tinybeeai 0.0.0-stage → 0.16.1

package/dist/bee/pairing.js

@@ -0,0 +1,351 @@
+// The Bee side of pairing (docs/tinybee/02-architecture-pairing.md section 4): make a nonce, sign it,
+// show it as a QR, tell Hive, poll until the phone has bound it, keep the tokens, then heartbeat.
+//
+// States the setup page shows:
+//   idle        TinyBee is on, nothing started.
+//   showing     A QR is on screen; Hive knows about it (or we are still trying to tell it: hiveReached=false).
+//   claimed     The install code was accepted; the phone has to confirm this laptop.
+//   paired      Tokens are stored; the heartbeat loop runs.
+//   replaced    Another laptop took this tenant; the person pairs again from the app.
+import { networkInterfaces } from 'node:os';
+import { config, log } from '../config.js';
+import { newNonce, pairMessage, signMessage } from '../tinybee/ed25519.js';
+import { encodePairUrl } from '../tinybee/pair-payload.js';
+import { beeHealth, laptopName, summaryOf } from './health.js';
+import { beeTunnelStatus, onBeeTunnelChange, startBeeTunnel, stopBeeTunnel, tokenRunsCloudflared } from './tunnel-manager.js';
+import { hiveApi, HiveClientError, hiveOrigin } from './hive-client.js';
+import { deviceKey } from './identity.js';
+import { setRelayToken } from './relay-client.js';
+import { clearBeeState, publicPaired, readBeeState, writeBeeState } from './state.js';
+import { beePlan, setBeePlan } from './status.js';
+import { startUpdater, stopUpdater } from './updater.js';
+export const QR_TTL_MS = 10 * 60 * 1000;
+export const POLL_MS = 2000;
+export const HEARTBEAT_MS = 30_000;
+/** The QR is drawn again a minute before Hive would refuse it. */
+const QR_RENEW_MS = QR_TTL_MS - 60_000;
+let session;
+let paired = null;
+let stage = 'off';
+let problem;
+let health;
+let heartbeatTimer;
+let lastHeartbeatAt;
+let online = false;
+const listeners = new Set();
+export function onBeeChange(fn) {
+    listeners.add(fn);
+    return () => listeners.delete(fn);
+}
+const changed = () => listeners.forEach((fn) => fn());
+onBeeTunnelChange(changed);
+/**
+ * cloudflared runs whenever the saved pairing has a real tunnel token and the plan allows remote access.
+ * Suspended (trial ended, docs 03 section 9): the tunnel stops, everything else keeps running.
+ */
+function syncTunnel() {
+    const allowed = beePlan()?.tunnel !== 'off';
+    if (paired && allowed && tokenRunsCloudflared(paired.tunnel_token))
+        startBeeTunnel(paired.tunnel_token);
+    else
+        void stopBeeTunnel(0);
+    setRelayToken(paired?.relay_token);
+}
+/** The setup page's line while remote access is paused (docs 04 section 5). */
+export function planNotice() {
+    const p = beePlan();
+    if (!p || p.status === 'active')
+        return undefined;
+    return p.reason === 'trial_ended'
+        ? 'Trial ended — your Bee still works here, but remote access is paused. Upgrade in the app.'
+        : 'Remote access is paused until the plan is paid. Your Bee still works here.';
+}
+/** The first LAN address of this laptop, so a phone on the same Wi-Fi can open the Bee straight away. */
+export function lanUrl(port = config.port) {
+    for (const addrs of Object.values(networkInterfaces()))
+        for (const a of addrs ?? [])
+            if (a.family === 'IPv4' && !a.internal)
+                return `http://${a.address}:${port}`;
+    return undefined;
+}
+/** Loads the saved state. Call once at boot, after the data dir exists. */
+export function initBee() {
+    if (!hiveOrigin()) {
+        stage = 'off';
+        return stage;
+    }
+    paired = readBeeState().paired;
+    stage = paired ? 'paired' : 'idle';
+    if (paired) {
+        syncTunnel();
+        startHeartbeat();
+    }
+    startUpdater();
+    return stage;
+}
+export function beeSnapshot() {
+    return {
+        stage,
+        qr: session?.qr,
+        expiresAt: session ? new Date(session.startedAt + QR_TTL_MS).toISOString() : undefined,
+        hiveReached: session?.hiveReached ?? false,
+        slug: session?.slug,
+        paired: publicPaired(paired),
+        online,
+        lastHeartbeatAt: lastHeartbeatAt ? new Date(lastHeartbeatAt).toISOString() : undefined,
+        problem,
+        health,
+        hostname: laptopName(),
+        hiveOrigin: hiveOrigin(),
+        tunnel: paired && tokenRunsCloudflared(paired.tunnel_token) ? beeTunnelStatus() : undefined,
+        plan: beePlan(),
+        planNotice: planNotice(),
+    };
+}
+/** The tokens, for the tunnel and the relay only. Never put these in a response. */
+export function pairedSecrets() {
+    return paired ? { tunnel_token: paired.tunnel_token, relay_token: paired.relay_token } : null;
+}
+export async function refreshHealth() {
+    health = await beeHealth();
+    return health;
+}
+function makeSession(hc) {
+    const key = deviceKey();
+    const nonce = newNonce();
+    const host = laptopName();
+    const payload = { v: 1, nonce, pub: key.pubId, host, hc, lan: lanUrl(), sig: signMessage(key, pairMessage(nonce, key.pubId, host)) };
+    return { nonce, payload, qr: encodePairUrl(payload), startedAt: Date.now(), hiveReached: false, polling: false };
+}
+/**
+ * Shows a QR (or renews it). Idempotent while a fresh one is on screen. The offer goes to Hive right away
+ * and again on every poll until it lands, so a laptop whose internet comes up late still pairs.
