@openpalm/ui 0.12.52 → 0.13.0-beta.2

package/build/server/chunks/_server.ts-2-50j5S8.js

@@ -0,0 +1,93 @@
+import { b1 as summarizeBackups, al as listBackupDirs, aw as pruneBackupDirs, G as createLogger } from './src-BwQUi60U.js';
+import { g as getState } from './state-Dm7U51xT.js';
+import { d as getRequestId, l as requireCapability, r as requireAdmin, k as jsonResponse, e as errorResponse } from './helpers-q4Ng8QTq.js';
+import './provider-constants-1s1k8kbj.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:fs';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+import './endpoints-B9ePqrMw.js';
+import './features-0lgyQreD.js';
+
+//#region src/routes/api/host/backups/+server.ts
+var logger = createLogger("backups-admin");
+/**
+* #499 — backup visibility. Returns count, total size, last-backup time and a
+* per-backup list (newest first) so the UI can surface the recovery net.
+* Read-only.
+*/
+var GET = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:recovery", requestId);
+	if (capabilityError) return capabilityError;
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	const state = getState();
+	try {
+		return jsonResponse(200, {
+			ok: true,
+			...summarizeBackups(state.homeDir)
+		}, requestId);
+	} catch (e) {
+		return errorResponse(500, "backups_list_failed", e instanceof Error ? e.message : String(e), {}, requestId);
+	}
+};
+/**
+* #499 — drives the EXISTING confirm-gated prune. The UI must pass an explicit
+* `keep` count (the confirmation is the UI's modal); this NEVER auto-prunes and
+* keeps the newest `keep` snapshots, deleting only the older ones.
+*/
+var POST = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:recovery", requestId);
+	if (capabilityError) return capabilityError;
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	let body;
+	try {
+		body = await event.request.json();
+	} catch {
+		body = {};
+	}
+	const keep = Number(body.keep);
+	if (!Number.isInteger(keep) || keep < 0) return errorResponse(400, "invalid_keep", "`keep` must be a non-negative integer", {}, requestId);
+	const state = getState();
+	try {
+		if (listBackupDirs(state.homeDir).slice(keep).length === 0) return jsonResponse(200, {
+			ok: true,
+			deleted: [],
+			kept: keep
+		}, requestId);
+		const deleted = pruneBackupDirs(state.homeDir, keep);
+		logger.info("pruned backups via admin", {
+			requestId,
+			deleted: deleted.length,
+			kept: keep
+		});
+		return jsonResponse(200, {
+			ok: true,
+			deleted,
+			kept: keep
+		}, requestId);
+	} catch (e) {
+		return errorResponse(500, "backups_prune_failed", e instanceof Error ? e.message : String(e), {}, requestId);
+	}
+};
+
+export { GET, POST };
+//# sourceMappingURL=_server.ts-2-50j5S8.js.map

package/build/server/chunks/_server.ts-2-50j5S8.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-2-50j5S8.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/host/backups/_server.ts.js"],"sourcesContent":["import { At as pruneBackupDirs, Nt as createLogger, jt as summarizeBackups, kt as listBackupDirs } from \"../../../../../chunks/compose-args.js\";\nimport \"../../../../../chunks/src.js\";\nimport { t as getState } from \"../../../../../chunks/state.js\";\nimport { a as getRequestId, c as jsonResponse, d as requireCapability, r as errorResponse, u as requireAdmin } from \"../../../../../chunks/helpers.js\";\n//#region src/routes/api/host/backups/+server.ts\nvar logger = createLogger(\"backups-admin\");\n/**\n* #499 — backup visibility. Returns count, total size, last-backup time and a\n* per-backup list (newest first) so the UI can surface the recovery net.\n* Read-only.\n*/\nvar GET = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:recovery\", requestId);\n\tif (capabilityError) return capabilityError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst state = getState();\n\ttry {\n\t\treturn jsonResponse(200, {\n\t\t\tok: true,\n\t\t\t...summarizeBackups(state.homeDir)\n\t\t}, requestId);\n\t} catch (e) {\n\t\treturn errorResponse(500, \"backups_list_failed\", e instanceof Error ? e.message : String(e), {}, requestId);\n\t}\n};\n/**\n* #499 — drives the EXISTING confirm-gated prune. The UI must pass an explicit\n* `keep` count (the confirmation is the UI's modal); this NEVER auto-prunes and\n* keeps the newest `keep` snapshots, deleting only the older ones.\n*/\nvar POST = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:recovery\", requestId);\n\tif (capabilityError) return capabilityError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tlet body;\n\ttry {\n\t\tbody = await event.request.json();\n\t} catch {\n\t\tbody = {};\n\t}\n\tconst keep = Number(body.keep);\n\tif (!Number.isInteger(keep) || keep < 0) return errorResponse(400, \"invalid_keep\", \"`keep` must be a non-negative integer\", {}, requestId);\n\tconst state = getState();\n\ttry {\n\t\tif (listBackupDirs(state.homeDir).slice(keep).length === 0) return jsonResponse(200, {\n\t\t\tok: true,\n\t\t\tdeleted: [],\n\t\t\tkept: keep\n\t\t}, requestId);\n\t\tconst deleted = pruneBackupDirs(state.homeDir, keep);\n\t\tlogger.info(\"pruned backups via admin\", {\n\t\t\trequestId,\n\t\t\tdeleted: deleted.length,\n\t\t\tkept: keep\n\t\t});\n\t\treturn jsonResponse(200, {\n\t\t\tok: true,\n\t\t\tdeleted,\n\t\t\tkept: keep\n\t\t}, requestId);\n\t} catch (e) {\n\t\treturn errorResponse(500, \"backups_prune_failed\", e instanceof Error ? e.message : String(e), {}, requestId);\n\t}\n};\n//#endregion\nexport { GET, POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAIA;AACA,IAAI,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC;AAC1C;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,KAAK,KAAK;AAC3B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,SAAS,CAAC;AAC7E,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,KAAK,GAAG,QAAQ,EAAE;AACzB,CAAC,IAAI;AACL,EAAE,OAAO,YAAY,CAAC,GAAG,EAAE;AAC3B,GAAG,EAAE,EAAE,IAAI;AACX,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO;AACpC,GAAG,EAAE,SAAS,CAAC;AACf,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,qBAAqB,EAAE,CAAC,YAAY,KAAK,GAAG,CAAC,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC;AAC7G,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,IAAI,GAAG,OAAO,KAAK,KAAK;AAC5B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,SAAS,CAAC;AAC7E,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,IAAI,IAAI;AACT,CAAC,IAAI;AACL,EAAE,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;AACnC,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,IAAI,GAAG,EAAE;AACX,CAAC;AACD,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;AAC/B,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,uCAAuC,EAAE,EAAE,EAAE,SAAS,CAAC;AAC3I,CAAC,MAAM,KAAK,GAAG,QAAQ,EAAE;AACzB,CAAC,IAAI;AACL,EAAE,IAAI,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,YAAY,CAAC,GAAG,EAAE;AACvF,GAAG,EAAE,EAAE,IAAI;AACX,GAAG,OAAO,EAAE,EAAE;AACd,GAAG,IAAI,EAAE;AACT,GAAG,EAAE,SAAS,CAAC;AACf,EAAE,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC;AACtD,EAAE,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;AAC1C,GAAG,SAAS;AACZ,GAAG,OAAO,EAAE,OAAO,CAAC,MAAM;AAC1B,GAAG,IAAI,EAAE;AACT,GAAG,CAAC;AACJ,EAAE,OAAO,YAAY,CAAC,GAAG,EAAE;AAC3B,GAAG,EAAE,EAAE,IAAI;AACX,GAAG,OAAO;AACV,GAAG,IAAI,EAAE;AACT,GAAG,EAAE,SAAS,CAAC;AACf,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,sBAAsB,EAAE,CAAC,YAAY,KAAK,GAAG,CAAC,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC;AAC9G,CAAC;AACD;;;;"}

