@legioncodeinc/hive 0.2.0 → 0.3.0

package/dist/daemon/installer/routes.d.ts

@@ -0,0 +1,43 @@
+/**
+ * PRD-009a: the `/api/onboarding/*` installer surface and its service factory.
+ *
+ * These Hono routes are registered on hive's app BEFORE the generic `/api/*` BFF proxy (the same
+ * registration-order discipline as `/api/fleet-status` and `/api/telemetry/stream`), so hive itself
+ * answers them rather than proxying to a workload daemon. Every route runs the three-check guard
+ * (`security.ts`): Host, Origin, and the one-time token. Manifest resolution, detection, the install
+ * state machine, and the token store are all reached through the injectable config, so a test never
+ * hits the network, real npm, or the real filesystem.
+ */
+import type { Hono } from "hono";
+import type { EmitDeps } from "../../telemetry/emit.js";
+import { type InstallStateStore } from "./install-state.js";
+import { type InstallerConfig } from "./config.js";
+import { type ManifestResolver } from "./manifest.js";
+import { type TokenStore } from "./token.js";
+import { type FunnelTelemetry } from "./funnel-telemetry.js";
+import { type SetupAuthFetchImpl } from "../setup-auth.js";
+import { type FetchImpl as FleetFetchImpl } from "../fleet-status.js";
+/** Service options: the installer config seams plus the fleet-status inputs the health check reuses. */
+export interface InstallerServiceOptions extends Partial<InstallerConfig> {
+    /** The fetch used by the health check's `fetchFleetStatus` (defaults to the global `fetch`). */
+    readonly fleetStatusFetch?: FleetFetchImpl;
+    /** Override doctor's status URL for the health check (defaults to the fixed loopback constant). */
+    readonly doctorStatusUrl?: string;
+    /** Fetch seam for `/setup/state` auth observation (`login_completed`, PRD-009c). */
+    readonly setupAuthFetch?: SetupAuthFetchImpl;
+    /** Injectable telemetry deps for funnel emission (tests record POST bodies). */
+    readonly funnelEmitDeps?: EmitDeps;
+    /** Override onboarding session ledger dir (tests). */
+    readonly funnelStateDir?: string;
+}
+/** The assembled installer service: a route registrar plus its state (exposed for tests). */
+export interface InstallerService {
+    register(app: Hono): void;
+    readonly config: InstallerConfig;
+    readonly store: InstallStateStore;
+    readonly tokenStore: TokenStore;
+    readonly manifest: ManifestResolver;
+    readonly funnel: FunnelTelemetry;
+}
+/** Build the installer service with a memoized npm-prefix resolver over the injected seams. */
+export declare function createInstallerService(options?: InstallerServiceOptions): InstallerService;

