@legioncodeinc/hive 0.3.1 → 0.5.0

package/dist/service/templates.d.ts

@@ -2,9 +2,28 @@ import { type ServicePlan } from "./platform.js";
 export declare const HIVE_START_COMMAND: "start";
 export declare const RESTART_SEC: 5;
 export declare const WINDOWS_RESTART_INTERVAL: "PT1M";
+/**
+ * rr-AC-10 / 010a implementation note: when the root resolved at render time differs from the
+ * default `<home>/.apiary` (an `APIARY_HOME` or Linux XDG override is active), the installer must
+ * pin `APIARY_HOME=<resolved root>` into the rendered unit so the manager-started daemon resolves
+ * the SAME root the unit's embedded paths were rendered with. Returns `null` for default installs
+ * (no pin rendered, no behavior change).
+ */
+export declare function apiaryHomePin(plan: ServicePlan, env: NodeJS.ProcessEnv): string | null;
 export declare function quoteSystemdToken(value: string): string;
 export declare function escapeXml(value: string): string;
-export declare function renderLaunchdPlist(plan: ServicePlan): string;
-export declare function renderSystemdUnit(plan: ServicePlan): string;
+export declare function renderLaunchdPlist(plan: ServicePlan, env?: NodeJS.ProcessEnv): string;
+export declare function renderSystemdUnit(plan: ServicePlan, env?: NodeJS.ProcessEnv): string;
+/**
+ * rr-AC-10 Windows caveat (documented limitation): the Task Scheduler task XML has no environment
+ * block, so an active `APIARY_HOME` override CANNOT be pinned into the task the way launchd
+ * (`EnvironmentVariables`) and systemd (`Environment=`) pin it. Wrapping the action in a shell to
+ * inject env is deliberately NOT done: the Arguments string is attacker-adjacent install input and
+ * must stay free of shell interpolation (the existing escapeXml metacharacter guard is the whole
+ * defense). Consequence: a Windows override install renders staged/unit paths under the override
+ * root at render time, but the task-started daemon resolves the default root unless the operator
+ * sets APIARY_HOME machine-wide (setx / system properties). Recorded in PRD-010a implementation
+ * notes; hive's Windows service is per-user InteractiveToken only, so no LocalSystem edge exists.
+ */
 export declare function renderScheduledTaskXml(plan: ServicePlan): string;
-export declare function renderUnit(plan: ServicePlan): string;
+export declare function renderUnit(plan: ServicePlan, env?: NodeJS.ProcessEnv): string;

package/dist/service/templates.js

@@ -1,7 +1,20 @@
+import { join } from "node:path";
 import { WINDOWS_TASK_NAME } from "./platform.js";
+import { resolveFleetRoot, resolveLaunchdLogPaths } from "../shared/apiary-root.js";
 export const HIVE_START_COMMAND = "start";
 export const RESTART_SEC = 5;
 export const WINDOWS_RESTART_INTERVAL = "PT1M";
+/**
+ * rr-AC-10 / 010a implementation note: when the root resolved at render time differs from the
+ * default `<home>/.apiary` (an `APIARY_HOME` or Linux XDG override is active), the installer must
+ * pin `APIARY_HOME=<resolved root>` into the rendered unit so the manager-started daemon resolves
+ * the SAME root the unit's embedded paths were rendered with. Returns `null` for default installs
+ * (no pin rendered, no behavior change).
+ */
+export function apiaryHomePin(plan, env) {
+    const resolved = resolveFleetRoot({ home: plan.home, env });
+    return resolved === join(plan.home, ".apiary") ? null : resolved;
+}
 export function quoteSystemdToken(value) {
     return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
 }
@@ -13,16 +26,27 @@ export function escapeXml(value) {
         .replaceAll('"', "&quot;")
         .replaceAll("'", "&apos;");
 }
-export function renderLaunchdPlist(plan) {
+export function renderLaunchdPlist(plan, env = process.env) {
     const node = escapeXml(process.execPath);
     const exec = escapeXml(plan.execPath);
-    const home = escapeXml(plan.home);
     const label = escapeXml(plan.label);
+    const logs = resolveLaunchdLogPaths({ home: plan.home, env });
+    const stdoutPath = escapeXml(logs.out);
+    const stderrPath = escapeXml(logs.err);
+    const pin = apiaryHomePin(plan, env);
+    const environmentBlock = pin === null
+        ? ""
+        : `	<key>EnvironmentVariables</key>
+	<dict>
+		<key>APIARY_HOME</key>
+		<string>${escapeXml(pin)}</string>
+	</dict>
+`;
     return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<key>Label</key>
+${environmentBlock}	<key>Label</key>
 	<string>${label}</string>
 	<key>ProgramArguments</key>
 	<array>
@@ -39,22 +63,24 @@ export function renderLaunchdPlist(plan) {
 	<key>ProcessType</key>
 	<string>Background</string>
 	<key>StandardOutPath</key>
-	<string>${home}/.honeycomb/hive/launchd.out.log</string>
+	<string>${stdoutPath}</string>
 	<key>StandardErrorPath</key>
-	<string>${home}/.honeycomb/hive/launchd.err.log</string>
+	<string>${stderrPath}</string>
 </dict>
 </plist>
 `;
 }
-export function renderSystemdUnit(plan) {
+export function renderSystemdUnit(plan, env = process.env) {
     const execStart = `${quoteSystemdToken(process.execPath)} ${quoteSystemdToken(plan.execPath)} ${HIVE_START_COMMAND}`;
+    const pin = apiaryHomePin(plan, env);
+    const environmentLine = pin === null ? "" : `Environment=${quoteSystemdToken(`APIARY_HOME=${pin}`)}\n`;
     return `[Unit]
 Description=hive portal daemon
 After=network.target
 