package/build/server/chunks/_server.ts-2Z0JYuCr.js

@@ -0,0 +1,61 @@
+import { W as disableHostAkmSharing, a9 as getHostAkmSharingStatus, Z as enableHostAkmSharing } from './src-BwQUi60U.js';
+import { g as getState } from './state-Dm7U51xT.js';
+import { d as getRequestId, l as requireCapability, r as requireAdmin, k as jsonResponse } from './helpers-q4Ng8QTq.js';
+import './provider-constants-1s1k8kbj.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:fs';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+import './endpoints-B9ePqrMw.js';
+import './features-0lgyQreD.js';
+
+//#region src/routes/api/host/akm/host-sharing/+server.ts
+var GET = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:akm-sharing", requestId);
+	if (capabilityError) return capabilityError;
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	return jsonResponse(200, getHostAkmSharingStatus(getState()), requestId);
+};
+var PUT = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:akm-sharing", requestId);
+	if (capabilityError) return capabilityError;
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	const state = getState();
+	const { profilesImported } = enableHostAkmSharing(state);
+	return jsonResponse(200, {
+		...getHostAkmSharingStatus(state),
+		profilesImported
+	}, requestId);
+};
+var DELETE = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:akm-sharing", requestId);
+	if (capabilityError) return capabilityError;
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	const state = getState();
+	disableHostAkmSharing(state);
+	return jsonResponse(200, getHostAkmSharingStatus(state), requestId);
+};
+
+export { DELETE, GET, PUT };
+//# sourceMappingURL=_server.ts-2Z0JYuCr.js.map

package/build/server/chunks/_server.ts-2Z0JYuCr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-2Z0JYuCr.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/host/akm/host-sharing/_server.ts.js"],"sourcesContent":["import { C as enableHostAkmSharing, S as disableHostAkmSharing, w as getHostAkmSharingStatus } from \"../../../../../../chunks/src.js\";\nimport { t as getState } from \"../../../../../../chunks/state.js\";\nimport { a as getRequestId, c as jsonResponse, d as requireCapability, u as requireAdmin } from \"../../../../../../chunks/helpers.js\";\n//#region src/routes/api/host/akm/host-sharing/+server.ts\nvar GET = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:akm-sharing\", requestId);\n\tif (capabilityError) return capabilityError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\treturn jsonResponse(200, getHostAkmSharingStatus(getState()), requestId);\n};\nvar PUT = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:akm-sharing\", requestId);\n\tif (capabilityError) return capabilityError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst state = getState();\n\tconst { profilesImported } = enableHostAkmSharing(state);\n\treturn jsonResponse(200, {\n\t\t...getHostAkmSharingStatus(state),\n\t\tprofilesImported\n\t}, requestId);\n};\nvar DELETE = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:akm-sharing\", requestId);\n\tif (capabilityError) return capabilityError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst state = getState();\n\tdisableHostAkmSharing(state);\n\treturn jsonResponse(200, getHostAkmSharingStatus(state), requestId);\n};\n//#endregion\nexport { DELETE, GET, PUT };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAGA;AACG,IAAC,GAAG,GAAG,OAAO,KAAK,KAAK;AAC3B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,EAAE,SAAS,CAAC;AAChF,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,OAAO,YAAY,CAAC,GAAG,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC,EAAE,SAAS,CAAC;AACzE;AACG,IAAC,GAAG,GAAG,OAAO,KAAK,KAAK;AAC3B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,EAAE,SAAS,CAAC;AAChF,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,KAAK,GAAG,QAAQ,EAAE;AACzB,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC;AACzD,CAAC,OAAO,YAAY,CAAC,GAAG,EAAE;AAC1B,EAAE,GAAG,uBAAuB,CAAC,KAAK,CAAC;AACnC,EAAE;AACF,EAAE,EAAE,SAAS,CAAC;AACd;AACG,IAAC,MAAM,GAAG,OAAO,KAAK,KAAK;AAC9B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,EAAE,SAAS,CAAC;AAChF,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,KAAK,GAAG,QAAQ,EAAE;AACzB,CAAC,qBAAqB,CAAC,KAAK,CAAC;AAC7B,CAAC,OAAO,YAAY,CAAC,GAAG,EAAE,uBAAuB,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;AACpE;;;;"}

