@legioncodeinc/hive 0.1.0

package/dist/daemon/server.js

@@ -0,0 +1,126 @@
+import { serve } from "@hono/node-server";
+import { Hono } from "hono";
+import { acquireSingleInstanceLock, releaseSingleInstanceLock } from "../lock.js";
+import { DOCTOR_STATUS_URL, HIVE_HOST, HIVE_PORT, HIVE_VERSION } from "../shared/constants.js";
+import { mountDashboardAssets, mountDashboardShellFallback, renderShell } from "./dashboard/host.js";
+import { fetchFleetStatus } from "./fleet-status.js";
+import { createPortalGate } from "./gate.js";
+import { createApiProxy } from "./proxy.js";
+import { resolveRegisteredServiceNames } from "./registry.js";
+import { createTelemetryStreamHandler } from "./telemetry-proxy.js";
+function closeServer(server) {
+    return new Promise((resolve, reject) => {
+        server.close((error) => {
+            if (error instanceof Error) {
+                reject(error);
+                return;
+            }
+            resolve();
+        });
+    });
+}
+export function createHive(options = {}) {
+    const host = options.host ?? HIVE_HOST;
+    const port = options.port ?? HIVE_PORT;
+    const now = options.now ?? Date.now;
+    const startedAt = now();
+    const app = new Hono();
+    const fleetStatusFetch = options.fleetStatusFetch ?? fetch;
+    const doctorStatusUrl = options.doctorStatusUrl ?? DOCTOR_STATUS_URL;
+    // PRD-003a: the server-side portal landing gate, registered FIRST so it runs ahead of every
+    // other route. It bypasses hive's own infra/asset/proxy paths and the two exempt screens
+    // (`/buzzing`, `/login`) internally; for every other path it evaluates health-then-auth and
+    // either redirects or falls through via `next()` to the routes below.
+    app.use("*", createPortalGate({
+        fleetStatusFetch,
+        doctorStatusUrl,
+        setupAuthFetch: options.setupAuthFetch,
+        registryPath: options.registryPath
+    }));
+    // The bundled SPA's static assets — specific, fixed paths registered before the shell catch-all
+    // (below) so they win.
+    mountDashboardAssets(app);
+    // PRD-005b: `/health` is content-negotiated (the gate makes the same distinction, `gate.ts`
+    // `isInfraPath`). A machine probe (doctor's own liveness check, monitoring) never asks for
+    // HTML and gets the existing cheap liveness JSON unchanged; a browser navigating to the new
+    // operator-facing `/health` page asks for HTML and gets the SAME SPA shell every other gated
+    // route renders (the bundled client resolves the `/health` registry page itself).
+    app.get("/health", (c) => {
+        const accept = c.req.header("accept") ?? "";
+        if (accept.includes("text/html")) {
+            c.header("cache-control", "no-cache");
+            return c.html(renderShell());
+        }
+        return c.json({
+            status: "ok",
+            uptimeMs: Math.max(0, now() - startedAt),
+            version: HIVE_VERSION
+        });
+    });
+    // hive-owned data route: aggregates doctor's supervisor status. Registered BEFORE the
+    // catch-all proxy so it wins (Hono runs matching handlers in registration order).
+    app.get("/api/fleet-status", async (c) => c.json(await fetchFleetStatus(fleetStatusFetch, doctorStatusUrl)));
+    // PRD-004a/PRD-005a: the full list of doctor-REGISTERED service names, even one hive's
+    // BFF proxy never routes to (e.g. doctor/hive itself). Lets `/buzzing` and the health
+    // rail render one tile/pill per registered service before any telemetry has arrived at all
+    // (bz-AC-1/bz-AC-2, hr-AC-1), independent of whichever daemons `resolveDaemonBases` proxies for.
+    app.get("/api/registered-services", (c) => c.json({ names: resolveRegisteredServiceNames({ registryPath: options.registryPath }) }));
+    // PRD-004/PRD-005: the same-origin relay of doctor's fleet-telemetry SSE stream
+    // (`telemetry-proxy.ts`). Registered BEFORE the generic `/api/*` proxy so THIS specific route
+    // wins; the browser only ever opens `/api/telemetry/stream`, never doctor's `:3852` directly.
+    app.get("/api/telemetry/stream", createTelemetryStreamHandler({
+        doctorEventsUrl: options.doctorEventsUrl,
+        fetchImpl: options.telemetryStreamFetch
+    }));
+    // Server-side federation (BFF): every other `/api/*` and `/setup/*` request is proxied over
+    // loopback to the workload daemon that owns it (honeycomb or nectar), resolved from
+    // doctor's registry. The browser only ever talks to hive's own origin.
+    const apiProxy = createApiProxy({ registryPath: options.registryPath, fetchImpl: options.proxyFetch });
+    app.all("/api/*", apiProxy);
+    app.all("/setup/*", apiProxy);
+    // PRD-003a: the SPA shell catch-all — MUST be registered LAST so every specific route above
+    // (assets, /health, /api/fleet-status, the BFF proxy) wins. Serves every gated page path the
+    // gate let through, plus `/buzzing` and `/login` themselves, plus any unknown deep link.
+    mountDashboardShellFallback(app);
+    return {
+        app,
+        host,
+        port,
+        startedAt
+    };
+}
+export function startHive(options = {}) {
+    const serveFn = options.serveFn ?? serve;
+    const hive = createHive(options);
+    const lockPaths = acquireSingleInstanceLock(options.lockPaths);
+    let server;
+    try {
+        server = serveFn({
+            fetch: hive.app.fetch,
+            hostname: hive.host,
+            port: hive.port
+        });
+    }
+    catch (error) {
+        releaseSingleInstanceLock(lockPaths);
+        throw error;
+    }
+    let stopped = false;
+    const stop = async () => {
+        if (stopped)
+            return;
+        stopped = true;
+        try {
+            await closeServer(server);
+        }
+        finally {
+            releaseSingleInstanceLock(lockPaths);
+        }
+    };
+    return {
+        ...hive,
+        lockPaths,
+        stop
+    };
+}
+//# sourceMappingURL=server.js.map

