tinybeeai 0.0.0-stage → 0.16.1

package/dist/hive/embed.js

@@ -0,0 +1,76 @@
+import { hiveConfig } from './config.js';
+import { HIVE_PREFIX, JWKS_PATH, hiveRoutes, wellKnownRoutes } from './routes.js';
+export function hiveMode(env = process.env) {
+    if ((env.TINYBEE_HIVE_URL ?? '').trim())
+        return 'proxy';
+    return hiveConfig.env === 'local' ? 'embedded' : 'off';
+}
+const HOP_BY_HOP = new Set([
+    'connection',
+    'keep-alive',
+    'transfer-encoding',
+    'te',
+    'trailer',
+    'upgrade',
+    'proxy-authorization',
+    'proxy-authenticate',
+    'host',
+    'content-length',
+]);
+/** Mounts the embedded Hive or the proxy on the localdost app. Returns the mode it picked. */
+export async function mountHive(app) {
+    const mode = hiveMode();
+    if (mode === 'embedded') {
+        await app.register(wellKnownRoutes);
+        await app.register(hiveRoutes, { prefix: HIVE_PREFIX, embedded: true });
+        return mode;
+    }
+    if (mode === 'proxy') {
+        const base = (process.env.TINYBEE_HIVE_URL ?? '').trim().replace(/\/+$/, '');
+        // Verifiers of tenant sessions (the Bee's own /api/v1/health, for one) read the JWKS from this origin too.
+        app.get(JWKS_PATH, async (_req, reply) => {
+            try {
+                const res = await fetch(`${base}${JWKS_PATH}`);
+                reply.code(res.status).header('Cache-Control', res.headers.get('cache-control') ?? 'public, max-age=300');
+                return reply.send(Buffer.from(await res.arrayBuffer()));
+            }
+            catch (err) {
+                return reply
+                    .code(502)
+                    .send({ error: `Hive is not reachable at ${base}: ${err instanceof Error ? err.message : String(err)}`, code: 'hive_unreachable' });
+            }
+        });
+        await app.register(async (p) => {
+            p.removeAllContentTypeParsers();
+            p.addContentTypeParser('*', { parseAs: 'buffer' }, (_req, body, done) => done(null, body));
+            p.all('/*', async (req, reply) => {
+                const target = `${base}${req.url}`;
+                const headers = {};
+                for (const [k, v] of Object.entries(req.headers))
+                    if (v && !HOP_BY_HOP.has(k))
+                        headers[k] = Array.isArray(v) ? v.join(', ') : v;
+                headers['x-forwarded-host'] = req.headers.host ?? '';
+                headers['x-forwarded-proto'] = req.protocol;
+                const hasBody = !['GET', 'HEAD'].includes(req.method);
+                let res;
+                try {
+                    res = await fetch(target, { method: req.method, headers, body: hasBody ? req.body : undefined, redirect: 'manual' });
+                }
+                catch (err) {
+                    return reply
+                        .code(502)
+                        .send({ error: `Hive is not reachable at ${base}: ${err instanceof Error ? err.message : String(err)}`, code: 'hive_unreachable' });
+                }
+                reply.code(res.status);
+                res.headers.forEach((v, k) => {
+                    if (!HOP_BY_HOP.has(k) && k !== 'content-encoding')
+                        reply.header(k, v);
+                });
+                return reply.send(Buffer.from(await res.arrayBuffer()));
+            });
+        }, { prefix: HIVE_PREFIX });
+        return mode;
+    }
+    return mode;
+}
+//# sourceMappingURL=embed.js.map

package/dist/hive/embed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"embed.js","sourceRoot":"","sources":["../../src/hive/embed.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAIlF,MAAM,UAAU,QAAQ,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC3D,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAAE,OAAO,OAAO,CAAC;IACxD,OAAO,UAAU,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,YAAY;IACZ,YAAY;IACZ,mBAAmB;IACnB,IAAI;IACJ,SAAS;IACT,SAAS;IACT,qBAAqB;IACrB,oBAAoB;IACpB,MAAM;IACN,gBAAgB;CACjB,CAAC,CAAC;AAEH,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAoB;IAClD,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,MAAM,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QACpC,MAAM,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,2GAA2G;QAC3G,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YACvC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,GAAG,SAAS,EAAE,CAAC,CAAC;gBAC/C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,qBAAqB,CAAC,CAAC;gBAC1G,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC1D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,KAAK;qBACT,IAAI,CAAC,GAAG,CAAC;qBACT,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACxI,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,CAAC,QAAQ,CAChB,KAAK,EAAE,CAAC,EAAE,EAAE;YACV,CAAC,CAAC,2BAA2B,EAAE,CAAC;YAChC,CAAC,CAAC,oBAAoB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YAC3F,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;gBAC/B,MAAM,MAAM,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC;gBACnC,MAAM,OAAO,GAA2B,EAAE,CAAC;gBAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;wBAAE,OAAO,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAChI,OAAO,CAAC,kBAAkB,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrD,OAAO,CAAC,mBAAmB,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC;gBAC5C,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACtD,IAAI,GAAa,CAAC;gBAClB,IAAI,CAAC;oBACH,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAE,GAAG,CAAC,IAAe,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACnI,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,KAAK;yBACT,IAAI,CAAC,GAAG,CAAC;yBACT,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBACxI,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACvB,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;oBAC3B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,kBAAkB;wBAAE,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACzE,CAAC,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC1D,CAAC,CAAC,CAAC;QACL,CAAC,EACD,EAAE,MAAM,EAAE,WAAW,EAAE,CACxB,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/hive/errors.js

