@legioncodeinc/hive 0.2.1 → 0.3.0

package/dist/daemon/dashboard/host.d.ts

@@ -46,6 +46,13 @@ export declare const DASHBOARD_LOGO_PATH: "/honeycomb-memory-cluster.svg";
  * six known filenames 404s (no attacker-controlled path component).
  */
 export declare const DASHBOARD_FONT_PATH: "/fonts/:name";
+/**
+ * The same-origin path prefix the host serves the product brand marks under (PRD-009a). `:name` is
+ * validated by a safe-name regex in `web-assets.ts` `brandAsset()` (leaf `*.svg` only, no traversal),
+ * so anything unsafe 404s. `/assets/` is gate-exempt (`gate.ts`) so the onboarding cards load their
+ * marks even when the shell has redirected the browser to a gated screen.
+ */
+export declare const DASHBOARD_BRAND_PATH: "/assets/brand/:name";
 /** Options for {@link mountDashboardHost}. */
 export interface MountDashboardHostOptions {
     /**

package/dist/daemon/dashboard/host.js

@@ -45,6 +45,13 @@ export const DASHBOARD_LOGO_PATH = "/honeycomb-memory-cluster.svg";
  * six known filenames 404s (no attacker-controlled path component).
  */
 export const DASHBOARD_FONT_PATH = "/fonts/:name";
+/**
+ * The same-origin path prefix the host serves the product brand marks under (PRD-009a). `:name` is
+ * validated by a safe-name regex in `web-assets.ts` `brandAsset()` (leaf `*.svg` only, no traversal),
+ * so anything unsafe 404s. `/assets/` is gate-exempt (`gate.ts`) so the onboarding cards load their
+ * marks even when the shell has redirected the browser to a gated screen.
+ */
+export const DASHBOARD_BRAND_PATH = "/assets/brand/:name";
 /**
  * The asset base the app resolves host-served assets under. hive serves the mark at the ROOT
  * (`/honeycomb-memory-cluster.svg`), so the base is empty — the app's `${assetBase}/…svg`
@@ -139,6 +146,15 @@ export function mountDashboardAssets(app, options = {}) {
             "cache-control": "public, max-age=31536000, immutable",
         });
     });
+    // GET /assets/brand/<file>.svg — the product brand marks (PRD-009a). `:name` is validated by a
+    // safe-name regex in `brandAsset()` (leaf `*.svg` only, no `..`, no separators); an unsafe or
+    // missing name 404s. The marks carry no secret; a modest revalidating cache is plenty over loopback.
+    app.get(DASHBOARD_BRAND_PATH, (c) => {
+        const asset = assets.brandAsset(c.req.param("name"));
+        if (asset === null)
+            return c.text("brand asset not found", 404);
+        return c.body(asset.body, 200, { "content-type": asset.contentType, "cache-control": "public, max-age=3600" });
+    });
 }
 /**
  * Attach the SPA shell CATCH-ALL onto hive's Hono app (PRD-003a g-AC-1 / g-AC-2). Register this

package/dist/daemon/dashboard/host.js.map

@@ -1 +1 @@
-{"version":3,"file":"host.js","sourceRoot":"","sources":["../../../src/daemon/dashboard/host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,EAAE,eAAe,EAAkB,MAAM,iBAAiB,CAAC;AAElE,kGAAkG;AAClG,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAY,CAAC;AAEhD,kEAAkE;AAClE,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAkB,CAAC;AAErD,kFAAkF;AAClF,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAsB,CAAC;AAEzD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,mBAAmB,GAAG,+BAAwC,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAuB,CAAC;AAE3D;;;;GAIG;AACH,MAAM,UAAU,GAAG,EAAW,CAAC;AAY/B;;;;GAIG;AACH,MAAM,UAAU,GAAG;IAClB,sEAAsE;IACtE,uEAAuE;IACvE,yEAAyE;IACzE,sEAAsE;IACtE,8EAA8E;IAC9E,kFAAkF;IAClF,4BAA4B;IAC5B,kDAAkD;IAClD,yEAAyE;IACzE,sFAAsF;IACtF,GAAG;IACH,4DAA4D;CAC5D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb;;;;;GAKG;AACH,MAAM,UAAU,WAAW;IAC1B,OAAO;QACN,iBAAiB;QACjB,kBAAkB;QAClB,QAAQ;QACR,wBAAwB;QACxB,sEAAsE;QACtE,iCAAiC;QACjC,gCAAgC,kBAAkB,IAAI;QACtD,0BAA0B,mBAAmB,IAAI;QACjD,UAAU,UAAU,UAAU;QAC9B,SAAS;QACT,QAAQ;QACR,mCAAmC,UAAU,UAAU;QACvD,8BAA8B,kBAAkB,aAAa;QAC7D,SAAS;QACT,SAAS;KACT,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAS,EAAE,UAAqC,EAAE;IACtF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,eAAe,EAAE,CAAC;IAEnD,2EAA2E;IAC3E,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;IAEH,wDAAwD;IACxD,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;IAEH,2FAA2F;IAC3F,6FAA6F;IAC7F,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;IAEH,4FAA4F;IAC5F,6FAA6F;IAC7F,+FAA+F;IAC/F,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;QACnE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE;YAC9B,cAAc,EAAE,KAAK,CAAC,WAAW;YACjC,eAAe,EAAE,qCAAqC;SACtD,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAS;IACpD,iGAAiG;IACjG,6FAA6F;IAC7F,6FAA6F;IAC7F,+FAA+F;IAC/F,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;QAClB,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACtC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAS,EAAE,UAAqC,EAAE;IACpF,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACnC,2BAA2B,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC"}
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../../../src/daemon/dashboard/host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,EAAE,eAAe,EAAkB,MAAM,iBAAiB,CAAC;AAElE,kGAAkG;AAClG,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAY,CAAC;AAEhD,kEAAkE;AAClE,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAkB,CAAC;AAErD,kFAAkF;AAClF,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAsB,CAAC;AAEzD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,mBAAmB,GAAG,+BAAwC,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAuB,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAA8B,CAAC;AAEnE;;;;GAIG;AACH,MAAM,UAAU,GAAG,EAAW,CAAC;AAY/B;;;;GAIG;AACH,MAAM,UAAU,GAAG;IAClB,sEAAsE;IACtE,uEAAuE;IACvE,yEAAyE;IACzE,sEAAsE;IACtE,8EAA8E;IAC9E,kFAAkF;IAClF,4BAA4B;IAC5B,kDAAkD;IAClD,yEAAyE;IACzE,sFAAsF;IACtF,GAAG;IACH,4DAA4D;CAC5D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb;;;;;GAKG;AACH,MAAM,UAAU,WAAW;IAC1B,OAAO;QACN,iBAAiB;QACjB,kBAAkB;QAClB,QAAQ;QACR,wBAAwB;QACxB,sEAAsE;QACtE,iCAAiC;QACjC,gCAAgC,kBAAkB,IAAI;QACtD,0BAA0B,mBAAmB,IAAI;QACjD,UAAU,UAAU,UAAU;QAC9B,SAAS;QACT,QAAQ;QACR,mCAAmC,UAAU,UAAU;QACvD,8BAA8B,kBAAkB,aAAa;QAC7D,SAAS;QACT,SAAS;KACT,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAS,EAAE,UAAqC,EAAE;IACtF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,eAAe,EAAE,CAAC;IAEnD,2EAA2E;IAC3E,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;IAEH,wDAAwD;IACxD,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;IAEH,2FAA2F;IAC3F,6FAA6F;IAC7F,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;IAEH,4FAA4F;IAC5F,6FAA6F;IAC7F,+FAA+F;IAC/F,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;QACnE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE;YAC9B,cAAc,EAAE,KAAK,CAAC,WAAW;YACjC,eAAe,EAAE,qCAAqC;SACtD,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,+FAA+F;IAC/F,8FAA8F;IAC9F,qGAAqG;IACrG,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE;QACnC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACrD,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QAChE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,WAAW,EAAE,eAAe,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAChH,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAS;IACpD,iGAAiG;IACjG,6FAA6F;IAC7F,6FAA6F;IAC7F,+FAA+F;IAC/F,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;QAClB,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACtC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAS,EAAE,UAAqC,EAAE;IACpF,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACnC,2BAA2B,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC"}

