@openpalm/ui 0.12.52 → 0.13.0-beta.2

package/build/server/chunks/_server.ts-BjD0Uf0U.js

@@ -0,0 +1,248 @@
+import { j as json } from './exports-CcmcYU0M.js';
+import { aJ as readVersions, aA as readPinnedVersions, ay as readChannelPreference, ab as getRunningImages, n as buildComposeOptions, at as parseEnvFile, S as SERVICE_VERSION_KEYS, b0 as stripVoiceVariantSuffix, a2 as formatForDisplay, bb as writeVersions, b5 as writeChannelPreference, ar as mergeEnvContent, D as DOCKER_IMAGE_NAMES, t as compareComparableVersions, P as PLATFORM_VERSION } from './src-BwQUi60U.js';
+import { g as getState } from './state-Dm7U51xT.js';
+import { d as getRequestId, l as requireCapability, r as requireAdmin, e as errorResponse } from './helpers-q4Ng8QTq.js';
+import { existsSync, writeFileSync, readFileSync } from 'node:fs';
+import './utils-OXHIhUb5.js';
+import './provider-constants-1s1k8kbj.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+import './endpoints-B9ePqrMw.js';
+import './features-0lgyQreD.js';
+
+//#region src/routes/api/host/versions/+server.ts
+/**
+* GET /api/host/versions  — truthful version state (constitution §4.2, §5)
+* PATCH /api/host/versions — write pins to state file
+*
+* GET returns THREE distinct values per component (§5 / Phase 5):
+*   running   — the digest + tag the currently running container was CREATED FROM
+*               (read from `docker inspect`, never from a pin file). Null when not running.
+*   pinned    — the explicit version lock from state/stack.state.env, or null = track latest.
+*               Moving tags ("latest", "next") are normalized to null (they express channel
+*               preference, not a lock).
+*   available — the resolved latest version on the active channel (silent null on registry down).
+*
+* Backward compatibility for the mixed-version window (old UI + new API or vice versa):
+*   - The legacy top-level `versions` field is preserved. Old UIs that read only
+*     `body.versions[key]` continue to get the same string they always did (the stored
+*     pin value / default). New UIs read `body.components[key].{running,pinned,available}`.
+*   - Old UIs cannot see `running` (never could — it's new). They may show a stale pin
+*     as "current", which was the pre-Phase-5 behaviour. That is acceptable for the
+*     transition window; Phase 6 (UpdatesTab rebuild) is where the new shape is consumed.
+*
+* Registry-down asymmetry (§4, compliance G2):
+*   Background "available?" resolution degrades SILENTLY — a registry outage just
+*   leaves `available` null; the stack keeps running what it has.
+*   A user-pressed update that can't reach the registry FAILS LOUDLY (handled in
+*   /api/host/update via applyStack pull-before-up + fatal pull failure).
+*
+* Voice variant on display (§4.2, compliance G3):
+*   `running.tag` for the voice service will include the hardware suffix (e.g.
+*   "openpalm/voice:0.12.0-cpu"). The `running.plainVersion` field strips it for
+*   use in the pinning control. `pinned` never carries the suffix (compose adds it).
+*
+* Service-name vs image-name (§5 truthful state):
+*   getRunningImages() keys its result by compose SERVICE name, not image name.
+*   OP_PORTAL_VERSION images run under services discord/slack/guardian/api/chat/gateway.
+*   OP_VOICE_VERSION may run as voice (cpu), voice-cuda, or voice-rocm.
+*   We therefore scan runningImages by matching the image tag against the expected
+*   image name, not by looking up the image name as a service name.
+*
+* upToDate field removed (§8, Phase-5-item-3):
+*   Tag-string equality cannot determine up-to-date status (tags can point to different
+*   digests). Phase 6 decides up-to-date by digest comparison after a pull. The route
+*   surfaces running.digest, running.plainVersion, pinned, and available as separate
+*   truthful values for Phase 6 to use.
