@openpalm/ui 0.11.2-rc.1 → 0.11.2-rc.3

package/build/server/chunks/{session-cookie-C61HbJV5.js.map → session-cookie-DUBC6gaA.js.map}

@@ -1 +1 @@
-{"version":3,"file":"session-cookie-C61HbJV5.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { h as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — 7 days, in lockstep with the in-store session TTL.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}
+{"version":3,"file":"session-cookie-DUBC6gaA.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { h as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — 7 days, in lockstep with the in-store session TTL.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}

package/build/server/chunks/{setup-deploy-D0Om28m3.js → setup-deploy-DnfUIlT1.js}

@@ -1,4 +1,4 @@
-import { c as applyInstall, a5 as listEnabledAddonIds, V as getAddonProfileSelection, at as setAddonProfileSelection, a as addonProfileId, l as buildManagedServices, k as buildComposeOptions, o as composeDown, s as composePull, x as composeUp, a3 as isSetupComplete, aq as resolveStackDir, y as createLogger, E as detectExistingProject, a9 as parseEnvFile, r as composePs, W as getAddonProfiles, an as resolveComposeProjectName } from './src-DJv-Q_k2.js';
+import { c as applyInstall, a5 as listEnabledAddonIds, V as getAddonProfileSelection, at as setAddonProfileSelection, a as addonProfileId, l as buildManagedServices, k as buildComposeOptions, o as composeDown, s as composePull, x as composeUp, a3 as isSetupComplete, aq as resolveStackDir, y as createLogger, E as detectExistingProject, a9 as parseEnvFile, r as composePs, W as getAddonProfiles, an as resolveComposeProjectName } from './src-Bg3Hw0f8.js';
 import { existsSync, readFileSync, writeFileSync, renameSync } from 'node:fs';
 
 //#region src/lib/server/setup-deploy.ts
@@ -236,7 +236,8 @@ function startDeploy(state) {
 			try {
 				const downResult = await composeDown({
 					...composeOpts,
-					removeVolumes: false
+					removeVolumes: false,
+					removeOrphans: true
 				});
 				if (!downResult.ok) logger.info("pre-deploy compose down returned non-zero (likely nothing to remove)", { stderr: downResult.stderr?.slice(0, 500) });
 			} catch (err) {
@@ -515,4 +516,4 @@ async function bringUpVoiceIfEnabled(state, composeOpts) {
 }
 
 export { getDeployState as g, resetDeployState as r, startDeploy as s };
-//# sourceMappingURL=setup-deploy-D0Om28m3.js.map
+//# sourceMappingURL=setup-deploy-DnfUIlT1.js.map

package/build/server/chunks/setup-deploy-DnfUIlT1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-deploy-DnfUIlT1.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { C as buildManagedServices, E as buildComposeOptions, It as resolveStackDir, M as composePs, N as composePull, Nt as parseEnvFile, R as composeUp, Rt as createLogger, V as resolveComposeProjectName, Z as isSetupComplete, at as getAddonProfileSelection, ft as setAddonProfileSelection, k as composeDown, ot as getAddonProfiles, pt as addonProfileId, ut as listEnabledAddonIds, y as applyInstall, z as detectExistingProject } from \"./src.js\";\nimport { existsSync, readFileSync, renameSync, writeFileSync } from \"node:fs\";\n//#region src/lib/server/setup-deploy.ts\n/**\n* In-process deploy state for the setup wizard.\n*\n* Tracks Docker Compose deploy progress during first-time setup.\n* State lives in this module so the polling endpoint can read it\n* without a database or filesystem dependency.\n*/\nvar logger = createLogger(\"admin:setup-deploy\");\nfunction projectNameForState(state) {\n\treturn resolveComposeProjectName(parseEnvFile(`${state.stashDir}/env/stack.env`));\n}\nfunction projectNameForComposeOptions(composeOpts) {\n\treturn resolveComposeProjectName(Object.assign({}, ...(composeOpts.envFiles ?? []).map((f) => parseEnvFile(f))));\n}\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\tphase: \"writing-config\"\n};\nfunction getDeployState() {\n\tif (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveStackDir())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: [..._state.deployStatus]\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\tphase: \"writing-config\"\n\t};\n}\n/**\n* Resolve the effective OP_IMAGE_TAG for a deploy.\n* Reads exclusively from stack.env files — by the time startDeploy() runs,\n* applyInstall() has already written the wizard's chosen tag to stack.env.\n* Process env is intentionally ignored so shell variables can never silently\n* override what the user configured in the wizard.\n*/\nfunction resolveImageTag(composeOpts) {\n\tfor (const envFile of composeOpts.envFiles ?? []) {\n\t\tif (!existsSync(envFile)) continue;\n\t\tconst parsed = parseEnvFile(envFile);\n\t\tif (parsed.OP_IMAGE_TAG) return parsed.OP_IMAGE_TAG;\n\t}\n\treturn \"\";\n}\n/**\n* Map opaque Docker/compose stderr text to a human-friendly error message.\n* If no pattern matches, the raw message is returned prefixed with a generic header.\n*/\nfunction mapDockerError(raw) {\n\tif (/cannot connect to the docker daemon|docker daemon is not running/i.test(raw)) return \"Docker Desktop appears to have stopped. Start Docker, then click Retry.\";\n\tconst portMatch = /bind: address already in use.*?:(\\d+)/i.exec(raw);\n\tif (portMatch) return `Port ${portMatch[1]} is already in use by another program. Free it (or quit the other app) and click Retry.`;\n\tif (/Cannot find specified .* file|no such file or directory/i.test(raw)) return \"A required configuration file is missing. Try re-running setup.\";\n\tif (/permission denied/i.test(raw)) return \"Permission denied. Check that ~/.openpalm and Docker have permission to write.\";\n\tif (/no space left on device|ENOSPC/i.test(raw)) return \"Your disk is full. Free up space and click Retry.\";\n\treturn `Deployment ran into a problem: ${raw}`;\n}\n/**\n* Atomic-merge OP_SETUP_COMPLETE=true into stack.env. Called only after every\n* container has reported healthy — until then the wizard must remain\n* resumable, so the flag is intentionally not written by performSetup.\n*/\nfunction markSetupComplete(state) {\n\tconst path = `${state.stashDir}/env/stack.env`;\n\tconst lines = (existsSync(path) ? readFileSync(path, \"utf-8\") : \"\").split(\"\\n\");\n\tlet replaced = false;\n\tfor (let i = 0; i < lines.length; i++) {\n\t\tconst trimmed = lines[i].trimStart();\n\t\tconst eq = trimmed.indexOf(\"=\");\n\t\tif (eq > 0 && trimmed.slice(0, eq).trim() === \"OP_SETUP_COMPLETE\") {\n\t\t\tlines[i] = \"OP_SETUP_COMPLETE=true\";\n\t\t\treplaced = true;\n\t\t\tbreak;\n\t\t}\n\t}\n\tif (!replaced) if (lines.length > 0 && lines[lines.length - 1] === \"\") {\n\t\tlines[lines.length - 1] = \"OP_SETUP_COMPLETE=true\";\n\t\tlines.push(\"\");\n\t} else lines.push(\"OP_SETUP_COMPLETE=true\");\n\tlet merged = lines.join(\"\\n\");\n\tif (!merged.endsWith(\"\\n\")) merged += \"\\n\";\n\tconst tmp = `${path}.tmp`;\n\twriteFileSync(tmp, merged, { mode: 384 });\n\trenameSync(tmp, path);\n}\n/**\n* Parse `docker compose ps --format json` output into a list of container states.\n* Compose outputs one JSON object per line (NDJSON), not a JSON array.\n*/\nfunction parseComposePsOutput(stdout) {\n\tconst results = [];\n\tfor (const line of stdout.split(\"\\n\")) {\n\t\tconst trimmed = line.trim();\n\t\tif (!trimmed) continue;\n\t\ttry {\n\t\t\tconst obj = JSON.parse(trimmed);\n\t\t\tresults.push({\n\t\t\t\tname: String(obj[\"Name\"] ?? obj[\"Service\"] ?? \"\"),\n\t\t\t\tstate: String(obj[\"State\"] ?? \"\"),\n\t\t\t\thealth: String(obj[\"Health\"] ?? \"\")\n\t\t\t});\n\t\t} catch {}\n\t}\n\treturn results;\n}\n/**\n* Poll container health for `services` until all are running (and healthy if\n* they declare a healthcheck). Updates `_state.deployStatus` with intermediate\n* labels as containers flip states.\n*\n* @returns null on success, or an error string if timeout fires with unhealthy services.