 [Service]
 Type=simple
-ExecStart=${execStart}
+${environmentLine}ExecStart=${execStart}
 Restart=always
 RestartSec=${RESTART_SEC}
 StartLimitIntervalSec=0
@@ -63,6 +89,17 @@ StartLimitIntervalSec=0
 WantedBy=default.target
 `;
 }
+/**
+ * rr-AC-10 Windows caveat (documented limitation): the Task Scheduler task XML has no environment
+ * block, so an active `APIARY_HOME` override CANNOT be pinned into the task the way launchd
+ * (`EnvironmentVariables`) and systemd (`Environment=`) pin it. Wrapping the action in a shell to
+ * inject env is deliberately NOT done: the Arguments string is attacker-adjacent install input and
+ * must stay free of shell interpolation (the existing escapeXml metacharacter guard is the whole
+ * defense). Consequence: a Windows override install renders staged/unit paths under the override
+ * root at render time, but the task-started daemon resolves the default root unless the operator
+ * sets APIARY_HOME machine-wide (setx / system properties). Recorded in PRD-010a implementation
+ * notes; hive's Windows service is per-user InteractiveToken only, so no LocalSystem edge exists.
+ */
 export function renderScheduledTaskXml(plan) {
     const node = escapeXml(process.execPath);
     const exec = escapeXml(plan.execPath);
@@ -107,12 +144,12 @@ export function renderScheduledTaskXml(plan) {
 </Task>
 `;
 }
-export function renderUnit(plan) {
+export function renderUnit(plan, env = process.env) {
     switch (plan.manager) {
         case "launchd":
-            return renderLaunchdPlist(plan);
+            return renderLaunchdPlist(plan, env);
         case "systemd":
-            return renderSystemdUnit(plan);
+            return renderSystemdUnit(plan, env);
         case "schtasks":
             return renderScheduledTaskXml(plan);
     }