+ */
+export async function startPairing(opts = {}) {
+    if (!hiveOrigin())
+        throw new Error('TinyBee is off on this laptop (TINYBEE_ENV is unset).');
+    if (stage === 'paired' && !opts.force)
+        return beeSnapshot();
+    const h = await refreshHealth();
+    if (!h.ok)
+        throw new Error(h.blockers.join(' '));
+    if (session && !opts.force && Date.now() - session.startedAt < QR_RENEW_MS)
+        return beeSnapshot();
+    stopSession();
+    session = makeSession(summaryOf(h));
+    stage = 'showing';
+    problem = undefined;
+    changed();
+    await announce();
+    schedulePoll();
+    return beeSnapshot();
+}
+/** The laptop types the install code from the app: Hive parks this offer on that account. */
+export async function submitInstallCode(code) {
+    const c = String(code ?? '')
+        .replace(/[\s-]/g, '')
+        .toUpperCase();
+    if (!/^[A-Z0-9]{6}$/.test(c))
+        throw new HiveClientError(400, 'install_code_invalid', 'Type the 6-character code the app shows.');
+    if (!session || stage === 'paired')
+        await startPairing({ force: stage !== 'paired' });
+    const s = session;
+    const r = await hiveApi.claim({ ...offerBody(s), install_code: c });
+    s.hiveReached = true;
+    s.slug = r.slug;
+    stage = 'claimed';
+    problem = undefined;
+    changed();
+    schedulePoll();
+    return beeSnapshot();
+}
+const offerBody = (s) => ({ nonce: s.nonce, pub: s.payload.pub, host: s.payload.host, hc: s.payload.hc, lan: s.payload.lan, sig: s.payload.sig });
+async function announce() {
+    const s = session;
+    if (!s || s.hiveReached)
+        return;
+    try {
+        await hiveApi.offer(offerBody(s));
+        s.hiveReached = true;
+        problem = undefined;
+    }
+    catch (err) {
+        problem = err instanceof Error ? err.message : String(err);
+    }
+    changed();
+}
+function schedulePoll() {
+    const s = session;
+    if (!s)
+        return;
+    if (s.timer)
+        clearTimeout(s.timer);
+    s.timer = setTimeout(() => void poll(), POLL_MS);
+    s.timer.unref?.();
+}
+async function poll() {
+    const s = session;
+    if (!s || s.polling)
+        return;
+    s.polling = true;
+    try {
+        if (Date.now() - s.startedAt >= QR_RENEW_MS) {
+            // Draw a fresh QR before the old one goes stale.
+            await startPairing({ force: true });
+            return;
+        }
+        if (!s.hiveReached) {
+            await announce();
+            return;
+        }
+        const r = await hiveApi.status(s.nonce);
+        problem = undefined;
+        if (r.state === 'paired') {
+            await becomePaired(r);
+            return;
+        }
+        if (r.state === 'claimed' && stage !== 'claimed') {
+            stage = 'claimed';
+            s.slug = typeof r.slug === 'string' ? r.slug : undefined;
+            changed();
+        }
+    }
+    catch (err) {
+        if (err instanceof HiveClientError && (err.code === 'nonce_expired' || err.code === 'nonce_unknown')) {
+            await startPairing({ force: true });
+            return;
+        }
+        if (err instanceof HiveClientError && err.code === 'bee_replaced') {
+            stopSession();
+            stage = 'replaced';
+            problem = err.message;
+            changed();
+            return;
+        }
+        problem = err instanceof Error ? err.message : String(err);
+        changed();
+    }
+    finally {
+        if (session === s) {
+            s.polling = false;
+            if (stage === 'showing' || stage === 'claimed')
+                schedulePoll();
+        }
+    }
+}
+async function becomePaired(r) {
+    paired = {
+        bee_id: r.bee_id,
+        bee_name: r.bee_name,
+        tenant_id: r.tenant_id,
+        slug: r.slug,
+        hostname: r.hostname,
+        tunnel_token: r.tunnel_token,
+        relay_token: r.relay_token,
+        pairedAt: new Date().toISOString(),
+    };
+    writeBeeState({ v: 1, paired });
+    stopSession();
+    stage = 'paired';
+    problem = undefined;
+    log.info(`tinybee: paired as ${r.hostname}`);
+    changed();
+    syncTunnel();
+    startHeartbeat();
+    await heartbeatOnce();
+}
+function stopSession() {
+    if (session?.timer)
+        clearTimeout(session.timer);
+    session = undefined;
+}
+async function heartbeatOnce() {
+    if (!paired)
+        return;
+    try {
+        const h = await refreshHealth();
+        const r = await hiveApi.heartbeat(summaryOf(h));
+        lastHeartbeatAt = Date.now();
+        online = true;
+        problem = undefined;
+        const before = beePlan()?.tunnel;
+        setBeePlan(r.plan);
+        if (r.plan && r.plan.tunnel !== before) {
+            if (r.plan.tunnel === 'off')
+                log.warn(`tinybee: remote access paused (${r.plan.reason ?? r.plan.status}); the Bee keeps running locally`);
+            else if (before !== undefined)
+                log.info('tinybee: remote access is back');
+            syncTunnel();
+        }
+    }
+    catch (err) {
+        online = false;
+        if (err instanceof HiveClientError && err.code === 'bee_unknown') {
+            // Replaced or revoked from the app: forget the tokens.
