@openpalm/ui 0.12.51 → 0.13.0-beta.1

package/build/server/chunks/_server.ts-C5NMGLvR.js

@@ -0,0 +1,68 @@
+import { X as dismissSecretStripNotice, aD as readSecretStripNotice, G as createLogger } from './src-CS2sSYOR.js';
+import { g as getState } from './state-BRh7vs9j.js';
+import { d as getRequestId, l as requireCapability, r as requireAdmin, k as jsonResponse, e as errorResponse } from './helpers-7BvhniSt.js';
+import './provider-constants-1s1k8kbj.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:fs';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+import './endpoints-CU3ehglV.js';
+import './features-DLGlNjZX.js';
+
+//#region src/routes/api/host/secret-notice/+server.ts
+var logger = createLogger("secret-notice");
+/**
+* #502 — one-time notice that secret-looking keys were removed from stack.env.
+* The strip itself is correct per the secret-boundary contract; this surfaces
+* it so the user knows where their value went and how to re-add it.
+*/
+var GET = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:secrets", requestId);
+	if (capabilityError) return capabilityError;
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	const state = getState();
+	try {
+		return jsonResponse(200, {
+			ok: true,
+			notice: readSecretStripNotice(state)
+		}, requestId);
+	} catch (e) {
+		return errorResponse(500, "secret_notice_failed", e instanceof Error ? e.message : String(e), {}, requestId);
+	}
+};
+/** Dismiss the one-time notice. */
+var DELETE = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:secrets", requestId);
+	if (capabilityError) return capabilityError;
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	const state = getState();
+	try {
+		dismissSecretStripNotice(state);
+		logger.info("secret-strip notice dismissed", { requestId });
+		return jsonResponse(200, { ok: true }, requestId);
+	} catch (e) {
+		return errorResponse(500, "secret_notice_dismiss_failed", e instanceof Error ? e.message : String(e), {}, requestId);
+	}
+};
+
+export { DELETE, GET };
+//# sourceMappingURL=_server.ts-C5NMGLvR.js.map

package/build/server/chunks/_server.ts-C5NMGLvR.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-C5NMGLvR.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/host/secret-notice/_server.ts.js"],"sourcesContent":["import { N as dismissSecretStripNotice, Nt as createLogger, P as readSecretStripNotice } from \"../../../../../chunks/compose-args.js\";\nimport \"../../../../../chunks/src.js\";\nimport { t as getState } from \"../../../../../chunks/state.js\";\nimport { a as getRequestId, c as jsonResponse, d as requireCapability, r as errorResponse, u as requireAdmin } from \"../../../../../chunks/helpers.js\";\n//#region src/routes/api/host/secret-notice/+server.ts\nvar logger = createLogger(\"secret-notice\");\n/**\n* #502 — one-time notice that secret-looking keys were removed from stack.env.\n* The strip itself is correct per the secret-boundary contract; this surfaces\n* it so the user knows where their value went and how to re-add it.\n*/\nvar GET = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:secrets\", requestId);\n\tif (capabilityError) return capabilityError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst state = getState();\n\ttry {\n\t\treturn jsonResponse(200, {\n\t\t\tok: true,\n\t\t\tnotice: readSecretStripNotice(state)\n\t\t}, requestId);\n\t} catch (e) {\n\t\treturn errorResponse(500, \"secret_notice_failed\", e instanceof Error ? e.message : String(e), {}, requestId);\n\t}\n};\n/** Dismiss the one-time notice. */\nvar DELETE = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:secrets\", requestId);\n\tif (capabilityError) return capabilityError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst state = getState();\n\ttry {\n\t\tdismissSecretStripNotice(state);\n\t\tlogger.info(\"secret-strip notice dismissed\", { requestId });\n\t\treturn jsonResponse(200, { ok: true }, requestId);\n\t} catch (e) {\n\t\treturn errorResponse(500, \"secret_notice_dismiss_failed\", e instanceof Error ? e.message : String(e), {}, requestId);\n\t}\n};\n//#endregion\nexport { DELETE, GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAIA;AACA,IAAI,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC;AAC1C;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,KAAK,KAAK;AAC3B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC;AAC5E,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,KAAK,GAAG,QAAQ,EAAE;AACzB,CAAC,IAAI;AACL,EAAE,OAAO,YAAY,CAAC,GAAG,EAAE;AAC3B,GAAG,EAAE,EAAE,IAAI;AACX,GAAG,MAAM,EAAE,qBAAqB,CAAC,KAAK;AACtC,GAAG,EAAE,SAAS,CAAC;AACf,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,sBAAsB,EAAE,CAAC,YAAY,KAAK,GAAG,CAAC,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC;AAC9G,CAAC;AACD;AACA;AACG,IAAC,MAAM,GAAG,OAAO,KAAK,KAAK;AAC9B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC;AAC5E,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,KAAK,GAAG,QAAQ,EAAE;AACzB,CAAC,IAAI;AACL,EAAE,wBAAwB,CAAC,KAAK,CAAC;AACjC,EAAE,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,SAAS,EAAE,CAAC;AAC7D,EAAE,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,CAAC;AACnD,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,8BAA8B,EAAE,CAAC,YAAY,KAAK,GAAG,CAAC,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC;AACtH,CAAC;AACD;;;;"}