package/dist/daemon/dashboard/web-assets.d.ts

@@ -77,6 +77,8 @@ export interface WebAssets {
     appJs(): ServedAsset | null;
     /** A brand font's bytes + content type for an allow-listed `name`, or `null` (→ 404) otherwise. */
     font(name: string): ServedBinaryAsset | null;
+    /** A brand SVG for a safe leaf `*.svg` `name` under `assets/brand/`, or `null` (→ 404) otherwise. */
+    brandAsset(name: string): ServedAsset | null;
 }
 /**
  * Build the host-side asset reader. Resolves the assets + bundle dirs once and reads on

package/dist/daemon/dashboard/web-assets.js

@@ -55,6 +55,15 @@ const FONT_FILES = [
 const FONT_ALLOW = new Set(FONT_FILES);
 /** The same-origin path hive serves the fonts under (origin-rooted; see {@link rewriteFontUrls}). */
 const FONT_ROUTE_PREFIX = "/fonts/";
+/**
+ * The on-disk dir (under `assets/`) the product brand marks live in, and the safe-name pattern the
+ * host route enforces (PRD-009a). Only a leaf `*.svg` filename drawn from a conservative charset is
+ * served; anything with a path separator, a `..`, or a non-`.svg` extension is rejected (404). This
+ * is the "allowlist .svg filenames, no path traversal" contract the onboarding UI's product cards
+ * load their marks through (`/assets/brand/doctor-mark.svg`, etc.).
+ */
+const BRAND_DIR = "brand";
+const BRAND_SVG_NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*\.svg$/;
 /** Map a font filename to its `content-type` by extension (`.woff2` → `font/woff2`, `.ttf` → `font/ttf`). */
 function fontContentType(name) {
     return name.endsWith(".woff2") ? "font/woff2" : "font/ttf";
@@ -190,6 +199,16 @@ export function createWebAssets(options = {}) {
             const js = readSoft(join(bundleDir, DASHBOARD_APP_BUNDLE));
             return js === null ? null : { body: js, contentType: "text/javascript; charset=utf-8" };
         },
+        brandAsset(name) {
+            if (assetsDir === null)
+                return null;
+            // Safe leaf filename ONLY: no separators, no `..`, `.svg` extension. No attacker-controlled
+            // path component reaches `join` — a rejected name never touches the filesystem.
+            if (name.includes("..") || !BRAND_SVG_NAME_RE.test(name))
+                return null;
+            const svg = readSoft(join(assetsDir, BRAND_DIR, name));
+            return svg === null ? null : { body: svg, contentType: "image/svg+xml" };
+        },
     };
 }
 //# sourceMappingURL=web-assets.js.map