package/dist/service/templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../src/service/templates.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAoB,MAAM,eAAe,CAAC;AAEpE,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAgB,CAAC;AACnD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAU,CAAC;AACtC,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAe,CAAC;AAExD,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAiB;IAClD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO;;;;;WAKE,KAAK;;;YAGJ,IAAI;YACJ,IAAI;YACJ,kBAAkB;;;;;;;YAOlB,WAAW;;;;WAIZ,IAAI;;WAEJ,IAAI;;;CAGd,CAAC;AACF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAiB;IACjD,MAAM,SAAS,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACrH,OAAO;;;;;;YAMG,SAAS;;aAER,WAAW;;;;;CAKvB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAiB;IACtD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO;;;;aAII,SAAS,CAAC,iBAAiB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;kBAwBvB,wBAAwB;;;;;;iBAMzB,IAAI;oBACD,IAAI,KAAK,kBAAkB;;;;CAI9C,CAAC;AACF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAiB;IAC1C,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAClC,KAAK,SAAS;YACZ,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACjC,KAAK,UAAU;YACb,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;AACH,CAAC"}
+{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../src/service/templates.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAEpF,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAgB,CAAC;AACnD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAU,CAAC;AACtC,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAe,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAiB,EAAE,GAAsB;IACrE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,OAAO,QAAQ,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAiB,EAAE,MAAyB,OAAO,CAAC,GAAG;IACxF,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,sBAAsB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,gBAAgB,GACpB,GAAG,KAAK,IAAI;QACV,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;;;YAGI,SAAS,CAAC,GAAG,CAAC;;CAEzB,CAAC;IACA,OAAO;;;;EAIP,gBAAgB;WACP,KAAK;;;YAGJ,IAAI;YACJ,IAAI;YACJ,kBAAkB;;;;;;;YAOlB,WAAW;;;;WAIZ,UAAU;;WAEV,UAAU;;;CAGpB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAiB,EAAE,MAAyB,OAAO,CAAC,GAAG;IACvF,MAAM,SAAS,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACrH,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,eAAe,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,iBAAiB,CAAC,eAAe,GAAG,EAAE,CAAC,IAAI,CAAC;IACvG,OAAO;;;;;;EAMP,eAAe,aAAa,SAAS;;aAE1B,WAAW;;;;;CAKvB,CAAC;AACF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAiB;IACtD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO;;;;aAII,SAAS,CAAC,iBAAiB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;kBAwBvB,wBAAwB;;;;;;iBAMzB,IAAI;oBACD,IAAI,KAAK,kBAAkB;;;;CAI9C,CAAC;AACF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAiB,EAAE,MAAyB,OAAO,CAAC,GAAG;IAChF,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvC,KAAK,SAAS;YACZ,OAAO,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtC,KAAK,UAAU;YACb,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;AACH,CAAC"}

package/dist/shared/apiary-root.d.ts

@@ -0,0 +1,28 @@
+/** Injectable seams for fleet-root resolution (hermetic tests mirror production env). */
+export interface FleetRootDeps {
+    readonly env?: NodeJS.ProcessEnv;
+    readonly platform?: NodeJS.Platform;
+    readonly home?: string;
+}
+/**
+ * Canonical fleet root chain (ADR-0005 / superproject ADR-0003 "Resolved decisions"):
+ * APIARY_HOME > Linux XDG_STATE_HOME/apiary (only when XDG is explicitly set) > <home>/.apiary.
+ * Anchored on `home` (default `os.homedir()`); never reads `process.cwd()`.
+ */
+export declare function resolveFleetRoot(deps?: FleetRootDeps): string;
+/** Per-product hive state directory: `<fleetRoot>/hive`. */
+export declare function resolveHiveStateDir(deps?: FleetRootDeps): string;
+/** Doctor-owned cross-daemon registry at the fleet root. */
+export declare function resolveFleetRegistryPath(deps?: FleetRootDeps): string;
+/** Fleet-root shared install id (doctor/installer-managed; hive read-only). */
+export declare function resolveSharedInstallIdPath(deps?: FleetRootDeps): string;
+export declare function resolveHivePidPath(deps?: FleetRootDeps): string;
+export declare function resolveHiveLockPath(deps?: FleetRootDeps): string;
+export declare function resolveOnboardingTokenPath(deps?: FleetRootDeps): string;
+export declare function resolveStagedWindowsTaskPath(deps?: FleetRootDeps): string;
+export declare function resolveLaunchdLogPaths(deps?: FleetRootDeps): {
+    readonly out: string;
+    readonly err: string;
+};
+/** Absolute pidPath written into hive's registry entry (ADR Resolved decision 4). */
+export declare function resolveHiveRegistryPidPath(deps?: FleetRootDeps): string;

