@openpalm/ui 0.12.11 → 0.12.13

package/build/server/chunks/{config-36DEvVZH.js.map → config-CO8OSXtU.js.map}

@@ -1 +1 @@
-{"version":3,"file":"config-36DEvVZH.js","sources":["../../../.svelte-kit/adapter-node/chunks/config.js"],"sourcesContent":["import { n as asRecord } from \"./coercion.js\";\nimport { t as opencodeFetch } from \"./http.js\";\nimport { readFileSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\n//#region src/lib/server/opencode/config.ts\n/**\n* OpenCode config read/write + small mutation helpers.\n*\n* Reads/writes `OP_HOME/config/assistant/opencode.json` directly because the\n* container mount is read-only and OpenCode's PATCH /config does not persist\n* to disk. We still call PATCH afterwards (best-effort) so the live process\n* picks up the change without a restart.\n*/\nfunction configPath() {\n\treturn join(process.env.OP_HOME ?? \"\", \"config\", \"assistant\", \"opencode.json\");\n}\nasync function getCurrentConfig() {\n\ttry {\n\t\treturn JSON.parse(readFileSync(configPath(), \"utf-8\"));\n\t} catch {\n\t\treturn opencodeFetch(\"/config\");\n\t}\n}\nasync function patchConfig(config) {\n\tlet existing = {};\n\ttry {\n\t\texisting = JSON.parse(readFileSync(configPath(), \"utf-8\"));\n\t} catch {}\n\tconst merged = {\n\t\t...existing,\n\t\t...config\n\t};\n\tif (config.provider) merged.provider = {\n\t\t...existing.provider ?? {},\n\t\t...config.provider\n\t};\n\twriteFileSync(configPath(), JSON.stringify(merged, null, 2) + \"\\n\");\n\tawait opencodeFetch(\"/config\", {\n\t\tmethod: \"PATCH\",\n\t\tbody: JSON.stringify(config)\n\t}).catch(() => {});\n\treturn merged;\n}\nfunction normalizeProviderConfig(providerConfig) {\n\tconst normalized = providerConfig ? { ...providerConfig } : {};\n\tconst options = asRecord(normalized.options);\n\tif (options && Object.keys(options).length === 0) delete normalized.options;\n\treturn Object.keys(normalized).length > 0 ? normalized : void 0;\n}\nfunction setProviderEnabled(config, providerId, enabled) {\n\tconst disabled = new Set(config.disabled_providers ?? []);\n\tconst allowlist = config.enabled_providers ? new Set(config.enabled_providers) : void 0;\n\tif (enabled) {\n\t\tdisabled.delete(providerId);\n\t\tallowlist?.add(providerId);\n\t} else {\n\t\tdisabled.add(providerId);\n\t\tallowlist?.delete(providerId);\n\t}\n\tconfig.disabled_providers = Array.from(disabled).sort();\n\tif (allowlist) config.enabled_providers = Array.from(allowlist).sort();\n\treturn config;\n}\n/** Save non-credential connection options (baseURL, headers, timeout, etc.) for a provider. */\nasync function setProviderOptions(providerId, options) {\n\tconst config = await getCurrentConfig();\n\tconst providerConfig = { ...config.provider ?? {} };\n\tconst current = asRecord(providerConfig[providerId]) ?? {};\n\tconst nextOptions = { ...asRecord(current.options) ?? {} };\n\tdelete nextOptions.apiKey;\n\tif (options.baseURL) nextOptions.baseURL = options.baseURL;\n\telse delete nextOptions.baseURL;\n\tif (options.enterpriseUrl) nextOptions.enterpriseUrl = options.enterpriseUrl;\n\telse delete nextOptions.enterpriseUrl;\n\tif (options.timeout !== void 0 && options.timeout > 0) nextOptions.timeout = options.timeout;\n\telse delete nextOptions.timeout;\n\tif (options.setCacheKey === true) nextOptions.setCacheKey = true;\n\telse delete nextOptions.setCacheKey;\n\tif (options.headers && Object.keys(options.headers).length > 0) nextOptions.headers = options.headers;\n\telse delete nextOptions.headers;\n\tconst nextEntry = normalizeProviderConfig({\n\t\t...current,\n\t\toptions: nextOptions\n\t});\n\tif (nextEntry) providerConfig[providerId] = nextEntry;\n\telse delete providerConfig[providerId];\n\tconfig.provider = providerConfig;\n\tawait patchConfig(config);\n}\n/** Register a provider entry (local-detected or fully custom) in opencode.json. */\nasync function registerProvider(providerId, entry, overwrite = false) {\n\tconst config = await getCurrentConfig();\n\tconst providerConfig = { ...config.provider ?? {} };\n\tif (providerConfig[providerId] && !overwrite) return { alreadyExists: true };\n\tproviderConfig[providerId] = {\n\t\t...asRecord(providerConfig[providerId]),\n\t\t...entry.npm !== void 0 ? { npm: entry.npm } : {},\n\t\t...entry.name !== void 0 ? { name: entry.name } : {},\n\t\t...entry.options !== void 0 ? { options: entry.options } : {},\n\t\t...entry.models !== void 0 ? { models: entry.models } : {}\n\t};\n\tconfig.provider = providerConfig;\n\tawait patchConfig(config);\n\treturn { alreadyExists: false };\n}\n/** Set the main model (or small model) in opencode.json. */\nasync function setMainModel(providerId, modelId, target) {\n\tconst config = await getCurrentConfig();\n\tconfig[target] = `${providerId}/${modelId}`;\n\tawait patchConfig(config);\n}\n/** Clear the main model (or small model) in opencode.json. */\nasync function unsetMainModel(target) {\n\tconst config = await getCurrentConfig();\n\tdelete config[target];\n\tawait patchConfig(config);\n}\n//#endregion\nexport { setProviderEnabled as a, setMainModel as i, patchConfig as n, setProviderOptions as o, registerProvider as r, unsetMainModel as s, getCurrentConfig as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,UAAU,GAAG;AACtB,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,CAAC;AAC/E;AACA,eAAe,gBAAgB,GAAG;AAClC,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,aAAa,CAAC,SAAS,CAAC;AACjC,CAAC;AACD;AACA,eAAe,WAAW,CAAC,MAAM,EAAE;AACnC,CAAC,IAAI,QAAQ,GAAG,EAAE;AAClB,CAAC,IAAI;AACL,EAAE,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,MAAM,MAAM,GAAG;AAChB,EAAE,GAAG,QAAQ;AACb,EAAE,GAAG;AACL,EAAE;AACF,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG;AACxC,EAAE,GAAG,QAAQ,CAAC,QAAQ,IAAI,EAAE;AAC5B,EAAE,GAAG,MAAM,CAAC;AACZ,EAAE;AACF,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AACpE,CAAC,MAAM,aAAa,CAAC,SAAS,EAAE;AAChC,EAAE,MAAM,EAAE,OAAO;AACjB,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM;AAC7B,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;AACnB,CAAC,OAAO,MAAM;AACd;AACA,SAAS,uBAAuB,CAAC,cAAc,EAAE;AACjD,CAAC,MAAM,UAAU,GAAG,cAAc,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,EAAE;AAC/D,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;AAC7C,CAAC,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,OAAO;AAC5E,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,UAAU,GAAG,MAAM;AAChE;AACA,SAAS,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE;AACzD,CAAC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC;AAC1D,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,iBAAiB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,MAAM;AACxF,CAAC,IAAI,OAAO,EAAE;AACd,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;AAC7B,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC;AAC5B,CAAC,CAAC,MAAM;AACR,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC;AAC1B,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC;AAC/B,CAAC;AACD,CAAC,MAAM,CAAC,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE;AACxD,CAAC,IAAI,SAAS,EAAE,MAAM,CAAC,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE;AACvE,CAAC,OAAO,MAAM;AACd;AACA;AACA,eAAe,kBAAkB,CAAC,UAAU,EAAE,OAAO,EAAE;AACvD,CAAC,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE;AACxC,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE;AACpD,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE;AAC3D,CAAC,MAAM,WAAW,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE;AAC3D,CAAC,OAAO,WAAW,CAAC,MAAM;AAC1B,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO;AAC3D,MAAM,OAAO,WAAW,CAAC,OAAO;AAChC,CAAC,IAAI,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa;AAC7E,MAAM,OAAO,WAAW,CAAC,aAAa;AACtC,CAAC,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC,EAAE,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO;AAC7F,MAAM,OAAO,WAAW,CAAC,OAAO;AAChC,CAAC,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,EAAE,WAAW,CAAC,WAAW,GAAG,IAAI;AACjE,MAAM,OAAO,WAAW,CAAC,WAAW;AACpC,CAAC,IAAI,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO;AACtG,MAAM,OAAO,WAAW,CAAC,OAAO;AAChC,CAAC,MAAM,SAAS,GAAG,uBAAuB,CAAC;AAC3C,EAAE,GAAG,OAAO;AACZ,EAAE,OAAO,EAAE;AACX,EAAE,CAAC;AACH,CAAC,IAAI,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,SAAS;AACtD,MAAM,OAAO,cAAc,CAAC,UAAU,CAAC;AACvC,CAAC,MAAM,CAAC,QAAQ,GAAG,cAAc;AACjC,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC;AAC1B;AACA;AACA,eAAe,gBAAgB,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,GAAG,KAAK,EAAE;AACtE,CAAC,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE;AACxC,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE;AACpD,CAAC,IAAI,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE;AAC7E,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG;AAC9B,EAAE,GAAG,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;AACzC,EAAE,GAAG,KAAK,CAAC,GAAG,KAAK,MAAM,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE;AACnD,EAAE,GAAG,KAAK,CAAC,IAAI,KAAK,MAAM,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE;AACtD,EAAE,GAAG,KAAK,CAAC,OAAO,KAAK,MAAM,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE;AAC/D,EAAE,GAAG,KAAK,CAAC,MAAM,KAAK,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG;AAC1D,EAAE;AACF,CAAC,MAAM,CAAC,QAAQ,GAAG,cAAc;AACjC,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC;AAC1B,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE;AAChC;AACA;AACA,eAAe,YAAY,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE;AACzD,CAAC,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE;AACxC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC;AAC1B;AACA;AACA,eAAe,cAAc,CAAC,MAAM,EAAE;AACtC,CAAC,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE;AACxC,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC;AACtB,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC;AAC1B;;;;"}
+{"version":3,"file":"config-CO8OSXtU.js","sources":["../../../.svelte-kit/adapter-node/chunks/config.js"],"sourcesContent":["import { n as asRecord } from \"./coercion.js\";\nimport { t as opencodeFetch } from \"./http.js\";\nimport { readFileSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\n//#region src/lib/server/opencode/config.ts\n/**\n* OpenCode config read/write + small mutation helpers.\n*\n* Reads/writes `OP_HOME/config/assistant/opencode.json` directly because the\n* container mount is read-only and OpenCode's PATCH /config does not persist\n* to disk. We still call PATCH afterwards (best-effort) so the live process\n* picks up the change without a restart.\n*/\nfunction configPath() {\n\treturn join(process.env.OP_HOME ?? \"\", \"config\", \"assistant\", \"opencode.json\");\n}\nasync function getCurrentConfig() {\n\ttry {\n\t\treturn JSON.parse(readFileSync(configPath(), \"utf-8\"));\n\t} catch {\n\t\treturn opencodeFetch(\"/config\");\n\t}\n}\nasync function patchConfig(config) {\n\tlet existing = {};\n\ttry {\n\t\texisting = JSON.parse(readFileSync(configPath(), \"utf-8\"));\n\t} catch {}\n\tconst merged = {\n\t\t...existing,\n\t\t...config\n\t};\n\tif (config.provider) merged.provider = {\n\t\t...existing.provider ?? {},\n\t\t...config.provider\n\t};\n\twriteFileSync(configPath(), JSON.stringify(merged, null, 2) + \"\\n\");\n\tawait opencodeFetch(\"/config\", {\n\t\tmethod: \"PATCH\",\n\t\tbody: JSON.stringify(config)\n\t}).catch(() => {});\n\treturn merged;\n}\nfunction normalizeProviderConfig(providerConfig) {\n\tconst normalized = providerConfig ? { ...providerConfig } : {};\n\tconst options = asRecord(normalized.options);\n\tif (options && Object.keys(options).length === 0) delete normalized.options;\n\treturn Object.keys(normalized).length > 0 ? normalized : void 0;\n}\nfunction setProviderEnabled(config, providerId, enabled) {\n\tconst disabled = new Set(config.disabled_providers ?? []);\n\tconst allowlist = config.enabled_providers ? new Set(config.enabled_providers) : void 0;\n\tif (enabled) {\n\t\tdisabled.delete(providerId);\n\t\tallowlist?.add(providerId);\n\t} else {\n\t\tdisabled.add(providerId);\n\t\tallowlist?.delete(providerId);\n\t}\n\tconfig.disabled_providers = Array.from(disabled).sort();\n\tif (allowlist) config.enabled_providers = Array.from(allowlist).sort();\n\treturn config;\n}\n/** Save non-credential connection options (baseURL, headers, timeout, etc.) for a provider. */\nasync function setProviderOptions(providerId, options) {\n\tconst config = await getCurrentConfig();\n\tconst providerConfig = { ...config.provider ?? {} };\n\tconst current = asRecord(providerConfig[providerId]) ?? {};\n\tconst nextOptions = { ...asRecord(current.options) ?? {} };\n\tdelete nextOptions.apiKey;\n\tif (options.baseURL) nextOptions.baseURL = options.baseURL;\n\telse delete nextOptions.baseURL;\n\tif (options.enterpriseUrl) nextOptions.enterpriseUrl = options.enterpriseUrl;\n\telse delete nextOptions.enterpriseUrl;\n\tif (options.timeout !== void 0 && options.timeout > 0) nextOptions.timeout = options.timeout;\n\telse delete nextOptions.timeout;\n\tif (options.setCacheKey === true) nextOptions.setCacheKey = true;\n\telse delete nextOptions.setCacheKey;\n\tif (options.headers && Object.keys(options.headers).length > 0) nextOptions.headers = options.headers;\n\telse delete nextOptions.headers;\n\tconst nextEntry = normalizeProviderConfig({\n\t\t...current,\n\t\toptions: nextOptions\n\t});\n\tif (nextEntry) providerConfig[providerId] = nextEntry;\n\telse delete providerConfig[providerId];\n\tconfig.provider = providerConfig;\n\tawait patchConfig(config);\n}\n/** Register a provider entry (local-detected or fully custom) in opencode.json. */\nasync function registerProvider(providerId, entry, overwrite = false) {\n\tconst config = await getCurrentConfig();\n\tconst providerConfig = { ...config.provider ?? {} };\n\tif (providerConfig[providerId] && !overwrite) return { alreadyExists: true };\n\tproviderConfig[providerId] = {\n\t\t...asRecord(providerConfig[providerId]),\n\t\t...entry.npm !== void 0 ? { npm: entry.npm } : {},\n\t\t...entry.name !== void 0 ? { name: entry.name } : {},\n\t\t...entry.options !== void 0 ? { options: entry.options } : {},\n\t\t...entry.models !== void 0 ? { models: entry.models } : {}\n\t};\n\tconfig.provider = providerConfig;\n\tawait patchConfig(config);\n\treturn { alreadyExists: false };\n}\n/** Set the main model (or small model) in opencode.json. */\nasync function setMainModel(providerId, modelId, target) {\n\tconst config = await getCurrentConfig();\n\tconfig[target] = `${providerId}/${modelId}`;\n\tawait patchConfig(config);\n}\n/** Clear the main model (or small model) in opencode.json. */\nasync function unsetMainModel(target) {\n\tconst config = await getCurrentConfig();\n\tdelete config[target];\n\tawait patchConfig(config);\n}\n//#endregion\nexport { setProviderEnabled as a, setMainModel as i, patchConfig as n, setProviderOptions as o, registerProvider as r, unsetMainModel as s, getCurrentConfig as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,UAAU,GAAG;AACtB,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,CAAC;AAC/E;AACA,eAAe,gBAAgB,GAAG;AAClC,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,aAAa,CAAC,SAAS,CAAC;AACjC,CAAC;AACD;AACA,eAAe,WAAW,CAAC,MAAM,EAAE;AACnC,CAAC,IAAI,QAAQ,GAAG,EAAE;AAClB,CAAC,IAAI;AACL,EAAE,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,MAAM,MAAM,GAAG;AAChB,EAAE,GAAG,QAAQ;AACb,EAAE,GAAG;AACL,EAAE;AACF,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG;AACxC,EAAE,GAAG,QAAQ,CAAC,QAAQ,IAAI,EAAE;AAC5B,EAAE,GAAG,MAAM,CAAC;AACZ,EAAE;AACF,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AACpE,CAAC,MAAM,aAAa,CAAC,SAAS,EAAE;AAChC,EAAE,MAAM,EAAE,OAAO;AACjB,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM;AAC7B,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;AACnB,CAAC,OAAO,MAAM;AACd;AACA,SAAS,uBAAuB,CAAC,cAAc,EAAE;AACjD,CAAC,MAAM,UAAU,GAAG,cAAc,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,EAAE;AAC/D,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;AAC7C,CAAC,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,OAAO;AAC5E,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,UAAU,GAAG,MAAM;AAChE;AACA,SAAS,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE;AACzD,CAAC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC;AAC1D,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,iBAAiB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,MAAM;AACxF,CAAC,IAAI,OAAO,EAAE;AACd,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;AAC7B,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC;AAC5B,CAAC,CAAC,MAAM;AACR,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC;AAC1B,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC;AAC/B,CAAC;AACD,CAAC,MAAM,CAAC,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE;AACxD,CAAC,IAAI,SAAS,EAAE,MAAM,CAAC,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE;AACvE,CAAC,OAAO,MAAM;AACd;AACA;AACA,eAAe,kBAAkB,CAAC,UAAU,EAAE,OAAO,EAAE;AACvD,CAAC,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE;AACxC,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE;AACpD,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE;AAC3D,CAAC,MAAM,WAAW,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE;AAC3D,CAAC,OAAO,WAAW,CAAC,MAAM;AAC1B,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO;AAC3D,MAAM,OAAO,WAAW,CAAC,OAAO;AAChC,CAAC,IAAI,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa;AAC7E,MAAM,OAAO,WAAW,CAAC,aAAa;AACtC,CAAC,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC,EAAE,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO;AAC7F,MAAM,OAAO,WAAW,CAAC,OAAO;AAChC,CAAC,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,EAAE,WAAW,CAAC,WAAW,GAAG,IAAI;AACjE,MAAM,OAAO,WAAW,CAAC,WAAW;AACpC,CAAC,IAAI,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO;AACtG,MAAM,OAAO,WAAW,CAAC,OAAO;AAChC,CAAC,MAAM,SAAS,GAAG,uBAAuB,CAAC;AAC3C,EAAE,GAAG,OAAO;AACZ,EAAE,OAAO,EAAE;AACX,EAAE,CAAC;AACH,CAAC,IAAI,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,SAAS;AACtD,MAAM,OAAO,cAAc,CAAC,UAAU,CAAC;AACvC,CAAC,MAAM,CAAC,QAAQ,GAAG,cAAc;AACjC,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC;AAC1B;AACA;AACA,eAAe,gBAAgB,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,GAAG,KAAK,EAAE;AACtE,CAAC,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE;AACxC,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE;AACpD,CAAC,IAAI,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE;AAC7E,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG;AAC9B,EAAE,GAAG,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;AACzC,EAAE,GAAG,KAAK,CAAC,GAAG,KAAK,MAAM,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE;AACnD,EAAE,GAAG,KAAK,CAAC,IAAI,KAAK,MAAM,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE;AACtD,EAAE,GAAG,KAAK,CAAC,OAAO,KAAK,MAAM,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE;AAC/D,EAAE,GAAG,KAAK,CAAC,MAAM,KAAK,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG;AAC1D,EAAE;AACF,CAAC,MAAM,CAAC,QAAQ,GAAG,cAAc;AACjC,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC;AAC1B,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE;AAChC;AACA;AACA,eAAe,YAAY,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE;AACzD,CAAC,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE;AACxC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC;AAC1B;AACA;AACA,eAAe,cAAc,CAAC,MAAM,EAAE;AACtC,CAAC,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE;AACxC,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC;AACtB,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC;AAC1B;;;;"}

package/build/server/chunks/{docker-Xky8KsOe.js → docker-CTjWsP_Q.js}

@@ -1,4 +1,4 @@
-import { x as composeRestart$1, u as composePreflight, aM as resolveComposeProjectName } from './src-BrowG4c5.js';
+import { y as composeRestart$1, v as composePreflight, aQ as resolveComposeProjectName } from './src-CidJbygh.js';
 