package/dist/daemon/dashboard/web-assets.js.map

@@ -1 +1 @@
-{"version":3,"file":"web-assets.js","sourceRoot":"","sources":["../../../src/daemon/dashboard/web-assets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,4FAA4F;AAC5F,MAAM,SAAS,GAAG,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,iBAAiB,CAAU,CAAC;AAEvI,iDAAiD;AACjD,MAAM,SAAS,GAAG,oCAAoC,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,UAAU,GAAG;IAClB,kCAAkC;IAClC,yCAAyC;IACzC,6BAA6B;IAC7B,4BAA4B;IAC5B,8BAA8B;IAC9B,0BAA0B;CACjB,CAAC;AACX,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,UAAU,CAAC,CAAC;AAE/C,qGAAqG;AACrG,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAEpC,6GAA6G;AAC7G,SAAS,eAAe,CAAC,IAAY;IACpC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC;AAC5D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,GAAW;IACnC,OAAO,GAAG,CAAC,UAAU,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,UAAU,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;AAC3G,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAiB,CAAC;AAEtD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB,MAAM,CAAC,IAAI,CAAC,GAAG;IAClE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACJ,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;IACD,wEAAwE;IACxE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACtC,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QAChE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB,MAAM,CAAC,IAAI,CAAC,GAAG;IAClE,IAAI,CAAC;QACJ,OAAO,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAwBD,4EAA4E;AAC5E,SAAS,QAAQ,CAAC,IAAY;IAC7B,IAAI,CAAC;QACJ,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,IAAY;IACnC,IAAI,CAAC;QACJ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAcD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,UAA4B,EAAE;IAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC3F,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC3F,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC;IAEpC,OAAO;QACN,GAAG;YACF,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACpC,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC5C,IAAI,IAAI,KAAK,IAAI;oBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,QAAQ,IAAI,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpC,yFAAyF;YACzF,2FAA2F;YAC3F,OAAO,EAAE,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;QAC9F,CAAC;QACD,IAAI;YACH,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACpC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;YACjD,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,IAAY;YAChB,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACpC,2FAA2F;YAC3F,8EAA8E;YAC9E,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YAC/D,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QACpF,CAAC;QACD,KAAK;YACJ,IAAI,aAAa,KAAK,SAAS;gBAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;YAC/G,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACpC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC,CAAC;YAC3D,OAAO,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;QACzF,CAAC;KACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"web-assets.js","sourceRoot":"","sources":["../../../src/daemon/dashboard/web-assets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,4FAA4F;AAC5F,MAAM,SAAS,GAAG,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,iBAAiB,CAAU,CAAC;AAEvI,iDAAiD;AACjD,MAAM,SAAS,GAAG,oCAAoC,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,UAAU,GAAG;IAClB,kCAAkC;IAClC,yCAAyC;IACzC,6BAA6B;IAC7B,4BAA4B;IAC5B,8BAA8B;IAC9B,0BAA0B;CACjB,CAAC;AACX,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,UAAU,CAAC,CAAC;AAE/C,qGAAqG;AACrG,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAEpC;;;;;;GAMG;AACH,MAAM,SAAS,GAAG,OAAO,CAAC;AAC1B,MAAM,iBAAiB,GAAG,mCAAmC,CAAC;AAE9D,6GAA6G;AAC7G,SAAS,eAAe,CAAC,IAAY;IACpC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC;AAC5D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,GAAW;IACnC,OAAO,GAAG,CAAC,UAAU,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,UAAU,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;AAC3G,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAiB,CAAC;AAEtD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB,MAAM,CAAC,IAAI,CAAC,GAAG;IAClE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACJ,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;IACD,wEAAwE;IACxE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACtC,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QAChE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB,MAAM,CAAC,IAAI,CAAC,GAAG;IAClE,IAAI,CAAC;QACJ,OAAO,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAwBD,4EAA4E;AAC5E,SAAS,QAAQ,CAAC,IAAY;IAC7B,IAAI,CAAC;QACJ,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,IAAY;IACnC,IAAI,CAAC;QACJ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAgBD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,UAA4B,EAAE;IAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC3F,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC3F,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC;IAEpC,OAAO;QACN,GAAG;YACF,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACpC,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC5C,IAAI,IAAI,KAAK,IAAI;oBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,QAAQ,IAAI,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpC,yFAAyF;YACzF,2FAA2F;YAC3F,OAAO,EAAE,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;QAC9F,CAAC;QACD,IAAI;YACH,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACpC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;YACjD,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,IAAY;YAChB,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACpC,2FAA2F;YAC3F,8EAA8E;YAC9E,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YAC/D,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QACpF,CAAC;QACD,KAAK;YACJ,IAAI,aAAa,KAAK,SAAS;gBAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;YAC/G,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACpC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC,CAAC;YAC3D,OAAO,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;QACzF,CAAC;QACD,UAAU,CAAC,IAAY;YACtB,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACpC,4FAA4F;YAC5F,gFAAgF;YAChF,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtE,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YACvD,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;QAC1E,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/daemon/gate.d.ts

@@ -33,8 +33,8 @@
 import type { MiddlewareHandler } from "hono";
 import { type FetchImpl as FleetFetchImpl } from "./fleet-status.js";
 import { type SetupAuthFetchImpl } from "./setup-auth.js";
-/** The only two gate-exempt SCREENS (g-AC-7 / g-AC-8): always served directly, never redirected. */
-export declare const GATE_EXEMPT_ROUTES: readonly ["/buzzing", "/login"];
+/** The gate-exempt SCREENS (g-AC-7 / g-AC-8): always served directly, never redirected. */
+export declare const GATE_EXEMPT_ROUTES: readonly ["/buzzing", "/login", "/onboarding"];
 export interface CreatePortalGateOptions {
     /** The fetch used for the health check (defaults to the global `fetch`; a test injects a fake). */
     readonly fleetStatusFetch?: FleetFetchImpl;

package/dist/daemon/gate.js

@@ -38,8 +38,14 @@ import { fetchSetupAuthenticated } from "./setup-auth.js";
 const BUZZING_ROUTE = "/buzzing";
 /** The fixed redirect target for a logged-out operator (g-AC-4). A hard-coded literal, never derived. */
 const LOGIN_ROUTE = "/login";
-/** The only two gate-exempt SCREENS (g-AC-7 / g-AC-8): always served directly, never redirected. */
-export const GATE_EXEMPT_ROUTES = [BUZZING_ROUTE, LOGIN_ROUTE];
+/**
+ * The onboarding installer screen (PRD-009). Gate-exempt like `/buzzing` and `/login`: on first run
+ * the fleet is by definition unhealthy and the operator unauthenticated, so `/onboarding` must serve
+ * its SPA shell directly rather than being redirected by the health-then-auth precedence.
+ */
+const ONBOARDING_ROUTE = "/onboarding";
+/** The gate-exempt SCREENS (g-AC-7 / g-AC-8): always served directly, never redirected. */
+export const GATE_EXEMPT_ROUTES = [BUZZING_ROUTE, LOGIN_ROUTE, ONBOARDING_ROUTE];
 /**
  * hive's OWN liveness route + the bundled SPA asset routes — never a page navigation to gate.
  * `/health` is deliberately NOT in this set (see {@link isInfraPath}): PRD-005b claims that same
@@ -47,8 +53,13 @@ export const GATE_EXEMPT_ROUTES = [BUZZING_ROUTE, LOGIN_ROUTE];
  * rather than a blanket exemption.
  */
 const GATE_EXEMPT_INFRA_PATHS = new Set(["/app.js", "/styles.css", "/honeycomb-memory-cluster.svg"]);
-/** Path PREFIXES that are data-plane traffic (the BFF proxy, fonts), never a gated page route. */
-const GATE_EXEMPT_INFRA_PREFIXES = ["/api/", "/setup/", "/fonts/"];
+/**
+ * Path PREFIXES that are data-plane / static-asset traffic (the BFF proxy, fonts, and the brand
+ * SVG assets under `/assets/`), never a gated page route. `/assets/` is exempt (PRD-009a) so the
+ * onboarding product-mark SVGs load even when the shell has redirected the browser to a gated
+ * screen, exactly like the other bundled asset routes.
+ */
+const GATE_EXEMPT_INFRA_PREFIXES = ["/api/", "/setup/", "/fonts/", "/assets/"];
 /**
  * hive's own machine-liveness path. Ambiguous on purpose (PRD-005b): a health-probe/monitoring
  * caller (doctor's own `/health` probe, an ops tool) never sends `Accept: text/html`, while a

