@legioncodeinc/hive 0.6.0 → 0.6.3

package/dist/service/templates.js

@@ -4,6 +4,12 @@ import { resolveFleetRoot, resolveLaunchdLogPaths } from "../shared/apiary-root.
 export const HIVE_START_COMMAND = "start";
 export const RESTART_SEC = 5;
 export const WINDOWS_RESTART_INTERVAL = "PT1M";
+/**
+ * The task action runs under `conhost.exe --headless` instead of `node.exe` directly, so the
+ * scheduled task never pops a visible console window at logon/run (proven empirically: the
+ * identical task ran with Last Result 0 and no window under this wrapper).
+ */
+export const WINDOWS_CONHOST_COMMAND = "C:\\Windows\\System32\\conhost.exe";
 /**
  * rr-AC-10 / 010a implementation note: when the root resolved at render time differs from the
  * default `<home>/.apiary` (an `APIARY_HOME` or Linux XDG override is active), the installer must
@@ -99,10 +105,19 @@ WantedBy=default.target
  * root at render time, but the task-started daemon resolves the default root unless the operator
  * sets APIARY_HOME machine-wide (setx / system properties). Recorded in PRD-010a implementation
  * notes; hive's Windows service is per-user InteractiveToken only, so no LocalSystem edge exists.
+ *
+ * `userId` (a SID or a `domain\user` fallback, resolved by the caller and passed in already
+ * escaped-ready) scopes the `LogonTrigger` and `Principal` to a concrete identity. An unscoped
+ * logon trigger/principal means "any user's logon", which a hardened Windows 11 25H2 machine
+ * (Administrator Protection enabled) refuses to register from a non-elevated shell. `null` renders
+ * with no `UserId`, matching prior behavior for machines where no identity could be resolved.
+ * `UserId` is placed first inside `<Principal>` and after `<Enabled>` inside `<LogonTrigger>` per
+ * the Task Scheduler schema's element ordering.
  */
-export function renderScheduledTaskXml(plan) {
+export function renderScheduledTaskXml(plan, userId = null) {
     const node = escapeXml(process.execPath);
     const exec = escapeXml(plan.execPath);
+    const userIdBlock = userId === null ? "" : `\n      <UserId>${escapeXml(userId)}</UserId>`;
     return `<?xml version="1.0" encoding="UTF-16"?>
 <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
   <RegistrationInfo>
@@ -111,11 +126,11 @@ export function renderScheduledTaskXml(plan) {
   </RegistrationInfo>
   <Triggers>
     <LogonTrigger>
-      <Enabled>true</Enabled>
+      <Enabled>true</Enabled>${userIdBlock}
     </LogonTrigger>
   </Triggers>
   <Principals>
-    <Principal id="Author">
+    <Principal id="Author">${userIdBlock}
       <LogonType>InteractiveToken</LogonType>
       <RunLevel>LeastPrivilege</RunLevel>
     </Principal>
@@ -137,21 +152,21 @@ export function renderScheduledTaskXml(plan) {
   </Settings>
   <Actions Context="Author">
     <Exec>
-      <Command>${node}</Command>
-      <Arguments>"${exec}" ${HIVE_START_COMMAND}</Arguments>
+      <Command>${WINDOWS_CONHOST_COMMAND}</Command>
+      <Arguments>--headless "${node}" "${exec}" ${HIVE_START_COMMAND}</Arguments>
     </Exec>
   </Actions>
 </Task>
 `;
 }
-export function renderUnit(plan, env = process.env) {
+export function renderUnit(plan, env = process.env, windowsUserId = null) {
     switch (plan.manager) {
         case "launchd":
             return renderLaunchdPlist(plan, env);
         case "systemd":
             return renderSystemdUnit(plan, env);
         case "schtasks":
-            return renderScheduledTaskXml(plan);
+            return renderScheduledTaskXml(plan, windowsUserId);
     }
 }
 //# sourceMappingURL=templates.js.map