+*/
+var ALLOWED_KEYS = new Set([
+	...SERVICE_VERSION_KEYS,
+	"OP_AUTO_UPDATE",
+	"OP_CHANNEL"
+]);
+function stackEnvPath() {
+	return `${getState().stashDir}/env/stack.env`;
+}
+var STABLE_SEMVER = /^v?(\d+\.\d+\.\d+)$/;
+var PRERELEASE_SEMVER = /^v?(\d+\.\d+\.\d+-(?:rc|alpha|beta|next)\.\d+)$/;
+var VOICE_STABLE = /^v?(\d+\.\d+\.\d+)-\w+$/;
+/**
+* Read the Docker Hub namespace from the stack env (OP_IMAGE_NAMESPACE), defaulting to
+* "openpalm". Compose uses the same default: ${OP_IMAGE_NAMESPACE:-openpalm}.
+*/
+function imageNamespace(stackEnvContent) {
+	return (stackEnvContent.OP_IMAGE_NAMESPACE ?? process.env.OP_IMAGE_NAMESPACE ?? "openpalm").trim() || "openpalm";
+}
+async function resolveDockerLatestSilent(image, namespace, channel) {
+	try {
+		const res = await fetch(`https://hub.docker.com/v2/repositories/${namespace}/${image}/tags?page_size=100&ordering=last_updated`, {
+			headers: { Accept: "application/json" },
+			signal: AbortSignal.timeout(5e3)
+		});
+		if (!res.ok) return null;
+		const data = await res.json();
+		const isVoice = image === "voice";
+		const candidates = [];
+		for (const tag of data.results ?? []) {
+			const plain = tag.name.match(STABLE_SEMVER)?.[1];
+			if (plain) {
+				candidates.push(plain);
+				continue;
+			}
+			if (isVoice) {
+				const voice = tag.name.match(VOICE_STABLE)?.[1];
+				if (voice) {
+					candidates.push(voice);
+					continue;
+				}
+			}
+			if (channel === "next") {
+				const pre = tag.name.match(PRERELEASE_SEMVER)?.[1];
+				if (pre) candidates.push(pre);
+			}
+		}
+		if (candidates.length === 0) return null;
+		return candidates.sort(compareComparableVersions).at(-1) ?? null;
+	} catch {
+		return null;
+	}
+}
+var _availableCache = /* @__PURE__ */ new Map();
+var CACHE_TTL_MS = 5 * 6e4;
+async function resolveAvailableVersions(channel, namespace) {
+	const cacheKey = `${channel}:${namespace}`;
+	const cached = _availableCache.get(cacheKey);
+	if (cached && Date.now() - cached.fetchedAt < CACHE_TTL_MS) return cached.versions;
+	const results = await Promise.all(SERVICE_VERSION_KEYS.map(async (key) => {
+		const image = DOCKER_IMAGE_NAMES[key];
+		return [key, await resolveDockerLatestSilent(image, namespace, channel)];
+	}));
+	const versions = {};
+	for (const [k, v] of results) versions[k] = v;
+	_availableCache.set(cacheKey, {
+		versions,
+		fetchedAt: Date.now()
+	});
+	return versions;
+}
+/**
+* Find the first running (non-not_installed) container whose image tag contains
+* the given image name (e.g. "/portal:" or "/voice:"). Returns null if none found.