package/dist/daemon/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/daemon/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EAE1B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,SAAS,EACT,YAAY,EACb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAkB,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAmB,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,4BAA4B,EAAuB,MAAM,sBAAsB,CAAC;AAwCzF,SAAS,WAAW,CAAC,MAAuB;IAC1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAa,EAAE,EAAE;YAC7B,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;gBAC3B,MAAM,CAAC,KAAK,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,UAA6B,EAAE;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IAExB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC3D,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,iBAAiB,CAAC;IAErE,4FAA4F;IAC5F,yFAAyF;IACzF,4FAA4F;IAC5F,sEAAsE;IACtE,GAAG,CAAC,GAAG,CACL,GAAG,EACH,gBAAgB,CAAC;QACf,gBAAgB;QAChB,eAAe;QACf,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CACH,CAAC;IAEF,gGAAgG;IAChG,uBAAuB;IACvB,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAE1B,4FAA4F;IAC5F,2FAA2F;IAC3F,4FAA4F;IAC5F,6FAA6F;IAC7F,kFAAkF;IAClF,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,OAAO,EAAE,YAAY;SACtB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sFAAsF;IACtF,kFAAkF;IAClF,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CACvC,CAAC,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAClE,CAAC;IAEF,uFAAuF;IACvF,sFAAsF;IACtF,2FAA2F;IAC3F,iGAAiG;IACjG,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,CAAC,CAAC,EAAE,EAAE,CACxC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,EAAE,CAAC,CACzF,CAAC;IAEF,gFAAgF;IAChF,8FAA8F;IAC9F,8FAA8F;IAC9F,GAAG,CAAC,GAAG,CACL,uBAAuB,EACvB,4BAA4B,CAAC;QAC3B,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,SAAS,EAAE,OAAO,CAAC,oBAAoB;KACxC,CAAC,CACH,CAAC;IAEF,4FAA4F;IAC5F,oFAAoF;IACpF,uEAAuE;IACvE,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACvG,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAE9B,4FAA4F;IAC5F,6FAA6F;IAC7F,yFAAyF;IACzF,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAEjC,OAAO;QACL,GAAG;QACH,IAAI;QACJ,IAAI;QACJ,SAAS;KACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,UAA4B,EAAE;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;IACzC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,yBAAyB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAE/D,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,OAAO,CAAC;YACf,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK;YACrB,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yBAAyB,CAAC,SAAS,CAAC,CAAC;QACrC,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACrC,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,yBAAyB,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,GAAG,IAAI;QACP,SAAS;QACT,IAAI;KACL,CAAC;AACJ,CAAC"}

package/dist/daemon/setup-auth.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The gate's AUTH input — PRD-003a/003b: "logged in" is credential presence, read through the
+ * proxied honeycomb `GET /setup/state` `authenticated` bit (no new portal session, ADR-0004).
+ *
+ * This mirrors `fleet-status.ts`'s shape deliberately: a small, injectable, fail-soft fetch that
+ * resolves the SAME honeycomb base the real `/setup/*` BFF proxy (`proxy.ts`) resolves requests to
+ * (via `resolveDaemonBases`), re-checks it is loopback (defense in depth, same posture as the
+ * proxy and `fleet-status.ts`), and degrades to `false` (not authenticated) on ANY failure —
+ * a non-loopback base, a network error, a non-OK response, invalid JSON, or a schema mismatch.
+ * l-AC-6 requires exactly this: a `/setup/state` fetch failure or timeout must read as "not logged
+ * in" (redirect to `/login`), never fail-soft into the dashboard.
+ */
+/** Minimal init surface for the auth fetch (mirrors `fleet-status.ts`'s `FleetFetchInit`). */
+export type SetupAuthFetchInit = {
+    readonly redirect?: "error" | "follow" | "manual";
+    /** Ties the upstream `/setup/state` fetch to the caller's lifecycle (e.g. the incoming request). */
+    readonly signal?: AbortSignal;
+};
+export type SetupAuthFetchImpl = (input: string, init?: SetupAuthFetchInit) => Promise<Response>;
+export interface FetchSetupAuthenticatedOptions {
+    /** Override the doctor registry file path the honeycomb base is resolved from. */
+    readonly registryPath?: string;
+    /**
+     * Abort signal forwarded to the underlying fetch, so a disconnected client (the gate passes
+     * `c.req.raw.signal`) never leaves a hung `/setup/state` request pinned upstream. An abort
+     * surfaces as a rejected fetch and therefore resolves `false`, the same fail-closed posture
+     * as every other failure mode here.
+     */
+    readonly signal?: AbortSignal;
+}
+/**
+ * Resolve "is the operator logged in" for the gate's auth step (g-AC-4, l-AC-4). Reads the SAME
+ * honeycomb base the BFF proxy would (`resolveDaemonBases`), fetches `/setup/state` over loopback,
+ * and returns its `authenticated` bit. Fails closed to `false` on any error so a transient fault
+ * never fail-softs an unauthenticated visitor into the dashboard (l-AC-6).
+ */
+export declare function fetchSetupAuthenticated(fetchImpl?: SetupAuthFetchImpl, options?: FetchSetupAuthenticatedOptions): Promise<boolean>;