package/dist/shared/apiary-root.js

@@ -0,0 +1,71 @@
+import { homedir, platform } from "node:os";
+import { join, win32 } from "node:path";
+function envStr(env, key) {
+    const raw = env[key];
+    if (raw === undefined)
+        return undefined;
+    const trimmed = raw.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+/**
+ * Canonical fleet root chain (ADR-0005 / superproject ADR-0003 "Resolved decisions"):
+ * APIARY_HOME > Linux XDG_STATE_HOME/apiary (only when XDG is explicitly set) > <home>/.apiary.
+ * Anchored on `home` (default `os.homedir()`); never reads `process.cwd()`.
+ */
+export function resolveFleetRoot(deps = {}) {
+    const env = deps.env ?? process.env;
+    const home = deps.home ?? homedir();
+    const plat = deps.platform ?? platform();
+    // Env roots are honored only when ABSOLUTE (fleet security rule, 2026-07-04; the XDG Base
+    // Directory spec also requires ignoring relative values). Honoring a relative value would
+    // anchor the fleet root (and the registry pidPath derived from it) on process.cwd(), which
+    // this resolver must never do. win32.isAbsolute accepts /x, \x, and C:\x, a strict superset
+    // of the posix check, so a relative value is never mistaken for absolute on any host.
+    const apiaryHome = envStr(env, "APIARY_HOME");
+    if (apiaryHome !== undefined && win32.isAbsolute(apiaryHome)) {
+        return apiaryHome;
+    }
+    if (plat === "linux") {
+        const xdgStateHome = envStr(env, "XDG_STATE_HOME");
+        if (xdgStateHome !== undefined && win32.isAbsolute(xdgStateHome)) {
+            return join(xdgStateHome, "apiary");
+        }
+    }
+    return join(home, ".apiary");
+}
+/** Per-product hive state directory: `<fleetRoot>/hive`. */
+export function resolveHiveStateDir(deps = {}) {
+    return join(resolveFleetRoot(deps), "hive");
+}
+/** Doctor-owned cross-daemon registry at the fleet root. */
+export function resolveFleetRegistryPath(deps = {}) {
+    return join(resolveFleetRoot(deps), "registry.json");
+}
+/** Fleet-root shared install id (doctor/installer-managed; hive read-only). */
+export function resolveSharedInstallIdPath(deps = {}) {
+    return join(resolveFleetRoot(deps), "install-id");
+}
+export function resolveHivePidPath(deps = {}) {
+    return join(resolveHiveStateDir(deps), "hive.pid");
+}
+export function resolveHiveLockPath(deps = {}) {
+    return join(resolveHiveStateDir(deps), "hive.lock");
+}
+export function resolveOnboardingTokenPath(deps = {}) {
+    return join(resolveHiveStateDir(deps), "onboarding-token");
+}
+export function resolveStagedWindowsTaskPath(deps = {}) {
+    return join(resolveHiveStateDir(deps), "hive-task.xml");
+}
+export function resolveLaunchdLogPaths(deps = {}) {
+    const stateDir = resolveHiveStateDir(deps);
+    return {
+        out: join(stateDir, "launchd.out.log"),
+        err: join(stateDir, "launchd.err.log")
+    };
+}
+/** Absolute pidPath written into hive's registry entry (ADR Resolved decision 4). */
+export function resolveHiveRegistryPidPath(deps = {}) {
+    return resolveHivePidPath(deps);
+}
+//# sourceMappingURL=apiary-root.js.map

package/dist/shared/apiary-root.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiary-root.js","sourceRoot":"","sources":["../../src/shared/apiary-root.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AASxC,SAAS,MAAM,CAAC,GAAsB,EAAE,GAAW;IACjD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAsB,EAAE;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,EAAE,CAAC;IAEzC,0FAA0F;IAC1F,0FAA0F;IAC1F,2FAA2F;IAC3F,4FAA4F;IAC5F,sFAAsF;IACtF,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC9C,IAAI,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7D,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACnD,IAAI,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACjE,OAAO,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAC/B,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,OAAsB,EAAE;IAC1D,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,wBAAwB,CAAC,OAAsB,EAAE;IAC/D,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC,CAAC;AACvD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,0BAA0B,CAAC,OAAsB,EAAE;IACjE,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAsB,EAAE;IACzD,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAsB,EAAE;IAC1D,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAsB,EAAE;IACjE,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,OAAsB,EAAE;IACnE,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAsB,EAAE;IAC7D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC;QACtC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,0BAA0B,CAAC,OAAsB,EAAE;IACjE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC"}

package/dist/shared/constants.d.ts

@@ -10,6 +10,5 @@ export declare const DOCTOR_STATUS_URL: "http://127.0.0.1:3852/status.json";
  * server-side relay (`daemon/telemetry-proxy.ts`) can never be pointed at an attacker-chosen origin.
  */
 export declare const DOCTOR_EVENTS_URL: "http://127.0.0.1:3852/events";
-export declare const HONEYCOMB_HOME_DIR: string;
 export declare const HIVE_PID_PATH: string;
 export declare const HIVE_LOCK_PATH: string;

