomb's existing loopback + local-mode + session-header posture and
+ * keeps team/hybrid auth working without hive becoming an auth authority.
+ *
+ * SECURITY (SSRF): the daemon base is resolved through {@link resolveDaemonBases}, which drops
+ * any non-loopback `healthUrl` from the registry and only ever hands back loopback origins. The
+ * proxy re-checks the resolved base with {@link isLoopbackBaseUrl} (defense in depth) and pins
+ * `redirect: "error"` so a workload daemon cannot 3xx-redirect the proxied fetch to an
+ * off-loopback origin after the initial URL passed the loopback gate.
+ */
+import type { Context } from "hono";
+/** The injectable fetch surface (the global in prod; a mock in unit tests). */
+export type ProxyFetch = (input: string, init: RequestInit) => Promise<Response>;
+export interface CreateApiProxyOptions {
+    /** Override the doctor registry file path the daemon bases are resolved from. */
+    readonly registryPath?: string;
+    /** The fetch implementation used to reach the workload daemon (defaults to the global `fetch`). */
+    readonly fetchImpl?: ProxyFetch;
+}
+/**
+ * Build the same-origin API proxy handler. Register it on hive's Hono app for `/api/*` and
+ * `/setup/*` (AFTER the hive-owned routes like `/health` and `/api/fleet-status`, so those
+ * win). It resolves the owning daemon per request, forwards method + headers + body over
+ * loopback, and streams the upstream response back. Any failure (network error, non-loopback
+ * base, redirect) degrades to a fail-soft 502 so one daemon being down never blanks the page.
+ */
+export declare function createApiProxy(options?: CreateApiProxyOptions): (c: Context) => Promise<Response>;

package/dist/daemon/proxy.js

@@ -0,0 +1,126 @@
+/**
+ * hive server-side API proxy: the BFF (backend-for-frontend) federation layer.
+ *
+ * The dashboard browser talks ONLY to hive's own origin (same-origin `/api/*` and
+ * `/setup/*`). hive's SERVER resolves the daemon that owns each request from doctor's
+ * registry, then fetches that daemon over loopback and streams the response straight back.
+ * This replaces the earlier client-side federation (the browser fetching each workload
+ * daemon's origin directly via `/api/daemon-bases`), which required the workload daemons to
+ * emit CORS headers and exposed their ports to a browser context.
+ *
+ * Auth model: TRANSPARENT PASS-THROUGH. hive forwards the browser's own request headers
+ * (session headers + any auth) verbatim to the workload daemon; it stores no credential of its
+ * own. This preserves honeycomb's existing loopback + local-mode + session-header posture and
+ * keeps team/hybrid auth working without hive becoming an auth authority.
+ *
+ * SECURITY (SSRF): the daemon base is resolved through {@link resolveDaemonBases}, which drops
+ * any non-loopback `healthUrl` from the registry and only ever hands back loopback origins. The
+ * proxy re-checks the resolved base with {@link isLoopbackBaseUrl} (defense in depth) and pins
+ * `redirect: "error"` so a workload daemon cannot 3xx-redirect the proxied fetch to an
+ * off-loopback origin after the initial URL passed the loopback gate.
+ */
+import { isLoopbackBaseUrl, resolveEndpointOwner } from "../shared/daemon-routing.js";
+import { resolveDaemonBases } from "./registry.js";
+/**
+ * Request headers that must NOT be forwarded to the upstream daemon. `host` is dropped so fetch
+ * sets it from the target origin; the rest are hop-by-hop headers (RFC 7230 §6.1) that are
+ * meaningless across a proxy, plus `content-length` which fetch recomputes from the forwarded body.
+ */
+const STRIPPED_REQUEST_HEADERS = new Set([
+    "host",
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+    "content-length"
+]);
+/**
+ * Response headers that must NOT be forwarded back to the browser. Hop-by-hop headers plus the
+ * framing headers fetch has already resolved: `content-encoding`/`content-length` would be wrong
+ * because fetch decompresses the upstream body before we re-stream it.
+ */
+const STRIPPED_RESPONSE_HEADERS = new Set([
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+    "content-encoding",
+    "content-length"
+]);
+/** The fail-soft result for an unreachable/failed upstream: a non-2xx JSON body the wire degrades to empty. */
+function unreachableResponse(daemon) {
+    return new Response(JSON.stringify({ error: "unreachable", daemon }), {
+        status: 502,
+        headers: { "content-type": "application/json" }
+    });
+}
+function forwardRequestHeaders(source) {
+    const headers = new Headers();
+    source.forEach((value, key) => {
+        if (!STRIPPED_REQUEST_HEADERS.has(key.toLowerCase()))
+            headers.set(key, value);
+    });
+    return headers;
+}
+function forwardResponseHeaders(source) {
+    const headers = new Headers();
+    source.forEach((value, key) => {
+        if (!STRIPPED_RESPONSE_HEADERS.has(key.toLowerCase()))
+            headers.set(key, value);
+    });
+    return headers;
+}
+/**
+ * Build the same-origin API proxy handler. Register it on hive's Hono app for `/api/*` and
+ * `/setup/*` (AFTER the hive-owned routes like `/health` and `/api/fleet-status`, so those
+ * win). It resolves the owning daemon per request, forwards method + headers + body over
+ * loopback, and streams the upstream response back. Any failure (network error, non-loopback
+ * base, redirect) degrades to a fail-soft 502 so one daemon being down never blanks the page.
+ */
+export function createApiProxy(options = {}) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    return async (c) => {
+        const incoming = c.req.raw;
+        const requestUrl = new URL(incoming.url);
+        const endpointPath = requestUrl.pathname;
+        const owner = resolveEndpointOwner(endpointPath);
+        const base = resolveDaemonBases({ registryPath: options.registryPath })[owner];
+        // resolveDaemonBases only ever returns loopback origins; this re-check is defense in depth so a
+        // future change to base resolution can never turn the proxy into an off-loopback SSRF primitive.
+        if (!isLoopbackBaseUrl(base))
+            return unreachableResponse(owner);
+        const target = `${base}${endpointPath}${requestUrl.search}`;
+        const method = incoming.method;
+        const hasBody = method !== "GET" && method !== "HEAD";
+        // Buffer the (small, JSON) request body rather than streaming it, so no `duplex: "half"` dance
+        // is needed. GET/HEAD carry no body. The response body is streamed through (below) so SSE tails
+        // and large payloads are not buffered.
+        const body = hasBody ? await incoming.arrayBuffer() : undefined;
+        try {
+            const upstream = await fetchImpl(target, {
+                method,
+                headers: forwardRequestHeaders(incoming.headers),
+                ...(body !== undefined ? { body } : {}),
+                redirect: "error"
+            });
+            return new Response(upstream.body, {
+                status: upstream.status,
+                statusText: upstream.statusText,
+                headers: forwardResponseHeaders(upstream.headers)
+            });
+        }
+        catch {
+            // Network error, refused connection, or a blocked redirect: fail soft per daemon.
+            return unreachableResponse(owner);
+        }
+    };
+}
+//# sourceMappingURL=proxy.js.map