\n*/\nasync function pollContainerHealth(composeOpts, services, timeoutMs) {\n\tconst deadline = Date.now() + timeoutMs;\n\tconst POLL_INTERVAL_MS = 2e3;\n\twhile (Date.now() < deadline) {\n\t\tawait new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));\n\t\tconst psResult = await composePs(composeOpts);\n\t\tif (!psResult.ok) {\n\t\t\tlogger.warn(\"composePs failed during health poll\", { stderr: psResult.stderr });\n\t\t\tcontinue;\n\t\t}\n\t\tconst containers = parseComposePsOutput(psResult.stdout);\n\t\t_state.deployStatus = _state.deployStatus.map((entry) => {\n\t\t\tconst found = containers.find((c) => c.name === entry.service || c.name.endsWith(`-${entry.service}-1`) || c.name.endsWith(`_${entry.service}_1`));\n\t\t\tif (!found) return {\n\t\t\t\t...entry,\n\t\t\t\tstatus: \"pending\",\n\t\t\t\tlabel: \"Starting...\"\n\t\t\t};\n\t\t\tif (found.state === \"running\") {\n\t\t\t\tconst health = found.health;\n\t\t\t\tif (health === \"unhealthy\") return {\n\t\t\t\t\t...entry,\n\t\t\t\t\tstatus: \"error\",\n\t\t\t\t\tlabel: \"Unhealthy\"\n\t\t\t\t};\n\t\t\t\tif (health === \"starting\") return {\n\t\t\t\t\t...entry,\n\t\t\t\t\tstatus: \"pending\",\n\t\t\t\t\tlabel: \"Health check running...\"\n\t\t\t\t};\n\t\t\t\treturn {\n\t\t\t\t\t...entry,\n\t\t\t\t\tstatus: \"running\",\n\t\t\t\t\tlabel: \"Running\"\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (found.state === \"exited\" || found.state === \"dead\") return {\n\t\t\t\t...entry,\n\t\t\t\tstatus: \"error\",\n\t\t\t\tlabel: `Exited (${found.state})`\n\t\t\t};\n\t\t\treturn {\n\t\t\t\t...entry,\n\t\t\t\tstatus: \"pending\",\n\t\t\t\tlabel: `Starting (${found.state})...`\n\t\t\t};\n\t\t});\n\t\tif (services.every((svc) => {\n\t\t\treturn _state.deployStatus.find((e) => e.service === svc)?.status === \"running\";\n\t\t})) return null;\n\t\tconst failed = _state.deployStatus.filter((e) => e.status === \"error\").map((e) => e.service);\n\t\tif (failed.length > 0) {\n\t\t\tconst projectName = projectNameForComposeOptions(composeOpts);\n\t\t\treturn `Services started but the following did not become healthy: ${failed.join(\", \")}. Check logs: docker compose -p ${projectName} logs ${failed.join(\" \")}.`;\n\t\t}\n\t}\n\tconst unhealthy = _state.deployStatus.filter((e) => e.status !== \"running\").map((e) => e.service);\n\tconst projectName = projectNameForComposeOptions(composeOpts);\n\treturn `Services started but some did not become healthy in time: ${unhealthy.join(\", \")}. Check logs: docker compose -p ${projectName} logs ${unhealthy.join(\" \")}.`;\n}\n/**\n* Pre-flight: refuse to deploy if existing containers in this compose\n* project belong to a DIFFERENT OP_HOME than the one we're about to deploy.\n* Without this, two stacks (e.g. dev and host) that share the default\n* \"openpalm\" project name will silently clobber each other.\n*\n* Detection logic lives in lib (detectExistingProject) so the CLI and UI\n* share the same ours-vs-foreign decision (CLAUDE.md: control-plane logic\n* in lib). An existing OURS project is fine — startDeploy's down + force-recreate\n* reconciles it. Only a FOREIGN project produces a refusal.\n*/\nasync function checkProjectNameCollision(state) {\n\tconst projectName = projectNameForState(state);\n\tconst existing = await detectExistingProject({\n\t\tprojectName,\n\t\texpectedWorkingDir: state.homeDir\n\t});\n\tif (existing.exists && !existing.isOurs) return `Refusing to deploy: docker project \"${projectName}\" is already running from ${existing.workingDir || \"another OpenPalm install\"}, but this deploy would use OP_HOME=${state.homeDir}. Set OP_PROJECT_NAME to a distinct value in stack.env, or stop the existing stack first.`;\n\treturn null;\n}\n/** Kick off a background Docker Compose deploy. Returns immediately. */\nfunction startDeploy(state) {\n\tif (_state.deploying) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\tlogger.warn(\"deploy rejected: deploy already in progress\");\n\t\treturn;\n\t}\n\t_state.deploying = true;\n\t_state.deployError = null;\n\t_state.phase = \"writing-config\";\n\t(async () => {\n\t\ttry {\n\t\t\tconst collision = await checkProjectNameCollision(state);\n\t\t\tif (collision) {\n\t\t\t\tlogger.error(\"deploy aborted: project name collision\", { error: collision });\n\t\t\t\t_state.deployError = collision;\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tawait applyInstall(state);\n\t\t\tif (listEnabledAddonIds(state.homeDir).includes(\"ollama\") && !getAddonProfileSelection(state.stackDir, \"ollama\")) try {\n\t\t\t\tsetAddonProfileSelection(state.stackDir, \"ollama\", addonProfileId(\"ollama\", \"cpu\"), state);\n\t\t\t} catch (err) {\n\t\t\t\tlogger.warn(\"ollama: failed to persist default profile selection (continuing)\", { error: err instanceof Error ? err.message : String(err) });\n\t\t\t}\n\t\t\tconst services = await buildManagedServices(state);\n\t\t\t_state.deployStatus = services.map((s) => ({\n\t\t\t\tservice: s,\n\t\t\t\tstatus: \"pending\",\n\t\t\t\tlabel: \"Waiting...\"\n\t\t\t}));\n\t\t\tconst composeOpts = buildComposeOptions(state);\n\t\t\ttry {\n\t\t\t\tconst downResult = await composeDown({\n\t\t\t\t\t...composeOpts,\n\t\t\t\t\tremoveVolumes: false,\n\t\t\t\t\tremoveOrphans: true\n\t\t\t\t});\n\t\t\t\tif (!downResult.ok) logger.info(\"pre-deploy compose down returned non-zero (likely nothing to remove)\", { stderr: downResult.stderr?.slice(0, 500) });\n\t\t\t} catch (err) {\n\t\t\t\tlogger.warn(\"pre-deploy compose down threw — continuing\", { error: err instanceof Error ? err.message : String(err) });\n\t\t\t}\n\t\t\t_state.phase = \"pulling-images\";\n\t\t\tconst imageTag = resolveImageTag(composeOpts);\n\t\t\tconst isDevTag = imageTag.startsWith(\"dev\");\n\t\t\tlet pullResult = null;\n\t\t\tif (!isDevTag) {\n\t\t\t\tconst pullDelaysMs = [\n\t\t\t\t\t0,\n\t\t\t\t\t5e3,\n\t\t\t\t\t15e3\n\t\t\t\t];\n\t\t\t\tfor (let attempt = 0; attempt < pullDelaysMs.length; attempt++) {\n\t\t\t\t\tif (pullDelaysMs[attempt] > 0) {\n\t\t\t\t\t\tlogger.info(\"retrying image pull\", {\n\t\t\t\t\t\t\tattempt: attempt + 1,\n\t\t\t\t\t\t\tdelayMs: pullDelaysMs[attempt]\n\t\t\t\t\t\t});\n\t\t\t\t\t\tawait new Promise((r) => setTimeout(r, pullDelaysMs[attempt]));\n\t\t\t\t\t}\n\t\t\t\t\tpullResult = await composePull(composeOpts);\n\t\t\t\t\tif (pullResult.ok) break;\n\t\t\t\t\tconst stderr = pullResult.stderr ?? \"\";\n\t\t\t\t\tif (/manifest unknown|manifest for .* not found|unauthorized|authentication required|access denied/i.test(stderr)) {\n\t\t\t\t\t\tlogger.error(\"image pull failed with permanent error\", { stderr: stderr.slice(0, 500) });\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\t\t\t\t\tlogger.warn(\"image pull failed (transient?)\", {\n\t\t\t\t\t\tattempt: attempt + 1,\n\t\t\t\t\t\tstderr: stderr.slice(0, 500)\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (isDevTag || !pullResult || !pullResult.ok) if (await allServiceImagesPresent(composeOpts, services)) if (isDevTag) logger.info(\"dev image tag — skipping registry pull, all images present locally\", {\n\t\t\t\timageTag,\n\t\t\t\tservices\n\t\t\t});\n\t\t\telse logger.info(\"image pull failed but all images present locally — continuing\", {\n\t\t\t\tservices,\n\t\t\t\tstderrSlice: (pullResult?.stderr ?? \"\").slice(0, 200)\n\t\t\t});\n\t\t\telse {\n\t\t\t\tlet msg;\n\t\t\t\tif (isDevTag) {\n\t\t\t\t\tconst missing = await missingServiceImages(composeOpts, services);\n\t\t\t\t\tmsg = `Dev images not found locally (tag: ${imageTag}): ${missing.length > 0 ? missing.join(\", \") : \"one or more images\"}. Run \\`bun run dev:build\\` from the project root to build them, then retry setup.`;\n\t\t\t\t} else msg = mapDockerError(pullResult?.stderr?.trim() || \"Image pull failed\");\n\t\t\t\t_state.deployStatus = _state.deployStatus.map((e) => ({\n\t\t\t\t\t...e,\n\t\t\t\t\tstatus: \"error\",\n\t\t\t\t\tlabel: \"Image pull failed\"\n\t\t\t\t}));\n\t\t\t\t_state.deployError = msg;\n\t\t\t\treturn;\n\t\t\t}\n\t\t\t_state.phase = \"starting\";\n\t\t\t_state.deployStatus = _state.deployStatus.map((e) => ({\n\t\t\t\t...e,\n\t\t\t\tstatus: \"pending\",\n\t\t\t\tlabel: \"Starting...