package/build/server/chunks/_server.ts-42ZGRWhn.js

@@ -0,0 +1,58 @@
+import { j as json } from './exports-CcmcYU0M.js';
+import { g as getOpenCodeClient } from './helpers-q4Ng8QTq.js';
+import './utils-OXHIhUb5.js';
+import './src-BwQUi60U.js';
+import './provider-constants-1s1k8kbj.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:fs';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+import './endpoints-B9ePqrMw.js';
+import './state-Dm7U51xT.js';
+import './features-0lgyQreD.js';
+
+//#region src/routes/api/setup/opencode/provider/[provider]/oauth/callback/+server.ts
+var PROVIDER_ID_RE = /^[a-zA-Z0-9_-]{1,64}$/;
+var POST = async ({ params, request }) => {
+	if (!PROVIDER_ID_RE.test(params.provider)) return json({
+		ok: false,
+		message: "Invalid provider"
+	}, { status: 400 });
+	try {
+		const body = await request.json();
+		const method = Number.isInteger(body.method) ? body.method : 0;
+		const code = typeof body.code === "string" ? body.code.slice(0, 1024) : void 0;
+		const result = await getOpenCodeClient().completeProviderOAuth(params.provider, method, code);
+		if (!result.ok) return json({
+			ok: false,
+			message: "OAuth callback failed"
+		}, { status: 400 });
+		return json({
+			ok: true,
+			complete: result.data
+		});
+	} catch {
+		return json({
+			ok: false,
+			message: "OAuth callback failed"
+		}, { status: 500 });
+	}
+};
+
+export { POST };
+//# sourceMappingURL=_server.ts-42ZGRWhn.js.map

package/build/server/chunks/_server.ts-42ZGRWhn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-42ZGRWhn.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/setup/opencode/provider/_provider_/oauth/callback/_server.ts.js"],"sourcesContent":["import { r as json } from \"../../../../../../../../../chunks/exports.js\";\nimport { i as getOpenCodeClient } from \"../../../../../../../../../chunks/helpers.js\";\n//#region src/routes/api/setup/opencode/provider/[provider]/oauth/callback/+server.ts\nvar PROVIDER_ID_RE = /^[a-zA-Z0-9_-]{1,64}$/;\nvar POST = async ({ params, request }) => {\n\tif (!PROVIDER_ID_RE.test(params.provider)) return json({\n\t\tok: false,\n\t\tmessage: \"Invalid provider\"\n\t}, { status: 400 });\n\ttry {\n\t\tconst body = await request.json();\n\t\tconst method = Number.isInteger(body.method) ? body.method : 0;\n\t\tconst code = typeof body.code === \"string\" ? body.code.slice(0, 1024) : void 0;\n\t\tconst result = await getOpenCodeClient().completeProviderOAuth(params.provider, method, code);\n\t\tif (!result.ok) return json({\n\t\t\tok: false,\n\t\t\tmessage: \"OAuth callback failed\"\n\t\t}, { status: 400 });\n\t\treturn json({\n\t\t\tok: true,\n\t\t\tcomplete: result.data\n\t\t});\n\t} catch {\n\t\treturn json({\n\t\t\tok: false,\n\t\t\tmessage: \"OAuth callback failed\"\n\t\t}, { status: 500 });\n\t}\n};\n//#endregion\nexport { POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA;AACA,IAAI,cAAc,GAAG,uBAAuB;AACzC,IAAC,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK;AAC1C,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI,CAAC;AACxD,EAAE,EAAE,EAAE,KAAK;AACX,EAAE,OAAO,EAAE;AACX,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACpB,CAAC,IAAI;AACL,EAAE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE;AACnC,EAAE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC;AAChE,EAAE,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;AAChF,EAAE,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC;AAC/F,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,IAAI,CAAC;AAC9B,GAAG,EAAE,EAAE,KAAK;AACZ,GAAG,OAAO,EAAE;AACZ,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACrB,EAAE,OAAO,IAAI,CAAC;AACd,GAAG,EAAE,EAAE,IAAI;AACX,GAAG,QAAQ,EAAE,MAAM,CAAC;AACpB,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,IAAI,CAAC;AACd,GAAG,EAAE,EAAE,KAAK;AACZ,GAAG,OAAO,EAAE;AACZ,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACrB,CAAC;AACD;;;;"}

package/build/server/chunks/_server.ts-6EuPIrt7.js

@@ -0,0 +1,88 @@
+import { G as createLogger, a as acquireInstallLock, d as applyInstall, p as checkDocker, e as applyStack, n as buildComposeOptions, aN as releaseInstallLock } from './src-BwQUi60U.js';
+import { g as getState } from './state-Dm7U51xT.js';
+import { d as getRequestId, l as requireCapability, r as requireAdmin, e as errorResponse, k as jsonResponse } from './helpers-q4Ng8QTq.js';
+import { w as withSerialQueue } from './serial-queue-D9FEpYVv.js';
+import './provider-constants-1s1k8kbj.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:fs';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+import './endpoints-B9ePqrMw.js';
+import './features-0lgyQreD.js';
+
+//#region src/routes/api/host/install/+server.ts
+var logger = createLogger("install");
+var POST = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:setup", requestId);
+	if (capabilityError) return capabilityError;
+	logger.info("install request received", { requestId });
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	return withSerialQueue("admin:install", async () => {
+		const state = getState();
+		const lock = acquireInstallLock(state.dataDir);
+		if (!lock) {
+			logger.info("install rejected — another install/update is in progress", { requestId });
+			return errorResponse(409, "install_in_progress", "Another install or update is already running. Wait for it to finish, or run 'openpalm unlock' to clear a stale lock.", {}, requestId);
+		}
+		try {
+			await applyInstall(state, { lock });
+			if (!(await checkDocker()).ok) {
+				logger.info("install completed (Docker unavailable — stack not started)", { requestId });
+				return jsonResponse(200, {
+					ok: true,
+					started: [],
+					failed: [],
+					dockerAvailable: false,
+					overallSuccess: true
+				}, requestId);
+			}
+			const stackResult = await applyStack({ kind: "all" }, buildComposeOptions(state));
+			const overallSuccess = stackResult.ok;
+			const status = stackResult.ok ? 200 : 502;
+			logger.info("install completed", {
+				requestId,
+				dockerAvailable: true,
+				overallSuccess,
+				startedCount: stackResult.started.length,
+				failedCount: stackResult.failed.length
+			});
+			return jsonResponse(status, {
+				ok: overallSuccess,
+				started: stackResult.started,
+				failed: stackResult.failed,
+				dockerAvailable: true,
+				overallSuccess,
+				...stackResult.error ? { error: stackResult.error } : {}
+			}, requestId);
+		} catch (err) {
+			const msg = err instanceof Error ? err.message : String(err);
+			logger.error("install failed", {
+				requestId,
+				error: msg
+			});
+			return errorResponse(500, "install_failed", msg, {}, requestId);
+		} finally {
+			releaseInstallLock(lock);
+		}
+	});
+};
+
+export { POST };
+//# sourceMappingURL=_server.ts-6EuPIrt7.js.map

