@openpalm/ui 0.12.52 → 0.13.0-beta.1

package/build/server/chunks/_server.ts-Q1zB1kiD.js

@@ -0,0 +1,87 @@
+import { ae as inspectInstallLock, I as INSTALL_LOCK_STALE_AFTER_MS, b2 as unlockInstallLock, G as createLogger } from './src-CS2sSYOR.js';
+import { g as getState } from './state-BRh7vs9j.js';
+import { d as getRequestId, l as requireCapability, r as requireAdmin, k as jsonResponse, e as errorResponse } from './helpers-7BvhniSt.js';
+import './provider-constants-1s1k8kbj.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:fs';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+import './endpoints-CU3ehglV.js';
+import './features-DLGlNjZX.js';
+
+//#region src/routes/api/host/unlock/+server.ts
+var logger = createLogger("unlock-admin");
+/**
+* #500 — "an operation seems stuck — clear it?" Reports whether an install lock
+* is present and whether it is stale (so the UI can decide whether to offer the
+* clear action). Read-only.
+*/
+var GET = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:recovery", requestId);
+	if (capabilityError) return capabilityError;
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	const state = getState();
+	try {
+		return jsonResponse(200, {
+			ok: true,
+			staleAfterMs: INSTALL_LOCK_STALE_AFTER_MS,
+			...inspectInstallLock(state.dataDir)
+		}, requestId);
+	} catch (e) {
+		return errorResponse(500, "unlock_status_failed", e instanceof Error ? e.message : String(e), {}, requestId);
+	}
+};
+/**
+* #500 — clears the install lock ONLY when stale (dead holder PID or older than
+* the 30-minute staleness window). Returns 409 when a live install is still
+* holding the lock so the UI can surface "an operation is still running" rather
+* than forcing it. Never blind-removes a live lock.
+*/
+var POST = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:recovery", requestId);
+	if (capabilityError) return capabilityError;
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	const state = getState();
+	let force = false;
+	try {
+		force = (await event.request.clone().json())?.force === true;
+	} catch {}
+	try {
+		const result = unlockInstallLock(state.dataDir, { force });
+		if (!result.ok) return errorResponse(409, "install_in_progress", "An install or upgrade still appears to be running. The lock clears itself automatically once it finishes or after 30 minutes. Nothing was changed. Send { \"force\": true } to clear it anyway if the recorded PID was reused by an unrelated process.", { status: result.status }, requestId);
+		logger.info("cleared install lock via admin", {
+			requestId,
+			removed: result.removed,
+			forced: force && result.status.present && !result.status.stale
+		});
+		return jsonResponse(200, {
+			ok: true,
+			removed: result.removed,
+			status: result.status
+		}, requestId);
+	} catch (e) {
+		return errorResponse(500, "unlock_failed", e instanceof Error ? e.message : String(e), {}, requestId);
+	}
+};
+
+export { GET, POST };
+//# sourceMappingURL=_server.ts-Q1zB1kiD.js.map

package/build/server/chunks/_server.ts-Q1zB1kiD.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-Q1zB1kiD.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/host/unlock/_server.ts.js"],"sourcesContent":["import { Nt as createLogger, d as inspectInstallLock, l as INSTALL_LOCK_STALE_AFTER_MS, m as unlockInstallLock } from \"../../../../../chunks/compose-args.js\";\nimport \"../../../../../chunks/src.js\";\nimport { t as getState } from \"../../../../../chunks/state.js\";\nimport { a as getRequestId, c as jsonResponse, d as requireCapability, r as errorResponse, u as requireAdmin } from \"../../../../../chunks/helpers.js\";\n//#region src/routes/api/host/unlock/+server.ts\nvar logger = createLogger(\"unlock-admin\");\n/**\n* #500 — \"an operation seems stuck — clear it?\" Reports whether an install lock\n* is present and whether it is stale (so the UI can decide whether to offer the\n* clear action). Read-only.\n*/\nvar GET = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:recovery\", requestId);\n\tif (capabilityError) return capabilityError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst state = getState();\n\ttry {\n\t\treturn jsonResponse(200, {\n\t\t\tok: true,\n\t\t\tstaleAfterMs: INSTALL_LOCK_STALE_AFTER_MS,\n\t\t\t...inspectInstallLock(state.dataDir)\n\t\t}, requestId);\n\t} catch (e) {\n\t\treturn errorResponse(500, \"unlock_status_failed\", e instanceof Error ? e.message : String(e), {}, requestId);\n\t}\n};\n/**\n* #500 — clears the install lock ONLY when stale (dead holder PID or older than\n* the 30-minute staleness window). Returns 409 when a live install is still\n* holding the lock so the UI can surface \"an operation is still running\" rather\n* than forcing it. Never blind-removes a live lock.\n*/\nvar POST = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:recovery\", requestId);\n\tif (capabilityError) return capabilityError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst state = getState();\n\tlet force = false;\n\ttry {\n\t\tforce = (await event.request.clone().json())?.force === true;\n\t} catch {}\n\ttry {\n\t\tconst result = unlockInstallLock(state.dataDir, { force });\n\t\tif (!result.ok) return errorResponse(409, \"install_in_progress\", \"An install or upgrade still appears to be running. The lock clears itself automatically once it finishes or after 30 minutes. Nothing was changed. Send { \\\"force\\\": true } to clear it anyway if the recorded PID was reused by an unrelated process.\", { status: result.status }, requestId);\n\t\tlogger.info(\"cleared install lock via admin\", {\n\t\t\trequestId,\n\t\t\tremoved: result.removed,\n\t\t\tforced: force && result.status.present && !result.status.stale\n\t\t});\n\t\treturn jsonResponse(200, {\n\t\t\tok: true,\n\t\t\tremoved: result.removed,\n\t\t\tstatus: result.status\n\t\t}, requestId);\n\t} catch (e) {\n\t\treturn errorResponse(500, \"unlock_failed\", e instanceof Error ? e.message : String(e), {}, requestId);\n\t}\n};\n//#endregion\nexport { GET, POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAIA;AACA,IAAI,MAAM,GAAG,YAAY,CAAC,cAAc,CAAC;AACzC;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,KAAK,KAAK;AAC3B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,SAAS,CAAC;AAC7E,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,KAAK,GAAG,QAAQ,EAAE;AACzB,CAAC,IAAI;AACL,EAAE,OAAO,YAAY,CAAC,GAAG,EAAE;AAC3B,GAAG,EAAE,EAAE,IAAI;AACX,GAAG,YAAY,EAAE,2BAA2B;AAC5C,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO;AACtC,GAAG,EAAE,SAAS,CAAC;AACf,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,sBAAsB,EAAE,CAAC,YAAY,KAAK,GAAG,CAAC,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC;AAC9G,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,IAAI,GAAG,OAAO,KAAK,KAAK;AAC5B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,SAAS,CAAC;AAC7E,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,KAAK,GAAG,QAAQ,EAAE;AACzB,CAAC,IAAI,KAAK,GAAG,KAAK;AAClB,CAAC,IAAI;AACL,EAAE,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,KAAK,IAAI;AAC9D,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,IAAI;AACL,EAAE,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC;AAC5D,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,qBAAqB,EAAE,wPAAwP,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC;AAClW,EAAE,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;AAChD,GAAG,SAAS;AACZ,GAAG,OAAO,EAAE,MAAM,CAAC,OAAO;AAC1B,GAAG,MAAM,EAAE,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;AAC5D,GAAG,CAAC;AACJ,EAAE,OAAO,YAAY,CAAC,GAAG,EAAE;AAC3B,GAAG,EAAE,EAAE,IAAI;AACX,GAAG,OAAO,EAAE,MAAM,CAAC,OAAO;AAC1B,GAAG,MAAM,EAAE,MAAM,CAAC;AAClB,GAAG,EAAE,SAAS,CAAC;AACf,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,CAAC,YAAY,KAAK,GAAG,CAAC,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC;AACvG,CAAC;AACD;;;;"}

