@legioncodeinc/hive 0.4.0 → 0.5.1

package/dist/daemon/gate.d.ts

@@ -1,8 +1,8 @@
 /**
  * The server-side PORTAL LANDING GATE — PRD-003a, implementing ADR-0004's precedence.
  *
- * On landing on ANY non-exempt route hive evaluates ONE ordered precedence, health then auth,
- * before deciding what to serve:
+ * On landing on ANY non-exempt route hive evaluates ONE ordered precedence, health then auth then
+ * tenancy, before deciding what to serve:
  *
  *   1. Fleet not healthy (per the EXISTING `isFleetReady()` projection, `fleet-status.ts`) →
  *      redirect to `/buzzing` (g-AC-3). Checked FIRST: an unhealthy fleet makes every other screen
@@ -10,7 +10,9 @@
  *   2. Else not logged in (the EXISTING proxied honeycomb `/setup/state` `authenticated` bit,
  *      `setup-auth.ts`) → redirect to `/login` (g-AC-4). A fetch failure/timeout reads as "not
  *      logged in" (l-AC-6) — never a fail-soft into the dashboard.
- *   3. Else serve the requested route as-is (g-AC-5 / g-AC-6): `next()` falls through to the
+ *   3. Else tenancy unconfirmed (`GET /setup/tenancy` `selected` bit, `setup-tenancy.ts`) →
+ *      redirect to `/onboarding` (PRD-011c tg-AC-1). Fails closed to unconfirmed on any read fault.
+ *   4. Else serve the requested route as-is (g-AC-5 / g-AC-6): `next()` falls through to the
  *      more specific route/catch-all registered after this middleware in `server.ts`.
  *
  * `/buzzing` and `/login` are a FIXED exemption set checked BEFORE the precedence above, so they
@@ -26,13 +28,13 @@
  * same-origin", both depend on the proxy handling its own requests untouched).
  *
  * SECURITY (g-AC-11, open-redirect defense): every redirect this middleware issues targets a
- * FIXED, hard-coded literal (`/buzzing` or `/login`) — never a value derived from user input (no
- * `?next=`, no `Referer`, no request path echoed back). This makes an open redirect structurally
- * impossible here: there is no code path where an attacker-controlled string reaches `c.redirect`.
+ * FIXED, hard-coded literal (`/buzzing`, `/login`, or `/onboarding`), never a value derived from
+ * user input (no `?next=`, no `Referer`, no request path echoed back).
  */
 import type { MiddlewareHandler } from "hono";
 import { type FetchImpl as FleetFetchImpl } from "./fleet-status.js";
 import { type SetupAuthFetchImpl } from "./setup-auth.js";
+import { type SetupTenancyFetchImpl } from "./setup-tenancy.js";
 /** The gate-exempt SCREENS (g-AC-7 / g-AC-8): always served directly, never redirected. */
 export declare const GATE_EXEMPT_ROUTES: readonly ["/buzzing", "/login", "/onboarding"];
 export interface CreatePortalGateOptions {
@@ -42,6 +44,8 @@ export interface CreatePortalGateOptions {
     readonly doctorStatusUrl?: string;
     /** The fetch used for the auth check (defaults to the global `fetch`; a test injects a fake). */
     readonly setupAuthFetch?: SetupAuthFetchImpl;
+    /** The fetch used for the tenancy check (defaults to the global `fetch`; a test injects a fake). */
+    readonly setupTenancyFetch?: SetupTenancyFetchImpl;
     /** Override the doctor registry file path the auth check resolves honeycomb's base from. */
     readonly registryPath?: string;
 }

package/dist/daemon/gate.js

@@ -1,8 +1,8 @@
 /**
  * The server-side PORTAL LANDING GATE — PRD-003a, implementing ADR-0004's precedence.
  *
- * On landing on ANY non-exempt route hive evaluates ONE ordered precedence, health then auth,
- * before deciding what to serve:
+ * On landing on ANY non-exempt route hive evaluates ONE ordered precedence, health then auth then
+ * tenancy, before deciding what to serve:
  *
  *   1. Fleet not healthy (per the EXISTING `isFleetReady()` projection, `fleet-status.ts`) →
  *      redirect to `/buzzing` (g-AC-3). Checked FIRST: an unhealthy fleet makes every other screen
@@ -10,7 +10,9 @@
  *   2. Else not logged in (the EXISTING proxied honeycomb `/setup/state` `authenticated` bit,
  *      `setup-auth.ts`) → redirect to `/login` (g-AC-4). A fetch failure/timeout reads as "not
  *      logged in" (l-AC-6) — never a fail-soft into the dashboard.
- *   3. Else serve the requested route as-is (g-AC-5 / g-AC-6): `next()` falls through to the
+ *   3. Else tenancy unconfirmed (`GET /setup/tenancy` `selected` bit, `setup-tenancy.ts`) →
+ *      redirect to `/onboarding` (PRD-011c tg-AC-1). Fails closed to unconfirmed on any read fault.
+ *   4. Else serve the requested route as-is (g-AC-5 / g-AC-6): `next()` falls through to the
  *      more specific route/catch-all registered after this middleware in `server.ts`.
  *
  * `/buzzing` and `/login` are a FIXED exemption set checked BEFORE the precedence above, so they
@@ -26,14 +28,14 @@
  * same-origin", both depend on the proxy handling its own requests untouched).
  *
  * SECURITY (g-AC-11, open-redirect defense): every redirect this middleware issues targets a
- * FIXED, hard-coded literal (`/buzzing` or `/login`) — never a value derived from user input (no
- * `?next=`, no `Referer`, no request path echoed back). This makes an open redirect structurally
- * impossible here: there is no code path where an attacker-controlled string reaches `c.redirect`.
+ * FIXED, hard-coded literal (`/buzzing`, `/login`, or `/onboarding`), never a value derived from
+ * user input (no `?next=`, no `Referer`, no request path echoed back).
  */
 import { DOCTOR_STATUS_URL } from "../shared/constants.js";
 import { isFleetReady } from "../shared/fleet-readiness.js";
 import { fetchFleetStatus } from "./fleet-status.js";
 import { fetchSetupAuthenticated } from "./setup-auth.js";
+import { fetchTenancySelected } from "./setup-tenancy.js";
 /** The fixed redirect target for an unhealthy fleet (g-AC-3). A hard-coded literal, never derived. */
 const BUZZING_ROUTE = "/buzzing";
 /** The fixed redirect target for a logged-out operator (g-AC-4). A hard-coded literal, never derived. */
@@ -99,6 +101,7 @@ export function createPortalGate(options = {}) {
     const fleetStatusFetch = options.fleetStatusFetch ?? fetch;
     const doctorStatusUrl = options.doctorStatusUrl ?? DOCTOR_STATUS_URL;
     const setupAuthFetch = options.setupAuthFetch ?? fetch;
+    const setupTenancyFetch = options.setupTenancyFetch ?? fetch;
     const registryPath = options.registryPath;
     return async (c, next) => {
         const pathname = new URL(c.req.url).pathname;
@@ -130,8 +133,17 @@ export function createPortalGate(options = {}) {
         if (!authenticated) {
             return c.redirect(LOGIN_ROUTE, 302);
         }
-        // g-AC-5 / g-AC-6 / g-AC-10: healthy + authenticated — serve the requested route as-is (the
-        // SPA shell catch-all defaults `/` to the dashboard; nothing here re-derives a fallback path).
+        // PRD-011c tg-AC-1: tenancy third. Unconfirmed (or any read fault) → `/onboarding` to resume
+        // the tenancy step; never serve the dashboard while `selected` is false.
+        // tg-AC-6 (separate-fetch justification): this is deliberately a SECOND loopback fetch rather
+        // than a coalesced read, because honeycomb does not surface `selected` on `/setup/state`;
+        // the tenancy marker lives only on `GET /setup/tenancy` (the canonical 073c contract). One
+        // additional loopback round trip per gated page navigation is the accepted budget.
+        const tenancySelected = await fetchTenancySelected(setupTenancyFetch, { registryPath, signal: c.req.raw.signal });
+        if (!tenancySelected) {
+            return c.redirect(ONBOARDING_ROUTE, 302);
+        }
+        // g-AC-5 / g-AC-6 / g-AC-10: healthy + authenticated + tenancy confirmed, serve as-is.
         await next();
         return undefined;
     };