package/build/server/chunks/_server.ts-6EuPIrt7.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-6EuPIrt7.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/host/install/_server.ts.js"],"sourcesContent":["import { Nt as createLogger, p as releaseInstallLock, r as applyInstall, t as buildComposeOptions, u as acquireInstallLock } from \"../../../../../chunks/compose-args.js\";\nimport { i as checkDocker, t as applyStack } from \"../../../../../chunks/docker.js\";\nimport \"../../../../../chunks/src.js\";\nimport { t as getState } from \"../../../../../chunks/state.js\";\nimport { a as getRequestId, c as jsonResponse, d as requireCapability, r as errorResponse, u as requireAdmin } from \"../../../../../chunks/helpers.js\";\nimport { t as withSerialQueue } from \"../../../../../chunks/serial-queue.js\";\n//#region src/routes/api/host/install/+server.ts\nvar logger = createLogger(\"install\");\nvar POST = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:setup\", requestId);\n\tif (capabilityError) return capabilityError;\n\tlogger.info(\"install request received\", { requestId });\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\treturn withSerialQueue(\"admin:install\", async () => {\n\t\tconst state = getState();\n\t\tconst lock = acquireInstallLock(state.dataDir);\n\t\tif (!lock) {\n\t\t\tlogger.info(\"install rejected — another install/update is in progress\", { requestId });\n\t\t\treturn errorResponse(409, \"install_in_progress\", \"Another install or update is already running. Wait for it to finish, or run 'openpalm unlock' to clear a stale lock.\", {}, requestId);\n\t\t}\n\t\ttry {\n\t\t\tawait applyInstall(state, { lock });\n\t\t\tif (!(await checkDocker()).ok) {\n\t\t\t\tlogger.info(\"install completed (Docker unavailable — stack not started)\", { requestId });\n\t\t\t\treturn jsonResponse(200, {\n\t\t\t\t\tok: true,\n\t\t\t\t\tstarted: [],\n\t\t\t\t\tfailed: [],\n\t\t\t\t\tdockerAvailable: false,\n\t\t\t\t\toverallSuccess: true\n\t\t\t\t}, requestId);\n\t\t\t}\n\t\t\tconst stackResult = await applyStack({ kind: \"all\" }, buildComposeOptions(state));\n\t\t\tconst overallSuccess = stackResult.ok;\n\t\t\tconst status = stackResult.ok ? 200 : 502;\n\t\t\tlogger.info(\"install completed\", {\n\t\t\t\trequestId,\n\t\t\t\tdockerAvailable: true,\n\t\t\t\toverallSuccess,\n\t\t\t\tstartedCount: stackResult.started.length,\n\t\t\t\tfailedCount: stackResult.failed.length\n\t\t\t});\n\t\t\treturn jsonResponse(status, {\n\t\t\t\tok: overallSuccess,\n\t\t\t\tstarted: stackResult.started,\n\t\t\t\tfailed: stackResult.failed,\n\t\t\t\tdockerAvailable: true,\n\t\t\t\toverallSuccess,\n\t\t\t\t...stackResult.error ? { error: stackResult.error } : {}\n\t\t\t}, requestId);\n\t\t} catch (err) {\n\t\t\tconst msg = err instanceof Error ? err.message : String(err);\n\t\t\tlogger.error(\"install failed\", {\n\t\t\t\trequestId,\n\t\t\t\terror: msg\n\t\t\t});\n\t\t\treturn errorResponse(500, \"install_failed\", msg, {}, requestId);\n\t\t} finally {\n\t\t\treleaseInstallLock(lock);\n\t\t}\n\t});\n};\n//#endregion\nexport { POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAMA;AACA,IAAI,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC;AACjC,IAAC,IAAI,GAAG,OAAO,KAAK,KAAK;AAC5B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,SAAS,CAAC;AAC1E,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,SAAS,EAAE,CAAC;AACvD,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,OAAO,eAAe,CAAC,eAAe,EAAE,YAAY;AACrD,EAAE,MAAM,KAAK,GAAG,QAAQ,EAAE;AAC1B,EAAE,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC;AAChD,EAAE,IAAI,CAAC,IAAI,EAAE;AACb,GAAG,MAAM,CAAC,IAAI,CAAC,0DAA0D,EAAE,EAAE,SAAS,EAAE,CAAC;AACzF,GAAG,OAAO,aAAa,CAAC,GAAG,EAAE,qBAAqB,EAAE,sHAAsH,EAAE,EAAE,EAAE,SAAS,CAAC;AAC1L,EAAE;AACF,EAAE,IAAI;AACN,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC;AACtC,GAAG,IAAI,CAAC,CAAC,MAAM,WAAW,EAAE,EAAE,EAAE,EAAE;AAClC,IAAI,MAAM,CAAC,IAAI,CAAC,4DAA4D,EAAE,EAAE,SAAS,EAAE,CAAC;AAC5F,IAAI,OAAO,YAAY,CAAC,GAAG,EAAE;AAC7B,KAAK,EAAE,EAAE,IAAI;AACb,KAAK,OAAO,EAAE,EAAE;AAChB,KAAK,MAAM,EAAE,EAAE;AACf,KAAK,eAAe,EAAE,KAAK;AAC3B,KAAK,cAAc,EAAE;AACrB,KAAK,EAAE,SAAS,CAAC;AACjB,GAAG;AACH,GAAG,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC;AACpF,GAAG,MAAM,cAAc,GAAG,WAAW,CAAC,EAAE;AACxC,GAAG,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG;AAC5C,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE;AACpC,IAAI,SAAS;AACb,IAAI,eAAe,EAAE,IAAI;AACzB,IAAI,cAAc;AAClB,IAAI,YAAY,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM;AAC5C,IAAI,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC;AACpC,IAAI,CAAC;AACL,GAAG,OAAO,YAAY,CAAC,MAAM,EAAE;AAC/B,IAAI,EAAE,EAAE,cAAc;AACtB,IAAI,OAAO,EAAE,WAAW,CAAC,OAAO;AAChC,IAAI,MAAM,EAAE,WAAW,CAAC,MAAM;AAC9B,IAAI,eAAe,EAAE,IAAI;AACzB,IAAI,cAAc;AAClB,IAAI,GAAG,WAAW,CAAC,KAAK,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,GAAG;AAC1D,IAAI,EAAE,SAAS,CAAC;AAChB,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC;AAC/D,GAAG,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE;AAClC,IAAI,SAAS;AACb,IAAI,KAAK,EAAE;AACX,IAAI,CAAC;AACL,GAAG,OAAO,aAAa,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,CAAC;AAClE,EAAE,CAAC,SAAS;AACZ,GAAG,kBAAkB,CAAC,IAAI,CAAC;AAC3B,EAAE;AACF,CAAC,CAAC,CAAC;AACH;;;;"}