@@ -0,0 +1,17 @@
+// One error shape for every Hive route: an HTTP status, a stable code the app switches on, and a
+// sentence a person can read. Routes throw it; the Hive plugin turns it into the response.
+export class HiveError extends Error {
+    status;
+    code;
+    extra;
+    constructor(status, code, message, extra = {}) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.extra = extra;
+    }
+    body() {
+        return { error: this.message, code: this.code, ...this.extra };
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/hive/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/hive/errors.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,2FAA2F;AAC3F,MAAM,OAAO,SAAU,SAAQ,KAAK;IAEvB;IACA;IAEA;IAJX,YACW,MAAc,EACd,IAAY,EACrB,OAAe,EACN,QAAiC,EAAE;QAE5C,KAAK,CAAC,OAAO,CAAC,CAAC;QALN,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAEZ,UAAK,GAAL,KAAK,CAA8B;IAG9C,CAAC;IACD,IAAI;QACF,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;IACjE,CAAC;CACF"}

package/dist/hive/google.js

@@ -0,0 +1,75 @@
+// Google sign-in (FR-H1): the app signs in with Google on the phone and sends Hive the ID token. Hive
+// checks it against Google's published keys and the client id in HIVE_GOOGLE_CLIENT_ID. Until that
+// id is set (docs/tinybee/OPEN-QUESTIONS.md item 3) the route answers 503 google_not_configured.
+import { createPublicKey } from 'node:crypto';
+import { HiveError } from './errors.js';
+import { JwtError, verifySession } from './jwt.js';
+const CERTS_URL = 'https://www.googleapis.com/oauth2/v3/certs';
+const ISSUERS = new Set(['accounts.google.com', 'https://accounts.google.com']);
+let fetchCerts = async () => {
+    const res = await fetch(CERTS_URL);
+    if (!res.ok)
+        throw new Error(`Google certs answered ${res.status}`);
+    return (await res.json());
+};
+let cache;
+async function googleKeys(now) {
+    if (cache && cache.until > now)
+        return cache.keys;
+    const { keys } = await fetchCerts();
+    const map = new Map();
+    for (const k of keys)
+        if (k.kty === 'RSA')
+            map.set(k.kid, createPublicKey({ key: { kty: 'RSA', n: k.n, e: k.e }, format: 'jwk' }));
+    cache = { keys: map, until: now + 60 * 60 * 1000 };
+    return map;
+}
+export const googleClientId = () => (process.env.HIVE_GOOGLE_CLIENT_ID || '').trim() || undefined;
+/** Checks a Google ID token and returns who it names. Throws HiveError with a code the app can show. */
+export async function verifyGoogleIdToken(rawToken, now = Date.now()) {
+    const aud = googleClientId();
+    if (!aud)
+        throw new HiveError(503, 'google_not_configured', 'Google sign-in is not set up on this Hive yet. Use your email instead.');
+    const token = typeof rawToken === 'string' ? rawToken.trim() : '';
+    if (!token)
+        throw new HiveError(400, 'google_token_invalid', 'The Google sign-in did not finish. Try again.');
+    let keys = await googleKeys(now);
+    const kidOf = (t) => {
+        try {
+            return JSON.parse(Buffer.from(t.split('.')[0], 'base64url').toString('utf8')).kid;
+        }
+        catch {
+            return undefined;
+        }
+    };
+    // A key Google rotated in since the cache was filled: fetch once more before giving up.
+    const kid = kidOf(token);
+    if (kid && !keys.has(kid)) {
+        cache = undefined;
+        keys = await googleKeys(now);
+    }
+    let claims;
+    try {
+        claims = verifySession(token, (k) => (k ? keys.get(k) : undefined), now);
+    }
+    catch (err) {
+        const code = err instanceof JwtError ? err.code : 'malformed';
+        throw new HiveError(400, 'google_token_invalid', code === 'expired' ? 'The Google sign-in expired. Try again.' : 'The Google sign-in could not be checked. Try again.');
+    }
+    if (!claims.iss || !ISSUERS.has(claims.iss) || claims.aud !== aud || !claims.sub || !claims.email)
+        throw new HiveError(400, 'google_token_invalid', 'The Google sign-in was not meant for TinyBee.');
+    return { sub: claims.sub, email: claims.email, emailVerified: claims.email_verified === true || claims.email_verified === 'true', name: claims.name ?? null };
+}
+/** Tests point this at their own key set. */
+export function setGoogleCertsFetcher(fn) {
+    cache = undefined;
+    fetchCerts =
+        fn ??
+            (async () => {
+                const res = await fetch(CERTS_URL);
+                if (!res.ok)
+                    throw new Error(`Google certs answered ${res.status}`);
+                return (await res.json());
+            });
+}
+//# sourceMappingURL=google.js.map