package/dist/daemon/gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/daemon/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAoC,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,uBAAuB,EAA2B,MAAM,iBAAiB,CAAC;AAEnF,sGAAsG;AACtG,MAAM,aAAa,GAAG,UAAmB,CAAC;AAE1C,yGAAyG;AACzG,MAAM,WAAW,GAAG,QAAiB,CAAC;AAEtC;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,aAAsB,CAAC;AAEhD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,gBAAgB,CAAU,CAAC;AAE1F;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,EAAE,aAAa,EAAE,+BAA+B,CAAC,CAAC,CAAC;AAE7G;;;;;GAKG;AACH,MAAM,0BAA0B,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,CAAU,CAAC;AAExF;;;;;GAKG;AACH,MAAM,aAAa,GAAG,SAAkB,CAAC;AAEzC,6GAA6G;AAC7G,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,QAAgB,EAAE,MAAc;IACnD,IAAI,QAAQ,KAAK,aAAa;QAAE,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,4FAA4F;AAC5F,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAQ,kBAAwC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACtE,CAAC;AAaD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAmC,EAAE;IACpE,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC3D,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,iBAAiB,CAAC;IACrE,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC;IACvD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAE1C,OAAO,KAAK,EAAE,CAAU,EAAE,IAAyB,EAA4B,EAAE;QAC/E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC7C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE5C,8EAA8E;QAC9E,IAAI,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,EAAE,CAAC;YACb,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,yFAAyF;QACzF,6FAA6F;QAC7F,6FAA6F;QAC7F,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,EAAE,CAAC;YACb,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,wFAAwF;QACxF,yFAAyF;QACzF,wDAAwD;QACxD,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;QAC9E,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;QAED,4FAA4F;QAC5F,gGAAgG;QAChG,4FAA4F;QAC5F,4FAA4F;QAC5F,MAAM,aAAa,GAAG,MAAM,uBAAuB,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAChH,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;QAED,4FAA4F;QAC5F,+FAA+F;QAC/F,MAAM,IAAI,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/daemon/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAoC,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,uBAAuB,EAA2B,MAAM,iBAAiB,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAA8B,MAAM,oBAAoB,CAAC;AAEtF,sGAAsG;AACtG,MAAM,aAAa,GAAG,UAAmB,CAAC;AAE1C,yGAAyG;AACzG,MAAM,WAAW,GAAG,QAAiB,CAAC;AAEtC;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,aAAsB,CAAC;AAEhD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,gBAAgB,CAAU,CAAC;AAE1F;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,EAAE,aAAa,EAAE,+BAA+B,CAAC,CAAC,CAAC;AAE7G;;;;;GAKG;AACH,MAAM,0BAA0B,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,CAAU,CAAC;AAExF;;;;;GAKG;AACH,MAAM,aAAa,GAAG,SAAkB,CAAC;AAEzC,6GAA6G;AAC7G,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,QAAgB,EAAE,MAAc;IACnD,IAAI,QAAQ,KAAK,aAAa;QAAE,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,4FAA4F;AAC5F,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAQ,kBAAwC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACtE,CAAC;AAeD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAmC,EAAE;IACpE,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC3D,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,iBAAiB,CAAC;IACrE,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC;IACvD,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,KAAK,CAAC;IAC7D,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAE1C,OAAO,KAAK,EAAE,CAAU,EAAE,IAAyB,EAA4B,EAAE;QAC/E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC7C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE5C,8EAA8E;QAC9E,IAAI,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,EAAE,CAAC;YACb,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,yFAAyF;QACzF,6FAA6F;QAC7F,6FAA6F;QAC7F,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,EAAE,CAAC;YACb,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,wFAAwF;QACxF,yFAAyF;QACzF,wDAAwD;QACxD,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;QAC9E,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;QAED,4FAA4F;QAC5F,gGAAgG;QAChG,4FAA4F;QAC5F,4FAA4F;QAC5F,MAAM,aAAa,GAAG,MAAM,uBAAuB,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAChH,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;QAED,6FAA6F;QAC7F,yEAAyE;QACzE,8FAA8F;QAC9F,0FAA0F;QAC1F,2FAA2F;QAC3F,mFAAmF;QACnF,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC,iBAAiB,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAClH,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO,CAAC,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC;QAED,uFAAuF;QACvF,MAAM,IAAI,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC"}

package/dist/daemon/installer/funnel-telemetry.d.ts

@@ -9,8 +9,8 @@ import { z } from "zod";
 import type { InstallableProduct, InstallStage } from "../../shared/onboarding-types.js";
 import { type EmitDeps } from "../../telemetry/emit.js";
 import type { InstallerConfig } from "./config.js";
-/** UI-reported funnel events validated at the event route (tm-AC-1). */
-export declare const UI_FUNNEL_EVENTS: readonly ["onboarding_started", "mode_selected", "login_shown", "dashboard_reached"];
+/** UI-reported funnel events validated at the event route (tm-AC-1; PRD-011a ts-AC-13 tenancy set). */
+export declare const UI_FUNNEL_EVENTS: readonly ["onboarding_started", "mode_selected", "login_shown", "tenancy_shown", "tenancy_selected", "workspace_created", "dashboard_reached"];
 export type UiFunnelEvent = (typeof UI_FUNNEL_EVENTS)[number];
 /** Closed zod schema for `POST /api/onboarding/event` bodies. */
 export declare const OnboardingEventBodySchema: z.ZodUnion<readonly [z.ZodObject<{
@@ -21,10 +21,25 @@ export declare const OnboardingEventBodySchema: z.ZodUnion<readonly [z.ZodObject
             advanced: "advanced";
         }>;
     }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    event: z.ZodLiteral<"tenancy_selected">;
+    properties: z.ZodObject<{
+        orgCount: z.ZodEnum<{
+            single: "single";
+            few: "few";
+            many: "many";
+        }>;
+        singleOrgConfirm: z.ZodEnum<{
+            true: "true";
+            false: "false";
+        }>;
+    }, z.core.$strip>;
 }, z.core.$strip>, z.ZodObject<{
     event: z.ZodEnum<{
         onboarding_started: "onboarding_started";
         login_shown: "login_shown";
+        tenancy_shown: "tenancy_shown";
+        workspace_created: "workspace_created";
         dashboard_reached: "dashboard_reached";
     }>;
     properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;