+*/
+function findRunningByImage(runningImages, imageName) {
+	const needle = `/${imageName}:`;
+	for (const ri of Object.values(runningImages)) if (ri.state !== "not_installed" && ri.tag.includes(needle)) return ri;
+	return null;
+}
+var GET = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:updates", requestId);
+	if (capabilityError) return capabilityError;
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	const state = getState();
+	if (!state.stackDir) return errorResponse(503, "not_initialized", "Stack directory not configured", {}, requestId);
+	const versions = readVersions(state);
+	const pinned = readPinnedVersions(state);
+	const channel = readChannelPreference(state);
+	let runningImages = {};
+	try {
+		runningImages = await getRunningImages(buildComposeOptions(state));
+	} catch {}
+	const path = stackEnvPath();
+	const env = existsSync(path) ? parseEnvFile(path) : {};
+	const available = await resolveAvailableVersions(channel, imageNamespace(env));
+	const components = {};
+	for (const key of SERVICE_VERSION_KEYS) {
+		const imageName = DOCKER_IMAGE_NAMES[key];
+		const ri = findRunningByImage(runningImages, imageName);
+		let runningEntry = null;
+		if (ri) {
+			const rawTag = ri.tag.split(":").pop() ?? ri.tag;
+			const plainVersion = key === "OP_VOICE_VERSION" ? stripVoiceVariantSuffix(rawTag) : rawTag;
+			runningEntry = {
+				digest: ri.digest,
+				tag: ri.tag,
+				plainVersion,
+				healthStatus: ri.healthStatus,
+				containerState: ri.state
+			};
+		}
+		components[key] = {
+			running: runningEntry,
+			pinned: pinned[key],
+			available: available[key] ?? null
+		};
+	}
+	return json({
+		components,
+		channel,
+		platformVersion: formatForDisplay(PLATFORM_VERSION),
+		versions,
+		autoUpdate: env.OP_AUTO_UPDATE !== "false"
+	});
+};
+var PATCH = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:updates", requestId);
+	if (capabilityError) return capabilityError;
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	const state = getState();
+	if (!state.stackDir) return errorResponse(503, "not_initialized", "Stack directory not configured", {}, requestId);
+	let body;
+	try {
+		body = await event.request.json();
+	} catch {
+		return errorResponse(400, "invalid_body", "Request body must be JSON", {}, requestId);
+	}
+	const versions = body?.versions;
+	if (!versions || typeof versions !== "object") return errorResponse(400, "invalid_body", "Body must include a versions object", {}, requestId);
+	const versionUpdates = {};
+	const settingUpdates = {};
+	let channelUpdate;
+	for (const [key, value] of Object.entries(versions)) {
+		if (!ALLOWED_KEYS.has(key)) return errorResponse(400, "unknown_version_key", `Unknown key: ${key}`, {}, requestId);
+		if (typeof value !== "string") return errorResponse(400, "invalid_version_value", `Value for ${key} must be a string`, {}, requestId);
+		if (key === "OP_CHANNEL") channelUpdate = value;
+		else if (key === "OP_AUTO_UPDATE") settingUpdates[key] = value;
+		else versionUpdates[key] = value;
+	}
+	if (Object.keys(versionUpdates).length > 0) {
+		writeVersions(state, versionUpdates);
+		_availableCache.clear();
+	}
+	if (channelUpdate !== void 0) try {
+		writeChannelPreference(state, channelUpdate);
+		_availableCache.clear();
+	} catch (e) {
+		return errorResponse(400, "invalid_channel", e instanceof Error ? e.message : String(e), {}, requestId);
+	}
+	if (Object.keys(settingUpdates).length > 0) {
+		const path = stackEnvPath();
+		writeFileSync(path, mergeEnvContent(existsSync(path) ? readFileSync(path, "utf-8") : "", settingUpdates), { mode: 384 });
+	}
+	return json({
+		ok: true,
+		versions: readVersions(state)
+	});
+};
+
+export { GET, PATCH };
+//# sourceMappingURL=_server.ts-BjD0Uf0U.js.map