 //#region src/lib/server/docker.ts
 async function runPreflight(options) {
@@ -17,4 +17,4 @@ async function composeRestart(services, options) {
 }
 
 export { composeRestart as c };
-//# sourceMappingURL=docker-Xky8KsOe.js.map
+//# sourceMappingURL=docker-CTjWsP_Q.js.map

package/build/server/chunks/{docker-Xky8KsOe.js.map → docker-CTjWsP_Q.js.map}

@@ -1 +1 @@
-{"version":3,"file":"docker-Xky8KsOe.js","sources":["../../../.svelte-kit/adapter-node/chunks/docker.js"],"sourcesContent":["import { at as composePreflight, ct as composeRestart$1, mt as resolveComposeProjectName } from \"./src.js\";\n//#region src/lib/server/docker.ts\nasync function runPreflight(options) {\n\tif (options.files.length === 0 || process.env.OP_SKIP_COMPOSE_PREFLIGHT) return;\n\tconst result = await composePreflight(options);\n\tif (!result.ok) {\n\t\tconst project = resolveComposeProjectName();\n\t\tconst fileArgs = options.files.map((f) => `-f ${f}`).join(\" \");\n\t\tconst envArgs = (options.envFiles ?? []).map((f) => `--env-file ${f}`).join(\" \");\n\t\tthrow new Error(`Compose preflight failed: ${result.stderr}\\nResolved command: docker compose ${fileArgs} --project-name ${project} ${envArgs} config --quiet`);\n\t}\n}\nasync function composeRestart(services, options) {\n\tawait runPreflight(options);\n\treturn composeRestart$1(services, options);\n}\n//#endregion\nexport { composeRestart as t };\n"],"names":[],"mappings":";;AACA;AACA,eAAe,YAAY,CAAC,OAAO,EAAE;AACrC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE;AAC1E,CAAC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC;AAC/C,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE;AACjB,EAAE,MAAM,OAAO,GAAG,yBAAyB,EAAE;AAC7C,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;AAChE,EAAE,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;AAClF,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC,mCAAmC,EAAE,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;AACjK,CAAC;AACD;AACA,eAAe,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE;AACjD,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC;AAC5B,CAAC,OAAO,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC;AAC3C;;;;"}
+{"version":3,"file":"docker-CTjWsP_Q.js","sources":["../../../.svelte-kit/adapter-node/chunks/docker.js"],"sourcesContent":["import { ft as composeRestart$1, lt as composePreflight, vt as resolveComposeProjectName } from \"./src.js\";\n//#region src/lib/server/docker.ts\nasync function runPreflight(options) {\n\tif (options.files.length === 0 || process.env.OP_SKIP_COMPOSE_PREFLIGHT) return;\n\tconst result = await composePreflight(options);\n\tif (!result.ok) {\n\t\tconst project = resolveComposeProjectName();\n\t\tconst fileArgs = options.files.map((f) => `-f ${f}`).join(\" \");\n\t\tconst envArgs = (options.envFiles ?? []).map((f) => `--env-file ${f}`).join(\" \");\n\t\tthrow new Error(`Compose preflight failed: ${result.stderr}\\nResolved command: docker compose ${fileArgs} --project-name ${project} ${envArgs} config --quiet`);\n\t}\n}\nasync function composeRestart(services, options) {\n\tawait runPreflight(options);\n\treturn composeRestart$1(services, options);\n}\n//#endregion\nexport { composeRestart as t };\n"],"names":[],"mappings":";;AACA;AACA,eAAe,YAAY,CAAC,OAAO,EAAE;AACrC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE;AAC1E,CAAC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC;AAC/C,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE;AACjB,EAAE,MAAM,OAAO,GAAG,yBAAyB,EAAE;AAC7C,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;AAChE,EAAE,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;AAClF,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC,mCAAmC,EAAE,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;AACjK,CAAC;AACD;AACA,eAAe,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE;AACjD,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC;AAC5B,CAAC,OAAO,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC;AAC3C;;;;"}

package/build/server/chunks/{endpoints-DIQ-qrrL.js → endpoints-UdQGgKsR.js}

@@ -1,4 +1,4 @@
-import { g as getState } from './state-uRAQa1hp.js';
+import { g as getState } from './state-fxN45gBp.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, chmodSync, unlinkSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { randomUUID } from 'node:crypto';
@@ -383,4 +383,4 @@ async function listRemoteStatuses() {
 }
 
 export { addEndpoint as a, listRemoteStatuses as b, deleteEndpoint as d, getActiveEndpoint as g, listEndpoints as l, setActiveId as s, updateEndpoint as u, validateEndpointUrl as v };
-//# sourceMappingURL=endpoints-DIQ-qrrL.js.map
+//# sourceMappingURL=endpoints-UdQGgKsR.js.map

package/build/server/chunks/{endpoints-DIQ-qrrL.js.map → endpoints-UdQGgKsR.js.map}