\"\n\t\t\t}));\n\t\t\tconst result = await composeUp({\n\t\t\t\t...composeOpts,\n\t\t\t\tforceRecreate: true,\n\t\t\t\tremoveOrphans: true\n\t\t\t});\n\t\t\tif (!result.ok) {\n\t\t\t\tconst msg = mapDockerError(result.stderr ?? \"compose up failed\");\n\t\t\t\t_state.deployStatus = _state.deployStatus.map((e) => ({\n\t\t\t\t\t...e,\n\t\t\t\t\tstatus: \"error\",\n\t\t\t\t\tlabel: msg\n\t\t\t\t}));\n\t\t\t\t_state.deployError = msg;\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tconst healthError = await pollContainerHealth(composeOpts, services, 5 * 6e4);\n\t\t\tif (healthError) {\n\t\t\t\t_state.deployError = healthError;\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tconst voiceError = await bringUpVoiceIfEnabled(state, composeOpts);\n\t\t\tif (voiceError) {\n\t\t\t\t_state.deployError = voiceError;\n\t\t\t\treturn;\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t} catch (err) {\n\t\t\t\tlogger.error(\"failed to persist OP_SETUP_COMPLETE after healthy deploy\", { error: err instanceof Error ? err.message : String(err) });\n\t\t\t\t_state.deployError = \"Deployment succeeded but failed to mark setup complete. Try Retry; if it persists, check disk space and permissions on knowledge/env/stack.env.\";\n\t\t\t\treturn;\n\t\t\t}\n\t\t\t_state.setupComplete = true;\n\t\t\t_state.phase = \"ready\";\n\t\t} catch (err) {\n\t\t\tconst raw = String(err);\n\t\t\tconst msg = mapDockerError(raw);\n\t\t\tlogger.error(\"deploy failed\", { error: raw });\n\t\t\t_state.deployStatus = _state.deployStatus.map((e) => ({\n\t\t\t\t...e,\n\t\t\t\tstatus: \"error\",\n\t\t\t\tlabel: msg\n\t\t\t}));\n\t\t\t_state.deployError = msg;\n\t\t} finally {\n\t\t\t_state.deploying = false;\n\t\t}\n\t})();\n}\nvar VOICE_ADDON = \"voice\";\nvar VOICE_HEALTH_TIMEOUT_MS = 10 * 6e4;\n/**\n* Return the image names for services whose images are NOT present on the\n* local Docker daemon. Used to build actionable error messages.\n*/\nasync function missingServiceImages(composeOpts, services) {\n\tif (services.length === 0) return [];\n\tconst { execFile } = await import(\"node:child_process\");\n\tconst args = [\n\t\t\"compose\",\n\t\t...composeOpts.files.flatMap((f) => [\"-f\", f]),\n\t\t...(composeOpts.envFiles ?? []).filter((f) => existsSync(f)).flatMap((f) => [\"--env-file\", f]),\n\t\t...composeOpts.profiles.flatMap((p) => [\"--profile\", p]),\n\t\t\"config\",\n\t\t\"--format\",\n\t\t\"json\"\n\t];\n\tconst serviceConfig = (await new Promise((resolve) => {\n\t\texecFile(\"docker\", args, { timeout: 3e4 }, (err, stdout) => {\n\t\t\tif (err) return resolve({});\n\t\t\ttry {\n\t\t\t\tresolve(JSON.parse(stdout.toString()));\n\t\t\t} catch {\n\t\t\t\tresolve({});\n\t\t\t}\n\t\t});\n\t})).services ?? {};\n\tconst missing = [];\n\tfor (const svc of services) {\n\t\tconst image = serviceConfig[svc]?.image;\n\t\tif (!image) {\n\t\t\tmissing.push(`${svc} (image unknown)`);\n\t\t\tcontinue;\n\t\t}\n\t\tif (!await new Promise((resolve) => {\n\t\t\texecFile(\"docker\", [\n\t\t\t\t\"image\",\n\t\t\t\t\"inspect\",\n\t\t\t\timage\n\t\t\t], { timeout: 5e3 }, (err) => resolve(!err));\n\t\t})) missing.push(image);\n\t}\n\treturn missing;\n}\n/**\n* Resolve each service's image via `docker compose config` and verify\n* `docker image inspect` finds it locally. Lets the deploy proceed\n* after a registry-pull failure when the operator has the images\n* cached (e.g. dev mode with locally-built `:dev` tags). Returns false\n* on any service whose image we can't confirm is present, including\n* services with no resolvable image and any docker-side error.\n*/\nasync function allServiceImagesPresent(composeOpts, services) {\n\tif (services.length === 0) return false;\n\tconst { execFile } = await import(\"node:child_process\");\n\tconst args = [\n\t\t\"compose\",\n\t\t...composeOpts.files.flatMap((f) => [\"-f\", f]),\n\t\t...(composeOpts.envFiles ?? []).filter((f) => existsSync(f)).flatMap((f) => [\"--env-file\", f]),\n\t\t...composeOpts.profiles.flatMap((p) => [\"--profile\", p]),\n\t\t\"config\",\n\t\t\"--format\",\n\t\t\"json\"\n\t];\n\tconst serviceConfig = (await new Promise((resolve) => {\n\t\texecFile(\"docker\", args, { timeout: 3e4 }, (err, stdout) => {\n\t\t\tif (err) return resolve({});\n\t\t\ttry {\n\t\t\t\tresolve(JSON.parse(stdout.toString()));\n\t\t\t} catch {\n\t\t\t\tresolve({});\n\t\t\t}\n\t\t});\n\t})).services ?? {};\n\tfor (const svc of services) {\n\t\tconst image = serviceConfig[svc]?.image;\n\t\tif (!image) return false;\n\t\tif (!await new Promise((resolve) => {\n\t\t\texecFile(\"docker\", [\n\t\t\t\t\"image\",\n\t\t\t\t\"inspect\",\n\t\t\t\timage\n\t\t\t], { timeout: 5e3 }, (err) => {\n\t\t\t\tresolve(!err);\n\t\t\t});\n\t\t})) return false;\n\t}\n\treturn true;\n}\n/**\n* Pull + bring up the voice addon's chosen profile if\n* the addon is enabled. Runs after the core stack is healthy so the\n* deploy progress UI shows voice as a distinct phase (\"starting-voice\")\n* with its own status row.\n*\n* Returns null on success or a user-friendly error string on failure.\n* The caller surfaces the error via _state.deployError.\n*/\nasync function bringUpVoiceIfEnabled(state, composeOpts) {\n\tif (!listEnabledAddonIds(state.homeDir).includes(VOICE_ADDON)) return null;\n\tconst profiles = getAddonProfiles(state.homeDir, VOICE_ADDON);\n\tconst stored = getAddonProfileSelection(state.stackDir, VOICE_ADDON);\n\tconst profileId = stored ?? profiles.find((p) => p.id === addonProfileId(VOICE_ADDON, \"cpu\"))?.id ?? profiles[0]?.id ?? addonProfileId(VOICE_ADDON, \"cpu\");\n\tif (!stored) try {\n\t\tsetAddonProfileSelection(state.stackDir, VOICE_ADDON, profileId, state);\n\t} catch (err) {\n\t\tlogger.warn(\"voice: failed to persist profile selection (continuing)\", { error: err instanceof Error ? err.message : String(err) });\n\t}\n\tconst profileServices = profiles.find((p) => p.id === profileId)?.services ?? [];\n\tif (profileServices.length === 0) {\n\t\tlogger.warn(\"voice: no services found for chosen profile (skipping)\", { profileId });\n\t\treturn null;\n\t}\n\t_state.phase = \"starting-voice\";\n\t_state.deployStatus = [..._state.deployStatus, ...profileServices.map((svc) => ({\n\t\tservice: svc,\n\t\tstatus: \"pending\",\n\t\tlabel: \"Voice — starting container…\"\n\t}))];\n\tconst upResult = await composeUp({\n\t\t...composeOpts,\n\t\tservices: profileServices,\n\t\tprofiles: [profileId],\n\t\tforceRecreate: true\n\t});\n\tif (!upResult.ok) {\n\t\tconst msg = mapDockerError(upResult.stderr ?? \"Voice container failed to start\");\n\t\t_state.deployStatus = _state.deployStatus.map((e) => profileServices.includes(e.service) ? {\n\t\t\t...e,\n\t\t\tstatus: \"error\",\n\t\t\tlabel: msg\n\t\t} : e);\n\t\treturn `Voice addon: ${msg}`;\n\t}\n\tconst probeUrl = \"http://127.0.0.1:8880/health\";\n\tconst deadline = Date.now() + VOICE_HEALTH_TIMEOUT_MS;\n\tlet healthy = false;\n\twhile (Date.now() < deadline) {\n\t\ttry {\n\t\t\tif ((await fetch(probeUrl, { signal: AbortSignal.timeout(1500) })).ok) {\n\t\t\t\thealthy = true;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t} catch {}\n\t\tawait new Promise((r) => setTimeout(r, 2e3));\n\t}\n\tif (!healthy) {\n\t\t_state.deployStatus = _state.deployStatus.map((e) => profileServices.includes(e.service) ? {\n\t\t\t...e,\n\t\t\tstatus: \"warning\",\n\t\t\tlabel: \"Voice is still warming up. You can finish setup; check the Voice tab in admin.