package/build/server/chunks/_server.ts-Rv6Qmjnm.js

@@ -0,0 +1,65 @@
+import { af as isAllowedService, p as checkDocker, w as composeLogs, n as buildComposeOptions } from './src-CS2sSYOR.js';
+import { g as getState } from './state-BRh7vs9j.js';
+import { d as getRequestId, l as requireCapability, r as requireAdmin, e as errorResponse, k as jsonResponse } from './helpers-7BvhniSt.js';
+import './provider-constants-1s1k8kbj.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:fs';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+import './endpoints-CU3ehglV.js';
+import './features-DLGlNjZX.js';
+
+//#region src/routes/api/host/logs/+server.ts
+var GET = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:logs", requestId);
+	if (capabilityError) return capabilityError;
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	const state = getState();
+	const url = new URL(event.request.url);
+	const serviceParam = url.searchParams.get("service");
+	const tailParam = url.searchParams.get("tail");
+	const sinceParam = url.searchParams.get("since");
+	const tail = tailParam ? Number(tailParam) : 100;
+	if (tailParam && (!Number.isInteger(tail) || tail < 1 || tail > 1e4)) return errorResponse(400, "invalid_parameter", "tail must be an integer between 1 and 10000", {}, requestId);
+	let services;
+	if (serviceParam) {
+		services = serviceParam.split(",").map((s) => s.trim()).filter(Boolean);
+		const invalid = services.filter((s) => !isAllowedService(s, state.configDir));
+		if (invalid.length > 0) return errorResponse(400, "invalid_service", `Invalid service name(s): ${invalid.join(", ")}`, { invalid }, requestId);
+	}
+	if (sinceParam && !/^[a-zA-Z0-9.:+\-T]+$/.test(sinceParam)) return errorResponse(400, "invalid_parameter", "since contains invalid characters", {}, requestId);
+	if (!(await checkDocker()).ok) return errorResponse(503, "docker_unavailable", "Docker is not available", {}, requestId);
+	const result = await composeLogs(services, tail, {
+		...buildComposeOptions(state),
+		since: sinceParam ?? void 0
+	});
+	if (!result.ok) return jsonResponse(500, {
+		ok: false,
+		logs: "",
+		error: result.stderr
+	}, requestId);
+	return jsonResponse(200, {
+		ok: true,
+		logs: (result.stdout + result.stderr).trim()
+	}, requestId);
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts-Rv6Qmjnm.js.map

package/build/server/chunks/_server.ts-Rv6Qmjnm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-Rv6Qmjnm.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/host/logs/_server.ts.js"],"sourcesContent":["import { t as buildComposeOptions } from \"../../../../../chunks/compose-args.js\";\nimport { f as composeLogs, i as checkDocker } from \"../../../../../chunks/docker.js\";\nimport { O as isAllowedService } from \"../../../../../chunks/src.js\";\nimport { t as getState } from \"../../../../../chunks/state.js\";\nimport { a as getRequestId, c as jsonResponse, d as requireCapability, r as errorResponse, u as requireAdmin } from \"../../../../../chunks/helpers.js\";\n//#region src/routes/api/host/logs/+server.ts\nvar GET = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:logs\", requestId);\n\tif (capabilityError) return capabilityError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst state = getState();\n\tconst url = new URL(event.request.url);\n\tconst serviceParam = url.searchParams.get(\"service\");\n\tconst tailParam = url.searchParams.get(\"tail\");\n\tconst sinceParam = url.searchParams.get(\"since\");\n\tconst tail = tailParam ? Number(tailParam) : 100;\n\tif (tailParam && (!Number.isInteger(tail) || tail < 1 || tail > 1e4)) return errorResponse(400, \"invalid_parameter\", \"tail must be an integer between 1 and 10000\", {}, requestId);\n\tlet services;\n\tif (serviceParam) {\n\t\tservices = serviceParam.split(\",\").map((s) => s.trim()).filter(Boolean);\n\t\tconst invalid = services.filter((s) => !isAllowedService(s, state.configDir));\n\t\tif (invalid.length > 0) return errorResponse(400, \"invalid_service\", `Invalid service name(s): ${invalid.join(\", \")}`, { invalid }, requestId);\n\t}\n\tif (sinceParam && !/^[a-zA-Z0-9.:+\\-T]+$/.test(sinceParam)) return errorResponse(400, \"invalid_parameter\", \"since contains invalid characters\", {}, requestId);\n\tif (!(await checkDocker()).ok) return errorResponse(503, \"docker_unavailable\", \"Docker is not available\", {}, requestId);\n\tconst result = await composeLogs(services, tail, {\n\t\t...buildComposeOptions(state),\n\t\tsince: sinceParam ?? void 0\n\t});\n\tif (!result.ok) return jsonResponse(500, {\n\t\tok: false,\n\t\tlogs: \"\",\n\t\terror: result.stderr\n\t}, requestId);\n\treturn jsonResponse(200, {\n\t\tok: true,\n\t\tlogs: (result.stdout + result.stderr).trim()\n\t}, requestId);\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAKA;AACG,IAAC,GAAG,GAAG,OAAO,KAAK,KAAK;AAC3B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC;AACzE,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,KAAK,GAAG,QAAQ,EAAE;AACzB,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;AACvC,CAAC,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC;AACrD,CAAC,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;AAC/C,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;AACjD,CAAC,MAAM,IAAI,GAAG,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,GAAG;AACjD,CAAC,IAAI,SAAS,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,mBAAmB,EAAE,6CAA6C,EAAE,EAAE,EAAE,SAAS,CAAC;AACnL,CAAC,IAAI,QAAQ;AACb,CAAC,IAAI,YAAY,EAAE;AACnB,EAAE,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;AACzE,EAAE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;AAC/E,EAAE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,iBAAiB,EAAE,CAAC,yBAAyB,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC;AAChJ,CAAC;AACD,CAAC,IAAI,UAAU,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,mBAAmB,EAAE,mCAAmC,EAAE,EAAE,EAAE,SAAS,CAAC;AAC/J,CAAC,IAAI,CAAC,CAAC,MAAM,WAAW,EAAE,EAAE,EAAE,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,EAAE,EAAE,SAAS,CAAC;AACzH,CAAC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE;AAClD,EAAE,GAAG,mBAAmB,CAAC,KAAK,CAAC;AAC/B,EAAE,KAAK,EAAE,UAAU,IAAI;AACvB,EAAE,CAAC;AACH,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,YAAY,CAAC,GAAG,EAAE;AAC1C,EAAE,EAAE,EAAE,KAAK;AACX,EAAE,IAAI,EAAE,EAAE;AACV,EAAE,KAAK,EAAE,MAAM,CAAC;AAChB,EAAE,EAAE,SAAS,CAAC;AACd,CAAC,OAAO,YAAY,CAAC,GAAG,EAAE;AAC1B,EAAE,EAAE,EAAE,IAAI;AACV,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI;AAC5C,EAAE,EAAE,SAAS,CAAC;AACd;;;;"}