package/build/server/chunks/_server.ts-C7uAOfo3.js

@@ -0,0 +1,94 @@
+import { j as json } from './exports-CcmcYU0M.js';
+import { ah as isSetupComplete, aV as resolveOpenPalmHome, av as performSetup, ap as mapDockerError, p as checkDocker } from './src-CS2sSYOR.js';
+import { g as getState, r as resetState } from './state-BRh7vs9j.js';
+import { r as requireAdmin, d as getRequestId, f as getUiLoginPassword, b as createSession } from './helpers-7BvhniSt.js';
+import { s as sessionCookieHeader } from './session-cookie-WuIYBiMY.js';
+import { p as prepareSetupRestorePoint, s as startDeploy, r as resetDeployState } from './setup-deploy-DaMn6d6g.js';
+import './utils-OXHIhUb5.js';
+import './provider-constants-1s1k8kbj.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:fs';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+import './endpoints-CU3ehglV.js';
+import './features-DLGlNjZX.js';
+
+//#region src/routes/api/setup/complete/+server.ts
+var POST = async (event) => {
+	if (isSetupComplete(resolveOpenPalmHome())) {
+		const authError = requireAdmin(event, getRequestId(event));
+		if (authError) return authError;
+	}
+	const { request } = event;
+	let body;
+	try {
+		body = await request.json();
+	} catch {
+		return json({
+			ok: false,
+			error: "invalid_json",
+			message: "Request body must be valid JSON"
+		}, { status: 400 });
+	}
+	const dryRun = body.dryRun === true;
+	let result;
+	try {
+		prepareSetupRestorePoint(getState());
+		result = await performSetup(body);
+	} catch (err) {
+		const mapped = mapDockerError(String(err));
+		return json({
+			ok: false,
+			error: mapped.code,
+			message: mapped.message
+		}, { status: 500 });
+	}
+	if (!result.ok) return json(result, { status: 400 });
+	resetState();
+	const state = getState();
+	resetDeployState();
+	let dockerCheck = null;
+	if (!dryRun) {
+		dockerCheck = await checkDocker();
+		if (dockerCheck.ok) startDeploy(state);
+		else return json({
+			ok: false,
+			error: "docker_unavailable",
+			message: "Docker isn't running. Start Docker Desktop or OrbStack, then try again."
+		}, {
+			status: 503,
+			headers: { "content-type": "application/json" }
+		});
+	}
+	const headers = new Headers({ "content-type": "application/json" });
+	if (typeof body.security?.uiLoginPassword === "string" && body.security.uiLoginPassword || getUiLoginPassword()) {
+		const sessionToken = createSession();
+		headers.set("set-cookie", sessionCookieHeader(sessionToken, event.request));
+	}
+	return new Response(JSON.stringify({
+		ok: true,
+		dockerAvailable: dockerCheck?.ok ?? false,
+		dryRun
+	}), {
+		status: 200,
+		headers
+	});
+};
+
+export { POST };
+//# sourceMappingURL=_server.ts-C7uAOfo3.js.map