package/dist/daemon/installer/routes.js

@@ -0,0 +1,201 @@
+/**
+ * PRD-009a: the `/api/onboarding/*` installer surface and its service factory.
+ *
+ * These Hono routes are registered on hive's app BEFORE the generic `/api/*` BFF proxy (the same
+ * registration-order discipline as `/api/fleet-status` and `/api/telemetry/stream`), so hive itself
+ * answers them rather than proxying to a workload daemon. Every route runs the three-check guard
+ * (`security.ts`): Host, Origin, and the one-time token. Manifest resolution, detection, the install
+ * state machine, and the token store are all reached through the injectable config, so a test never
+ * hits the network, real npm, or the real filesystem.
+ */
+import { z } from "zod";
+import { DOCTOR_STATUS_URL } from "../../shared/constants.js";
+import { createInstallStateStore } from "./install-state.js";
+import { createInstallerConfig } from "./config.js";
+import { createManifestResolver } from "./manifest.js";
+import { createTokenStore } from "./token.js";
+import { detectFleet, installedVersion } from "./detection.js";
+import { isInstallableProduct } from "./products.js";
+import { resolveNpmPrefixViaCli } from "./bin-resolver.js";
+import { guardInstallerRequest } from "./security.js";
+import { createFunnelTelemetry, OnboardingEventBodySchema } from "./funnel-telemetry.js";
+import { fetchSetupAuthenticated } from "../setup-auth.js";
+import { fetchFleetStatus, isFleetReady } from "../fleet-status.js";
+const InstallBodySchema = z.object({ product: z.string() });
+function jsonError(c, status, error) {
+    return c.json({ error }, status);
+}
+async function readJsonBody(c) {
+    try {
+        return await c.req.json();
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Build the installer service with a memoized npm-prefix resolver over the injected seams. */
+export function createInstallerService(options = {}) {
+    const base = createInstallerConfig(options);
+    // Memoize `npm prefix -g` so it runs at most once per daemon session (is-AC: prefix cached).
+    let prefixPromise = null;
+    const config = {
+        ...base,
+        resolveNpmPrefix: () => {
+            if (prefixPromise === null) {
+                prefixPromise = options.resolveNpmPrefix ? options.resolveNpmPrefix() : resolveNpmPrefixViaCli(config);
+            }
+            return prefixPromise;
+        }
+    };
+    const funnel = createFunnelTelemetry({
+        config,
+        emitDeps: options.funnelEmitDeps,
+        stateDir: options.funnelStateDir
+    });
+    const store = createInstallStateStore(config, {
+        onInstallStarted: (product) => funnel.recordProductInstallStarted(product),
+        onInstallCompleted: (product) => funnel.recordProductInstallCompleted(product),
+        onInstallFailed: (product, stage) => funnel.recordProductInstallFailed(product, stage)
+    });
+    const tokenStore = createTokenStore(config);
+    const manifest = createManifestResolver(config);
+    const fleetStatusFetch = options.fleetStatusFetch ?? fetch;
+    const setupAuthFetch = options.setupAuthFetch ?? fetch;
+    const doctorStatusUrl = options.doctorStatusUrl ?? DOCTOR_STATUS_URL;
+    const register = (app) => {
+        // 1) Detection (is-AC-1/2). Token required only while a session is active (is-AC-10 carve-out).
+        app.get("/api/onboarding/detect", async (c) => {
+            const rejection = guardInstallerRequest(c, tokenStore, "detect");
+            if (rejection !== null)
+                return rejection;
+            return c.json(await detectFleet(config, store));
+        });
+        // 2) Install start (is-AC-3/4/5/15/16). Server resolves the target; the request carries only a slug.
+        app.post("/api/onboarding/install", async (c) => {
+            const rejection = guardInstallerRequest(c, tokenStore, "always");
+            if (rejection !== null)
+                return rejection;
+            const body = await readJsonBody(c);
+            const parsed = InstallBodySchema.safeParse(body);
+            if (!parsed.success)
+                return jsonError(c, 400, "invalid_body");
+            // is-AC-3: only the four slugs; `hive` is not installable. Either way a 400 with no spawn.
+            const product = parsed.data.product;
+            if (!isInstallableProduct(product))
+                return jsonError(c, 400, "invalid_product");
+            // is-AC-4/5: resolve `packageName@version` server-side, refusing rather than falling to @latest.
+            const resolution = await manifest.resolve(product);
+            if (resolution.kind === "unpublished")
+                return jsonError(c, 409, "unpublished");
+            if (resolution.kind === "manifest_unresolved")
+                return jsonError(c, 409, "manifest_unresolved");
+            // is-AC-15: already installed at the pinned version -> short-circuit, never spawn npm.
+            const snapshot = store.detectState(product);
+            const detectedVersion = await installedVersion(config, product);
+            if (snapshot.status === "installed" || detectedVersion === resolution.version) {
+                return c.json({ product, state: "installed" }, 200);
+            }
+            // is-AC-16: begin (or attach to an in-flight install); either way the wire state is in_progress.
+            store.begin(product, {
+                packageName: resolution.packageName,
+                version: resolution.version,
+                target: resolution.target
+            });
+            return c.json({ product, state: "install_in_progress" }, 202);
+        });
+        // 3) SSE progress (is-AC-11/12/14). Mirrors the telemetry-proxy relay discipline: a streamed
+        //    body, no buffering beyond the current event, tied to the request's abort signal.
+        app.get("/api/onboarding/install/:product/events", (c) => {
+            const rejection = guardInstallerRequest(c, tokenStore, "always");
+            if (rejection !== null)
+                return rejection;
+            const product = c.req.param("product");
+            if (!isInstallableProduct(product))
+                return jsonError(c, 400, "invalid_product");
+            const signal = c.req.raw.signal;
+            const stream = new ReadableStream({
+                start(controller) {
+                    const encoder = new TextEncoder();
+                    let closed = false;
+                    const subscriber = {
+                        send(event) {
+                            if (closed)
+                                return;
+                            try {
+                                controller.enqueue(encoder.encode(`data: ${JSON.stringify(event)}\n\n`));
+                            }
+                            catch {
+                                closed = true;
+                            }
+                        },
+                        close() {
+                            if (closed)
+                                return;
+                            closed = true;
+                            try {
+                                controller.close();
+                            }
+                            catch {
+                                // The stream may already be closed by a client disconnect; nothing to do.
+                            }
+                        }
+                    };
+                    const unsubscribe = store.subscribe(product, subscriber);
+                    const onAbort = () => {
+                        unsubscribe();
+                        subscriber.close();
+                    };
+                    // is-AC-14: a client disconnect removes this subscriber but the install continues.
+                    if (signal.aborted)
+                        onAbort();
+                    else
+                        signal.addEventListener("abort", onAbort, { once: true });
+                }
+            });
+            return new Response(stream, {
+                status: 200,
+                headers: {
+                    "content-type": "text/event-stream",
+                    "cache-control": "no-store",
+                    connection: "keep-alive"
+                }
+            });
+        });
+        // 4) Health check (is-AC-18): reuse the existing readiness projection, do not re-derive it.
+        app.get("/api/onboarding/health", async (c) => {
+            const rejection = guardInstallerRequest(c, tokenStore, "always");
+            if (rejection !== null)
+                return rejection;
+            const status = await fetchFleetStatus(fleetStatusFetch, doctorStatusUrl);
+            const ready = isFleetReady(status);
+            funnel.observeHealthReady(ready);
+            const authenticated = await fetchSetupAuthenticated(setupAuthFetch, { signal: c.req.raw.signal });
+            funnel.observeAuthenticated(authenticated);
+            return c.json({ ready, status });
+        });
+        // 5) Completion (is-AC-10): invalidate the token (delete the file + set the memory flag), 204.
+        app.post("/api/onboarding/complete", (c) => {
+            const rejection = guardInstallerRequest(c, tokenStore, "always");
+            if (rejection !== null)
+                return rejection;
+            tokenStore.invalidate();
+            return c.body(null, 204);
+        });
+        // 6) Funnel events (PRD-009c): validate token + closed UI event set, emit through chokepoint.
+        app.post("/api/onboarding/event", async (c) => {
+            const rejection = guardInstallerRequest(c, tokenStore, "always");
+            if (rejection !== null)
+                return rejection;
+            const body = await readJsonBody(c);
+            const parsed = OnboardingEventBodySchema.safeParse(body);
+            if (!parsed.success)
+                return jsonError(c, 400, "invalid_body");
+            funnel.recordUiEvent(parsed.data);
+            const authenticated = await fetchSetupAuthenticated(setupAuthFetch, { signal: c.req.raw.signal });
+            funnel.observeAuthenticated(authenticated);
+            return c.body(null, 202);
+        });
+    };
+    return { register, config, store, tokenStore, manifest, funnel };
+}
+//# sourceMappingURL=routes.js.map