package/dist/daemon/installer/funnel-telemetry.js

@@ -8,23 +8,42 @@
 import { z } from "zod";
 import { emitTelemetry, HIVE_STATE_DIR } from "../../telemetry/emit.js";
 import { isSessionEventReported, loadOnboardingLedger, markSessionEventReported, sessionKeyFromToken } from "../../telemetry/onboarding-session-ledger.js";
-/** UI-reported funnel events validated at the event route (tm-AC-1). */
+/** UI-reported funnel events validated at the event route (tm-AC-1; PRD-011a ts-AC-13 tenancy set). */
 export const UI_FUNNEL_EVENTS = [
     "onboarding_started",
     "mode_selected",
     "login_shown",
+    "tenancy_shown",
+    "tenancy_selected",
+    "workspace_created",
     "dashboard_reached"
 ];
 const ModeSelectedBodySchema = z.object({
     event: z.literal("mode_selected"),
     properties: z.object({ mode: z.enum(["standard", "advanced"]) })
 });
+/**
+ * PRD-011a ts-AC-13: `tenancy_selected` carries ONLY a bucketed org count and the single-org-confirm
+ * flag (both closed enums; never an org/workspace id or name). Mirrors the UI emit in
+ * `src/dashboard/web/onboarding/tenancy-step.tsx`.
+ */
+const TenancySelectedBodySchema = z.object({
+    event: z.literal("tenancy_selected"),
+    properties: z.object({
+        orgCount: z.enum(["single", "few", "many"]),
+        singleOrgConfirm: z.enum(["true", "false"])
+    })
+});
 const SimpleUiEventBodySchema = z.object({
-    event: z.enum(["onboarding_started", "login_shown", "dashboard_reached"]),
+    event: z.enum(["onboarding_started", "login_shown", "tenancy_shown", "workspace_created", "dashboard_reached"]),
     properties: z.record(z.string(), z.string()).optional()
 });
 /** Closed zod schema for `POST /api/onboarding/event` bodies. */
-export const OnboardingEventBodySchema = z.union([ModeSelectedBodySchema, SimpleUiEventBodySchema]);
+export const OnboardingEventBodySchema = z.union([
+    ModeSelectedBodySchema,
+    TenancySelectedBodySchema,
+    SimpleUiEventBodySchema
+]);
 const SESSION_ONCE_SET = new Set([
     "onboarding_started",
     "health_check_passed",
@@ -97,6 +116,18 @@ export function createFunnelTelemetry(deps) {
                 case "login_shown":
                     emit("login_shown");
                     break;
+                case "tenancy_shown":
+                    emit("tenancy_shown");
+                    break;
+                case "tenancy_selected":
+                    emit("tenancy_selected", {
+                        org_count: body.properties.orgCount,
+                        single_org_confirm: body.properties.singleOrgConfirm
+                    });
+                    break;
+                case "workspace_created":
+                    emit("workspace_created");
+                    break;
                 case "dashboard_reached":
                     emit("dashboard_reached", {}, true);
                     break;

package/dist/daemon/installer/funnel-telemetry.js.map

@@ -1 +1 @@
-{"version":3,"file":"funnel-telemetry.js","sourceRoot":"","sources":["../../../src/daemon/installer/funnel-telemetry.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EACL,aAAa,EACb,cAAc,EAMf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EAEpB,MAAM,8CAA8C,CAAC;AAGtD,wEAAwE;AACxE,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,oBAAoB;IACpB,eAAe;IACf,aAAa;IACb,mBAAmB;CACX,CAAC;AAIX,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;CACjE,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC;IACzE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAEH,iEAAiE;AACjE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,sBAAsB,EAAE,uBAAuB,CAAC,CAAC,CAAC;AAIpG,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAmB;IACjD,oBAAoB;IACpB,qBAAqB;IACrB,iBAAiB;IACjB,mBAAmB;CACpB,CAAC,CAAC;AAEH,MAAM,cAAc,GAAkC;IACpD,WAAW;IACX,aAAa;IACb,SAAS;IACT,qBAAqB;CACtB,CAAC;AAEF,SAAS,4BAA4B,CAAC,KAAmB;IACvD,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAQ,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAA4B,CAAC,CAAC,CAAC,IAAI,CAAC;AACtG,CAAC;AAyBD,SAAS,cAAc,CAAC,MAAuB;IAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,aAAa,CAAC,GAAwB;IAC7C,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;QACpB,iEAAiE;IACnE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAyB;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,QAAQ,IAAI,cAAc,CAAC;IAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,GAAW,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACrE,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAE7B,MAAM,IAAI,GAAG,CAAC,KAA4B,EAAE,SAAuB,EAAE,EAAE,aAAa,GAAG,KAAK,EAAQ,EAAE;QACpG,aAAa,CAAC,KAAK,IAAI,EAAE;YACvB,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,aAAa,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBACzC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAyB,CAAC;oBAAE,OAAO;gBAC7D,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;gBAC9C,IAAI,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAyB,CAAC;oBAAE,OAAO;YACpF,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACjE,IACE,OAAO,CAAC,IAAI;gBACZ,aAAa;gBACb,UAAU,KAAK,IAAI;gBACnB,gBAAgB,CAAC,GAAG,CAAC,KAAyB,CAAC,EAC/C,CAAC;gBACD,IAAI,CAAC;oBACH,wBAAwB,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAyB,EAAE,KAAK,CAAC,CAAC;gBACnF,CAAC;gBAAC,MAAM,CAAC;oBACP,uDAAuD;gBACzD,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO;QACL,aAAa,CAAC,IAAI;YAChB,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;gBACnB,KAAK,eAAe;oBAClB,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,IAAkB,EAAE,CAAC,CAAC;oBACpE,MAAM;gBACR,KAAK,oBAAoB;oBACvB,IAAI,CAAC,oBAAoB,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;oBACrC,MAAM;gBACR,KAAK,aAAa;oBAChB,IAAI,CAAC,aAAa,CAAC,CAAC;oBACpB,MAAM;gBACR,KAAK,mBAAmB;oBACtB,IAAI,CAAC,mBAAmB,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;oBACpC,MAAM;gBACR,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,WAAW,GAAU,IAAI,CAAC;oBAChC,KAAK,WAAW,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;QAED,2BAA2B,CAAC,OAAO;YACjC,IAAI,CAAC,yBAAyB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/C,CAAC;QAED,6BAA6B,CAAC,OAAO;YACnC,IAAI,CAAC,2BAA2B,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;QAED,0BAA0B,CAAC,OAAO,EAAE,KAAK;YACvC,MAAM,YAAY,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;YACzD,IAAI,YAAY,KAAK,IAAI;gBAAE,OAAO;YAClC,IAAI,CAAC,wBAAwB,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,kBAAkB,CAAC,KAAK;YACtB,IAAI,CAAC,KAAK;gBAAE,OAAO;YACnB,IAAI,CAAC,qBAAqB,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QAED,oBAAoB,CAAC,aAAa;YAChC,IAAI,CAAC,aAAa,IAAI,gBAAgB;gBAAE,OAAO;YAC/C,gBAAgB,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,iBAAiB,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"funnel-telemetry.js","sourceRoot":"","sources":["../../../src/daemon/installer/funnel-telemetry.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EACL,aAAa,EACb,cAAc,EAMf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EAEpB,MAAM,8CAA8C,CAAC;AAGtD,uGAAuG;AACvG,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,oBAAoB;IACpB,eAAe;IACf,aAAa;IACb,eAAe;IACf,kBAAkB;IAClB,mBAAmB;IACnB,mBAAmB;CACX,CAAC;AAIX,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;CACjE,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3C,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC5C,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;IAC/G,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAEH,iEAAiE;AACjE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC;IAC/C,sBAAsB;IACtB,yBAAyB;IACzB,uBAAuB;CACxB,CAAC,CAAC;AAIH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAmB;IACjD,oBAAoB;IACpB,qBAAqB;IACrB,iBAAiB;IACjB,mBAAmB;CACpB,CAAC,CAAC;AAEH,MAAM,cAAc,GAAkC;IACpD,WAAW;IACX,aAAa;IACb,SAAS;IACT,qBAAqB;CACtB,CAAC;AAEF,SAAS,4BAA4B,CAAC,KAAmB;IACvD,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAQ,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAA4B,CAAC,CAAC,CAAC,IAAI,CAAC;AACtG,CAAC;AAyBD,SAAS,cAAc,CAAC,MAAuB;IAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,aAAa,CAAC,GAAwB;IAC7C,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;QACpB,iEAAiE;IACnE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAyB;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,QAAQ,IAAI,cAAc,CAAC;IAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,GAAW,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACrE,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAE7B,MAAM,IAAI,GAAG,CAAC,KAA4B,EAAE,SAAuB,EAAE,EAAE,aAAa,GAAG,KAAK,EAAQ,EAAE;QACpG,aAAa,CAAC,KAAK,IAAI,EAAE;YACvB,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,aAAa,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBACzC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAyB,CAAC;oBAAE,OAAO;gBAC7D,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;gBAC9C,IAAI,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAyB,CAAC;oBAAE,OAAO;YACpF,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACjE,IACE,OAAO,CAAC,IAAI;gBACZ,aAAa;gBACb,UAAU,KAAK,IAAI;gBACnB,gBAAgB,CAAC,GAAG,CAAC,KAAyB,CAAC,EAC/C,CAAC;gBACD,IAAI,CAAC;oBACH,wBAAwB,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAyB,EAAE,KAAK,CAAC,CAAC;gBACnF,CAAC;gBAAC,MAAM,CAAC;oBACP,uDAAuD;gBACzD,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO;QACL,aAAa,CAAC,IAAI;YAChB,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;gBACnB,KAAK,eAAe;oBAClB,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,IAAkB,EAAE,CAAC,CAAC;oBACpE,MAAM;gBACR,KAAK,oBAAoB;oBACvB,IAAI,CAAC,oBAAoB,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;oBACrC,MAAM;gBACR,KAAK,aAAa;oBAChB,IAAI,CAAC,aAAa,CAAC,CAAC;oBACpB,MAAM;gBACR,KAAK,eAAe;oBAClB,IAAI,CAAC,eAAe,CAAC,CAAC;oBACtB,MAAM;gBACR,KAAK,kBAAkB;oBACrB,IAAI,CAAC,kBAAkB,EAAE;wBACvB,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ;wBACnC,kBAAkB,EAAE,IAAI,CAAC,UAAU,CAAC,gBAAgB;qBACrD,CAAC,CAAC;oBACH,MAAM;gBACR,KAAK,mBAAmB;oBACtB,IAAI,CAAC,mBAAmB,CAAC,CAAC;oBAC1B,MAAM;gBACR,KAAK,mBAAmB;oBACtB,IAAI,CAAC,mBAAmB,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;oBACpC,MAAM;gBACR,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,WAAW,GAAU,IAAI,CAAC;oBAChC,KAAK,WAAW,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;QAED,2BAA2B,CAAC,OAAO;YACjC,IAAI,CAAC,yBAAyB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/C,CAAC;QAED,6BAA6B,CAAC,OAAO;YACnC,IAAI,CAAC,2BAA2B,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;QAED,0BAA0B,CAAC,OAAO,EAAE,KAAK;YACvC,MAAM,YAAY,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;YACzD,IAAI,YAAY,KAAK,IAAI;gBAAE,OAAO;YAClC,IAAI,CAAC,wBAAwB,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,kBAAkB,CAAC,KAAK;YACtB,IAAI,CAAC,KAAK;gBAAE,OAAO;YACnB,IAAI,CAAC,qBAAqB,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QAED,oBAAoB,CAAC,aAAa;YAChC,IAAI,CAAC,aAAa,IAAI,gBAAgB;gBAAE,OAAO;YAC/C,gBAAgB,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,iBAAiB,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/daemon/installer/manifest-snapshot.json