+            log.warn('tinybee: this laptop was unpaired from the app');
+            clearBeeState();
+            paired = null;
+            setBeePlan(undefined);
+            setRelayToken(undefined);
+            stopHeartbeat();
+            void stopBeeTunnel();
+            stage = 'replaced';
+            problem = 'This laptop was unpaired from the app. Pair again to reconnect.';
+        }
+        else
+            problem = err instanceof Error ? err.message : String(err);
+    }
+    changed();
+}
+function startHeartbeat() {
+    stopHeartbeat();
+    heartbeatTimer = setInterval(() => void heartbeatOnce(), HEARTBEAT_MS);
+    heartbeatTimer.unref?.();
+    void heartbeatOnce();
+}
+export function stopHeartbeat() {
+    if (heartbeatTimer)
+        clearInterval(heartbeatTimer);
+    heartbeatTimer = undefined;
+}
+/** Forgets the pairing on this laptop. Hive learns on the next missed heartbeat; the app can replace the Bee any time. */
+export function unpair() {
+    stopHeartbeat();
+    stopSession();
+    void stopBeeTunnel();
+    clearBeeState();
+    paired = null;
+    setBeePlan(undefined);
+    setRelayToken(undefined);
+    online = false;
+    lastHeartbeatAt = undefined;
+    stage = hiveOrigin() ? 'idle' : 'off';
+    problem = undefined;
+    changed();
+    return beeSnapshot();
+}
+/** Stops timers (shutdown and tests). Keeps the saved state. */
+export function stopBee() {
+    stopUpdater();
+    stopHeartbeat();
+    stopSession();
+    void stopBeeTunnel();
+}
+/** Tests: drop in-memory state. */
+export function resetBee() {
+    stopBee();
+    paired = null;
+    setBeePlan(undefined);
+    setRelayToken(undefined);
+    stage = 'off';
+    problem = undefined;
+    health = undefined;
+    online = false;
+    lastHeartbeatAt = undefined;
+    listeners.clear();
+}
+/** One poll on demand (tests and the setup page's refresh button). */
+export const pollNow = poll;
+/** Local development only (src/bee/routes.ts /dev/heartbeat): one heartbeat now, outside the 30 s timer. */
+export const heartbeatNow = heartbeatOnce;
+//# sourceMappingURL=pairing.js.map

package/dist/bee/pairing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing.js","sourceRoot":"","sources":["../../src/bee/pairing.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,kGAAkG;AAClG,EAAE;AACF,+BAA+B;AAC/B,gDAAgD;AAChD,+GAA+G;AAC/G,qFAAqF;AACrF,4DAA4D;AAC5D,sFAAsF;AACtF,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAwC,MAAM,4BAA4B,CAAC;AACjG,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAkB,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,cAAc,EAAE,aAAa,EAAE,oBAAoB,EAAwB,MAAM,qBAAqB,CAAC;AACpJ,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAoB,MAAM,YAAY,CAAC;AACxG,OAAO,EAAE,OAAO,EAAE,UAAU,EAAgB,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEzD,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC;AAC5B,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AACnC,kEAAkE;AAClE,MAAM,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;AAwCvC,IAAI,OAA4B,CAAC;AACjC,IAAI,MAAM,GAAuB,IAAI,CAAC;AACtC,IAAI,KAAK,GAAa,KAAK,CAAC;AAC5B,IAAI,OAA2B,CAAC;AAChC,IAAI,MAA6B,CAAC;AAClC,IAAI,cAA0C,CAAC;AAC/C,IAAI,eAAmC,CAAC;AACxC,IAAI,MAAM,GAAG,KAAK,CAAC;AACnB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAc,CAAC;AAExC,MAAM,UAAU,WAAW,CAAC,EAAc;IACxC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACpC,CAAC;AACD,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5D,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAE3B;;;GAGG;AACH,SAAS,UAAU;IACjB,MAAM,OAAO,GAAG,OAAO,EAAE,EAAE,MAAM,KAAK,KAAK,CAAC;IAC5C,IAAI,MAAM,IAAI,OAAO,IAAI,oBAAoB,CAAC,MAAM,CAAC,YAAY,CAAC;QAAE,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;;QACnG,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC;IAC3B,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AACrC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,UAAU;IACxB,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAClD,OAAO,CAAC,CAAC,MAAM,KAAK,aAAa;QAC/B,CAAC,CAAC,2FAA2F;QAC7F,CAAC,CAAC,4EAA4E,CAAC;AACnF,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI;IACvC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QACpD,KAAK,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE;YAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ;gBAAE,OAAO,UAAU,CAAC,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;IAC5G,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,OAAO;IACrB,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAClB,KAAK,GAAG,KAAK,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,YAAY,EAAE,CAAC,MAAM,CAAC;IAC/B,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,MAAM,EAAE,CAAC;QACX,UAAU,EAAE,CAAC;QACb,cAAc,EAAE,CAAC;IACnB,CAAC;IACD,YAAY,EAAE,CAAC;IACf,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO;QACL,KAAK;QACL,EAAE,EAAE,OAAO,EAAE,EAAE;QACf,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;QACtF,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,KAAK;QAC1C,IAAI,EAAE,OAAO,EAAE,IAAI;QACnB,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC;QAC5B,MAAM;QACN,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;QACtF,OAAO;QACP,MAAM;QACN,QAAQ,EAAE,UAAU,EAAE;QACtB,UAAU,EAAE,UAAU,EAAE;QACxB,MAAM,EAAE,MAAM,IAAI,oBAAoB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS;QAC3F,IAAI,EAAE,OAAO,EAAE;QACf,UAAU,EAAE,UAAU,EAAE;KACzB,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,aAAa;IAC3B,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;IAC3B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,EAAiB;IACpC,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAgB,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;IAClJ,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACnH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA4B,EAAE;IAC/D,IAAI,CAAC,UAAU,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC5F,IAAI,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,WAAW,EAAE,CAAC;IAC5D,MAAM,CAAC,GAAG,MAAM,aAAa,EAAE,CAAC;IAChC,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,GAAG,WAAW;QAAE,OAAO,WAAW,EAAE,CAAC;IACjG,WAAW,EAAE,CAAC;IACd,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,KAAK,GAAG,SAAS,CAAC;IAClB,OAAO,GAAG,SAAS,CAAC;IACpB,OAAO,EAAE,CAAC;IACV,MAAM,QAAQ,EAAE,CAAC;IACjB,YAAY,EAAE,CAAC;IACf,OAAO,WAAW,EAAE,CAAC;AACvB,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAa;IACnD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;SACzB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,WAAW,EAAE,CAAC;IACjB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,sBAAsB,EAAE,0CAA0C,CAAC,CAAC;IACjI,IAAI,CAAC,OAAO,IAAI,KAAK,KAAK,QAAQ;QAAE,MAAM,YAAY,CAAC,EAAE,KAAK,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC,CAAC;IACtF,MAAM,CAAC,GAAG,OAAQ,CAAC;IACnB,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IAChB,KAAK,GAAG,SAAS,CAAC;IAClB,OAAO,GAAG,SAAS,CAAC;IACpB,OAAO,EAAE,CAAC;IACV,YAAY,EAAE,CAAC;IACf,OAAO,WAAW,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;AAE3J,KAAK,UAAU,QAAQ;IACrB,MAAM,CAAC,GAAG,OAAO,CAAC;IAClB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW;QAAE,OAAO;IAChC,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC;QACrB,OAAO,GAAG,SAAS,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,CAAC,GAAG,OAAO,CAAC;IAClB,IAAI,CAAC,CAAC;QAAE,OAAO;IACf,IAAI,CAAC,CAAC,KAAK;QAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,GAAG,OAAO,CAAC;IAClB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO;QAAE,OAAO;IAC5B,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,IAAI,WAAW,EAAE,CAAC;YAC5C,iDAAiD;YACjD,MAAM,YAAY,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnB,MAAM,QAAQ,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACxC,OAAO,GAAG,SAAS,CAAC;QACpB,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACzB,MAAM,YAAY,CAAC,CAA2B,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACjD,KAAK,GAAG,SAAS,CAAC;YAClB,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACzD,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,eAAe,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,eAAe,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,CAAC,EAAE,CAAC;YACrG,MAAM,YAAY,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QACD,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAClE,WAAW,EAAE,CAAC;YACd,KAAK,GAAG,UAAU,CAAC;YACnB,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;YACtB,OAAO,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3D,OAAO,EAAE,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC;YAClB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;gBAAE,YAAY,EAAE,CAAC;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AAYD,KAAK,UAAU,YAAY,CAAC,CAAc;IACxC,MAAM,GAAG;QACP,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnC,CAAC;IACF,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAChC,WAAW,EAAE,CAAC;IACd,KAAK,GAAG,QAAQ,CAAC;IACjB,OAAO,GAAG,SAAS,CAAC;IACpB,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7C,OAAO,EAAE,CAAC;IACV,UAAU,EAAE,CAAC;IACb,cAAc,EAAE,CAAC;IACjB,MAAM,aAAa,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,WAAW;IAClB,IAAI,OAAO,EAAE,KAAK;QAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,GAAG,SAAS,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,aAAa,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,GAAG,IAAI,CAAC;QACd,OAAO,GAAG,SAAS,CAAC;QACpB,MAAM,MAAM,GAAG,OAAO,EAAE,EAAE,MAAM,CAAC;QACjC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnB,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACvC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK;gBAAE,GAAG,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,kCAAkC,CAAC,CAAC;iBACrI,IAAI,MAAM,KAAK,SAAS;gBAAE,GAAG,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;YAC1E,UAAU,EAAE,CAAC;QACf,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,KAAK,CAAC;QACf,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACjE,uDAAuD;YACvD,GAAG,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAC3D,aAAa,EAAE,CAAC;YAChB,MAAM,GAAG,IAAI,CAAC;YACd,UAAU,CAAC,SAAS,CAAC,CAAC;YACtB,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,aAAa,EAAE,CAAC;YAChB,KAAK,aAAa,EAAE,CAAC;YACrB,KAAK,GAAG,UAAU,CAAC;YACnB,OAAO,GAAG,iEAAiE,CAAC;QAC9E,CAAC;;YAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,cAAc;IACrB,aAAa,EAAE,CAAC;IAChB,cAAc,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,aAAa,EAAE,EAAE,YAAY,CAAC,CAAC;IACvE,