\"\n\t\t} : e);\n\t\tlogger.warn(\"voice: container did not become healthy in time\", { timeoutMs: VOICE_HEALTH_TIMEOUT_MS });\n\t\treturn null;\n\t}\n\t_state.deployStatus = _state.deployStatus.map((e) => profileServices.includes(e.service) ? {\n\t\t...e,\n\t\tstatus: \"running\",\n\t\tlabel: \"Voice — ready\"\n\t} : e);\n\treturn null;\n}\n//#endregion\nexport { resetDeployState as n, startDeploy as r, getDeployState as t };\n"],"names":[],"mappings":";;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,GAAG,YAAY,CAAC,oBAAoB,CAAC;AAC/C,SAAS,mBAAmB,CAAC,KAAK,EAAE;AACpC,CAAC,OAAO,yBAAyB,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;AAClF;AACA,SAAS,4BAA4B,CAAC,WAAW,EAAE;AACnD,CAAC,OAAO,yBAAyB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,QAAQ,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjH;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,SAAS,cAAc,GAAG;AAC1B,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AAClH,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,CAAC,GAAG,MAAM,CAAC,YAAY;AACvC,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,WAAW,EAAE;AACtC,CAAC,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,QAAQ,IAAI,EAAE,EAAE;AACnD,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;AAC5B,EAAE,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC;AACtC,EAAE,IAAI,MAAM,CAAC,YAAY,EAAE,OAAO,MAAM,CAAC,YAAY;AACrD,CAAC;AACD,CAAC,OAAO,EAAE;AACV;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,GAAG,EAAE;AAC7B,CAAC,IAAI,mEAAmE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,yEAAyE;AACpK,CAAC,MAAM,SAAS,GAAG,wCAAwC,CAAC,IAAI,CAAC,GAAG,CAAC;AACrE,CAAC,IAAI,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,uFAAuF,CAAC;AACpI,CAAC,IAAI,0DAA0D,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,iEAAiE;AACnJ,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,gFAAgF;AAC5H,CAAC,IAAI,iCAAiC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,mDAAmD;AAC5G,CAAC,OAAO,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;AAC/C;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,CAAC,MAAM,IAAI,GAAG,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;AAC/C,CAAC,MAAM,KAAK,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC;AAChF,CAAC,IAAI,QAAQ,GAAG,KAAK;AACrB,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;AACxC,EAAE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE;AACtC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;AACjC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,mBAAmB,EAAE;AACrE,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,wBAAwB;AACtC,GAAG,QAAQ,GAAG,IAAI;AAClB,GAAG;AACH,EAAE;AACF,CAAC;AACD,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;AACxE,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,wBAAwB;AACpD,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;AAChB,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC;AAC5C,CAAC,IAAI,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AAC9B,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,IAAI,IAAI;AAC3C,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC;AAC1B,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC1C,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC;AACtB;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,MAAM,EAAE;AACtC,CAAC,MAAM,OAAO,GAAG,EAAE;AACnB,CAAC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;AACxC,EAAE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE;AAC7B,EAAE,IAAI,CAAC,OAAO,EAAE;AAChB,EAAE,IAAI;AACN,GAAG,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;AAClC,GAAG,OAAO,CAAC,IAAI,CAAC;AAChB,IAAI,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;AACrD,IAAI,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;AACrC,IAAI,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;AACtC,IAAI,CAAC;AACL,EAAE,CAAC,CAAC,MAAM,CAAC;AACX,CAAC;AACD,CAAC,OAAO,OAAO;AACf;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,mBAAmB,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE;AACrE,CAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;AACxC,CAAC,MAAM,gBAAgB,GAAG,GAAG;AAC7B,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE;AAC/B,EAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;AAC3D,EAAE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC;AAC/C,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;AACpB,GAAG,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AAClF,GAAG;AACH,EAAE;AACF,EAAE,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC;AAC1D,EAAE,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK;AAC3D,GAAG,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;AACrJ,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO;AACtB,IAAI,GAAG,KAAK;AACZ,IAAI,MAAM,EAAE,SAAS;AACrB,IAAI,KAAK,EAAE;AACX,IAAI;AACJ,GAAG,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE;AAClC,IAAI,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM;AAC/B,IAAI,IAAI,MAAM,KAAK,WAAW,EAAE,OAAO;AACvC,KAAK,GAAG,KAAK;AACb,KAAK,MAAM,EAAE,OAAO;AACpB,KAAK,KAAK,EAAE;AACZ,KAAK;AACL,IAAI,IAAI,MAAM,KAAK,UAAU,EAAE,OAAO;AACtC,KAAK,GAAG,KAAK;AACb,KAAK,MAAM,EAAE,SAAS;AACtB,KAAK,KAAK,EAAE;AACZ,KAAK;AACL,IAAI,OAAO;AACX,KAAK,GAAG,KAAK;AACb,KAAK,MAAM,EAAE,SAAS;AACtB,KAAK,KAAK,EAAE;AACZ,KAAK;AACL,GAAG;AACH,GAAG,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,EAAE,OAAO;AAClE,IAAI,GAAG,KAAK;AACZ,IAAI,MAAM,EAAE,OAAO;AACnB,IAAI,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;AACnC,IAAI;AACJ,GAAG,OAAO;AACV,IAAI,GAAG,KAAK;AACZ,IAAI,MAAM,EAAE,SAAS;AACrB,IAAI,KAAK,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;AACxC,IAAI;AACJ,EAAE,CAAC,CAAC;AACJ,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK;AAC9B,GAAG,OAAO,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,EAAE,MAAM,KAAK,SAAS;AAClF,EAAE,CAAC,CAAC,EAAE,OAAO,IAAI;AACjB,EAAE,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC9F,EAAE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE;AACzB,GAAG,MAAM,WAAW,GAAG,4BAA4B,CAAC,WAAW,CAAC;AAChE,GAAG,OAAO,CAAC,2DAA2D,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,gCAAgC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACnK,EAAE;AACF,CAAC;AACD,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAClG,CAAC,MAAM,WAAW,GAAG,4BAA4B,CAAC,WAAW,CAAC;AAC9D,CAAC,OAAO,CAAC,0DAA0D,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,gCAAgC,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACtK;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,yBAAyB,CAAC,KAAK,EAAE;AAChD,CAAC,MAAM,WAAW,GAAG,mBAAmB,CAAC,KAAK,CAAC;AAC/C,CAAC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;AAC9C,EAAE,WAAW;AACb,EAAE,kBAAkB,EAAE,KAAK,CAAC;AAC5B,EAAE,CAAC;AACH,CAAC,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,oCAAoC,EAAE,WAAW,CAAC,0BAA0B,EAAE,QAAQ,CAAC,UAAU,IAAI,0BAA0B,CAAC,oCAAoC,EAAE,KAAK,CAAC,OAAO,CAAC,yFAAyF,CAAC;AAChU,CAAC,OAAO,IAAI;AACZ;AACA;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE;AACvB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC;AAC5D,EAAE;AACF,CAAC;AACD,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI;AACxB,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI;AAC1B,CAAC,MAAM,CAAC,KAAK,GAAG,gBAAgB;AAChC,CAAC,CAAC,YAAY;AACd,EAAE,IAAI;AACN,GAAG,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC;AAC3D,GAAG,IAAI,SAAS,EAAE;AAClB,IAAI,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAChF,IAAI,MAAM,CAAC,WAAW,GAAG,SAAS;AAClC,IAAI;AACJ,GAAG;AACH,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC;AAC5B,GAAG,IAAI,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,IAAI;AACzH,IAAI,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC;AAC9F,GAAG,CAAC,CAAC,OAAO,GAAG,EAAE;AACjB,IAAI,MAAM,CAAC,IAAI,CAAC,kEAAkE,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AAChJ,GAAG;AACH,GAAG,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC;AACrD,GAAG,MAAM,CAAC,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AAC9C,IAAI,OAAO,EAAE,CAAC;AACd,IAAI,MAAM,EAAE,SAAS;AACrB,IAAI,KAAK,EAAE;AACX,IAAI,CAAC,CAAC;AACN,GAAG,MAAM,WAAW,GAAG,mBAAmB,CAAC,KAAK,CAAC;AACjD,GAAG,IAAI;AACP,IAAI,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC;AACzC,KAAK,GAAG,WAAW;AACnB,KAAK,aAAa,EAAE,KAAK;AACzB,KAAK,aAAa,EAAE;AACpB,KAAK,CAAC;AACN,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,sEAAsE,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AACzJ,GAAG,CAAC,CAAC,OAAO,GAAG,EAAE;AACjB,IAAI,