package/dist/hive/google.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.js","sourceRoot":"","sources":["../../src/hive/google.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,mGAAmG;AACnG,iGAAiG;AACjG,OAAO,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEnD,MAAM,SAAS,GAAG,4CAA4C,CAAC;AAC/D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,qBAAqB,EAAE,6BAA6B,CAAC,CAAC,CAAC;AAkBhF,IAAI,UAAU,GAAiB,KAAK,IAAI,EAAE;IACxC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;AACrD,CAAC,CAAC;AACF,IAAI,KAAkE,CAAC;AAEvE,KAAK,UAAU,UAAU,CAAC,GAAW;IACnC,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IAClD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAqB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,IAAI,CAAC,CAAC,GAAG,KAAK,KAAK;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACnI,KAAK,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IACnD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,GAAuB,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;AAEtH,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAiB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACnF,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,uBAAuB,EAAE,wEAAwE,CAAC,CAAC;IACtI,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,sBAAsB,EAAE,+CAA+C,CAAC,CAAC;IAC9G,IAAI,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,CAAC,CAAS,EAAsB,EAAE;QAC9C,IAAI,CAAC;YACH,OAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsB,CAAC,GAAG,CAAC;QAC1G,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IACF,wFAAwF;IACxF,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,KAAK,GAAG,SAAS,CAAC;QAClB,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,GAAG,CAOtE,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,GAAG,YAAY,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;QAC9D,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,sBAAsB,EACtB,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,qDAAqD,CACtH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK;QAC/F,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,sBAAsB,EAAE,+CAA+C,CAAC,CAAC;IACpG,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,cAAc,KAAK,IAAI,IAAI,MAAM,CAAC,cAAc,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;AAChK,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,qBAAqB,CAAC,EAA4B;IAChE,KAAK,GAAG,SAAS,CAAC;IAClB,UAAU;QACR,EAAE;YACF,CAAC,KAAK,IAAI,EAAE;gBACV,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;gBACnC,IAAI,CAAC,GAAG,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpE,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;YACrD,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/hive/index.js

@@ -0,0 +1,25 @@
+// Hive entrypoint: `node dist/hive/index.js` on Railway, `npm run hive` in a checkout.
+import { hiveConfig, hiveLog } from './config.js';
+import { signingKey } from './keys.js';
+import { buildHiveServer } from './server.js';
+import { tunnelProvider } from './tunnel/provider.js';
+async function main() {
+    if (!hiveConfig.env)
+        hiveLog.warn('TINYBEE_ENV is unset; running as local');
+    const key = signingKey();
+    const app = await buildHiveServer();
+    await app.listen({ port: hiveConfig.port, host: hiveConfig.host });
+    hiveLog.info(`Hive on http://localhost:${hiveConfig.port} (${hiveConfig.env ?? 'local'}, tenants under *.${hiveConfig.tenantHost}, tunnels: ${tunnelProvider().name}, jwt kid ${key.kid})`);
+    const stop = async (sig) => {
+        hiveLog.info(`${sig}: shutting down`);
+        await app.close();
+        process.exit(0);
+    };
+    process.on('SIGINT', () => void stop('SIGINT'));
+    process.on('SIGTERM', () => void stop('SIGTERM'));
+}
+main().catch((err) => {
+    hiveLog.error('boot failed', err);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/hive/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/hive/index.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC,UAAU,CAAC,GAAG;QAAE,OAAO,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,GAAG,GAAG,MAAM,eAAe,EAAE,CAAC;IACpC,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACnE,OAAO,CAAC,IAAI,CACV,4BAA4B,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,GAAG,IAAI,OAAO,qBAAqB,UAAU,CAAC,UAAU,cAAc,cAAc,EAAE,CAAC,IAAI,aAAa,GAAG,CAAC,GAAG,GAAG,CAC9K,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,EAAE,GAAW,EAAE,EAAE;QACjC,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,iBAAiB,CAAC,CAAC;QACtC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/hive/jwt.js