package/dist/service/templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../src/service/templates.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAEpF,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAgB,CAAC;AACnD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAU,CAAC;AACtC,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAe,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAiB,EAAE,GAAsB;IACrE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,OAAO,QAAQ,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAiB,EAAE,MAAyB,OAAO,CAAC,GAAG;IACxF,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,sBAAsB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,gBAAgB,GACpB,GAAG,KAAK,IAAI;QACV,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;;;YAGI,SAAS,CAAC,GAAG,CAAC;;CAEzB,CAAC;IACA,OAAO;;;;EAIP,gBAAgB;WACP,KAAK;;;YAGJ,IAAI;YACJ,IAAI;YACJ,kBAAkB;;;;;;;YAOlB,WAAW;;;;WAIZ,UAAU;;WAEV,UAAU;;;CAGpB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAiB,EAAE,MAAyB,OAAO,CAAC,GAAG;IACvF,MAAM,SAAS,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACrH,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,eAAe,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,iBAAiB,CAAC,eAAe,GAAG,EAAE,CAAC,IAAI,CAAC;IACvG,OAAO;;;;;;EAMP,eAAe,aAAa,SAAS;;aAE1B,WAAW;;;;;CAKvB,CAAC;AACF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAiB;IACtD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO;;;;aAII,SAAS,CAAC,iBAAiB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;kBAwBvB,wBAAwB;;;;;;iBAMzB,IAAI;oBACD,IAAI,KAAK,kBAAkB;;;;CAI9C,CAAC;AACF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAiB,EAAE,MAAyB,OAAO,CAAC,GAAG;IAChF,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvC,KAAK,SAAS;YACZ,OAAO,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtC,KAAK,UAAU;YACb,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;AACH,CAAC"}
+{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../src/service/templates.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAEpF,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAgB,CAAC;AACnD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAU,CAAC;AACtC,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAe,CAAC;AACxD;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,oCAA6C,CAAC;AAErF;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAiB,EAAE,GAAsB;IACrE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,OAAO,QAAQ,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAiB,EAAE,MAAyB,OAAO,CAAC,GAAG;IACxF,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,sBAAsB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,gBAAgB,GACpB,GAAG,KAAK,IAAI;QACV,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;;;YAGI,SAAS,CAAC,GAAG,CAAC;;CAEzB,CAAC;IACA,OAAO;;;;EAIP,gBAAgB;WACP,KAAK;;;YAGJ,IAAI;YACJ,IAAI;YACJ,kBAAkB;;;;;;;YAOlB,WAAW;;;;WAIZ,UAAU;;WAEV,UAAU;;;CAGpB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAiB,EAAE,MAAyB,OAAO,CAAC,GAAG;IACvF,MAAM,SAAS,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACrH,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,eAAe,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,iBAAiB,CAAC,eAAe,GAAG,EAAE,CAAC,IAAI,CAAC;IACvG,OAAO;;;;;;EAMP,eAAe,aAAa,SAAS;;aAE1B,WAAW;;;;;CAKvB,CAAC;AACF,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAiB,EAAE,SAAwB,IAAI;IACpF,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC;IAC3F,OAAO;;;;aAII,SAAS,CAAC,iBAAiB,CAAC;;;;+BAIV,WAAW;;;;6BAIb,WAAW;;;;;;;;;;;;;;;;kBAgBtB,wBAAwB;;;;;;iBAMzB,uBAAuB;+BACT,IAAI,MAAM,IAAI,KAAK,kBAAkB;;;;CAInE,CAAC;AACF,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,IAAiB,EACjB,MAAyB,OAAO,CAAC,GAAG,EACpC,gBAA+B,IAAI;IAEnC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvC,KAAK,SAAS;YACZ,OAAO,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtC,KAAK,UAAU;YACb,OAAO,sBAAsB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACvD,CAAC;AACH,CAAC"}