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AAC1H,GAAG;AACH,GAAG,MAAM,CAAC,KAAK,GAAG,gBAAgB;AAClC,GAAG,MAAM,QAAQ,GAAG,eAAe,CAAC,WAAW,CAAC;AAChD,GAAG,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;AAC9C,GAAG,IAAI,UAAU,GAAG,IAAI;AACxB,GAAG,IAAI,CAAC,QAAQ,EAAE;AAClB,IAAI,MAAM,YAAY,GAAG;AACzB,KAAK,CAAC;AACN,KAAK,GAAG;AACR,KAAK;AACL,KAAK;AACL,IAAI,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;AACpE,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;AACpC,MAAM,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE;AACzC,OAAO,OAAO,EAAE,OAAO,GAAG,CAAC;AAC3B,OAAO,OAAO,EAAE,YAAY,CAAC,OAAO;AACpC,OAAO,CAAC;AACR,MAAM,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;AACpE,KAAK;AACL,KAAK,UAAU,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC;AAChD,KAAK,IAAI,UAAU,CAAC,EAAE,EAAE;AACxB,KAAK,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,EAAE;AAC3C,KAAK,IAAI,gGAAgG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;AACxH,MAAM,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AAC9F,MAAM;AACN,KAAK;AACL,KAAK,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;AACnD,MAAM,OAAO,EAAE,OAAO,GAAG,CAAC;AAC1B,MAAM,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG;AACjC,MAAM,CAAC;AACP,IAAI;AACJ,GAAG;AACH,GAAG,IAAI,QAAQ,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,MAAM,uBAAuB,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,IAAI,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,oEAAoE,EAAE;AAC5M,IAAI,QAAQ;AACZ,IAAI;AACJ,IAAI,CAAC;AACL,QAAQ,MAAM,CAAC,IAAI,CAAC,+DAA+D,EAAE;AACrF,IAAI,QAAQ;AACZ,IAAI,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG;AACxD,IAAI,CAAC;AACL,QAAQ;AACR,IAAI,IAAI,GAAG;AACX,IAAI,IAAI,QAAQ,EAAE;AAClB,KAAK,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE,QAAQ,CAAC;AACtE,KAAK,GAAG,GAAG,CAAC,mCAAmC,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,kFAAkF,CAAC;AACjN,IAAI,CAAC,MAAM,GAAG,GAAG,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,mBAAmB,CAAC;AAClF,IAAI,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AAC1D,KAAK,GAAG,CAAC;AACT,KAAK,MAAM,EAAE,OAAO;AACpB,KAAK,KAAK,EAAE;AACZ,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,CAAC,WAAW,GAAG,GAAG;AAC5B,IAAI;AACJ,GAAG;AACH,GAAG,MAAM,CAAC,KAAK,GAAG,UAAU;AAC5B,GAAG,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AACzD,IAAI,GAAG,CAAC;AACR,IAAI,MAAM,EAAE,SAAS;AACrB,IAAI,KAAK,EAAE;AACX,IAAI,CAAC,CAAC;AACN,GAAG,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;AAClC,IAAI,GAAG,WAAW;AAClB,IAAI,aAAa,EAAE,IAAI;AACvB,IAAI,aAAa,EAAE;AACnB,IAAI,CAAC;AACL,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE;AACnB,IAAI,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,IAAI,mBAAmB,CAAC;AACpE,IAAI,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AAC1D,KAAK,GAAG,CAAC;AACT,KAAK,MAAM,EAAE,OAAO;AACpB,KAAK,KAAK,EAAE;AACZ,KAAK,CAAC,CAAC;AACP,IAAI,MAAM,CAAC,WAAW,GAAG,GAAG;AAC5B,IAAI;AACJ,GAAG;AACH,GAAG,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,GAAG,GAAG,CAAC;AAChF,GAAG,IAAI,WAAW,EAAE;AACpB,IAAI,MAAM,CAAC,WAAW,GAAG,WAAW;AACpC,IAAI;AACJ,GAAG;AACH,GAAG,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,WAAW,CAAC;AACrE,GAAG,IAAI,UAAU,EAAE;AACnB,IAAI,MAAM,CAAC,WAAW,GAAG,UAAU;AACnC,IAAI;AACJ,GAAG;AACH,GAAG,IAAI;AACP,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG,CAAC,CAAC,OAAO,GAAG,EAAE;AACjB,IAAI,MAAM,CAAC,KAAK,CAAC,0DAA0D,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AACzI,IAAI,MAAM,CAAC,WAAW,GAAG,iJAAiJ;AAC1K,IAAI;AACJ,GAAG;AACH,GAAG,MAAM,CAAC,aAAa,GAAG,IAAI;AAC9B,GAAG,MAAM,CAAC,KAAK,GAAG,OAAO;AACzB,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;AAC1B,GAAG,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC;AAClC,GAAG,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAChD,GAAG,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AACzD,IAAI,GAAG,CAAC;AACR,IAAI,MAAM,EAAE,OAAO;AACnB,IAAI,KAAK,EAAE;AACX,IAAI,CAAC,CAAC;AACN,GAAG,MAAM,CAAC,WAAW,GAAG,GAAG;AAC3B,EAAE,CAAC,SAAS;AACZ,GAAG,MAAM,CAAC,SAAS,GAAG,KAAK;AAC3B,EAAE;AACF,CAAC,CAAC,GAAG;AACL;AACA,IAAI,WAAW,GAAG,OAAO;AACzB,IAAI,uBAAuB,GAAG,EAAE,GAAG,GAAG;AACtC;AACA;AACA;AACA;AACA,eAAe,oBAAoB,CAAC,WAAW,EAAE,QAAQ,EAAE;AAC3D,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE;AACrC,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,oBAAoB,CAAC;AACxD,CAAC,MAAM,IAAI,GAAG;AACd,EAAE,SAAS;AACX,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAChD,EAAE,GAAG,CAAC,WAAW,CAAC,QAAQ,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;AAChG,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC1D,EAAE,QAAQ;AACV,EAAE,UAAU;AACZ,EAAE;AACF,EAAE;AACF,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK;AACvD,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK;AAC9D,GAAG,IAAI,GAAG,EAAE,OAAO,OAAO,CAAC,EAAE,CAAC;AAC9B,GAAG,IAAI;AACP,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC1C,GAAG,CAAC,CAAC,MAAM;AACX,IAAI,OAAO,CAAC,EAAE,CAAC;AACf,GAAG;AACH,EAAE,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,EAAE;AACnB,CAAC,MAAM,OAAO,GAAG,EAAE;AACnB,CAAC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE;AAC7B,EAAE,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,KAAK;AACzC,EAAE,IAAI,CAAC,KAAK,EAAE;AACd,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;AACzC,GAAG;AACH,EAAE;AACF,EAAE,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK;AACtC,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,OAAO;AACX,IAAI,SAAS;AACb,IAAI;AACJ,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;AAC/C,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;AACzB,CAAC;AACD,CAAC,OAAO,OAAO;AACf;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,uBAAuB,CAAC,WAAW,EAAE,QAAQ,EAAE;AAC9D,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,KAAK;AACxC,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,oBAAoB,CAAC;AACxD,CAAC,MAAM,IAAI,GAAG;AACd,EAAE,SAAS;AACX,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAChD,EAAE,GAAG,CAAC,WAAW,CAAC,QAAQ,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;AAChG,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC1D,EAAE,QAAQ;AACV,EAAE,UAAU;AACZ,EAAE;AACF,EAAE;AACF,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK;AACvD,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK;AAC9D,GAAG,IAAI,GAAG,EAAE,OAAO,OAAO,CAAC,EAAE,CAAC;AAC9B,GAAG,IAAI;AACP,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC1C,GAAG,CAAC,CAAC,MAAM;AACX,IAAI,OAAO,CAAC,EAAE,CAAC;AACf,GAAG;AACH,EAAE,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,EAAE;AACnB,CAAC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE;AAC7B,EAAE,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,KAAK;AACzC,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,KAAK;AAC1B,EAAE,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK;AACtC,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,OAAO;AACX,IAAI,SAAS;AACb,IAAI;AACJ,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK;AACjC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC;AACjB,GAAG,CAAC,CAAC;AACL,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK;AAClB,CAAC;AACD,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,qBAAqB,CAAC,KAAK,EAAE,WAAW,EAAE;AACzD,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,IAAI;AAC3E,CAAC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC;AAC9D,CAAC,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC;AACrE,CAAC,MAAM,SAAS,GAAG,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC;AAC3J,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI;AAClB,EAAE,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC;AACzE,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,MAAM,CAAC,IAAI,CAAC,yDAAyD,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AACrI,CAAC;AACD,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,QAAQ,IAAI,EAAE;AACjF,CAAC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE;AACnC,EAAE,MAAM,CAAC,IAAI,CAAC,wDAAwD,EAAE,EAAE,SAAS,EAAE,CAAC;AACtF,EAAE,OAAO,IAAI;AACb,CAAC;AACD,CAAC,MAAM,CAAC,KAAK,GAAG,gBAAgB;AAChC,CAAC,MAAM,CAAC,YAAY,GAAG,CAAC,GAAG,MAAM,CAAC,YAAY,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM;AACjF,EAAE,OAAO,EAAE,GAAG;AACd,EAAE,MAAM,EAAE,SAAS;AACnB,EAAE,KAAK,EAAE;AACT,EAAE,CAAC,CAAC,CAAC;AACL,CAAC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC;AAClC,EAAE,GAAG,WAAW;AAChB,EAAE,QAAQ,EAAE,eAAe;AAC3B,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC;AACvB,EAAE,aAAa,EAAE;AACjB,EAAE,CAAC;AACH,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;AACnB,EAAE,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,IAAI,iCAAiC,CAAC;AAClF,EAAE,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;AAC7F,GAAG,GAAG,CAAC;AACP,GAAG,MAAM,EAAE,OAAO;AAClB,GAAG,KAAK,EAAE;AACV,GAAG,GAAG,CAAC,CAAC;AACR,EAAE,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AAC9B,CAAC;AACD,CAAC,MAAM,QAAQ,GAAG,8BAA8B;AAChD,CAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,uBAAuB;AACtD,CAAC,IAAI,OAAO,GAAG,KAAK;AACpB,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE;AAC/B,EAAE,IAAI;AACN,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE;AAC1E,IAAI,OAAO,GAAG,IAAI;AAClB,IAAI;AACJ,GAAG;AACH,EAAE,CAAC,CAAC,MAAM,CAAC;AACX,EAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC;AACD,CAAC,IAAI,CAAC,OAAO,EAAE;AACf,EAAE,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;AAC7F,GAAG,GAAG,CAAC;AACP,GAAG,MAAM,EAAE,SAAS;AACpB,GAAG,KAAK,EAAE;AACV,GAAG,GAAG,CAAC,CAAC;AACR,EAAE,MAAM,CAAC,IAAI,CAAC,iDAAiD,EAAE,EAAE,SAAS,EAAE,uBAAuB,EAAE,CAAC;AACxG,EAAE,OAAO,IAAI;AACb,CAAC;AACD,CAAC,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;AAC5F,EAAE,GAAG,CAAC;AACN,EAAE,MAAM,EAAE,SAAS;AACnB,EAAE,KAAK,EAAE;AACT,EAAE,GAAG,CAAC,CAAC;AACP,CAAC,OAAO,IAAI;AACZ;;;;"}

package/build/server/chunks/{src-DJv-Q_k2.js → src-Bg3Hw0f8.js}

@@ -6864,7 +6864,7 @@ function ensureHomeDirs() {
 * On any unexpected error (permissions, ENOSPC, etc.) we return null so the
 * caller surfaces "install_in_progress" rather than silently fake-acquiring.
 */
-var logger$10 = createLogger("install-lock");
+var logger$11 = createLogger("install-lock");
 var STALE_AFTER_MS = 1800 * 1e3;
 function isProcessAlive(pid) {
 	try {
@@ -6931,7 +6931,7 @@ function acquireInstallLock(dataDir) {
 	try {
 		mkdirSync(dataDir, { recursive: true });
 	} catch (err) {
-		logger$10.warn("failed to ensure data dir for install lock", {
+		logger$11.warn("failed to ensure data dir for install lock", {
 			dataDir,
 			error: err instanceof Error ? err.message : String(err)
 		});
@@ -6941,18 +6941,18 @@ function acquireInstallLock(dataDir) {
 	try {
 		if (tryCreate(path)) return { path };
 	} catch (err) {
-		logger$10.warn("unexpected error acquiring install lock", {
+		logger$11.warn("unexpected error acquiring install lock", {
 			path,
 			error: err instanceof Error ? err.message : String(err)
 		});
 		return null;
 	}
 	if (!isStale(path)) return null;
-	logger$10.info("removing stale install lock and retrying acquire", { path });
+	logger$11.info("removing stale install lock and retrying acquire", { path });
 	try {
 		rmSync(path, { force: true });
 	} catch (err) {
-		logger$10.warn("failed to remove stale install lock", {
+		logger$11.warn("failed to remove stale install lock", {
 			path,
 			error: err instanceof Error ? err.message : String(err)
 		});
@@ -6961,7 +6961,7 @@ function acquireInstallLock(dataDir) {
 	try {
 		if (tryCreate(path)) return { path };
 	} catch (err) {
-		logger$10.warn("unexpected error re-acquiring install lock", {
+		logger$11.warn("unexpected error re-acquiring install lock", {
 			path,
 			error: err instanceof Error ? err.message : String(err)
 		});
@@ -6974,7 +6974,7 @@ function releaseInstallLock(handle) {
 	try {
 		rmSync(handle.path, { force: true });
 	} catch (err) {
-		logger$10.warn("failed to release install lock", {
+		logger$11.warn("failed to release install lock", {
 			path: handle.path,
 			error: err instanceof Error ? err.message : String(err)
 		});
@@ -10665,7 +10665,7 @@ var yo = (s) => {
 *   4. null → remote download (the UI build from the @openpalm/ui npm registry
 *      tarball; the .openpalm skeleton from the GitHub repo tarball)
 */
-var logger$9 = createLogger("lib:ui-assets");
+var logger$10 = createLogger("lib:ui-assets");
 async function fetchWithRetry(url, retries = 3) {
 	for (let i = 0; i < retries; i++) try {
 		const res = await fetch(url, { signal: AbortSignal.timeout(6e4) });
@@ -10761,7 +10761,7 @@ async function downloadNpmUiBundle(manifest, uiDir, dataDir) {
 	const data = new Uint8Array(await res.arrayBuffer());
 	if (!manifest.integrity) throw new Error(`npm manifest for ${UI_PACKAGE}@${manifest.version} has no integrity hash — refusing to install unverified`);
 	verifyNpmIntegrity(data, manifest.integrity);
-	logger$9.debug("UI bundle integrity verified", { version: manifest.version });
+	logger$10.debug("UI bundle integrity verified", { version: manifest.version });
 	const tmpTar = join(dataDir, ".ui-build.tgz.tmp");
 	const staging = join(dataDir, ".ui-build.staging");
 	try {
@@ -10804,7 +10804,7 @@ async function seedUiBuild(repoRef, dataDir, options) {
 	const uiDir = join(dataDir, "ui");
 	mkdirSync(uiDir, { recursive: true });
 	const manifest = await fetchNpmUiManifest(toNpmVersion(repoRef));
-	logger$9.debug("downloading UI build from npm", { version: manifest.version });
+	logger$10.debug("downloading UI build from npm", { version: manifest.version });
 	await downloadNpmUiBundle(manifest, uiDir, dataDir);
 }
 //#endregion
@@ -10925,7 +10925,7 @@ function removeSecretFile(stackDir, name) {
 //#region ../lib/src/control-plane/secrets.ts
 /** Secrets and capability key management. */
 var OPENCODE_STARTER_CONFIG = JSON.stringify({ $schema: "https://opencode.ai/config.json" }, null, 2) + "\n";
-var logger$8 = createLogger("secrets");
+var logger$9 = createLogger("secrets");
 var VAULT_DIR_MODE = 448;
 var VAULT_FILE_MODE = 384;
 var SECRET_ENV_KEY_RE = /(?:^OP_UI_LOGIN_PASSWORD$|^OP_OPENCODE_PASSWORD$|_API_KEY$|_TOKEN$|_SECRET$|_PASSWORD$)/;
@@ -10945,7 +10945,7 @@ function enforceVaultDirMode(vaultDir) {
 	try {
 		chmodSync(vaultDir, VAULT_DIR_MODE);
 	} catch (error) {
-		logger$8.warn("failed to enforce vault directory permissions", {
+		logger$9.warn("failed to enforce vault directory permissions", {
 			vaultDir,
 			error: error instanceof Error ? error.message : String(error)
 		});
@@ -10956,7 +10956,7 @@ function writeVaultFile(path, content) {
 	try {
 		chmodSync(path, VAULT_FILE_MODE);
 	} catch (error) {
-		logger$8.warn("failed to enforce vault file permissions", {
+		logger$9.warn("failed to enforce vault file permissions", {
 			path,
 			error: error instanceof Error ? error.message : String(error)
 		});
@@ -11021,7 +11021,7 @@ function ensureAuthJson(state) {
 			return;
 		}
 	} catch (error) {
-		logger$8.warn("failed to repair auth.json path", {
+		logger$9.warn("failed to repair auth.json path", {
 			path: authJsonPath$1,
 			error: error instanceof Error ? error.message : String(error)
 		});
@@ -11064,12 +11064,12 @@ function writeAuthJsonProviderKeys(state, providerKeys) {
 		const corruptPath = `${authJsonPath$2}.corrupt-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
 		try {
 			renameSync(authJsonPath$2, corruptPath);
-			logger$8.warn("corrupt auth.json renamed for recovery", {
+			logger$9.warn("corrupt auth.json renamed for recovery", {
 				original: authJsonPath$2,
 				renamed: corruptPath
 			});
 		} catch (renameErr) {
-			logger$8.warn("could not rename corrupt auth.json; starting fresh", {
+			logger$9.warn("could not rename corrupt auth.json; starting fresh", {
 				path: authJsonPath$2,
 				error: renameErr instanceof Error ? renameErr.message : String(renameErr)
 			});
@@ -11209,6 +11209,21 @@ function sha256(content) {
 function randomHex(bytes) {
 	return randomBytes(bytes).toString("hex");
 }
+//#endregion
+//#region ../lib/src/control-plane/core-assets.ts
+/**
+* Core runtime asset management for the OpenPalm control plane.