package/dist/shared/constants.js

@@ -1,6 +1,5 @@
-import { homedir } from "node:os";
-import { join } from "node:path";
 import packageJson from "../../package.json" with { type: "json" };
+import { resolveHiveLockPath, resolveHivePidPath } from "./apiary-root.js";
 export const HIVE_HOST = "127.0.0.1";
 export const HIVE_PORT = 3853;
 export const HIVE_VERSION = packageJson.version;
@@ -13,7 +12,6 @@ export const DOCTOR_STATUS_URL = "http://127.0.0.1:3852/status.json";
  * server-side relay (`daemon/telemetry-proxy.ts`) can never be pointed at an attacker-chosen origin.
  */
 export const DOCTOR_EVENTS_URL = "http://127.0.0.1:3852/events";
-export const HONEYCOMB_HOME_DIR = join(homedir(), ".honeycomb");
-export const HIVE_PID_PATH = join(HONEYCOMB_HOME_DIR, "hive.pid");
-export const HIVE_LOCK_PATH = join(HONEYCOMB_HOME_DIR, "hive.lock");
+export const HIVE_PID_PATH = resolveHivePidPath();
+export const HIVE_LOCK_PATH = resolveHiveLockPath();
 //# sourceMappingURL=constants.js.map

package/dist/shared/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/shared/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,WAAW,MAAM,oBAAoB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAEnE,MAAM,CAAC,MAAM,SAAS,GAAG,WAAoB,CAAC;AAC9C,MAAM,CAAC,MAAM,SAAS,GAAG,IAAa,CAAC;AACvC,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC;AAEhD,0GAA0G;AAC1G,MAAM,CAAC,MAAM,iBAAiB,GAAG,mCAA4C,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,8BAAuC,CAAC;AAEzE,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;AAChE,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;AAClE,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/shared/constants.ts"],"names":[],"mappings":"AAAA,OAAO,WAAW,MAAM,oBAAoB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,MAAM,CAAC,MAAM,SAAS,GAAG,WAAoB,CAAC;AAC9C,MAAM,CAAC,MAAM,SAAS,GAAG,IAAa,CAAC;AACvC,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC;AAEhD,0GAA0G;AAC1G,MAAM,CAAC,MAAM,iBAAiB,GAAG,mCAA4C,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,8BAAuC,CAAC;AAEzE,MAAM,CAAC,MAAM,aAAa,GAAG,kBAAkB,EAAE,CAAC;AAClD,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,EAAE,CAAC"}

package/dist/shared/legacy-paths.d.ts

@@ -0,0 +1,22 @@
+import type { FleetRootDeps } from "./apiary-root.js";
+/** Legacy shared runtime dir (pre-fleet-root migration). */
+export declare function resolveLegacyHoneycombHomeDir(deps?: FleetRootDeps): string;
+/** Legacy hive state dir under the shared honeycomb runtime dir. */
+export declare function resolveLegacyHiveStateDir(deps?: FleetRootDeps): string;
+/** Legacy pid/lock lived at the honeycomb home root, not inside the hive subdir. */
+export declare function resolveLegacyHivePidPath(deps?: FleetRootDeps): string;
+export declare function resolveLegacyHiveLockPath(deps?: FleetRootDeps): string;
+/** Legacy doctor registry file (write/read fallback during the compatibility window). */
+export declare function resolveLegacyDoctorRegistryPath(deps?: FleetRootDeps): string;
+/** Legacy shared install-id (read fallback during the compatibility window). */
+export declare function resolveLegacySharedInstallIdPath(deps?: FleetRootDeps): string;
+/** Legacy onboarding token path (read fallback until bootstrap mint moves). */
+export declare function resolveLegacyOnboardingTokenPath(deps?: FleetRootDeps): string;
+/** Module-load defaults (production); prefer the resolvers in tests and injectable call sites. */
+export declare const LEGACY_HONEYCOMB_HOME_DIR: string;
+export declare const LEGACY_HIVE_STATE_DIR: string;
+export declare const LEGACY_HIVE_PID_PATH: string;
+export declare const LEGACY_HIVE_LOCK_PATH: string;
+export declare const LEGACY_DOCTOR_REGISTRY_PATH: string;
+export declare const LEGACY_SHARED_INSTALL_ID_PATH: string;
+export declare const LEGACY_ONBOARDING_TOKEN_PATH: string;