package/build/server/chunks/_server.ts-S90K5IJI.js

@@ -0,0 +1,57 @@
+import { d as getRequestId, e as errorResponse, f as getUiLoginPassword, s as safeTokenCompare, b as createSession } from './helpers-7BvhniSt.js';
+import { s as sessionCookieHeader } from './session-cookie-WuIYBiMY.js';
+import './src-CS2sSYOR.js';
+import './provider-constants-1s1k8kbj.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:fs';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+import './endpoints-CU3ehglV.js';
+import './state-BRh7vs9j.js';
+import './features-DLGlNjZX.js';
+
+//#region src/routes/api/auth/login/+server.ts
+var POST = async (event) => {
+	const requestId = getRequestId(event);
+	let body;
+	try {
+		body = await event.request.json();
+	} catch {
+		return errorResponse(400, "bad_request", "Invalid JSON body", {}, requestId);
+	}
+	const password = typeof body.password === "string" ? body.password : "";
+	if (!password) return errorResponse(400, "bad_request", "password is required", {}, requestId);
+	const configured = getUiLoginPassword();
+	if (!configured) return errorResponse(503, "admin_not_configured", "OP_UI_LOGIN_PASSWORD has not been set. Complete setup first.", {}, requestId);
+	if (!safeTokenCompare(password, configured)) return errorResponse(401, "unauthorized", "Invalid password", {}, requestId);
+	const sessionToken = createSession();
+	return new Response(JSON.stringify({
+		ok: true,
+		role: "admin"
+	}), {
+		status: 200,
+		headers: {
+			"content-type": "application/json",
+			"set-cookie": sessionCookieHeader(sessionToken, event.request),
+			"x-request-id": requestId
+		}
+	});
+};
+
+export { POST };
+//# sourceMappingURL=_server.ts-S90K5IJI.js.map

package/build/server/chunks/_server.ts-S90K5IJI.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-S90K5IJI.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/auth/login/_server.ts.js"],"sourcesContent":["import { a as getRequestId, f as safeTokenCompare, g as getUiLoginPassword, h as createSession, r as errorResponse } from \"../../../../../chunks/helpers.js\";\nimport { r as sessionCookieHeader } from \"../../../../../chunks/session-cookie.js\";\n//#region src/routes/api/auth/login/+server.ts\nvar POST = async (event) => {\n\tconst requestId = getRequestId(event);\n\tlet body;\n\ttry {\n\t\tbody = await event.request.json();\n\t} catch {\n\t\treturn errorResponse(400, \"bad_request\", \"Invalid JSON body\", {}, requestId);\n\t}\n\tconst password = typeof body.password === \"string\" ? body.password : \"\";\n\tif (!password) return errorResponse(400, \"bad_request\", \"password is required\", {}, requestId);\n\tconst configured = getUiLoginPassword();\n\tif (!configured) return errorResponse(503, \"admin_not_configured\", \"OP_UI_LOGIN_PASSWORD has not been set. Complete setup first.\", {}, requestId);\n\tif (!safeTokenCompare(password, configured)) return errorResponse(401, \"unauthorized\", \"Invalid password\", {}, requestId);\n\tconst sessionToken = createSession();\n\treturn new Response(JSON.stringify({\n\t\tok: true,\n\t\trole: \"admin\"\n\t}), {\n\t\tstatus: 200,\n\t\theaders: {\n\t\t\t\"content-type\": \"application/json\",\n\t\t\t\"set-cookie\": sessionCookieHeader(sessionToken, event.request),\n\t\t\t\"x-request-id\": requestId\n\t\t}\n\t});\n};\n//#endregion\nexport { POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA;AACG,IAAC,IAAI,GAAG,OAAO,KAAK,KAAK;AAC5B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,IAAI,IAAI;AACT,CAAC,IAAI;AACL,EAAE,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;AACnC,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,mBAAmB,EAAE,EAAE,EAAE,SAAS,CAAC;AAC9E,CAAC;AACD,CAAC,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,GAAG,IAAI,CAAC,QAAQ,GAAG,EAAE;AACxE,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,sBAAsB,EAAE,EAAE,EAAE,SAAS,CAAC;AAC/F,CAAC,MAAM,UAAU,GAAG,kBAAkB,EAAE;AACxC,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,sBAAsB,EAAE,8DAA8D,EAAE,EAAE,EAAE,SAAS,CAAC;AAClJ,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,EAAE,SAAS,CAAC;AAC1H,CAAC,MAAM,YAAY,GAAG,aAAa,EAAE;AACrC,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AACpC,EAAE,EAAE,EAAE,IAAI;AACV,EAAE,IAAI,EAAE;AACR,EAAE,CAAC,EAAE;AACL,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,OAAO,EAAE;AACX,GAAG,cAAc,EAAE,kBAAkB;AACrC,GAAG,YAAY,EAAE,mBAAmB,CAAC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC;AACjE,GAAG,cAAc,EAAE;AACnB;AACA,EAAE,CAAC;AACH;;;;"}