package/dist/daemon/setup-auth.js

@@ -0,0 +1,51 @@
+/**
+ * The gate's AUTH input — PRD-003a/003b: "logged in" is credential presence, read through the
+ * proxied honeycomb `GET /setup/state` `authenticated` bit (no new portal session, ADR-0004).
+ *
+ * This mirrors `fleet-status.ts`'s shape deliberately: a small, injectable, fail-soft fetch that
+ * resolves the SAME honeycomb base the real `/setup/*` BFF proxy (`proxy.ts`) resolves requests to
+ * (via `resolveDaemonBases`), re-checks it is loopback (defense in depth, same posture as the
+ * proxy and `fleet-status.ts`), and degrades to `false` (not authenticated) on ANY failure —
+ * a non-loopback base, a network error, a non-OK response, invalid JSON, or a schema mismatch.
+ * l-AC-6 requires exactly this: a `/setup/state` fetch failure or timeout must read as "not logged
+ * in" (redirect to `/login`), never fail-soft into the dashboard.
+ */
+import { z } from "zod";
+import { isLoopbackBaseUrl } from "../shared/daemon-routing.js";
+import { resolveDaemonBases } from "./registry.js";
+const SetupStateAuthSchema = z.object({
+    authenticated: z.boolean().catch(false)
+});
+/**
+ * Resolve "is the operator logged in" for the gate's auth step (g-AC-4, l-AC-4). Reads the SAME
+ * honeycomb base the BFF proxy would (`resolveDaemonBases`), fetches `/setup/state` over loopback,
+ * and returns its `authenticated` bit. Fails closed to `false` on any error so a transient fault
+ * never fail-softs an unauthenticated visitor into the dashboard (l-AC-6).
+ */
+export async function fetchSetupAuthenticated(fetchImpl = fetch, options = {}) {
+    const base = resolveDaemonBases({ registryPath: options.registryPath }).honeycomb;
+    // Defense in depth, mirroring proxy.ts / fleet-status.ts: resolveDaemonBases only ever returns
+    // loopback origins, but a future change to base resolution must never turn this into an
+    // off-loopback fetch that could leak the request (or its redirect) off hive's trust boundary.
+    if (!isLoopbackBaseUrl(base))
+        return false;
+    try {
+        const response = await fetchImpl(`${base}/setup/state`, { redirect: "error", signal: options.signal });
+        if (!response.ok)
+            return false;
+        let parsedJson;
+        try {
+            parsedJson = await response.json();
+        }
+        catch {
+            return false;
+        }
+        const parsed = SetupStateAuthSchema.safeParse(parsedJson);
+        return parsed.success ? parsed.data.authenticated : false;
+    }
+    catch {
+        // Network error, refused connection, timeout, or a blocked redirect: fail CLOSED (not logged in).
+        return false;
+    }
+}
+//# sourceMappingURL=setup-auth.js.map

package/dist/daemon/setup-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-auth.js","sourceRoot":"","sources":["../../src/daemon/setup-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;CACxC,CAAC,CAAC;AAsBH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,YAAgC,KAAK,EACrC,UAA0C,EAAE;IAE5C,MAAM,IAAI,GAAG,kBAAkB,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC;IAClF,+FAA+F;IAC/F,wFAAwF;IACxF,8FAA8F;IAC9F,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAE3C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,cAAc,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACvG,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAE/B,IAAI,UAAmB,CAAC;QACxB,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC1D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,kGAAkG;QAClG,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/daemon/telemetry-proxy.d.ts