@@ -0,0 +1,57 @@
+// Tenant session JWTs (docs/tinybee/02-architecture-pairing.md section 3): RS256, signed with Hive's
+// key, verified by the edge and by every Bee against /.well-known/jwks.json. No library: node:crypto
+// signs and verifies, and the token is small enough to assemble by hand.
+import { createSign, createVerify } from 'node:crypto';
+import { signingKey } from './keys.js';
+export const ACCESS_TOKEN_TTL_SEC = 60 * 60;
+const b64 = (v) => Buffer.from(v).toString('base64url');
+/** Signs the claims with the current key. `exp` and `iat` are filled in from `ttlSec`. */
+export function signSession(claims, opts = {}) {
+    const key = signingKey();
+    const iat = Math.floor((opts.now ?? Date.now()) / 1000);
+    const body = { ...claims, iss: 'tinybee-hive', iat, exp: iat + (opts.ttlSec ?? ACCESS_TOKEN_TTL_SEC) };
+    const head = b64(JSON.stringify({ alg: 'RS256', typ: 'JWT', kid: key.kid }));
+    const payload = b64(JSON.stringify(body));
+    const sig = createSign('RSA-SHA256').update(`${head}.${payload}`).sign(key.privateKey);
+    return `${head}.${payload}.${b64(sig)}`;
+}
+export class JwtError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+    }
+}
+/** Verifies a token against a public key picked by kid. Throws JwtError. */
+export function verifySession(token, keyFor, now = Date.now()) {
+    const parts = token.split('.');
+    if (parts.length !== 3)
+        throw new JwtError('token is not a JWT', 'malformed');
+    const [head, payload, sig] = parts;
+    let header;
+    let claims;
+    try {
+        header = JSON.parse(Buffer.from(head, 'base64url').toString('utf8'));
+        claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+    }
+    catch {
+        throw new JwtError('token is not a JWT', 'malformed');
+    }
+    if (header.alg !== 'RS256')
+        throw new JwtError(`unsupported alg ${String(header.alg)}`, 'malformed');
+    const key = keyFor(header.kid);
+    if (!key)
+        throw new JwtError('no key for this kid', 'unknown_key');
+    const ok = createVerify('RSA-SHA256').update(`${head}.${payload}`).verify(key, Buffer.from(sig, 'base64url'));
+    if (!ok)
+        throw new JwtError('bad signature', 'bad_signature');
+    if (typeof claims.exp !== 'number' || claims.exp * 1000 <= now)
+        throw new JwtError('token expired', 'expired');
+    return claims;
+}
+/** Verifies a token Hive itself issued. */
+export function verifyOwnSession(token, now) {
+    const key = signingKey();
+    return verifySession(token, (kid) => (kid === key.kid ? key.publicKey : undefined), now);
+}
+//# sourceMappingURL=jwt.js.map

package/dist/hive/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/hive/jwt.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,qGAAqG;AACrG,yEAAyE;AACzE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAkB,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,CAAC;AAc5C,MAAM,GAAG,GAAG,CAAC,CAAkB,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEjF,0FAA0F;AAC1F,MAAM,UAAU,WAAW,CAAC,MAAkD,EAAE,OAA0C,EAAE;IAC1H,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACxD,MAAM,IAAI,GAAkB,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,oBAAoB,CAAC,EAAE,CAAC;IACtH,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvF,OAAO,GAAG,IAAI,IAAI,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,OAAO,QAAS,SAAQ,KAAK;IAGtB;IAFX,YACE,OAAe,EACN,IAA+D;QAExE,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,SAAI,GAAJ,IAAI,CAA2D;IAG1E,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,MAA0D,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IAC/H,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;IAC9E,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;IACnC,IAAI,MAAsC,CAAC;IAC3C,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAmC,CAAC;QACvG,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAkB,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,MAAM,IAAI,QAAQ,CAAC,mBAAmB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IACrG,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,QAAQ,CAAC,qBAAqB,EAAE,aAAa,CAAC,CAAC;IACnE,MAAM,EAAE,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;IAC9G,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC9D,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,IAAI,GAAG;QAAE,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IAC/G,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,GAAY;IAC1D,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,OAAO,aAAa,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;AAC3F,CAAC"}