package/build/server/chunks/_server.ts-Y4JoeA12.js

@@ -0,0 +1,141 @@
+import { ai as isVersionKey, G as createLogger, a as acquireInstallLock, n as buildComposeOptions, p as checkDocker, au as patchSecretsEnvFile, e as applyStack, g as applyUpdate, aN as releaseInstallLock } from './src-CS2sSYOR.js';
+import { g as getState } from './state-BRh7vs9j.js';
+import { d as getRequestId, l as requireCapability, r as requireAdmin, e as errorResponse, k as jsonResponse } from './helpers-7BvhniSt.js';
+import { w as withSerialQueue } from './serial-queue-D9FEpYVv.js';
+import './provider-constants-1s1k8kbj.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:fs';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+import './endpoints-CU3ehglV.js';
+import './features-DLGlNjZX.js';
+
+//#region src/routes/api/host/update/+server.ts
+var logger = createLogger("update");
+var POST = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:updates", requestId);
+	if (capabilityError) return capabilityError;
+	logger.info("update request received", { requestId });
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	let service;
+	const targetVersions = {};
+	try {
+		const body = event.request.headers.get("content-type")?.includes("application/json") ? await event.request.json() : {};
+		if (typeof body?.service === "string" && body.service.trim()) service = body.service.trim();
+		if (body?.versions && typeof body.versions === "object") {
+			for (const [k, v] of Object.entries(body.versions)) if (isVersionKey(k) && typeof v === "string" && v.trim()) targetVersions[k] = v.trim();
+		}
+	} catch {}
+	return withSerialQueue("admin:update", async () => {
+		const state = getState();
+		const lock = acquireInstallLock(state.dataDir);
+		if (!lock) {
+			logger.info("update rejected — another install/update is in progress", { requestId });
+			return errorResponse(409, "install_in_progress", "Another install or update is already running. Wait for it to finish, or run 'openpalm unlock' to clear a stale lock.", {}, requestId);
+		}
+		try {
+			const composeOpts = buildComposeOptions(state);
+			if (!(await checkDocker()).ok) {
+				logger.info("Docker unavailable — update rejected", { requestId });
+				return jsonResponse(200, {
+					ok: false,
+					restarted: [],
+					failed: [],
+					dockerAvailable: false,
+					overallSuccess: false
+				}, requestId);
+			}
+			const advanceTargetVersions = () => {
+				if (Object.keys(targetVersions).length === 0) return;
+				patchSecretsEnvFile(state.homeDir, targetVersions);
+				logger.info("advanced versions before recreate", {
+					requestId,
+					targetVersions
+				});
+			};
+			if (service) {
+				advanceTargetVersions();
+				logger.info("scoped service update", {
+					requestId,
+					service
+				});
+				const stackResult = await applyStack({
+					kind: "service",
+					service
+				}, composeOpts);
+				const overallSuccess = stackResult.ok;
+				const status = stackResult.ok ? 200 : 502;
+				logger.info("service update completed", {
+					requestId,
+					service,
+					overallSuccess,
+					startedCount: stackResult.started.length,
+					failedCount: stackResult.failed.length,
+					error: stackResult.error
+				});
+				return jsonResponse(status, {
+					ok: overallSuccess,
+					restarted: stackResult.started,
+					failed: stackResult.failed,
+					dockerAvailable: true,
+					overallSuccess,
+					...stackResult.error ? { error: stackResult.error } : {}
+				}, requestId);
+			}
+			const result = await applyUpdate(state, { lock });
+			logger.info("update applied, running applyStack", {
+				requestId,
+				intended: result.restarted
+			});
+			advanceTargetVersions();
+			const stackResult = await applyStack({ kind: "all" }, composeOpts);
+			const overallSuccess = stackResult.ok;
+			const status = stackResult.ok ? 200 : 502;
+			logger.info("update completed", {
+				requestId,
+				dockerAvailable: true,
+				overallSuccess,
+				startedCount: stackResult.started.length,
+				failedCount: stackResult.failed.length,
+				error: stackResult.error
+			});
+			return jsonResponse(status, {
+				ok: overallSuccess,
+				restarted: stackResult.started,
+				failed: stackResult.failed,
+				dockerAvailable: true,
+				overallSuccess,
+				...stackResult.error ? { error: stackResult.error } : {}
+			}, requestId);
+		} catch (err) {
+			const msg = err instanceof Error ? err.message : String(err);
+			logger.error("update failed", {
+				requestId,
+				error: msg
+			});
+			return errorResponse(500, "update_failed", msg, {}, requestId);
+		} finally {
+			releaseInstallLock(lock);
+		}
+	});
+};
+
+export { POST };
+//# sourceMappingURL=_server.ts-Y4JoeA12.js.map