+*
+* Manages source-of-truth files for the ~/.openpalm/ layout:
+*   stack/              — compose runtime assets (core.compose.yml)
+*
+* This module manages runtime-owned core files only.
+* Addon compose bundle generation and registry catalog refresh are handled
+* separately in registry.ts.
+* Env validation has moved to `akm vault` + the in-house redactor — the
+* historical `.env.schema` files (varlock format) were retired in #391.
+*/
+var logger$8 = createLogger("core-assets");
 function bundledAssetPath(relPath) {
 	return join(dirname(fileURLToPath(import.meta.url)), "../../../../.openpalm", relPath);
 }
@@ -11218,7 +11233,15 @@ function readCoreCompose() {
 	return readFileSync(bundledAssetPath("config/stack/core.compose.yml"), "utf-8");
 }
 function readBundledStackAsset(name) {
-	return readFileSync(bundledAssetPath(`config/stack/${name}`), "utf-8");
+	try {
+		return readFileSync(bundledAssetPath(`config/stack/${name}`), "utf-8");
+	} catch (err) {
+		logger$8.warn("bundled stack asset unavailable (returning empty)", {
+			name,
+			error: err instanceof Error ? err.message : String(err)
+		});
+		return "";
+	}
 }
 function ensureOpenCodeSystemConfig() {
 	mkdirSync(`${resolveDataDir()}/assistant`, { recursive: true });
@@ -13116,6 +13139,7 @@ async function composeDown(options) {
 	const args = buildComposeArgs(options);
 	args.push("down");
 	if (options.removeVolumes) args.push("-v");
+	if (options.removeOrphans) args.push("--remove-orphans");
 	return run$1(args, void 0);
 }
 /**
@@ -13473,9 +13497,18 @@ async function applyTagChange(state, tag) {
 function buildComposeFileList(state) {
 	return discoverStackOverlays(state.stackDir, state.homeDir);
 }
+var CHANNEL_ADDON_IDS = [
+	"api",
+	"chat",
+	"discord",
+	"slack"
+];
 async function buildManagedServices(state) {
 	const composeOpts = buildComposeOptions(state);
-	const services = new Set(CORE_SERVICES);
+	const enabledAddons = listEnabledAddonIds(state.homeDir);
+	const channelsEnabled = enabledAddons.some((a) => CHANNEL_ADDON_IDS.includes(a));
+	const services = new Set(["assistant"]);
+	if (channelsEnabled) services.add("guardian");
 	if (composeOpts.files.length > 0 && !process.env.OP_SKIP_COMPOSE_PREFLIGHT) {
 		const result = await composeConfigServices(composeOpts);
 		if (result.ok && result.services.length > 0) {
@@ -13483,7 +13516,7 @@ async function buildManagedServices(state) {
 			return [...services];
 		}
 	}
-	for (const addon of listEnabledAddonIds(state.homeDir)) for (const s of getAddonServiceNames(state.homeDir, addon)) services.add(s);
+	for (const addon of enabledAddons) for (const s of getAddonServiceNames(state.homeDir, addon)) services.add(s);
 	return [...services];
 }
 //#endregion
@@ -13852,74 +13885,181 @@ async function validateOllamaResponse(res) {
 		return false;
 	}
 }
-var LOCAL_PROVIDER_PROBES = [
-	{
-		provider: "model-runner",
-		probes: [
-			{
-				url: "http://model-runner.docker.internal/engines/v1/models",
-				baseUrl: "http://model-runner.docker.internal/engines"
-			},
-			{
-				url: "http://model-runner.docker.internal:12434/engines/v1/models",
-				baseUrl: "http://model-runner.docker.internal:12434/engines"
-			},
-			{
-				url: "http://host.docker.internal:12434/engines/v1/models",
-				baseUrl: "http://host.docker.internal:12434/engines"
-			},
-			{
-				url: "http://localhost:12434/engines/v1/models",
-				baseUrl: "http://localhost:12434/engines"
-			}
-		]
-	},
-	{
-		provider: "ollama",
-		probes: [
-			{
-				url: "http://ollama:11434/api/tags",
-				baseUrl: "http://ollama:11434",
-				validate: validateOllamaResponse
-			},
-			{
-				url: "http://host.docker.internal:11434/api/tags",
-				baseUrl: "http://host.docker.internal:11434",
-				validate: validateOllamaResponse
-			},
-			{
-				url: "http://localhost:11434/api/tags",
-				baseUrl: "http://localhost:11434",
-				validate: validateOllamaResponse
-			}
-		]
-	},
-	{
-		provider: "lmstudio",
-		probes: [{
-			url: "http://host.docker.internal:1234/v1/models",
-			baseUrl: "http://host.docker.internal:1234"
-		}, {
-			url: "http://localhost:1234/v1/models",
-			baseUrl: "http://localhost:1234"
-		}]
+/**
+* Parse an OLLAMA_HOST env value into a normalized base URL string, or null if
+* the input is absent/malformed.
+*
+* Accepted forms:
+*   - bare port:                "9999"           → "http://localhost:9999"
+*   - host:port:                "127.0.0.1:9999" → "http://127.0.0.1:9999"
+*   - full URL (http/https):    "http://h:9999"  → "http://h:9999"
+*   - bare hostname:            "localhost"       → "http://localhost:11434"  (default port)
+*
+* Returns null for empty string, non-numeric bare tokens that aren't valid
+* hostnames, and any other garbage.
+*/
+function parseOllamaHostEnv(raw) {
+	if (!raw || raw.trim() === "") return null;
+	const s = raw.trim();
+	if (s.startsWith("http://") || s.startsWith("https://")) try {
+		const u = new URL(s);
+		if (!u.hostname) return null;
+		return u.origin;
+	} catch {
+		return null;
 	}
-];
+	if (/^\d+$/.test(s)) {
+		const port = parseInt(s, 10);
+		if (port < 1 || port > 65535) return null;
+		return `http://localhost:${port}`;
+	}
+	const colonIdx = s.lastIndexOf(":");
+	if (colonIdx > 0) {
+		const host = s.slice(0, colonIdx);
+		const portStr = s.slice(colonIdx + 1);
+		if (!/^\d+$/.test(portStr)) return null;
+		const port = parseInt(portStr, 10);
+		if (port < 1 || port > 65535) return null;
+		if (/[\s/]/.test(host)) return null;
+		return `http://${host}:${port}`;
+	}
+	if (/^[a-zA-Z0-9._-]+$/.test(s)) return `http://${s}:11434`;
+	return null;
+}
+/**
+* Parse a bare port env value (e.g. LMSTUDIO_PORT, MODEL_RUNNER_PORT) into an
+* integer, or null if absent/malformed.
+*/
+function parsePortEnv(raw) {
+	if (!raw || raw.trim() === "") return null;
+	const n = parseInt(raw.trim(), 10);
+	if (!Number.isFinite(n) || n < 1 || n > 65535) return null;
+	return n;
+}
+/**
+* Probe timeout in milliseconds.
+*
+* 5 000 ms is chosen to tolerate slow/loaded machines without blocking the
+* caller for too long.  Override with OP_LOCAL_PROBE_TIMEOUT_MS (clamped to
+* a floor of 1 000 ms so the env value can't make probes never-timeout).