package/dist/hive/keys.js

@@ -0,0 +1,61 @@
+// The RS256 key that signs tenant session JWTs (docs/tinybee/02-architecture-pairing.md section 3).
+// Hive publishes the public half at /.well-known/jwks.json; the edge Worker and every Bee verify
+// tokens against it without a round trip to Hive.
+//
+// The private key comes from HIVE_JWT_PRIVATE_KEY (PEM, PKCS8) with HIVE_JWT_KID. When they are unset,
+// a 2048-bit key is generated once into <dataDir>/hive-jwt.json, like the VAPID keys of localdost, so a
+// local or staging Hive keeps its identity across restarts. A production Hive must set the env vars.
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { hiveConfig, hiveLog } from './config.js';
+let current;
+/** RFC 7638 thumbprint of the public key, used as the kid when none is configured. */
+function thumbprint(publicKey) {
+    const jwk = publicKey.export({ format: 'jwk' });
+    const canonical = JSON.stringify({ e: jwk.e, kty: 'RSA', n: jwk.n });
+    return createHash('sha256').update(canonical).digest('base64url').slice(0, 16);
+}
+function fromPem(pem, kid) {
+    const privateKey = createPrivateKey(pem.includes('\\n') ? pem.replace(/\\n/g, '\n') : pem);
+    if (privateKey.asymmetricKeyType !== 'rsa')
+        throw new Error('HIVE_JWT_PRIVATE_KEY must be an RSA key');
+    const publicKey = createPublicKey(privateKey);
+    return { kid: kid || thumbprint(publicKey), privateKey, publicKey };
+}
+/** The signing key: env, then the generated file, else a fresh key written to the file. */
+export function signingKey() {
+    if (current)
+        return current;
+    if (hiveConfig.jwt.privateKey)
+        return (current = fromPem(hiveConfig.jwt.privateKey, hiveConfig.jwt.kid));
+    const file = join(hiveConfig.dataDir, 'hive-jwt.json');
+    if (existsSync(file)) {
+        try {
+            const v = JSON.parse(readFileSync(file, 'utf8'));
+            if (v.privateKey)
+                return (current = fromPem(v.privateKey, v.kid));
+        }
+        catch (err) {
+            hiveLog.warn(`${file} is unreadable (${String(err)}); generating a new signing key`);
+        }
+    }
+    const pair = generateKeyPairSync('rsa', { modulusLength: 2048 });
+    const pem = pair.privateKey.export({ format: 'pem', type: 'pkcs8' });
+    const key = fromPem(pem);
+    mkdirSync(hiveConfig.dataDir, { recursive: true });
+    writeFileSync(file, JSON.stringify({ kid: key.kid, privateKey: pem }, null, 2), { mode: 0o600 });
+    hiveLog.info(`generated the JWT signing key into ${file} (kid ${key.kid})`);
+    return (current = key);
+}
+/** The public key set served at /.well-known/jwks.json. */
+export function jwks() {
+    const k = signingKey();
+    const pub = k.publicKey.export({ format: 'jwk' });
+    return { keys: [{ kty: 'RSA', kid: k.kid, use: 'sig', alg: 'RS256', n: pub.n, e: pub.e }] };
+}
+/** Tests swap the key; production code never calls this. */
+export function resetSigningKey() {
+    current = undefined;
+}
+//# sourceMappingURL=keys.js.map

package/dist/hive/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/hive/keys.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,iGAAiG;AACjG,kDAAkD;AAClD,EAAE;AACF,uGAAuG;AACvG,wGAAwG;AACxG,qGAAqG;AACrG,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAkB,MAAM,aAAa,CAAC;AACjH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAiBlD,IAAI,OAA+B,CAAC;AAEpC,sFAAsF;AACtF,SAAS,UAAU,CAAC,SAAoB;IACtC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAA6B,CAAC;IAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IACrE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,GAAY;IACxC,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3F,IAAI,UAAU,CAAC,iBAAiB,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACvG,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AACtE,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,UAAU;IACxB,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,IAAI,UAAU,CAAC,GAAG,CAAC,UAAU;QAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACzG,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACvD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA0C,CAAC;YAC1F,IAAI,CAAC,CAAC,UAAU;gBAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,mBAAmB,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAW,CAAC;IAC/E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACzB,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjG,OAAO,CAAC,IAAI,CAAC,sCAAsC,IAAI,SAAS,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;IAC5E,OAAO,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,IAAI;IAClB,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAA6B,CAAC;IAC9E,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,eAAe;IAC7B,OAAO,GAAG,SAAS,CAAC;AACtB,CAAC"}