package/build/server/chunks/_server.ts-Y4JoeA12.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-Y4JoeA12.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/host/update/_server.ts.js"],"sourcesContent":["import { J as patchSecretsEnvFile, L as isVersionKey, Nt as createLogger, a as applyUpdate, p as releaseInstallLock, t as buildComposeOptions, u as acquireInstallLock } from \"../../../../../chunks/compose-args.js\";\nimport { i as checkDocker, t as applyStack } from \"../../../../../chunks/docker.js\";\nimport \"../../../../../chunks/src.js\";\nimport { t as getState } from \"../../../../../chunks/state.js\";\nimport { a as getRequestId, c as jsonResponse, d as requireCapability, r as errorResponse, u as requireAdmin } from \"../../../../../chunks/helpers.js\";\nimport { t as withSerialQueue } from \"../../../../../chunks/serial-queue.js\";\n//#region src/routes/api/host/update/+server.ts\nvar logger = createLogger(\"update\");\nvar POST = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:updates\", requestId);\n\tif (capabilityError) return capabilityError;\n\tlogger.info(\"update request received\", { requestId });\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tlet service;\n\tconst targetVersions = {};\n\ttry {\n\t\tconst body = event.request.headers.get(\"content-type\")?.includes(\"application/json\") ? await event.request.json() : {};\n\t\tif (typeof body?.service === \"string\" && body.service.trim()) service = body.service.trim();\n\t\tif (body?.versions && typeof body.versions === \"object\") {\n\t\t\tfor (const [k, v] of Object.entries(body.versions)) if (isVersionKey(k) && typeof v === \"string\" && v.trim()) targetVersions[k] = v.trim();\n\t\t}\n\t} catch {}\n\treturn withSerialQueue(\"admin:update\", async () => {\n\t\tconst state = getState();\n\t\tconst lock = acquireInstallLock(state.dataDir);\n\t\tif (!lock) {\n\t\t\tlogger.info(\"update rejected — another install/update is in progress\", { requestId });\n\t\t\treturn errorResponse(409, \"install_in_progress\", \"Another install or update is already running. Wait for it to finish, or run 'openpalm unlock' to clear a stale lock.\", {}, requestId);\n\t\t}\n\t\ttry {\n\t\t\tconst composeOpts = buildComposeOptions(state);\n\t\t\tif (!(await checkDocker()).ok) {\n\t\t\t\tlogger.info(\"Docker unavailable — update rejected\", { requestId });\n\t\t\t\treturn jsonResponse(200, {\n\t\t\t\t\tok: false,\n\t\t\t\t\trestarted: [],\n\t\t\t\t\tfailed: [],\n\t\t\t\t\tdockerAvailable: false,\n\t\t\t\t\toverallSuccess: false\n\t\t\t\t}, requestId);\n\t\t\t}\n\t\t\tconst advanceTargetVersions = () => {\n\t\t\t\tif (Object.keys(targetVersions).length === 0) return;\n\t\t\t\tpatchSecretsEnvFile(state.homeDir, targetVersions);\n\t\t\t\tlogger.info(\"advanced versions before recreate\", {\n\t\t\t\t\trequestId,\n\t\t\t\t\ttargetVersions\n\t\t\t\t});\n\t\t\t};\n\t\t\tif (service) {\n\t\t\t\tadvanceTargetVersions();\n\t\t\t\tlogger.info(\"scoped service update\", {\n\t\t\t\t\trequestId,\n\t\t\t\t\tservice\n\t\t\t\t});\n\t\t\t\tconst stackResult = await applyStack({\n\t\t\t\t\tkind: \"service\",\n\t\t\t\t\tservice\n\t\t\t\t}, composeOpts);\n\t\t\t\tconst overallSuccess = stackResult.ok;\n\t\t\t\tconst status = stackResult.ok ? 200 : 502;\n\t\t\t\tlogger.info(\"service update completed\", {\n\t\t\t\t\trequestId,\n\t\t\t\t\tservice,\n\t\t\t\t\toverallSuccess,\n\t\t\t\t\tstartedCount: stackResult.started.length,\n\t\t\t\t\tfailedCount: stackResult.failed.length,\n\t\t\t\t\terror: stackResult.error\n\t\t\t\t});\n\t\t\t\treturn jsonResponse(status, {\n\t\t\t\t\tok: overallSuccess,\n\t\t\t\t\trestarted: stackResult.started,\n\t\t\t\t\tfailed: stackResult.failed,\n\t\t\t\t\tdockerAvailable: true,\n\t\t\t\t\toverallSuccess,\n\t\t\t\t\t...stackResult.error ? { error: stackResult.error } : {}\n\t\t\t\t}, requestId);\n\t\t\t}\n\t\t\tconst result = await applyUpdate(state, { lock });\n\t\t\tlogger.info(\"update applied, running applyStack\", {\n\t\t\t\trequestId,\n\t\t\t\tintended: result.restarted\n\t\t\t});\n\t\t\tadvanceTargetVersions();\n\t\t\tconst stackResult = await applyStack({ kind: \"all\" }, composeOpts);\n\t\t\tconst overallSuccess = stackResult.ok;\n\t\t\tconst status = stackResult.ok ? 