package/dist/shared/legacy-paths.js

@@ -0,0 +1,48 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+/**
+ * Legacy-window path constants only. Each site carries the fleet ADR removal criterion:
+ * delete when every supported install path ships the PRD-010 migration
+ * (superproject `library/ledger/EXECUTION_LEDGER-apiary-state-root.md`).
+ *
+ * Do not use these as runtime defaults; resolve current paths through `apiary-root.ts`.
+ */
+function legacyHome(deps = {}) {
+    return deps.home ?? homedir();
+}
+/** Legacy shared runtime dir (pre-fleet-root migration). */
+export function resolveLegacyHoneycombHomeDir(deps = {}) {
+    return join(legacyHome(deps), ".honeycomb");
+}
+/** Legacy hive state dir under the shared honeycomb runtime dir. */
+export function resolveLegacyHiveStateDir(deps = {}) {
+    return join(resolveLegacyHoneycombHomeDir(deps), "hive");
+}
+/** Legacy pid/lock lived at the honeycomb home root, not inside the hive subdir. */
+export function resolveLegacyHivePidPath(deps = {}) {
+    return join(resolveLegacyHoneycombHomeDir(deps), "hive.pid");
+}
+export function resolveLegacyHiveLockPath(deps = {}) {
+    return join(resolveLegacyHoneycombHomeDir(deps), "hive.lock");
+}
+/** Legacy doctor registry file (write/read fallback during the compatibility window). */
+export function resolveLegacyDoctorRegistryPath(deps = {}) {
+    return join(resolveLegacyHoneycombHomeDir(deps), "doctor.daemons.json");
+}
+/** Legacy shared install-id (read fallback during the compatibility window). */
+export function resolveLegacySharedInstallIdPath(deps = {}) {
+    return join(resolveLegacyHoneycombHomeDir(deps), "install-id");
+}
+/** Legacy onboarding token path (read fallback until bootstrap mint moves). */
+export function resolveLegacyOnboardingTokenPath(deps = {}) {
+    return join(resolveLegacyHiveStateDir(deps), "onboarding-token");
+}
+/** Module-load defaults (production); prefer the resolvers in tests and injectable call sites. */
+export const LEGACY_HONEYCOMB_HOME_DIR = resolveLegacyHoneycombHomeDir();
+export const LEGACY_HIVE_STATE_DIR = resolveLegacyHiveStateDir();
+export const LEGACY_HIVE_PID_PATH = resolveLegacyHivePidPath();
+export const LEGACY_HIVE_LOCK_PATH = resolveLegacyHiveLockPath();
+export const LEGACY_DOCTOR_REGISTRY_PATH = resolveLegacyDoctorRegistryPath();
+export const LEGACY_SHARED_INSTALL_ID_PATH = resolveLegacySharedInstallIdPath();
+export const LEGACY_ONBOARDING_TOKEN_PATH = resolveLegacyOnboardingTokenPath();
+//# sourceMappingURL=legacy-paths.js.map

package/dist/shared/legacy-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-paths.js","sourceRoot":"","sources":["../../src/shared/legacy-paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC;;;;;;GAMG;AAEH,SAAS,UAAU,CAAC,OAAsB,EAAE;IAC1C,OAAO,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,6BAA6B,CAAC,OAAsB,EAAE;IACpE,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;AAC9C,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,yBAAyB,CAAC,OAAsB,EAAE;IAChE,OAAO,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,wBAAwB,CAAC,OAAsB,EAAE;IAC/D,OAAO,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAsB,EAAE;IAChE,OAAO,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,CAAC;AAChE,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,+BAA+B,CAAC,OAAsB,EAAE;IACtE,OAAO,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,EAAE,qBAAqB,CAAC,CAAC;AAC1E,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gCAAgC,CAAC,OAAsB,EAAE;IACvE,OAAO,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;AACjE,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,gCAAgC,CAAC,OAAsB,EAAE;IACvE,OAAO,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAC;AACnE,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,yBAAyB,GAAG,6BAA6B,EAAE,CAAC;AACzE,MAAM,CAAC,MAAM,qBAAqB,GAAG,yBAAyB,EAAE,CAAC;AACjE,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAwB,EAAE,CAAC;AAC/D,MAAM,CAAC,MAAM,qBAAqB,GAAG,yBAAyB,EAAE,CAAC;AACjE,MAAM,CAAC,MAAM,2BAA2B,GAAG,+BAA+B,EAAE,CAAC;AAC7E,MAAM,CAAC,MAAM,6BAA6B,GAAG,gCAAgC,EAAE,CAAC;AAChF,MAAM,CAAC,MAAM,4BAA4B,GAAG,gCAAgC,EAAE,CAAC"}