@@ -1,23 +1,23 @@
 {
-    "manifestVersion": "0.2.1",
+    "manifestVersion": "0.5.1",
     "products": {
         "honeycomb": {
-            "version": "0.2.1",
+            "version": "0.4.1",
             "packageName": "@legioncodeinc/honeycomb",
             "published": true
         },
         "doctor": {
-            "version": "0.2.1",
+            "version": "0.3.1",
             "packageName": "@legioncodeinc/doctor",
             "published": true
         },
         "hive": {
-            "version": "0.2.1",
+            "version": "0.5.1",
             "packageName": "@legioncodeinc/hive",
             "published": true
         },
         "nectar": {
-            "version": "0.1.1",
+            "version": "0.2.1",
             "packageName": "@legioncodeinc/nectar",
             "published": true
         }

package/dist/daemon/installer/routes.js

@@ -181,9 +181,13 @@ export function createInstallerService(options = {}) {
             tokenStore.invalidate();
             return c.body(null, 204);
         });
-        // 6) Funnel events (PRD-009c): validate token + closed UI event set, emit through chokepoint.
+        // 6) Funnel events (PRD-009c): closed UI event set, emitted through the chokepoint. Token
+        //    mode is "optional" (PRD-011 N-1): the tokenless gate-redirect resume path (C-1) must
+        //    still be able to record tenancy_shown / tenancy_selected / dashboard_reached, or the
+        //    resume cohort is silently undercounted; a presented token still validates as before.
+        //    This route is telemetry-only (no state change), Host + Origin guarded like the rest.
         app.post("/api/onboarding/event", async (c) => {
-            const rejection = guardInstallerRequest(c, tokenStore, "always");
+            const rejection = guardInstallerRequest(c, tokenStore, "optional");
             if (rejection !== null)
                 return rejection;
             const body = await readJsonBody(c);