package/dist/daemon/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../src/daemon/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAmB,MAAM,6BAA6B,CAAC;AACvG,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAYnD;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,MAAM;IACN,YAAY;IACZ,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;IACT,gBAAgB;CACjB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,YAAY;IACZ,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;IACT,kBAAkB;IAClB,gBAAgB;CACjB,CAAC,CAAC;AAEH,+GAA+G;AAC/G,SAAS,mBAAmB,CAAC,MAAkB;IAC7C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,EAAE;QACpE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAe;IAC5C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5B,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAe;IAC7C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5B,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,UAAiC,EAAE;IAChE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAK,KAAoB,CAAC;IAE7D,OAAO,KAAK,EAAE,CAAU,EAAqB,EAAE;QAC7C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAC3B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC;QACzC,MAAM,KAAK,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAEjD,MAAM,IAAI,GAAG,kBAAkB,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAC/E,gGAAgG;QAChG,iGAAiG;QACjG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;YAAE,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAEhE,MAAM,MAAM,GAAG,GAAG,IAAI,GAAG,YAAY,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC;QACtD,+FAA+F;QAC/F,gGAAgG;QAChG,uCAAuC;QACvC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAEhE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE;gBACvC,MAAM;gBACN,OAAO,EAAE,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAChD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAC;YACH,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;gBACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,OAAO,EAAE,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;YAClF,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/daemon/registry.d.ts