package/dist/service/windows-identity.d.ts

@@ -0,0 +1,46 @@
+/** Matches a Windows SID string such as `S-1-5-21-...-1001`. */
+export declare const WINDOWS_SID_PATTERN: RegExp;
+export interface WhoamiResult {
+    readonly ok: boolean;
+    readonly stdout: string;
+}
+/** Injectable seam over the `whoami.exe` invocation (hermetic tests mirror production env). */
+export type WhoamiRunner = (executable: string, args: readonly string[]) => Promise<WhoamiResult>;
+/** Injectable seams for Windows identity resolution (hermetic tests mirror production env). */
+export interface WindowsUserIdResolverDeps {
+    readonly env?: NodeJS.ProcessEnv;
+    readonly runWhoami?: WhoamiRunner;
+}
+/**
+ * Resolves `whoami.exe` under `%SystemRoot%\System32` explicitly (never bare `whoami`
+ * on PATH), so a git-bash `whoami` shadowing the real binary on some machines can never
+ * be picked up instead.
+ */
+export declare function whoamiExecutablePath(env: NodeJS.ProcessEnv): string;
+/** Real `whoami.exe` runner: execFile, never a shell. */
+export declare function createExecFileWhoamiRunner(): WhoamiRunner;
+/**
+ * Parses the SID out of `whoami /user /fo csv /nh` output, e.g.
+ * `"domain\user","S-1-5-21-...-1001"`. Takes the last non-empty line (defensive
+ * against a stray header row) and the last CSV field, strips surrounding quotes,
+ * and validates the shape. Returns `null` on anything that does not look like a SID.
+ */
+export declare function parseWhoamiSid(stdout: string): string | null;
+/** `${USERDOMAIN}\${USERNAME}`, or `null` when either is unset/empty. */
+export declare function fallbackWindowsAccount(env: NodeJS.ProcessEnv): string | null;
+/**
+ * Resolves the value to embed as the schtasks `LogonTrigger`/`Principal` `UserId`.
+ *
+ * On a hardened Windows 11 25H2 machine (Administrator Protection enabled), an
+ * unscoped `LogonTrigger`/`Principal` (no `UserId`, meaning "any user's logon") is
+ * exactly what makes `schtasks /Create` refuse registration from a non-elevated
+ * shell with "ERROR: Access is denied." Scoping both elements to a concrete
+ * identity is the fix.
+ *
+ * Resolution order: the current user's SID via `whoami.exe /user /fo csv /nh`
+ * (execFile, never a shell); falling back to `${USERDOMAIN}\${USERNAME}` when the
+ * SID cannot be determined; falling back to `null` (render with no `UserId`,
+ * today's unscoped behavior) when neither is available, so non-hardened machines
+ * keep working unchanged.
+ */
+export declare function resolveWindowsUserId(deps?: WindowsUserIdResolverDeps): Promise<string | null>;

package/dist/service/windows-identity.js

@@ -0,0 +1,76 @@
+import { execFile } from "node:child_process";
+import { win32 } from "node:path";
+/** Matches a Windows SID string such as `S-1-5-21-...-1001`. */
+export const WINDOWS_SID_PATTERN = /^S-1-\d+(-\d+)+$/;
+/**
+ * Resolves `whoami.exe` under `%SystemRoot%\System32` explicitly (never bare `whoami`
+ * on PATH), so a git-bash `whoami` shadowing the real binary on some machines can never
+ * be picked up instead.
+ */
+export function whoamiExecutablePath(env) {
+    return win32.join(env.SystemRoot ?? "C:\\Windows", "System32", "whoami.exe");
+}
+/** Real `whoami.exe` runner: execFile, never a shell. */
+export function createExecFileWhoamiRunner() {
+    return (executable, args) => new Promise((resolve) => {
+        execFile(executable, [...args], (error, stdout) => {
+            resolve({ ok: error === null, stdout });
+        });
+    });
+}
+/**
+ * Parses the SID out of `whoami /user /fo csv /nh` output, e.g.
+ * `"domain\user","S-1-5-21-...-1001"`. Takes the last non-empty line (defensive
+ * against a stray header row) and the last CSV field, strips surrounding quotes,
+ * and validates the shape. Returns `null` on anything that does not look like a SID.
+ */
+export function parseWhoamiSid(stdout) {
+    const line = stdout
+        .split(/\r?\n/)
+        .map((entry) => entry.trim())
+        .filter((entry) => entry !== "")
+        .pop();
+    if (line === undefined)
+        return null;
+    const fields = line.split(",");
+    const rawLast = fields[fields.length - 1];
+    if (rawLast === undefined)
+        return null;
+    const sid = rawLast.trim().replace(/^"/, "").replace(/"$/, "");
+    return WINDOWS_SID_PATTERN.test(sid) ? sid : null;
+}
+/** `${USERDOMAIN}\${USERNAME}`, or `null` when either is unset/empty. */
+export function fallbackWindowsAccount(env) {
+    const domain = env.USERDOMAIN;
+    const user = env.USERNAME;
+    if (domain === undefined || domain === "" || user === undefined || user === "")
+        return null;
+    return `${domain}\\${user}`;
+}
+/**
+ * Resolves the value to embed as the schtasks `LogonTrigger`/`Principal` `UserId`.
+ *
+ * On a hardened Windows 11 25H2 machine (Administrator Protection enabled), an
+ * unscoped `LogonTrigger`/`Principal` (no `UserId`, meaning "any user's logon") is
+ * exactly what makes `schtasks /Create` refuse registration from a non-elevated
+ * shell with "ERROR: Access is denied." Scoping both elements to a concrete
+ * identity is the fix.
+ *
+ * Resolution order: the current user's SID via `whoami.exe /user /fo csv /nh`
+ * (execFile, never a shell); falling back to `${USERDOMAIN}\${USERNAME}` when the
+ * SID cannot be determined; falling back to `null` (render with no `UserId`,
+ * today's unscoped behavior) when neither is available, so non-hardened machines
+ * keep working unchanged.
+ */
+export async function resolveWindowsUserId(deps = {}) {
+    const env = deps.env ?? process.env;
+    const runWhoami = deps.runWhoami ?? createExecFileWhoamiRunner();
+    const result = await runWhoami(whoamiExecutablePath(env), ["/user", "/fo", "csv", "/nh"]);
+    if (result.ok) {
+        const sid = parseWhoamiSid(result.stdout);
+        if (sid !== null)
+            return sid;
+    }
+    return fallbackWindowsAccount(env);
+}
+//# sourceMappingURL=windows-identity.js.map