package/dist/daemon/installer/routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../src/daemon/installer/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG9D,OAAO,EAAE,uBAAuB,EAA0B,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAwB,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAyB,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAmB,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EAE1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAA2B,MAAM,kBAAkB,CAAC;AACpF,OAAO,EACL,gBAAgB,EAChB,YAAY,EAEb,MAAM,oBAAoB,CAAC;AA0B5B,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE5D,SAAS,SAAS,CAAC,CAAU,EAAE,MAA6B,EAAE,KAAa;IACzE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,CAAU;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,sBAAsB,CAAC,UAAmC,EAAE;IAC1E,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAE5C,6FAA6F;IAC7F,IAAI,aAAa,GAAkC,IAAI,CAAC;IACxD,MAAM,MAAM,GAAoB;QAC9B,GAAG,IAAI;QACP,gBAAgB,EAAE,GAAG,EAAE;YACrB,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3B,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;YACzG,CAAC;YACD,OAAO,aAAa,CAAC;QACvB,CAAC;KACF,CAAC;IAEF,MAAM,MAAM,GAAG,qBAAqB,CAAC;QACnC,MAAM;QACN,QAAQ,EAAE,OAAO,CAAC,cAAc;QAChC,QAAQ,EAAE,OAAO,CAAC,cAAc;KACjC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,uBAAuB,CAAC,MAAM,EAAE;QAC5C,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,2BAA2B,CAAC,OAAO,CAAC;QAC1E,kBAAkB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,6BAA6B,CAAC,OAAO,CAAC;QAC9E,eAAe,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC;KACvF,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAEhD,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC3D,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC;IACvD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,iBAAiB,CAAC;IAErE,MAAM,QAAQ,GAAG,CAAC,GAAS,EAAQ,EAAE;QACnC,gGAAgG;QAChG,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC5C,MAAM,SAAS,GAAG,qBAAqB,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YACzC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,qGAAqG;QACrG,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC9C,MAAM,SAAS,GAAG,qBAAqB,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YAEzC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YAE9D,2FAA2F;YAC3F,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;YACpC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;YAEhF,iGAAiG;YACjG,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,UAAU,CAAC,IAAI,KAAK,aAAa;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;YAC/E,IAAI,UAAU,CAAC,IAAI,KAAK,qBAAqB;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;YAE/F,uFAAuF;YACvF,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAChE,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,IAAI,eAAe,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC9E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;YACtD,CAAC;YAED,iGAAiG;YACjG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;gBACnB,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,6FAA6F;QAC7F,sFAAsF;QACtF,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,CAAC,EAAE,EAAE;YACvD,MAAM,SAAS,GAAG,qBAAqB,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YAEzC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;YAEhF,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAChC,MAAM,MAAM,GAAG,IAAI,cAAc,CAAa;gBAC5C,KAAK,CAAC,UAAU;oBACd,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;oBAClC,IAAI,MAAM,GAAG,KAAK,CAAC;oBACnB,MAAM,UAAU,GAAuB;wBACrC,IAAI,CAAC,KAAK;4BACR,IAAI,MAAM;gCAAE,OAAO;4BACnB,IAAI,CAAC;gCACH,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;4BAC3E,CAAC;4BAAC,MAAM,CAAC;gCACP,MAAM,GAAG,IAAI,CAAC;4BAChB,CAAC;wBACH,CAAC;wBACD,KAAK;4BACH,IAAI,MAAM;gCAAE,OAAO;4BACnB,MAAM,GAAG,IAAI,CAAC;4BACd,IAAI,CAAC;gCACH,UAAU,CAAC,KAAK,EAAE,CAAC;4BACrB,CAAC;4BAAC,MAAM,CAAC;gCACP,0EAA0E;4BAC5E,CAAC;wBACH,CAAC;qBACF,CAAC;oBAEF,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;oBACzD,MAAM,OAAO,GAAG,GAAS,EAAE;wBACzB,WAAW,EAAE,CAAC;wBACd,UAAU,CAAC,KAAK,EAAE,CAAC;oBACrB,CAAC,CAAC;oBACF,mFAAmF;oBACnF,IAAI,MAAM,CAAC,OAAO;wBAAE,OAAO,EAAE,CAAC;;wBACzB,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjE,CAAC;aACF,CAAC,CAAC;YAEH,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE;gBAC1B,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,mBAAmB;oBACnC,eAAe,EAAE,UAAU;oBAC3B,UAAU,EAAE,YAAY;iBACzB;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,4FAA4F;QAC5F,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC5C,MAAM,SAAS,GAAG,qBAAqB,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;YACzE,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,aAAa,GAAG,MAAM,uBAAuB,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAClG,MAAM,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;YAC3C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,+FAA+F;QAC/F,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,CAAC,CAAC,EAAE,EAAE;YACzC,MAAM,SAAS,GAAG,qBAAqB,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YACzC,UAAU,CAAC,UAAU,EAAE,CAAC;YACxB,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,8FAA8F;QAC9F,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC5C,MAAM,SAAS,GAAG,qBAAqB,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YACzC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YAC9D,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,aAAa,GAAG,MAAM,uBAAuB,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAClG,MAAM,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;YAC3C,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACnE,CAAC"}
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../src/daemon/installer/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG9D,OAAO,EAAE,uBAAuB,EAA0B,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAwB,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAyB,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAmB,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EAE1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAA2B,MAAM,kBAAkB,CAAC;AACpF,OAAO,EACL,gBAAgB,EAChB,YAAY,EAEb,MAAM,oBAAoB,CAAC;AA0B5B,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE5D,SAAS,SAAS,CAAC,CAAU,EAAE,MAA6B,EAAE,KAAa;IACzE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,CAAU;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,sBAAsB,CAAC,UAAmC,EAAE;IAC1E,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAE5C,6FAA6F;IAC7F,IAAI,aAAa,GAAkC,IAAI,CAAC;IACxD,MAAM,MAAM,GAAoB;QAC9B,GAAG,IAAI;QACP,gBAAgB,EAAE,GAAG,EAAE;YACrB,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3B,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;YACzG,CAAC;YACD,OAAO,aAAa,CAAC;QACvB,CAAC;KACF,CAAC;IAEF,MAAM,MAAM,GAAG,qBAAqB,CAAC;QACnC,MAAM;QACN,QAAQ,EAAE,OAAO,CAAC,cAAc;QAChC,QAAQ,EAAE,OAAO,CAAC,cAAc;KACjC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,uBAAuB,CAAC,MAAM,EAAE;QAC5C,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,2BAA2B,CAAC,OAAO,CAAC;QAC1E,kBAAkB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,6BAA6B,CAAC,OAAO,CAAC;QAC9E,eAAe,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,0BAA0B,CAAC,OAAO,EAAE,KAAK,CAAC;KACvF,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAEhD,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC3D,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC;IACvD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,iBAAiB,CAAC;IAErE,MAAM,QAAQ,GAAG,CAAC,GAAS,EAAQ,EAAE;QACnC,gGAAgG;QAChG,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC5C,MAAM,SAAS,GAAG,qBAAqB,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YACzC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,qGAAqG;QACrG,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC9C,MAAM,SAAS,GAAG,qBAAqB,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YAEzC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YAE9D,2FAA2F;YAC3F,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;YACpC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;YAEhF,iGAAiG;YACjG,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,UAAU,CAAC,IAAI,KAAK,aAAa;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;YAC/E,IAAI,UAAU,CAAC,IAAI,KAAK,qBAAqB;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;YAE/F,uFAAuF;YACvF,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAChE,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,IAAI,eAAe,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC9E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;YACtD,CAAC;YAED,iGAAiG;YACjG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;gBACnB,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,6FAA6F;QAC7F,sFAAsF;QACtF,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,CAAC,EAAE,EAAE;YACvD,MAAM,SAAS,GAAG,qBAAqB,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YAEzC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;YAEhF,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAChC,MAAM,MAAM,GAAG,IAAI,cAAc,CAAa;gBAC5C,KAAK,CAAC,UAAU;oBACd,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;oBAClC,IAAI,MAAM,GAAG,KAAK,CAAC;oBACnB,MAAM,UAAU,GAAuB;wBACrC,IAAI,CAAC,KAAK;4BACR,IAAI,MAAM;gCAAE,OAAO;4BACnB,IAAI,CAAC;gCACH,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;4BAC3E,CAAC;4BAAC,MAAM,CAAC;gCACP,MAAM,GAAG,IAAI,CAAC;4BAChB,CAAC;wBACH,CAAC;wBACD,KAAK;4BACH,IAAI,MAAM;gCAAE,OAAO;4BACnB,MAAM,GAAG,IAAI,CAAC;4BACd,IAAI,CAAC;gCACH,UAAU,CAAC,KAAK,EAAE,CAAC;4BACrB,CAAC;4BAAC,MAAM,CAAC;gCACP,0EAA0E;4BAC5E,CAAC;wBACH,CAAC;qBACF,CAAC;oBAEF,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;oBACzD,MAAM,OAAO,GAAG,GAAS,EAAE;wBACzB,WAAW,EAAE,CAAC;wBACd,UAAU,CAAC,KAAK,EAAE,CAAC;oBACrB,CAAC,CAAC;oBACF,mFAAmF;oBACnF,IAAI,MAAM,CAAC,OAAO;wBAAE,OAAO,EAAE,CAAC;;wBACzB,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjE,CAAC;aACF,CAAC,CAAC;YAEH,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE;gBAC1B,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,mBAAmB;oBACnC,eAAe,EAAE,UAAU;oBAC3B,UAAU,EAAE,YAAY;iBACzB;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,4FAA4F;QAC5F,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC5C,MAAM,SAAS,GAAG,qBAAqB,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;YACzE,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,aAAa,GAAG,MAAM,uBAAuB,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAClG,MAAM,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;YAC3C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,+FAA+F;QAC/F,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,CAAC,CAAC,EAAE,EAAE;YACzC,MAAM,SAAS,GAAG,qBAAqB,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACjE,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YACzC,UAAU,CAAC,UAAU,EAAE,CAAC;YACxB,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,0FAA0F;QAC1F,0FAA0F;QAC1F,0FAA0F;QAC1F,0FAA0F;QAC1F,0FAA0F;QAC1F,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC5C,MAAM,SAAS,GAAG,qBAAqB,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;YACnE,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YACzC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YAC9D,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,aAAa,GAAG,MAAM,uBAAuB,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAClG,MAAM,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;YAC3C,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACnE,CAAC"}