package/build/server/chunks/_server.ts-BjD0Uf0U.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-BjD0Uf0U.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/host/versions/_server.ts.js"],"sourcesContent":["import { r as json } from \"../../../../../chunks/exports.js\";\nimport { B as readVersions, F as DOCKER_IMAGE_NAMES, H as writeChannelPreference, I as SERVICE_VERSION_KEYS, R as readChannelPreference, U as writeVersions, V as stripVoiceVariantSuffix, _t as formatForDisplay, gt as compareComparableVersions, ht as PLATFORM_VERSION, t as buildComposeOptions, z as readPinnedVersions } from \"../../../../../chunks/compose-args.js\";\nimport { F as mergeEnvContent, R as parseEnvFile, w as getRunningImages } from \"../../../../../chunks/docker.js\";\nimport \"../../../../../chunks/src.js\";\nimport { t as getState } from \"../../../../../chunks/state.js\";\nimport { a as getRequestId, d as requireCapability, r as errorResponse, u as requireAdmin } from \"../../../../../chunks/helpers.js\";\nimport { existsSync, readFileSync, writeFileSync } from \"node:fs\";\n//#region src/routes/api/host/versions/+server.ts\n/**\n* GET /api/host/versions  — truthful version state (constitution §4.2, §5)\n* PATCH /api/host/versions — write pins to state file\n*\n* GET returns THREE distinct values per component (§5 / Phase 5):\n*   running   — the digest + tag the currently running container was CREATED FROM\n*               (read from `docker inspect`, never from a pin file). Null when not running.\n*   pinned    — the explicit version lock from state/stack.state.env, or null = track latest.\n*               Moving tags (\"latest\", \"next\") are normalized to null (they express channel\n*               preference, not a lock).\n*   available — the resolved latest version on the active channel (silent null on registry down).\n*\n* Backward compatibility for the mixed-version window (old UI + new API or vice versa):\n*   - The legacy top-level `versions` field is preserved. Old UIs that read only\n*     `body.versions[key]` continue to get the same string they always did (the stored\n*     pin value / default). New UIs read `body.components[key].{running,pinned,available}`.\n*   - Old UIs cannot see `running` (never could — it's new). They may show a stale pin\n*     as \"current\", which was the pre-Phase-5 behaviour. That is acceptable for the\n*     transition window; Phase 6 (UpdatesTab rebuild) is where the new shape is consumed.\n*\n* Registry-down asymmetry (§4, compliance G2):\n*   Background \"available?\" resolution degrades SILENTLY — a registry outage just\n*   leaves `available` null; the stack keeps running what it has.\n*   A user-pressed update that can't reach the registry FAILS LOUDLY (handled in\n*   /api/host/update via applyStack pull-before-up + fatal pull failure).\n*\n* Voice variant on display (§4.2, compliance G3):\n*   `running.tag` for the voice service will include the hardware suffix (e.g.\n*   \"openpalm/voice:0.12.0-cpu\"). The `running.plainVersion` field strips it for\n*   use in the pinning control. `pinned` never carries the suffix (compose adds it).\n*\n* Service-name vs image-name (§5 truthful state):\n*   getRunningImages() keys its result by compose SERVICE name, not image name.\n*   OP_PORTAL_VERSION images run under services discord/slack/guardian/api/chat/gateway.\n*   OP_VOICE_VERSION may run as voice (cpu), voice-cuda, or voice-rocm.\n*   We therefore scan runningImages by matching the image tag against the expected\n*   image name, not by looking up the image name as a service name.\n*\n* upToDate field removed (§8, Phase-5-item-3):\n*   Tag-string equality cannot determine up-to-date status (tags can point to different\n*   digests). Phase 6 decides up-to-date by digest comparison after a pull. The route\n*   surfaces running.digest, running.plainVersion, pinned, and available as separate\n*   truthful values for Phase 6 to use.