package/build/server/chunks/_server.ts-6muCM4Nz.js

@@ -0,0 +1,44 @@
+import { j as json } from './exports-CcmcYU0M.js';
+import { ah as isSetupComplete, aV as resolveOpenPalmHome, a4 as getAddonProfileSelection, c as annotateAddonProfileAvailability, a5 as getAddonProfiles } from './src-BwQUi60U.js';
+import { g as getState } from './state-Dm7U51xT.js';
+import { r as requireAdmin, d as getRequestId } from './helpers-q4Ng8QTq.js';
+import './utils-OXHIhUb5.js';
+import './provider-constants-1s1k8kbj.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:fs';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+import './endpoints-B9ePqrMw.js';
+import './features-0lgyQreD.js';
+
+//#region src/routes/api/setup/ollama-profiles/+server.ts
+var GET = async (event) => {
+	if (isSetupComplete(resolveOpenPalmHome())) {
+		const authError = requireAdmin(event, getRequestId(event));
+		if (authError) return authError;
+	}
+	const state = getState();
+	return json({
+		ok: true,
+		profiles: await annotateAddonProfileAvailability(getAddonProfiles(state.homeDir, "ollama")),
+		selectedProfile: getAddonProfileSelection(state.stackDir, "ollama")
+	});
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts-6muCM4Nz.js.map

package/build/server/chunks/_server.ts-6muCM4Nz.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-6muCM4Nz.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/setup/ollama-profiles/_server.ts.js"],"sourcesContent":["import { r as json } from \"../../../../../chunks/exports.js\";\nimport { Tt as resolveOpenPalmHome, b as getAddonProfileSelection, x as getAddonProfiles, y as annotateAddonProfileAvailability } from \"../../../../../chunks/compose-args.js\";\nimport { z as isSetupComplete } from \"../../../../../chunks/src.js\";\nimport { t as getState } from \"../../../../../chunks/state.js\";\nimport { a as getRequestId, u as requireAdmin } from \"../../../../../chunks/helpers.js\";\n//#region src/routes/api/setup/ollama-profiles/+server.ts\nvar GET = async (event) => {\n\tif (isSetupComplete(resolveOpenPalmHome())) {\n\t\tconst authError = requireAdmin(event, getRequestId(event));\n\t\tif (authError) return authError;\n\t}\n\tconst state = getState();\n\treturn json({\n\t\tok: true,\n\t\tprofiles: await annotateAddonProfileAvailability(getAddonProfiles(state.homeDir, \"ollama\")),\n\t\tselectedProfile: getAddonProfileSelection(state.stackDir, \"ollama\")\n\t});\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKA;AACG,IAAC,GAAG,GAAG,OAAO,KAAK,KAAK;AAC3B,CAAC,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAC,EAAE;AAC7C,EAAE,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;AAC5D,EAAE,IAAI,SAAS,EAAE,OAAO,SAAS;AACjC,CAAC;AACD,CAAC,MAAM,KAAK,GAAG,QAAQ,EAAE;AACzB,CAAC,OAAO,IAAI,CAAC;AACb,EAAE,EAAE,EAAE,IAAI;AACV,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAC7F,EAAE,eAAe,EAAE,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ;AACpE,EAAE,CAAC;AACH;;;;"}