package/dist/daemon/installer/security.d.ts

@@ -15,8 +15,15 @@ import type { Context } from "hono";
 import type { TokenStore } from "./token.js";
 /** The request header carrying the onboarding token (the SSE path uses the `t` query param instead). */
 export declare const TOKEN_HEADER: "x-onboarding-token";
-/** Whether detection-style read endpoints require the token unconditionally or only while active. */
-export type TokenMode = "always" | "detect";
+/**
+ * Token requirement per endpoint class:
+ * - `always`: a valid token is required unconditionally (state-changing installer endpoints).
+ * - `detect`: required only while an onboarding session is active (the is-AC-10 re-entry carve-out).
+ * - `optional`: a PRESENTED token must be valid, but absence is accepted (PRD-011 N-1: the
+ *   telemetry-only event route, so the tokenless gate-redirect resume cohort is still counted;
+ *   the Host + Origin checks remain the cross-origin defense on this route).
+ */
+export type TokenMode = "always" | "detect" | "optional";
 /** True iff the `Host` header is the portal's own host (is-AC-8). */
 export declare function hostAllowed(host: string | undefined): boolean;
 /**

package/dist/daemon/installer/security.js

@@ -72,6 +72,14 @@ export function guardInstallerRequest(c, tokenStore, tokenMode) {
             return unauthorized();
         return null;
     }
+    // "optional" (PRD-011 N-1): tokenless is accepted (the gate-redirect resume path has no token
+    // by design, ts-AC-12); a token that IS presented must still validate, so token-bearing
+    // behavior is unchanged and a wrong token never passes.
+    if (tokenMode === "optional") {
+        if (provided !== null && !tokenStore.requireValid(provided))
+            return unauthorized();
+        return null;
+    }
     // "detect": token required only while an onboarding session is active (is-AC-10 carve-out).
     if (tokenStore.isActive() && !tokenStore.requireValid(provided))
         return unauthorized();

package/dist/daemon/installer/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/daemon/installer/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAGjE,sFAAsF;AACtF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,SAAS,IAAI,SAAS,EAAE,EAAE,aAAa,SAAS,EAAE,CAAC,CAAC,CAAC;AAE/F,0FAA0F;AAC1F,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS,CAAC,UAAU,SAAS,IAAI,SAAS,EAAE,EAAE,oBAAoB,SAAS,EAAE,CAAC,CAAC,CAAC;AAE/G,wGAAwG;AACxG,MAAM,CAAC,MAAM,YAAY,GAAG,oBAA6B,CAAC;AAK1D,qEAAqE;AACrE,MAAM,UAAU,WAAW,CAAC,IAAwB;IAClD,OAAO,IAAI,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,MAA0B;IACtE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC;IACvE,OAAO,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE;QAC1D,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE;QAC7D,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAU;IAClC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IACzC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,6CAA6C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5F,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,YAAY,CAAC,CAAU;IACrC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAC7D,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAAU,EAAE,UAAsB,EAAE,SAAoB;IAC5F,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,SAAS,EAAE,CAAC;IAC3D,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,SAAS,EAAE,CAAC;IAE7E,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC;YAAE,OAAO,YAAY,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4FAA4F;IAC5F,IAAI,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC;QAAE,OAAO,YAAY,EAAE,CAAC;IACvF,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/daemon/installer/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAGjE,sFAAsF;AACtF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,SAAS,IAAI,SAAS,EAAE,EAAE,aAAa,SAAS,EAAE,CAAC,CAAC,CAAC;AAE/F,0FAA0F;AAC1F,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS,CAAC,UAAU,SAAS,IAAI,SAAS,EAAE,EAAE,oBAAoB,SAAS,EAAE,CAAC,CAAC,CAAC;AAE/G,wGAAwG;AACxG,MAAM,CAAC,MAAM,YAAY,GAAG,oBAA6B,CAAC;AAY1D,qEAAqE;AACrE,MAAM,UAAU,WAAW,CAAC,IAAwB;IAClD,OAAO,IAAI,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,MAA0B;IACtE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC;IACvE,OAAO,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE;QAC1D,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE;QAC7D,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAU;IAClC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IACzC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,6CAA6C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5F,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,YAAY,CAAC,CAAU;IACrC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAC7D,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAAU,EAAE,UAAsB,EAAE,SAAoB;IAC5F,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,SAAS,EAAE,CAAC;IAC3D,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,SAAS,EAAE,CAAC;IAE7E,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC;YAAE,OAAO,YAAY,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8FAA8F;IAC9F,wFAAwF;IACxF,wDAAwD;IACxD,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;QAC7B,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC;YAAE,OAAO,YAAY,EAAE,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4FAA4F;IAC5F,IAAI,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC;QAAE,OAAO,YAAY,EAAE,CAAC;IACvF,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/daemon/server.d.ts

@@ -6,6 +6,7 @@ import { type ProxyFetch } from "./proxy.js";
 import { type TelemetryFetch } from "./telemetry-proxy.js";
 import { type InstallerServiceOptions } from "./installer/index.js";
 import type { SetupAuthFetchImpl } from "./setup-auth.js";
+import type { SetupTenancyFetchImpl } from "./setup-tenancy.js";
 export interface CreateHiveOptions {
     readonly host?: string;
     readonly port?: number;
@@ -17,6 +18,8 @@ export interface CreateHiveOptions {
     readonly proxyFetch?: ProxyFetch;
     /** The fetch used by the portal gate's auth check (`/setup/state`, defaults to the global `fetch`). */
     readonly setupAuthFetch?: SetupAuthFetchImpl;
+    /** The fetch used by the portal gate's tenancy check (`/setup/tenancy`, defaults to the global `fetch`). */
+    readonly setupTenancyFetch?: SetupTenancyFetchImpl;
     /** Override doctor's SSE events URL the telemetry relay connects to (defaults to the fixed loopback constant). */
     readonly doctorEventsUrl?: string;
     /** The fetch used by the telemetry relay to reach doctor's SSE stream (defaults to the global `fetch`). */

package/dist/daemon/server.js

@@ -38,6 +38,7 @@ export function createHive(options = {}) {
         fleetStatusFetch,
         doctorStatusUrl,
         setupAuthFetch: options.setupAuthFetch,
+        setupTenancyFetch: options.setupTenancyFetch,
         registryPath: options.registryPath
     }));
     // The bundled SPA's static assets — specific, fixed paths registered before the shell catch-all