package/dist/daemon/installer/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../src/daemon/installer/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG9D,OAAO,EAAE,uBAAuB,EAA0B,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAwB,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAyB,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAmB,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EAE1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAA2B,MAAM,kBAAkB,CAAC;AACpF,OAAO,EACL,gBAAgB,EAChB,YAAY,EAEb,MAAM,oBAAoB,CAAC;AA0B5B,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE5D,SAAS,SAAS,CAAC,CAAU,EAAE,MAA6B,EAAE,KAAa;IACzE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,CAAU;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,sBAAsB,CAAC,UAAmC,EAAE;IAC1E,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAE5C,6FAA6F;IAC7F,IAAI,aAAa,GAAkC,IAAI,CAAC;IACxD,MAAM,MAAM,GAAoB;QAC9B,GAAG,IAAI;QACP,gBAAgB,EAAE,GAAG,EAAE;YACrB,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3B,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;YACzG,CAAC;YACD,OAAO,aAAa,CAAC;QACvB,CAAC;KACF,CAAC;IAEF,MAAM,MAAM,GAAG,qBAAqB,CAAC;QACnC,MAAM;QACN,QAAQ,EAAE,OAAO,CAAC,cAAc;QAChC,QAAQ,EAAE,OAAO,CAAC,cAAc;KACjC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,uBAAuB,CAAC,MAAM,EAAE;QAC5C,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,2BAA2B,CAAC,OAAO,CAAC;QAC1E,kBAAkB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,6BAA6B,CAAC,OAAO,CAAC;QAC9E,eAAe,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC;KACvF,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAEhD,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC3D,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC;IACvD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,iBAAiB,CAAC;IAErE,MAAM,QAAQ,GAAG,CAAC,GAAS,EAAQ,EAAE;QACnC,gGAAgG;QAChG,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC5C,MAAM,SAAS,GAAG,qBAAqB,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YACzC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,qGAAqG;QACrG,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC9C,MAAM,SAAS,GAAG,qBAAqB,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YAEzC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YAE9D,2FAA2F;YAC3F,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;YACpC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;YAEhF,iGAAiG;YACjG,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,UAAU,CAAC,IAAI,KAAK,aAAa;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;YAC/E,IAAI,UAAU,CAAC,IAAI,KAAK,qBAAqB;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;YAE/F,uFAAuF;YACvF,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAChE,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,IAAI,eAAe,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC9E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;YACtD,CAAC;YAED,iGAAiG;YACjG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;gBACnB,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,6FAA6F;QAC7F,sFAAsF;QACtF,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,CAAC,EAAE,EAAE;YACvD,MAAM,SAAS,GAAG,qBAAqB,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YAEzC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;YAEhF,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAChC,MAAM,MAAM,GAAG,IAAI,cAAc,CAAa;gBAC5C,KAAK,CAAC,UAAU;oBACd,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;oBAClC,IAAI,MAAM,GAAG,KAAK,CAAC;oBACnB,MAAM,UAAU,GAAuB;wBACrC,IAAI,CAAC,KAAK;4BACR,IAAI,MAAM;gCAAE,OAAO;4BACnB,IAAI,CAAC;gCACH,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;4BAC3E,CAAC;4BAAC,MAAM,CAAC;gCACP,MAAM,GAAG,IAAI,CAAC;4BAChB,CAAC;wBACH,CAAC;wBACD,KAAK;4BACH,IAAI,MAAM;gCAAE,OAAO;4BACnB,MAAM,GAAG,IAAI,CAAC;4BACd,IAAI,CAAC;gCACH,UAAU,CAAC,KAAK,EAAE,CAAC;4BACrB,CAAC;4BAAC,MAAM,CAAC;gCACP,0EAA0E;4BAC5E,CAAC;wBACH,CAAC;qBACF,CAAC;oBAEF,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;oBACzD,MAAM,OAAO,GAAG,GAAS,EAAE;wBACzB,WAAW,EAAE,CAAC;wBACd,UAAU,CAAC,KAAK,EAAE,CAAC;oBACrB,CAAC,CAAC;oBACF,mFAAmF;oBACnF,IAAI,MAAM,CAAC,OAAO;wBAAE,OAAO,EAAE,CAAC;;wBACzB,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjE,CAAC;aACF,CAAC,CAAC;YAEH,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE;gBAC1B,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,mBAAmB;oBACnC,eAAe,EAAE,UAAU;oBAC3B,UAAU,EAAE,YAAY;iBACzB;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,4FAA4F;QAC5F,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC5C,MAAM,SAAS,GAAG,qBAAqB,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;YACzE,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,aAAa,GAAG,MAAM,uBAAuB,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAClG,MAAM,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;YAC3C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,+FAA+F;QAC/F,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,CAAC,CAAC,EAAE,EAAE;YACzC,MAAM,SAAS,GAAG,qBAAqB,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YACzC,UAAU,CAAC,UAAU,EAAE,CAAC;YACxB,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,8FAA8F;QAC9F,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC5C,MAAM,SAAS,GAAG,qBAAqB,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YACzC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YAC9D,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,aAAa,GAAG,MAAM,uBAAuB,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAClG,MAAM,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;YAC3C,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACnE,CAAC"}