@@ -1 +1 @@
-{"version":3,"file":"endpoints-DIQ-qrrL.js","sources":["../../../.svelte-kit/adapter-node/chunks/endpoints.js"],"sourcesContent":["import { t as getState } from \"./state.js\";\nimport { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from \"node:fs\";\nimport { dirname } from \"node:path\";\nimport { randomUUID } from \"node:crypto\";\n//#region src/lib/server/endpoints.ts\n/**\n* Assistant endpoints — list of OpenCode servers the UI can target, with\n* one marked active. The \"default\" entry is synthesized from environment\n* (OP_OPENCODE_URL / OP_ASSISTANT_URL / OP_ASSISTANT_PORT) and cannot be\n* deleted. User-added endpoints are persisted to a JSON file in the\n* config directory (it's user-owned configuration, not service state —\n* see Phase 5 / D4 in docs/technical/auth-and-proxy-refactor-plan.md).\n*\n* File: ${configDir}/endpoints.json (mode 0600)\n* Shape: { activeId: string | null, endpoints: EndpointEntry[] }\n*   - activeId === null or \"default\" → use the env-derived default\n*   - activeId === \"<id>\" → use the matching user entry (falls back to default if not found)\n*\n* Legacy path: ${dataDir}/admin/endpoints.json. Old installs are\n* migrated lazily on first read by maybeMigrateLegacyEndpointsFile().\n*/\nvar DEFAULT_ID = \"default\";\nvar LOCAL_ELECTRON_ID = \"local-electron\";\nvar remoteStatusCache = null;\nfunction endpointsPath() {\n\treturn `${getState().configDir}/endpoints.json`;\n}\n/**\n* Legacy path used before Phase 5 of the auth/proxy refactor.\n* See docs/technical/auth-and-proxy-refactor-plan.md § Phase 5 / D4.\n*/\nfunction legacyEndpointsPath() {\n\treturn `${getState().dataDir}/admin/endpoints.json`;\n}\n/**\n* One-shot lazy migration from the legacy data/ path to the new config/ path.\n*\n* Phase 5 of docs/technical/auth-and-proxy-refactor-plan.md (D6 step 3):\n*   - If the new path already exists → no-op (already migrated).\n*   - If the legacy path doesn't exist → no-op (fresh install).\n*   - Otherwise copy contents to the new path (mode 0600), then unlink legacy.\n*\n* If the migration fails partway, the legacy file is left in place so reads\n* fall back to it for the remainder of this session. Idempotent across\n* process restarts because the existence check makes it a no-op after the\n* first successful run.\n*/\nfunction maybeMigrateLegacyEndpointsFile() {\n\tconst newPath = endpointsPath();\n\tif (existsSync(newPath)) return;\n\tconst oldPath = legacyEndpointsPath();\n\tif (!existsSync(oldPath)) return;\n\ttry {\n\t\tmkdirSync(dirname(newPath), { recursive: true });\n\t\twriteFileSync(newPath, readFileSync(oldPath), { mode: 384 });\n\t\ttry {\n\t\t\tchmodSync(newPath, 384);\n\t\t} catch {}\n\t\tunlinkSync(oldPath);\n\t} catch (e) {\n\t\tconsole.warn(\"[endpoints] Failed to migrate legacy endpoints.json from data/ to config/. Leaving the old file in place; reads will fall back to it for this session.\", e);\n\t}\n}\nfunction localRuntimePath() {\n\treturn `${getState().dataDir}/local-opencode.runtime.json`;\n}\n/**\n* Read the Electron-written runtime.json each time it's needed. The file is\n* 0600 and is rewritten on each Electron launch (random password per launch),\n* so callers must NOT cache the result.\n*/\nfunction readLocalRuntime() {\n\tconst path = localRuntimePath();\n\tif (!existsSync(path)) return null;\n\ttry {\n\t\tconst parsed = JSON.parse(readFileSync(path, \"utf-8\"));\n\t\tif (!parsed || typeof parsed.url !== \"string\" || !parsed.url) return null;\n\t\treturn {\n\t\t\turl: parsed.url,\n\t\t\tusername: typeof parsed.username === \"string\" ? parsed.username : void 0,\n\t\t\tpassword: typeof parsed.password === \"string\" ? parsed.password : void 0,\n\t\t\tpid: typeof parsed.pid === \"number\" ? parsed.pid : void 0,\n\t\t\tstartedAt: typeof parsed.startedAt === \"string\" ? parsed.startedAt : void 0\n\t\t};\n\t} catch (e) {\n\t\tconsole.warn(\"[endpoints] Failed to parse local-opencode.runtime.json:\", e);\n\t\treturn null;\n\t}\n}\nfunction localEndpoint() {\n\tconst rt = readLocalRuntime();\n\tif (!rt) return null;\n\treturn {\n\t\tid: LOCAL_ELECTRON_ID,\n\t\tlabel: \"OpenPalm Admin\",\n\t\turl: normalizeBrowserFacingUrl(rt.url),\n\t\tusername: rt.username || \"openpalm\",\n\t\t...rt.password ? { password: rt.password } : {},\n\t\tisDefault: false,\n\t\tisLocal: true\n\t};\n}\nfunction normalizeBrowserFacingUrl(raw) {\n\ttry {\n\t\tconst url = new URL(raw);\n\t\tconst host = url.hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n\t\tif (host === \"0.0.0.0\" || host === \"::\") url.hostname = \"127.0.0.1\";\n\t\treturn url.toString().replace(/\\/$/, \"\");\n\t} catch {\n\t\treturn raw;\n\t}\n}\nfunction readFile() {\n\tmaybeMigrateLegacyEndpointsFile();\n\tlet path = endpointsPath();\n\tif (!existsSync(path)) {\n\t\tconst legacy = legacyEndpointsPath();\n\t\tif (!existsSync(legacy)) return {\n\t\t\tactiveId: null,\n\t\t\tendpoints: []\n\t\t};\n\t\tpath = legacy;\n\t}\n\ttry {\n\t\tconst parsed = JSON.parse(readFileSync(path, \"utf-8\"));\n\t\treturn {\n\t\t\tactiveId: typeof parsed.activeId === \"string\" ? parsed.activeId : null,\n\t\t\tendpoints: Array.isArray(parsed.endpoints) ? parsed.endpoints.filter(isValidEntry) : []\n\t\t};\n\t} catch (e) {\n\t\tconsole.warn(\"[endpoints] Failed to parse endpoints.json, resetting:\", e);\n\t\treturn {\n\t\t\tactiveId: null,\n\t\t\tendpoints: []\n\t\t};\n\t}\n}\nfunction isValidEntry(e) {\n\tif (!e || typeof e !== \"object\") return false;\n\tconst o = e;\n\treturn typeof o.id === \"string\" && typeof o.label === \"string\" && typeof o.url === \"string\";\n}\nfunction writeFile(data) {\n\tconst path = endpointsPath();\n\tmkdirSync(dirname(path), { recursive: true });\n\twriteFileSync(path, JSON.stringify(data, null, 2), {\n\t\tencoding: \"utf-8\",\n\t\tmode: 384\n\t});\n\ttry {\n\t\tchmodSync(path, 384);\n\t} catch {}\n}\nfunction defaultEndpoint() {\n\tconst url = process.env.OP_OPENCODE_URL ?? process.env.OP_ASSISTANT_URL ?? `http://127.0.0.1:${process.env.OP_ASSISTANT_PORT ?? \"3800\"}`;\n\tconst username = process.env.OPENCODE_SERVER_USERNAME || \"openpalm\";\n\tconst password = process.env.OPENCODE_SERVER_PASSWORD || void 0;\n\treturn {\n\t\tid: DEFAULT_ID,\n\t\tlabel: \"Local Assistant\",\n\t\turl: normalizeBrowserFacingUrl(url),\n\t\tusername,\n\t\tpassword,\n\t\tisDefault: true\n\t};\n}\n/**\n* Hostnames where plain HTTP is permitted. Anything else must use HTTPS.\n*\n* - `127.0.0.1`, `::1`, `localhost` — loopback addresses on the same host.\n* - `host.docker.internal` — Docker's loopback-equivalent for the container\n*   hop back to the host (used by the Electron + dev compose setups).\n*\n* Phase 6 of docs/technical/auth-and-proxy-refactor-plan.md.\n*/\nvar LOOPBACK_HOSTS = new Set([\n\t\"127.0.0.1\",\n\t\"::1\",\n\t\"localhost\",\n\t\"host.docker.internal\"\n]);\n/**\n* `URL.hostname` wraps IPv6 addresses in square brackets (e.g. `[::1]`).\n* Strip them before checking against the loopback set so the literal IPv6\n* loopback matches `::1`.\n*/\nfunction isLoopbackHost(hostname) {\n\tconst stripped = hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n\treturn LOOPBACK_HOSTS.has(stripped);\n}\n/**\n* Discriminated validator that callers (admin routes) use to surface\n* specific error messages — in particular, the HTTPS-for-remote rule.\n*/\nfunction validateEndpointUrl(input) {\n\tlet u;\n\ttry {\n\t\tu = new URL(input.trim());\n\t} catch {\n\t\treturn {\n\t\t\tok: false,\n\t\t\treason: \"invalid_url\"\n\t\t};\n\t}\n\tif (u.protocol !== \"http:\" && u.protocol !== \"https:\") return {\n\t\tok: false,\n\t\treason: \"invalid_scheme\"\n\t};\n\tif (!u.hostname) return {\n\t\tok: false,\n\t\treason: \"missing_host\"\n\t};\n\tif (u.protocol === \"http:\" && !isLoopbackHost(u.hostname)) return {\n\t\tok: false,\n\t\treason: \"http_not_allowed\"\n\t};\n\treturn {\n\t\tok: true,\n\t\turl: u.toString().replace(/\\/$/, \"\")\n\t};\n}\n/**\n* Validate a URL string — must be http(s) with a host. Plain HTTP is only\n* allowed for loopback hosts (see `LOOPBACK_HOSTS`). Returns the normalized\n* URL or null. For finer-grained errors, use `validateEndpointUrl`.\n*/\nfunction normalizeEndpointUrl(input) {\n\tconst result = validateEndpointUrl(input);\n\treturn result.ok ? result.url : null;\n}\n/**\n* Returns: [local-electron (if Electron is running it), default, ...user entries].\n* The local-electron entry is synthesized at call time from\n* state/local-opencode.runtime.json — never persisted to endpoints.json.\n*/\nfunction listEndpoints() {\n\tconst { endpoints } = readFile();\n\tconst local = localEndpoint();\n\treturn [\n\t\t...local ? [local] : [],\n\t\tdefaultEndpoint(),\n\t\t...endpoints.map((e) => ({\n\t\t\t...e,\n\t\t\tisDefault: false\n\t\t}))\n\t];\n}\n/**\n* Returns the active endpoint, falling back to the default if no active id is\n* set OR if the active id is `local-electron` but the runtime.json isn't there\n* (e.g. the Electron child died). Re-reads runtime.json each call so a\n* password rotated by a new Electron launch is picked up immediately.\n*/\nfunction getActiveEndpoint() {\n\tconst { activeId, endpoints } = readFile();\n\tif (activeId === LOCAL_ELECTRON_ID) {\n\t\tconst local = localEndpoint();\n\t\tif (local) return local;\n\t\treturn defaultEndpoint();\n\t}\n\tif (!activeId || activeId === DEFAULT_ID) return defaultEndpoint();\n\tconst found = endpoints.find((e) => e.id === activeId);\n\tif (!found) return defaultEndpoint();\n\treturn {\n\t\t...found,\n\t\tisDefault: false\n\t};\n}\nfunction setActiveId(id) {\n\tconst data = readFile();\n\tif (!id || id === DEFAULT_ID) data.activeId = null;\n\telse if (id === LOCAL_ELECTRON_ID) {\n\t\tif (!localEndpoint()) throw new Error(\"Local OpenCode is not running (Electron only)\");\n\t\tdata.activeId = LOCAL_ELECTRON_ID;\n\t} else {\n\t\tif (!data.endpoints.some((e) => e.id === id)) throw new Error(`Endpoint not found: ${id}`);\n\t\tdata.activeId = id;\n\t}\n\twriteFile(data);\n\treturn getActiveEndpoint();\n}\nfunction addEndpoint(input) {\n\tconst label = input.label.trim();\n\tif (!label) throw new Error(\"Label is required\");\n\tconst url = normalizeEndpointUrl(input.url);\n\tif (!url) throw new Error(\"URL must be a valid http(s) URL\");\n\tconst data = readFile();\n\tconst entry = {\n\t\tid: randomUUID(),\n\t\tlabel,\n\t\turl,\n\t\t...input.password ? { password: input.password } : {}\n\t};\n\tdata.endpoints.push(entry);\n\twriteFile(data);\n\treturn entry;\n}\nfunction updateEndpoint(id, patch) {\n\tif (id === DEFAULT_ID) throw new Error(\"Cannot edit the default endpoint\");\n\tif (id === LOCAL_ELECTRON_ID) throw new Error(\"Cannot edit the local Electron OpenCode entry (it is ephemeral and per-launch)\");\n\tconst data = readFile();\n\tconst idx = data.endpoints.findIndex((e) => e.id === id);\n\tif (idx === -1) throw new Error(`Endpoint not found: ${id}`);\n\tconst next = { ...data.endpoints[idx] };\n\tif (patch.label !== void 0) {\n\t\tconst label = patch.label.trim();\n\t\tif (!label) throw new Error(\"Label cannot be empty\");\n\t\tnext.label = label;\n\t}\n\tif (patch.url !== void 0) {\n\t\tconst url = normalizeEndpointUrl(patch.url);\n\t\tif (!url) throw new Error(\"URL must be a valid http(s) URL\");\n\t\tnext.url = url;\n\t}\n\tif (patch.password === null) delete next.password;\n\telse if (typeof patch.password === \"string\") next.password = patch.password;\n\tdata.endpoints[idx] = next;\n\twriteFile(data);\n\treturn next;\n}\nfunction deleteEndpoint(id) {\n\tif (id === DEFAULT_ID) throw new Error(\"Cannot delete the default endpoint\");\n\tif (id === LOCAL_ELECTRON_ID) throw new Error(\"Cannot delete the local Electron OpenCode entry (managed by Electron lifecycle)\");\n\tconst data = readFile();\n\tconst idx = data.endpoints.findIndex((e) => e.id === id);\n\tif (idx === -1) throw new Error(`Endpoint not found: ${id}`);\n\tdata.endpoints.splice(idx, 1);\n\tif (data.activeId === id) data.activeId = null;\n\twriteFile(data);\n}\nasync function probeEndpoint(endpoint) {\n\tconst headers = new Headers();\n\tif (endpoint.password) {\n\t\tconst username = endpoint.username ?? \"openpalm\";\n\t\theaders.set(\"authorization\", `Basic ${Buffer.from(`${username}:${endpoint.password}`).toString(\"base64\")}`);\n\t}\n\ttry {\n\t\tconst response = await fetch(endpoint.url, {\n\t\t\tmethod: \"GET\",\n\t\t\theaders,\n\t\t\tredirect: \"manual\",\n\t\t\tsignal: AbortSignal.timeout(2e3)\n\t\t});\n\t\tif (response.status === 401 || response.status === 403) return {\n\t\t\tid: endpoint.id,\n\t\t\tname: endpoint.label,\n\t\t\turl: endpoint.url,\n\t\t\tstate: \"unauthorized\",\n\t\t\tdetail: `HTTP ${response.status}`\n\t\t};\n\t\tif (response.ok || response.status >= 300 && response.status < 400) return {\n\t\t\tid: endpoint.id,\n\t\t\tname: endpoint.label,\n\t\t\turl: endpoint.url,\n\t\t\tstate: \"accessible\"\n\t\t};\n\t\treturn {\n\t\t\tid: endpoint.id,\n\t\t\tname: endpoint.label,\n\t\t\turl: endpoint.url,\n\t\t\tstate: \"unreachable\",\n\t\t\tdetail: `HTTP ${response.status}`\n\t\t};\n\t} catch (error) {\n\t\treturn {\n\t\t\tid: endpoint.id,\n\t\t\tname: endpoint.label,\n\t\t\turl: endpoint.url,\n\t\t\tstate: \"unreachable\",\n\t\t\tdetail: error instanceof Error ? error.message : String(error)\n\t\t};\n\t}\n}\nasync function listRemoteStatuses() {\n\tif (remoteStatusCache && remoteStatusCache.expiresAt > Date.now()) return remoteStatusCache.value.map((status) => ({ ...status }));\n\tconst statuses = await Promise.all(listEndpoints().map((endpoint) => probeEndpoint(endpoint)));\n\tremoteStatusCache = {\n\t\tvalue: statuses,\n\t\texpiresAt: Date.now() + 5e3\n\t};\n\treturn statuses.map((status) => ({ ...status }));\n}\n//#endregion\nexport { listRemoteStatuses as a, validateEndpointUrl as c, listEndpoints as i, deleteEndpoint as n, setActiveId as o, getActiveEndpoint as r, updateEndpoint as s, addEndpoint as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,UAAU,GAAG,SAAS;AAC1B,IAAI,iBAAiB,GAAG,gBAAgB;AACxC,IAAI,iBAAiB,GAAG,IAAI;AAC5B,SAAS,aAAa,GAAG;AACzB,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,eAAe,CAAC;AAChD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,GAAG;AAC/B,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC;AACpD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,+BAA+B,GAAG;AAC3C,CAAC,MAAM,OAAO,GAAG,aAAa,EAAE;AAChC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE;AAC1B,CAAC,MAAM,OAAO,GAAG,mBAAmB,EAAE;AACtC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;AAC3B,CAAC,IAAI;AACL,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAClD,EAAE,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC9D,EAAE,IAAI;AACN,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC;AAC1B,EAAE,CAAC,CAAC,MAAM,CAAC;AACX,EAAE,UAAU,CAAC,OAAO,CAAC;AACrB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,CAAC,IAAI,CAAC,wJAAwJ,EAAE,CAAC,CAAC;AAC3K,CAAC;AACD;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,4BAA4B,CAAC;AAC3D;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,IAAI,GAAG,gBAAgB,EAAE;AAChC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AACnC,CAAC,IAAI;AACL,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACxD,EAAE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI;AAC3E,EAAE,OAAO;AACT,GAAG,GAAG,EAAE,MAAM,CAAC,GAAG;AAClB,GAAG,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;AAC3E,GAAG,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;AAC3E,GAAG,GAAG,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,GAAG,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC;AAC5D,GAAG,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,GAAG,MAAM,CAAC,SAAS,GAAG,KAAK;AAC7E,GAAG;AACH,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,CAAC,IAAI,CAAC,0DAA0D,EAAE,CAAC,CAAC;AAC7E,EAAE,OAAO,IAAI;AACb,CAAC;AACD;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,MAAM,EAAE,GAAG,gBAAgB,EAAE;AAC9B,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,IAAI;AACrB,CAAC,OAAO;AACR,EAAE,EAAE,EAAE,iBAAiB;AACvB,EAAE,KAAK,EAAE,gBAAgB;AACzB,EAAE,GAAG,EAAE,yBAAyB,CAAC,EAAE,CAAC,GAAG,CAAC;AACxC,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,UAAU;AACrC,EAAE,GAAG,EAAE,CAAC,QAAQ,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;AACjD,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,OAAO,EAAE;AACX,EAAE;AACF;AACA,SAAS,yBAAyB,CAAC,GAAG,EAAE;AACxC,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC;AAC1B,EAAE,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;AACjE,EAAE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,WAAW;AACrE,EAAE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AAC1C,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,GAAG;AACZ,CAAC;AACD;AACA,SAAS,QAAQ,GAAG;AACpB,CAAC,+BAA+B,EAAE;AAClC,CAAC,IAAI,IAAI,GAAG,aAAa,EAAE;AAC3B,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;AACxB,EAAE,MAAM,MAAM,GAAG,mBAAmB,EAAE;AACtC,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,OAAO;AAClC,GAAG,QAAQ,EAAE,IAAI;AACjB,GAAG,SAAS,EAAE;AACd,GAAG;AACH,EAAE,IAAI,GAAG,MAAM;AACf,CAAC;AACD,CAAC,IAAI;AACL,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACxD,EAAE,OAAO;AACT,GAAG,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,IAAI;AACzE,GAAG,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG;AACxF,GAAG;AACH,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,CAAC,IAAI,CAAC,wDAAwD,EAAE,CAAC,CAAC;AAC3E,EAAE,OAAO;AACT,GAAG,QAAQ,EAAE,IAAI;AACjB,GAAG,SAAS,EAAE;AACd,GAAG;AACH,CAAC;AACD;AACA,SAAS,YAAY,CAAC,CAAC,EAAE;AACzB,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,OAAO,KAAK;AAC9C,CAAC,MAAM,CAAC,GAAG,CAAC;AACZ,CAAC,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;AAC5F;AACA,SAAS,SAAS,CAAC,IAAI,EAAE;AACzB,CAAC,MAAM,IAAI,GAAG,aAAa,EAAE;AAC7B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;AACpD,EAAE,QAAQ,EAAE,OAAO;AACnB,EAAE,IAAI,EAAE;AACR,EAAE,CAAC;AACH,CAAC,IAAI;AACL,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC;AACtB,CAAC,CAAC,CAAC,MAAM,CAAC;AACV;AACA,SAAS,eAAe,GAAG;AAC3B,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,MAAM,CAAC,CAAC;AACzI,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,UAAU;AACpE,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,MAAM;AAChE,CAAC,OAAO;AACR,EAAE,EAAE,EAAE,UAAU;AAChB,EAAE,KAAK,EAAE,iBAAiB;AAC1B,EAAE,GAAG,EAAE,yBAAyB,CAAC,GAAG,CAAC;AACrC,EAAE,QAAQ;AACV,EAAE,QAAQ;AACV,EAAE,SAAS,EAAE;AACb,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,cAAc,GAAG,IAAI,GAAG,CAAC;AAC7B,CAAC,WAAW;AACZ,CAAC,KAAK;AACN,CAAC,WAAW;AACZ,CAAC;AACD,CAAC,CAAC;AACF;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,QAAQ,EAAE;AAClC,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;AAChE,CAAC,OAAO,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;AACpC;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE;AACpC,CAAC,IAAI,CAAC;AACN,CAAC,IAAI;AACL,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO;AACT,GAAG,EAAE,EAAE,KAAK;AACZ,GAAG,MAAM,EAAE;AACX,GAAG;AACH,CAAC;AACD,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,OAAO;AAC/D,EAAE,EAAE,EAAE,KAAK;AACX,EAAE,MAAM,EAAE;AACV,EAAE;AACF,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO;AACzB,EAAE,EAAE,EAAE,KAAK;AACX,EAAE,MAAM,EAAE;AACV,EAAE;AACF,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAO;AACnE,EAAE,EAAE,EAAE,KAAK;AACX,EAAE,MAAM,EAAE;AACV,EAAE;AACF,CAAC,OAAO;AACR,EAAE,EAAE,EAAE,IAAI;AACV,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE;AACrC,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,KAAK,EAAE;AACrC,CAAC,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC;AAC1C,CAAC,OAAO,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI;AACrC;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE;AACjC,CAAC,MAAM,KAAK,GAAG,aAAa,EAAE;AAC9B,CAAC,OAAO;AACR,EAAE,GAAG,KAAK,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;AACzB,EAAE,eAAe,EAAE;AACnB,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AAC3B,GAAG,GAAG,CAAC;AACP,GAAG,SAAS,EAAE;AACd,GAAG,CAAC;AACJ,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,GAAG;AAC7B,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE;AAC3C,CAAC,IAAI,QAAQ,KAAK,iBAAiB,EAAE;AACrC,EAAE,MAAM,KAAK,GAAG,aAAa,EAAE;AAC/B,EAAE,IAAI,KAAK,EAAE,OAAO,KAAK;AACzB,EAAE,OAAO,eAAe,EAAE;AAC1B,CAAC;AACD,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,UAAU,EAAE,OAAO,eAAe,EAAE;AACnE,CAAC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC;AACvD,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,eAAe,EAAE;AACrC,CAAC,OAAO;AACR,EAAE,GAAG,KAAK;AACV,EAAE,SAAS,EAAE;AACb,EAAE;AACF;AACA,SAAS,WAAW,CAAC,EAAE,EAAE;AACzB,CAAC,MAAM,IAAI,GAAG,QAAQ,EAAE;AACxB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,UAAU,EAAE,IAAI,CAAC,QAAQ,GAAG,IAAI;AACnD,MAAM,IAAI,EAAE,KAAK,iBAAiB,EAAE;AACpC,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC;AACxF,EAAE,IAAI,CAAC,QAAQ,GAAG,iBAAiB;AACnC,CAAC,CAAC,MAAM;AACR,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAC;AAC5F,EAAE,IAAI,CAAC,QAAQ,GAAG,EAAE;AACpB,CAAC;AACD,CAAC,SAAS,CAAC,IAAI,CAAC;AAChB,CAAC,OAAO,iBAAiB,EAAE;AAC3B;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE;AACjC,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC;AACjD,CAAC,MAAM,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC;AAC5C,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC;AAC7D,CAAC,MAAM,IAAI,GAAG,QAAQ,EAAE;AACxB,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,KAAK;AACP,EAAE,GAAG;AACL,EAAE,GAAG,KAAK,CAAC,QAAQ,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG;AACrD,EAAE;AACF,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;AAC3B,CAAC,SAAS,CAAC,IAAI,CAAC;AAChB,CAAC,OAAO,KAAK;AACb;AACA,SAAS,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE;AACnC,CAAC,IAAI,EAAE,KAAK,UAAU,EAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC;AAC3E,CAAC,IAAI,EAAE,KAAK,iBAAiB,EAAE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC;AAChI,CAAC,MAAM,IAAI,GAAG,QAAQ,EAAE;AACxB,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;AACzD,CAAC,IAAI,GAAG,KAAK,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE;AACxC,CAAC,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,EAAE;AAC7B,EAAE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE;AAClC,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC;AACtD,EAAE,IAAI,CAAC,KAAK,GAAG,KAAK;AACpB,CAAC;AACD,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,EAAE;AAC3B,EAAE,MAAM,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC;AAC7C,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC;AAC9D,EAAE,IAAI,CAAC,GAAG,GAAG,GAAG;AAChB,CAAC;AACD,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,OAAO,IAAI,CAAC,QAAQ;AAClD,MAAM,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ;AAC5E,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI;AAC3B,CAAC,SAAS,CAAC,IAAI,CAAC;AAChB,CAAC,OAAO,IAAI;AACZ;AACA,SAAS,cAAc,CAAC,EAAE,EAAE;AAC5B,CAAC,IAAI,EAAE,KAAK,UAAU,EAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC;AAC7E,CAAC,IAAI,EAAE,KAAK,iBAAiB,EAAE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC;AACjI,CAAC,MAAM,IAAI,GAAG,QAAQ,EAAE;AACxB,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;AACzD,CAAC,IAAI,GAAG,KAAK,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;AAC9B,CAAC,IAAI,IAAI,CAAC,QAAQ,KAAK,EAAE,EAAE,IAAI,CAAC,QAAQ,GAAG,IAAI;AAC/C,CAAC,SAAS,CAAC,IAAI,CAAC;AAChB;AACA,eAAe,aAAa,CAAC,QAAQ,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE;AAC9B,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE;AACxB,EAAE,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,UAAU;AAClD,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC7G,CAAC;AACD,CAAC,IAAI;AACL,EAAE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE;AAC7C,GAAG,MAAM,EAAE,KAAK;AAChB,GAAG,OAAO;AACV,GAAG,QAAQ,EAAE,QAAQ;AACrB,GAAG,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG;AAClC,GAAG,CAAC;AACJ,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,OAAO;AACjE,GAAG,EAAE,EAAE,QAAQ,CAAC,EAAE;AAClB,GAAG,IAAI,EAAE,QAAQ,CAAC,KAAK;AACvB,GAAG,GAAG,EAAE,QAAQ,CAAC,GAAG;AACpB,GAAG,KAAK,EAAE,cAAc;AACxB,GAAG,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC;AACnC,GAAG;AACH,EAAE,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO;AAC7E,GAAG,EAAE,EAAE,QAAQ,CAAC,EAAE;AAClB,GAAG,IAAI,EAAE,QAAQ,CAAC,KAAK;AACvB,GAAG,GAAG,EAAE,QAAQ,CAAC,GAAG;AACpB,GAAG,KAAK,EAAE;AACV,GAAG;AACH,EAAE,OAAO;AACT,GAAG,EAAE,EAAE,QAAQ,CAAC,EAAE;AAClB,GAAG,IAAI,EAAE,QAAQ,CAAC,KAAK;AACvB,GAAG,GAAG,EAAE,QAAQ,CAAC,GAAG;AACpB,GAAG,KAAK,EAAE,aAAa;AACvB,GAAG,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC;AACnC,GAAG;AACH,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE;AACjB,EAAE,OAAO;AACT,GAAG,EAAE,EAAE,QAAQ,CAAC,EAAE;AAClB,GAAG,IAAI,EAAE,QAAQ,CAAC,KAAK;AACvB,GAAG,GAAG,EAAE,QAAQ,CAAC,GAAG;AACpB,GAAG,KAAK,EAAE,aAAa;AACvB,GAAG,MAAM,EAAE,KAAK,YAAY,KAAK,GAAG,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK;AAChE,GAAG;AACH,CAAC;AACD;AACA,eAAe,kBAAkB,GAAG;AACpC,CAAC,IAAI,iBAAiB,IAAI,iBAAiB,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AACnI,CAAC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/F,CAAC,iBAAiB,GAAG;AACrB,EAAE,KAAK,EAAE,QAAQ;AACjB,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG;AAC1B,EAAE;AACF,CAAC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AACjD;;;;"}