package/dist/shared/registry-paths.d.ts

@@ -0,0 +1,19 @@
+import { resolveFleetRoot, type FleetRootDeps } from "./apiary-root.js";
+/**
+ * Registry compatibility window (ADR-0005 Resolved decision 3):
+ * write `<fleetRoot>/registry.json` when the fleet root directory exists, else legacy path; never both.
+ */
+export declare function resolveRegistryWritePath(deps?: FleetRootDeps): string;
+export interface ReadRegistryBodyOptions extends FleetRootDeps {
+    /** Explicit override for tests (skips the new-then-legacy chain). */
+    readonly registryPath?: string;
+    readonly readFile?: (path: string) => string;
+}
+/**
+ * Read-side fallback chain (rc-AC-4/5/6, mg-AC-10): new path first, then legacy, then absent.
+ * The legacy fallback is ABSENCE-triggered only (ENOENT): a new file that exists but cannot be
+ * read (EACCES, EISDIR, corruption at the fs layer) yields `null` (callers degrade to defaults),
+ * never stale legacy data, because when the new path exists the new file wins.
+ */
+export declare function readRegistryBody(options?: ReadRegistryBodyOptions): string | null;
+export { resolveFleetRoot };

package/dist/shared/registry-paths.js

@@ -0,0 +1,52 @@
+import { existsSync, readFileSync } from "node:fs";
+import { resolveFleetRegistryPath, resolveFleetRoot } from "./apiary-root.js";
+import { resolveLegacyDoctorRegistryPath } from "./legacy-paths.js";
+/**
+ * Registry compatibility window (ADR-0005 Resolved decision 3):
+ * write `<fleetRoot>/registry.json` when the fleet root directory exists, else legacy path; never both.
+ */
+export function resolveRegistryWritePath(deps = {}) {
+    const fleetRoot = resolveFleetRoot(deps);
+    if (existsSync(fleetRoot)) {
+        return resolveFleetRegistryPath(deps);
+    }
+    return resolveLegacyDoctorRegistryPath(deps);
+}
+function isEnoent(error) {
+    return error?.code === "ENOENT";
+}
+/**
+ * Read-side fallback chain (rc-AC-4/5/6, mg-AC-10): new path first, then legacy, then absent.
+ * The legacy fallback is ABSENCE-triggered only (ENOENT): a new file that exists but cannot be
+ * read (EACCES, EISDIR, corruption at the fs layer) yields `null` (callers degrade to defaults),
+ * never stale legacy data, because when the new path exists the new file wins.
+ */
+export function readRegistryBody(options = {}) {
+    const readFile = options.readFile ?? ((path) => readFileSync(path, "utf8"));
+    if (options.registryPath !== undefined) {
+        try {
+            return readFile(options.registryPath);
+        }
+        catch {
+            return null;
+        }
+    }
+    const newPath = resolveFleetRegistryPath(options);
+    try {
+        return readFile(newPath);
+    }
+    catch (error) {
+        // mg-AC-10: a present-but-unreadable new file must NOT surface legacy data.
+        if (!isEnoent(error))
+            return null;
+        // Legacy-window read fallback (new path absent); removal criterion in legacy-paths.ts.
+        try {
+            return readFile(resolveLegacyDoctorRegistryPath(options));
+        }
+        catch {
+            return null;
+        }
+    }
+}
+export { resolveFleetRoot };
+//# sourceMappingURL=registry-paths.js.map

package/dist/shared/registry-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-paths.js","sourceRoot":"","sources":["../../src/shared/registry-paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEnD,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAsB,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AAEpE;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAsB,EAAE;IAC/D,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,+BAA+B,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAQD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAQ,KAAsC,EAAE,IAAI,KAAK,QAAQ,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAmC,EAAE;IACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAE5F,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,OAAO,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4EAA4E;QAC5E,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,uFAAuF;QACvF,IAAI,CAAC;YACH,OAAO,QAAQ,CAAC,+BAA+B,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/shared/state-migration.d.ts

@@ -0,0 +1,13 @@
+import { type FleetRootDeps } from "./apiary-root.js";
+export interface MigrateHiveStateResult {
+    readonly migratedFiles: readonly string[];
+    readonly skippedFiles: readonly string[];
+    readonly errors: readonly string[];
+}
+/**
+ * One-time, idempotent, additive migration of hive-owned state (PRD-010b).
+ * Fail-soft: never throws; legacy originals remain when copy fails (mg-AC-3).
+ */
+export declare function migrateHiveState(deps?: FleetRootDeps): MigrateHiveStateResult;
+/** Best-effort ensure the new hive state dir exists with mode 0o700 (mg-AC-4). */
+export declare function ensureHiveStateDir(deps?: FleetRootDeps): void;