package/dist/daemon/installer/security.d.ts

@@ -0,0 +1,33 @@
+/**
+ * PRD-009a: the three non-negotiable installer mitigations (is-AC-7/8/9/10).
+ *
+ * A loopback endpoint that shells out to `npm install` is a drive-by target: any page the operator
+ * visits can `fetch` or form-POST at `127.0.0.1:3853`. Every installer request therefore passes:
+ *   - HOST validation (is-AC-8, DNS-rebinding defense): a rebound hostname that resolves to
+ *     127.0.0.1 still fails because its `Host` header is not the portal's own host.
+ *   - ORIGIN validation (is-AC-7): a foreign Origin is rejected 403; a missing Origin on a
+ *     state-changing (non-GET) request is rejected too.
+ *   - TOKEN validation (is-AC-9): the one-time bootstrap token, constant-time compared. State-
+ *     changing endpoints always require it; read-only detection requires it only while a session is
+ *     active, staying available token-free after completion for the re-entry short-circuit (is-AC-10).
+ */
+import type { Context } from "hono";
+import type { TokenStore } from "./token.js";
+/** The request header carrying the onboarding token (the SSE path uses the `t` query param instead). */
+export declare const TOKEN_HEADER: "x-onboarding-token";
+/** Whether detection-style read endpoints require the token unconditionally or only while active. */
+export type TokenMode = "always" | "detect";
+/** True iff the `Host` header is the portal's own host (is-AC-8). */
+export declare function hostAllowed(host: string | undefined): boolean;
+/**
+ * Origin policy (is-AC-7): a present Origin must be the portal's own; a missing Origin is allowed
+ * only on a safe (GET) request and rejected on any state-changing method.
+ */
+export declare function originAllowed(method: string, origin: string | undefined): boolean;
+/** Read the presented token from the header, falling back to the `t` query param only for EventSource. */
+export declare function extractToken(c: Context): string | null;
+/**
+ * Run the full guard for an installer request. Returns a rejection {@link Response} to short-circuit
+ * the handler, or `null` when the request passed all three checks. Never logs or echoes the token.
+ */
+export declare function guardInstallerRequest(c: Context, tokenStore: TokenStore, tokenMode: TokenMode): Response | null;

package/dist/daemon/installer/security.js

@@ -0,0 +1,80 @@
+/**
+ * PRD-009a: the three non-negotiable installer mitigations (is-AC-7/8/9/10).
+ *
+ * A loopback endpoint that shells out to `npm install` is a drive-by target: any page the operator
+ * visits can `fetch` or form-POST at `127.0.0.1:3853`. Every installer request therefore passes:
+ *   - HOST validation (is-AC-8, DNS-rebinding defense): a rebound hostname that resolves to
+ *     127.0.0.1 still fails because its `Host` header is not the portal's own host.
+ *   - ORIGIN validation (is-AC-7): a foreign Origin is rejected 403; a missing Origin on a
+ *     state-changing (non-GET) request is rejected too.
+ *   - TOKEN validation (is-AC-9): the one-time bootstrap token, constant-time compared. State-
+ *     changing endpoints always require it; read-only detection requires it only while a session is
+ *     active, staying available token-free after completion for the re-entry short-circuit (is-AC-10).
+ */
+import { HIVE_HOST, HIVE_PORT } from "../../shared/constants.js";
+/** The portal's own hosts (is-AC-8). Only these `Host` header values are accepted. */
+const ALLOWED_HOSTS = new Set([`${HIVE_HOST}:${HIVE_PORT}`, `localhost:${HIVE_PORT}`]);
+/** The portal's own origins (is-AC-7). Only these `Origin` header values are accepted. */
+const ALLOWED_ORIGINS = new Set([`http://${HIVE_HOST}:${HIVE_PORT}`, `http://localhost:${HIVE_PORT}`]);
+/** The request header carrying the onboarding token (the SSE path uses the `t` query param instead). */
+export const TOKEN_HEADER = "x-onboarding-token";
+/** True iff the `Host` header is the portal's own host (is-AC-8). */
+export function hostAllowed(host) {
+    return host !== undefined && ALLOWED_HOSTS.has(host);
+}
+/**
+ * Origin policy (is-AC-7): a present Origin must be the portal's own; a missing Origin is allowed
+ * only on a safe (GET) request and rejected on any state-changing method.
+ */
+export function originAllowed(method, origin) {
+    if (origin === undefined)
+        return method === "GET" || method === "HEAD";
+    return ALLOWED_ORIGINS.has(origin);
+}
+function forbidden() {
+    return new Response(JSON.stringify({ error: "forbidden" }), {
+        status: 403,
+        headers: { "content-type": "application/json" }
+    });
+}
+function unauthorized() {
+    return new Response(JSON.stringify({ error: "unauthorized" }), {
+        status: 401,
+        headers: { "content-type": "application/json" }
+    });
+}
+function allowsQueryToken(c) {
+    const path = new URL(c.req.url).pathname;
+    return c.req.method === "GET" && /^\/api\/onboarding\/install\/[^/]+\/events$/.test(path);
+}
+/** Read the presented token from the header, falling back to the `t` query param only for EventSource. */
+export function extractToken(c) {
+    const header = c.req.header(TOKEN_HEADER);
+    if (header !== undefined && header.length > 0)
+        return header;
+    if (!allowsQueryToken(c))
+        return null;
+    const query = c.req.query("t");
+    return query !== undefined && query.length > 0 ? query : null;
+}
+/**
+ * Run the full guard for an installer request. Returns a rejection {@link Response} to short-circuit
+ * the handler, or `null` when the request passed all three checks. Never logs or echoes the token.
+ */
+export function guardInstallerRequest(c, tokenStore, tokenMode) {
+    if (!hostAllowed(c.req.header("host")))
+        return forbidden();
+    if (!originAllowed(c.req.method, c.req.header("origin")))
+        return forbidden();
+    const provided = extractToken(c);
+    if (tokenMode === "always") {
+        if (!tokenStore.requireValid(provided))
+            return unauthorized();
+        return null;
+    }
+    // "detect": token required only while an onboarding session is active (is-AC-10 carve-out).
+    if (tokenStore.isActive() && !tokenStore.requireValid(provided))
+        return unauthorized();
+    return null;
+}
+//# sourceMappingURL=security.js.map