+{"version":3,"file":"endpoints-UdQGgKsR.js","sources":["../../../.svelte-kit/adapter-node/chunks/endpoints.js"],"sourcesContent":["import { t as getState } from \"./state.js\";\nimport { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from \"node:fs\";\nimport { dirname } from \"node:path\";\nimport { randomUUID } from \"node:crypto\";\n//#region src/lib/server/endpoints.ts\n/**\n* Assistant endpoints — list of OpenCode servers the UI can target, with\n* one marked active. The \"default\" entry is synthesized from environment\n* (OP_OPENCODE_URL / OP_ASSISTANT_URL / OP_ASSISTANT_PORT) and cannot be\n* deleted. User-added endpoints are persisted to a JSON file in the\n* config directory (it's user-owned configuration, not service state —\n* see Phase 5 / D4 in docs/technical/auth-and-proxy-refactor-plan.md).\n*\n* File: ${configDir}/endpoints.json (mode 0600)\n* Shape: { activeId: string | null, endpoints: EndpointEntry[] }\n*   - activeId === null or \"default\" → use the env-derived default\n*   - activeId === \"<id>\" → use the matching user entry (falls back to default if not found)\n*\n* Legacy path: ${dataDir}/admin/endpoints.json. Old installs are\n* migrated lazily on first read by maybeMigrateLegacyEndpointsFile().\n*/\nvar DEFAULT_ID = \"default\";\nvar LOCAL_ELECTRON_ID = \"local-electron\";\nvar remoteStatusCache = null;\nfunction endpointsPath() {\n\treturn `${getState().configDir}/endpoints.json`;\n}\n/**\n* Legacy path used before Phase 5 of the auth/proxy refactor.\n* See docs/technical/auth-and-proxy-refactor-plan.md § Phase 5 / D4.\n*/\nfunction legacyEndpointsPath() {\n\treturn `${getState().dataDir}/admin/endpoints.json`;\n}\n/**\n* One-shot lazy migration from the legacy data/ path to the new config/ path.\n*\n* Phase 5 of docs/technical/auth-and-proxy-refactor-plan.md (D6 step 3):\n*   - If the new path already exists → no-op (already migrated).\n*   - If the legacy path doesn't exist → no-op (fresh install).\n*   - Otherwise copy contents to the new path (mode 0600), then unlink legacy.\n*\n* If the migration fails partway, the legacy file is left in place so reads\n* fall back to it for the remainder of this session. Idempotent across\n* process restarts because the existence check makes it a no-op after the\n* first successful run.\n*/\nfunction maybeMigrateLegacyEndpointsFile() {\n\tconst newPath = endpointsPath();\n\tif (existsSync(newPath)) return;\n\tconst oldPath = legacyEndpointsPath();\n\tif (!existsSync(oldPath)) return;\n\ttry {\n\t\tmkdirSync(dirname(newPath), { recursive: true });\n\t\twriteFileSync(newPath, readFileSync(oldPath), { mode: 384 });\n\t\ttry {\n\t\t\tchmodSync(newPath, 384);\n\t\t} catch {}\n\t\tunlinkSync(oldPath);\n\t} catch (e) {\n\t\tconsole.warn(\"[endpoints] Failed to migrate legacy endpoints.json from data/ to config/. Leaving the old file in place; reads will fall back to it for this session.\", e);\n\t}\n}\nfunction localRuntimePath() {\n\treturn `${getState().dataDir}/local-opencode.runtime.json`;\n}\n/**\n* Read the Electron-written runtime.json each time it's needed. The file is\n* 0600 and is rewritten on each Electron launch (random password per launch),\n* so callers must NOT cache the result.\n*/\nfunction readLocalRuntime() {\n\tconst path = localRuntimePath();\n\tif (!existsSync(path)) return null;\n\ttry {\n\t\tconst parsed = JSON.parse(readFileSync(path, \"utf-8\"));\n\t\tif (!parsed || typeof parsed.url !== \"string\" || !parsed.url) return null;\n\t\treturn {\n\t\t\turl: parsed.url,\n\t\t\tusername: typeof parsed.username === \"string\" ? parsed.username : void 0,\n\t\t\tpassword: typeof parsed.password === \"string\" ? parsed.password : void 0,\n\t\t\tpid: typeof parsed.pid === \"number\" ? parsed.pid : void 0,\n\t\t\tstartedAt: typeof parsed.startedAt === \"string\" ? parsed.startedAt : void 0\n\t\t};\n\t} catch (e) {\n\t\tconsole.warn(\"[endpoints] Failed to parse local-opencode.runtime.json:\", e);\n\t\treturn null;\n\t}\n}\nfunction localEndpoint() {\n\tconst rt = readLocalRuntime();\n\tif (!rt) return null;\n\treturn {\n\t\tid: LOCAL_ELECTRON_ID,\n\t\tlabel: \"OpenPalm Admin\",\n\t\turl: normalizeBrowserFacingUrl(rt.url),\n\t\tusername: rt.username || \"openpalm\",\n\t\t...rt.password ? { password: rt.password } : {},\n\t\tisDefault: false,\n\t\tisLocal: true\n\t};\n}\nfunction normalizeBrowserFacingUrl(raw) {\n\ttry {\n\t\tconst url = new URL(raw);\n\t\tconst host = url.hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n\t\tif (host === \"0.0.0.0\" || host === \"::\") url.hostname = \"127.0.0.1\";\n\t\treturn url.toString().replace(/\\/$/, \"\");\n\t} catch {\n\t\treturn raw;\n\t}\n}\nfunction readFile() {\n\tmaybeMigrateLegacyEndpointsFile();\n\tlet path = endpointsPath();\n\tif (!existsSync(path)) {\n\t\tconst legacy = legacyEndpointsPath();\n\t\tif (!existsSync(legacy)) return {\n\t\t\tactiveId: null,\n\t\t\tendpoints: []\n\t\t};\n\t\tpath = legacy;\n\t}\n\ttry {\n\t\tconst parsed = JSON.parse(readFileSync(path, \"utf-8\"));\n\t\treturn {\n\t\t\tactiveId: typeof parsed.activeId === \"string\" ? parsed.activeId : null,\n\t\t\tendpoints: Array.isArray(parsed.endpoints) ? parsed.endpoints.filter(isValidEntry) : []\n\t\t};\n\t} catch (e) {\n\t\tconsole.warn(\"[endpoints] Failed to parse endpoints.json, resetting:\", e);\n\t\treturn {\n\t\t\tactiveId: null,\n\t\t\tendpoints: []\n\t\t};\n\t}\n}\nfunction isValidEntry(e) {\n\tif (!e || typeof e !== \"object\") return false;\n\tconst o = e;\n\treturn typeof o.id === \"string\" && typeof o.label === \"string\" && typeof o.url === \"string\";\n}\nfunction writeFile(data) {\n\tconst path = endpointsPath();\n\tmkdirSync(dirname(path), { recursive: true });\n\twriteFileSync(path, JSON.stringify(data, null, 2), {\n\t\tencoding: \"utf-8\",\n\t\tmode: 384\n\t});\n\ttry {\n\t\tchmodSync(path, 384);\n\t} catch {}\n}\nfunction defaultEndpoint() {\n\tconst url = process.env.OP_OPENCODE_URL ?? process.env.OP_ASSISTANT_URL ?? `http://127.0.0.1:${process.env.OP_ASSISTANT_PORT ?? \"3800\"}`;\n\tconst username = process.env.OPENCODE_SERVER_USERNAME || \"openpalm\";\n\tconst password = process.env.OPENCODE_SERVER_PASSWORD || void 0;\n\treturn {\n\t\tid: DEFAULT_ID,\n\t\tlabel: \"Local Assistant\",\n\t\turl: normalizeBrowserFacingUrl(url),\n\t\tusername,\n\t\tpassword,\n\t\tisDefault: true\n\t};\n}\n/**\n* Hostnames where plain HTTP is permitted. Anything else must use HTTPS.\n*\n* - `127.0.0.1`, `::1`, `localhost` — loopback addresses on the same host.\n* - `host.docker.internal` — Docker's loopback-equivalent for the container\n*   hop back to the host (used by the Electron + dev compose setups).\n*\n* Phase 6 of docs/technical/auth-and-proxy-refactor-plan.md.\n*/\nvar LOOPBACK_HOSTS = new Set([\n\t\"127.0.0.1\",\n\t\"::1\",\n\t\"localhost\",\n\t\"host.docker.internal\"\n]);\n/**\n* `URL.hostname` wraps IPv6 addresses in square brackets (e.g. `[::1]`).\n* Strip them before checking against the loopback set so the literal IPv6\n* loopback matches `::1`.\n*/\nfunction isLoopbackHost(hostname) {\n\tconst stripped = hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n\treturn LOOPBACK_HOSTS.has(stripped);\n}\n/**\n* Discriminated validator that callers (admin routes) use to surface\n* specific error messages — in particular, the HTTPS-for-remote rule.\n*/\nfunction validateEndpointUrl(input) {\n\tlet u;\n\ttry {\n\t\tu = new URL(input.trim());\n\t} catch {\n\t\treturn {\n\t\t\tok: false,\n\t\t\treason: \"invalid_url\"\n\t\t};\n\t}\n\tif (u.protocol !== \"http:\" && u.protocol !== \"https:\") return {\n\t\tok: false,\n\t\treason: \"invalid_scheme\"\n\t};\n\tif (!u.hostname) return {\n\t\tok: false,\n\t\treason: \"missing_host\"\n\t};\n\tif (u.protocol === \"http:\" && !isLoopbackHost(u.hostname)) return {\n\t\tok: false,\n\t\treason: \"http_not_allowed\"\n\t};\n\treturn {\n\t\tok: true,\n\t\turl: u.toString().replace(/\\/$/, \"\")\n\t};\n}\n/**\n* Validate a URL string — must be http(s) with a host. Plain HTTP is only\n* allowed for loopback hosts (see `LOOPBACK_HOSTS`). Returns the normalized\n* URL or null. For finer-grained errors, use `validateEndpointUrl`.\n*/\nfunction normalizeEndpointUrl(input) {\n\tconst result = validateEndpointUrl(input);\n\treturn result.ok ? result.url : null;\n}\n/**\n* Returns: [local-electron (if Electron is running it), default, ...user entries].\n* The local-electron entry is synthesized at call time from\n* state/local-opencode.runtime.json — never persisted to endpoints.json.\n*/\nfunction listEndpoints() {\n\tconst { endpoints } = readFile();\n\tconst local = localEndpoint();\n\treturn [\n\t\t...local ? [local] : [],\n\t\tdefaultEndpoint(),\n\t\t...endpoints.map((e) => ({\n\t\t\t...e,\n\t\t\tisDefault: false\n\t\t}))\n\t];\n}\n/**\n* Returns the active endpoint, falling back to the default if no active id is\n* set OR if the active id is `local-electron` but the runtime.json isn't there\n* (e.g. the Electron child died). Re-reads runtime.json each call so a\n* password rotated by a new Electron launch is picked up immediately.\n*/\nfunction getActiveEndpoint() {\n\tconst { activeId, endpoints } = readFile();\n\tif (activeId === LOCAL_ELECTRON_ID) {\n\t\tconst local = localEndpoint();\n\t\tif (local) return local;\n\t\treturn defaultEndpoint();\n\t}\n\tif (!activeId || activeId === DEFAULT_ID) return defaultEndpoint();\n\tconst found = endpoints.find((e) => e.id === activeId);\n\tif (!found) return defaultEndpoint();\n\treturn {\n\t\t...found,\n\t\tisDefault: false\n\t};\n}\nfunction setActiveId(id) {\n\tconst data = readFile();\n\tif (!id || id === DEFAULT_ID) data.activeId = null;\n\telse if (id === LOCAL_ELECTRON_ID) {\n\t\tif (!localEndpoint()) throw new Error(\"Local OpenCode is not running (Electron only)\");\n\t\tdata.activeId = LOCAL_ELECTRON_ID;\n\t} else {\n\t\tif (!data.endpoints.some((e) => e.id === id)) throw new Error(`Endpoint not found: ${id}`);\n\t\tdata.activeId = id;\n\t}\n\twriteFile(data);\n\treturn getActiveEndpoint();\n}\nfunction addEndpoint(input) {\n\tconst label = input.label.trim();\n\tif (!label) throw new Error(\"Label is required\");\n\tconst url = normalizeEndpointUrl(input.url);\n\tif (!url) throw new Error(\"URL must be a valid http(s) URL\");\n\tconst data = readFile();\n\tconst entry = {\n\t\tid: randomUUID(),\n\t\tlabel,\n\t\turl,\n\t\t...input.password ? { password: input.password } : {}\n\t};\n\tdata.endpoints.push(entry);\n\twriteFile(data);\n\treturn entry;\n}\nfunction updateEndpoint(id, patch) {\n\tif (id === DEFAULT_ID) throw new Error(\"Cannot edit the default endpoint\");\n\tif (id === LOCAL_ELECTRON_ID) throw new Error(\"Cannot edit the local Electron OpenCode entry (it is ephemeral and per-launch)\");\n\tconst data = readFile();\n\tconst idx = data.endpoints.findIndex((e) => e.id === id);\n\tif (idx === -1) throw new Error(`Endpoint not found: ${id}`);\n\tconst next = { ...data.endpoints[idx] };\n\tif (patch.label !== void 0) {\n\t\tconst label = patch.label.trim();\n\t\tif (!label) throw new Error(\"Label cannot be empty\");\n\t\tnext.label = label;\n\t}\n\tif (patch.url !== void 0) {\n\t\tconst url = normalizeEndpointUrl(patch.url);\n\t\tif (!url) throw new Error(\"URL must be a valid http(s) URL\");\n\t\tnext.url = url;\n\t}\n\tif (patch.password === null) delete next.password;\n\telse if (typeof patch.password === \"string\") next.password = patch.password;\n\tdata.endpoints[idx] = next;\n\twriteFile(data);\n\treturn next;\n}\nfunction deleteEndpoint(id) {\n\tif (id === DEFAULT_ID) throw new Error(\"Cannot delete the default endpoint\");\n\tif (id === LOCAL_ELECTRON_ID) throw new Error(\"Cannot delete the local Electron OpenCode entry (managed by Electron lifecycle)\");\n\tconst data = readFile();\n\tconst idx = data.endpoints.findIndex((e) => e.id === id);\n\tif (idx === -1) throw new Error(`Endpoint not found: ${id}`);\n\tdata.endpoints.splice(idx, 1);\n\tif (data.activeId === id) data.activeId = null;\n\twriteFile(data);\n}\nasync function probeEndpoint(endpoint) {\n\tconst headers = new Headers();\n\tif (endpoint.password) {\n\t\tconst username = endpoint.username ?? \"openpalm\";\n\t\theaders.set(\"authorization\", `Basic ${Buffer.from(`${username}:${endpoint.password}`).toString(\"base64\")}`);\n\t}\n\ttry {\n\t\tconst response = await fetch(endpoint.url, {\n\t\t\tmethod: \"GET\",\n\t\t\theaders,\n\t\t\tredirect: \"manual\",\n\t\t\tsignal: AbortSignal.timeout(2e3)\n\t\t});\n\t\tif (response.status === 401 || response.status === 403) return {\n\t\t\tid: endpoint.id,\n\t\t\tname: endpoint.label,\n\t\t\turl: endpoint.url,\n\t\t\tstate: \"unauthorized\",\n\t\t\tdetail: `HTTP ${response.status}`\n\t\t};\n\t\tif (response.ok || response.status >= 300 && response.status < 400) return {\n\t\t\tid: endpoint.id,\n\t\t\tname: endpoint.label,\n\t\t\turl: endpoint.url,\n\t\t\tstate: \"accessible\"\n\t\t};\n\t\treturn {\n\t\t\tid: endpoint.id,\n\t\t\tname: endpoint.label,\n\t\t\turl: endpoint.url,\n\t\t\tstate: \"unreachable\",\n\t\t\tdetail: `HTTP ${response.status}`\n\t\t};\n\t} catch (error) {\n\t\treturn {\n\t\t\tid: endpoint.id,\n\t\t\tname: endpoint.label,\n\t\t\turl: endpoint.url,\n\t\t\tstate: \"unreachable\",\n\t\t\tdetail: error instanceof Error ? error.message : String(error)\n\t\t};\n\t}\n}\nasync function listRemoteStatuses() {\n\tif (remoteStatusCache && remoteStatusCache.expiresAt > Date.now()) return remoteStatusCache.value.map((status) => ({ ...status }));\n\tconst statuses = await Promise.all(listEndpoints().map((endpoint) => probeEndpoint(endpoint)));\n\tremoteStatusCache = {\n\t\tvalue: statuses,\n\t\texpiresAt: Date.now() + 5e3\n\t};\n\treturn statuses.map((status) => ({ ...status }));\n}\n//#endregion\nexport { listRemoteStatuses as a, validateEndpointUrl as c, listEndpoints as i, deleteEndpoint as n, setActiveId as o, getActiveEndpoint as r, updateEndpoint as s, addEndpoint as t };\n"],"names":[],"mappings":";;;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,UAAU,GAAG,SAAS;AAC1B,IAAI,iBAAiB,GAAG,gBAAgB;AACxC,IAAI,iBAAiB,GAAG,IAAI;AAC5B,SAAS,aAAa,GAAG;AACzB,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,eAAe,CAAC;AAChD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,GAAG;AAC/B,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC;AACpD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,+BAA+B,GAAG;AAC3C,CAAC,MAAM,OAAO,GAAG,aAAa,EAAE;AAChC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE;AAC1B,CAAC,MAAM,OAAO,GAAG,mBAAmB,EAAE;AACtC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;AAC3B,CAAC,IAAI;AACL,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAClD,EAAE,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC9D,EAAE,IAAI;AACN,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC;AAC1B,EAAE,CAAC,CAAC,MAAM,CAAC;AACX,EAAE,UAAU,CAAC,OAAO,CAAC;AACrB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,CAAC,IAAI,CAAC,wJAAwJ,EAAE,CAAC,CAAC;AAC3K,CAAC;AACD;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,4BAA4B,CAAC;AAC3D;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,IAAI,GAAG,gBAAgB,EAAE;AAChC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AACnC,CAAC,IAAI;AACL,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACxD,EAAE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI;AAC3E,EAAE,OAAO;AACT,GAAG,GAAG,EAAE,MAAM,CAAC,GAAG;AAClB,GAAG,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;AAC3E,GAAG,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;AAC3E,GAAG,GAAG,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,GAAG,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC;AAC5D,GAAG,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,GAAG,MAAM,CAAC,SAAS,GAAG,KAAK;AAC7E,GAAG;AACH,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,CAAC,IAAI,CAAC,0DAA0D,EAAE,CAAC,CAAC;AAC7E,EAAE,OAAO,IAAI;AACb,CAAC;AACD;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,MAAM,EAAE,GAAG,gBAAgB,EAAE;AAC9B,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,IAAI;AACrB,CAAC,OAAO;AACR,EAAE,EAAE,EAAE,iBAAiB;AACvB,EAAE,KAAK,EAAE,gBAAgB;AACzB,EAAE,GAAG,EAAE,yBAAyB,CAAC,EAAE,CAAC,GAAG,CAAC;AACxC,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,UAAU;AACrC,EAAE,GAAG,EAAE,CAAC,QAAQ,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;AACjD,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,OAAO,EAAE;AACX,EAAE;AACF;AACA,SAAS,yBAAyB,CAAC,GAAG,EAAE;AACxC,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC;AAC1B,EAAE,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;AACjE,EAAE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,WAAW;AACrE,EAAE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AAC1C,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,GAAG;AACZ,CAAC;AACD;AACA,SAAS,QAAQ,GAAG;AACpB,CAAC,+BAA+B,EAAE;AAClC,CAAC,IAAI,IAAI,GAAG,aAAa,EAAE;AAC3B,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;AACxB,EAAE,MAAM,MAAM,GAAG,mBAAmB,EAAE;AACtC,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,OAAO;AAClC,GAAG,QAAQ,EAAE,IAAI;AACjB,GAAG,SAAS,EAAE;AACd,GAAG;AACH,EAAE,IAAI,GAAG,MAAM;AACf,CAAC;AACD,CAAC,IAAI;AACL,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACxD,EAAE,OAAO;AACT,GAAG,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,IAAI;AACzE,GAAG,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG;AACxF,GAAG;AACH,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,CAAC,IAAI,CAAC,wDAAwD,EAAE,CAAC,CAAC;AAC3E,EAAE,OAAO;AACT,GAAG,QAAQ,EAAE,IAAI;AACjB,GAAG,SAAS,EAAE;AACd,GAAG;AACH,CAAC;AACD;AACA,SAAS,YAAY,CAAC,CAAC,EAAE;AACzB,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,OAAO,KAAK;AAC9C,CAAC,MAAM,CAAC,GAAG,CAAC;AACZ,CAAC,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;AAC5F;AACA,SAAS,SAAS,CAAC,IAAI,EAAE;AACzB,CAAC,MAAM,IAAI,GAAG,aAAa,EAAE;AAC7B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;AACpD,EAAE,QAAQ,EAAE,OAAO;AACnB,EAAE,IAAI,EAAE;AACR,EAAE,CAAC;AACH,CAAC,IAAI;AACL,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC;AACtB,CAAC,CAAC,CAAC,MAAM,CAAC;AACV;AACA,SAAS,eAAe,GAAG;AAC3B,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,MAAM,CAAC,CAAC;AACzI,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,UAAU;AACpE,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,MAAM;AAChE,CAAC,OAAO;AACR,EAAE,EAAE,EAAE,UAAU;AAChB,EAAE,KAAK,EAAE,iBAAiB;AAC1B,EAAE,GAAG,EAAE,yBAAyB,CAAC,GAAG,CAAC;AACrC,EAAE,QAAQ;AACV,EAAE,QAAQ;AACV,EAAE,SAAS,EAAE;AACb,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,cAAc,GAAG,IAAI,GAAG,CAAC;AAC7B,CAAC,WAAW;AACZ,CAAC,KAAK;AACN,CAAC,WAAW;AACZ,CAAC;AACD,CAAC,CAAC;AACF;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,QAAQ,EAAE;AAClC,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;AAChE,CAAC,OAAO,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;AACpC;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE;AACpC,CAAC,IAAI,CAAC;AACN,CAAC,IAAI;AACL,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO;AACT,GAAG,EAAE,EAAE,KAAK;AACZ,GAAG,MAAM,EAAE;AACX,GAAG;AACH,CAAC;AACD,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,OAAO;AAC/D,EAAE,EAAE,EAAE,KAAK;AACX,EAAE,MAAM,EAAE;AACV,EAAE;AACF,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO;AACzB,EAAE,EAAE,EAAE,KAAK;AACX,EAAE,MAAM,EAAE;AACV,EAAE;AACF,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAO;AACnE,EAAE,EAAE,EAAE,KAAK;AACX,EAAE,MAAM,EAAE;AACV,EAAE;AACF,CAAC,OAAO;AACR,EAAE,EAAE,EAAE,IAAI;AACV,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE;AACrC,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,KAAK,EAAE;AACrC,CAAC,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC;AAC1C,CAAC,OAAO,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI;AACrC;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE;AACjC,CAAC,MAAM,KAAK,GAAG,aAAa,EAAE;AAC9B,CAAC,OAAO;AACR,EAAE,GAAG,KAAK,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;AACzB,EAAE,eAAe,EAAE;AACnB,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AAC3B,GAAG,GAAG,CAAC;AACP,GAAG,SAAS,EAAE;AACd,GAAG,CAAC;AACJ,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,GAAG;AAC7B,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE;AAC3C,CAAC,IAAI,QAAQ,KAAK,iBAAiB,EAAE;AACrC,EAAE,MAAM,KAAK,GAAG,aAAa,EAAE;AAC/B,EAAE,IAAI,KAAK,EAAE,OAAO,KAAK;AACzB,EAAE,OAAO,eAAe,EAAE;AAC1B,CAAC;AACD,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,UAAU,EAAE,OAAO,eAAe,EAAE;AACnE,CAAC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC;AACvD,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,eAAe,EAAE;AACrC,CAAC,OAAO;AACR,EAAE,GAAG,KAAK;AACV,EAAE,SAAS,EAAE;AACb,EAAE;AACF;AACA,SAAS,WAAW,CAAC,EAAE,EAAE;AACzB,CAAC,MAAM,IAAI,GAAG,QAAQ,EAAE;AACxB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,UAAU,EAAE,IAAI,CAAC,QAAQ,GAAG,IAAI;AACnD,MAAM,IAAI,EAAE,KAAK,iBAAiB,EAAE;AACpC,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC;AACxF,EAAE,IAAI,CAAC,QAAQ,GAAG,iBAAiB;AACnC,CAAC,CAAC,MAAM;AACR,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAC;AAC5F,EAAE,IAAI,CAAC,QAAQ,GAAG,EAAE;AACpB,CAAC;AACD,CAAC,SAAS,CAAC,IAAI,CAAC;AAChB,CAAC,OAAO,iBAAiB,EAAE;AAC3B;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE;AACjC,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC;AACjD,CAAC,MAAM,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC;AAC5C,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC;AAC7D,CAAC,MAAM,IAAI,GAAG,QAAQ,EAAE;AACxB,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,KAAK;AACP,EAAE,GAAG;AACL,EAAE,GAAG,KAAK,CAAC,QAAQ,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG;AACrD,EAAE;AACF,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;AAC3B,CAAC,SAAS,CAAC,IAAI,CAAC;AAChB,CAAC,OAAO,KAAK;AACb;AACA,SAAS,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE;AACnC,CAAC,IAAI,EAAE,KAAK,UAAU,EAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC;AAC3E,CAAC,IAAI,EAAE,KAAK,iBAAiB,EAAE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC;AAChI,CAAC,MAAM,IAAI,GAAG,QAAQ,EAAE;AACxB,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;AACzD,CAAC,IAAI,GAAG,KAAK,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE;AACxC,CAAC,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,EAAE;AAC7B,EAAE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE;AAClC,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC;AACtD,EAAE,IAAI,CAAC,KAAK,GAAG,KAAK;AACpB,CAAC;AACD,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,EAAE;AAC3B,EAAE,MAAM,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC;AAC7C,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC;AAC9D,EAAE,IAAI,CAAC,GAAG,GAAG,GAAG;AAChB,CAAC;AACD,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,OAAO,IAAI,CAAC,QAAQ;AAClD,MAAM,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ;AAC5E,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI;AAC3B,CAAC,SAAS,CAAC,IAAI,CAAC;AAChB,CAAC,OAAO,IAAI;AACZ;AACA,SAAS,cAAc,CAAC,EAAE,EAAE;AAC5B,CAAC,IAAI,EAAE,KAAK,UAAU,EAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC;AAC7E,CAAC,IAAI,EAAE,KAAK,iBAAiB,EAAE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC;AACjI,CAAC,MAAM,IAAI,GAAG,QAAQ,EAAE;AACxB,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;AACzD,CAAC,IAAI,GAAG,KAAK,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;AAC9B,CAAC,IAAI,IAAI,CAAC,QAAQ,KAAK,EAAE,EAAE,IAAI,CAAC,QAAQ,GAAG,IAAI;AAC/C,CAAC,SAAS,CAAC,IAAI,CAAC;AAChB;AACA,eAAe,aAAa,CAAC,QAAQ,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE;AAC9B,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE;AACxB,EAAE,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,UAAU;AAClD,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC7G,CAAC;AACD,CAAC,IAAI;AACL,EAAE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE;AAC7C,GAAG,MAAM,EAAE,KAAK;AAChB,GAAG,OAAO;AACV,GAAG,QAAQ,EAAE,QAAQ;AACrB,GAAG,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG;AAClC,GAAG,CAAC;AACJ,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,OAAO;AACjE,GAAG,EAAE,EAAE,QAAQ,CAAC,EAAE;AAClB,GAAG,IAAI,EAAE,QAAQ,CAAC,KAAK;AACvB,GAAG,GAAG,EAAE,QAAQ,CAAC,GAAG;AACpB,GAAG,KAAK,EAAE,cAAc;AACxB,GAAG,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC;AACnC,GAAG;AACH,EAAE,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO;AAC7E,GAAG,EAAE,EAAE,QAAQ,CAAC,EAAE;AAClB,GAAG,IAAI,EAAE,QAAQ,CAAC,KAAK;AACvB,GAAG,GAAG,EAAE,QAAQ,CAAC,GAAG;AACpB,GAAG,KAAK,EAAE;AACV,GAAG;AACH,EAAE,OAAO;AACT,GAAG,EAAE,EAAE,QAAQ,CAAC,EAAE;AAClB,GAAG,IAAI,EAAE,QAAQ,CAAC,KAAK;AACvB,GAAG,GAAG,EAAE,QAAQ,CAAC,GAAG;AACpB,GAAG,KAAK,EAAE,aAAa;AACvB,GAAG,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC;AACnC,GAAG;AACH,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE;AACjB,EAAE,OAAO;AACT,GAAG,EAAE,EAAE,QAAQ,CAAC,EAAE;AAClB,GAAG,IAAI,EAAE,QAAQ,CAAC,KAAK;AACvB,GAAG,GAAG,EAAE,QAAQ,CAAC,GAAG;AACpB,GAAG,KAAK,EAAE,aAAa;AACvB,GAAG,MAAM,EAAE,KAAK,YAAY,KAAK,GAAG,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK;AAChE,GAAG;AACH,CAAC;AACD;AACA,eAAe,kBAAkB,GAAG;AACpC,CAAC,IAAI,iBAAiB,IAAI,iBAAiB,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AACnI,CAAC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/F,CAAC,iBAAiB,GAAG;AACrB,EAAE,KAAK,EAAE,QAAQ;AACjB,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG;AAC1B,EAAE;AACF,CAAC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AACjD;;;;"}