package/dist/hive/mail.js

@@ -0,0 +1,27 @@
+// How Hive sends a one-time code (docs/tinybee/OPEN-QUESTIONS.md item 4). HIVE_MAIL_PROVIDER picks the
+// sender: `console` writes the code to the Hive log, which is what local development and the first
+// staging runs use; a real provider is added behind the same interface once one is chosen. A prod
+// Hive refuses to start on the console sender.
+import { hiveConfig, hiveLog } from './config.js';
+export class ConsoleMailer {
+    name = 'console';
+    async sendOtp(mail) {
+        hiveLog.info(`sign-in code for ${mail.to}: ${mail.code} (expires in ${mail.expiresInMin} min)`);
+    }
+}
+let current;
+export function mailer() {
+    if (current)
+        return current;
+    const name = (process.env.HIVE_MAIL_PROVIDER || 'console').trim().toLowerCase();
+    if (name !== 'console')
+        throw new Error(`HIVE_MAIL_PROVIDER=${name} is not supported yet; only console is`);
+    if (hiveConfig.env === 'prod')
+        throw new Error('a prod Hive cannot send sign-in codes to the console; set HIVE_MAIL_PROVIDER');
+    return (current = new ConsoleMailer());
+}
+/** Tests swap the sender to read the code back. */
+export function setMailer(m) {
+    current = m;
+}
+//# sourceMappingURL=mail.js.map

package/dist/hive/mail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail.js","sourceRoot":"","sources":["../../src/hive/mail.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,mGAAmG;AACnG,kGAAkG;AAClG,+CAA+C;AAC/C,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAalD,MAAM,OAAO,aAAa;IACf,IAAI,GAAG,SAAS,CAAC;IAC1B,KAAK,CAAC,OAAO,CAAC,IAAa;QACzB,OAAO,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,gBAAgB,IAAI,CAAC,YAAY,OAAO,CAAC,CAAC;IAClG,CAAC;CACF;AAED,IAAI,OAA2B,CAAC;AAEhC,MAAM,UAAU,MAAM;IACpB,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChF,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,wCAAwC,CAAC,CAAC;IAC5G,IAAI,UAAU,CAAC,GAAG,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAC/H,OAAO,CAAC,OAAO,GAAG,IAAI,aAAa,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,SAAS,CAAC,CAAqB;IAC7C,OAAO,GAAG,CAAC,CAAC;AACd,CAAC"}