cAAc,CAAC,KAAK,EAAE,EAAE,CAAC;IACzB,KAAK,aAAa,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,IAAI,cAAc;QAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAClD,cAAc,GAAG,SAAS,CAAC;AAC7B,CAAC;AAED,0HAA0H;AAC1H,MAAM,UAAU,MAAM;IACpB,aAAa,EAAE,CAAC;IAChB,WAAW,EAAE,CAAC;IACd,KAAK,aAAa,EAAE,CAAC;IACrB,aAAa,EAAE,CAAC;IAChB,MAAM,GAAG,IAAI,CAAC;IACd,UAAU,CAAC,SAAS,CAAC,CAAC;IACtB,aAAa,CAAC,SAAS,CAAC,CAAC;IACzB,MAAM,GAAG,KAAK,CAAC;IACf,eAAe,GAAG,SAAS,CAAC;IAC5B,KAAK,GAAG,UAAU,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IACtC,OAAO,GAAG,SAAS,CAAC;IACpB,OAAO,EAAE,CAAC;IACV,OAAO,WAAW,EAAE,CAAC;AACvB,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,OAAO;IACrB,WAAW,EAAE,CAAC;IACd,aAAa,EAAE,CAAC;IAChB,WAAW,EAAE,CAAC;IACd,KAAK,aAAa,EAAE,CAAC;AACvB,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,QAAQ;IACtB,OAAO,EAAE,CAAC;IACV,MAAM,GAAG,IAAI,CAAC;IACd,UAAU,CAAC,SAAS,CAAC,CAAC;IACtB,aAAa,CAAC,SAAS,CAAC,CAAC;IACzB,KAAK,GAAG,KAAK,CAAC;IACd,OAAO,GAAG,SAAS,CAAC;IACpB,MAAM,GAAG,SAAS,CAAC;IACnB,MAAM,GAAG,KAAK,CAAC;IACf,eAAe,GAAG,SAAS,CAAC;IAC5B,SAAS,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC;AAC5B,4GAA4G;AAC5G,MAAM,CAAC,MAAM,YAAY,GAAG,aAAa,CAAC"}

package/dist/bee/relay-client.js

@@ -0,0 +1,50 @@
+// Phase 6 (docs/tinybee/02-architecture.md section 7): how the Bee reaches bundled AI. With no key of its own,
+// a paired Bee talks to Claude through Hive's relay, authenticated by the relay token it got at pairing. The
+// token stays in memory here (set by pairing.ts) and goes out only as the relay's API key; it is never in a
+// response or a log. The source label tells Hive's metering what asked (a workflow name or `chat`), nothing more.
+import { hiveOrigin } from './hive-client.js';
+import { markRelayExhausted } from './status.js';
+/** Hive names its 402 in this header, so the Bee can mark the budget used up without reading the body. */
+export const RELAY_REFUSAL_HEADER = 'x-tinybee-refusal';
+export const RELAY_SOURCE_HEADER = 'x-tinybee-source';
+let relayToken;
+const listeners = new Set();
+/** pairing.ts: the token of the current pairing, or undefined once unpaired. */
+export function setRelayToken(token) {
+    if (token === relayToken)
+        return;
+    relayToken = token;
+    for (const fn of listeners)
+        fn();
+}
+/** Fires when the relay becomes available or goes away (llm.ts drops its cached backend). */
+export function onRelayChange(fn) {
+    listeners.add(fn);
+    return () => {
+        listeners.delete(fn);
+    };
+}
+export function relayCredentials() {
+    const origin = hiveOrigin();
+    if (!relayToken || !origin)
+        return undefined;
+    return { apiKey: relayToken, baseURL: `${origin}/api/hive/relay/anthropic` };
+}
+let source = 'chat';
+/** The label for the next relayed calls: the workflow engine sets its workflow's name while it runs. */
+export function setRelaySource(label) {
+    source = (label ?? 'chat').replace(/[^\x20-\x7e]/g, '?').slice(0, 80) || 'chat';
+}
+export function relaySource() {
+    return source;
+}
+/** A fetch for the SDK that adds the source label at call time, so one client serves every caller. */
+export async function relayFetch(url, init) {
+    const headers = new Headers(init?.headers);
+    headers.set(RELAY_SOURCE_HEADER, relaySource());
+    const res = await fetch(url, { ...init, headers });
+    if (res.status === 402 && res.headers.get(RELAY_REFUSAL_HEADER) === 'budget_exhausted')
+        markRelayExhausted();
+    return res;
+}
+//# sourceMappingURL=relay-client.js.map

package/dist/bee/relay-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-client.js","sourceRoot":"","sources":["../../src/bee/relay-client.ts"],"names":[],"mappings":"AAAA,+GAA+G;AAC/G,6GAA6G;AAC7G,4GAA4G;AAC5G,kHAAkH;AAClH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,0GAA0G;AAC1G,MAAM,CAAC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AAExD,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AAEtD,IAAI,UAA8B,CAAC;AACnC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAc,CAAC;AAExC,gFAAgF;AAChF,MAAM,UAAU,aAAa,CAAC,KAAyB;IACrD,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO;IACjC,UAAU,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,EAAE,IAAI,SAAS;QAAE,EAAE,EAAE,CAAC;AACnC,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,aAAa,CAAC,EAAc;IAC1C,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,GAAG,EAAE;QACV,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC;AASD,MAAM,UAAU,gBAAgB;IAC9B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC7C,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,2BAA2B,EAAE,CAAC;AAC/E,CAAC;AAED,IAAI,MAAM,GAAG,MAAM,CAAC;AACpB,wGAAwG;AACxG,MAAM,UAAU,cAAc,CAAC,KAAyB;IACtD,MAAM,GAAG,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC;AAClF,CAAC;AACD,MAAM,UAAU,WAAW;IACzB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAA2B,EAAE,IAAkB;IAC9E,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,WAAW,EAAE,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACnD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,kBAAkB;QAAE,kBAAkB,EAAE,CAAC;IAC7G,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/bee/routes.js