package/build/server/chunks/{environment-B7NymDAL.js → environment-DedKcJdc.js}

@@ -30,7 +30,7 @@ function set_public_env(environment) {
 }
 //#endregion
 //#region \0virtual:__sveltekit/environment
-var version = "0.12.11";
+var version = "0.12.13";
 
 export { app_dir as a, assets as b, base as c, set_public_env as d, override as o, public_env as p, reset as r, set_private_env as s, version as v };
-//# sourceMappingURL=environment-B7NymDAL.js.map
+//# sourceMappingURL=environment-DedKcJdc.js.map

package/build/server/chunks/{environment-B7NymDAL.js.map → environment-DedKcJdc.js.map}

@@ -1 +1 @@
-{"version":3,"file":"environment-B7NymDAL.js","sources":["../../../.svelte-kit/adapter-node/chunks/environment.js"],"sourcesContent":["//#region ../../node_modules/.bun/@sveltejs+kit@2.61.0+aeb06e9cf8e23ab6/node_modules/@sveltejs/kit/src/runtime/app/paths/internal/server.js\nvar base = \"\";\nvar assets = base;\nvar app_dir = \"_app\";\nvar initial = {\n\tbase,\n\tassets\n};\ninitial.base;\n/**\n* @param {{ base: string, assets: string }} paths\n*/\nfunction override(paths) {\n\tbase = paths.base;\n\tassets = paths.assets;\n}\nfunction reset() {\n\tbase = initial.base;\n\tassets = initial.assets;\n}\n/** @param {string} path */\nfunction set_assets(path) {\n\tassets = initial.assets = path;\n}\n/**\n* `$env/dynamic/public`\n* @type {Record<string, string>}\n*/\nvar public_env = {};\n/** @type {(environment: Record<string, string>) => void} */\nfunction set_private_env(environment) {}\n/** @type {(environment: Record<string, string>) => void} */\nfunction set_public_env(environment) {\n\tpublic_env = environment;\n}\n//#endregion\n//#region \\0virtual:__sveltekit/environment\nvar version = \"0.12.11\";\nvar prerendering = false;\nfunction set_building() {}\nfunction set_prerendering() {\n\tprerendering = true;\n}\n//#endregion\nexport { public_env as a, app_dir as c, override as d, reset as f, version as i, assets as l, set_building as n, set_private_env as o, set_assets as p, set_prerendering as r, set_public_env as s, prerendering as t, base as u };\n"],"names":[],"mappings":"AAAA;AACG,IAAC,IAAI,GAAG;AACR,IAAC,MAAM,GAAG;AACV,IAAC,OAAO,GAAG;AACd,IAAI,OAAO,GAAG;AACd,CAAC,IAAI;AACL,CAAC;AACD,CAAC;AAED;AACA;AACA;AACA,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI;AAClB,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;AACtB;AACA,SAAS,KAAK,GAAG;AACjB,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI;AACpB,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM;AACxB;AAKA;AACA;AACA;AACA;AACG,IAAC,UAAU,GAAG;AACjB;AACA,SAAS,eAAe,CAAC,WAAW,EAAE,CAAC;AACvC;AACA,SAAS,cAAc,CAAC,WAAW,EAAE;AACrC,CAAC,UAAU,GAAG,WAAW;AACzB;AACA;AACA;AACG,IAAC,OAAO,GAAG;;;;"}
+{"version":3,"file":"environment-DedKcJdc.js","sources":["../../../.svelte-kit/adapter-node/chunks/environment.js"],"sourcesContent":["//#region ../../node_modules/.bun/@sveltejs+kit@2.61.0+aeb06e9cf8e23ab6/node_modules/@sveltejs/kit/src/runtime/app/paths/internal/server.js\nvar base = \"\";\nvar assets = base;\nvar app_dir = \"_app\";\nvar initial = {\n\tbase,\n\tassets\n};\ninitial.base;\n/**\n* @param {{ base: string, assets: string }} paths\n*/\nfunction override(paths) {\n\tbase = paths.base;\n\tassets = paths.assets;\n}\nfunction reset() {\n\tbase = initial.base;\n\tassets = initial.assets;\n}\n/** @param {string} path */\nfunction set_assets(path) {\n\tassets = initial.assets = path;\n}\n/**\n* `$env/dynamic/public`\n* @type {Record<string, string>}\n*/\nvar public_env = {};\n/** @type {(environment: Record<string, string>) => void} */\nfunction set_private_env(environment) {}\n/** @type {(environment: Record<string, string>) => void} */\nfunction set_public_env(environment) {\n\tpublic_env = environment;\n}\n//#endregion\n//#region \\0virtual:__sveltekit/environment\nvar version = \"0.12.13\";\nvar prerendering = false;\nfunction set_building() {}\nfunction set_prerendering() {\n\tprerendering = true;\n}\n//#endregion\nexport { public_env as a, app_dir as c, override as d, reset as f, version as i, assets as l, set_building as n, set_private_env as o, set_assets as p, set_prerendering as r, set_public_env as s, prerendering as t, base as u };\n"],"names":[],"mappings":"AAAA;AACG,IAAC,IAAI,GAAG;AACR,IAAC,MAAM,GAAG;AACV,IAAC,OAAO,GAAG;AACd,IAAI,OAAO,GAAG;AACd,CAAC,IAAI;AACL,CAAC;AACD,CAAC;AAED;AACA;AACA;AACA,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI;AAClB,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;AACtB;AACA,SAAS,KAAK,GAAG;AACjB,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI;AACpB,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM;AACxB;AAKA;AACA;AACA;AACA;AACG,IAAC,UAAU,GAAG;AACjB;AACA,SAAS,eAAe,CAAC,WAAW,EAAE,CAAC;AACvC;AACA,SAAS,cAAc,CAAC,WAAW,EAAE;AACrC,CAAC,UAAU,GAAG,WAAW;AACzB;AACA;AACA;AACG,IAAC,OAAO,GAAG;;;;"}

package/build/server/chunks/{error.svelte-BQiDKgW2.js → error.svelte-C6ZvgK-0.js}

@@ -1,8 +1,8 @@
 import { r as escape_html } from './dev-B6xUe35c.js';
-import { p as page } from './state2-C0_95QUq.js';
+import { p as page } from './state2-boKye0ZJ.js';
 import 'node:module';
-import './client-B8iuur7b.js';
-import './internal-DYjrNs__.js';
+import './client-BVhtM1mG.js';
+import './internal-DQFuMtuQ.js';
 import './utils-BSRjJDrZ.js';
 import './chunk-CLZ62Ad-.js';
 
@@ -14,4 +14,4 @@ function Error($$renderer, $$props) {
 }
 
 export { Error as default };
-//# sourceMappingURL=error.svelte-BQiDKgW2.js.map
+//# sourceMappingURL=error.svelte-C6ZvgK-0.js.map

package/build/server/chunks/{error.svelte-BQiDKgW2.js.map → error.svelte-C6ZvgK-0.js.map}

@@ -1 +1 @@
-{"version":3,"file":"error.svelte-BQiDKgW2.js","sources":["../../../.svelte-kit/adapter-node/entries/fallbacks/error.svelte.js"],"sourcesContent":["import { H as escape_html } from \"../../chunks/dev.js\";\nimport { t as page } from \"../../chunks/state2.js\";\n//#region ../../node_modules/.bun/@sveltejs+kit@2.61.0+aeb06e9cf8e23ab6/node_modules/@sveltejs/kit/src/runtime/components/svelte-5/error.svelte\nfunction Error($$renderer, $$props) {\n\t$$renderer.component(($$renderer) => {\n\t\t$$renderer.push(`<h1>${escape_html(page.status)}</h1> <p>${escape_html(page.error?.message)}</p>`);\n\t});\n}\n//#endregion\nexport { Error as default };\n"],"names":[],"mappings":";;;;;;;;AAEA;AACA,SAAS,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE;AACpC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,KAAK;AACtC,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;AACpG,CAAC,CAAC,CAAC;AACH;;;;"}
+{"version":3,"file":"error.svelte-C6ZvgK-0.js","sources":["../../../.svelte-kit/adapter-node/entries/fallbacks/error.svelte.js"],"sourcesContent":["import { H as escape_html } from \"../../chunks/dev.js\";\nimport { t as page } from \"../../chunks/state2.js\";\n//#region ../../node_modules/.bun/@sveltejs+kit@2.61.0+aeb06e9cf8e23ab6/node_modules/@sveltejs/kit/src/runtime/components/svelte-5/error.svelte\nfunction Error($$renderer, $$props) {\n\t$$renderer.component(($$renderer) => {\n\t\t$$renderer.push(`<h1>${escape_html(page.status)}</h1> <p>${escape_html(page.error?.message)}</p>`);\n\t});\n}\n//#endregion\nexport { Error as default };\n"],"names":[],"mappings":";;;;;;;;AAEA;AACA,SAAS,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE;AACpC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,KAAK;AACtC,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;AACpG,CAAC,CAAC,CAAC;AACH;;;;"}

package/build/server/chunks/{helpers-TBhHA7BL.js → helpers-kzwksNq1.js}

@@ -1,5 +1,5 @@
-import { aB as readSecret, aU as resolveStackDir, H as createOpenCodeClient } from './src-BrowG4c5.js';
-import { g as getActiveEndpoint } from './endpoints-DIQ-qrrL.js';
+import { aF as readSecret, aZ as resolveStackDir, J as createOpenCodeClient } from './src-CidJbygh.js';
+import { g as getActiveEndpoint } from './endpoints-UdQGgKsR.js';
 import { timingSafeEqual, createHmac, createHash } from 'node:crypto';
 
 //#region src/lib/server/session-store.ts
@@ -274,4 +274,4 @@ function checkOriginHeader(request, port) {
 var UI_PORT = Number(process.env.PORT ?? 3880);
 
 export { SESSION_TTL_SECONDS as S, UI_PORT as U, checkOriginHeader as a, createSession as b, checkHostHeader as c, getRequestId as d, errorResponse as e, getUiLoginPassword as f, getOpenCodeClient as g, invalidateSession as h, identifyCallerByToken as i, jsonBodyError as j, jsonResponse as k, parseJsonBody as p, requireAdmin as r, safeTokenCompare as s, touchSession as t, withAdminBody as w };
-//# sourceMappingURL=helpers-TBhHA7BL.js.map
+//# sourceMappingURL=helpers-kzwksNq1.js.map