package/dist/daemon/gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/daemon/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAoC,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,uBAAuB,EAA2B,MAAM,iBAAiB,CAAC;AAEnF,sGAAsG;AACtG,MAAM,aAAa,GAAG,UAAmB,CAAC;AAE1C,yGAAyG;AACzG,MAAM,WAAW,GAAG,QAAiB,CAAC;AAEtC,oGAAoG;AACpG,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,aAAa,EAAE,WAAW,CAAU,CAAC;AAExE;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,EAAE,aAAa,EAAE,+BAA+B,CAAC,CAAC,CAAC;AAE7G,kGAAkG;AAClG,MAAM,0BAA0B,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAU,CAAC;AAE5E;;;;;GAKG;AACH,MAAM,aAAa,GAAG,SAAkB,CAAC;AAEzC,6GAA6G;AAC7G,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,QAAgB,EAAE,MAAc;IACnD,IAAI,QAAQ,KAAK,aAAa;QAAE,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,4FAA4F;AAC5F,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAQ,kBAAwC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACtE,CAAC;AAaD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAmC,EAAE;IACpE,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC3D,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,iBAAiB,CAAC;IACrE,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC;IACvD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAE1C,OAAO,KAAK,EAAE,CAAU,EAAE,IAAyB,EAA4B,EAAE;QAC/E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC7C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE5C,8EAA8E;QAC9E,IAAI,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,EAAE,CAAC;YACb,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,yFAAyF;QACzF,6FAA6F;QAC7F,6FAA6F;QAC7F,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,EAAE,CAAC;YACb,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,wFAAwF;QACxF,yFAAyF;QACzF,wDAAwD;QACxD,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;QAC9E,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;QAED,4FAA4F;QAC5F,gGAAgG;QAChG,4FAA4F;QAC5F,4FAA4F;QAC5F,MAAM,aAAa,GAAG,MAAM,uBAAuB,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAChH,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;QAED,4FAA4F;QAC5F,+FAA+F;QAC/F,MAAM,IAAI,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/daemon/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAoC,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,uBAAuB,EAA2B,MAAM,iBAAiB,CAAC;AAEnF,sGAAsG;AACtG,MAAM,aAAa,GAAG,UAAmB,CAAC;AAE1C,yGAAyG;AACzG,MAAM,WAAW,GAAG,QAAiB,CAAC;AAEtC;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,aAAsB,CAAC;AAEhD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,gBAAgB,CAAU,CAAC;AAE1F;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,EAAE,aAAa,EAAE,+BAA+B,CAAC,CAAC,CAAC;AAE7G;;;;;GAKG;AACH,MAAM,0BAA0B,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,CAAU,CAAC;AAExF;;;;;GAKG;AACH,MAAM,aAAa,GAAG,SAAkB,CAAC;AAEzC,6GAA6G;AAC7G,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,QAAgB,EAAE,MAAc;IACnD,IAAI,QAAQ,KAAK,aAAa;QAAE,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,4FAA4F;AAC5F,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAQ,kBAAwC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACtE,CAAC;AAaD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAmC,EAAE;IACpE,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC3D,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,iBAAiB,CAAC;IACrE,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC;IACvD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAE1C,OAAO,KAAK,EAAE,CAAU,EAAE,IAAyB,EAA4B,EAAE;QAC/E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC7C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE5C,8EAA8E;QAC9E,IAAI,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,EAAE,CAAC;YACb,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,yFAAyF;QACzF,6FAA6F;QAC7F,6FAA6F;QAC7F,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,EAAE,CAAC;YACb,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,wFAAwF;QACxF,yFAAyF;QACzF,wDAAwD;QACxD,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;QAC9E,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;QAED,4FAA4F;QAC5F,gGAAgG;QAChG,4FAA4F;QAC5F,4FAA4F;QAC5F,MAAM,aAAa,GAAG,MAAM,uBAAuB,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAChH,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;QAED,4FAA4F;QAC5F,+FAA+F;QAC/F,MAAM,IAAI,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC"}