@@ -0,0 +1,47 @@
+/**
+ * The doctor -> hive fleet-telemetry SSE RELAY — hive PRD-004/PRD-005 (sd-AC-6,
+ * hr-AC-6, hm-AC-8, lg-AC-1), realizing ADR-0002's server-side BFF proxy for the SSE stream.
+ *
+ * Mounted at `GET /api/telemetry/stream` (`server.ts`). hive's SERVER connects to doctor's
+ * real `GET http://127.0.0.1:3852/events` and re-streams the raw `fleet-telemetry` SSE bytes to
+ * the browser same-origin. The browser NEVER opens a connection to doctor's `:3852` directly —
+ * this is the one and only seam that does, mirroring `proxy.ts`'s BFF posture for the REST surface.
+ *
+ * Memory-bounded by construction: this is a straight body-to-body PIPE (`new Response(upstream.body, ...)`),
+ * never buffered or accumulated here — the parent index's "never buffer more than the current event"
+ * constraint holds trivially because nothing is held in memory between upstream and downstream at all.
+ *
+ * Fail-soft: doctor unreachable, a non-2xx response, or a non-loopback configured URL all
+ * degrade to a 502 with no body, never a thrown error — the browser-side hook (`use-fleet-telemetry.ts`)
+ * treats a failed/errored EventSource as "SSE unavailable" and falls back to polling
+ * `GET /api/fleet-status`, exactly as it does for a mid-stream drop.
+ */
+import type { Context } from "hono";
+/**
+ * The injectable fetch surface reaching doctor's status page (the global `fetch` in prod, a
+ * mock in tests). `redirect` is part of the surface so the relay can pin `redirect: "error"`
+ * (matching `proxy.ts`/`fleet-status.ts`): native fetch follows 30x by default, and
+ * `isLoopbackBaseUrl()` only validates the FIRST hop, so an unpinned redirect could take the
+ * relay off-loopback and defeat the SSRF guard.
+ */
+export type TelemetryFetch = (input: string, init?: {
+    readonly signal?: AbortSignal;
+    readonly redirect?: "error" | "follow" | "manual";
+}) => Promise<Response>;
+/** Options for {@link createTelemetryStreamHandler}. */
+export interface CreateTelemetryStreamOptions {
+    /** Override doctor's events URL (defaults to the fixed loopback constant). */
+    readonly doctorEventsUrl?: string;
+    /** The fetch implementation used to reach doctor (defaults to the global `fetch`). */
+    readonly fetchImpl?: TelemetryFetch;
+}
+/**
+ * Build the `GET /api/telemetry/stream` handler. Register it on hive's Hono app BEFORE the
+ * generic `/api/*` BFF proxy (`proxy.ts`) so this specific route wins for this one path (Hono
+ * composes matching handlers in registration order, same discipline as `/api/fleet-status`).
+ *
+ * The upstream fetch is tied to the INCOMING request's abort signal, so when the browser closes
+ * its EventSource (navigation, unmount, tab close) hive's own connection to doctor closes
+ * too — no orphaned upstream sockets accumulate across reconnects.
+ */
+export declare function createTelemetryStreamHandler(options?: CreateTelemetryStreamOptions): (c: Context) => Promise<Response>;

package/dist/daemon/telemetry-proxy.js

@@ -0,0 +1,63 @@
+/**
+ * The doctor -> hive fleet-telemetry SSE RELAY — hive PRD-004/PRD-005 (sd-AC-6,
+ * hr-AC-6, hm-AC-8, lg-AC-1), realizing ADR-0002's server-side BFF proxy for the SSE stream.
+ *
+ * Mounted at `GET /api/telemetry/stream` (`server.ts`). hive's SERVER connects to doctor's
+ * real `GET http://127.0.0.1:3852/events` and re-streams the raw `fleet-telemetry` SSE bytes to
+ * the browser same-origin. The browser NEVER opens a connection to doctor's `:3852` directly —
+ * this is the one and only seam that does, mirroring `proxy.ts`'s BFF posture for the REST surface.
+ *
+ * Memory-bounded by construction: this is a straight body-to-body PIPE (`new Response(upstream.body, ...)`),
+ * never buffered or accumulated here — the parent index's "never buffer more than the current event"
+ * constraint holds trivially because nothing is held in memory between upstream and downstream at all.
+ *
+ * Fail-soft: doctor unreachable, a non-2xx response, or a non-loopback configured URL all
+ * degrade to a 502 with no body, never a thrown error — the browser-side hook (`use-fleet-telemetry.ts`)
+ * treats a failed/errored EventSource as "SSE unavailable" and falls back to polling
+ * `GET /api/fleet-status`, exactly as it does for a mid-stream drop.
+ */
+import { DOCTOR_EVENTS_URL } from "../shared/constants.js";
+import { isLoopbackBaseUrl } from "../shared/daemon-routing.js";
+/** The fail-soft response for an unreachable/misconfigured upstream: an empty 502, no retry-storm body to parse. */
+function unreachableStreamResponse() {
+    return new Response(null, { status: 502 });
+}
+/**
+ * Build the `GET /api/telemetry/stream` handler. Register it on hive's Hono app BEFORE the
+ * generic `/api/*` BFF proxy (`proxy.ts`) so this specific route wins for this one path (Hono
+ * composes matching handlers in registration order, same discipline as `/api/fleet-status`).
+ *
+ * The upstream fetch is tied to the INCOMING request's abort signal, so when the browser closes
+ * its EventSource (navigation, unmount, tab close) hive's own connection to doctor closes
+ * too — no orphaned upstream sockets accumulate across reconnects.
+ */
+export function createTelemetryStreamHandler(options = {}) {
+    const doctorEventsUrl = options.doctorEventsUrl ?? DOCTOR_EVENTS_URL;
+    const fetchImpl = options.fetchImpl ?? fetch;
+    return async (c) => {
+        // Defense in depth (mirrors `proxy.ts`/`fleet-status.ts`): the URL is a fixed constant, never
+        // derived from external input, but this re-check ensures a future refactor can never turn
+        // this relay into an off-loopback fetch primitive.
+        if (!isLoopbackBaseUrl(doctorEventsUrl))
+            return unreachableStreamResponse();
+        try {
+            const upstream = await fetchImpl(doctorEventsUrl, { signal: c.req.raw.signal, redirect: "error" });
+            if (!upstream.ok || upstream.body === null)
+                return unreachableStreamResponse();
+            return new Response(upstream.body, {
+                status: 200,
+                headers: {
+                    "content-type": "text/event-stream",
+                    "cache-control": "no-store",
+                    connection: "keep-alive",
+                },
+            });
+        }
+        catch {
+            // Network error, refused connection, or an aborted fetch: fail soft, never throw. The
+            // browser-side EventSource treats this as a connection failure and retries/falls back.
+            return unreachableStreamResponse();
+        }
+    };
+}
+//# sourceMappingURL=telemetry-proxy.js.map