@@ -0,0 +1,214 @@
+// Bee HTTP surface:
+//   GET  /setup                 the setup page, loopback only
+//   */   /api/bee/*             the page's JSON API, loopback only, with the page's CSRF token
+//   GET  /api/v1/health         for the phone through the tunnel, with a tenant session JWT from Hive
+import { randomBytes, createPublicKey } from 'node:crypto';
+import { JwtError, verifySession } from '../hive/jwt.js';
+import { JWKS_PATH } from '../hive/routes.js';
+import { isLoopbackHost } from '../loopback.js';
+import { HiveClientError, hiveOrigin } from './hive-client.js';
+import { beeSnapshot, heartbeatNow, refreshHealth, startPairing, submitInstallCode, unpair } from './pairing.js';
+import { qrSvg, setupPageHtml } from './setup-page.js';
+import { fakeTinyBee, fakeTinyBeeOf, setFakeTinyBee, tinybeeHealth } from './status.js';
+import { checkForUpdate, maybeApply, updaterSnapshot } from './updater.js';
+import { setWorkflowsPaused, workflowsPaused } from '../tinybee/workflows/scheduler.js';
+import { hiveConfig } from '../hive/config.js';
+export const SETUP_PATH = '/setup';
+export const BEE_API_PREFIX = '/api/bee';
+export const TENANT_HEALTH_PATH = '/api/v1/health';
+export const SETUP_TOKEN_HEADER = 'x-setup-token';
+export const MENUBAR_HEADER = 'x-tinybee-menubar';
+const JWKS_TTL_MS = 5 * 60 * 1000;
+/** True for a path the Bee authenticates itself (so the localdost token gate skips it). */
+export function beePath(path) {
+    return path === BEE_API_PREFIX || path.startsWith(`${BEE_API_PREFIX}/`) || path === TENANT_HEALTH_PATH || path.startsWith('/api/v1/');
+}
+/** One token per process: the page carries it and sends it back as a header, so another site cannot drive the API. */
+const setupToken = randomBytes(16).toString('hex');
+function hostHeaderIsLoopback(host) {
+    const h = (host ?? '').trim().toLowerCase();
+    if (!h)
+        return false;
+    const name = h.startsWith('[') ? h.slice(0, h.indexOf(']') + 1) : h.replace(/:\d+$/, '');
+    return isLoopbackHost(name) || name.endsWith('.localhost');
+}
+/** The setup page and its API answer only on the loopback socket with a loopback Host header (no DNS rebinding, no tunnel). */
+export function isLocalSetupRequest(req) {
+    const ip = req.socket?.remoteAddress ?? req.ip ?? '';
+    return isLoopbackHost(ip.replace(/^::ffff:/, '')) && hostHeaderIsLoopback(req.headers.host);
+}
+let jwksCache;
+/** Public keys from Hive, cached five minutes; a miss on an unknown kid fetches again once. */
+export async function hiveKeys(opts = {}) {
+    const origin = hiveOrigin();
+    if (!origin)
+        throw new Error('TinyBee is off.');
+    if (!opts.force && jwksCache && Date.now() - jwksCache.at < JWKS_TTL_MS)
+        return jwksCache.keys;
+    const res = await (opts.fetchImpl ?? fetch)(`${origin}${JWKS_PATH}`, { signal: AbortSignal.timeout(5000) });
+    if (!res.ok)
+        throw new Error(`JWKS fetch failed: ${res.status}`);
+    const body = (await res.json());
+    const keys = new Map();
+    for (const jwk of body.keys ?? [])
+        keys.set(jwk.kid, createPublicKey({ key: { ...jwk }, format: 'jwk' }));
+    jwksCache = { at: Date.now(), keys };
+    return keys;
+}
+export function resetHiveKeys() {
+    jwksCache = undefined;
+}
+/** Verifies a Hive session token from the Authorization header. Resolves the claims or sends a 401 and resolves undefined. */
+export async function requireTenantSession(req, reply) {
+    const auth = req.headers.authorization ?? '';
+    const token = auth.startsWith('Bearer ') ? auth.slice(7).trim() : '';
+    if (!token) {
+        void reply.code(401).send({ error: 'session_missing', message: 'Sign in to the TinyBee app first.' });
+        return undefined;
+    }
+    let keys = await hiveKeys();
+    try {
+        try {
+            return verifySession(token, (kid) => keys.get(kid ?? ''));
+        }
+        catch (err) {
+            if (!(err instanceof JwtError) || err.code !== 'unknown_key')
+                throw err;
+            keys = await hiveKeys({ force: true });
+            return verifySession(token, (kid) => keys.get(kid ?? ''));
+        }
+    }
+    catch (err) {
+        const code = err instanceof JwtError ? err.code : 'session_invalid';
+        void reply.code(401).send({ error: code, message: code === 'expired' ? 'Your session expired. Sign in again.' : 'This session is not valid here.' });
+        return undefined;
+    }
+}
+function sendClientError(reply, err) {
+    if (err instanceof HiveClientError)
+        return reply.code(err.status).send({ error: err.code, message: err.message, ...(err.extra ?? {}) });
+    return reply.code(500).send({ error: 'bee_error', message: err instanceof Error ? err.message : String(err) });
+}
+export async function beeRoutes(app) {
+    app.get(SETUP_PATH, async (req, reply) => {
+        if (!isLocalSetupRequest(req))
+            return reply.code(403).type('text/plain').send('Open TinyBee setup on the laptop itself: http://127.0.0.1:<port>/setup');
+        return reply
+            .type('text/html; charset=utf-8')
+            .header('cache-control', 'no-store')