package/dist/daemon/installer/bin-resolver.d.ts

@@ -0,0 +1,34 @@
+/**
+ * PRD-009a: argv-safe resolution of the JS entry points the installer spawns (is-AC-6).
+ *
+ * npm and each product ship a `.cmd`/shell shim on the global `bin` path that cannot be spawned
+ * with `shell:false` on Windows. Instead of ever touching those shims, we resolve the underlying
+ * `*.js` entry from the package's own `package.json#bin` field and spawn it as
+ * `process.execPath [entry.js, ...args]`. No `.cmd`, no shell, anywhere.
+ *
+ * Layout facts:
+ *   - global node_modules: `<prefix>/lib/node_modules` (POSIX) or `<prefix>/node_modules` (Windows)
+ *   - npm's own entry: `npm/bin/npm-cli.js` inside global node_modules (or a require.resolve fallback)
+ *   - node ships npm next to the executable, so npm-cli.js is locatable relative to `process.execPath`
+ *     even before we know the prefix (used to run `npm prefix -g` itself)
+ */
+import type { InstallerConfig } from "./config.js";
+/** The global node_modules directory for a resolved npm prefix, per platform. */
+export declare function globalNodeModulesDir(prefix: string, platform: NodeJS.Platform): string;
+/**
+ * Resolve the absolute `*.js` entry for `binName` inside `<nodeModulesDir>/<packageName>`, reading
+ * the package's `package.json#bin`. Returns `null` when the package, its manifest, or the bin entry
+ * cannot be resolved (the caller treats that as a registration failure, is-AC-13).
+ */
+export declare function resolvePackageBinJs(config: InstallerConfig, nodeModulesDir: string, packageName: string, binName: string): string | null;
+/**
+ * Locate `npm/bin/npm-cli.js` relative to `process.execPath` (node ships npm beside its binary),
+ * so we can run `npm prefix -g` before the prefix is known. Falls back to `require.resolve`.
+ */
+export declare function locateNpmCliJs(config: InstallerConfig): string | null;
+/**
+ * The default `npm prefix -g` resolver: locate npm-cli.js relative to the node binary and spawn it
+ * argv-safe, returning the trimmed prefix. Returns `null` when npm-cli.js cannot be located or the
+ * command fails. The installer service memoizes this so it runs at most once per daemon session.
+ */
+export declare function resolveNpmPrefixViaCli(config: InstallerConfig): Promise<string | null>;

package/dist/daemon/installer/bin-resolver.js

@@ -0,0 +1,86 @@
+/**
+ * PRD-009a: argv-safe resolution of the JS entry points the installer spawns (is-AC-6).
+ *
+ * npm and each product ship a `.cmd`/shell shim on the global `bin` path that cannot be spawned
+ * with `shell:false` on Windows. Instead of ever touching those shims, we resolve the underlying
+ * `*.js` entry from the package's own `package.json#bin` field and spawn it as
+ * `process.execPath [entry.js, ...args]`. No `.cmd`, no shell, anywhere.
+ *
+ * Layout facts:
+ *   - global node_modules: `<prefix>/lib/node_modules` (POSIX) or `<prefix>/node_modules` (Windows)
+ *   - npm's own entry: `npm/bin/npm-cli.js` inside global node_modules (or a require.resolve fallback)
+ *   - node ships npm next to the executable, so npm-cli.js is locatable relative to `process.execPath`
+ *     even before we know the prefix (used to run `npm prefix -g` itself)
+ */
+import { dirname, join } from "node:path";
+import { z } from "zod";
+/** The global node_modules directory for a resolved npm prefix, per platform. */
+export function globalNodeModulesDir(prefix, platform) {
+    return platform === "win32" ? join(prefix, "node_modules") : join(prefix, "lib", "node_modules");
+}
+/** npm's `bin` field can be a bare string or a `{ name: relPath }` map. */
+const BinFieldSchema = z.union([z.string(), z.record(z.string(), z.string())]);
+const PackageJsonBinSchema = z.object({ bin: BinFieldSchema.optional() });
+/**
+ * Resolve the absolute `*.js` entry for `binName` inside `<nodeModulesDir>/<packageName>`, reading
+ * the package's `package.json#bin`. Returns `null` when the package, its manifest, or the bin entry
+ * cannot be resolved (the caller treats that as a registration failure, is-AC-13).
+ */
+export function resolvePackageBinJs(config, nodeModulesDir, packageName, binName) {
+    const packageDir = join(nodeModulesDir, packageName);
+    const raw = config.readTextFile(join(packageDir, "package.json"));
+    if (raw === null)
+        return null;
+    let parsedJson;
+    try {
+        parsedJson = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    const parsed = PackageJsonBinSchema.safeParse(parsedJson);
+    if (!parsed.success || parsed.data.bin === undefined)
+        return null;
+    const bin = parsed.data.bin;
+    const relEntry = typeof bin === "string" ? bin : bin[binName];
+    if (relEntry === undefined || relEntry.length === 0)
+        return null;
+    const entry = join(packageDir, relEntry);
+    return config.fileExists(entry) ? entry : null;
+}
+/**
+ * Locate `npm/bin/npm-cli.js` relative to `process.execPath` (node ships npm beside its binary),
+ * so we can run `npm prefix -g` before the prefix is known. Falls back to `require.resolve`.
+ */
+export function locateNpmCliJs(config) {
+    const execDir = dirname(config.execPath);
+    const candidates = config.platform === "win32"
+        ? [join(execDir, "node_modules", "npm", "bin", "npm-cli.js")]
+        : [join(dirname(execDir), "lib", "node_modules", "npm", "bin", "npm-cli.js")];
+    for (const candidate of candidates) {
+        if (config.fileExists(candidate))
+            return candidate;
+    }
+    return config.requireResolve("npm/bin/npm-cli.js");
+}
+/**
+ * The default `npm prefix -g` resolver: locate npm-cli.js relative to the node binary and spawn it
+ * argv-safe, returning the trimmed prefix. Returns `null` when npm-cli.js cannot be located or the
+ * command fails. The installer service memoizes this so it runs at most once per daemon session.
+ */
+export async function resolveNpmPrefixViaCli(config) {
+    const npmCli = locateNpmCliJs(config);
+    if (npmCli === null)
+        return null;
+    try {
+        const outcome = await config.spawn(config.execPath, [npmCli, "prefix", "-g"]);
+        if (outcome.code !== 0)
+            return null;
+        const prefix = outcome.stdoutTail.trim();
+        return prefix.length > 0 ? prefix : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=bin-resolver.js.map

package/dist/daemon/installer/bin-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin-resolver.js","sourceRoot":"","sources":["../../../src/daemon/installer/bin-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,iFAAiF;AACjF,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,QAAyB;IAC5E,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;AACnG,CAAC;AAED,2EAA2E;AAC3E,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/E,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAuB,EACvB,cAAsB,EACtB,WAAmB,EACnB,OAAe;IAEf,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;IAClE,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE9B,IAAI,UAAmB,CAAC;IACxB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAElE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;IAC5B,MAAM,QAAQ,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAuB;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,UAAU,GACd,MAAM,CAAC,QAAQ,KAAK,OAAO;QACzB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;IAElF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACrD,CAAC;IACD,OAAO,MAAM,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,MAAuB;IAClE,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9E,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACzC,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/daemon/installer/config.d.ts