package/build/server/chunks/_server.ts-C7uAOfo3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-C7uAOfo3.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/setup/complete/_server.ts.js"],"sourcesContent":["import { r as json } from \"../../../../../chunks/exports.js\";\nimport { Tt as resolveOpenPalmHome } from \"../../../../../chunks/compose-args.js\";\nimport { P as mapDockerError, i as checkDocker } from \"../../../../../chunks/docker.js\";\nimport { c as performSetup, z as isSetupComplete } from \"../../../../../chunks/src.js\";\nimport { n as resetState, t as getState } from \"../../../../../chunks/state.js\";\nimport { a as getRequestId, g as getUiLoginPassword, h as createSession, u as requireAdmin } from \"../../../../../chunks/helpers.js\";\nimport { r as sessionCookieHeader } from \"../../../../../chunks/session-cookie.js\";\nimport { i as startDeploy, n as prepareSetupRestorePoint, r as resetDeployState } from \"../../../../../chunks/setup-deploy.js\";\n//#region src/routes/api/setup/complete/+server.ts\nvar POST = async (event) => {\n\tif (isSetupComplete(resolveOpenPalmHome())) {\n\t\tconst authError = requireAdmin(event, getRequestId(event));\n\t\tif (authError) return authError;\n\t}\n\tconst { request } = event;\n\tlet body;\n\ttry {\n\t\tbody = await request.json();\n\t} catch {\n\t\treturn json({\n\t\t\tok: false,\n\t\t\terror: \"invalid_json\",\n\t\t\tmessage: \"Request body must be valid JSON\"\n\t\t}, { status: 400 });\n\t}\n\tconst dryRun = body.dryRun === true;\n\tlet result;\n\ttry {\n\t\tprepareSetupRestorePoint(getState());\n\t\tresult = await performSetup(body);\n\t} catch (err) {\n\t\tconst mapped = mapDockerError(String(err));\n\t\treturn json({\n\t\t\tok: false,\n\t\t\terror: mapped.code,\n\t\t\tmessage: mapped.message\n\t\t}, { status: 500 });\n\t}\n\tif (!result.ok) return json(result, { status: 400 });\n\tresetState();\n\tconst state = getState();\n\tresetDeployState();\n\tlet dockerCheck = null;\n\tif (!dryRun) {\n\t\tdockerCheck = await checkDocker();\n\t\tif (dockerCheck.ok) startDeploy(state);\n\t\telse return json({\n\t\t\tok: false,\n\t\t\terror: \"docker_unavailable\",\n\t\t\tmessage: \"Docker isn't running. Start Docker Desktop or OrbStack, then try again.\"\n\t\t}, {\n\t\t\tstatus: 503,\n\t\t\theaders: { \"content-type\": \"application/json\" }\n\t\t});\n\t}\n\tconst headers = new Headers({ \"content-type\": \"application/json\" });\n\tif (typeof body.security?.uiLoginPassword === \"string\" && body.security.uiLoginPassword || getUiLoginPassword()) {\n\t\tconst sessionToken = createSession();\n\t\theaders.set(\"set-cookie\", sessionCookieHeader(sessionToken, event.request));\n\t}\n\treturn new Response(JSON.stringify({\n\t\tok: true,\n\t\tdockerAvailable: dockerCheck?.ok ?? false,\n\t\tdryRun\n\t}), {\n\t\tstatus: 200,\n\t\theaders\n\t});\n};\n//#endregion\nexport { POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA;AACG,IAAC,IAAI,GAAG,OAAO,KAAK,KAAK;AAC5B,CAAC,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAC,EAAE;AAC7C,EAAE,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;AAC5D,EAAE,IAAI,SAAS,EAAE,OAAO,SAAS;AACjC,CAAC;AACD,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK;AAC1B,CAAC,IAAI,IAAI;AACT,CAAC,IAAI;AACL,EAAE,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE;AAC7B,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,IAAI,CAAC;AACd,GAAG,EAAE,EAAE,KAAK;AACZ,GAAG,KAAK,EAAE,cAAc;AACxB,GAAG,OAAO,EAAE;AACZ,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACrB,CAAC;AACD,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI;AACpC,CAAC,IAAI,MAAM;AACX,CAAC,IAAI;AACL,EAAE,wBAAwB,CAAC,QAAQ,EAAE,CAAC;AACtC,EAAE,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC;AACnC,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC5C,EAAE,OAAO,IAAI,CAAC;AACd,GAAG,EAAE,EAAE,KAAK;AACZ,GAAG,KAAK,EAAE,MAAM,CAAC,IAAI;AACrB,GAAG,OAAO,EAAE,MAAM,CAAC;AACnB,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACrB,CAAC;AACD,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACrD,CAAC,UAAU,EAAE;AACb,CAAC,MAAM,KAAK,GAAG,QAAQ,EAAE;AACzB,CAAC,gBAAgB,EAAE;AACnB,CAAC,IAAI,WAAW,GAAG,IAAI;AACvB,CAAC,IAAI,CAAC,MAAM,EAAE;AACd,EAAE,WAAW,GAAG,MAAM,WAAW,EAAE;AACnC,EAAE,IAAI,WAAW,CAAC,EAAE,EAAE,WAAW,CAAC,KAAK,CAAC;AACxC,OAAO,OAAO,IAAI,CAAC;AACnB,GAAG,EAAE,EAAE,KAAK;AACZ,GAAG,KAAK,EAAE,oBAAoB;AAC9B,GAAG,OAAO,EAAE;AACZ,GAAG,EAAE;AACL,GAAG,MAAM,EAAE,GAAG;AACd,GAAG,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AAChD,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;AACpE,CAAC,IAAI,OAAO,IAAI,CAAC,QAAQ,EAAE,eAAe,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,IAAI,kBAAkB,EAAE,EAAE;AAClH,EAAE,MAAM,YAAY,GAAG,aAAa,EAAE;AACtC,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,mBAAmB,CAAC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;AAC7E,CAAC;AACD,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AACpC,EAAE,EAAE,EAAE,IAAI;AACV,EAAE,eAAe,EAAE,WAAW,EAAE,EAAE,IAAI,KAAK;AAC3C,EAAE;AACF,EAAE,CAAC,EAAE;AACL,EAAE,MAAM,EAAE,GAAG;AACb,EAAE;AACF,EAAE,CAAC;AACH;;;;"}