package/dist/daemon/installer/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/daemon/installer/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAGjE,sFAAsF;AACtF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,SAAS,IAAI,SAAS,EAAE,EAAE,aAAa,SAAS,EAAE,CAAC,CAAC,CAAC;AAE/F,0FAA0F;AAC1F,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS,CAAC,UAAU,SAAS,IAAI,SAAS,EAAE,EAAE,oBAAoB,SAAS,EAAE,CAAC,CAAC,CAAC;AAE/G,wGAAwG;AACxG,MAAM,CAAC,MAAM,YAAY,GAAG,oBAA6B,CAAC;AAK1D,qEAAqE;AACrE,MAAM,UAAU,WAAW,CAAC,IAAwB;IAClD,OAAO,IAAI,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,MAA0B;IACtE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC;IACvE,OAAO,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE;QAC1D,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE;QAC7D,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAU;IAClC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IACzC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,6CAA6C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5F,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,YAAY,CAAC,CAAU;IACrC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAC7D,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAAU,EAAE,UAAsB,EAAE,SAAoB;IAC5F,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,SAAS,EAAE,CAAC;IAC3D,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,SAAS,EAAE,CAAC;IAE7E,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC;YAAE,OAAO,YAAY,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4FAA4F;IAC5F,IAAI,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC;QAAE,OAAO,YAAY,EAAE,CAAC;IACvF,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/daemon/installer/spawn.d.ts

@@ -0,0 +1,48 @@
+/**
+ * PRD-009a: the argv-safe child-process seam (is-AC-6).
+ *
+ * Every npm invocation and every product registration verb runs through {@link SpawnFn}, whose
+ * signature is structurally injection-proof: the command and its arguments are ALWAYS an argv
+ * array, so there is no code path that can concatenate request-derived data into a shell string.
+ * The default node implementation ({@link createNodeSpawn}) passes `shell: false` explicitly.
+ *
+ * Windows footgun this design side-steps: `npm.cmd` cannot be spawned with `shell:false` on
+ * Node >= 20 (EINVAL). Callers therefore never spawn a `.cmd`; they spawn `process.execPath`
+ * with a resolved `*.js` entry as the first argv element (see `bin-resolver.ts`), so no `.cmd`
+ * and no shell is ever involved.
+ */
+import type { ChildProcess } from "node:child_process";
+/** The bounded tail we keep of each stream (is-AC-17: a bounded stderr excerpt, ~2 KB). */
+export declare const SPAWN_TAIL_LIMIT = 2048;
+/** The terminal outcome of a spawned process: its exit code plus bounded stdout/stderr tails. */
+export interface SpawnOutcome {
+    /** The process exit code, or `null` when it was terminated by a signal without a code. */
+    readonly code: number | null;
+    readonly stdoutTail: string;
+    readonly stderrTail: string;
+}
+/** Optional streaming hooks + an abort signal for a single spawn. */
+export interface SpawnInvocationOptions {
+    readonly signal?: AbortSignal;
+    /** Called for each stdout chunk (used to derive observable stage milestones, is-AC-12). */
+    readonly onStdout?: (chunk: string) => void;
+    /** Called for each stderr chunk. */
+    readonly onStderr?: (chunk: string) => void;
+}
+/**
+ * The injectable spawn surface. `command` + `args` are an argv array by construction; a shell
+ * string is not expressible. Resolves with the terminal {@link SpawnOutcome}; rejects only on a
+ * spawn-level error (ENOENT, EINVAL), which callers translate into a `failed` stage.
+ */
+export type SpawnFn = (command: string, args: readonly string[], options?: SpawnInvocationOptions) => Promise<SpawnOutcome>;
+/** The low-level node spawn seam, injected by tests to assert `shell:false` + the argv array. */
+export type RawSpawn = (command: string, args: readonly string[], options: {
+    readonly shell: false;
+    readonly signal?: AbortSignal;
+}) => ChildProcess;
+/**
+ * Build the default {@link SpawnFn} over node's `child_process.spawn`, pinned to `shell: false`.
+ * A test injects `rawSpawn` to assert the argv array and the disabled shell without touching a
+ * real process.
+ */
+export declare function createNodeSpawn(rawSpawn?: RawSpawn): SpawnFn;