@@ -0,0 +1,63 @@
+/**
+ * PRD-009a: the installer service's injectable configuration (its test seams).
+ *
+ * Every side effect the installer performs, the manifest fetch, filesystem reads, the token file,
+ * child-process spawns, npm-prefix resolution, and the clock, is reached through this object, so a
+ * test never hits the network, real npm, or the real filesystem (mirroring how `fleet-status.ts`
+ * takes a `FetchImpl`). Production defaults are assembled by {@link createInstallerConfig}.
+ */
+import { type SpawnFn } from "./spawn.js";
+/** The primary fleet manifest URL served by the install site (MV-2). */
+export declare const MANIFEST_URL: "https://get.theapiary.sh/hive-release.json";
+/**
+ * Second-chance fallback when {@link MANIFEST_URL} is unreachable. The private GitHub raw URL may
+ * 404 without auth; it is tried only after the primary fetch fails, before the bundled snapshot.
+ */
+export declare const MANIFEST_FALLBACK_URL: "https://raw.githubusercontent.com/legioncodeinc/the-apiary/main/hive-release.json";
+/** The bootstrap-minted one-time onboarding token file (mode 0600), read lazily per request (is-AC-9). */
+export declare const ONBOARDING_TOKEN_PATH: string;
+/** The bounded timeout for the single network manifest fetch before falling back to the snapshot. */
+export declare const MANIFEST_TIMEOUT_MS: 5000;
+/** The minimal fetch surface the manifest resolver needs (a mock in tests). */
+export type ManifestFetch = (input: string, init?: {
+    readonly signal?: AbortSignal;
+}) => Promise<Response>;
+/** The full seam set. Every field is overridable; {@link createInstallerConfig} fills the rest. */
+export interface InstallerConfig {
+    /** The primary raw manifest URL fetched once per session (is-AC-4, MV-2). */
+    readonly manifestUrl: string;
+    /** Fallback manifest URL when the primary fetch fails (MV-2). */
+    readonly manifestFallbackUrl: string;
+    /** The manifest fetch implementation (defaults to the global `fetch`). */
+    readonly manifestFetch: ManifestFetch;
+    /** The bounded manifest-fetch timeout in ms. */
+    readonly manifestTimeoutMs: number;
+    /** The onboarding token file path (read lazily, deleted on completion). */
+    readonly tokenPath: string;
+    /** Existence check (a fake map in tests). */
+    readonly fileExists: (path: string) => boolean;
+    /** UTF-8 read returning `null` on any error (a fake map in tests). */
+    readonly readTextFile: (path: string) => string | null;
+    /** Best-effort delete used to invalidate the token (never throws). */
+    readonly deleteFile: (path: string) => void;
+    /** Resolve npm's global prefix (`npm prefix -g`), cached by the service. */
+    readonly resolveNpmPrefix: () => Promise<string | null>;
+    /** The OS platform, deciding global node_modules + bin path shape. */
+    readonly platform: NodeJS.Platform;
+    /** The argv-safe spawn seam (is-AC-6). */
+    readonly spawn: SpawnFn;
+    /** A `require.resolve`-style fallback for locating `npm/bin/npm-cli.js`; `null` when unresolvable. */
+    readonly requireResolve: (specifier: string) => string | null;
+    /** The clock (injected in tests). */
+    readonly now: () => number;
+    /** hive's own running version, the authoritative answer for hive detection. */
+    readonly hiveVersion: string;
+    /** The node executable used as the argv[0] for every spawn (`process.execPath`). */
+    readonly execPath: string;
+}
+/**
+ * Assemble the production {@link InstallerConfig}. `resolveNpmPrefix` is intentionally left to the
+ * service (it needs the other seams and memoizes the result), so it is injected by the service
+ * wiring rather than defaulted here; a test provides its own.
+ */
+export declare function createInstallerConfig(overrides?: Partial<InstallerConfig>): InstallerConfig;