package/build/server/chunks/_server.ts-C7wn5VUY.js

@@ -0,0 +1,111 @@
+import { L as deleteUserEnvKey, _ as ensureAkmUserEnv, aI as readUserEnvFile, G as createLogger, A as AKM_USER_ENV_REF, ba as writeUserEnvKey } from './src-CS2sSYOR.js';
+import { g as getState } from './state-BRh7vs9j.js';
+import { d as getRequestId, l as requireCapability, r as requireAdmin, e as errorResponse, k as jsonResponse, w as withAdminBody } from './helpers-7BvhniSt.js';
+import './provider-constants-1s1k8kbj.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:fs';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+import './endpoints-CU3ehglV.js';
+import './features-DLGlNjZX.js';
+
+//#region src/routes/api/host/secrets/user-env/+server.ts
+var logger = createLogger("admin.secrets.user-env");
+var KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/**
+* GET — list keys in the akm env:user store. Values are NEVER returned.
+*/
+var GET = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:secrets", requestId);
+	if (capabilityError) return capabilityError;
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	const envPath = ensureAkmUserEnv(getState());
+	return jsonResponse(200, {
+		provider: "akm",
+		envRef: AKM_USER_ENV_REF,
+		keys: Object.keys(readUserEnvFile(envPath)).sort()
+	}, requestId);
+};
+/**
+* POST — write a key into the user env file. The value is shell-quoted and
+* written directly to `knowledge/env/user.env` (mode 0600); it never appears on
+* a process argv. The assistant sources the env file at startup, so a key
+* written here is visible to OpenCode after the next assistant restart.
+*/
+var POST = async (event) => {
+	const capabilityError = requireCapability(event, "host:secrets", getRequestId(event));
+	if (capabilityError) return capabilityError;
+	return withAdminBody(event, async ({ requestId, body }) => {
+		const state = getState();
+		const key = typeof body.key === "string" ? body.key.trim() : "";
+		const value = typeof body.value === "string" ? body.value : null;
+		if (!key || value === null) return errorResponse(400, "bad_request", "key and value are required", {}, requestId);
+		if (!KEY_RE.test(key)) return errorResponse(400, "invalid_key", "key must match [A-Za-z_][A-Za-z0-9_]*", {}, requestId);
+		if (value.length === 0) return errorResponse(400, "bad_request", "value must be non-empty; use DELETE to remove a key", {}, requestId);
+		if ([...value].some((ch) => {
+			const code = ch.charCodeAt(0);
+			return code >= 0 && code <= 8 || code >= 10 && code <= 31 || code === 127;
+		})) return errorResponse(400, "invalid_value", "value must not contain newlines or control characters", {}, requestId);
+		try {
+			writeUserEnvKey(state, key, value);
+		} catch (err) {
+			const reason = err instanceof Error ? err.message : String(err);
+			logger.warn("user env write failed", {
+				key,
+				reason,
+				requestId
+			});
+			return errorResponse(500, "write_failed", `Failed to write user env key: ${reason}`, {}, requestId);
+		}
+		return jsonResponse(200, {
+			ok: true,
+			key
+		}, requestId);
+	});
+};
+/** DELETE — remove a key from the user env file. */
+var DELETE = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:secrets", requestId);
+	if (capabilityError) return capabilityError;
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	const state = getState();
+	const key = new URL(event.request.url).searchParams.get("key")?.trim() ?? "";
+	if (!key || !KEY_RE.test(key)) return errorResponse(400, "bad_request", "valid key query parameter is required", {}, requestId);
+	try {
+		deleteUserEnvKey(state, key);
+	} catch (err) {
+		const reason = err instanceof Error ? err.message : String(err);
+		logger.warn("user env delete failed", {
+			key,
+			reason,
+			requestId
+		});
+		return errorResponse(500, "delete_failed", `Failed to remove user env key: ${reason}`, {}, requestId);
+	}
+	return jsonResponse(200, {
+		ok: true,
+		key
+	}, requestId);
+};
+
+export { DELETE, GET, POST };
+//# sourceMappingURL=_server.ts-C7wn5VUY.js.map