package/dist/hive/native-push.js

@@ -0,0 +1,255 @@
+// Native push from Hive to the store apps (docs/tinybee/06-environments-and-delivery.md, Phase 7). The
+// Android app registers an FCM token and the iOS app an APNs token; Hive sends the same HivePushPayload
+// it sends over web push. Both channels are plain HTTPS from node: FCM HTTP v1 with a service-account
+// JWT exchanged for an OAuth token, APNs with an ES256 provider token over HTTP/2. A channel without its
+// credentials is off: devices still register, sends are counted as skipped, nothing is thrown.
+//
+// Env (all on the hive service): FCM_SERVICE_ACCOUNT_JSON; APNS_KEY_P8, APNS_KEY_ID, APNS_TEAM_ID,
+// APNS_BUNDLE_ID (default ai.tinybee.app), APNS_ENV (production | sandbox).
+import { connect, constants as h2 } from 'node:http2';
+import { createPrivateKey, sign as cryptoSign } from 'node:crypto';
+import { hiveLog } from './config.js';
+/** Thrown when the platform dropped the token: the row is deleted, like a 410 from a web push service. */
+export class DeviceGone extends Error {
+    reason;
+    constructor(reason) {
+        super(`device gone: ${reason}`);
+        this.reason = reason;
+    }
+}
+const b64url = (data) => Buffer.from(data).toString('base64url');
+function jwt(header, claims, key, alg) {
+    const signingInput = `${b64url(JSON.stringify(header))}.${b64url(JSON.stringify(claims))}`;
+    const sig = alg === 'RS256'
+        ? cryptoSign('RSA-SHA256', Buffer.from(signingInput), key)
+        : cryptoSign('sha256', Buffer.from(signingInput), { key, dsaEncoding: 'ieee-p1363' });
+    return `${signingInput}.${b64url(sig)}`;
+}
+let fcmAccount;
+let fcmKey;
+let fcmToken;
+let fcmTokenPending;
+function serviceAccount() {
+    if (fcmAccount !== undefined)
+        return fcmAccount;
+    const raw = process.env.FCM_SERVICE_ACCOUNT_JSON?.trim();
+    if (!raw)
+        return (fcmAccount = null);
+    try {
+        const o = JSON.parse(raw);
+        if (!o.project_id || !o.client_email || !o.private_key)
+            throw new Error('project_id, client_email and private_key are required');
+        fcmKey = createPrivateKey(o.private_key.replace(/\\n/g, '\n'));
+        fcmAccount = { project_id: o.project_id, client_email: o.client_email, private_key: '', token_uri: o.token_uri };
+    }
+    catch (err) {
+        hiveLog.warn(`native push: FCM_SERVICE_ACCOUNT_JSON is not usable: ${err instanceof Error ? err.message : String(err)}`);
+        fcmAccount = null;
+    }
+    return fcmAccount;
+}
+/** One exchange at a time: parallel sends share the pending request. */
+function fcmAccessToken(now) {
+    if (fcmToken && fcmToken.expiresAt - 60_000 > now)
+        return Promise.resolve(fcmToken.value);
+    if (!fcmTokenPending)
+        fcmTokenPending = exchangeFcmToken(now).finally(() => (fcmTokenPending = undefined));
+    return fcmTokenPending;
+}
+async function exchangeFcmToken(now) {
+    const acct = serviceAccount();
+    const tokenUri = acct.token_uri || 'https://oauth2.googleapis.com/token';
+    const iat = Math.floor(now / 1000);
+    const assertion = jwt({ alg: 'RS256', typ: 'JWT' }, { iss: acct.client_email, scope: 'https://www.googleapis.com/auth/firebase.messaging', aud: tokenUri, iat, exp: iat + 3600 }, fcmKey, 'RS256');
+    const body = new URLSearchParams({ grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer', assertion }).toString();
+    const res = await transport({ channel: 'fcm-oauth', method: 'POST', url: tokenUri, headers: { 'content-type': 'application/x-www-form-urlencoded' }, body });
+    if (res.status !== 200)
+        throw new Error(`FCM oauth ${res.status}`);
+    const o = JSON.parse(res.body);
+    fcmToken = { value: o.access_token, expiresAt: now + (o.expires_in ?? 3600) * 1000 };
+    return o.access_token;
+}
+async function sendFcm(device, payload, now) {
+    const acct = serviceAccount();
+    const access = await fcmAccessToken(now);
+    const message = {
+        message: {
+            token: device.token,
+            notification: { title: payload.title, body: payload.body },
+            data: { url: payload.url, tag: payload.tag, urgency: payload.urgency },
+            android: {
+                priority: payload.urgency === 'high' ? 'high' : 'normal',
+                collapse_key: payload.tag,
+                ttl: '3600s',
+                notification: { tag: payload.tag, click_action: 'ai.tinybee.OPEN' },
+            },
+        },
+    };
+    const res = await transport({
+        channel: 'fcm',
+        method: 'POST',
+        url: `https://fcm.googleapis.com/v1/projects/${acct.project_id}/messages:send`,
+        headers: { authorization: `Bearer ${access}`, 'content-type': 'application/json' },
+        body: JSON.stringify(message),
+    });
+    if (res.status >= 200 && res.status < 300)
+        return;
+    let code = '';
+    try {
+        const o = JSON.parse(res.body);
+        code = o.error?.details?.find((d) => d.errorCode)?.errorCode ?? o.error?.status ?? '';
+    }
+    catch {
+        /* not json */
+    }
+    if (res.status === 404 || code === 'UNREGISTERED')
+        throw new DeviceGone(code || 'not_found');
+    if (res.status === 401)
+        fcmToken = undefined;
+    throw new Error(`FCM ${res.status}${code ? ` ${code}` : ''}`);
+}
+let apnsConfig;
+let apnsToken;
+function apns() {
+    if (apnsConfig !== undefined)
+        return apnsConfig;