package/build/server/chunks/{helpers-TBhHA7BL.js.map → helpers-kzwksNq1.js.map}

@@ -1 +1 @@
-{"version":3,"file":"helpers-TBhHA7BL.js","sources":["../../../.svelte-kit/adapter-node/chunks/helpers.js"],"sourcesContent":["import { bt as createOpenCodeClient, nn as resolveStackDir, qt as readSecret } from \"./src.js\";\nimport \"./state.js\";\nimport { r as getActiveEndpoint } from \"./endpoints.js\";\nimport { createHash, createHmac, timingSafeEqual } from \"node:crypto\";\n//#region src/lib/server/session-store.ts\n/**\n* Stateless signed session tokens.\n*\n* Token format: `<expiresAt>.<hmac-sha256-hex>`\n*   expiresAt — unix ms timestamp when the session expires\n*   signature — HMAC-SHA256(expiresAt, login password)\n*\n* Tokens are self-validating: the server holds no per-session state and\n* sessions survive UI server restarts. Signing with the login password means\n* a password change invalidates all existing sessions — correct behaviour.\n*\n* The signing secret is resolved exactly like login verification\n* (`getUiLoginPassword`): `process.env.OP_UI_LOGIN_PASSWORD` first, then the\n* on-disk stack secret. When NEITHER exists, minting throws and validation\n* fails closed — there is deliberately no fallback secret, because a constant\n* key would let anyone forge an admin token. Reading the file per call also\n* means tokens minted right after the setup wizard writes the password are\n* signed with the real secret, without waiting for a process restart.\n*\n* Logout semantics (known trade-off of stateless tokens): logout revokes the\n* single token the browser presented (in-memory list, cleared on restart) and\n* clears the cookie. Earlier tokens issued to the same browser by sliding\n* renewal remain cryptographically valid until they expire — logout is\n* \"forget my cookie\", not \"kill every credential ever issued\". A real\n* kill-switch is changing the login password, which invalidates everything.\n*/\n/** Session lifetime for both the token expiry and the cookie Max-Age. 14 days. */\nvar SESSION_TTL_MS = 12096e5;\n/** Cookie Max-Age in seconds (Set-Cookie uses seconds, not ms). */\nvar SESSION_TTL_SECONDS = SESSION_TTL_MS / 1e3;\nvar _revoked = /* @__PURE__ */ new Set();\nvar _testOverrides = /* @__PURE__ */ new Set();\n/**\n* Read the operator UI login password from the host environment or the\n* file-based stack secret (`knowledge/secrets/op_ui_login_password`).\n*\n* This is the single source of truth for the password — login verification\n* (helpers.ts) and token signing below both use it, so they can never\n* disagree about whether a password exists. Returns \"\" when neither source\n* has a value (first boot, before the wizard runs).\n*/\nfunction getUiLoginPassword() {\n\tconst envValue = process.env.OP_UI_LOGIN_PASSWORD;\n\tif (envValue) return envValue;\n\treturn readSecret(resolveStackDir(), \"op_ui_login_password\")?.trimEnd() ?? \"\";\n}\n/** Sign `expiresAt` with the login password. Returns null when no password is configured. */\nfunction signToken(expiresAt) {\n\tconst secret = getUiLoginPassword();\n\tif (!secret) return null;\n\treturn createHmac(\"sha256\", secret).update(String(expiresAt)).digest(\"hex\");\n}\n/**\n* Mint a new signed session token with a 14-day TTL.\n* Place the result in the `op_session` cookie.\n* Throws when no login password is configured — callers must verify a\n* password exists (they all do: login/session/setup-complete check first).\n*/\nfunction createSession() {\n\tconst expiresAt = Date.now() + SESSION_TTL_MS;\n\tconst sig = signToken(expiresAt);\n\tif (sig === null) throw new Error(\"Cannot mint a session: no UI login password is configured.\");\n\treturn `${expiresAt}.${sig}`;\n}\n/**\n* Return true iff `token` is a valid, non-expired, non-revoked session.\n*/\nfunction validateSession(token) {\n\tif (!token) return false;\n\tif (_testOverrides.has(token)) return true;\n\tif (_revoked.has(token)) return false;\n\tconst dot = token.lastIndexOf(\".\");\n\tif (dot < 0) return false;\n\tconst expiresAt = Number(token.slice(0, dot));\n\tif (!Number.isFinite(expiresAt) || Date.now() >= expiresAt) return false;\n\tconst sig = token.slice(dot + 1);\n\tconst expected = signToken(expiresAt);\n\tif (expected === null) return false;\n\tif (sig.length !== expected.length) return false;\n\treturn timingSafeEqual(Buffer.from(sig), Buffer.from(expected));\n}\n/**\n* Sliding renewal: validate the old token, return a new one with a fresh\n* 14-day TTL, or return false if the old token is invalid/expired.\n* The caller must place the returned token in the `op_session` cookie.\n*/\nfunction touchSession(token) {\n\tif (!validateSession(token)) return false;\n\treturn createSession();\n}\n/**\n* Revoke a token (logout). The browser cookie must also be cleared by the caller.\n* The revocation list survives until the next server restart. Entries whose\n* embedded expiry has passed are pruned on each call — an expired token fails\n* validation anyway, so keeping it listed is pure memory growth.\n*/\nfunction invalidateSession(token) {\n\tconst now = Date.now();\n\tfor (const revoked of _revoked) {\n\t\tconst expiresAt = Number(revoked.slice(0, revoked.lastIndexOf(\".\")));\n\t\tif (!Number.isFinite(expiresAt) || expiresAt <= now) _revoked.delete(revoked);\n\t}\n\t_revoked.add(token);\n}\n//#endregion\n//#region src/lib/server/helpers.ts\n/**\n* Lazy OpenCode client bound to the currently active endpoint. The client is\n* recreated whenever the active endpoint URL changes so user switches in the\n* UI take effect on the next call.\n*/\nvar _openCodeClient;\nvar _openCodeClientUrl;\nfunction getOpenCodeClient() {\n\tconst { url } = getActiveEndpoint();\n\tif (!_openCodeClient || url !== _openCodeClientUrl) {\n\t\t_openCodeClient = createOpenCodeClient({ baseUrl: url });\n\t\t_openCodeClientUrl = url;\n\t}\n\treturn _openCodeClient;\n}\nfunction safeTokenCompare(a, b) {\n\tif (typeof a !== \"string\" || typeof b !== \"string\") return false;\n\tif (!a || !b) return false;\n\treturn timingSafeEqual(createHash(\"sha256\").update(a).digest(), createHash(\"sha256\").update(b).digest());\n}\n/** Standard JSON response with request ID header */\nfunction jsonResponse(status, body, requestId = \"\") {\n\treturn new Response(JSON.stringify(body), {\n\t\tstatus,\n\t\theaders: {\n\t\t\t\"content-type\": \"application/json\",\n\t\t\t...requestId ? { \"x-request-id\": requestId } : {}\n\t\t}\n\t});\n}\n/** Standard error envelope */\nfunction errorResponse(status, error, message, details = {}, requestId = \"\") {\n\treturn jsonResponse(status, {\n\t\terror,\n\t\tmessage,\n\t\tdetails,\n\t\trequestId\n\t}, requestId);\n}\n/** Extract or generate request ID */\nfunction getRequestId(event) {\n\treturn event.request.headers.get(\"x-request-id\") || crypto.randomUUID();\n}\n/**\n* Extract raw session token from the `op_session` cookie.\n*\n* Phase 2 of the auth/proxy refactor (docs/technical/auth-and-proxy-refactor-plan.md)\n* removed the legacy `x-admin-token` / `Authorization: Bearer` header fallbacks.\n* The cookie is HttpOnly + SameSite=Strict and is the ONLY credential the browser\n* holds; XSS cannot read it and out-of-process callers must obtain a session via\n* `POST /admin/auth/login` (or `/session`) and present the cookie on subsequent\n* requests.\n*/\nfunction extractToken(event) {\n\tconst match = (event.request.headers.get(\"cookie\") ?? \"\").match(/(?:^|;\\s*)op_session=([^;]+)/);\n\tif (match) return match[1];\n\treturn \"\";\n}\n/** Check admin auth — returns error Response or null if OK */\nfunction requireAdmin(event, requestId) {\n\tif (!getUiLoginPassword()) return errorResponse(503, \"admin_not_configured\", \"OP_UI_LOGIN_PASSWORD has not been set. Complete setup first.\", {}, requestId);\n\tif (!validateSession(extractToken(event))) return errorResponse(401, \"unauthorized\", \"Missing or invalid credentials\", {}, requestId);\n\treturn null;\n}\n/**\n* Identify caller by the presented `op_session` cookie.\n*\n* Returns \"admin\" when the cookie holds a valid session token.\n*/\nfunction identifyCallerByToken(event) {\n\tif (!getUiLoginPassword()) return null;\n\tif (validateSession(extractToken(event))) return \"admin\";\n\treturn null;\n}\n/** Parse JSON body safely — returns discriminated result with error type */\nasync function parseJsonBody(request, maxBytes = 1048576) {\n\ttry {\n\t\tconst contentLength = request.headers.get(\"content-length\");\n\t\tif (contentLength && parseInt(contentLength, 10) > maxBytes) return { error: \"too_large\" };\n\t\treturn { data: await request.json() };\n\t} catch (e) {\n\t\tconsole.warn(\"[helpers] Failed to parse JSON request body\", e);\n\t\treturn { error: \"invalid_json\" };\n\t}\n}\n/** Convert a ParseJsonBodyError to an appropriate HTTP error response */\nfunction jsonBodyError(err, requestId) {\n\tif (err.error === \"too_large\") return errorResponse(413, \"too_large\", \"Request body too large\", {}, requestId);\n\treturn errorResponse(400, \"invalid_json\", \"Request body must be valid JSON\", {}, requestId);\n}\n/**\n* Auth + JSON body wrapper for admin POST/DELETE handlers.\n*\n* Replaces the 4-line boilerplate copy-pasted across 30+ routes:\n*   const requestId = getRequestId(event);\n*   const authError = requireAdmin(event, requestId);\n*   if (authError) return authError;\n*   const result = await parseJsonBody(event.request);\n*   if ('error' in result) return jsonBodyError(result, requestId);\n*\n* Use for routes that need both auth and a JSON body. For auth-only or\n* GET routes, call `requireAdmin` directly.\n*/\nasync function withAdminBody(event, handler) {\n\tconst requestId = getRequestId(event);\n\tconst originError = checkOriginHeader(event.request, UI_PORT);\n\tif (originError) return originError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst result = await parseJsonBody(event.request);\n\tif (\"error\" in result) return jsonBodyError(result, requestId);\n\treturn handler({\n\t\trequestId,\n\t\tbody: result.data\n\t});\n}\n/**\n* Reject requests whose Host header does not match localhost or 127.0.0.1\n* on the configured admin port.\n*\n* @param request  Incoming Request (or SvelteKit RequestEvent.request)\n* @param port     The port this server is bound to (e.g. 3880 or 8100)\n* @returns        A 400 Response if the host is rejected; null if allowed\n*/\nfunction checkHostHeader(request, port) {\n\tconst normalized = (request.headers.get(\"host\") ?? \"\").trim().replace(/\\.$/, \"\");\n\tif ([`localhost:${port}`, `127.0.0.1:${port}`].includes(normalized)) return null;\n\treturn new Response(JSON.stringify({\n\t\terror: \"invalid_host\",\n\t\thost: normalized,\n\t\tmessage: \"Request rejected: Host header does not match allowed hosts. The admin UI binds to loopback (127.0.0.1) only; reach it via localhost or front it with a reverse proxy/tunnel for remote access.\"\n\t}), {\n\t\tstatus: 400,\n\t\theaders: { \"content-type\": \"application/json\" }\n\t});\n}\n/**\n* Reject POST/PUT/DELETE requests whose Origin header does not match\n* localhost or 127.0.0.1. Requests with no Origin (non-browser clients)\n* are always allowed.\n*\n* @param request  Incoming Request\n* @param port     The port this server is bound to\n* @returns        A 403 Response if the origin is rejected; null if allowed\n*/\nfunction checkOriginHeader(request, port) {\n\tconst method = request.method.toUpperCase();\n\tif (method === \"GET\" || method === \"HEAD\" || method === \"OPTIONS\") return null;\n\tconst origin = request.headers.get(\"origin\");\n\tif (!origin) return null;\n\ttry {\n\t\tconst u = new URL(origin);\n\t\tif ([`localhost:${port}`, `127.0.0.1:${port}`].includes(u.host)) return null;\n\t} catch {}\n\treturn new Response(JSON.stringify({\n\t\terror: \"forbidden_origin\",\n\t\torigin\n\t}), {\n\t\tstatus: 403,\n\t\theaders: { \"content-type\": \"application/json\" }\n\t});\n}\nvar UI_PORT = Number(process.env.PORT ?? 3880);\n//#endregion\nexport { invalidateSession as _, getOpenCodeClient as a, jsonBodyError as c, requireAdmin as d, safeTokenCompare as f, getUiLoginPassword as g, createSession as h, errorResponse as i, jsonResponse as l, SESSION_TTL_SECONDS as m, checkHostHeader as n, getRequestId as o, withAdminBody as p, checkOriginHeader as r, identifyCallerByToken as s, UI_PORT as t, parseJsonBody as u, touchSession as v };\n"],"names":[],"mappings":";;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,cAAc,GAAG,OAAO;AAC5B;AACG,IAAC,mBAAmB,GAAG,cAAc,GAAG;AAC3C,IAAI,QAAQ,mBAAmB,IAAI,GAAG,EAAE;AACxC,IAAI,cAAc,mBAAmB,IAAI,GAAG,EAAE;AAC9C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,GAAG;AAC9B,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB;AAClD,CAAC,IAAI,QAAQ,EAAE,OAAO,QAAQ;AAC9B,CAAC,OAAO,UAAU,CAAC,eAAe,EAAE,EAAE,sBAAsB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;AAC9E;AACA;AACA,SAAS,SAAS,CAAC,SAAS,EAAE;AAC9B,CAAC,MAAM,MAAM,GAAG,kBAAkB,EAAE;AACpC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI;AACzB,CAAC,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;AAC5E;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc;AAC9C,CAAC,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC;AACjC,CAAC,IAAI,GAAG,KAAK,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC;AAChG,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7B;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,KAAK,EAAE;AAChC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,KAAK;AACzB,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,IAAI;AAC3C,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK;AACtC,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC;AACnC,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,OAAO,KAAK;AAC1B,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,EAAE,OAAO,KAAK;AACzE,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;AACjC,CAAC,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC;AACtC,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,OAAO,KAAK;AACpC,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,OAAO,KAAK;AACjD,CAAC,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAChE;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK;AAC1C,CAAC,OAAO,aAAa,EAAE;AACvB;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;AACvB,CAAC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE;AACjC,EAAE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;AACtE,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;AAC/E,CAAC;AACD,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;AACpB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,eAAe;AACnB,IAAI,kBAAkB;AACtB,SAAS,iBAAiB,GAAG;AAC7B,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,iBAAiB,EAAE;AACpC,CAAC,IAAI,CAAC,eAAe,IAAI,GAAG,KAAK,kBAAkB,EAAE;AACrD,EAAE,eAAe,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC1D,EAAE,kBAAkB,GAAG,GAAG;AAC1B,CAAC;AACD,CAAC,OAAO,eAAe;AACvB;AACA,SAAS,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE;AAChC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,OAAO,KAAK;AACjE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,KAAK;AAC3B,CAAC,OAAO,eAAe,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AACzG;AACA;AACA,SAAS,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,EAAE,EAAE;AACpD,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;AAC3C,EAAE,MAAM;AACR,EAAE,OAAO,EAAE;AACX,GAAG,cAAc,EAAE,kBAAkB;AACrC,GAAG,GAAG,SAAS,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG;AAClD;AACA,EAAE,CAAC;AACH;AACA;AACA,SAAS,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,EAAE;AAC7E,CAAC,OAAO,YAAY,CAAC,MAAM,EAAE;AAC7B,EAAE,KAAK;AACP,EAAE,OAAO;AACT,EAAE,OAAO;AACT,EAAE;AACF,EAAE,EAAE,SAAS,CAAC;AACd;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE;AACxE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,8BAA8B,CAAC;AAChG,CAAC,IAAI,KAAK,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC;AAC3B,CAAC,OAAO,EAAE;AACV;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE;AACxC,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,sBAAsB,EAAE,8DAA8D,EAAE,EAAE,EAAE,SAAS,CAAC;AAC5J,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,gCAAgC,EAAE,EAAE,EAAE,SAAS,CAAC;AACtI,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,KAAK,EAAE;AACtC,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,OAAO,IAAI;AACvC,CAAC,IAAI,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,OAAO;AACzD,CAAC,OAAO,IAAI;AACZ;AACA;AACA,eAAe,aAAa,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,EAAE;AAC1D,CAAC,IAAI;AACL,EAAE,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;AAC7D,EAAE,IAAI,aAAa,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE;AAC5F,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE;AACvC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,CAAC,IAAI,CAAC,6CAA6C,EAAE,CAAC,CAAC;AAChE,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE;AAClC,CAAC;AACD;AACA;AACA,SAAS,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE;AACvC,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,EAAE,EAAE,SAAS,CAAC;AAC/G,CAAC,OAAO,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,iCAAiC,EAAE,EAAE,EAAE,SAAS,CAAC;AAC5F;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC;AAC9D,CAAC,IAAI,WAAW,EAAE,OAAO,WAAW;AACpC,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;AAClD,CAAC,IAAI,OAAO,IAAI,MAAM,EAAE,OAAO,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC;AAC/D,CAAC,OAAO,OAAO,CAAC;AAChB,EAAE,SAAS;AACX,EAAE,IAAI,EAAE,MAAM,CAAC;AACf,EAAE,CAAC;AACH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE;AACxC,CAAC,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AACjF,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,IAAI;AACjF,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AACpC,EAAE,KAAK,EAAE,cAAc;AACvB,EAAE,IAAI,EAAE,UAAU;AAClB,EAAE,OAAO,EAAE;AACX,EAAE,CAAC,EAAE;AACL,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AAC/C,EAAE,CAAC;AACH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE;AAC1C,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;AAC5C,CAAC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,OAAO,IAAI;AAC/E,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC7C,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI;AACzB,CAAC,IAAI;AACL,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC;AAC3B,EAAE,IAAI,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AAC9E,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AACpC,EAAE,KAAK,EAAE,kBAAkB;AAC3B,EAAE;AACF,EAAE,CAAC,EAAE;AACL,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AAC/C,EAAE,CAAC;AACH;AACG,IAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI;;;;"}
+{"version":3,"file":"helpers-kzwksNq1.js","sources":["../../../.svelte-kit/adapter-node/chunks/helpers.js"],"sourcesContent":["import { Zt as readSecret, on as resolveStackDir, wt as createOpenCodeClient } from \"./src.js\";\nimport \"./state.js\";\nimport { r as getActiveEndpoint } from \"./endpoints.js\";\nimport { createHash, createHmac, timingSafeEqual } from \"node:crypto\";\n//#region src/lib/server/session-store.ts\n/**\n* Stateless signed session tokens.\n*\n* Token format: `<expiresAt>.<hmac-sha256-hex>`\n*   expiresAt — unix ms timestamp when the session expires\n*   signature — HMAC-SHA256(expiresAt, login password)\n*\n* Tokens are self-validating: the server holds no per-session state and\n* sessions survive UI server restarts. Signing with the login password means\n* a password change invalidates all existing sessions — correct behaviour.\n*\n* The signing secret is resolved exactly like login verification\n* (`getUiLoginPassword`): `process.env.OP_UI_LOGIN_PASSWORD` first, then the\n* on-disk stack secret. When NEITHER exists, minting throws and validation\n* fails closed — there is deliberately no fallback secret, because a constant\n* key would let anyone forge an admin token. Reading the file per call also\n* means tokens minted right after the setup wizard writes the password are\n* signed with the real secret, without waiting for a process restart.\n*\n* Logout semantics (known trade-off of stateless tokens): logout revokes the\n* single token the browser presented (in-memory list, cleared on restart) and\n* clears the cookie. Earlier tokens issued to the same browser by sliding\n* renewal remain cryptographically valid until they expire — logout is\n* \"forget my cookie\", not \"kill every credential ever issued\". A real\n* kill-switch is changing the login password, which invalidates everything.\n*/\n/** Session lifetime for both the token expiry and the cookie Max-Age. 14 days. */\nvar SESSION_TTL_MS = 12096e5;\n/** Cookie Max-Age in seconds (Set-Cookie uses seconds, not ms). */\nvar SESSION_TTL_SECONDS = SESSION_TTL_MS / 1e3;\nvar _revoked = /* @__PURE__ */ new Set();\nvar _testOverrides = /* @__PURE__ */ new Set();\n/**\n* Read the operator UI login password from the host environment or the\n* file-based stack secret (`knowledge/secrets/op_ui_login_password`).\n*\n* This is the single source of truth for the password — login verification\n* (helpers.ts) and token signing below both use it, so they can never\n* disagree about whether a password exists. Returns \"\" when neither source\n* has a value (first boot, before the wizard runs).\n*/\nfunction getUiLoginPassword() {\n\tconst envValue = process.env.OP_UI_LOGIN_PASSWORD;\n\tif (envValue) return envValue;\n\treturn readSecret(resolveStackDir(), \"op_ui_login_password\")?.trimEnd() ?? \"\";\n}\n/** Sign `expiresAt` with the login password. Returns null when no password is configured. */\nfunction signToken(expiresAt) {\n\tconst secret = getUiLoginPassword();\n\tif (!secret) return null;\n\treturn createHmac(\"sha256\", secret).update(String(expiresAt)).digest(\"hex\");\n}\n/**\n* Mint a new signed session token with a 14-day TTL.\n* Place the result in the `op_session` cookie.\n* Throws when no login password is configured — callers must verify a\n* password exists (they all do: login/session/setup-complete check first).\n*/\nfunction createSession() {\n\tconst expiresAt = Date.now() + SESSION_TTL_MS;\n\tconst sig = signToken(expiresAt);\n\tif (sig === null) throw new Error(\"Cannot mint a session: no UI login password is configured.\");\n\treturn `${expiresAt}.${sig}`;\n}\n/**\n* Return true iff `token` is a valid, non-expired, non-revoked session.\n*/\nfunction validateSession(token) {\n\tif (!token) return false;\n\tif (_testOverrides.has(token)) return true;\n\tif (_revoked.has(token)) return false;\n\tconst dot = token.lastIndexOf(\".\");\n\tif (dot < 0) return false;\n\tconst expiresAt = Number(token.slice(0, dot));\n\tif (!Number.isFinite(expiresAt) || Date.now() >= expiresAt) return false;\n\tconst sig = token.slice(dot + 1);\n\tconst expected = signToken(expiresAt);\n\tif (expected === null) return false;\n\tif (sig.length !== expected.length) return false;\n\treturn timingSafeEqual(Buffer.from(sig), Buffer.from(expected));\n}\n/**\n* Sliding renewal: validate the old token, return a new one with a fresh\n* 14-day TTL, or return false if the old token is invalid/expired.\n* The caller must place the returned token in the `op_session` cookie.\n*/\nfunction touchSession(token) {\n\tif (!validateSession(token)) return false;\n\treturn createSession();\n}\n/**\n* Revoke a token (logout). The browser cookie must also be cleared by the caller.\n* The revocation list survives until the next server restart. Entries whose\n* embedded expiry has passed are pruned on each call — an expired token fails\n* validation anyway, so keeping it listed is pure memory growth.\n*/\nfunction invalidateSession(token) {\n\tconst now = Date.now();\n\tfor (const revoked of _revoked) {\n\t\tconst expiresAt = Number(revoked.slice(0, revoked.lastIndexOf(\".\")));\n\t\tif (!Number.isFinite(expiresAt) || expiresAt <= now) _revoked.delete(revoked);\n\t}\n\t_revoked.add(token);\n}\n//#endregion\n//#region src/lib/server/helpers.ts\n/**\n* Lazy OpenCode client bound to the currently active endpoint. The client is\n* recreated whenever the active endpoint URL changes so user switches in the\n* UI take effect on the next call.\n*/\nvar _openCodeClient;\nvar _openCodeClientUrl;\nfunction getOpenCodeClient() {\n\tconst { url } = getActiveEndpoint();\n\tif (!_openCodeClient || url !== _openCodeClientUrl) {\n\t\t_openCodeClient = createOpenCodeClient({ baseUrl: url });\n\t\t_openCodeClientUrl = url;\n\t}\n\treturn _openCodeClient;\n}\nfunction safeTokenCompare(a, b) {\n\tif (typeof a !== \"string\" || typeof b !== \"string\") return false;\n\tif (!a || !b) return false;\n\treturn timingSafeEqual(createHash(\"sha256\").update(a).digest(), createHash(\"sha256\").update(b).digest());\n}\n/** Standard JSON response with request ID header */\nfunction jsonResponse(status, body, requestId = \"\") {\n\treturn new Response(JSON.stringify(body), {\n\t\tstatus,\n\t\theaders: {\n\t\t\t\"content-type\": \"application/json\",\n\t\t\t...requestId ? { \"x-request-id\": requestId } : {}\n\t\t}\n\t});\n}\n/** Standard error envelope */\nfunction errorResponse(status, error, message, details = {}, requestId = \"\") {\n\treturn jsonResponse(status, {\n\t\terror,\n\t\tmessage,\n\t\tdetails,\n\t\trequestId\n\t}, requestId);\n}\n/** Extract or generate request ID */\nfunction getRequestId(event) {\n\treturn event.request.headers.get(\"x-request-id\") || crypto.randomUUID();\n}\n/**\n* Extract raw session token from the `op_session` cookie.\n*\n* Phase 2 of the auth/proxy refactor (docs/technical/auth-and-proxy-refactor-plan.md)\n* removed the legacy `x-admin-token` / `Authorization: Bearer` header fallbacks.\n* The cookie is HttpOnly + SameSite=Strict and is the ONLY credential the browser\n* holds; XSS cannot read it and out-of-process callers must obtain a session via\n* `POST /admin/auth/login` (or `/session`) and present the cookie on subsequent\n* requests.\n*/\nfunction extractToken(event) {\n\tconst match = (event.request.headers.get(\"cookie\") ?? \"\").match(/(?:^|;\\s*)op_session=([^;]+)/);\n\tif (match) return match[1];\n\treturn \"\";\n}\n/** Check admin auth — returns error Response or null if OK */\nfunction requireAdmin(event, requestId) {\n\tif (!getUiLoginPassword()) return errorResponse(503, \"admin_not_configured\", \"OP_UI_LOGIN_PASSWORD has not been set. Complete setup first.\", {}, requestId);\n\tif (!validateSession(extractToken(event))) return errorResponse(401, \"unauthorized\", \"Missing or invalid credentials\", {}, requestId);\n\treturn null;\n}\n/**\n* Identify caller by the presented `op_session` cookie.\n*\n* Returns \"admin\" when the cookie holds a valid session token.\n*/\nfunction identifyCallerByToken(event) {\n\tif (!getUiLoginPassword()) return null;\n\tif (validateSession(extractToken(event))) return \"admin\";\n\treturn null;\n}\n/** Parse JSON body safely — returns discriminated result with error type */\nasync function parseJsonBody(request, maxBytes = 1048576) {\n\ttry {\n\t\tconst contentLength = request.headers.get(\"content-length\");\n\t\tif (contentLength && parseInt(contentLength, 10) > maxBytes) return { error: \"too_large\" };\n\t\treturn { data: await request.json() };\n\t} catch (e) {\n\t\tconsole.warn(\"[helpers] Failed to parse JSON request body\", e);\n\t\treturn { error: \"invalid_json\" };\n\t}\n}\n/** Convert a ParseJsonBodyError to an appropriate HTTP error response */\nfunction jsonBodyError(err, requestId) {\n\tif (err.error === \"too_large\") return errorResponse(413, \"too_large\", \"Request body too large\", {}, requestId);\n\treturn errorResponse(400, \"invalid_json\", \"Request body must be valid JSON\", {}, requestId);\n}\n/**\n* Auth + JSON body wrapper for admin POST/DELETE handlers.\n*\n* Replaces the 4-line boilerplate copy-pasted across 30+ routes:\n*   const requestId = getRequestId(event);\n*   const authError = requireAdmin(event, requestId);\n*   if (authError) return authError;\n*   const result = await parseJsonBody(event.request);\n*   if ('error' in result) return jsonBodyError(result, requestId);\n*\n* Use for routes that need both auth and a JSON body. For auth-only or\n* GET routes, call `requireAdmin` directly.\n*/\nasync function withAdminBody(event, handler) {\n\tconst requestId = getRequestId(event);\n\tconst originError = checkOriginHeader(event.request, UI_PORT);\n\tif (originError) return originError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst result = await parseJsonBody(event.request);\n\tif (\"error\" in result) return jsonBodyError(result, requestId);\n\treturn handler({\n\t\trequestId,\n\t\tbody: result.data\n\t});\n}\n/**\n* Reject requests whose Host header does not match localhost or 127.0.0.1\n* on the configured admin port.\n*\n* @param request  Incoming Request (or SvelteKit RequestEvent.request)\n* @param port     The port this server is bound to (e.g. 3880 or 8100)\n* @returns        A 400 Response if the host is rejected; null if allowed\n*/\nfunction checkHostHeader(request, port) {\n\tconst normalized = (request.headers.get(\"host\") ?? \"\").trim().replace(/\\.$/, \"\");\n\tif ([`localhost:${port}`, `127.0.0.1:${port}`].includes(normalized)) return null;\n\treturn new Response(JSON.stringify({\n\t\terror: \"invalid_host\",\n\t\thost: normalized,\n\t\tmessage: \"Request rejected: Host header does not match allowed hosts. The admin UI binds to loopback (127.0.0.1) only; reach it via localhost or front it with a reverse proxy/tunnel for remote access.\"\n\t}), {\n\t\tstatus: 400,\n\t\theaders: { \"content-type\": \"application/json\" }\n\t});\n}\n/**\n* Reject POST/PUT/DELETE requests whose Origin header does not match\n* localhost or 127.0.0.1. Requests with no Origin (non-browser clients)\n* are always allowed.\n*\n* @param request  Incoming Request\n* @param port     The port this server is bound to\n* @returns        A 403 Response if the origin is rejected; null if allowed\n*/\nfunction checkOriginHeader(request, port) {\n\tconst method = request.method.toUpperCase();\n\tif (method === \"GET\" || method === \"HEAD\" || method === \"OPTIONS\") return null;\n\tconst origin = request.headers.get(\"origin\");\n\tif (!origin) return null;\n\ttry {\n\t\tconst u = new URL(origin);\n\t\tif ([`localhost:${port}`, `127.0.0.1:${port}`].includes(u.host)) return null;\n\t} catch {}\n\treturn new Response(JSON.stringify({\n\t\terror: \"forbidden_origin\",\n\t\torigin\n\t}), {\n\t\tstatus: 403,\n\t\theaders: { \"content-type\": \"application/json\" }\n\t});\n}\nvar UI_PORT = Number(process.env.PORT ?? 3880);\n//#endregion\nexport { invalidateSession as _, getOpenCodeClient as a, jsonBodyError as c, requireAdmin as d, safeTokenCompare as f, getUiLoginPassword as g, createSession as h, errorResponse as i, jsonResponse as l, SESSION_TTL_SECONDS as m, checkHostHeader as n, getRequestId as o, withAdminBody as p, checkOriginHeader as r, identifyCallerByToken as s, UI_PORT as t, parseJsonBody as u, touchSession as v };\n"],"names":[],"mappings":";;;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,cAAc,GAAG,OAAO;AAC5B;AACG,IAAC,mBAAmB,GAAG,cAAc,GAAG;AAC3C,IAAI,QAAQ,mBAAmB,IAAI,GAAG,EAAE;AACxC,IAAI,cAAc,mBAAmB,IAAI,GAAG,EAAE;AAC9C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,GAAG;AAC9B,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB;AAClD,CAAC,IAAI,QAAQ,EAAE,OAAO,QAAQ;AAC9B,CAAC,OAAO,UAAU,CAAC,eAAe,EAAE,EAAE,sBAAsB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;AAC9E;AACA;AACA,SAAS,SAAS,CAAC,SAAS,EAAE;AAC9B,CAAC,MAAM,MAAM,GAAG,kBAAkB,EAAE;AACpC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI;AACzB,CAAC,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;AAC5E;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc;AAC9C,CAAC,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC;AACjC,CAAC,IAAI,GAAG,KAAK,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC;AAChG,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7B;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,KAAK,EAAE;AAChC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,KAAK;AACzB,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,IAAI;AAC3C,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK;AACtC,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC;AACnC,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,OAAO,KAAK;AAC1B,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,EAAE,OAAO,KAAK;AACzE,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;AACjC,CAAC,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC;AACtC,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,OAAO,KAAK;AACpC,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,OAAO,KAAK;AACjD,CAAC,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAChE;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK;AAC1C,CAAC,OAAO,aAAa,EAAE;AACvB;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;AACvB,CAAC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE;AACjC,EAAE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;AACtE,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;AAC/E,CAAC;AACD,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;AACpB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,eAAe;AACnB,IAAI,kBAAkB;AACtB,SAAS,iBAAiB,GAAG;AAC7B,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,iBAAiB,EAAE;AACpC,CAAC,IAAI,CAAC,eAAe,IAAI,GAAG,KAAK,kBAAkB,EAAE;AACrD,EAAE,eAAe,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC1D,EAAE,kBAAkB,GAAG,GAAG;AAC1B,CAAC;AACD,CAAC,OAAO,eAAe;AACvB;AACA,SAAS,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE;AAChC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,OAAO,KAAK;AACjE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,KAAK;AAC3B,CAAC,OAAO,eAAe,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AACzG;AACA;AACA,SAAS,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,EAAE,EAAE;AACpD,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;AAC3C,EAAE,MAAM;AACR,EAAE,OAAO,EAAE;AACX,GAAG,cAAc,EAAE,kBAAkB;AACrC,GAAG,GAAG,SAAS,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG;AAClD;AACA,EAAE,CAAC;AACH;AACA;AACA,SAAS,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,EAAE;AAC7E,CAAC,OAAO,YAAY,CAAC,MAAM,EAAE;AAC7B,EAAE,KAAK;AACP,EAAE,OAAO;AACT,EAAE,OAAO;AACT,EAAE;AACF,EAAE,EAAE,SAAS,CAAC;AACd;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE;AACxE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,8BAA8B,CAAC;AAChG,CAAC,IAAI,KAAK,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC;AAC3B,CAAC,OAAO,EAAE;AACV;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE;AACxC,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,sBAAsB,EAAE,8DAA8D,EAAE,EAAE,EAAE,SAAS,CAAC;AAC5J,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,gCAAgC,EAAE,EAAE,EAAE,SAAS,CAAC;AACtI,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,KAAK,EAAE;AACtC,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,OAAO,IAAI;AACvC,CAAC,IAAI,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,OAAO;AACzD,CAAC,OAAO,IAAI;AACZ;AACA;AACA,eAAe,aAAa,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,EAAE;AAC1D,CAAC,IAAI;AACL,EAAE,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;AAC7D,EAAE,IAAI,aAAa,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE;AAC5F,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE;AACvC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,CAAC,IAAI,CAAC,6CAA6C,EAAE,CAAC,CAAC;AAChE,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE;AAClC,CAAC;AACD;AACA;AACA,SAAS,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE;AACvC,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,EAAE,EAAE,SAAS,CAAC;AAC/G,CAAC,OAAO,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,iCAAiC,EAAE,EAAE,EAAE,SAAS,CAAC;AAC5F;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC;AAC9D,CAAC,IAAI,WAAW,EAAE,OAAO,WAAW;AACpC,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;AAClD,CAAC,IAAI,OAAO,IAAI,MAAM,EAAE,OAAO,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC;AAC/D,CAAC,OAAO,OAAO,CAAC;AAChB,EAAE,SAAS;AACX,EAAE,IAAI,EAAE,MAAM,CAAC;AACf,EAAE,CAAC;AACH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE;AACxC,CAAC,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AACjF,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,IAAI;AACjF,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AACpC,EAAE,KAAK,EAAE,cAAc;AACvB,EAAE,IAAI,EAAE,UAAU;AAClB,EAAE,OAAO,EAAE;AACX,EAAE,CAAC,EAAE;AACL,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AAC/C,EAAE,CAAC;AACH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE;AAC1C,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;AAC5C,CAAC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,OAAO,IAAI;AAC/E,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC7C,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI;AACzB,CAAC,IAAI;AACL,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC;AAC3B,EAAE,IAAI,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AAC9E,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AACpC,EAAE,KAAK,EAAE,kBAAkB;AAC3B,EAAE;AACF,EAAE,CAAC,EAAE;AACL,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AAC/C,EAAE,CAAC;AACH;AACG,IAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI;;;;"}