package/build/server/chunks/_server.ts-C7wn5VUY.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-C7wn5VUY.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/host/secrets/user-env/_server.ts.js"],"sourcesContent":["import { Nt as createLogger } from \"../../../../../../chunks/compose-args.js\";\nimport { b as readUserEnvFile, g as AKM_USER_ENV_REF, v as deleteUserEnvKey, x as writeUserEnvKey, y as ensureAkmUserEnv } from \"../../../../../../chunks/src.js\";\nimport { t as getState } from \"../../../../../../chunks/state.js\";\nimport { a as getRequestId, c as jsonResponse, d as requireCapability, p as withAdminBody, r as errorResponse, u as requireAdmin } from \"../../../../../../chunks/helpers.js\";\n//#region src/routes/api/host/secrets/user-env/+server.ts\nvar logger = createLogger(\"admin.secrets.user-env\");\nvar KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;\n/**\n* GET — list keys in the akm env:user store. Values are NEVER returned.\n*/\nvar GET = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:secrets\", requestId);\n\tif (capabilityError) return capabilityError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst envPath = ensureAkmUserEnv(getState());\n\treturn jsonResponse(200, {\n\t\tprovider: \"akm\",\n\t\tenvRef: AKM_USER_ENV_REF,\n\t\tkeys: Object.keys(readUserEnvFile(envPath)).sort()\n\t}, requestId);\n};\n/**\n* POST — write a key into the user env file. The value is shell-quoted and\n* written directly to `knowledge/env/user.env` (mode 0600); it never appears on\n* a process argv. The assistant sources the env file at startup, so a key\n* written here is visible to OpenCode after the next assistant restart.\n*/\nvar POST = async (event) => {\n\tconst capabilityError = requireCapability(event, \"host:secrets\", getRequestId(event));\n\tif (capabilityError) return capabilityError;\n\treturn withAdminBody(event, async ({ requestId, body }) => {\n\t\tconst state = getState();\n\t\tconst key = typeof body.key === \"string\" ? body.key.trim() : \"\";\n\t\tconst value = typeof body.value === \"string\" ? body.value : null;\n\t\tif (!key || value === null) return errorResponse(400, \"bad_request\", \"key and value are required\", {}, requestId);\n\t\tif (!KEY_RE.test(key)) return errorResponse(400, \"invalid_key\", \"key must match [A-Za-z_][A-Za-z0-9_]*\", {}, requestId);\n\t\tif (value.length === 0) return errorResponse(400, \"bad_request\", \"value must be non-empty; use DELETE to remove a key\", {}, requestId);\n\t\tif ([...value].some((ch) => {\n\t\t\tconst code = ch.charCodeAt(0);\n\t\t\treturn code >= 0 && code <= 8 || code >= 10 && code <= 31 || code === 127;\n\t\t})) return errorResponse(400, \"invalid_value\", \"value must not contain newlines or control characters\", {}, requestId);\n\t\ttry {\n\t\t\twriteUserEnvKey(state, key, value);\n\t\t} catch (err) {\n\t\t\tconst reason = err instanceof Error ? err.message : String(err);\n\t\t\tlogger.warn(\"user env write failed\", {\n\t\t\t\tkey,\n\t\t\t\treason,\n\t\t\t\trequestId\n\t\t\t});\n\t\t\treturn errorResponse(500, \"write_failed\", `Failed to write user env key: ${reason}`, {}, requestId);\n\t\t}\n\t\treturn jsonResponse(200, {\n\t\t\tok: true,\n\t\t\tkey\n\t\t}, requestId);\n\t});\n};\n/** DELETE — remove a key from the user env file. */\nvar DELETE = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:secrets\", requestId);\n\tif (capabilityError) return capabilityError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst state = getState();\n\tconst key = new URL(event.request.url).searchParams.get(\"key\")?.trim() ?? \"\";\n\tif (!key || !KEY_RE.test(key)) return errorResponse(400, \"bad_request\", \"valid key query parameter is required\", {}, requestId);\n\ttry {\n\t\tdeleteUserEnvKey(state, key);\n\t} catch (err) {\n\t\tconst reason = err instanceof Error ? err.message : String(err);\n\t\tlogger.warn(\"user env delete failed\", {\n\t\t\tkey,\n\t\t\treason,\n\t\t\trequestId\n\t\t});\n\t\treturn errorResponse(500, \"delete_failed\", `Failed to remove user env key: ${reason}`, {}, requestId);\n\t}\n\treturn jsonResponse(200, {\n\t\tok: true,\n\t\tkey\n\t}, requestId);\n};\n//#endregion\nexport { DELETE, GET, POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAIA;AACA,IAAI,MAAM,GAAG,YAAY,CAAC,wBAAwB,CAAC;AACnD,IAAI,MAAM,GAAG,0BAA0B;AACvC;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,KAAK,KAAK;AAC3B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC;AAC5E,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,EAAE,CAAC;AAC7C,CAAC,OAAO,YAAY,CAAC,GAAG,EAAE;AAC1B,EAAE,QAAQ,EAAE,KAAK;AACjB,EAAE,MAAM,EAAE,gBAAgB;AAC1B,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;AAClD,EAAE,EAAE,SAAS,CAAC;AACd;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,IAAI,GAAG,OAAO,KAAK,KAAK;AAC5B,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;AACtF,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,OAAO,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK;AAC5D,EAAE,MAAM,KAAK,GAAG,QAAQ,EAAE;AAC1B,EAAE,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE;AACjE,EAAE,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI;AAClE,EAAE,IAAI,CAAC,GAAG,IAAI,KAAK,KAAK,IAAI,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,4BAA4B,EAAE,EAAE,EAAE,SAAS,CAAC;AACnH,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,uCAAuC,EAAE,EAAE,EAAE,SAAS,CAAC;AACzH,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,qDAAqD,EAAE,EAAE,EAAE,SAAS,CAAC;AACxI,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK;AAC9B,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;AAChC,GAAG,OAAO,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,KAAK,GAAG;AAC5E,EAAE,CAAC,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,uDAAuD,EAAE,EAAE,EAAE,SAAS,CAAC;AACxH,EAAE,IAAI;AACN,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC;AACrC,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC;AAClE,GAAG,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;AACxC,IAAI,GAAG;AACP,IAAI,MAAM;AACV,IAAI;AACJ,IAAI,CAAC;AACL,GAAG,OAAO,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC;AACtG,EAAE;AACF,EAAE,OAAO,YAAY,CAAC,GAAG,EAAE;AAC3B,GAAG,EAAE,EAAE,IAAI;AACX,GAAG;AACH,GAAG,EAAE,SAAS,CAAC;AACf,CAAC,CAAC,CAAC;AACH;AACA;AACG,IAAC,MAAM,GAAG,OAAO,KAAK,KAAK;AAC9B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC;AAC5E,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,KAAK,GAAG,QAAQ,EAAE;AACzB,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;AAC7E,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,uCAAuC,EAAE,EAAE,EAAE,SAAS,CAAC;AAChI,CAAC,IAAI;AACL,EAAE,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC;AAC9B,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC;AACjE,EAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;AACxC,GAAG,GAAG;AACN,GAAG,MAAM;AACT,GAAG;AACH,GAAG,CAAC;AACJ,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,CAAC,+BAA+B,EAAE,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC;AACvG,CAAC;AACD,CAAC,OAAO,YAAY,CAAC,GAAG,EAAE;AAC1B,EAAE,EAAE,EAAE,IAAI;AACV,EAAE;AACF,EAAE,EAAE,SAAS,CAAC;AACd;;;;"}

package/build/server/chunks/_server.ts-CFz_IeN4.js

@@ -0,0 +1,56 @@
+import { d as getRequestId, l as requireCapability, r as requireAdmin, p as parseJsonBody, j as jsonBodyError, e as errorResponse, k as jsonResponse } from './helpers-7BvhniSt.js';
+import { t as testEmbeddingSettings } from './akm-D8uSJNzt.js';
+import './src-CS2sSYOR.js';
+import './provider-constants-1s1k8kbj.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:fs';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+import './endpoints-CU3ehglV.js';
+import './state-BRh7vs9j.js';
+import './features-DLGlNjZX.js';
+
+//#region src/routes/api/host/akm/embedding/test/+server.ts
+var POST = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:stack:read", requestId);
+	if (capabilityError) return capabilityError;
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	const parsed = await parseJsonBody(event.request);
+	if ("error" in parsed) return jsonBodyError(parsed, requestId);
+	const body = parsed.data;
+	const endpoint = typeof body.endpoint === "string" ? body.endpoint : "";
+	const model = typeof body.model === "string" ? body.model : "";
+	const provider = typeof body.provider === "string" ? body.provider : "";
+	const apiKey = typeof body.apiKey === "string" ? body.apiKey : "";
+	const dimension = typeof body.dimension === "number" ? body.dimension : void 0;
+	if (!endpoint.trim() || !model.trim()) return errorResponse(400, "bad_request", "Endpoint and model are required.", {}, requestId);
+	const result = await testEmbeddingSettings({
+		endpoint,
+		model,
+		provider,
+		apiKey,
+		dimension
+	});
+	if (!result.ok) return errorResponse(502, "embedding_test_failed", result.message, {}, requestId);
+	return jsonResponse(200, result, requestId);
+};
+
+export { POST };
+//# sourceMappingURL=_server.ts-CFz_IeN4.js.map