package/dist/daemon/installer/config.js

@@ -0,0 +1,74 @@
+/**
+ * PRD-009a: the installer service's injectable configuration (its test seams).
+ *
+ * Every side effect the installer performs, the manifest fetch, filesystem reads, the token file,
+ * child-process spawns, npm-prefix resolution, and the clock, is reached through this object, so a
+ * test never hits the network, real npm, or the real filesystem (mirroring how `fleet-status.ts`
+ * takes a `FetchImpl`). Production defaults are assembled by {@link createInstallerConfig}.
+ */
+import { createRequire } from "node:module";
+import { existsSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { platform as osPlatform } from "node:process";
+import { HIVE_VERSION, HONEYCOMB_HOME_DIR } from "../../shared/constants.js";
+import { createNodeSpawn } from "./spawn.js";
+/** The primary fleet manifest URL served by the install site (MV-2). */
+export const MANIFEST_URL = "https://get.theapiary.sh/hive-release.json";
+/**
+ * Second-chance fallback when {@link MANIFEST_URL} is unreachable. The private GitHub raw URL may
+ * 404 without auth; it is tried only after the primary fetch fails, before the bundled snapshot.
+ */
+export const MANIFEST_FALLBACK_URL = "https://raw.githubusercontent.com/legioncodeinc/the-apiary/main/hive-release.json";
+/** The bootstrap-minted one-time onboarding token file (mode 0600), read lazily per request (is-AC-9). */
+export const ONBOARDING_TOKEN_PATH = join(HONEYCOMB_HOME_DIR, "hive", "onboarding-token");
+/** The bounded timeout for the single network manifest fetch before falling back to the snapshot. */
+export const MANIFEST_TIMEOUT_MS = 5000;
+function defaultReadTextFile(path) {
+    try {
+        return existsSync(path) ? readFileSync(path, "utf8") : null;
+    }
+    catch {
+        return null;
+    }
+}
+function defaultDeleteFile(path) {
+    try {
+        rmSync(path, { force: true });
+    }
+    catch {
+        // Best effort: a delete failure still leaves the in-memory invalidation flag set (see token.ts).
+    }
+}
+function defaultRequireResolve(specifier) {
+    try {
+        return createRequire(import.meta.url).resolve(specifier);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Assemble the production {@link InstallerConfig}. `resolveNpmPrefix` is intentionally left to the
+ * service (it needs the other seams and memoizes the result), so it is injected by the service
+ * wiring rather than defaulted here; a test provides its own.
+ */
+export function createInstallerConfig(overrides = {}) {
+    return {
+        manifestUrl: overrides.manifestUrl ?? MANIFEST_URL,
+        manifestFallbackUrl: overrides.manifestFallbackUrl ?? MANIFEST_FALLBACK_URL,
+        manifestFetch: overrides.manifestFetch ?? ((input, init) => fetch(input, init)),
+        manifestTimeoutMs: overrides.manifestTimeoutMs ?? MANIFEST_TIMEOUT_MS,
+        tokenPath: overrides.tokenPath ?? ONBOARDING_TOKEN_PATH,
+        fileExists: overrides.fileExists ?? ((path) => existsSync(path)),
+        readTextFile: overrides.readTextFile ?? defaultReadTextFile,
+        deleteFile: overrides.deleteFile ?? defaultDeleteFile,
+        resolveNpmPrefix: overrides.resolveNpmPrefix ?? (async () => null),
+        platform: overrides.platform ?? osPlatform,
+        spawn: overrides.spawn ?? createNodeSpawn(),
+        requireResolve: overrides.requireResolve ?? defaultRequireResolve,
+        now: overrides.now ?? Date.now,
+        hiveVersion: overrides.hiveVersion ?? HIVE_VERSION,
+        execPath: overrides.execPath ?? process.execPath
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/daemon/installer/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/daemon/installer/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAgB,MAAM,YAAY,CAAC;AAE3D,wEAAwE;AACxE,MAAM,CAAC,MAAM,YAAY,GAAG,4CAAqD,CAAC;AAElF;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAChC,mFAA4F,CAAC;AAE/F,0GAA0G;AAC1G,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;AAE1F,qGAAqG;AACrG,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAa,CAAC;AAuCjD,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,iGAAiG;IACnG,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,SAAiB;IAC9C,IAAI,CAAC;QACH,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAsC,EAAE;IAC5E,OAAO;QACL,WAAW,EAAE,SAAS,CAAC,WAAW,IAAI,YAAY;QAClD,mBAAmB,EAAE,SAAS,CAAC,mBAAmB,IAAI,qBAAqB;QAC3E,aAAa,EAAE,SAAS,CAAC,aAAa,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC/E,iBAAiB,EAAE,SAAS,CAAC,iBAAiB,IAAI,mBAAmB;QACrE,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,qBAAqB;QACvD,UAAU,EAAE,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAChE,YAAY,EAAE,SAAS,CAAC,YAAY,IAAI,mBAAmB;QAC3D,UAAU,EAAE,SAAS,CAAC,UAAU,IAAI,iBAAiB;QACrD,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC;QAClE,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,UAAU;QAC1C,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,eAAe,EAAE;QAC3C,cAAc,EAAE,SAAS,CAAC,cAAc,IAAI,qBAAqB;QACjE,GAAG,EAAE,SAAS,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG;QAC9B,WAAW,EAAE,SAAS,CAAC,WAAW,IAAI,YAAY;QAClD,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ;KACjD,CAAC;AACJ,CAAC"}

package/dist/daemon/installer/detection.d.ts

@@ -0,0 +1,20 @@
+/**
+ * PRD-009a: fleet detection from LOCAL evidence, without requiring doctor (is-AC-1/2).
+ *
+ * fleet-status alone cannot answer "is doctor installed" pre-doctor (it depends on doctor's status
+ * page being reachable), so detection derives each product's state from local evidence only:
+ *   1. in-memory install state (an in-progress or failed install the daemon is tracking), then
+ *   2. the presence + version of the package under the global node_modules directory.
+ * hive is always installed (it is the daemon answering this request), reported at its own version.
+ * Nothing here is taken from the request.
+ */
+import type { DetectResponse, ProductSlug } from "../../shared/onboarding-types.js";
+import type { InstallerConfig } from "./config.js";
+import type { InstallStateStore } from "./install-state.js";
+/**
+ * The installed version of a single product from the global node_modules, or `undefined` when it is
+ * not installed. Used by the install endpoint's pinned-version short-circuit (is-AC-15).
+ */
+export declare function installedVersion(config: InstallerConfig, slug: ProductSlug): Promise<string | undefined>;
+/** Produce the full per-product detection map (is-AC-1/2). */
+export declare function detectFleet(config: InstallerConfig, store: InstallStateStore): Promise<DetectResponse>;