package/dist/daemon/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/daemon/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EAE1B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,SAAS,EACT,YAAY,EACb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAkB,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAmB,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,4BAA4B,EAAuB,MAAM,sBAAsB,CAAC;AACzF,OAAO,EAAE,sBAAsB,EAAgC,MAAM,sBAAsB,CAAC;AAwD5F,SAAS,WAAW,CAAC,MAAuB;IAC1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAa,EAAE,EAAE;YAC7B,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;gBAC3B,MAAM,CAAC,KAAK,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,UAA6B,EAAE;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IAExB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC3D,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,iBAAiB,CAAC;IAErE,4FAA4F;IAC5F,yFAAyF;IACzF,4FAA4F;IAC5F,sEAAsE;IACtE,GAAG,CAAC,GAAG,CACL,GAAG,EACH,gBAAgB,CAAC;QACf,gBAAgB;QAChB,eAAe;QACf,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CACH,CAAC;IAEF,gGAAgG;IAChG,uBAAuB;IACvB,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAE1B,4FAA4F;IAC5F,2FAA2F;IAC3F,4FAA4F;IAC5F,6FAA6F;IAC7F,kFAAkF;IAClF,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,OAAO,EAAE,YAAY;SACtB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sFAAsF;IACtF,kFAAkF;IAClF,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CACvC,CAAC,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAClE,CAAC;IAEF,uFAAuF;IACvF,sFAAsF;IACtF,2FAA2F;IAC3F,iGAAiG;IACjG,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,CAAC,CAAC,EAAE,EAAE,CACxC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,EAAE,CAAC,CACzF,CAAC;IAEF,gFAAgF;IAChF,8FAA8F;IAC9F,8FAA8F;IAC9F,GAAG,CAAC,GAAG,CACL,uBAAuB,EACvB,4BAA4B,CAAC;QAC3B,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,SAAS,EAAE,OAAO,CAAC,oBAAoB;KACxC,CAAC,CACH,CAAC;IAEF,8FAA8F;IAC9F,iGAAiG;IACjG,kGAAkG;IAClG,kGAAkG;IAClG,4FAA4F;IAC5F,sBAAsB,CAAC,EAAE,gBAAgB,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAElG,4FAA4F;IAC5F,oFAAoF;IACpF,uEAAuE;IACvE,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACvG,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAE9B,4FAA4F;IAC5F,6FAA6F;IAC7F,yFAAyF;IACzF,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAEjC,OAAO;QACL,GAAG;QACH,IAAI;QACJ,IAAI;QACJ,SAAS;KACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,UAA4B,EAAE;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;IACzC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,GAAS,EAAE;QACvD,gBAAgB,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,CAAC,GAAS,EAAE;QACnE,sBAAsB,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,YAAY,EAAE,CAAC;IACf,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,yBAAyB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAE/D,6FAA6F;IAC7F,gGAAgG;IAChG,6BAA6B;IAC7B,IAAI,CAAC;QACH,kBAAkB,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,uBAAuB;IACzB,CAAC;IAED,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,OAAO,CAAC;YACf,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK;YACrB,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yBAAyB,CAAC,SAAS,CAAC,CAAC;QACrC,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACrC,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,yBAAyB,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,GAAG,IAAI;QACP,SAAS;QACT,IAAI;KACL,CAAC;AACJ,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/daemon/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EAE1B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,SAAS,EACT,YAAY,EACb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAkB,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAmB,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,4BAA4B,EAAuB,MAAM,sBAAsB,CAAC;AACzF,OAAO,EAAE,sBAAsB,EAAgC,MAAM,sBAAsB,CAAC;AA2D5F,SAAS,WAAW,CAAC,MAAuB;IAC1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAa,EAAE,EAAE;YAC7B,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;gBAC3B,MAAM,CAAC,KAAK,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,UAA6B,EAAE;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IAExB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC3D,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,iBAAiB,CAAC;IAErE,4FAA4F;IAC5F,yFAAyF;IACzF,4FAA4F;IAC5F,sEAAsE;IACtE,GAAG,CAAC,GAAG,CACL,GAAG,EACH,gBAAgB,CAAC;QACf,gBAAgB;QAChB,eAAe;QACf,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CACH,CAAC;IAEF,gGAAgG;IAChG,uBAAuB;IACvB,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAE1B,4FAA4F;IAC5F,2FAA2F;IAC3F,4FAA4F;IAC5F,6FAA6F;IAC7F,kFAAkF;IAClF,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,OAAO,EAAE,YAAY;SACtB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sFAAsF;IACtF,kFAAkF;IAClF,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CACvC,CAAC,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAClE,CAAC;IAEF,uFAAuF;IACvF,sFAAsF;IACtF,2FAA2F;IAC3F,iGAAiG;IACjG,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,CAAC,CAAC,EAAE,EAAE,CACxC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,EAAE,CAAC,CACzF,CAAC;IAEF,gFAAgF;IAChF,8FAA8F;IAC9F,8FAA8F;IAC9F,GAAG,CAAC,GAAG,CACL,uBAAuB,EACvB,4BAA4B,CAAC;QAC3B,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,SAAS,EAAE,OAAO,CAAC,oBAAoB;KACxC,CAAC,CACH,CAAC;IAEF,8FAA8F;IAC9F,iGAAiG;IACjG,kGAAkG;IAClG,kGAAkG;IAClG,4FAA4F;IAC5F,sBAAsB,CAAC,EAAE,gBAAgB,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAElG,4FAA4F;IAC5F,oFAAoF;IACpF,uEAAuE;IACvE,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACvG,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAE9B,4FAA4F;IAC5F,6FAA6F;IAC7F,yFAAyF;IACzF,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAEjC,OAAO;QACL,GAAG;QACH,IAAI;QACJ,IAAI;QACJ,SAAS;KACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,UAA4B,EAAE;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;IACzC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,GAAS,EAAE;QACvD,gBAAgB,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IACH,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,CAAC,GAAS,EAAE;QACnE,sBAAsB,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,YAAY,EAAE,CAAC;IACf,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,yBAAyB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAE/D,6FAA6F;IAC7F,gGAAgG;IAChG,6BAA6B;IAC7B,IAAI,CAAC;QACH,kBAAkB,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,uBAAuB;IACzB,CAAC;IAED,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,OAAO,CAAC;YACf,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK;YACrB,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yBAAyB,CAAC,SAAS,CAAC,CAAC;QACrC,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACrC,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,yBAAyB,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,GAAG,IAAI;QACP,SAAS;QACT,IAAI;KACL,CAAC;AACJ,CAAC"}

package/dist/daemon/setup-tenancy.d.ts

@@ -0,0 +1,18 @@
+/**
+ * PRD-011c gate tenancy input: fail-closed read of honeycomb `GET /setup/tenancy` `selected` bit.
+ * Mirrors `setup-auth.ts` construction exactly (tg-AC-5).
+ */
+export type SetupTenancyFetchInit = {
+    readonly redirect?: "error" | "follow" | "manual";
+    readonly signal?: AbortSignal;
+};
+export type SetupTenancyFetchImpl = (input: string, init?: SetupTenancyFetchInit) => Promise<Response>;
+export interface FetchTenancySelectedOptions {
+    readonly registryPath?: string;
+    readonly signal?: AbortSignal;
+}
+/**
+ * Resolve whether tenancy is confirmed for the gate's third precedence step (tg-AC-1..4).
+ * Returns `false` on ANY failure so a transient fault lands on `/onboarding`, never the dashboard.
+ */
+export declare function fetchTenancySelected(fetchImpl?: SetupTenancyFetchImpl, options?: FetchTenancySelectedOptions): Promise<boolean>;