package/dist/daemon/telemetry-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry-proxy.js","sourceRoot":"","sources":["../../src/daemon/telemetry-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAsBhE,oHAAoH;AACpH,SAAS,yBAAyB;IACjC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAAC,UAAwC,EAAE;IACtF,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,iBAAiB,CAAC;IACrE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAK,KAAwB,CAAC;IAEjE,OAAO,KAAK,EAAE,CAAU,EAAqB,EAAE;QAC9C,8FAA8F;QAC9F,0FAA0F;QAC1F,mDAAmD;QACnD,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;YAAE,OAAO,yBAAyB,EAAE,CAAC;QAE5E,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YACnG,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAO,yBAAyB,EAAE,CAAC;YAE/E,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;gBAClC,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACR,cAAc,EAAE,mBAAmB;oBACnC,eAAe,EAAE,UAAU;oBAC3B,UAAU,EAAE,YAAY;iBACxB;aACD,CAAC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACR,sFAAsF;YACtF,uFAAuF;YACvF,OAAO,yBAAyB,EAAE,CAAC;QACpC,CAAC;IACF,CAAC,CAAC;AACH,CAAC"}

package/dist/dashboard/contracts.d.ts

@@ -0,0 +1,235 @@
+/**
+ * PARTIAL copy of honeycomb's `src/dashboard/contracts.ts` — PRD-001b ("copy partially").
+ *
+ * Only the web-consumed ROI view-model types cross into hive: the subset that
+ * `web/wire.ts` (`EMPTY_ROI_TREND`, `EMPTY_ROI_VIEW`, `RoiTrendView`, `RoiView`) and the ROI
+ * pages (`web/pages/roi.tsx`, `web/pages/roi-chart.tsx`) import. The rest of honeycomb's
+ * contracts serve its own daemon-side view-models and STAY in honeycomb. hive owns a small
+ * copy of just the types its `wire` validates against.
+ *
+ * Copied verbatim from honeycomb `src/dashboard/contracts.ts` (the `PRD-060e` ROI section),
+ * with one cross-repo JSDoc `{@link}` path softened to a plain reference so the module is
+ * self-contained in hive.
+ */
+/**
+ * The per-section status discriminant (e-AC-2). Every section of the {@link RoiView}
+ * carries ONE of these so the page renders the right treatment per section rather than a
+ * single page-wide state:
+ *   - `ok`              — a confident, complete figure (measured-or-fully-read).
+ *   - `partial`         — populated but degraded (some inputs read, some missing; e.g. "Claude Code only").
+ *   - `absent`          — no data yet (the page shows a dash glyph, NOT `$0.00`).
+ *   - `unreachable`     — an input could not be read (billing flap → dash + scoped retry).
+ *   - `unauthenticated` — no credentials for the input (a Settings-CTA state, redacted).
+ * A measured zero is `ok` with a zero figure — DISTINCT from `absent`.
+ */
+export type RoiSectionStatus = "ok" | "partial" | "absent" | "unreachable" | "unauthenticated";
+/**
+ * The cost basis a net/cost line rests on (e-AC-15, mirrors PRD-060f `cost_basis`):
+ *   - `measured`  — a billed/metered fact (org/workspace infra read from billing).
+ *   - `allocated` — an estimated split of a shared cost down to a team/user; carries the
+ *                   SAME `est.`-class subordination as a modeled line, never a measured fact.
+ *   - `none`      — no cost line applies (e.g. a savings-only rollup).
+ * The page renders an `allocated` net distinctly and flags a MIXED-basis rollup.
+ */
+export type RoiCostBasisTag = "measured" | "allocated" | "none";
+/**
+ * The modeled assumption carried on the wire as a DATA FIELD (e-AC-8, the daemon-side
+ * mirror of 060b's memory-injection assumption). The page's ⓘ popover + page-foot footnote
+ * read `assumptionText` VERBATIM from this single source — the page never hardcodes the copy.
+ * `signedOff` is `false` until the operator signs off (the page may mark the estimate provisional).
+ */
+export interface RoiAssumption {
+    /** The model-kind machine id (so the page can branch if more models are added). */
+    readonly kind: string;
+    /** The human-readable assumption string the disclosure surfaces verbatim (the ONE source). */
+    readonly assumptionText: string;
+    /** Whether the assumption is an operator-signed-off decision (`false` until sign-off). */
+    readonly signedOff: boolean;
+}
+/**
+ * The MEASURED + MODELED savings section (e-AC-3). Measured cache savings is the defensible
+ * headline (integer cents, `measured` tone); modeled memory-injection savings is the
+ * subordinate `est.` line carrying its {@link RoiAssumption}. `blendedCentsPerMtok` is the
+ * effective $/Mtok rate — `null` UNTIL token capture is live (the page shows a placeholder,
+ * never a fabricated `$0.00`, e-AC-11).
+ */
+export interface RoiSavingsSection {
+    /** The per-section status (e-AC-2): `absent` until any capture lands. */
+    readonly status: RoiSectionStatus;
+    /** MEASURED cache savings in INTEGER cents (the defensible, billed-fact headline). */
+    readonly measuredCents: number;
+    /** MODELED memory-injection savings in INTEGER cents (the subordinate `est.` line). */
+    readonly modeledCents: number;