+            .header('content-security-policy', "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src data:; connect-src 'self'")
+            .send(setupPageHtml({ token: setupToken }));
+    });
+    await app.register(async (bee) => {
+        bee.addHook('onRequest', async (req, reply) => {
+            if (!isLocalSetupRequest(req))
+                return reply.code(403).send({ error: 'loopback_only', message: 'TinyBee setup answers only on this laptop.' });
+            if (req.headers[SETUP_TOKEN_HEADER] !== setupToken)
+                return reply.code(403).send({ error: 'setup_token', message: 'Reload the setup page.' });
+        });
+        const withQr = () => {
+            const s = beeSnapshot();
+            return { ...s, qrSvg: s.qr ? qrSvg(s.qr) : undefined };
+        };
+        bee.get('/state', async () => withQr());
+        bee.get('/health', async () => refreshHealth());
+        bee.post('/pair/start', async (req, reply) => {
+            const body = (req.body ?? {});
+            try {
+                await startPairing({ force: body.force === true });
+                return withQr();
+            }
+            catch (err) {
+                return sendClientError(reply, err);
+            }
+        });
+        bee.post('/pair/code', async (req, reply) => {
+            const body = (req.body ?? {});
+            try {
+                await submitInstallCode(body.code);
+                return withQr();
+            }
+            catch (err) {
+                return sendClientError(reply, err);
+            }
+        });
+        bee.post('/unpair', async () => {
+            unpair();
+            return withQr();
+        });
+        // Phase 7: the setup page's "Check for updates" and "Install now" (updater.ts).
+        bee.get('/update', async () => ({ ...updaterSnapshot(), status: tinybeeHealth().update }));
+        bee.post('/update/check', async () => ({ ...updaterSnapshot(), status: await checkForUpdate() }));
+        bee.post('/update/install', async () => ({ ...updaterSnapshot(), requested: maybeApply(Date.now(), { force: true }), status: tinybeeHealth().update }));
+        // Local development only: fake the budget, connections, update and API version that /api/health reports,
+        // so every degraded screen of the app (docs 05 section 10) is reachable. An empty body clears the fake.
+        if (hiveConfig.env === 'local') {
+            bee.post('/dev/fake', async (req) => {
+                const next = fakeTinyBeeOf(req.body);
+                setFakeTinyBee(Object.keys(next).length ? next : undefined);
+                return { ok: true, fake: fakeTinyBee() ?? null };
+            });
+            // One heartbeat now, so a test does not wait for the 30 s timer after Hive's /dev/bee set the Bee offline.
+            bee.post('/dev/heartbeat', async () => {
+                await heartbeatNow();
+                return beeSnapshot();
+            });
+        }
+    }, { prefix: BEE_API_PREFIX });
+    // The menu bar app (packaging/macos/MenuBar): loopback only, and a custom header instead of the page token,
+    // which a browser page cannot add cross-site without a preflight this server never answers.
+    await app.register(async (bar) => {
+        bar.addHook('onRequest', async (req, reply) => {
+            if (!isLocalSetupRequest(req))
+                return reply.code(403).send({ error: 'loopback_only', message: 'TinyBee answers the menu bar only on this laptop.' });
+            if (req.headers[MENUBAR_HEADER] !== '1')
+                return reply.code(403).send({ error: 'menubar_header', message: `Send ${MENUBAR_HEADER}: 1.` });
+        });
+        bar.get('/status', async () => {
+            const s = beeSnapshot();
+            const h = tinybeeHealth();
+            return {
+                stage: s.stage,
+                online: s.online,
+                hostname: s.paired?.hostname ?? null,
+                tunnel: s.tunnel?.state ?? 'off',
+                paused: workflowsPaused(),
+                update: h.update,
+                budget: h.budget,
+                version: h.update.current,
+            };
+        });
+        bar.post('/pause', async (req) => {
+            const body = (req.body ?? {});
+            setWorkflowsPaused(body.paused !== false);
+            return { paused: workflowsPaused() };
+        });
+        bar.post('/update/check', async () => ({ update: await checkForUpdate() }));
+        bar.post('/update/install', async () => ({ requested: maybeApply(Date.now(), { force: true }), update: tinybeeHealth().update }));
+    }, { prefix: `${BEE_API_PREFIX}/menubar` });
+    // The phone's first call through the tunnel (docs 02 section 6): proves the tunnel and the JWT work end to end.
+    app.get(TENANT_HEALTH_PATH, async (req, reply) => {
+        const claims = await requireTenantSession(req, reply);
+        if (!claims)
+            return reply;
+        const s = beeSnapshot();
+        // A session minted before the account had a tenant carries no tenant_id: the app refreshes it after sign-up.