package/dist/shared/state-migration.js

@@ -0,0 +1,92 @@
+import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
+import { resolveHiveStateDir } from "./apiary-root.js";
+import { resolveLegacyHiveStateDir } from "./legacy-paths.js";
+/** Hive-owned state files copied from the legacy state dir (not pid/lock or launchd logs). */
+const MIGRATABLE_STATE_FILENAMES = [
+    "install-id",
+    "telemetry.json",
+    "onboarding-telemetry.json",
+    "hive-task.xml",
+    "onboarding-token"
+];
+function filesEqual(a, b) {
+    return readFileSync(a).equals(readFileSync(b));
+}
+function copyVerified(source, dest) {
+    copyFileSync(source, dest);
+    if (!filesEqual(source, dest)) {
+        rmSync(dest, { force: true });
+        throw new Error(`verify failed after copy: ${dest}`);
+    }
+}
+function migrateOneFile(legacyDir, newDir, filename) {
+    const source = `${legacyDir}/${filename}`;
+    const dest = `${newDir}/${filename}`;
+    if (!existsSync(source))
+        return "absent";
+    if (existsSync(dest))
+        return "skipped";
+    try {
+        copyVerified(source, dest);
+        rmSync(source, { force: true });
+        return "migrated";
+    }
+    catch {
+        return "error";
+    }
+}
+/**
+ * One-time, idempotent, additive migration of hive-owned state (PRD-010b).
+ * Fail-soft: never throws; legacy originals remain when copy fails (mg-AC-3).
+ */
+export function migrateHiveState(deps = {}) {
+    const newDir = resolveHiveStateDir(deps);
+    const legacyDir = resolveLegacyHiveStateDir(deps);
+    const migratedFiles = [];
+    const skippedFiles = [];
+    const errors = [];
+    const legacyStatePresent = existsSync(legacyDir);
+    if (!legacyStatePresent) {
+        try {
+            mkdirSync(newDir, { recursive: true, mode: 0o700 });
+        }
+        catch {
+            // Best effort; lock acquisition will retry mkdir.
+        }
+        return { migratedFiles, skippedFiles, errors };
+    }
+    try {
+        mkdirSync(newDir, { recursive: true, mode: 0o700 });
+    }
+    catch (error) {
+        errors.push(error instanceof Error ? error.message : "mkdir failed");
+        return { migratedFiles, skippedFiles, errors };
+    }
+    for (const filename of MIGRATABLE_STATE_FILENAMES) {
+        const outcome = migrateOneFile(legacyDir, newDir, filename);
+        switch (outcome) {
+            case "migrated":
+                migratedFiles.push(filename);
+                break;
+            case "skipped":
+                skippedFiles.push(filename);
+                break;
+            case "error":
+                errors.push(filename);
+                break;
+            case "absent":
+                break;
+        }
+    }
+    return { migratedFiles, skippedFiles, errors };
+}
+/** Best-effort ensure the new hive state dir exists with mode 0o700 (mg-AC-4). */
+export function ensureHiveStateDir(deps = {}) {
+    try {
+        mkdirSync(resolveHiveStateDir(deps), { recursive: true, mode: 0o700 });
+    }
+    catch {
+        // Fail-soft; callers that require the dir will surface errors later.
+    }
+}
+//# sourceMappingURL=state-migration.js.map

package/dist/shared/state-migration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-migration.js","sourceRoot":"","sources":["../../src/shared/state-migration.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,UAAU,EACV,SAAS,EACT,YAAY,EACZ,MAAM,EAEP,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,mBAAmB,EAAsB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAE9D,8FAA8F;AAC9F,MAAM,0BAA0B,GAAG;IACjC,YAAY;IACZ,gBAAgB;IAChB,2BAA2B;IAC3B,eAAe;IACf,kBAAkB;CACV,CAAC;AAQX,SAAS,UAAU,CAAC,CAAS,EAAE,CAAS;IACtC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,IAAY;IAChD,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,SAAiB,EACjB,MAAc,EACd,QAAgB;IAEhB,MAAM,MAAM,GAAG,GAAG,SAAS,IAAI,QAAQ,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzC,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,IAAI,CAAC;QACH,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,OAAO,UAAU,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAsB,EAAE;IACvD,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,MAAM,kBAAkB,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;QACD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,CAAC;QACH,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QACrE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,0BAA0B,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC5D,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,UAAU;gBACb,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC7B,MAAM;YACR,KAAK,SAAS;gBACZ,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC5B,MAAM;YACR,KAAK,OAAO;gBACV,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACtB,MAAM;YACR,KAAK,QAAQ;gBACX,MAAM;QACV,CAAC;IACH,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;AACjD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,kBAAkB,CAAC,OAAsB,EAAE;IACzD,IAAI,CAAC;QACH,SAAS,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;IACvE,CAAC;AACH,CAAC"}