+    /** The modeled estimate's assumption, carried as data (e-AC-8) — the single disclosure source. */
+    readonly assumption: RoiAssumption;
+    /** The effective blended rate in cents-per-Mtok, or `null` until capture is live (e-AC-11). */
+    readonly blendedCentsPerMtok: number | null;
+}
+/**
+ * The INFRA COST section (e-AC-6, from 060c's billing read-model). `cents` is the measured
+ * DeepLake infra cost in INTEGER cents; the `status` carries 060c's billing discriminant so
+ * the page distinguishes a billed `$0` (`ok`) from "couldn't read billing" (`unreachable`) /
+ * "no credentials" (`unauthenticated`). `costBasis` is `measured` (org/workspace infra is
+ * always measured here; a per-team/user allocated share lives on a rollup, not this line).
+ */
+export interface RoiInfraSection {
+    /** The per-section status (e-AC-2/6): how the page tells billed-$0 from couldn't-read. */
+    readonly status: RoiSectionStatus;
+    /** The measured infra cost in INTEGER cents (`0` when absent — read the STATUS, not the number). */
+    readonly cents: number;
+    /** The cost basis on this line (e-AC-15): `measured` for org/workspace infra. */
+    readonly costBasis: RoiCostBasisTag;
+}
+/** One pollination contributor split line (the readable per-contributor breakdown the page shows). */
+export interface RoiPollinationLine {
+    /** The contributor label (e.g. `haiku-skillify`, `deeplake-query`, `deeplake-embedding`). */
+    readonly label: string;
+    /** This contributor's cost in INTEGER cents. */
+    readonly cents: number;
+}
+/**
+ * The POLLINATION COST section (e-AC-6, from 060d's composer). `cents` is the itemized
+ * pollination total in INTEGER cents (Haiku skillify + DeepLake GPU sessions); `status` is
+ * 060d's worst-of-contributors discriminant mapped onto {@link RoiSectionStatus} so a
+ * confident total appears only when both halves are confident. `lines` is the readable split.
+ */
+export interface RoiPollinationSection {
+    /** The per-section status (e-AC-2): the worst of the two contributing halves (060d). */
+    readonly status: RoiSectionStatus;
+    /** The itemized pollination total in INTEGER cents. */
+    readonly cents: number;
+    /** The per-contributor split (Haiku + per session_type) the page renders. */
+    readonly lines: readonly RoiPollinationLine[];
+}
+/**
+ * The NET-ROI section (e-AC-6). The net (`saved − (infra + pollination)`) is computed ONLY
+ * when its inputs are present (status `ok`); a missing/unreachable input leaves the section
+ * `unreachable`/`absent` with `computed: false` and `netCents: 0` — the net is NEVER
+ * fabricated from incomplete inputs (the page shows a dash glyph + scoped retry). Because the
+ * net folds a MODELED savings term it inherits `est.` (`modeled: true`); `costBasis` reflects
+ * whether the cost half is measured or carries an allocated share.
+ */
+export interface RoiNetSection {
+    /** The per-section status (e-AC-2/6): `ok` only when every input was present. */
+    readonly status: RoiSectionStatus;
+    /** True iff the net was actually computed from complete inputs; `false` ⇒ render a dash, not the number. */
+    readonly computed: boolean;
+    /** The net in INTEGER cents (`0` when `computed: false` — read the STATUS / `computed`, not this). */
+    readonly netCents: number;
+    /** True — the net folds a modeled term, so it ALWAYS carries `est.` (e-AC-3 net-hero inheritance). */
+    readonly modeled: boolean;
+    /** The cost basis on the net (e-AC-15): `allocated` when a per-team/user infra share fed it. */
+    readonly costBasis: RoiCostBasisTag;
+}
+/** One ROLLUP dimension the page's dimension switch offers (e-AC-13). */
+export type RoiRollupDimension = "org" | "team" | "agent" | "project";
+/** One row in a rollup: a dimension key + its summed measured/net cents + the basis flag. */
+export interface RoiRollupRow {
+    /** The dimension key (the org id / team id / agent id / project id). */
+    readonly key: string;
+    /** A human label for the key (falls back to the key when no friendlier name resolves). */
+    readonly label: string;
+    /** Σ measured cache savings for this key, in INTEGER cents. */
+    readonly measuredSavingsCents: number;
+    /** Σ net (saved − cost) for this key, in INTEGER cents (allocated cost carries `est.`). */
+    readonly netCents: number;
+    /** Σ infra cost attributed to this key, in INTEGER cents. */
+    readonly infraCostCents: number;
+    /** The cost basis for THIS row (e-AC-15): `allocated` when its infra share is an estimate. */
+    readonly costBasis: RoiCostBasisTag;
+    /** Number of sessions (ledger rows) folded into this row. */
+    readonly sessions: number;
+}
+/**
+ * One rollup VIEW (e-AC-13): all rows for a single dimension, plus a MIXED-BASIS flag. The
+ * daemon computes these as read-time `GROUP BY`s over `roi_metrics` (the component does NO
+ * grouping). `mixedBasis` is `true` when the rows span more than one `cost_basis`
+ * (`COUNT(DISTINCT cost_basis) > 1`) — the page flags it rather than silently blending.