package/build/server/chunks/_server.ts-CFz_IeN4.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-CFz_IeN4.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/host/akm/embedding/test/_server.ts.js"],"sourcesContent":["import { a as getRequestId, c as jsonResponse, d as requireCapability, l as parseJsonBody, r as errorResponse, s as jsonBodyError, u as requireAdmin } from \"../../../../../../../chunks/helpers.js\";\nimport { r as testEmbeddingSettings } from \"../../../../../../../chunks/akm.js\";\n//#region src/routes/api/host/akm/embedding/test/+server.ts\nvar POST = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:stack:read\", requestId);\n\tif (capabilityError) return capabilityError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst parsed = await parseJsonBody(event.request);\n\tif (\"error\" in parsed) return jsonBodyError(parsed, requestId);\n\tconst body = parsed.data;\n\tconst endpoint = typeof body.endpoint === \"string\" ? body.endpoint : \"\";\n\tconst model = typeof body.model === \"string\" ? body.model : \"\";\n\tconst provider = typeof body.provider === \"string\" ? body.provider : \"\";\n\tconst apiKey = typeof body.apiKey === \"string\" ? body.apiKey : \"\";\n\tconst dimension = typeof body.dimension === \"number\" ? body.dimension : void 0;\n\tif (!endpoint.trim() || !model.trim()) return errorResponse(400, \"bad_request\", \"Endpoint and model are required.\", {}, requestId);\n\tconst result = await testEmbeddingSettings({\n\t\tendpoint,\n\t\tmodel,\n\t\tprovider,\n\t\tapiKey,\n\t\tdimension\n\t});\n\tif (!result.ok) return errorResponse(502, \"embedding_test_failed\", result.message, {}, requestId);\n\treturn jsonResponse(200, result, requestId);\n};\n//#endregion\nexport { POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA;AACG,IAAC,IAAI,GAAG,OAAO,KAAK,KAAK;AAC5B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,EAAE,SAAS,CAAC;AAC/E,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;AAClD,CAAC,IAAI,OAAO,IAAI,MAAM,EAAE,OAAO,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC;AAC/D,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI;AACzB,CAAC,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,GAAG,IAAI,CAAC,QAAQ,GAAG,EAAE;AACxE,CAAC,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE;AAC/D,CAAC,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,GAAG,IAAI,CAAC,QAAQ,GAAG,EAAE;AACxE,CAAC,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,EAAE;AAClE,CAAC,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,GAAG,IAAI,CAAC,SAAS,GAAG,MAAM;AAC/E,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,kCAAkC,EAAE,EAAE,EAAE,SAAS,CAAC;AACnI,CAAC,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC;AAC5C,EAAE,QAAQ;AACV,EAAE,KAAK;AACP,EAAE,QAAQ;AACV,EAAE,MAAM;AACR,EAAE;AACF,EAAE,CAAC;AACH,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,uBAAuB,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC;AAClG,CAAC,OAAO,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC;AAC5C;;;;"}

package/build/server/chunks/_server.ts-CHuyT9rF.js

@@ -0,0 +1,69 @@
+import { af as isAllowedService, p as checkDocker, aL as reconcileHostOwnership, H as HostSwapBlockedError, B as composeStart, n as buildComposeOptions, G as createLogger } from './src-CS2sSYOR.js';
+import { g as getState } from './state-BRh7vs9j.js';
+import { d as getRequestId, l as requireCapability, r as requireAdmin, p as parseJsonBody, j as jsonBodyError, e as errorResponse, k as jsonResponse } from './helpers-7BvhniSt.js';
+import './provider-constants-1s1k8kbj.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:fs';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+import './endpoints-CU3ehglV.js';
+import './features-DLGlNjZX.js';
+
+//#region src/routes/api/host/containers/up/+server.ts
+var logger = createLogger("containers-up");
+var POST = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:containers", requestId);
+	if (capabilityError) return capabilityError;
+	logger.info("container start request received", { requestId });
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	const state = getState();
+	const result = await parseJsonBody(event.request);
+	if ("error" in result) return jsonBodyError(result, requestId);
+	const body = result.data;
+	const service = typeof body.service === "string" ? body.service : "";
+	logger.info("starting service", {
+		requestId,
+		service
+	});
+	if (!isAllowedService(service, state.configDir)) return errorResponse(400, "invalid_service", "Service is not in allowlist", { service }, requestId);
+	if ((await checkDocker()).ok) {
+		try {
+			await reconcileHostOwnership(state, { services: [service] });
+		} catch (err) {
+			if (err instanceof HostSwapBlockedError) return errorResponse(409, "host_swap_blocked", "OP_HOME appears to have moved from another host. Ownership must be adopted for this host before starting. Run `openpalm start --adopt-host` from the host CLI, then retry.", {
+				service,
+				previousHost: err.previousIdentity?.host ?? null,
+				currentHost: err.currentIdentity.host
+			}, requestId);
+			throw err;
+		}
+		const result = await composeStart([service], buildComposeOptions(state));
+		if (result.ok) state.services[service] = "running";
+		else return errorResponse(500, "docker_error", `Failed to start service: ${result.stderr}`, { service }, requestId);
+	} else state.services[service] = "running";
+	return jsonResponse(200, {
+		ok: true,
+		service,
+		status: state.services[service]
+	}, requestId);
+};
+
+export { POST };
+//# sourceMappingURL=_server.ts-CHuyT9rF.js.map