\n*/\nvar ALLOWED_KEYS = new Set([\n\t...SERVICE_VERSION_KEYS,\n\t\"OP_AUTO_UPDATE\",\n\t\"OP_CHANNEL\"\n]);\nfunction stackEnvPath() {\n\treturn `${getState().stashDir}/env/stack.env`;\n}\nvar STABLE_SEMVER = /^v?(\\d+\\.\\d+\\.\\d+)$/;\nvar PRERELEASE_SEMVER = /^v?(\\d+\\.\\d+\\.\\d+-(?:rc|alpha|beta|next)\\.\\d+)$/;\nvar VOICE_STABLE = /^v?(\\d+\\.\\d+\\.\\d+)-\\w+$/;\n/**\n* Read the Docker Hub namespace from the stack env (OP_IMAGE_NAMESPACE), defaulting to\n* \"openpalm\". Compose uses the same default: ${OP_IMAGE_NAMESPACE:-openpalm}.\n*/\nfunction imageNamespace(stackEnvContent) {\n\treturn (stackEnvContent.OP_IMAGE_NAMESPACE ?? process.env.OP_IMAGE_NAMESPACE ?? \"openpalm\").trim() || \"openpalm\";\n}\nasync function resolveDockerLatestSilent(image, namespace, channel) {\n\ttry {\n\t\tconst res = await fetch(`https://hub.docker.com/v2/repositories/${namespace}/${image}/tags?page_size=100&ordering=last_updated`, {\n\t\t\theaders: { Accept: \"application/json\" },\n\t\t\tsignal: AbortSignal.timeout(5e3)\n\t\t});\n\t\tif (!res.ok) return null;\n\t\tconst data = await res.json();\n\t\tconst isVoice = image === \"voice\";\n\t\tconst candidates = [];\n\t\tfor (const tag of data.results ?? []) {\n\t\t\tconst plain = tag.name.match(STABLE_SEMVER)?.[1];\n\t\t\tif (plain) {\n\t\t\t\tcandidates.push(plain);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (isVoice) {\n\t\t\t\tconst voice = tag.name.match(VOICE_STABLE)?.[1];\n\t\t\t\tif (voice) {\n\t\t\t\t\tcandidates.push(voice);\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (channel === \"next\") {\n\t\t\t\tconst pre = tag.name.match(PRERELEASE_SEMVER)?.[1];\n\t\t\t\tif (pre) candidates.push(pre);\n\t\t\t}\n\t\t}\n\t\tif (candidates.length === 0) return null;\n\t\treturn candidates.sort(compareComparableVersions).at(-1) ?? null;\n\t} catch {\n\t\treturn null;\n\t}\n}\nvar _availableCache = /* @__PURE__ */ new Map();\nvar CACHE_TTL_MS = 5 * 6e4;\nasync function resolveAvailableVersions(channel, namespace) {\n\tconst cacheKey = `${channel}:${namespace}`;\n\tconst cached = _availableCache.get(cacheKey);\n\tif (cached && Date.now() - cached.fetchedAt < CACHE_TTL_MS) return cached.versions;\n\tconst results = await Promise.all(SERVICE_VERSION_KEYS.map(async (key) => {\n\t\tconst image = DOCKER_IMAGE_NAMES[key];\n\t\treturn [key, await resolveDockerLatestSilent(image, namespace, channel)];\n\t}));\n\tconst versions = {};\n\tfor (const [k, v] of results) versions[k] = v;\n\t_availableCache.set(cacheKey, {\n\t\tversions,\n\t\tfetchedAt: Date.now()\n\t});\n\treturn versions;\n}\n/**\n* Find the first running (non-not_installed) container whose image tag contains\n* the given image name (e.g. \"/portal:\" or \"/voice:\"). Returns null if none found.\n*/\nfunction findRunningByImage(runningImages, imageName) {\n\tconst needle = `/${imageName}:`;\n\tfor (const ri of Object.values(runningImages)) if (ri.state !== \"not_installed\" && ri.tag.includes(needle)) return ri;\n\treturn null;\n}\nvar GET = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:updates\", requestId);\n\tif (capabilityError) return capabilityError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst state = getState();\n\tif (!state.stackDir) return errorResponse(503, \"not_initialized\", \"Stack directory not configured\", {}, requestId);\n\tconst versions = readVersions(state);\n\tconst pinned = readPinnedVersions(state);\n\tconst channel = readChannelPreference(state);\n\tlet runningImages = {};\n\ttry {\n\t\trunningImages = await getRunningImages(buildComposeOptions(state));\n\t} catch {}\n\tconst