+        if (!claims.tenant_id)
+            return reply.code(403).send({ error: 'no_tenant', message: 'Your session has no account yet. Sign in again.' });
+        if (!s.paired || claims.tenant_id !== s.paired.tenant_id)
+            return reply.code(403).send({ error: 'wrong_tenant', message: 'This laptop belongs to another account.' });
+        return reply.header('cache-control', 'no-store').send({
+            ok: true,
+            bee_id: s.paired.bee_id,
+            bee_name: s.paired.bee_name,
+            hostname: s.paired.hostname,
+            online: s.online,
+            health: s.health,
+            tunnel: s.tunnel
+                ? { state: s.tunnel.state, protocol: s.tunnel.protocol, connections: s.tunnel.connections, connectedAt: s.tunnel.connectedAt }
+                : undefined,
+            version: 1,
+        });
+    });
+}
+//# sourceMappingURL=routes.js.map

package/dist/bee/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/bee/routes.ts"],"names":[],"mappings":"AAAA,oBAAoB;AACpB,8DAA8D;AAC9D,+FAA+F;AAC/F,sGAAsG;AACtG,OAAO,EAAE,WAAW,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAC;AAE3E,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAsB,MAAM,gBAAgB,CAAC;AAE7E,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACjH,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC;AACnC,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;AACzC,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AACnD,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAClD,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAClD,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAElC,2FAA2F;AAC3F,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,IAAI,KAAK,cAAc,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,cAAc,GAAG,CAAC,IAAI,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACxI,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAEnD,SAAS,oBAAoB,CAAC,IAAwB;IACpD,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACzF,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AAC7D,CAAC;AAED,+HAA+H;AAC/H,MAAM,UAAU,mBAAmB,CAAC,GAAmB;IACrD,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;IACrD,OAAO,cAAc,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAC9F,CAAC;AAED,IAAI,SAAmE,CAAC;AAExE,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAsD,EAAE;IACrF,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,EAAE,GAAG,WAAW;QAAE,OAAO,SAAS,CAAC,IAAI,CAAC;IAC/F,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,MAAM,GAAG,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5G,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE;QAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC1G,SAAS,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC;IACrC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,SAAS,GAAG,SAAS,CAAC;AACxB,CAAC;AAED,8HAA8H;AAC9H,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAmB,EAAE,KAAmB;IACjF,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC;QACtG,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,IAAI,CAAC;YACH,OAAO,aAAa,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa;gBAAE,MAAM,GAAG,CAAC;YACxE,IAAI,GAAG,MAAM,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACvC,OAAO,aAAa,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,GAAG,YAAY,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC;QACpE,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,iCAAiC,EAAE,CAAC,CAAC;QACrJ,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAmB,EAAE,GAAY;IACxD,IAAI,GAAG,YAAY,eAAe;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IACxI,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACjH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAoB;IAClD,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACvC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;QACxJ,OAAO,KAAK;aACT,IAAI,CAAC,0BAA0B,CAAC;aAChC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;aACnC,MAAM,CAAC,yBAAyB,EAAE,8GAA8G,CAAC;aACjJ,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAChB,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAC5C,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAAC;YAC9I,IAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAC/I,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC;YACxB,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QACzD,CAAC,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QACxC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;QAChD,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAC3C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAwB,CAAC;YACrD,IAAI,CAAC;gBACH,MAAM,YAAY,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC,CAAC;gBACnD,OAAO,MAAM,EAAE,CAAC;YAClB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACrC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAC1C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAuB,CAAC;YACpD,IAAI,CAAC;gBACH,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnC,OAAO,MAAM,EAAE,CAAC;YAClB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACrC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;YAC7B,MAAM,EAAE,CAAC;YACT,OAAO,MAAM,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,gFAAgF;QAChF,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,eAAe,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC3F,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,eAAe,EAAE,EAAE,MAAM,EAAE,MAAM,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;QAClG,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,eAAe,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACxJ,yGAAyG;QACzG,wGAAwG;QACxG,IAAI,UAAU,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAClC,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAC5D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC;YACnD,CAAC,CAAC,CAAC;YACH,2GAA2G;YAC3G,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,IAAI,EAAE;gBACpC,MAAM,YAAY,EAAE,CAAC;gBACrB,OAAO,WAAW,EAAE,CAAC;YACvB,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,EACD,EAAE,MAAM,EAAE,cAAc,EAAE,CAC3B,CAAC;IAEF,4GAA4G;IAC5G,4FAA4F;IAC5F,MAAM,GAAG,CAAC,QAAQ,CAChB,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAC5C,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CAAC;YACrJ,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,GAAG;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,cAAc,MAAM,EAAE,CAAC,CAAC;QAC3I,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;YAC5B,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,aAAa,EAAE,CAAC;YAC1B,OAAO;gBACL,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,IAAI,IAAI;gBACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,IAAI,KAAK;gBAChC,MAAM,EAAE,eAAe,EAAE;gBACzB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO;aAC1B,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC/B,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAyB,CAAC;YACtD,kBAAkB,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC;YAC1C,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,CAAC;QACvC,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5E,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACpI,CAAC,EACD,EAAE,MAAM,EAAE,GAAG,cAAc,UAAU,EAAE,CACxC,CAAC;IAEF,gHAAgH;IAChH,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC/C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC;QACxB,6GAA6G;QAC7G,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC,CAAC;QACvI,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS;YACtD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC,CAAC;QAC7G,OAAO,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC;YACpD,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM;YACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ;YAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ;YAC3B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM;gBACd,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE;gBAC9H,CAAC,CAAC,SAAS;YACb,OAAO,EAAE,CAAC;SACX,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}