@@ -0,0 +1,31 @@
+import { type DaemonBases, type DaemonName } from "../shared/daemon-routing.js";
+export declare const DOCTOR_REGISTRY_PATH: string;
+export interface ResolveDaemonBasesOptions {
+    readonly registryPath?: string;
+    readonly readFile?: (path: string) => string;
+}
+export declare function baseUrlFromHealthUrl(healthUrl: string): string | null;
+export declare function parseDoctorRegistry(raw: string): Partial<Record<DaemonName, string>>;
+/**
+ * Parse the RAW list of registered service names from a doctor registry file body (PRD-004a
+ * bz-AC-1/bz-AC-2). Unlike {@link parseDoctorRegistry} (which narrows to the two daemons
+ * hive's BFF proxy forwards to, `honeycomb`/`nectar`), this returns EVERY registered name —
+ * including `hive` itself or any future peer — so `/buzzing` and the health rail can render one
+ * tile/pill per service that doctor says should exist, even one hive's proxy never routes
+ * to. A corrupt/absent registry degrades to an empty list (never a throw), matching every other
+ * reader of this file.
+ */
+export declare function parseRegisteredServiceNames(raw: string): readonly string[];
+/** Options for {@link resolveRegisteredServiceNames}. */
+export interface ResolveRegisteredServiceNamesOptions {
+    readonly registryPath?: string;
+    readonly readFile?: (path: string) => string;
+}
+/**
+ * Read the FULL list of registered service names from doctor's registry file (PRD-004a
+ * bz-AC-1/bz-AC-2, PRD-005a hr-AC-1). A missing/unreadable/corrupt registry resolves to an empty
+ * list rather than throwing, so a cold box with no registry yet still serves `/buzzing` (it simply
+ * shows no tiles until the fleet-status/SSE feed enumerates services some other way).
+ */
+export declare function resolveRegisteredServiceNames(options?: ResolveRegisteredServiceNamesOptions): readonly string[];
+export declare function resolveDaemonBases(options?: ResolveDaemonBasesOptions): DaemonBases;

package/dist/daemon/registry.js

@@ -0,0 +1,120 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { z } from "zod";
+import { HONEYCOMB_HOME_DIR } from "../shared/constants.js";
+import { isLoopbackBaseUrl, normalizeDaemonBases } from "../shared/daemon-routing.js";
+export const DOCTOR_REGISTRY_PATH = join(HONEYCOMB_HOME_DIR, "doctor.daemons.json");
+const RegistryEntrySchema = z.object({
+    name: z.string().min(1),
+    healthUrl: z.string().url(),
+    pidPath: z.string().min(1)
+});
+const DoctorRegistrySchema = z.object({
+    daemons: z.array(RegistryEntrySchema).catch([])
+});
+function daemonName(name) {
+    if (name === "honeycomb" || name === "nectar")
+        return name;
+    return null;
+}
+export function baseUrlFromHealthUrl(healthUrl) {
+    try {
+        const url = new URL(healthUrl);
+        // Reject any registry entry naming a non-loopback host BEFORE it can become a daemon base:
+        // every workload daemon binds loopback only, so a `healthUrl` pointing elsewhere is either a
+        // corrupt registry or a tampered one, and must never become a base the server-side proxy
+        // (`src/daemon/proxy.ts`) would forward request bodies (including captured session/memory
+        // content) to.
+        if (!isLoopbackBaseUrl(url.origin))
+            return null;
+        const pathname = url.pathname.endsWith("/health") ? url.pathname.slice(0, -"/health".length) : url.pathname;
+        const normalizedPath = pathname === "/" ? "" : pathname.replace(/\/$/, "");
+        return `${url.origin}${normalizedPath}`;
+    }
+    catch {
+        // zod normally rejects invalid URLs first; this keeps the exported helper total for tests and callers.
+        return null;
+    }
+}
+export function parseDoctorRegistry(raw) {
+    let parsedJson;
+    try {
+        parsedJson = JSON.parse(raw);
+    }
+    catch {
+        // A corrupt registry must not prevent hive from serving. Defaults remain available.
+        return {};
+    }
+    const parsed = DoctorRegistrySchema.safeParse(parsedJson);
+    if (!parsed.success)
+        return {};
+    const bases = {};
+    for (const entry of parsed.data.daemons) {
+        const name = daemonName(entry.name);
+        if (name === null)
+            continue;
+        const baseUrl = baseUrlFromHealthUrl(entry.healthUrl);
+        if (baseUrl !== null)
+            bases[name] = baseUrl;
+    }
+    return bases;
+}
+/**
+ * Parse the RAW list of registered service names from a doctor registry file body (PRD-004a
+ * bz-AC-1/bz-AC-2). Unlike {@link parseDoctorRegistry} (which narrows to the two daemons
+ * hive's BFF proxy forwards to, `honeycomb`/`nectar`), this returns EVERY registered name —
+ * including `hive` itself or any future peer — so `/buzzing` and the health rail can render one
+ * tile/pill per service that doctor says should exist, even one hive's proxy never routes
+ * to. A corrupt/absent registry degrades to an empty list (never a throw), matching every other
+ * reader of this file.
+ */
+export function parseRegisteredServiceNames(raw) {
+    let parsedJson;
+    try {
+        parsedJson = JSON.parse(raw);
+    }
+    catch {
+        return [];
+    }
+    const parsed = DoctorRegistrySchema.safeParse(parsedJson);
+    if (!parsed.success)
+        return [];
+    // De-duplicate defensively (a hand-edited registry could repeat a name); preserve first-seen order.
+    const seen = new Set();
+    const names = [];
+    for (const entry of parsed.data.daemons) {
+        if (seen.has(entry.name))
+            continue;
+        seen.add(entry.name);
+        names.push(entry.name);
+    }
+    return names;
+}
+/**
+ * Read the FULL list of registered service names from doctor's registry file (PRD-004a
+ * bz-AC-1/bz-AC-2, PRD-005a hr-AC-1). A missing/unreadable/corrupt registry resolves to an empty
+ * list rather than throwing, so a cold box with no registry yet still serves `/buzzing` (it simply
+ * shows no tiles until the fleet-status/SSE feed enumerates services some other way).
+ */
+export function resolveRegisteredServiceNames(options = {}) {
+    const registryPath = options.registryPath ?? DOCTOR_REGISTRY_PATH;
+    const readFile = options.readFile ?? ((path) => readFileSync(path, "utf8"));
+    try {
+        return parseRegisteredServiceNames(readFile(registryPath));
+    }
+    catch {
+        return [];
+    }
+}
+export function resolveDaemonBases(options = {}) {
+    const registryPath = options.registryPath ?? DOCTOR_REGISTRY_PATH;
+    const readFile = options.readFile ?? ((path) => readFileSync(path, "utf8"));
+    try {
+        return normalizeDaemonBases(parseDoctorRegistry(readFile(registryPath)));
+    }
+    catch {
+        // Missing or unreadable registry means no daemon has registered yet. Use documented loopback defaults.
+        return normalizeDaemonBases();
+    }
+}
+//# sourceMappingURL=registry.js.map