package/dist/daemon/setup-tenancy.js

@@ -0,0 +1,37 @@
+/**
+ * PRD-011c gate tenancy input: fail-closed read of honeycomb `GET /setup/tenancy` `selected` bit.
+ * Mirrors `setup-auth.ts` construction exactly (tg-AC-5).
+ */
+import { z } from "zod";
+import { isLoopbackBaseUrl } from "../shared/daemon-routing.js";
+import { resolveDaemonBases } from "./registry.js";
+const SetupTenancySelectedSchema = z.object({
+    selected: z.boolean().catch(false),
+});
+/**
+ * Resolve whether tenancy is confirmed for the gate's third precedence step (tg-AC-1..4).
+ * Returns `false` on ANY failure so a transient fault lands on `/onboarding`, never the dashboard.
+ */
+export async function fetchTenancySelected(fetchImpl = fetch, options = {}) {
+    const base = resolveDaemonBases({ registryPath: options.registryPath }).honeycomb;
+    if (!isLoopbackBaseUrl(base))
+        return false;
+    try {
+        const response = await fetchImpl(`${base}/setup/tenancy`, { redirect: "error", signal: options.signal });
+        if (!response.ok)
+            return false;
+        let parsedJson;
+        try {
+            parsedJson = await response.json();
+        }
+        catch {
+            return false;
+        }
+        const parsed = SetupTenancySelectedSchema.safeParse(parsedJson);
+        return parsed.success ? parsed.data.selected : false;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=setup-tenancy.js.map

package/dist/daemon/setup-tenancy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-tenancy.js","sourceRoot":"","sources":["../../src/daemon/setup-tenancy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;CAClC,CAAC,CAAC;AAaH;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,YAAmC,KAAK,EACxC,UAAuC,EAAE;IAEzC,MAAM,IAAI,GAAG,kBAAkB,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC;IAClF,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAE3C,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,gBAAgB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACzG,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAE/B,IAAI,UAAmB,CAAC;QACxB,IAAI,CAAC;YACJ,UAAU,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAChE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC"}

package/dist/dashboard/web/active-tenancy-display.d.ts

@@ -0,0 +1,34 @@
+/**
+ * PRD-011b: active tenancy readout helpers and shell chrome component.
+ * Maps daemon truth to honest labels; never fabricates `local · default`.
+ */
+import React from "react";
+import type { SetupTenancyResultWire, WireClient } from "./wire.js";
+export type ActiveTenancyLabel = {
+    readonly kind: "ok";
+    readonly org: string;
+    readonly workspace: string;
+    /** How the tenancy was confirmed (honeycomb `confirmedBy`); absent on older daemons. */
+    readonly confirmedBy?: "selection" | "grandfathered";
+} | {
+    readonly kind: "unavailable";
+} | {
+    readonly kind: "not-linked";
+} | {
+    readonly kind: "not-selected";
+};
+/** Derive the shell readout label from a tenancy read (tv-AC-2/3). */
+export declare function deriveActiveTenancyLabel(read: SetupTenancyResultWire): ActiveTenancyLabel;
+export declare function formatActiveTenancyLabel(label: ActiveTenancyLabel): string;
+export interface ActiveTenancyDisplayProps {
+    readonly wire: WireClient;
+    /** Incremented by the shell on honeycomb down→up recovery (tv-AC-4). */
+    readonly refreshKey?: number;
+}
+/** Persistent org · workspace readout for the shell chrome bar (tv-AC-1..5). */
+export declare function ActiveTenancyDisplay({ wire, refreshKey }: ActiveTenancyDisplayProps): React.JSX.Element;
+/** Tenancy line for the nectar projects panel (tv-AC-6..8). */
+export declare function formatNectarPanelTenancy(projectsTenancy: {
+    org?: string;
+    workspace?: string;
+} | undefined, fleetTenancy: ActiveTenancyLabel): string | null;

package/dist/dashboard/web/active-tenancy-display.js

@@ -0,0 +1,84 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+/**
+ * PRD-011b: active tenancy readout helpers and shell chrome component.
+ * Maps daemon truth to honest labels; never fabricates `local · default`.
+ */
+import React from "react";
+import { UNREACHABLE_SETUP_TENANCY } from "./wire.js";
+import { useScopeSwitcher } from "./scope-context.js";
+/** Derive the shell readout label from a tenancy read (tv-AC-2/3). */
+export function deriveActiveTenancyLabel(read) {
+    if (read.unreachable)
+        return { kind: "unavailable" };
+    if (!read.authenticated)
+        return { kind: "not-linked" };
+    if (!read.selected)
+        return { kind: "not-selected" };
+    const org = read.org?.name !== "" && read.org?.name !== undefined ? read.org.name : read.org?.id ?? "";
+    const workspace = read.workspace?.name !== "" && read.workspace?.name !== undefined ? read.workspace.name : read.workspace?.id ?? "";
+    if (org === "" || workspace === "")
+        return { kind: "unavailable" };
+    return read.confirmedBy !== undefined ? { kind: "ok", org, workspace, confirmedBy: read.confirmedBy } : { kind: "ok", org, workspace };
+}
+export function formatActiveTenancyLabel(label) {
+    switch (label.kind) {
+        case "ok":
+            // A grandfathered confirmation (carried forward from a pre-selection credential) is
+            // hinted subtly so the operator knows this tenancy was never explicitly picked.
+            return label.confirmedBy === "grandfathered" ? `${label.org} · ${label.workspace} (grandfathered)` : `${label.org} · ${label.workspace}`;
+        case "unavailable":
+            return "tenancy unavailable";
+        case "not-linked":
+            return "not linked";
+        case "not-selected":
+            return "tenancy not selected";
+        default: {
+            const _exhaustive = label;
+            return _exhaustive;
+        }
+    }
+}
+/** Persistent org · workspace readout for the shell chrome bar (tv-AC-1..5). */
+export function ActiveTenancyDisplay({ wire, refreshKey = 0 }) {
+    const { switchFeedback } = useScopeSwitcher();
+    const [tenancy, setTenancy] = React.useState(UNREACHABLE_SETUP_TENANCY);
+    const hydrate = React.useCallback(async () => {
+        setTenancy(await wire.setupTenancy());
+    }, [wire]);
+    React.useEffect(() => {
+        void hydrate();
+    }, [hydrate, refreshKey]);
+    // tv-AC-5: re-hydrate after a persisted org/workspace switch acknowledges.
+    React.useEffect(() => {
+        if (switchFeedback?.kind === "persisted" && switchFeedback.pending !== true) {
+            void hydrate();
+        }
+    }, [switchFeedback, hydrate]);
+    const label = deriveActiveTenancyLabel(tenancy);
+    const text = formatActiveTenancyLabel(label);
+    return (_jsx("span", { "data-testid": "active-tenancy-display", "data-tenancy-state": label.kind, style: {
+            fontFamily: "var(--font-mono)",
+            fontSize: "var(--text-xs)",
+            color: label.kind === "ok" ? "var(--text-secondary)" : "var(--text-tertiary)",
+            whiteSpace: "nowrap",
+            overflow: "hidden",
+            textOverflow: "ellipsis",
+        }, children: text }));
+}
+/** Tenancy line for the nectar projects panel (tv-AC-6..8). */
+export function formatNectarPanelTenancy(projectsTenancy, fleetTenancy) {
+    if (projectsTenancy?.org !== undefined && projectsTenancy.org !== "" && projectsTenancy.workspace !== undefined && projectsTenancy.workspace !== "") {
+        return `${projectsTenancy.org} · ${projectsTenancy.workspace}`;
+    }
+    if (fleetTenancy.kind === "ok") {
+        return `${fleetTenancy.org} · ${fleetTenancy.workspace} (fleet credential)`;
+    }
+    if (fleetTenancy.kind === "unavailable")
+        return "tenancy unknown";
+    if (fleetTenancy.kind === "not-linked")
+        return "not linked";
+    if (fleetTenancy.kind === "not-selected")
+        return "tenancy not selected";
+    return "tenancy unknown";
+}
+//# sourceMappingURL=active-tenancy-display.js.map