path = stackEnvPath();\n\tconst env = existsSync(path) ? parseEnvFile(path) : {};\n\tconst available = await resolveAvailableVersions(channel, imageNamespace(env));\n\tconst components = {};\n\tfor (const key of SERVICE_VERSION_KEYS) {\n\t\tconst imageName = DOCKER_IMAGE_NAMES[key];\n\t\tconst ri = findRunningByImage(runningImages, imageName);\n\t\tlet runningEntry = null;\n\t\tif (ri) {\n\t\t\tconst rawTag = ri.tag.split(\":\").pop() ?? ri.tag;\n\t\t\tconst plainVersion = key === \"OP_VOICE_VERSION\" ? stripVoiceVariantSuffix(rawTag) : rawTag;\n\t\t\trunningEntry = {\n\t\t\t\tdigest: ri.digest,\n\t\t\t\ttag: ri.tag,\n\t\t\t\tplainVersion,\n\t\t\t\thealthStatus: ri.healthStatus,\n\t\t\t\tcontainerState: ri.state\n\t\t\t};\n\t\t}\n\t\tcomponents[key] = {\n\t\t\trunning: runningEntry,\n\t\t\tpinned: pinned[key],\n\t\t\tavailable: available[key] ?? null\n\t\t};\n\t}\n\treturn json({\n\t\tcomponents,\n\t\tchannel,\n\t\tplatformVersion: formatForDisplay(PLATFORM_VERSION),\n\t\tversions,\n\t\tautoUpdate: env.OP_AUTO_UPDATE !== \"false\"\n\t});\n};\nvar PATCH = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:updates\", requestId);\n\tif (capabilityError) return capabilityError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst state = getState();\n\tif (!state.stackDir) return errorResponse(503, \"not_initialized\", \"Stack directory not configured\", {}, requestId);\n\tlet body;\n\ttry {\n\t\tbody = await event.request.json();\n\t} catch {\n\t\treturn errorResponse(400, \"invalid_body\", \"Request body must be JSON\", {}, requestId);\n\t}\n\tconst versions = body?.versions;\n\tif (!versions || typeof versions !== \"object\") return errorResponse(400, \"invalid_body\", \"Body must include a versions object\", {}, requestId);\n\tconst versionUpdates = {};\n\tconst settingUpdates = {};\n\tlet channelUpdate;\n\tfor (const [key, value] of Object.entries(versions)) {\n\t\tif (!ALLOWED_KEYS.has(key)) return errorResponse(400, \"unknown_version_key\", `Unknown key: ${key}`, {}, requestId);\n\t\tif (typeof value !== \"string\") return errorResponse(400, \"invalid_version_value\", `Value for ${key} must be a string`, {}, requestId);\n\t\tif (key === \"OP_CHANNEL\") channelUpdate = value;\n\t\telse if (key === \"OP_AUTO_UPDATE\") settingUpdates[key] = value;\n\t\telse versionUpdates[key] = value;\n\t}\n\tif (Object.keys(versionUpdates).length > 0) {\n\t\twriteVersions(state, versionUpdates);\n\t\t_availableCache.clear();\n\t}\n\tif (channelUpdate !== void 0) try {\n\t\twriteChannelPreference(state, channelUpdate);\n\t\t_availableCache.clear();\n\t} catch (e) {\n\t\treturn errorResponse(400, \"invalid_channel\", e instanceof Error ? e.message : String(e), {}, requestId);\n\t}\n\tif (Object.keys(settingUpdates).length > 0) {\n\t\tconst path = stackEnvPath();\n\t\twriteFileSync(path, mergeEnvContent(existsSync(path) ? readFileSync(path, \"utf-8\") : \"\", settingUpdates), { mode: 384 });\n\t}\n\treturn json({\n\t\tok: true,\n\t\tversions: readVersions(state)\n\t});\n};\n//#endregion\nexport { GET, PATCH };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,YAAY,GAAG,IAAI,GAAG,CAAC;AAC3B,CAAC,GAAG,oBAAoB;AACxB,CAAC,gBAAgB;AACjB,CAAC;AACD,CAAC,CAAC;AACF,SAAS,YAAY,GAAG;AACxB,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC;AAC9C;AACA,IAAI,aAAa,GAAG,qBAAqB;AACzC,IAAI,iBAAiB,GAAG,iDAAiD;AACzE,IAAI,YAAY,GAAG,yBAAyB;AAC5C;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,eAAe,EAAE;AACzC,CAAC,OAAO,CAAC,eAAe,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,UAAU,EAAE,IAAI,EAAE,IAAI,UAAU;AACjH;AACA,eAAe,yBAAyB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE;AACpE,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,CAAC,uCAAuC,EAAE,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,yCAAyC