package/dist/daemon/installer/spawn.js

@@ -0,0 +1,51 @@
+/**
+ * PRD-009a: the argv-safe child-process seam (is-AC-6).
+ *
+ * Every npm invocation and every product registration verb runs through {@link SpawnFn}, whose
+ * signature is structurally injection-proof: the command and its arguments are ALWAYS an argv
+ * array, so there is no code path that can concatenate request-derived data into a shell string.
+ * The default node implementation ({@link createNodeSpawn}) passes `shell: false` explicitly.
+ *
+ * Windows footgun this design side-steps: `npm.cmd` cannot be spawned with `shell:false` on
+ * Node >= 20 (EINVAL). Callers therefore never spawn a `.cmd`; they spawn `process.execPath`
+ * with a resolved `*.js` entry as the first argv element (see `bin-resolver.ts`), so no `.cmd`
+ * and no shell is ever involved.
+ */
+import { spawn as nodeSpawn } from "node:child_process";
+/** The bounded tail we keep of each stream (is-AC-17: a bounded stderr excerpt, ~2 KB). */
+export const SPAWN_TAIL_LIMIT = 2048;
+/** Keep only the last `limit` characters of `current + chunk` so a chatty child cannot grow memory. */
+function appendTail(current, chunk, limit) {
+    const next = current + chunk;
+    return next.length > limit ? next.slice(next.length - limit) : next;
+}
+/**
+ * Build the default {@link SpawnFn} over node's `child_process.spawn`, pinned to `shell: false`.
+ * A test injects `rawSpawn` to assert the argv array and the disabled shell without touching a
+ * real process.
+ */
+export function createNodeSpawn(rawSpawn = nodeSpawn) {
+    return (command, args, options = {}) => new Promise((resolve, reject) => {
+        let stdoutTail = "";
+        let stderrTail = "";
+        // The whole point of is-AC-6: an argv array and `shell: false`, never a shell string.
+        const child = rawSpawn(command, [...args], { shell: false, signal: options.signal });
+        child.stdout?.on("data", (data) => {
+            const chunk = String(data);
+            stdoutTail = appendTail(stdoutTail, chunk, SPAWN_TAIL_LIMIT);
+            options.onStdout?.(chunk);
+        });
+        child.stderr?.on("data", (data) => {
+            const chunk = String(data);
+            stderrTail = appendTail(stderrTail, chunk, SPAWN_TAIL_LIMIT);
+            options.onStderr?.(chunk);
+        });
+        child.on("error", (error) => {
+            reject(error);
+        });
+        child.on("close", (code) => {
+            resolve({ code, stdoutTail, stderrTail });
+        });
+    });
+}
+//# sourceMappingURL=spawn.js.map

package/dist/daemon/installer/spawn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn.js","sourceRoot":"","sources":["../../../src/daemon/installer/spawn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAGxD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAqCrC,uGAAuG;AACvG,SAAS,UAAU,CAAC,OAAe,EAAE,KAAa,EAAE,KAAa;IAC/D,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,CAAC;IAC7B,OAAO,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,WAAqB,SAAgC;IACnF,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE,CACrC,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC5C,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,UAAU,GAAG,EAAE,CAAC;QAEpB,sFAAsF;QACtF,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAErF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAa,EAAE,EAAE;YACzC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,UAAU,GAAG,UAAU,CAAC,UAAU,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;YAC7D,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAa,EAAE,EAAE;YACzC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,UAAU,GAAG,UAAU,CAAC,UAAU,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;YAC7D,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;YACjC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,EAAE;YACxC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/daemon/installer/token.d.ts

@@ -0,0 +1,23 @@
+/**
+ * PRD-009a: the daemon side of the one-time onboarding token contract (is-AC-9/10).
+ *
+ * The bootstrap mints the token and writes it to `~/.honeycomb/hive/onboarding-token` at mode
+ * 0600 BEFORE the daemon starts (PRD-009d). The daemon reads it LAZILY at request time, not at
+ * startup, because on re-entry the daemon may already be running when a fresh bootstrap writes a
+ * new token. Comparison is constant time (`crypto.timingSafeEqual`). Completion invalidates the
+ * token: the file is deleted and an in-memory flag is set, so state-changing endpoints refuse all
+ * requests until a fresh bootstrap mints a new one (is-AC-10). The token is never logged, never
+ * returned, and never placed in an error body.
+ */
+import type { InstallerConfig } from "./config.js";
+/** The token gate: whether onboarding is active, whether a presented token is valid, and invalidation. */
+export interface TokenStore {
+    /** True while a token file exists and has not been invalidated (an active onboarding session). */
+    isActive(): boolean;
+    /** True iff `provided` matches the on-disk token in constant time and the token is not invalidated. */
+    requireValid(provided: string | null | undefined): boolean;
+    /** Invalidate the token: delete the file and set the in-memory flag (idempotent). */
+    invalidate(): void;
+}
+/** Build the token store over the injected config seams. */
+export declare function createTokenStore(config: InstallerConfig): TokenStore;