package/dist/daemon/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/daemon/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAqC,MAAM,6BAA6B,CAAC;AAEzH,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;AAEpF,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;CAChD,CAAC,CAAC;AAOH,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,2FAA2F;QAC3F,6FAA6F;QAC7F,yFAAyF;QACzF,0FAA0F;QAC1F,eAAe;QACf,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC5G,MAAM,cAAc,GAAG,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3E,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,uGAAuG;QACvG,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,IAAI,UAAmB,CAAC;IACxB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,oFAAoF;QACpF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAE/B,MAAM,KAAK,GAAwC,EAAE,CAAC;IACtD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QAC5B,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,OAAO,KAAK,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;IAC9C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAW;IACrD,IAAI,UAAmB,CAAC;IACxB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAE/B,oGAAoG;IACpG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAQD;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAAC,UAAgD,EAAE;IAC9F,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,oBAAoB,CAAC;IAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAE5F,IAAI,CAAC;QACH,OAAO,2BAA2B,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,UAAqC,EAAE;IACxE,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,oBAAoB,CAAC;IAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAE5F,IAAI,CAAC;QACH,OAAO,oBAAoB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,uGAAuG;QACvG,OAAO,oBAAoB,EAAE,CAAC;IAChC,CAAC;AACH,CAAC"}

package/dist/daemon/server.d.ts

@@ -0,0 +1,41 @@
+import { serve } from "@hono/node-server";
+import { Hono } from "hono";
+import { type LockPaths } from "../lock.js";
+import { type FetchImpl } from "./fleet-status.js";
+import { type ProxyFetch } from "./proxy.js";
+import { type TelemetryFetch } from "./telemetry-proxy.js";
+import type { SetupAuthFetchImpl } from "./setup-auth.js";
+export interface CreateHiveOptions {
+    readonly host?: string;
+    readonly port?: number;
+    readonly now?: () => number;
+    readonly registryPath?: string;
+    readonly fleetStatusFetch?: FetchImpl;
+    readonly doctorStatusUrl?: string;
+    /** The fetch used by the API proxy to reach workload daemons over loopback (defaults to the global `fetch`). */
+    readonly proxyFetch?: ProxyFetch;
+    /** The fetch used by the portal gate's auth check (`/setup/state`, defaults to the global `fetch`). */
+    readonly setupAuthFetch?: SetupAuthFetchImpl;
+    /** Override doctor's SSE events URL the telemetry relay connects to (defaults to the fixed loopback constant). */
+    readonly doctorEventsUrl?: string;
+    /** The fetch used by the telemetry relay to reach doctor's SSE stream (defaults to the global `fetch`). */
+    readonly telemetryStreamFetch?: TelemetryFetch;
+}
+export interface StartHiveOptions extends CreateHiveOptions {
+    readonly lockPaths?: Partial<LockPaths>;
+    readonly serveFn?: ServeFunction;
+}
+export interface HiveInstance {
+    readonly app: Hono;
+    readonly host: string;
+    readonly port: number;
+    readonly startedAt: number;
+}
+export interface StartedHive extends HiveInstance {
+    readonly lockPaths: LockPaths;
+    stop(): Promise<void>;
+}
+type ServeFunction = typeof serve;
+export declare function createHive(options?: CreateHiveOptions): HiveInstance;
+export declare function startHive(options?: StartHiveOptions): StartedHive;
+export {};