package/dist/daemon/installer/detection.js

@@ -0,0 +1,73 @@
+/**
+ * PRD-009a: fleet detection from LOCAL evidence, without requiring doctor (is-AC-1/2).
+ *
+ * fleet-status alone cannot answer "is doctor installed" pre-doctor (it depends on doctor's status
+ * page being reachable), so detection derives each product's state from local evidence only:
+ *   1. in-memory install state (an in-progress or failed install the daemon is tracking), then
+ *   2. the presence + version of the package under the global node_modules directory.
+ * hive is always installed (it is the daemon answering this request), reported at its own version.
+ * Nothing here is taken from the request.
+ */
+import { z } from "zod";
+import { globalNodeModulesDir } from "./bin-resolver.js";
+import { PRODUCT_PACKAGES, PRODUCT_SLUGS } from "./products.js";
+import { isInstallableProduct } from "./products.js";
+import { join } from "node:path";
+const InstalledPackageSchema = z.object({ version: z.string().optional() });
+/** Read the installed version of `packageName` from its global node_modules package.json, if present. */
+function readInstalledVersion(config, nodeModulesDir, packageName) {
+    const raw = config.readTextFile(join(nodeModulesDir, packageName, "package.json"));
+    if (raw === null)
+        return undefined;
+    try {
+        const parsed = InstalledPackageSchema.safeParse(JSON.parse(raw));
+        return parsed.success ? parsed.data.version : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function detectFromBinEvidence(config, nodeModulesDir, slug) {
+    if (nodeModulesDir === null)
+        return { state: "not_installed" };
+    const version = readInstalledVersion(config, nodeModulesDir, PRODUCT_PACKAGES[slug]);
+    return version === undefined ? { state: "not_installed" } : { state: "installed", version };
+}
+function detectProduct(config, store, nodeModulesDir, slug) {
+    // hive is the running daemon: authoritative, and never a portal install target.
+    if (slug === "hive")
+        return { state: "installed", version: config.hiveVersion };
+    // An in-flight or failed install the daemon is actively tracking wins over on-disk evidence.
+    if (isInstallableProduct(slug)) {
+        const snapshot = store.detectState(slug);
+        if (snapshot.status === "in_progress")
+            return { state: "install_in_progress" };
+        if (snapshot.status === "failed") {
+            return snapshot.error === undefined
+                ? { state: "install_failed" }
+                : { state: "install_failed", error: snapshot.error };
+        }
+    }
+    return detectFromBinEvidence(config, nodeModulesDir, slug);
+}
+/**
+ * The installed version of a single product from the global node_modules, or `undefined` when it is
+ * not installed. Used by the install endpoint's pinned-version short-circuit (is-AC-15).
+ */
+export async function installedVersion(config, slug) {
+    const prefix = await config.resolveNpmPrefix();
+    if (prefix === null)
+        return undefined;
+    return readInstalledVersion(config, globalNodeModulesDir(prefix, config.platform), PRODUCT_PACKAGES[slug]);
+}
+/** Produce the full per-product detection map (is-AC-1/2). */
+export async function detectFleet(config, store) {
+    const prefix = await config.resolveNpmPrefix();
+    const nodeModulesDir = prefix === null ? null : globalNodeModulesDir(prefix, config.platform);
+    const products = {};
+    for (const slug of PRODUCT_SLUGS) {
+        products[slug] = detectProduct(config, store, nodeModulesDir, slug);
+    }
+    return { products };
+}
+//# sourceMappingURL=detection.js.map

package/dist/daemon/installer/detection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detection.js","sourceRoot":"","sources":["../../../src/daemon/installer/detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAE5E,yGAAyG;AACzG,SAAS,oBAAoB,CAAC,MAAuB,EAAE,cAAsB,EAAE,WAAmB;IAChG,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;IACnF,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACjE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAAuB,EACvB,cAA6B,EAC7B,IAAiB;IAEjB,IAAI,cAAc,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IAC/D,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IACrF,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AAC9F,CAAC;AAED,SAAS,aAAa,CACpB,MAAuB,EACvB,KAAwB,EACxB,cAA6B,EAC7B,IAAiB;IAEjB,gFAAgF;IAChF,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;IAEhF,6FAA6F;IAC7F,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,aAAa;YAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC/E,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC,KAAK,KAAK,SAAS;gBACjC,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE;gBAC7B,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;QACzD,CAAC;IACH,CAAC;IAED,OAAO,qBAAqB,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAuB,EAAE,IAAiB;IAC/E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,gBAAgB,EAAE,CAAC;IAC/C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACtC,OAAO,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAuB,EAAE,KAAwB;IACjF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,gBAAgB,EAAE,CAAC;IAC/C,MAAM,cAAc,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE9F,MAAM,QAAQ,GAAG,EAA2C,CAAC;IAC7D,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC"}

package/dist/daemon/installer/funnel-telemetry.d.ts

@@ -0,0 +1,54 @@
+/**
+ * PRD-009c: daemon-side onboarding funnel emission.
+ *
+ * Every funnel byte leaves through {@link emitTelemetry} in `src/telemetry/emit.ts`. UI-originated
+ * milestones arrive via the token-gated event route; install and auth milestones are observed from
+ * daemon state transitions. Session-scoped dedupe lives in `onboarding-session-ledger.ts`.
+ */
+import { z } from "zod";
+import type { InstallableProduct, InstallStage } from "../../shared/onboarding-types.js";
+import { type EmitDeps } from "../../telemetry/emit.js";
+import type { InstallerConfig } from "./config.js";
+/** UI-reported funnel events validated at the event route (tm-AC-1). */
+export declare const UI_FUNNEL_EVENTS: readonly ["onboarding_started", "mode_selected", "login_shown", "dashboard_reached"];
+export type UiFunnelEvent = (typeof UI_FUNNEL_EVENTS)[number];
+/** Closed zod schema for `POST /api/onboarding/event` bodies. */
+export declare const OnboardingEventBodySchema: z.ZodUnion<readonly [z.ZodObject<{
+    event: z.ZodLiteral<"mode_selected">;
+    properties: z.ZodObject<{
+        mode: z.ZodEnum<{
+            standard: "standard";
+            advanced: "advanced";
+        }>;
+    }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    event: z.ZodEnum<{
+        onboarding_started: "onboarding_started";
+        login_shown: "login_shown";
+        dashboard_reached: "dashboard_reached";
+    }>;
+    properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>]>;
+export type ParsedOnboardingEvent = z.infer<typeof OnboardingEventBodySchema>;
+export interface FunnelTelemetryDeps {
+    readonly config: InstallerConfig;
+    readonly emitDeps?: EmitDeps;
+    readonly stateDir?: string;
+    readonly clock?: () => string;
+}
+/** The funnel emitter wired into installer routes and the install state machine. */
+export interface FunnelTelemetry {
+    /** Handle a validated UI event body from the event route. */
+    recordUiEvent(body: ParsedOnboardingEvent): void;
+    /** Emit when a new install begins (not attach, not short-circuit). */
+    recordProductInstallStarted(product: InstallableProduct): void;
+    /** Emit when an install reaches the completed stage. */
+    recordProductInstallCompleted(product: InstallableProduct): void;
+    /** Emit when an install fails at a closed stage. */
+    recordProductInstallFailed(product: InstallableProduct, stage: InstallStage): void;
+    /** Observe fleet readiness; emits `health_check_passed` once when ready becomes true. */
+    observeHealthReady(ready: boolean): void;
+    /** Observe auth; emits `login_completed` once when authenticated flips true (tm-AC-1). */
+    observeAuthenticated(authenticated: boolean): void;
+}
+export declare function createFunnelTelemetry(deps: FunnelTelemetryDeps): FunnelTelemetry;