package/build/server/chunks/_server.ts-B28SfXaZ.js

@@ -0,0 +1,172 @@
+import { G as createLogger } from './src-BwQUi60U.js';
+import { d as getRequestId, l as requireCapability, r as requireAdmin, e as errorResponse, g as getOpenCodeClient, k as jsonResponse, p as parseJsonBody, j as jsonBodyError } from './helpers-q4Ng8QTq.js';
+import './provider-constants-1s1k8kbj.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:fs';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+import './endpoints-B9ePqrMw.js';
+import './state-Dm7U51xT.js';
+import './features-0lgyQreD.js';
+
+//#region src/routes/api/host/opencode/providers/[id]/auth/+server.ts
+var logger = createLogger("opencode.auth");
+var MAX_API_KEY_LENGTH = 512;
+var API_KEY_PATTERN = /^[\x20-\x7E]+$/;
+var OAUTH_SESSION_TTL_MS = 6e5;
+var MAX_PROVIDER_ID_LENGTH = 128;
+var PROVIDER_ID_PATTERN = /^[a-zA-Z0-9_.-]+$/;
+function validateApiKey(key) {
+	if (key.length > MAX_API_KEY_LENGTH) return "API key exceeds maximum length";
+	if (!API_KEY_PATTERN.test(key)) return "API key contains invalid characters";
+	return null;
+}
+var oauthSessions = /* @__PURE__ */ new Map();
+function purgeExpiredSessions() {
+	const now = Date.now();
+	for (const [token, session] of oauthSessions) if (now - session.createdAt > OAUTH_SESSION_TTL_MS) oauthSessions.delete(token);
+}
+var GET = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:secrets", requestId);
+	if (capabilityError) return capabilityError;
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	const pollToken = event.url.searchParams.get("pollToken");
+	if (!pollToken) return errorResponse(400, "bad_request", "pollToken query parameter is required", {}, requestId);
+	purgeExpiredSessions();
+	const session = oauthSessions.get(pollToken);
+	if (!session) return errorResponse(404, "not_found", "Poll session not found or expired", {}, requestId);
+	if (event.params.id !== session.providerId) return errorResponse(400, "bad_request", "Provider ID does not match poll session", {}, requestId);
+	if ((await getOpenCodeClient().completeProviderOAuth(session.providerId, session.methodIndex)).ok) {
+		oauthSessions.delete(pollToken);
+		logger.info("oauth authorization completed", {
+			providerId: session.providerId,
+			requestId
+		});
+		return jsonResponse(200, {
+			status: "complete",
+			message: "Authorization successful"
+		}, requestId);
+	}
+	if (Date.now() - session.createdAt > OAUTH_SESSION_TTL_MS) {
+		oauthSessions.delete(pollToken);
+		return jsonResponse(200, {
+			status: "error",
+			message: "Authorization session expired"
+		}, requestId);
+	}
+	return jsonResponse(200, {
+		status: "pending",
+		message: "Waiting for authorization..."
+	}, requestId);
+};
+var POST = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:secrets", requestId);
+	if (capabilityError) return capabilityError;
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	const result = await parseJsonBody(event.request);
+	if ("error" in result) return jsonBodyError(result, requestId);
+	const body = result.data;
+	const providerId = event.params.id;
+	const mode = typeof body.mode === "string" ? body.mode : "";
+	if (!providerId || providerId.length > MAX_PROVIDER_ID_LENGTH || !PROVIDER_ID_PATTERN.test(providerId)) return errorResponse(400, "bad_request", "Invalid provider ID", {}, requestId);
+	purgeExpiredSessions();
+	if (mode === "api_key") {
+		const apiKey = typeof body.apiKey === "string" ? body.apiKey.trim() : "";
+		if (!apiKey) return errorResponse(400, "bad_request", "apiKey is required for api_key mode", {}, requestId);
+		const keyError = validateApiKey(apiKey);
+		if (keyError) return errorResponse(400, "bad_request", keyError, {}, requestId);
+		const result = await getOpenCodeClient().setProviderApiKey(providerId, apiKey);
+		if (!result.ok) {
+			logger.warn("provider api key save failed", {
+				providerId,
+				requestId,
+				error: result.code
+			});
+			return errorResponse(result.status, result.code, result.message, {}, requestId);
+		}
+		logger.info("provider API key saved to OpenCode auth.json", {
+			providerId,
+			requestId
+		});
+		return jsonResponse(200, {
+			ok: true,
+			mode: "api_key"
+		}, requestId);
+	}
+	if (mode === "oauth") {
+		if (typeof body.methodIndex !== "undefined" && (typeof body.methodIndex !== "number" || !Number.isInteger(body.methodIndex) || body.methodIndex < 0)) return errorResponse(400, "bad_request", "methodIndex must be a non-negative integer", {}, requestId);
+		const methodIndex = typeof body.methodIndex === "number" ? body.methodIndex : 0;
+		const result = await getOpenCodeClient().startProviderOAuth(providerId, methodIndex);
+		if (!result.ok) return errorResponse(result.status, result.code, result.message, {}, requestId);
+		const data = result.data;
+		const pollToken = crypto.randomUUID();
+		oauthSessions.set(pollToken, {
+			providerId,
+			methodIndex,
+			createdAt: Date.now()
+		});
+		logger.info("oauth authorization started", {
+			providerId,
+			methodIndex,
+			requestId
+		});
+		return jsonResponse(200, {
+			ok: true,
+			mode: "oauth",
+			pollToken,
+			url: data.url,
+			method: data.method,
+			instructions: data.instructions
+		}, requestId);
+	}
+	return errorResponse(400, "bad_request", "mode must be api_key or oauth", {}, requestId);
+};
+/**
+* DELETE /api/host/opencode/providers/:id/auth — Disconnect a provider by
+* removing its credential from OpenCode's auth.json.
+*/
+var DELETE = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:secrets", requestId);
+	if (capabilityError) return capabilityError;
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	const providerId = event.params.id ?? "";
+	if (!providerId || providerId.length > MAX_PROVIDER_ID_LENGTH || !PROVIDER_ID_PATTERN.test(providerId)) return errorResponse(400, "bad_request", "Invalid provider ID", {}, requestId);
+	const result = await getOpenCodeClient().proxy(`/auth/${encodeURIComponent(providerId)}`, { method: "DELETE" });
+	if (!result.ok) {
+		logger.warn("provider disconnect failed", {
+			providerId,
+			requestId,
+			error: result.code
+		});
+		return errorResponse(result.status, result.code, result.message, {}, requestId);
+	}
+	logger.info("provider credential removed via OpenCode /auth DELETE", {
+		providerId,
+		requestId
+	});
+	return jsonResponse(200, { ok: true }, requestId);
+};
+
+export { DELETE, GET, POST };
+//# sourceMappingURL=_server.ts-B28SfXaZ.js.map