+ */
+export interface RoiRollup {
+    /** The dimension this rollup groups by (e-AC-13). */
+    readonly dimension: RoiRollupDimension;
+    /** The grouped rows (one per distinct dimension key). */
+    readonly rows: readonly RoiRollupRow[];
+    /** True when the rows mix `measured` + `allocated` bases (e-AC-15 mixed-basis flag). */
+    readonly mixedBasis: boolean;
+}
+/**
+ * THE COMPOSITE ROI VIEW-MODEL (e-AC-2). The `/roi` page is a PURE FUNCTION of this — every
+ * section carries its own {@link RoiSectionStatus}, all money is INTEGER cents, modeled
+ * savings carries its assumption as data, the daemon computes the {@link rollups}, and the
+ * per-user availability flag is `false` until verified backend claims land (060f gate, today
+ * always false). The `scopedAcrossDevices` flag tells the page the figure aggregates across
+ * devices (a `shared` read) vs only this machine (an `isolated` read), so the page can caption
+ * the scope honestly (e-AC-12).
+ */
+export interface RoiView {
+    /** The measured + modeled savings section (e-AC-3). */
+    readonly savings: RoiSavingsSection;
+    /** The infra cost section (e-AC-6, from 060c). */
+    readonly infra: RoiInfraSection;
+    /** The pollination cost section (e-AC-6, from 060d). */
+    readonly pollination: RoiPollinationSection;
+    /** The net-ROI section (e-AC-6) — computed ONLY from complete inputs, never fabricated. */
+    readonly net: RoiNetSection;
+    /** The org / team / agent / project rollups (e-AC-13), computed by the daemon as `GROUP BY`s. */
+    readonly rollups: readonly RoiRollup[];
+    /**
+     * The PER-USER availability flag (e-AC-14): `false` until verified backend user-claims are
+     * live (060f gate). It is `false` today — the page shows the "per-user requires verified
+     * login" empty state and NEVER a `$0` or a self-asserted name when this is false.
+     */
+    readonly perUserAvailable: boolean;
+    /**
+     * True when the read aggregated ACROSS DEVICES (a `shared` read_policy returned workspace-wide
+     * rows); false when it returned only this machine's rows (an `isolated` read). The page captions
+     * the scope honestly from this (e-AC-12). NOT a tenancy decision — the daemon already scoped the read.
+     */
+    readonly scopedAcrossDevices: boolean;
+    /** The rate-table "as of" stamp (060b) so a stale rate is auditable on the page. */
+    readonly ratesAsOf: string;
+}
+/** One point in a trend series (e-AC-10): a period label + an INTEGER-cents value + its measured/modeled tag. */
+export interface RoiTrendPoint {
+    /** The period label (e.g. an ISO date / `YYYY-MM` bucket). */
+    readonly period: string;
+    /** The value at this period in INTEGER cents. */
+    readonly cents: number;
+}
+/**
+ * One trend SERIES (e-AC-10): a named line whose `modeled` tag drives the dashed (modeled) vs
+ * solid (measured) stroke. Money is INTEGER cents at every point. The page renders these as an
+ * inline-SVG chart (no charting dependency); this contract is purely the data the chart consumes.
+ */
+export interface RoiTrendSeries {
+    /** The series label (e.g. `measured-savings`, `modeled-savings`, `infra-cost`, `net`). */
+    readonly label: string;
+    /** True ⇒ the chart draws a DASHED stroke (modeled / `est.`); false ⇒ SOLID (measured). */
+    readonly modeled: boolean;
+    /** The series points, oldest-first, in INTEGER cents. */
+    readonly points: readonly RoiTrendPoint[];
+}
+/**
+ * THE TREND VIEW-MODEL (e-AC-10) backing `GET /api/diagnostics/roi/trend`. `series` are the
+ * measured-vs-modeled lines (dashed/solid). `status` carries the same {@link RoiSectionStatus}
+ * vocabulary so an absent trend (no history before capture started) renders honestly rather
+ * than a fabricated flat line; `startedAt` marks when savings tracking began (or `''` when none).
+ */
+export interface RoiTrendView {
+    /** The overall trend status (e-AC-2 vocabulary): `absent` until a history exists. */
+    readonly status: RoiSectionStatus;
+    /** The measured/modeled series the inline-SVG chart draws (e-AC-10). */
+    readonly series: readonly RoiTrendSeries[];
+    /** When savings tracking began (ISO), or `''` when there is no history yet ("savings tracked from <date>"). */
+    readonly startedAt: string;
+}
+/**
+ * The honest-empty {@link RoiView} the page renders before the first load resolves, on any
+ * failure, or on a genuine first-run/empty workspace (e-AC-5). Every section is `absent`
+ * (the page shows a DASH glyph, NOT `$0.00`), the net is NOT computed, `blendedCentsPerMtok`
+ * is `null`, `perUserAvailable` is `false`, and the rollups are empty. The daemon degrades to
+ * THIS rather than throwing, and the wire degrades to it on a malformed/absent body.
+ */
+export declare const EMPTY_ROI_VIEW: RoiView;
+/** The honest-empty {@link RoiTrendView} the page renders before first load / on failure / before capture (e-AC-10). */
+export declare const EMPTY_ROI_TREND: RoiTrendView;