200 : 502;\n\t\t\tlogger.info(\"update completed\", {\n\t\t\t\trequestId,\n\t\t\t\tdockerAvailable: true,\n\t\t\t\toverallSuccess,\n\t\t\t\tstartedCount: stackResult.started.length,\n\t\t\t\tfailedCount: stackResult.failed.length,\n\t\t\t\terror: stackResult.error\n\t\t\t});\n\t\t\treturn jsonResponse(status, {\n\t\t\t\tok: overallSuccess,\n\t\t\t\trestarted: stackResult.started,\n\t\t\t\tfailed: stackResult.failed,\n\t\t\t\tdockerAvailable: true,\n\t\t\t\toverallSuccess,\n\t\t\t\t...stackResult.error ? { error: stackResult.error } : {}\n\t\t\t}, requestId);\n\t\t} catch (err) {\n\t\t\tconst msg = err instanceof Error ? err.message : String(err);\n\t\t\tlogger.error(\"update failed\", {\n\t\t\t\trequestId,\n\t\t\t\terror: msg\n\t\t\t});\n\t\t\treturn errorResponse(500, \"update_failed\", msg, {}, requestId);\n\t\t} finally {\n\t\t\treleaseInstallLock(lock);\n\t\t}\n\t});\n};\n//#endregion\nexport { POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAMA;AACA,IAAI,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC;AAChC,IAAC,IAAI,GAAG,OAAO,KAAK,KAAK;AAC5B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC;AAC5E,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,SAAS,EAAE,CAAC;AACtD,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,IAAI,OAAO;AACZ,CAAC,MAAM,cAAc,GAAG,EAAE;AAC1B,CAAC,IAAI;AACL,EAAE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE;AACxH,EAAE,IAAI,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;AAC7F,EAAE,IAAI,IAAI,EAAE,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE;AAC3D,GAAG,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;AAC7I,EAAE;AACF,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,OAAO,eAAe,CAAC,cAAc,EAAE,YAAY;AACpD,EAAE,MAAM,KAAK,GAAG,QAAQ,EAAE;AAC1B,EAAE,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC;AAChD,EAAE,IAAI,CAAC,IAAI,EAAE;AACb,GAAG,MAAM,CAAC,IAAI,CAAC,yDAAyD,EAAE,EAAE,SAAS,EAAE,CAAC;AACxF,GAAG,OAAO,aAAa,CAAC,GAAG,EAAE,qBAAqB,EAAE,sHAAsH,EAAE,EAAE,EAAE,SAAS,CAAC;AAC1L,EAAE;AACF,EAAE,IAAI;AACN,GAAG,MAAM,WAAW,GAAG,mBAAmB,CAAC,KAAK,CAAC;AACjD,GAAG,IAAI,CAAC,CAAC,MAAM,WAAW,EAAE,EAAE,EAAE,EAAE;AAClC,IAAI,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,SAAS,EAAE,CAAC;AACtE,IAAI,OAAO,YAAY,CAAC,GAAG,EAAE;AAC7B,KAAK,EAAE,EAAE,KAAK;AACd,KAAK,SAAS,EAAE,EAAE;AAClB,KAAK,MAAM,EAAE,EAAE;AACf,KAAK,eAAe,EAAE,KAAK;AAC3B,KAAK,cAAc,EAAE;AACrB,KAAK,EAAE,SAAS,CAAC;AACjB,GAAG;AACH,GAAG,MAAM,qBAAqB,GAAG,MAAM;AACvC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE;AAClD,IAAI,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC;AACtD,IAAI,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;AACrD,KAAK,SAAS;AACd,KAAK;AACL,KAAK,CAAC;AACN,GAAG,CAAC;AACJ,GAAG,IAAI,OAAO,EAAE;AAChB,IAAI,qBAAqB,EAAE;AAC3B,IAAI,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;AACzC,KAAK,SAAS;AACd,KAAK;AACL,KAAK,CAAC;AACN,IAAI,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC;AACzC,KAAK,IAAI,EAAE,SAAS;AACpB,KAAK;AACL,KAAK,EAAE,WAAW,CAAC;AACnB,IAAI,MAAM,cAAc,GAAG,WAAW,CAAC,EAAE;AACzC,IAAI,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG;AAC7C,IAAI,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;AAC5C,KAAK,SAAS;AACd,KAAK,OAAO;AACZ,KAAK,cAAc;AACnB,KAAK,YAAY,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM;AAC7C,KAAK,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM;AAC3C,KAAK,KAAK,EAAE,WAAW,CAAC;AACxB,KAAK,CAAC;AACN,IAAI,OAAO,YAAY,CAAC,MAAM,EAAE;AAChC,KAAK,EAAE,EAAE,cAAc;AACvB,KAAK,SAAS,EAAE,WAAW,CAAC,OAAO;AACnC,KAAK,MAAM,EAAE,WAAW,CAAC,MAAM;AAC/B,KAAK,eAAe,EAAE,IAAI;AAC1B,KAAK,cAAc;AACnB,KAAK,GAAG,WAAW,CAAC,KAAK,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,GAAG;AAC3D,KAAK,EAAE,SAAS,CAAC;AACjB,GAAG;AACH,GAAG,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC;AACpD,GAAG,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;AACrD,IAAI,SAAS;AACb,IAAI,QAAQ,EAAE,MAAM,CAAC;AACrB,IAAI,CAAC;AACL,GAAG,qBAAqB,EAAE;AAC1B,GAAG,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,WAAW,CAAC;AACrE,GAAG,MAAM,cAAc,GAAG,WAAW,CAAC,EAAE;AACxC,GAAG,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG;AAC5C,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE;AACnC,IAAI,SAAS;AACb,IAAI,eAAe,EAAE,IAAI;AACzB,IAAI,cAAc;AAClB,IAAI,YAAY,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM;AAC5C,IAAI,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM;AAC1C,IAAI,KAAK,EAAE,WAAW,CAAC;AACvB,IAAI,CAAC;AACL,GAAG,OAAO,YAAY,CAAC,MAAM,EAAE;AAC/B,IAAI,EAAE,EAAE,cAAc;AACtB,IAAI,SAAS,EAAE,WAAW,CAAC,OAAO;AAClC,IAAI,MAAM,EAAE,WAAW,CAAC,MAAM;AAC9B,IAAI,eAAe,EAAE,IAAI;AACzB,IAAI,cAAc;AAClB,IAAI,GAAG,WAAW,CAAC,KAAK,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,GAAG;AAC1D,IAAI,EAAE,SAAS,CAAC;AAChB,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC;AAC/D,GAAG,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE;AACjC,IAAI,SAAS;AACb,IAAI,KAAK,EAAE;AACX,IAAI,CAAC;AACL,GAAG,OAAO,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,CAAC;AACjE,EAAE,CAAC,SAAS;AACZ,GAAG,kBAAkB,CAAC,IAAI,CAAC;AAC3B,EAAE;AACF,CAAC,CAAC,CAAC;AACH;;;;"}

