# {{name}} — a tiny body ({{board}})

Scaffolded by `npx tiny-tech init --body {{slug}}` (tiny-tech {{version}}, template `endpoint-python`).
This body joins tiny as an **endpoint**: it serves its own HTTPS API and tiny dials OUT to it. The
worker's endpoint allow-list is exactly three actions, and `server.py` exposes exactly those:

| action | route | notes |
|---|---|---|
| `telemetry` | `GET /api/telemetry` | JSON, bearer |
| `snapshot` | `GET /api/camera/snapshot` | JPEG bytes, bearer; 503 while there is no frame |
| `chat` | `POST /api/chat {prompt}` | one agent turn on the body, bearer |
| — | `GET /api/health` | public: `{ok, body, version}` |

## The three commands

```bash
pip install -r requirements.txt && pytest            # green before anything is enrolled
{{SLUG}}_TOKEN=$(openssl rand -hex 32) uvicorn server:app --host 0.0.0.0 --port 8080
bash enroll.sh https://{{slug}}.example.com "$TOKEN"   # from a machine that is logged in (npx tiny-tech login)
```

`enroll.sh` does the owner-session `POST /api/devices {kind:"endpoint", url, secret}` from
[docs/BODIES.md](https://tiny.technology/docs/developers/enroll-a-device/). The URL must be https + a
public hostname (the worker refuses IP literals and `.local`) — put the server behind a tunnel
(`cloudflared tunnel`) or a reverse proxy with a certificate.

## Auth

`{{SLUG}}_TOKEN` env, else `~/.{{slug}}/token` (0600). `Authorization: Bearer`, `?token=`, or the
`{{slug}}_session` cookie set by `GET /api/auth/login?token=`. Fail closed: with a token configured,
everything but `/api/health` is 401 unauthenticated. Loopback may read only while NO token exists.