package/build/server/chunks/_server.ts-B28SfXaZ.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-B28SfXaZ.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/host/opencode/providers/_id_/auth/_server.ts.js"],"sourcesContent":["import { Nt as createLogger } from \"../../../../../../../../chunks/compose-args.js\";\nimport \"../../../../../../../../chunks/src.js\";\nimport { a as getRequestId, c as jsonResponse, d as requireCapability, i as getOpenCodeClient, l as parseJsonBody, r as errorResponse, s as jsonBodyError, u as requireAdmin } from \"../../../../../../../../chunks/helpers.js\";\n//#region src/routes/api/host/opencode/providers/[id]/auth/+server.ts\nvar logger = createLogger(\"opencode.auth\");\nvar MAX_API_KEY_LENGTH = 512;\nvar API_KEY_PATTERN = /^[\\x20-\\x7E]+$/;\nvar OAUTH_SESSION_TTL_MS = 6e5;\nvar MAX_PROVIDER_ID_LENGTH = 128;\nvar PROVIDER_ID_PATTERN = /^[a-zA-Z0-9_.-]+$/;\nfunction validateApiKey(key) {\n\tif (key.length > MAX_API_KEY_LENGTH) return \"API key exceeds maximum length\";\n\tif (!API_KEY_PATTERN.test(key)) return \"API key contains invalid characters\";\n\treturn null;\n}\nvar oauthSessions = /* @__PURE__ */ new Map();\nfunction purgeExpiredSessions() {\n\tconst now = Date.now();\n\tfor (const [token, session] of oauthSessions) if (now - session.createdAt > OAUTH_SESSION_TTL_MS) oauthSessions.delete(token);\n}\nvar GET = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:secrets\", requestId);\n\tif (capabilityError) return capabilityError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst pollToken = event.url.searchParams.get(\"pollToken\");\n\tif (!pollToken) return errorResponse(400, \"bad_request\", \"pollToken query parameter is required\", {}, requestId);\n\tpurgeExpiredSessions();\n\tconst session = oauthSessions.get(pollToken);\n\tif (!session) return errorResponse(404, \"not_found\", \"Poll session not found or expired\", {}, requestId);\n\tif (event.params.id !== session.providerId) return errorResponse(400, \"bad_request\", \"Provider ID does not match poll session\", {}, requestId);\n\tif ((await getOpenCodeClient().completeProviderOAuth(session.providerId, session.methodIndex)).ok) {\n\t\toauthSessions.delete(pollToken);\n\t\tlogger.info(\"oauth authorization completed\", {\n\t\t\tproviderId: session.providerId,\n\t\t\trequestId\n\t\t});\n\t\treturn jsonResponse(200, {\n\t\t\tstatus: \"complete\",\n\t\t\tmessage: \"Authorization successful\"\n\t\t}, requestId);\n\t}\n\tif (Date.now() - session.createdAt > OAUTH_SESSION_TTL_MS) {\n\t\toauthSessions.delete(pollToken);\n\t\treturn jsonResponse(200, {\n\t\t\tstatus: \"error\",\n\t\t\tmessage: \"Authorization session expired\"\n\t\t}, requestId);\n\t}\n\treturn jsonResponse(200, {\n\t\tstatus: \"pending\",\n\t\tmessage: \"Waiting for authorization...\"\n\t}, requestId);\n};\nvar POST = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:secrets\", requestId);\n\tif (capabilityError) return capabilityError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst result = await parseJsonBody(event.request);\n\tif (\"error\" in result) return jsonBodyError(result, requestId);\n\tconst body = result.data;\n\tconst providerId = event.params.id;\n\tconst mode = typeof body.mode === \"string\" ? body.mode : \"\";\n\tif (!providerId || providerId.length > MAX_PROVIDER_ID_LENGTH || !PROVIDER_ID_PATTERN.test(providerId)) return errorResponse(400, \"bad_request\", \"Invalid provider ID\", {}, requestId);\n\tpurgeExpiredSessions();\n\tif (mode === \"api_key\") {\n\t\tconst apiKey = typeof body.apiKey === \"string\" ? body.apiKey.trim() : \"\";\n\t\tif (!apiKey) return errorResponse(400, \"bad_request\", \"apiKey is required for api_key mode\", {}, requestId);\n\t\tconst keyError = validateApiKey(apiKey);\n\t\tif (keyError) return errorResponse(400, \"bad_request\", keyError, {}, requestId);\n\t\tconst result = await getOpenCodeClient().setProviderApiKey(providerId, apiKey);\n\t\tif (!result.ok) {\n\t\t\tlogger.warn(\"provider api key save failed\", {\n\t\t\t\tproviderId,\n\t\t\t\trequestId,\n\t\t\t\terror: result.code\n\t\t\t});\n\t\t\treturn errorResponse(result.status, result.code, result.message, {}, requestId);\n\t\t}\n\t\tlogger.info(\"provider API key saved to OpenCode auth.json\", {\n\t\t\tproviderId,\n\t\t\trequestId\n\t\t});\n\t\treturn jsonResponse(200, {\n\t\t\tok: true,\n\t\t\tmode: \"api_key\"\n\t\t}, requestId);\n\t}\n\tif (mode === \"oauth\") {\n\t\tif (typeof body.methodIndex !== \"undefined\" && (typeof body.methodIndex !== \"number\" || !Number.isInteger(body.methodIndex) || body.methodIndex < 0)) return errorResponse(400, \"bad_request\", \"methodIndex must be a non-negative integer\", {}, requestId);\n\t\tconst methodIndex = typeof body.methodIndex === \"number\" ? body.methodIndex : 0;\n\t\tconst result = await getOpenCodeClient().startProviderOAuth(providerId, methodIndex);\n\t\tif (!result.ok) return errorResponse(result.status, result.code, result.message, {}, requestId);\n\t\tconst data = result.data;\n\t\tconst pollToken = crypto.randomUUID();\n\t\toauthSessions.set(pollToken, {\n\t\t\tproviderId,\n\t\t\tmethodIndex,\n\t\t\tcreatedAt: Date.now()\n\t\t});\n\t\tlogger.info(\"oauth authorization started\", {\n\t\t\tproviderId,\n\t\t\tmethodIndex,\n\t\t\trequestId\n\t\t});\n\t\treturn jsonResponse(200, {\n\t\t\tok: true,\n\t\t\tmode: \"oauth\",\n\t\t\tpollToken,\n\t\t\turl: data.url,\n\t\t\tmethod: data.method,\n\t\t\tinstructions: data.instructions\n\t\t}, requestId);\n\t}\n\treturn errorResponse(400, \"bad_request\", \"mode must be api_key or oauth\", {}, requestId);\n};\n/**\n* DELETE /api/host/opencode/providers/:id/auth — Disconnect a provider by\n* removing its credential from OpenCode's auth.json.