package/build/server/chunks/_server.ts-at5EQV31.js

@@ -0,0 +1,162 @@
+import { ad as importHostOpenCode, R as detectHostOpenCode, j as authJsonPath, p as checkDocker, n as buildComposeOptions } from './src-CS2sSYOR.js';
+import { g as getState } from './state-BRh7vs9j.js';
+import { d as getRequestId, l as requireCapability, r as requireAdmin, p as parseJsonBody, e as errorResponse, k as jsonResponse } from './helpers-7BvhniSt.js';
+import { o as opencodeFetch } from './http-D0qKwTqb.js';
+import { w as withSerialQueue } from './serial-queue-D9FEpYVv.js';
+import { c as composeRestart } from './docker3-DvrSgFLt.js';
+import { existsSync, readFileSync } from 'node:fs';
+import './provider-constants-1s1k8kbj.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+import './endpoints-CU3ehglV.js';
+import './features-DLGlNjZX.js';
+
+//#region src/routes/api/host/providers/import-host/+server.ts
+/**
+* POST /api/host/providers/import-host
+*
+* Copies host OpenCode config + auth into OP_HOME, then pushes each
+* imported credential to the running OpenCode server so the providers
+* appear connected immediately (no restart required).
+*
+* - opencode.json: stripped of plugin/mcp/permission keys, merged with
+*   existing OP_HOME config. Provider conflicts preserved by default.
+* - auth.json: byte-copied and chmodded 0o600. Never logged.
+* - Live push: best-effort PUT to OpenCode /auth/{id} per credential.
+*   If OpenCode is unreachable, the file copy still applies and OpenCode
+*   will pick up the credentials on next restart.
+* - Service restart: assistant is restarted after the import so opencode.json
+*   provider blocks are re-read (live push only updates the auth store, not
+*   config).
+*
+* Body (optional JSON):
+*   { overwriteConflicts?: boolean }   — default false
+*
+* Auth: admin token required.
+*/
+/**
+* Restart services that hold provider state in startup config.
+* Best-effort: the file-level import is the durable part; this is the polish
+* that makes the change visible without the user having to bounce things by hand.
+* OpenCode caches opencode.json provider blocks at startup, so imported
+* provider config needs a fresh assistant process.
+*/
+async function restartProviderConsumers() {
+	const services = ["assistant"];
+	if (!(await checkDocker()).ok) return {
+		restarted: [],
+		failed: services.map((s) => ({
+			service: s,
+			error: "docker unavailable"
+		}))
+	};
+	const opts = buildComposeOptions(getState());
+	const restarted = [];
+	const failed = [];
+	for (const service of services) try {
+		const r = await composeRestart([service], opts);
+		if (r.ok) restarted.push(service);
+		else failed.push({
+			service,
+			error: r.stderr || `exit ${r.code}`
+		});
+	} catch (err) {
+		failed.push({
+			service,
+			error: err instanceof Error ? err.message : String(err)
+		});
+	}
+	return {
+		restarted,
+		failed
+	};
+}
+/** Push each auth.json entry to OpenCode's /auth/{id} so the running process sees them. */
+async function pushAuthToOpenCode(authPath) {
+	let raw;
+	try {
+		raw = JSON.parse(readFileSync(authPath, "utf-8"));
+	} catch {
+		return {
+			pushed: 0,
+			failed: []
+		};
+	}
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return {
+		pushed: 0,
+		failed: []
+	};
+	let pushed = 0;
+	const failed = [];
+	for (const [providerId, value] of Object.entries(raw)) try {
+		await opencodeFetch(`/auth/${encodeURIComponent(providerId)}`, {
+			method: "PUT",
+			body: JSON.stringify(value)
+		});
+		pushed++;
+	} catch {
+		failed.push(providerId);
+	}
+	return {
+		pushed,
+		failed
+	};
+}
+var POST = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:secrets", requestId);
+	if (capabilityError) return capabilityError;
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	return withSerialQueue("admin:providers:import-host", async () => {
+		const state = getState();
+		let overwriteConflicts = false;
+		if ((event.request.headers.get("content-type") ?? "").includes("application/json")) {
+			const parsed = await parseJsonBody(event.request);
+			if (!("error" in parsed)) overwriteConflicts = parsed.data.overwriteConflicts === true;
+		}
+		let result;
+		try {
+			result = importHostOpenCode(state, { overwriteConflicts });
+		} catch (err) {
+			return errorResponse(500, "import_failed", err instanceof Error ? err.message : "Import failed", {}, requestId);
+		}
+		const hostStatus = detectHostOpenCode();
+		let livePush = {
+			pushed: 0,
+			failed: []
+		};
+		const importedAuthPath = authJsonPath(state);
+		if (existsSync(importedAuthPath)) livePush = await pushAuthToOpenCode(importedAuthPath);
+		else if (hostStatus.authPath) livePush = await pushAuthToOpenCode(hostStatus.authPath);
+		const restart = await restartProviderConsumers();
+		return jsonResponse(200, {
+			ok: true,
+			imported: result.imported,
+			conflicts: result.conflicts,
+			livePushed: livePush.pushed,
+			livePushFailed: livePush.failed,
+			restarted: restart.restarted,
+			restartFailed: restart.failed
+		}, requestId);
+	});
+};
+
+export { POST };
+//# sourceMappingURL=_server.ts-at5EQV31.js.map