+*/
+function getProbeTimeoutMs() {
+	const floor = 1e3;
+	const envRaw = process.env["OP_LOCAL_PROBE_TIMEOUT_MS"];
+	if (envRaw) {
+		const n = parseInt(envRaw, 10);
+		if (Number.isFinite(n) && n >= floor) return n;
+	}
+	return 5e3;
+}
+/** Build the ordered probe list for model-runner, prepending any env-configured port. */
+function buildModelRunnerProbes() {
+	const defaults = [
+		{
+			url: "http://model-runner.docker.internal/engines/v1/models",
+			baseUrl: "http://model-runner.docker.internal/engines"
+		},
+		{
+			url: "http://model-runner.docker.internal:12434/engines/v1/models",
+			baseUrl: "http://model-runner.docker.internal:12434/engines"
+		},
+		{
+			url: "http://host.docker.internal:12434/engines/v1/models",
+			baseUrl: "http://host.docker.internal:12434/engines"
+		},
+		{
+			url: "http://localhost:12434/engines/v1/models",
+			baseUrl: "http://localhost:12434/engines"
+		}
+	];
+	const port = parsePortEnv(process.env["MODEL_RUNNER_PORT"]);
+	if (port !== null) return [{
+		url: `http://localhost:${port}/engines/v1/models`,
+		baseUrl: `http://localhost:${port}/engines`
+	}, ...defaults];
+	return defaults;
+}
+/** Build the ordered probe list for ollama, prepending any env-configured endpoint. */
+function buildOllamaProbes() {
+	const defaults = [
+		{
+			url: "http://ollama:11434/api/tags",
+			baseUrl: "http://ollama:11434",
+			validate: validateOllamaResponse
+		},
+		{
+			url: "http://host.docker.internal:11434/api/tags",
+			baseUrl: "http://host.docker.internal:11434",
+			validate: validateOllamaResponse
+		},
+		{
+			url: "http://localhost:11434/api/tags",
+			baseUrl: "http://localhost:11434",
+			validate: validateOllamaResponse
+		}
+	];
+	const base = parseOllamaHostEnv(process.env["OLLAMA_HOST"]);
+	if (base !== null) return [{
+		url: `${base}/api/tags`,
+		baseUrl: base,
+		validate: validateOllamaResponse
+	}, ...defaults];
+	return defaults;
+}
+/** Build the ordered probe list for lmstudio, prepending any env-configured port. */
+function buildLmStudioProbes() {
+	const defaults = [{
+		url: "http://host.docker.internal:1234/v1/models",
+		baseUrl: "http://host.docker.internal:1234"
+	}, {
+		url: "http://localhost:1234/v1/models",
+		baseUrl: "http://localhost:1234"
+	}];
+	const port = parsePortEnv(process.env["LMSTUDIO_PORT"] ?? process.env["LM_STUDIO_PORT"]);
+	if (port !== null) return [{
+		url: `http://localhost:${port}/v1/models`,
+		baseUrl: `http://localhost:${port}`
+	}, ...defaults];
+	return defaults;
+}
 /**
 * Detect all available local providers by probing well-known endpoints.
 * Returns results for all providers (available or not) in parallel.
 */
 async function detectLocalProviders() {
-	return await Promise.all(LOCAL_PROVIDER_PROBES.map(async ({ provider, probes }) => {
+	const probeTimeoutMs = getProbeTimeoutMs();
+	const providerProbes = [
+		{
+			provider: "model-runner",
+			probes: buildModelRunnerProbes()
+		},
+		{
+			provider: "ollama",
+			probes: buildOllamaProbes()
+		},
+		{
+			provider: "lmstudio",
+			probes: buildLmStudioProbes()
+		}
+	];
+	return await Promise.all(providerProbes.map(async ({ provider, probes }) => {
 		for (const { url: probeUrl, baseUrl, validate } of probes) try {
-			const res = await fetch(probeUrl, { signal: AbortSignal.timeout(3e3) });
+			const res = await fetch(probeUrl, { signal: AbortSignal.timeout(probeTimeoutMs) });
 			if (res.ok) {
-				if (validate && !await validate(res)) {
-					logger$2.debug("provider probe response failed validation", {
-						provider,
-						url: baseUrl
-					});
-					continue;
+				if (validate) {
+					const resForValidate = res.clone();
+					if (!await validate(res)) {
+						let bodySnippet = "(unreadable)";
+						try {
+							bodySnippet = (await resForValidate.text()).slice(0, 500);
+						} catch {}
+						logger$2.debug("provider probe response failed validation", {
+							provider,
+							url: probeUrl,
+							bodySnippet
+						});
+						continue;
+					}
 				}
 				logger$2.debug("detected local provider", {
 					provider,
@@ -14073,19 +14213,25 @@ var labelHostProviders = (h) => h.map((p) => p.provider).join(" and ");
 * Decide what setup should do, given detected providers + hardware.
 *
 * Order (first match wins):
-*  1. cloud provider connected      -> use it.
-*  2. host-local provider running   -> add it, proceed.
-*  3. darwin + apple GPU            -> guide to HOST Ollama (Metal); never in-stack.
-*  4. capable GPU (>= threshold)    -> enable in-stack Ollama.
-*  5. otherwise                     -> ask the user to connect a provider.
+*  1. cloud provider connected              -> use it.
+*  2. host OpenCode has credentials         -> steer to import; NEVER auto-enable Ollama.
+*  3. host-local provider running           -> add it, proceed.
+*  4. darwin + apple GPU                    -> guide to HOST Ollama (Metal); never in-stack.
+*  5. capable GPU (>= threshold)            -> enable in-stack Ollama.
+*  6. otherwise                             -> ask the user to connect a provider.
 */
 function recommendSetup(input) {
 	const { cloudProviders, hostProviders, gpu } = input;
 	const platform = input.platform ?? process.platform;
+	const hostCredentialCount = input.hostCredentialCount ?? 0;
 	if (cloudProviders.length > 0) return {
 		action: "use-cloud",
 		cloudProviders
 	};
+	if (hostCredentialCount > 0) return {
+		action: "connect-manually",
+		alert: "Your host OpenCode installation has configured AI providers. Import them now to use your existing setup — click \"Import from host OpenCode\" on the Providers step, or connect a provider manually."
+	};
 	if (hostProviders.length > 0) return {
 		action: "use-host-providers",
 		hostProviders,
@@ -14732,4 +14878,4 @@ function importHostOpenCode(state, options = {}) {
 }
 
 export { hostAkmStashPath as $, AKM_USER_ENV_REF as A, createState as B, CORE_SERVICES as C, deleteUserEnvKey as D, detectExistingProject as E, detectGpu as F, detectHostOpenCode as G, detectLocalProviders as H, disableHostAkmSharing as I, enableHostAkmSharing as J, ensureAkmUserEnv as K, ensureHomeDirs as L, MigrationError as M, ensureMigrated as N, ensureOpenCodeConfig as O, PROVIDER_KEY_MAP as P, ensureOpenCodeSystemConfig as Q, ensureSecrets as R, executeAutomation as S, fetchProviderModels as T, getAddonProfileAvailability as U, getAddonProfileSelection as V, getAddonProfiles as W, getAddonServiceNames as X, getDockerEvents as Y, getHostAkmSharingStatus as Z, getRegistryAddonConfig as _, addonProfileId as a, importHostOpenCode as a0, isAllowedService as a1, isHostAkmAvailable as a2, isSetupComplete as a3, listAvailableAddonIds as a4, listEnabledAddonIds as a5, listSecretFiles as a6, loadAutomations as a7, parseComposeStderr as a8, parseEnvFile as a9, writeTaskFile as aA, writeUserEnvKey as aB, writeVoiceVars as aC, performSetup as aa, performUpgrade as ab, readAutomationLogs as ac, readSecret as ad, readSecretFile as ae, readStackEnv as af, readStackRuntimeEnv as ag, readStackSecretEnv as ah, readTaskFile as ai, readUserEnvFile as aj, recommendSetup as ak, removeSecretFile as al, removeTaskFile as am, resolveComposeProjectName as an, resolveDataDir as ao, resolveRuntimeFiles as ap, resolveStackDir as aq, seedUiBuild as ar, setAddonEnabled as as, setAddonProfileSelection as at, summarizeComposeStderr as au, validateProposedState as av, writeFileAtomic as aw, writeRuntimeFiles as ax, writeSecretFile as ay, writeStackSecretEnv as az, annotateAddonProfileAvailability as b, applyInstall as c, applyTagChange as d, applyUninstall as e, applyUpdate as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, buildAkmEnv as j, buildComposeOptions as k, buildManagedServices as l, checkDocker as m, checkDockerCompose as n, composeDown as o, composeLogs as p, composePreflight as q, composePs as r, composePull as s, composeRestart as t, composeStart as u, composeStats as v, composeStop as w, composeUp as x, createLogger as y, createOpenCodeClient as z };
-//# sourceMappingURL=src-DJv-Q_k2.js.map
+//# sourceMappingURL=src-Bg3Hw0f8.js.map