package/build/server/chunks/_server.ts-CHuyT9rF.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-CHuyT9rF.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/host/containers/up/_server.ts.js"],"sourcesContent":["import { Nt as createLogger, _ as HostSwapBlockedError, t as buildComposeOptions, v as reconcileHostOwnership } from \"../../../../../../chunks/compose-args.js\";\nimport { g as composeStart, i as checkDocker } from \"../../../../../../chunks/docker.js\";\nimport { O as isAllowedService } from \"../../../../../../chunks/src.js\";\nimport { t as getState } from \"../../../../../../chunks/state.js\";\nimport { a as getRequestId, c as jsonResponse, d as requireCapability, l as parseJsonBody, r as errorResponse, s as jsonBodyError, u as requireAdmin } from \"../../../../../../chunks/helpers.js\";\n//#region src/routes/api/host/containers/up/+server.ts\nvar logger = createLogger(\"containers-up\");\nvar POST = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:containers\", requestId);\n\tif (capabilityError) return capabilityError;\n\tlogger.info(\"container start request received\", { requestId });\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst state = getState();\n\tconst result = await parseJsonBody(event.request);\n\tif (\"error\" in result) return jsonBodyError(result, requestId);\n\tconst body = result.data;\n\tconst service = typeof body.service === \"string\" ? body.service : \"\";\n\tlogger.info(\"starting service\", {\n\t\trequestId,\n\t\tservice\n\t});\n\tif (!isAllowedService(service, state.configDir)) return errorResponse(400, \"invalid_service\", \"Service is not in allowlist\", { service }, requestId);\n\tif ((await checkDocker()).ok) {\n\t\ttry {\n\t\t\tawait reconcileHostOwnership(state, { services: [service] });\n\t\t} catch (err) {\n\t\t\tif (err instanceof HostSwapBlockedError) return errorResponse(409, \"host_swap_blocked\", \"OP_HOME appears to have moved from another host. Ownership must be adopted for this host before starting. Run `openpalm start --adopt-host` from the host CLI, then retry.\", {\n\t\t\t\tservice,\n\t\t\t\tpreviousHost: err.previousIdentity?.host ?? null,\n\t\t\t\tcurrentHost: err.currentIdentity.host\n\t\t\t}, requestId);\n\t\t\tthrow err;\n\t\t}\n\t\tconst result = await composeStart([service], buildComposeOptions(state));\n\t\tif (result.ok) state.services[service] = \"running\";\n\t\telse return errorResponse(500, \"docker_error\", `Failed to start service: ${result.stderr}`, { service }, requestId);\n\t} else state.services[service] = \"running\";\n\treturn jsonResponse(200, {\n\t\tok: true,\n\t\tservice,\n\t\tstatus: state.services[service]\n\t}, requestId);\n};\n//#endregion\nexport { POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAKA;AACA,IAAI,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC;AACvC,IAAC,IAAI,GAAG,OAAO,KAAK,KAAK;AAC5B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,EAAE,SAAS,CAAC;AAC/E,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,SAAS,EAAE,CAAC;AAC/D,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,KAAK,GAAG,QAAQ,EAAE;AACzB,CAAC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;AAClD,CAAC,IAAI,OAAO,IAAI,MAAM,EAAE,OAAO,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC;AAC/D,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI;AACzB,CAAC,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,GAAG,IAAI,CAAC,OAAO,GAAG,EAAE;AACrE,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE;AACjC,EAAE,SAAS;AACX,EAAE;AACF,EAAE,CAAC;AACH,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC;AACrJ,CAAC,IAAI,CAAC,MAAM,WAAW,EAAE,EAAE,EAAE,EAAE;AAC/B,EAAE,IAAI;AACN,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;AAC/D,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,IAAI,GAAG,YAAY,oBAAoB,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,mBAAmB,EAAE,4KAA4K,EAAE;AACzQ,IAAI,OAAO;AACX,IAAI,YAAY,EAAE,GAAG,CAAC,gBAAgB,EAAE,IAAI,IAAI,IAAI;AACpD,IAAI,WAAW,EAAE,GAAG,CAAC,eAAe,CAAC;AACrC,IAAI,EAAE,SAAS,CAAC;AAChB,GAAG,MAAM,GAAG;AACZ,EAAE;AACF,EAAE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC;AAC1E,EAAE,IAAI,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,SAAS;AACpD,OAAO,OAAO,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,CAAC,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC;AACrH,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,SAAS;AAC3C,CAAC,OAAO,YAAY,CAAC,GAAG,EAAE;AAC1B,EAAE,EAAE,EAAE,IAAI;AACV,EAAE,OAAO;AACT,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;AAChC,EAAE,EAAE,SAAS,CAAC;AACd;;;;"}