package/dist/service/windows-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windows-identity.js","sourceRoot":"","sources":["../../src/service/windows-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,gEAAgE;AAChE,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AAgBtD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAsB;IACzD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;AAC/E,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,0BAA0B;IACxC,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CAC1B,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACtB,QAAQ,CAAC,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAChD,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,KAAK,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,IAAI,GAAG,MAAM;SAChB,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC;SAC/B,GAAG,EAAE,CAAC;IACT,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEvC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/D,OAAO,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,sBAAsB,CAAC,GAAsB;IAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC;IAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5F,OAAO,GAAG,MAAM,KAAK,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAkC,EAAE;IAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,0BAA0B,EAAE,CAAC;IAEjE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC;IAC/B,CAAC;IAED,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC"}

package/dist/shared/onboarding-types.d.ts

@@ -11,11 +11,15 @@
 import type { FleetStatusResponse } from "./fleet-readiness.js";
 /** The four fleet product slugs (is-AC-3). The install allowlist is derived from this closed set. */
 export type ProductSlug = "honeycomb" | "doctor" | "hive" | "nectar";
+/** The canonical runtime product list used by detect/onboarding contract code paths. */
+export declare const PRODUCT_SLUGS: readonly ["honeycomb", "doctor", "hive", "nectar"];
 /**
  * The three installable-via-portal products. `hive` is intentionally excluded: it is the daemon
  * serving this very endpoint, so it is never a portal install target (a request for it is a 400).
  */
 export type InstallableProduct = "doctor" | "honeycomb" | "nectar";
+/** The canonical installable product order for onboarding flows. */
+export declare const INSTALLABLE_PRODUCTS: readonly ["doctor", "honeycomb", "nectar"];
 /** The closed set of install stages streamed over SSE (is-AC-11). Never a percentage (is-AC-12). */
 export type InstallStage = "resolving" | "downloading" | "linking" | "registering_service" | "completed" | "failed";
 /** The closed detection state set for a product (is-AC-2). */

package/dist/shared/onboarding-types.js

@@ -8,5 +8,8 @@
  * Nothing in this module reaches persistence: the installer's only durable artifact is the
  * one-time onboarding token file, and even that is out of band from these wire types.
  */
-export {};
+/** The canonical runtime product list used by detect/onboarding contract code paths. */
+export const PRODUCT_SLUGS = ["honeycomb", "doctor", "hive", "nectar"];
+/** The canonical installable product order for onboarding flows. */
+export const INSTALLABLE_PRODUCTS = ["doctor", "honeycomb", "nectar"];
 //# sourceMappingURL=onboarding-types.js.map

package/dist/shared/onboarding-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding-types.js","sourceRoot":"","sources":["../../src/shared/onboarding-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}
+{"version":3,"file":"onboarding-types.js","sourceRoot":"","sources":["../../src/shared/onboarding-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,wFAAwF;AACxF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAU,CAAC;AAQhF,oEAAoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAU,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@legioncodeinc/hive",
-  "version": "0.6.0",
+  "version": "0.6.3",
   "description": "Hive portal daemon",
   "license": "AGPL-3.0-or-later",
   "type": "module",