package/build/server/chunks/{hooks.server-UooxK5Hq.js → hooks.server-BjQOtOyj.js}

@@ -1,10 +1,10 @@
 import { r as redirect } from './exports-D1quPX8S.js';
-import { ak as isSetupComplete, aU as resolveStackDir, q as classifyLocalInstall, v as composePs, m as buildComposeOptions, L as deriveLaunchStatus, S as detectRuntime, N as deriveLocalStackState, r as collectBindAddressWarnings, X as ensureHomeDirs, a0 as ensureSecrets, aB as readSecret, aF as readStackRuntimeEnv, Z as ensureOpenCodeConfig, _ as ensureOpenCodeSystemConfig, aT as resolveRuntimeFiles, b4 as writeRuntimeFiles, G as createLogger } from './src-BrowG4c5.js';
-import { g as getState } from './state-uRAQa1hp.js';
-import { b as listRemoteStatuses } from './endpoints-DIQ-qrrL.js';
-import { c as checkHostHeader, a as checkOriginHeader, i as identifyCallerByToken, t as touchSession, U as UI_PORT } from './helpers-TBhHA7BL.js';
-import { S as SESSION_COOKIE_NAME, s as sessionCookieHeader } from './session-cookie-BJaAqVXS.js';
-import { i as isMigrationBlocking } from './migration-status-cTKFvPYd.js';
+import { am as isSetupComplete, aZ as resolveStackDir, r as classifyLocalInstall, w as composePs, n as buildComposeOptions, N as deriveLaunchStatus, T as detectRuntime, O as deriveLocalStackState, s as collectBindAddressWarnings, Y as ensureHomeDirs, a1 as ensureSecrets, aF as readSecret, aJ as readStackRuntimeEnv, _ as ensureOpenCodeConfig, $ as ensureOpenCodeSystemConfig, aY as resolveRuntimeFiles, b9 as writeRuntimeFiles, H as createLogger } from './src-CidJbygh.js';
+import { g as getState } from './state-fxN45gBp.js';
+import { b as listRemoteStatuses } from './endpoints-UdQGgKsR.js';
+import { c as checkHostHeader, a as checkOriginHeader, i as identifyCallerByToken, t as touchSession, U as UI_PORT } from './helpers-kzwksNq1.js';
+import { S as SESSION_COOKIE_NAME, s as sessionCookieHeader } from './session-cookie-CHgIES2p.js';
+import { i as isMigrationBlocking } from './migration-status-a9KsTKSo.js';
 import './utils-BSRjJDrZ.js';
 import './chunk-CLZ62Ad-.js';
 import 'node:module';
@@ -159,4 +159,4 @@ var handle = async ({ event, resolve }) => {
 };
 
 export { _resetLaunchCache, handle };
-//# sourceMappingURL=hooks.server-UooxK5Hq.js.map
+//# sourceMappingURL=hooks.server-BjQOtOyj.js.map