\n*/\nvar DELETE = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:secrets\", requestId);\n\tif (capabilityError) return capabilityError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst providerId = event.params.id ?? \"\";\n\tif (!providerId || providerId.length > MAX_PROVIDER_ID_LENGTH || !PROVIDER_ID_PATTERN.test(providerId)) return errorResponse(400, \"bad_request\", \"Invalid provider ID\", {}, requestId);\n\tconst result = await getOpenCodeClient().proxy(`/auth/${encodeURIComponent(providerId)}`, { method: \"DELETE\" });\n\tif (!result.ok) {\n\t\tlogger.warn(\"provider disconnect failed\", {\n\t\t\tproviderId,\n\t\t\trequestId,\n\t\t\terror: result.code\n\t\t});\n\t\treturn errorResponse(result.status, result.code, result.message, {}, requestId);\n\t}\n\tlogger.info(\"provider credential removed via OpenCode /auth DELETE\", {\n\t\tproviderId,\n\t\trequestId\n\t});\n\treturn jsonResponse(200, { ok: true }, requestId);\n};\n//#endregion\nexport { DELETE, GET, POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAGA;AACA,IAAI,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC;AAC1C,IAAI,kBAAkB,GAAG,GAAG;AAC5B,IAAI,eAAe,GAAG,gBAAgB;AACtC,IAAI,oBAAoB,GAAG,GAAG;AAC9B,IAAI,sBAAsB,GAAG,GAAG;AAChC,IAAI,mBAAmB,GAAG,mBAAmB;AAC7C,SAAS,cAAc,CAAC,GAAG,EAAE;AAC7B,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,kBAAkB,EAAE,OAAO,gCAAgC;AAC7E,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,qCAAqC;AAC7E,CAAC,OAAO,IAAI;AACZ;AACA,IAAI,aAAa,mBAAmB,IAAI,GAAG,EAAE;AAC7C,SAAS,oBAAoB,GAAG;AAChC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;AACvB,CAAC,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,aAAa,EAAE,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,GAAG,oBAAoB,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AAC9H;AACG,IAAC,GAAG,GAAG,OAAO,KAAK,KAAK;AAC3B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC;AAC5E,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1D,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,uCAAuC,EAAE,EAAE,EAAE,SAAS,CAAC;AACjH,CAAC,oBAAoB,EAAE;AACvB,CAAC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC;AAC7C,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,mCAAmC,EAAE,EAAE,EAAE,SAAS,CAAC;AACzG,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,OAAO,CAAC,UAAU,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,yCAAyC,EAAE,EAAE,EAAE,SAAS,CAAC;AAC/I,CAAC,IAAI,CAAC,MAAM,iBAAiB,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE;AACpG,EAAE,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;AACjC,EAAE,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;AAC/C,GAAG,UAAU,EAAE,OAAO,CAAC,UAAU;AACjC,GAAG;AACH,GAAG,CAAC;AACJ,EAAE,OAAO,YAAY,CAAC,GAAG,EAAE;AAC3B,GAAG,MAAM,EAAE,UAAU;AACrB,GAAG,OAAO,EAAE;AACZ,GAAG,EAAE,SAAS,CAAC;AACf,CAAC;AACD,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,GAAG,oBAAoB,EAAE;AAC5D,EAAE,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;AACjC,EAAE,OAAO,YAAY,CAAC,GAAG,EAAE;AAC3B,GAAG,MAAM,EAAE,OAAO;AAClB,GAAG,OAAO,EAAE;AACZ,GAAG,EAAE,SAAS,CAAC;AACf,CAAC;AACD,CAAC,OAAO,YAAY,CAAC,GAAG,EAAE;AAC1B,EAAE,MAAM,EAAE,SAAS;AACnB,EAAE,OAAO,EAAE;AACX,EAAE,EAAE,SAAS,CAAC;AACd;AACG,IAAC,IAAI,GAAG,OAAO,KAAK,KAAK;AAC5B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC;AAC5E,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;AAClD,CAAC,IAAI,OAAO,IAAI,MAAM,EAAE,OAAO,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC;AAC/D,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI;AACzB,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE;AACnC,CAAC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,GAAG,IAAI,CAAC,IAAI,GAAG,EAAE;AAC5D,CAAC,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,sBAAsB,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,qBAAqB,EAAE,EAAE,EAAE,SAAS,CAAC;AACvL,CAAC,oBAAoB,EAAE;AACvB,CAAC,IAAI,IAAI,KAAK,SAAS,EAAE;AACzB,EAAE,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;AAC1E,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,qCAAqC,EAAE,EAAE,EAAE,SAAS,CAAC;AAC7G,EAAE,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC;AACzC,EAAE,IAAI,QAAQ,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,CAAC;AACjF,EAAE,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC,iBAAiB,CAAC,UAAU,EAAE,MAAM,CAAC;AAChF,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE;AAClB,GAAG,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;AAC/C,IAAI,UAAU;AACd,IAAI,SAAS;AACb,IAAI,KAAK,EAAE,MAAM,CAAC;AAClB,IAAI,CAAC;AACL,GAAG,OAAO,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC;AAClF,EAAE;AACF,EAAE,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE;AAC9D,GAAG,UAAU;AACb,GAAG;AACH,GAAG,CAAC;AACJ,EAAE,OAAO,YAAY,CAAC,GAAG,EAAE;AAC3B,GAAG,EAAE,EAAE,IAAI;AACX,GAAG,IAAI,EAAE;AACT,GAAG,EAAE,SAAS,CAAC;AACf,CAAC;AACD,CAAC,IAAI,IAAI,KAAK,OAAO,EAAE;AACvB,EAAE,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,WAAW,KAAK,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,4CAA4C,EAAE,EAAE,EAAE,SAAS,CAAC;AAC7P,EAAE,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,GAAG,IAAI,CAAC,WAAW,GAAG,CAAC;AACjF,EAAE,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,WAAW,CAAC;AACtF,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC;AACjG,EAAE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI;AAC1B,EAAE,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE;AACvC,EAAE,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE;AAC/B,GAAG,UAAU;AACb,GAAG,WAAW;AACd,GAAG,SAAS,EAAE,IAAI,CAAC,GAAG;AACtB,GAAG,CAAC;AACJ,EAAE,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;AAC7C,GAAG,UAAU;AACb,GAAG,WAAW;AACd,GAAG;AACH,GAAG,CAAC;AACJ,EAAE,OAAO,YAAY,CAAC,GAAG,EAAE;AAC3B,GAAG,EAAE,EAAE,IAAI;AACX,GAAG,IAAI,EAAE,OAAO;AAChB,GAAG,SAAS;AACZ,GAAG,GAAG,EAAE,IAAI,CAAC,GAAG;AAChB,GAAG,MAAM,EAAE,IAAI,CAAC,MAAM;AACtB,GAAG,YAAY,EAAE,IAAI,CAAC;AACtB,GAAG,EAAE,SAAS,CAAC;AACf,CAAC;AACD,CAAC,OAAO,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,+BAA+B,EAAE,EAAE,EAAE,SAAS,CAAC;AACzF;AACA;AACA;AACA;AACA;AACG,IAAC,MAAM,GAAG,OAAO,KAAK,KAAK;AAC9B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC;AAC5E,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE;AACzC,CAAC,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,sBAAsB,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,qBAAqB,EAAE,EAAE,EAAE,SAAS,CAAC;AACvL,CAAC,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAChH,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE;AACjB,EAAE,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;AAC5C,GAAG,UAAU;AACb,GAAG,SAAS;AACZ,GAAG,KAAK,EAAE,MAAM,CAAC;AACjB,GAAG,CAAC;AACJ,EAAE,OAAO,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC;AACjF,CAAC;AACD,CAAC,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE;AACtE,EAAE,UAAU;AACZ,EAAE;AACF,EAAE,CAAC;AACH,CAAC,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,CAAC;AAClD;;;;"}