package/dist/daemon/installer/token.js

@@ -0,0 +1,56 @@
+/**
+ * PRD-009a: the daemon side of the one-time onboarding token contract (is-AC-9/10).
+ *
+ * The bootstrap mints the token and writes it to `~/.honeycomb/hive/onboarding-token` at mode
+ * 0600 BEFORE the daemon starts (PRD-009d). The daemon reads it LAZILY at request time, not at
+ * startup, because on re-entry the daemon may already be running when a fresh bootstrap writes a
+ * new token. Comparison is constant time (`crypto.timingSafeEqual`). Completion invalidates the
+ * token: the file is deleted and an in-memory flag is set, so state-changing endpoints refuse all
+ * requests until a fresh bootstrap mints a new one (is-AC-10). The token is never logged, never
+ * returned, and never placed in an error body.
+ */
+import { timingSafeEqual } from "node:crypto";
+/** Constant-time string comparison. Length is compared first (timingSafeEqual requires equal length). */
+function constantTimeEquals(a, b) {
+    const bufA = Buffer.from(a, "utf8");
+    const bufB = Buffer.from(b, "utf8");
+    if (bufA.length !== bufB.length) {
+        // Still run a same-length comparison so a length mismatch is not a faster reject path.
+        timingSafeEqual(bufA, bufA);
+        return false;
+    }
+    return timingSafeEqual(bufA, bufB);
+}
+/** Build the token store over the injected config seams. */
+export function createTokenStore(config) {
+    let invalidated = false;
+    const readToken = () => {
+        const raw = config.readTextFile(config.tokenPath);
+        if (raw === null)
+            return null;
+        const trimmed = raw.trim();
+        return trimmed.length > 0 ? trimmed : null;
+    };
+    return {
+        isActive() {
+            if (invalidated)
+                return false;
+            return config.fileExists(config.tokenPath);
+        },
+        requireValid(provided) {
+            if (invalidated)
+                return false;
+            if (provided === null || provided === undefined || provided.length === 0)
+                return false;
+            const stored = readToken();
+            if (stored === null)
+                return false;
+            return constantTimeEquals(stored, provided);
+        },
+        invalidate() {
+            invalidated = true;
+            config.deleteFile(config.tokenPath);
+        }
+    };
+}
+//# sourceMappingURL=token.js.map

package/dist/daemon/installer/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/daemon/installer/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAI9C,yGAAyG;AACzG,SAAS,kBAAkB,CAAC,CAAS,EAAE,CAAS;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,uFAAuF;QACvF,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAYD,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB,CAAC,MAAuB;IACtD,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,MAAM,SAAS,GAAG,GAAkB,EAAE;QACpC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC,CAAC;IAEF,OAAO;QACL,QAAQ;YACN,IAAI,WAAW;gBAAE,OAAO,KAAK,CAAC;YAC9B,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;QACD,YAAY,CAAC,QAAQ;YACnB,IAAI,WAAW;gBAAE,OAAO,KAAK,CAAC;YAC9B,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACvF,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAClC,OAAO,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC9C,CAAC;QACD,UAAU;YACR,WAAW,GAAG,IAAI,CAAC;YACnB,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/daemon/server.d.ts

@@ -4,6 +4,7 @@ import { type LockPaths } from "../lock.js";
 import { type FetchImpl } from "./fleet-status.js";
 import { type ProxyFetch } from "./proxy.js";
 import { type TelemetryFetch } from "./telemetry-proxy.js";
+import { type InstallerServiceOptions } from "./installer/index.js";
 import type { SetupAuthFetchImpl } from "./setup-auth.js";
 export interface CreateHiveOptions {
     readonly host?: string;
@@ -20,6 +21,11 @@ export interface CreateHiveOptions {
     readonly doctorEventsUrl?: string;
     /** The fetch used by the telemetry relay to reach doctor's SSE stream (defaults to the global `fetch`). */
     readonly telemetryStreamFetch?: TelemetryFetch;
+    /**
+     * PRD-009a: installer-service seams (manifest fetch, spawn, token/npm-prefix resolution, fs).
+     * A test injects fakes here so the onboarding endpoints never touch the network or real npm.
+     */
+    readonly installer?: InstallerServiceOptions;
 }
 export interface StartHiveOptions extends CreateHiveOptions {
     readonly lockPaths?: Partial<LockPaths>;

package/dist/daemon/server.js

@@ -8,6 +8,7 @@ import { createPortalGate } from "./gate.js";
 import { createApiProxy } from "./proxy.js";
 import { resolveRegisteredServiceNames } from "./registry.js";
 import { createTelemetryStreamHandler } from "./telemetry-proxy.js";
+import { createInstallerService } from "./installer/index.js";
 function closeServer(server) {
     return new Promise((resolve, reject) => {
         server.close((error) => {
@@ -72,6 +73,12 @@ export function createHive(options = {}) {
         doctorEventsUrl: options.doctorEventsUrl,
         fetchImpl: options.telemetryStreamFetch
     }));
+    // PRD-009a: the onboarding installer service (detection, install start, SSE progress, health,
+    // completion, funnel-event stub). Registered BEFORE the generic `/api/*` proxy so these specific
+    // `/api/onboarding/*` routes win (same registration-order discipline as `/api/fleet-status`). Its
+    // health check reuses the SAME fleet-status fetch + doctor URL the gate uses; a test can override
+    // any installer seam (manifest fetch, spawn, token/npm-prefix, fs) via `options.installer`.
+    createInstallerService({ fleetStatusFetch, doctorStatusUrl, ...options.installer }).register(app);
     // Server-side federation (BFF): every other `/api/*` and `/setup/*` request is proxied over
     // loopback to the workload daemon that owns it (honeycomb or nectar), resolved from
     // doctor's registry. The browser only ever talks to hive's own origin.