package/build/server/chunks/hooks.server-BjQOtOyj.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.server-BjQOtOyj.js","sources":["../../../.svelte-kit/adapter-node/entries/hooks.server.js"],"sourcesContent":["import { i as redirect } from \"../chunks/exports.js\";\nimport { Bt as resolveRuntimeFiles, Ht as ensureOpenCodeConfig, Kt as readStackRuntimeEnv, Tn as createLogger, Ut as ensureSecrets, Vt as writeRuntimeFiles, Zt as readSecret, in as ensureHomeDirs, it as detectRuntime, nt as deriveLaunchStatus, on as resolveStackDir, rn as ensureOpenCodeSystemConfig, rt as deriveLocalStackState, t as collectBindAddressWarnings, tt as classifyLocalInstall, ut as composePs, yt as isSetupComplete, z as buildComposeOptions } from \"../chunks/src.js\";\nimport { t as getState } from \"../chunks/state.js\";\nimport { a as listRemoteStatuses } from \"../chunks/endpoints.js\";\nimport { n as checkHostHeader, r as checkOriginHeader, s as identifyCallerByToken, t as UI_PORT, v as touchSession } from \"../chunks/helpers.js\";\nimport { r as sessionCookieHeader, t as SESSION_COOKIE_NAME } from \"../chunks/session-cookie.js\";\nimport { n as isMigrationBlocking } from \"../chunks/migration-status.js\";\n//#region src/hooks.server.ts\nvar logger = createLogger(\"admin\");\nvar startupApplyDone = false;\nvar setupCompleteMemo = false;\nvar localStatusCache = null;\n/** Test-only: clear the 5s launch-routing cache so each test resolves fresh. */\nfunction _resetLaunchCache() {\n\tlocalStatusCache = null;\n}\nfunction runStartupApply() {\n\tif (startupApplyDone) return;\n\tstartupApplyDone = true;\n\tfor (const line of collectBindAddressWarnings(process.env)) logger.warn(line);\n\ttry {\n\t\tensureHomeDirs();\n\t\tconst state = getState();\n\t\tensureSecrets(state);\n\t\tif (!process.env.OP_UI_LOGIN_PASSWORD) {\n\t\t\tconst pw = readSecret(state.stackDir, \"op_ui_login_password\");\n\t\t\tif (pw) process.env.OP_UI_LOGIN_PASSWORD = pw.trimEnd();\n\t\t}\n\t\tconst stackVars = readStackRuntimeEnv(state.stackDir);\n\t\tfor (const [k, v] of Object.entries(stackVars)) if (v && !process.env[k]) process.env[k] = v;\n\t\tensureOpenCodeConfig();\n\t\tensureOpenCodeSystemConfig();\n\t\tstate.artifacts = resolveRuntimeFiles();\n\t\twriteRuntimeFiles(state);\n\t\tlogger.info(\"startup auto-apply completed successfully\", { artifactMeta: state.artifactMeta });\n\t} catch (err) {\n\t\tlogger.error(\"startup auto-apply failed\", { error: String(err) });\n\t}\n}\nrunStartupApply();\nvar SETUP_PATHS = [\n\t\"/setup\",\n\t\"/api/setup\",\n\t\"/health\",\n\t\"/guardian/health\"\n];\nfunction isLocalhostAddress(ip) {\n\treturn ip === \"127.0.0.1\" || ip === \"::1\" || ip === \"::ffff:127.0.0.1\";\n}\nfunction parseComposePsServices(stdout) {\n\tconst services = [];\n\tfor (const line of stdout.split(\"\\n\")) {\n\t\tconst trimmed = line.trim();\n\t\tif (!trimmed) continue;\n\t\ttry {\n\t\t\tconst parsed = JSON.parse(trimmed);\n\t\t\tservices.push({\n\t\t\t\tservice: String(parsed.Service ?? parsed.Name ?? \"\"),\n\t\t\t\tstate: String(parsed.State ?? \"\"),\n\t\t\t\thealth: String(parsed.Health ?? \"\")\n\t\t\t});\n\t\t} catch {\n\t\t\tcontinue;\n\t\t}\n\t}\n\treturn services;\n}\nasync function resolveLaunchRouting() {\n\tif (localStatusCache && localStatusCache.expiresAt > Date.now()) return localStatusCache.value;\n\tconst state = getState();\n\tconst installState = classifyLocalInstall(state.stackDir);\n\tconst composeResult = await composePs(buildComposeOptions(state));\n\tconst value = {\n\t\tinstallState,\n\t\tlaunch: deriveLaunchStatus({\n\t\t\tlocal: {\n\t\t\t\tstate: deriveLocalStackState(installState, composeResult.ok ? parseComposePsServices(composeResult.stdout) : []),\n\t\t\t\truntime: installState === \"not_installed\" ? await detectRuntime() : void 0,\n\t\t\t\tdetail: { installState }\n\t\t\t},\n\t\t\tremotes: await listRemoteStatuses()\n\t\t}),\n\t\tmigrationBlocking: isMigrationBlocking(state.homeDir)\n\t};\n\tlocalStatusCache = {\n\t\tvalue,\n\t\texpiresAt: Date.now() + 5e3\n\t};\n\treturn value;\n}\nvar handle = async ({ event, resolve }) => {\n\tconst hostError = checkHostHeader(event.request, UI_PORT);\n\tif (hostError) return hostError;\n\tconst originError = checkOriginHeader(event.request, UI_PORT);\n\tif (originError) return originError;\n\tconst path = event.url.pathname;\n\tconst isSetupPath = SETUP_PATHS.some((p) => path === p || path.startsWith(p + \"/\"));\n\tconst setupComplete = setupCompleteMemo || isSetupComplete(resolveStackDir());\n\tif (setupComplete) setupCompleteMemo = true;\n\tif (isSetupPath && !setupComplete) {\n\t\tif (!isLocalhostAddress(event.getClientAddress())) return new Response(JSON.stringify({\n\t\t\terror: \"setup_localhost_only\",\n\t\t\tmessage: \"Setup is only accessible from the host machine until installation is complete.\"\n\t\t}), {\n\t\t\tstatus: 403,\n\t\t\theaders: { \"content-type\": \"application/json\" }\n\t\t});\n\t}\n\tif (!isSetupPath) {\n\t\tconst { installState, launch, migrationBlocking } = await resolveLaunchRouting();\n\t\tconst desiredPath = migrationBlocking ? \"/splash\" : installState === \"setup_incomplete\" && launch.local.state === \"running\" ? \"/splash\" : launch.recommendedRoute === \"chat\" ? \"/chat\" : \"/splash\";\n\t\tconst usageRoute = path.startsWith(\"/chat\") || path.startsWith(\"/advanced\");\n\t\tconst exempt = path.startsWith(\"/api/\") || path.startsWith(\"/proxy/\") || path.startsWith(\"/login\") || path.startsWith(\"/health\") || path.startsWith(\"/guardian/health\") || path.startsWith(\"/admin\") || path.startsWith(\"/splash\") || !migrationBlocking && usageRoute;\n\t\tif (path === \"/\" || path !== desiredPath && !exempt) redirect(302, desiredPath);\n\t}\n\tevent.locals.role = identifyCallerByToken(event);\n\tlet renewedCookie = null;\n\tif (event.locals.role === \"admin\") {\n\t\tconst match = (event.request.headers.get(\"cookie\") ?? \"\").match(new RegExp(`(?:^|;\\\\s*)${SESSION_COOKIE_NAME}=([^;]+)`));\n\t\tconst renewed = match ? touchSession(match[1]) : false;\n\t\tif (renewed) renewedCookie = sessionCookieHeader(renewed, event.request);\n\t}\n\tconst isAuthPath = path === \"/login\" || path.startsWith(\"/login/\");\n\tif (event.request.method === \"GET\" && (event.request.headers.get(\"accept\") ?? \"\").includes(\"text/html\") && !event.locals.role && !isSetupPath && !isAuthPath) {\n\t\tconst redirectTo = path + event.url.search;\n\t\tredirect(302, `/login?redirectTo=${encodeURIComponent(redirectTo)}`);\n\t}\n\tconst response = await resolve(event);\n\tif (renewedCookie) {\n\t\tif (!(response.headers.get(\"set-cookie\") ?? \"\").includes(`op_session=`)) response.headers.append(\"set-cookie\", renewedCookie);\n\t}\n\tresponse.headers.set(\"X-Frame-Options\", path === \"/admin/akm/health-report\" ? \"SAMEORIGIN\" : \"DENY\");\n\tresponse.headers.set(\"X-Content-Type-Options\", \"nosniff\");\n\tresponse.headers.set(\"Referrer-Policy\", \"no-referrer\");\n\treturn response;\n};\n//#endregion\nexport { _resetLaunchCache, handle };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOA;AACA,IAAI,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC;AAClC,IAAI,gBAAgB,GAAG,KAAK;AAC5B,IAAI,iBAAiB,GAAG,KAAK;AAC7B,IAAI,gBAAgB,GAAG,IAAI;AAC3B;AACA,SAAS,iBAAiB,GAAG;AAC7B,CAAC,gBAAgB,GAAG,IAAI;AACxB;AACA,SAAS,eAAe,GAAG;AAC3B,CAAC,IAAI,gBAAgB,EAAE;AACvB,CAAC,gBAAgB,GAAG,IAAI;AACxB,CAAC,KAAK,MAAM,IAAI,IAAI,0BAA0B,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;AAC9E,CAAC,IAAI;AACL,EAAE,cAAc,EAAE;AAClB,EAAE,MAAM,KAAK,GAAG,QAAQ,EAAE;AAC1B,EAAE,aAAa,CAAC,KAAK,CAAC;AACtB,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE;AACzC,GAAG,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,sBAAsB,CAAC;AAChE,GAAG,IAAI,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,EAAE,CAAC,OAAO,EAAE;AAC1D,EAAE;AACF,EAAE,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC;AACvD,EAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC9F,EAAE,oBAAoB,EAAE;AACxB,EAAE,0BAA0B,EAAE;AAC9B,EAAE,KAAK,CAAC,SAAS,GAAG,mBAAmB,EAAE;AACzC,EAAE,iBAAiB,CAAC,KAAK,CAAC;AAC1B,EAAE,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;AAChG,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AACnE,CAAC;AACD;AACA,eAAe,EAAE;AACjB,IAAI,WAAW,GAAG;AAClB,CAAC,QAAQ;AACT,CAAC,YAAY;AACb,CAAC,SAAS;AACV,CAAC;AACD,CAAC;AACD,SAAS,kBAAkB,CAAC,EAAE,EAAE;AAChC,CAAC,OAAO,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,kBAAkB;AACvE;AACA,SAAS,sBAAsB,CAAC,MAAM,EAAE;AACxC,CAAC,MAAM,QAAQ,GAAG,EAAE;AACpB,CAAC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;AACxC,EAAE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE;AAC7B,EAAE,IAAI,CAAC,OAAO,EAAE;AAChB,EAAE,IAAI;AACN,GAAG,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;AACrC,GAAG,QAAQ,CAAC,IAAI,CAAC;AACjB,IAAI,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;AACxD,IAAI,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;AACrC,IAAI,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE;AACtC,IAAI,CAAC;AACL,EAAE,CAAC,CAAC,MAAM;AACV,GAAG;AACH,EAAE;AACF,CAAC;AACD,CAAC,OAAO,QAAQ;AAChB;AACA,eAAe,oBAAoB,GAAG;AACtC,CAAC,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,gBAAgB,CAAC,KAAK;AAC/F,CAAC,MAAM,KAAK,GAAG,QAAQ,EAAE;AACzB,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC;AAC1D,CAAC,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,YAAY;AACd,EAAE,MAAM,EAAE,kBAAkB,CAAC;AAC7B,GAAG,KAAK,EAAE;AACV,IAAI,KAAK,EAAE,qBAAqB,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE,GAAG,sBAAsB,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;AACpH,IAAI,OAAO,EAAE,YAAY,KAAK,eAAe,GAAG,MAAM,aAAa,EAAE,GAAG,MAAM;AAC9E,IAAI,MAAM,EAAE,EAAE,YAAY;AAC1B,IAAI;AACJ,GAAG,OAAO,EAAE,MAAM,kBAAkB;AACpC,GAAG,CAAC;AACJ,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO;AACtD,EAAE;AACF,CAAC,gBAAgB,GAAG;AACpB,EAAE,KAAK;AACP,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG;AAC1B,EAAE;AACF,CAAC,OAAO,KAAK;AACb;AACG,IAAC,MAAM,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AAC3C,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC;AAC1D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC;AAC9D,CAAC,IAAI,WAAW,EAAE,OAAO,WAAW;AACpC,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ;AAChC,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;AACpF,CAAC,MAAM,aAAa,GAAG,iBAAiB,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;AAC9E,CAAC,IAAI,aAAa,EAAE,iBAAiB,GAAG,IAAI;AAC5C,CAAC,IAAI,WAAW,IAAI,CAAC,aAAa,EAAE;AACpC,EAAE,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AACxF,GAAG,KAAK,EAAE,sBAAsB;AAChC,GAAG,OAAO,EAAE;AACZ,GAAG,CAAC,EAAE;AACN,GAAG,MAAM,EAAE,GAAG;AACd,GAAG,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AAChD,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,IAAI,CAAC,WAAW,EAAE;AACnB,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,oBAAoB,EAAE;AAClF,EAAE,MAAM,WAAW,GAAG,iBAAiB,GAAG,SAAS,GAAG,YAAY,KAAK,kBAAkB,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,gBAAgB,KAAK,MAAM,GAAG,OAAO,GAAG,SAAS;AACpM,EAAE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;AAC7E,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,IAAI,UAAU;AACxQ,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,WAAW,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;AACjF,CAAC;AACD,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC;AACjD,CAAC,IAAI,aAAa,GAAG,IAAI;AACzB,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE;AACpC,EAAE,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1H,EAAE,MAAM,OAAO,GAAG,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK;AACxD,EAAE,IAAI,OAAO,EAAE,aAAa,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;AAC1E,CAAC;AACD,CAAC,MAAM,UAAU,GAAG,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;AACnE,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,EAAE;AAC/J,EAAE,MAAM,UAAU,GAAG,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM;AAC5C,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AACD,CAAC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC;AACtC,CAAC,IAAI,aAAa,EAAE;AACpB,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC;AAC/H,CAAC;AACD,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,KAAK,0BAA0B,GAAG,YAAY,GAAG,MAAM,CAAC;AACrG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC;AAC1D,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC;AACvD,CAAC,OAAO,QAAQ;AAChB;;;;"}

package/build/server/chunks/{http-D1XmiUzn.js → http-D8YVIqJa.js}

@@ -1,4 +1,4 @@
-import { g as getActiveEndpoint } from './endpoints-DIQ-qrrL.js';
+import { g as getActiveEndpoint } from './endpoints-UdQGgKsR.js';
 
 //#region src/lib/server/opencode/http.ts
 /**
@@ -28,4 +28,4 @@ async function opencodeFetch(path, init) {
 }
 
 export { opencodeFetch as o };
-//# sourceMappingURL=http-D1XmiUzn.js.map
+//# sourceMappingURL=http-D8YVIqJa.js.map

package/build/server/chunks/{http-D1XmiUzn.js.map → http-D8YVIqJa.js.map}

@@ -1 +1 @@
-{"version":3,"file":"http-D1XmiUzn.js","sources":["../../../.svelte-kit/adapter-node/chunks/http.js"],"sourcesContent":["import { r as getActiveEndpoint } from \"./endpoints.js\";\n//#region src/lib/server/opencode/http.ts\n/**\n* HTTP transport for talking to the active OpenCode endpoint.\n*\n* Used by sibling modules (`config.ts`, `catalog.ts`) — not part of the\n* public API of `$lib/server/opencode`. Reads the active endpoint per-call\n* so user switches in the UI take effect immediately.\n*/\nasync function opencodeFetch(path, init) {\n\tconst endpoint = getActiveEndpoint();\n\tconst headers = {\n\t\t\"content-type\": \"application/json\",\n\t\t...init?.headers\n\t};\n\tif (endpoint.password) {\n\t\tconst user = endpoint.username || \"openpalm\";\n\t\theaders[\"authorization\"] = `Basic ${btoa(`${user}:${endpoint.password}`)}`;\n\t}\n\tconst response = await fetch(`${endpoint.url}${path}`, {\n\t\t...init,\n\t\theaders\n\t});\n\tif (!response.ok) throw new Error(`${init?.method ?? \"GET\"} ${path} failed with ${response.status}`);\n\tif (response.status === 204) return;\n\treturn await response.json();\n}\n//#endregion\nexport { opencodeFetch as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE;AACzC,CAAC,MAAM,QAAQ,GAAG,iBAAiB,EAAE;AACrC,CAAC,MAAM,OAAO,GAAG;AACjB,EAAE,cAAc,EAAE,kBAAkB;AACpC,EAAE,GAAG,IAAI,EAAE;AACX,EAAE;AACF,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE;AACxB,EAAE,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,IAAI,UAAU;AAC9C,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AACD,CAAC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE;AACxD,EAAE,GAAG,IAAI;AACT,EAAE;AACF,EAAE,CAAC;AACH,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACrG,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE;AAC9B,CAAC,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE;AAC7B;;;;"}
+{"version":3,"file":"http-D8YVIqJa.js","sources":["../../../.svelte-kit/adapter-node/chunks/http.js"],"sourcesContent":["import { r as getActiveEndpoint } from \"./endpoints.js\";\n//#region src/lib/server/opencode/http.ts\n/**\n* HTTP transport for talking to the active OpenCode endpoint.\n*\n* Used by sibling modules (`config.ts`, `catalog.ts`) — not part of the\n* public API of `$lib/server/opencode`. Reads the active endpoint per-call\n* so user switches in the UI take effect immediately.\n*/\nasync function opencodeFetch(path, init) {\n\tconst endpoint = getActiveEndpoint();\n\tconst headers = {\n\t\t\"content-type\": \"application/json\",\n\t\t...init?.headers\n\t};\n\tif (endpoint.password) {\n\t\tconst user = endpoint.username || \"openpalm\";\n\t\theaders[\"authorization\"] = `Basic ${btoa(`${user}:${endpoint.password}`)}`;\n\t}\n\tconst response = await fetch(`${endpoint.url}${path}`, {\n\t\t...init,\n\t\theaders\n\t});\n\tif (!response.ok) throw new Error(`${init?.method ?? \"GET\"} ${path} failed with ${response.status}`);\n\tif (response.status === 204) return;\n\treturn await response.json();\n}\n//#endregion\nexport { opencodeFetch as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE;AACzC,CAAC,MAAM,QAAQ,GAAG,iBAAiB,EAAE;AACrC,CAAC,MAAM,OAAO,GAAG;AACjB,EAAE,cAAc,EAAE,kBAAkB;AACpC,EAAE,GAAG,IAAI,EAAE;AACX,EAAE;AACF,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE;AACxB,EAAE,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,IAAI,UAAU;AAC9C,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AACD,CAAC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE;AACxD,EAAE,GAAG,IAAI;AACT,EAAE;AACF,EAAE,CAAC;AACH,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACrG,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE;AAC9B,CAAC,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE;AAC7B;;;;"}

package/build/server/chunks/{internal-DYjrNs__.js → internal-DQFuMtuQ.js}

@@ -1518,7 +1518,7 @@ var options = {
 		app: ({ head, body, assets, nonce, env }) => "<!doctype html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n    <meta name=\"theme-color\" content=\"#ffffff\" />\n    <meta name=\"color-scheme\" content=\"light\" />\n    <script>\n      (() => {\n        const storageKey = 'openpalm.theme';\n        const darkThemeColor = '#161c22';\n        const lightThemeColor = '#f9fafb';\n\n        try {\n          const stored = window.localStorage.getItem(storageKey);\n          const preference = stored === 'light' || stored === 'dark' || stored === 'system' ? stored : 'system';\n          const resolved = preference === 'system'\n            ? (window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light')\n            : preference;\n          const root = document.documentElement;\n          root.setAttribute('data-theme', resolved);\n          root.style.colorScheme = resolved;\n\n          const themeColorMeta = document.querySelector('meta[name=\"theme-color\"]');\n          if (themeColorMeta) {\n            themeColorMeta.setAttribute('content', resolved === 'dark' ? darkThemeColor : lightThemeColor);\n          }\n\n          const colorSchemeMeta = document.querySelector('meta[name=\"color-scheme\"]');\n          if (colorSchemeMeta) {\n            colorSchemeMeta.setAttribute('content', resolved);\n          }\n        } catch {\n          // Keep the default light metadata if storage access is unavailable.\n        }\n      })();\n    <\/script>\n    <link rel=\"preconnect\" href=\"https://fonts.googleapis.com\" />\n    <link rel=\"preconnect\" href=\"https://fonts.gstatic.com\" crossorigin />\n    <link\n      href=\"https://fonts.googleapis.com/css2?family=Source+Sans+3:wght@400;500;600;700&family=IBM+Plex+Mono:wght@400;500&display=swap\"\n      rel=\"stylesheet\"\n    />\n    " + head + "\n  </head>\n  <body data-sveltekit-preload-data=\"hover\">\n    <div style=\"display: contents\">" + body + "</div>\n  </body>\n</html>\n",
 		error: ({ status, message }) => "<!doctype html>\n<html lang=\"en\">\n	<head>\n		<meta charset=\"utf-8\" />\n		<title>" + message + "</title>\n\n		<style>\n			body {\n				--bg: white;\n				--fg: #222;\n				--divider: #ccc;\n				background: var(--bg);\n				color: var(--fg);\n				font-family:\n					system-ui,\n					-apple-system,\n					BlinkMacSystemFont,\n					'Segoe UI',\n					Roboto,\n					Oxygen,\n					Ubuntu,\n					Cantarell,\n					'Open Sans',\n					'Helvetica Neue',\n					sans-serif;\n				display: flex;\n				align-items: center;\n				justify-content: center;\n				height: 100vh;\n				margin: 0;\n			}\n\n			.error {\n				display: flex;\n				align-items: center;\n				max-width: 32rem;\n				margin: 0 1rem;\n			}\n\n			.status {\n				font-weight: 200;\n				font-size: 3rem;\n				line-height: 1;\n				position: relative;\n				top: -0.05rem;\n			}\n\n			.message {\n				border-left: 1px solid var(--divider);\n				padding: 0 0 0 1rem;\n				margin: 0 0 0 1rem;\n				min-height: 2.5rem;\n				display: flex;\n				align-items: center;\n			}\n\n			.message h1 {\n				font-weight: 400;\n				font-size: 1em;\n				margin: 0;\n			}\n\n			@media (prefers-color-scheme: dark) {\n				body {\n					--bg: #222;\n					--fg: #ddd;\n					--divider: #666;\n				}\n			}\n		</style>\n	</head>\n	<body>\n		<div class=\"error\">\n			<span class=\"status\">" + status + "</span>\n			<div class=\"message\">\n				<h1>" + message + "</h1>\n			</div>\n		</div>\n	</body>\n</html>\n"
 	},
-	version_hash: "4vip9y"
+	version_hash: "1bildys"
 };
 async function get_hooks() {
 	let handle;
@@ -1526,7 +1526,7 @@ async function get_hooks() {
 	let handleError;
 	let handleValidationError;
 	let init;
-	({handle, handleFetch, handleError, handleValidationError, init} = await import('./hooks.server-UooxK5Hq.js'));
+	({handle, handleFetch, handleError, handleValidationError, init} = await import('./hooks.server-BjQOtOyj.js'));
 	let reroute;
 	let transport;
 	return {
@@ -1541,4 +1541,4 @@ async function get_hooks() {
 }
 
 export { stringify$1 as A, validate_layout_exports as B, validate_layout_server_exports as C, validate_page_exports as D, validate_page_server_exports as E, with_request_store as F, INVALIDATED_PARAM as I, NULL_BODY_STATUS as N, TRAILING_SLASH_PARAM as T, IN_WEBCONTAINER as a, compact as b, coalesce_to_error as c, create_remote_key as d, decode_pathname as e, disable_search as f, find_route as g, get_hooks as h, get_message as i, get_status as j, hash as k, merge_tracing as l, make_trackable as m, noop as n, noop_span as o, normalize_error as p, normalize_path as q, once as r, options as s, parse as t, parse_remote_arg as u, read_implementation as v, resolve as w, set_read_implementation as x, split_remote_key as y, stringify as z };
-//# sourceMappingURL=internal-DYjrNs__.js.map
+//# sourceMappingURL=internal-DQFuMtuQ.js.map