package/dist/dashboard/contracts.js

@@ -0,0 +1,43 @@
+/**
+ * PARTIAL copy of honeycomb's `src/dashboard/contracts.ts` — PRD-001b ("copy partially").
+ *
+ * Only the web-consumed ROI view-model types cross into hive: the subset that
+ * `web/wire.ts` (`EMPTY_ROI_TREND`, `EMPTY_ROI_VIEW`, `RoiTrendView`, `RoiView`) and the ROI
+ * pages (`web/pages/roi.tsx`, `web/pages/roi-chart.tsx`) import. The rest of honeycomb's
+ * contracts serve its own daemon-side view-models and STAY in honeycomb. hive owns a small
+ * copy of just the types its `wire` validates against.
+ *
+ * Copied verbatim from honeycomb `src/dashboard/contracts.ts` (the `PRD-060e` ROI section),
+ * with one cross-repo JSDoc `{@link}` path softened to a plain reference so the module is
+ * self-contained in hive.
+ */
+/**
+ * The honest-empty {@link RoiView} the page renders before the first load resolves, on any
+ * failure, or on a genuine first-run/empty workspace (e-AC-5). Every section is `absent`
+ * (the page shows a DASH glyph, NOT `$0.00`), the net is NOT computed, `blendedCentsPerMtok`
+ * is `null`, `perUserAvailable` is `false`, and the rollups are empty. The daemon degrades to
+ * THIS rather than throwing, and the wire degrades to it on a malformed/absent body.
+ */
+export const EMPTY_ROI_VIEW = Object.freeze({
+    savings: {
+        status: "absent",
+        measuredCents: 0,
+        modeledCents: 0,
+        assumption: { kind: "", assumptionText: "", signedOff: false },
+        blendedCentsPerMtok: null,
+    },
+    infra: { status: "absent", cents: 0, costBasis: "none" },
+    pollination: { status: "absent", cents: 0, lines: [] },
+    net: { status: "absent", computed: false, netCents: 0, modeled: true, costBasis: "none" },
+    rollups: [],
+    perUserAvailable: false,
+    scopedAcrossDevices: false,
+    ratesAsOf: "",
+});
+/** The honest-empty {@link RoiTrendView} the page renders before first load / on failure / before capture (e-AC-10). */
+export const EMPTY_ROI_TREND = Object.freeze({
+    status: "absent",
+    series: [],
+    startedAt: "",
+});
+//# sourceMappingURL=contracts.js.map

package/dist/dashboard/contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../src/dashboard/contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAgPH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAY,MAAM,CAAC,MAAM,CAAC;IACpD,OAAO,EAAE;QACR,MAAM,EAAE,QAAiB;QACzB,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC;QACf,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;QAC9D,mBAAmB,EAAE,IAAI;KACzB;IACD,KAAK,EAAE,EAAE,MAAM,EAAE,QAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,MAAe,EAAE;IAC1E,WAAW,EAAE,EAAE,MAAM,EAAE,QAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;IAC/D,GAAG,EAAE,EAAE,MAAM,EAAE,QAAiB,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAe,EAAE;IAC3G,OAAO,EAAE,EAAE;IACX,gBAAgB,EAAE,KAAK;IACvB,mBAAmB,EAAE,KAAK;IAC1B,SAAS,EAAE,EAAE;CACb,CAAC,CAAC;AAEH,wHAAwH;AACxH,MAAM,CAAC,MAAM,eAAe,GAAiB,MAAM,CAAC,MAAM,CAAC;IAC1D,MAAM,EAAE,QAAiB;IACzB,MAAM,EAAE,EAAE;IACV,SAAS,EAAE,EAAE;CACb,CAAC,CAAC"}