package/build/server/chunks/_server.ts-CKcFu8B-.js

@@ -0,0 +1,171 @@
+import { j as json } from './exports-CcmcYU0M.js';
+import { ad as importHostOpenCode, j as authJsonPath, R as detectHostOpenCode, G as createLogger, p as checkDocker, n as buildComposeOptions } from './src-CS2sSYOR.js';
+import { g as getState } from './state-BRh7vs9j.js';
+import { o as opencodeFetch } from './http-D0qKwTqb.js';
+import { c as composeRestart } from './docker3-DvrSgFLt.js';
+import { existsSync, readFileSync } from 'node:fs';
+import './utils-OXHIhUb5.js';
+import './provider-constants-1s1k8kbj.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+import './endpoints-CU3ehglV.js';
+
+//#region src/routes/api/setup/import-host/+server.ts
+/**
+* POST /api/setup/import-host
+*
+* Setup-phase equivalent of POST /admin/providers/import-host.
+* No admin auth required — the admin token hasn't been written yet during setup.
+*
+* Copies host OpenCode config + auth into OP_HOME and live-pushes credentials
+* to the running OpenCode subprocess so providers appear connected immediately.
+*/
+var logger = createLogger("setup:import-host");
+async function pushAuthToOpenCode(authPath) {
+	let raw;
+	try {
+		raw = JSON.parse(readFileSync(authPath, "utf-8"));
+	} catch (err) {
+		return {
+			pushed: [],
+			errors: [{
+				provider: "*",
+				error: `Could not read auth.json: ${err instanceof Error ? err.message : String(err)}`
+			}]
+		};
+	}
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return {
+		pushed: [],
+		errors: [{
+			provider: "*",
+			error: "auth.json is not a JSON object"
+		}]
+	};
+	const pushed = [];
+	const errors = [];
+	for (const [providerId, value] of Object.entries(raw)) {
+		if (providerId === "anthropic") continue;
+		try {
+			await opencodeFetch(`/auth/${encodeURIComponent(providerId)}`, {
+				method: "PUT",
+				body: JSON.stringify(value)
+			});
+			pushed.push(providerId);
+		} catch (err) {
+			errors.push({
+				provider: providerId,
+				error: err instanceof Error ? err.message : String(err)
+			});
+		}
+	}
+	return {
+		pushed,
+		errors
+	};
+}
+/** Restart provider-consuming services so they re-read imported startup config. */
+async function restartProviderConsumers(state) {
+	const services = ["assistant"];
+	if (!(await checkDocker()).ok) return {
+		restarted: [],
+		failed: services.map((s) => ({
+			service: s,
+			error: "docker unavailable"
+		}))
+	};
+	const opts = buildComposeOptions(state);
+	const restarted = [];
+	const failed = [];
+	for (const service of services) try {
+		const r = await composeRestart([service], opts);
+		if (r.ok) restarted.push(service);
+		else failed.push({
+			service,
+			error: r.stderr || `exit ${r.code}`
+		});
+	} catch (err) {
+		failed.push({
+			service,
+			error: err instanceof Error ? err.message : String(err)
+		});
+	}
+	return {
+		restarted,
+		failed
+	};
+}
+/** Read the provider ids present in an auth.json, ignoring read/parse errors. */
+function providerIdsFromAuth(authPath) {
+	try {
+		const raw = JSON.parse(readFileSync(authPath, "utf-8"));
+		if (raw && typeof raw === "object" && !Array.isArray(raw)) return Object.keys(raw);
+	} catch {}
+	return [];
+}
+var POST = async () => {
+	const state = getState();
+	let result;
+	try {
+		result = importHostOpenCode(state, { overwriteConflicts: false });
+	} catch (err) {
+		return json({
+			ok: false,
+			error: `Could not copy host OpenCode config: ${err instanceof Error ? err.message : String(err)}`
+		}, { status: 500 });
+	}
+	const importedAuthPath = authJsonPath(state);
+	let importedProviderIds = [];
+	if (result.imported.credentials > 0 || existsSync(importedAuthPath)) {
+		const fromDestination = providerIdsFromAuth(importedAuthPath);
+		if (fromDestination.length > 0) importedProviderIds = fromDestination;
+		else if (result.imported.credentials > 0) {
+			const hostStatus = detectHostOpenCode();
+			const hostFallback = hostStatus.authPath ? providerIdsFromAuth(hostStatus.authPath) : [];
+			logger.warn("post-copy auth.json read returned no providers despite credentials being reported; falling back to host auth.json", {
+				importedAuthPath,
+				importedCredentials: result.imported.credentials,
+				fallbackCount: hostFallback.length
+			});
+			importedProviderIds = hostFallback;
+		}
+	}
+	const conflictProviders = result.conflicts;
+	const authPathToUse = existsSync(importedAuthPath) ? importedAuthPath : null;
+	let pushResult = {
+		pushed: [],
+		errors: []
+	};
+	if (authPathToUse) pushResult = await pushAuthToOpenCode(authPathToUse);
+	const restart = await restartProviderConsumers(state);
+	return json({
+		ok: true,
+		imported: result.imported,
+		importedProviders: importedProviderIds,
+		conflicts: result.conflicts.length,
+		conflictProviders,
+		livePushed: pushResult.pushed.length,
+		pushedProviders: pushResult.pushed,
+		errors: pushResult.errors,
+		restarted: restart.restarted,
+		restartFailed: restart.failed
+	});
+};
+
+export { POST };
+//# sourceMappingURL=_server.ts-CKcFu8B-.js.map