+    const p8 = process.env.APNS_KEY_P8?.trim();
+    const keyId = process.env.APNS_KEY_ID?.trim();
+    const teamId = process.env.APNS_TEAM_ID?.trim();
+    if (!p8 || !keyId || !teamId)
+        return (apnsConfig = null);
+    try {
+        apnsConfig = {
+            key: createPrivateKey(p8.replace(/\\n/g, '\n')),
+            keyId,
+            teamId,
+            bundleId: process.env.APNS_BUNDLE_ID?.trim() || 'ai.tinybee.app',
+            host: process.env.APNS_ENV?.trim() === 'sandbox' ? 'https://api.sandbox.push.apple.com' : 'https://api.push.apple.com',
+        };
+    }
+    catch (err) {
+        hiveLog.warn(`native push: APNS_KEY_P8 is not usable: ${err instanceof Error ? err.message : String(err)}`);
+        apnsConfig = null;
+    }
+    return apnsConfig;
+}
+/** Apple wants the provider token refreshed between 20 and 60 minutes; we rotate at 40. */
+function apnsProviderToken(now) {
+    if (apnsToken && now - apnsToken.issuedAt < 40 * 60_000)
+        return apnsToken.value;
+    const c = apns();
+    const iat = Math.floor(now / 1000);
+    apnsToken = { value: jwt({ alg: 'ES256', kid: c.keyId }, { iss: c.teamId, iat }, c.key, 'ES256'), issuedAt: now };
+    return apnsToken.value;
+}
+async function sendApns(device, payload, now) {
+    const c = apns();
+    const body = JSON.stringify({
+        aps: {
+            alert: { title: payload.title, body: payload.body },
+            sound: 'default',
+            'thread-id': payload.tag,
+            'interruption-level': payload.urgency === 'high' ? 'time-sensitive' : 'active',
+        },
+        url: payload.url,
+        tag: payload.tag,
+    });
+    const res = await transport({
+        channel: 'apns',
+        method: 'POST',
+        url: `${c.host}/3/device/${device.token}`,
+        headers: {
+            authorization: `bearer ${apnsProviderToken(now)}`,
+            'apns-topic': c.bundleId,
+            'apns-push-type': 'alert',
+            'apns-priority': payload.urgency === 'low' ? '5' : '10',
+            'apns-collapse-id': payload.tag.slice(0, 64),
+            'apns-expiration': String(Math.floor(now / 1000) + 3600),
+            'content-type': 'application/json',
+        },
+        body,
+    });
+    if (res.status === 200)
+        return;
+    let reason = '';
+    try {
+        reason = JSON.parse(res.body).reason ?? '';
+    }
+    catch {
+        /* empty body */
+    }
+    if (res.status === 410 || reason === 'BadDeviceToken' || reason === 'Unregistered' || reason === 'DeviceTokenNotForTopic')
+        throw new DeviceGone(reason || 'gone');
+    if (res.status === 403 && reason === 'ExpiredProviderToken')
+        apnsToken = undefined;
+    throw new Error(`APNs ${res.status}${reason ? ` ${reason}` : ''}`);
+}
+// ---- transport ----
+/** HTTPS as the platforms want it: fetch for Google, HTTP/2 for Apple (APNs refuses HTTP/1.1). */
+const defaultTransport = async (req) => {
+    if (req.channel !== 'apns') {
+        const res = await fetch(req.url, { method: req.method, headers: req.headers, body: req.body, signal: AbortSignal.timeout(15_000) });
+        return { status: res.status, body: await res.text() };
+    }
+    const u = new URL(req.url);
+    return new Promise((resolve, reject) => {
+        const client = connect(u.origin);
+        const timer = setTimeout(() => {
+            client.close();
+            reject(new Error('APNs timeout'));
+        }, 15_000);
+        client.on('error', (err) => {
+            clearTimeout(timer);
+            reject(err);
+        });
+        const stream = client.request({ ...req.headers, [h2.HTTP2_HEADER_METHOD]: req.method, [h2.HTTP2_HEADER_PATH]: u.pathname });
+        let status = 0;
+        const chunks = [];
+        stream.on('response', (headers) => {
+            status = Number(headers[h2.HTTP2_HEADER_STATUS] ?? 0);
+        });
+        stream.on('data', (c) => chunks.push(c));
+        stream.on('end', () => {
+            clearTimeout(timer);
+            client.close();
+            resolve({ status, body: Buffer.concat(chunks).toString('utf8') });
+        });
+        stream.on('error', (err) => {
+            clearTimeout(timer);
+            client.close();
+            reject(err);
+        });
+        stream.end(req.body);
+    });
+};
+let transport = defaultTransport;
+/** Tests replace the HTTPS layer; `undefined` restores the real one. */
+export function setNativeTransport(fn) {
+    transport = fn ?? defaultTransport;
+}
+/** Forgets parsed credentials and cached tokens, so a test can change the env. */
+export function resetNativePush() {
+    fcmAccount = undefined;
+    fcmKey = undefined;
+    fcmToken = undefined;
+    fcmTokenPending = undefined;
+    apnsConfig = undefined;
+    apnsToken = undefined;
+}
+export function nativePushChannels() {
+    return { android: serviceAccount() !== null, ios: apns() !== null };
+}
+/** Sends one notice to one device. Returns false when the channel has no credentials; throws DeviceGone when the token is dead. */
+export async function sendNativePush(device, payload, now = Date.now()) {
+    if (device.platform === 'android') {
+        if (!serviceAccount())
+            return false;
+        await sendFcm(device, payload, now);
+        return true;
+    }
+    if (!apns())
+        return false;
+    await sendApns(device, payload, now);
+    return true;
+}
+//# sourceMappingURL=native-push.js.map