package/dist/daemon/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/daemon/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EAE1B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,SAAS,EACT,YAAY,EACb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAkB,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAmB,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,4BAA4B,EAAuB,MAAM,sBAAsB,CAAC;AAwCzF,SAAS,WAAW,CAAC,MAAuB;IAC1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAa,EAAE,EAAE;YAC7B,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;gBAC3B,MAAM,CAAC,KAAK,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,UAA6B,EAAE;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IAExB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC3D,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,iBAAiB,CAAC;IAErE,4FAA4F;IAC5F,yFAAyF;IACzF,4FAA4F;IAC5F,sEAAsE;IACtE,GAAG,CAAC,GAAG,CACL,GAAG,EACH,gBAAgB,CAAC;QACf,gBAAgB;QAChB,eAAe;QACf,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CACH,CAAC;IAEF,gGAAgG;IAChG,uBAAuB;IACvB,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAE1B,4FAA4F;IAC5F,2FAA2F;IAC3F,4FAA4F;IAC5F,6FAA6F;IAC7F,kFAAkF;IAClF,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,OAAO,EAAE,YAAY;SACtB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sFAAsF;IACtF,kFAAkF;IAClF,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CACvC,CAAC,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAClE,CAAC;IAEF,uFAAuF;IACvF,sFAAsF;IACtF,2FAA2F;IAC3F,iGAAiG;IACjG,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,CAAC,CAAC,EAAE,EAAE,CACxC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,EAAE,CAAC,CACzF,CAAC;IAEF,gFAAgF;IAChF,8FAA8F;IAC9F,8FAA8F;IAC9F,GAAG,CAAC,GAAG,CACL,uBAAuB,EACvB,4BAA4B,CAAC;QAC3B,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,SAAS,EAAE,OAAO,CAAC,oBAAoB;KACxC,CAAC,CACH,CAAC;IAEF,4FAA4F;IAC5F,oFAAoF;IACpF,uEAAuE;IACvE,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACvG,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAE9B,4FAA4F;IAC5F,6FAA6F;IAC7F,yFAAyF;IACzF,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAEjC,OAAO;QACL,GAAG;QACH,IAAI;QACJ,IAAI;QACJ,SAAS;KACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,UAA4B,EAAE;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;IACzC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,yBAAyB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAE/D,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,OAAO,CAAC;YACf,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK;YACrB,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yBAAyB,CAAC,SAAS,CAAC,CAAC;QACrC,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACrC,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,yBAAyB,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,GAAG,IAAI;QACP,SAAS;QACT,IAAI;KACL,CAAC;AACJ,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/daemon/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EAE1B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,SAAS,EACT,YAAY,EACb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAkB,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAmB,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,4BAA4B,EAAuB,MAAM,sBAAsB,CAAC;AACzF,OAAO,EAAE,sBAAsB,EAAgC,MAAM,sBAAsB,CAAC;AA6C5F,SAAS,WAAW,CAAC,MAAuB;IAC1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAa,EAAE,EAAE;YAC7B,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;gBAC3B,MAAM,CAAC,KAAK,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,UAA6B,EAAE;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IAExB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC3D,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,iBAAiB,CAAC;IAErE,4FAA4F;IAC5F,yFAAyF;IACzF,4FAA4F;IAC5F,sEAAsE;IACtE,GAAG,CAAC,GAAG,CACL,GAAG,EACH,gBAAgB,CAAC;QACf,gBAAgB;QAChB,eAAe;QACf,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CACH,CAAC;IAEF,gGAAgG;IAChG,uBAAuB;IACvB,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAE1B,4FAA4F;IAC5F,2FAA2F;IAC3F,4FAA4F;IAC5F,6FAA6F;IAC7F,kFAAkF;IAClF,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,OAAO,EAAE,YAAY;SACtB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sFAAsF;IACtF,kFAAkF;IAClF,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CACvC,CAAC,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAClE,CAAC;IAEF,uFAAuF;IACvF,sFAAsF;IACtF,2FAA2F;IAC3F,iGAAiG;IACjG,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,CAAC,CAAC,EAAE,EAAE,CACxC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,EAAE,CAAC,CACzF,CAAC;IAEF,gFAAgF;IAChF,8FAA8F;IAC9F,8FAA8F;IAC9F,GAAG,CAAC,GAAG,CACL,uBAAuB,EACvB,4BAA4B,CAAC;QAC3B,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,SAAS,EAAE,OAAO,CAAC,oBAAoB;KACxC,CAAC,CACH,CAAC;IAEF,8FAA8F;IAC9F,iGAAiG;IACjG,kGAAkG;IAClG,kGAAkG;IAClG,4FAA4F;IAC5F,sBAAsB,CAAC,EAAE,gBAAgB,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAElG,4FAA4F;IAC5F,oFAAoF;IACpF,uEAAuE;IACvE,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACvG,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAE9B,4FAA4F;IAC5F,6FAA6F;IAC7F,yFAAyF;IACzF,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAEjC,OAAO;QACL,GAAG;QACH,IAAI;QACJ,IAAI;QACJ,SAAS;KACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,UAA4B,EAAE;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;IACzC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,yBAAyB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAE/D,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,OAAO,CAAC;YACf,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK;YACrB,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yBAAyB,CAAC,SAAS,CAAC,CAAC;QACrC,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACrC,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,yBAAyB,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,GAAG,IAAI;QACP,SAAS;QACT,IAAI;KACL,CAAC;AACJ,CAAC"}