package/build/server/chunks/_server.ts-at5EQV31.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-at5EQV31.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/host/providers/import-host/_server.ts.js"],"sourcesContent":["import { dt as authJsonPath, t as buildComposeOptions } from \"../../../../../../chunks/compose-args.js\";\nimport { i as checkDocker } from \"../../../../../../chunks/docker.js\";\nimport { o as detectHostOpenCode, s as importHostOpenCode } from \"../../../../../../chunks/src.js\";\nimport { t as getState } from \"../../../../../../chunks/state.js\";\nimport { a as getRequestId, c as jsonResponse, d as requireCapability, l as parseJsonBody, r as errorResponse, u as requireAdmin } from \"../../../../../../chunks/helpers.js\";\nimport { t as opencodeFetch } from \"../../../../../../chunks/http.js\";\nimport { t as withSerialQueue } from \"../../../../../../chunks/serial-queue.js\";\nimport { t as composeRestart } from \"../../../../../../chunks/docker3.js\";\nimport { existsSync, readFileSync } from \"node:fs\";\n//#region src/routes/api/host/providers/import-host/+server.ts\n/**\n* POST /api/host/providers/import-host\n*\n* Copies host OpenCode config + auth into OP_HOME, then pushes each\n* imported credential to the running OpenCode server so the providers\n* appear connected immediately (no restart required).\n*\n* - opencode.json: stripped of plugin/mcp/permission keys, merged with\n*   existing OP_HOME config. Provider conflicts preserved by default.\n* - auth.json: byte-copied and chmodded 0o600. Never logged.\n* - Live push: best-effort PUT to OpenCode /auth/{id} per credential.\n*   If OpenCode is unreachable, the file copy still applies and OpenCode\n*   will pick up the credentials on next restart.\n* - Service restart: assistant is restarted after the import so opencode.json\n*   provider blocks are re-read (live push only updates the auth store, not\n*   config).\n*\n* Body (optional JSON):\n*   { overwriteConflicts?: boolean }   — default false\n*\n* Auth: admin token required.\n*/\n/**\n* Restart services that hold provider state in startup config.\n* Best-effort: the file-level import is the durable part; this is the polish\n* that makes the change visible without the user having to bounce things by hand.\n* OpenCode caches opencode.json provider blocks at startup, so imported\n* provider config needs a fresh assistant process.\n*/\nasync function restartProviderConsumers() {\n\tconst services = [\"assistant\"];\n\tif (!(await checkDocker()).ok) return {\n\t\trestarted: [],\n\t\tfailed: services.map((s) => ({\n\t\t\tservice: s,\n\t\t\terror: \"docker unavailable\"\n\t\t}))\n\t};\n\tconst opts = buildComposeOptions(getState());\n\tconst restarted = [];\n\tconst failed = [];\n\tfor (const service of services) try {\n\t\tconst r = await composeRestart([service], opts);\n\t\tif (r.ok) restarted.push(service);\n\t\telse failed.push({\n\t\t\tservice,\n\t\t\terror: r.stderr || `exit ${r.code}`\n\t\t});\n\t} catch (err) {\n\t\tfailed.push({\n\t\t\tservice,\n\t\t\terror: err instanceof Error ? err.message : String(err)\n\t\t});\n\t}\n\treturn {\n\t\trestarted,\n\t\tfailed\n\t};\n}\n/** Push each auth.json entry to OpenCode's /auth/{id} so the running process sees them. */\nasync function pushAuthToOpenCode(authPath) {\n\tlet raw;\n\ttry {\n\t\traw = JSON.parse(readFileSync(authPath, \"utf-8\"));\n\t} catch {\n\t\treturn {\n\t\t\tpushed: 0,\n\t\t\tfailed: []\n\t\t};\n\t}\n\tif (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return {\n\t\tpushed: 0,\n\t\tfailed: []\n\t};\n\tlet pushed = 0;\n\tconst failed = [];\n\tfor (const [providerId, value] of Object.entries(raw)) try {\n\t\tawait opencodeFetch(`/auth/${encodeURIComponent(providerId)}`, {\n\t\t\tmethod: \"PUT\",\n\t\t\tbody: JSON.stringify(value)\n\t\t});\n\t\tpushed++;\n\t} catch {\n\t\tfailed.push(providerId);\n\t}\n\treturn {\n\t\tpushed,\n\t\tfailed\n\t};\n}\nvar POST = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:secrets\", requestId);\n\tif (capabilityError) return capabilityError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\treturn withSerialQueue(\"admin:providers:import-host\", async () => {\n\t\tconst state = getState();\n\t\tlet overwriteConflicts = false;\n\t\tif ((event.request.headers.get(\"content-type\") ?? \"\").includes(\"application/json\")) {\n\t\t\tconst parsed = await parseJsonBody(event.request);\n\t\t\tif (!(\"error\" in parsed)) overwriteConflicts = parsed.data.overwriteConflicts === true;\n\t\t}\n\t\tlet result;\n\t\ttry {\n\t\t\tresult = importHostOpenCode(state, { overwriteConflicts });\n\t\t} catch (err) {\n\t\t\treturn errorResponse(500, \"import_failed\", err instanceof Error ? err.message : \"Import failed\", {}, requestId);\n\t\t}\n\t\tconst hostStatus = detectHostOpenCode();\n\t\tlet livePush = {\n\t\t\tpushed: 0,\n\t\t\tfailed: []\n\t\t};\n\t\tconst importedAuthPath = authJsonPath(state);\n\t\tif (existsSync(importedAuthPath)) livePush = await pushAuthToOpenCode(importedAuthPath);\n\t\telse if (hostStatus.authPath) livePush = await pushAuthToOpenCode(hostStatus.authPath);\n\t\tconst restart = await restartProviderConsumers();\n\t\treturn jsonResponse(200, {\n\t\t\tok: true,\n\t\t\timported: result.imported,\n\t\t\tconflicts: result.conflicts,\n\t\t\tlivePushed: livePush.pushed,\n\t\t\tlivePushFailed: livePush.failed,\n\t\t\trestarted: restart.restarted,\n\t\t\trestartFailed: restart.failed\n\t\t}, requestId);\n\t});\n};\n//#endregion\nexport { POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AASA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,wBAAwB,GAAG;AAC1C,CAAC,MAAM,QAAQ,GAAG,CAAC,WAAW,CAAC;AAC/B,CAAC,IAAI,CAAC,CAAC,MAAM,WAAW,EAAE,EAAE,EAAE,EAAE,OAAO;AACvC,EAAE,SAAS,EAAE,EAAE;AACf,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AAC/B,GAAG,OAAO,EAAE,CAAC;AACb,GAAG,KAAK,EAAE;AACV,GAAG,CAAC;AACJ,EAAE;AACF,CAAC,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,EAAE,CAAC;AAC7C,CAAC,MAAM,SAAS,GAAG,EAAE;AACrB,CAAC,MAAM,MAAM,GAAG,EAAE;AAClB,CAAC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,IAAI;AACrC,EAAE,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC;AACjD,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;AACnC,OAAO,MAAM,CAAC,IAAI,CAAC;AACnB,GAAG,OAAO;AACV,GAAG,KAAK,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC;AACrC,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,MAAM,CAAC,IAAI,CAAC;AACd,GAAG,OAAO;AACV,GAAG,KAAK,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AACzD,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,OAAO;AACR,EAAE,SAAS;AACX,EAAE;AACF,EAAE;AACF;AACA;AACA,eAAe,kBAAkB,CAAC,QAAQ,EAAE;AAC5C,CAAC,IAAI,GAAG;AACR,CAAC,IAAI;AACL,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO;AACT,GAAG,MAAM,EAAE,CAAC;AACZ,GAAG,MAAM,EAAE;AACX,GAAG;AACH,CAAC;AACD,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO;AACnE,EAAE,MAAM,EAAE,CAAC;AACX,EAAE,MAAM,EAAE;AACV,EAAE;AACF,CAAC,IAAI,MAAM,GAAG,CAAC;AACf,CAAC,MAAM,MAAM,GAAG,EAAE;AAClB,CAAC,KAAK,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI;AAC5D,EAAE,MAAM,aAAa,CAAC,CAAC,MAAM,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;AACjE,GAAG,MAAM,EAAE,KAAK;AAChB,GAAG,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK;AAC7B,GAAG,CAAC;AACJ,EAAE,MAAM,EAAE;AACV,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;AACzB,CAAC;AACD,CAAC,OAAO;AACR,EAAE,MAAM;AACR,EAAE;AACF,EAAE;AACF;AACG,IAAC,IAAI,GAAG,OAAO,KAAK,KAAK;AAC5B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC;AAC5E,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,OAAO,eAAe,CAAC,6BAA6B,EAAE,YAAY;AACnE,EAAE,MAAM,KAAK,GAAG,QAAQ,EAAE;AAC1B,EAAE,IAAI,kBAAkB,GAAG,KAAK;AAChC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE;AACtF,GAAG,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;AACpD,GAAG,IAAI,EAAE,OAAO,IAAI,MAAM,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,KAAK,IAAI;AACzF,EAAE;AACF,EAAE,IAAI,MAAM;AACZ,EAAE,IAAI;AACN,GAAG,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE,EAAE,kBAAkB,EAAE,CAAC;AAC7D,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,OAAO,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,eAAe,EAAE,EAAE,EAAE,SAAS,CAAC;AAClH,EAAE;AACF,EAAE,MAAM,UAAU,GAAG,kBAAkB,EAAE;AACzC,EAAE,IAAI,QAAQ,GAAG;AACjB,GAAG,MAAM,EAAE,CAAC;AACZ,GAAG,MAAM,EAAE;AACX,GAAG;AACH,EAAE,MAAM,gBAAgB,GAAG,YAAY,CAAC,KAAK,CAAC;AAC9C,EAAE,IAAI,UAAU,CAAC,gBAAgB,CAAC,EAAE,QAAQ,GAAG,MAAM,kBAAkB,CAAC,gBAAgB,CAAC;AACzF,OAAO,IAAI,UAAU,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,QAAQ,CAAC;AACxF,EAAE,MAAM,OAAO,GAAG,MAAM,wBAAwB,EAAE;AAClD,EAAE,OAAO,YAAY,CAAC,GAAG,EAAE;AAC3B,GAAG,EAAE,EAAE,IAAI;AACX,GAAG,QAAQ,EAAE,MAAM,CAAC,QAAQ;AAC5B,GAAG,SAAS,EAAE,MAAM,CAAC,SAAS;AAC9B,GAAG,UAAU,EAAE,QAAQ,CAAC,MAAM;AAC9B,GAAG,cAAc,EAAE,QAAQ,CAAC,MAAM;AAClC,GAAG,SAAS,EAAE,OAAO,CAAC,SAAS;AAC/B,GAAG,aAAa,EAAE,OAAO,CAAC;AAC1B,GAAG,EAAE,SAAS,CAAC;AACf,CAAC,CAAC,CAAC;AACH;;;;"}