,CAAC,EAAE;AACnI,GAAG,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;AAC1C,GAAG,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG;AAClC,GAAG,CAAC;AACJ,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,IAAI;AAC1B,EAAE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE;AAC/B,EAAE,MAAM,OAAO,GAAG,KAAK,KAAK,OAAO;AACnC,EAAE,MAAM,UAAU,GAAG,EAAE;AACvB,EAAE,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE;AACxC,GAAG,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;AACnD,GAAG,IAAI,KAAK,EAAE;AACd,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;AAC1B,IAAI;AACJ,GAAG;AACH,GAAG,IAAI,OAAO,EAAE;AAChB,IAAI,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;AACnD,IAAI,IAAI,KAAK,EAAE;AACf,KAAK,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;AAC3B,KAAK;AACL,IAAI;AACJ,GAAG;AACH,GAAG,IAAI,OAAO,KAAK,MAAM,EAAE;AAC3B,IAAI,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;AACtD,IAAI,IAAI,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;AACjC,GAAG;AACH,EAAE;AACF,EAAE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,IAAI;AAC1C,EAAE,OAAO,UAAU,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI;AAClE,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,IAAI;AACb,CAAC;AACD;AACA,IAAI,eAAe,mBAAmB,IAAI,GAAG,EAAE;AAC/C,IAAI,YAAY,GAAG,CAAC,GAAG,GAAG;AAC1B,eAAe,wBAAwB,CAAC,OAAO,EAAE,SAAS,EAAE;AAC5D,CAAC,MAAM,QAAQ,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAC3C,CAAC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC7C,CAAC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,YAAY,EAAE,OAAO,MAAM,CAAC,QAAQ;AACnF,CAAC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,OAAO,GAAG,KAAK;AAC3E,EAAE,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC;AACvC,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,yBAAyB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAC1E,CAAC,CAAC,CAAC,CAAC;AACJ,CAAC,MAAM,QAAQ,GAAG,EAAE;AACpB,CAAC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;AAC9C,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE;AAC/B,EAAE,QAAQ;AACV,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG;AACrB,EAAE,CAAC;AACH,CAAC,OAAO,QAAQ;AAChB;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,aAAa,EAAE,SAAS,EAAE;AACtD,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;AAChC,CAAC,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,KAAK,eAAe,IAAI,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE;AACtH,CAAC,OAAO,IAAI;AACZ;AACG,IAAC,GAAG,GAAG,OAAO,KAAK,KAAK;AAC3B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC;AAC5E,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,KAAK,GAAG,QAAQ,EAAE;AACzB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,iBAAiB,EAAE,gCAAgC,EAAE,EAAE,EAAE,SAAS,CAAC;AACnH,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC;AACrC,CAAC,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC;AACzC,CAAC,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC;AAC7C,CAAC,IAAI,aAAa,GAAG,EAAE;AACvB,CAAC,IAAI;AACL,EAAE,aAAa,GAAG,MAAM,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,MAAM,IAAI,GAAG,YAAY,EAAE;AAC5B,CAAC,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE;AACvD,CAAC,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC;AAC/E,CAAC,MAAM,UAAU,GAAG,EAAE;AACtB,CAAC,KAAK,MAAM,GAAG,IAAI,oBAAoB,EAAE;AACzC,EAAE,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC;AAC3C,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAAC,aAAa,EAAE,SAAS,CAAC;AACzD,EAAE,IAAI,YAAY,GAAG,IAAI;AACzB,EAAE,IAAI,EAAE,EAAE;AACV,GAAG,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG;AACnD,GAAG,MAAM,YAAY,GAAG,GAAG,KAAK,kBAAkB,GAAG,uBAAuB,CAAC,MAAM,CAAC,GAAG,MAAM;AAC7F,GAAG,YAAY,GAAG;AAClB,IAAI,MAAM,EAAE,EAAE,CAAC,MAAM;AACrB,IAAI,GAAG,EAAE,EAAE,CAAC,GAAG;AACf,IAAI,YAAY;AAChB,IAAI,YAAY,EAAE,EAAE,CAAC,YAAY;AACjC,IAAI,cAAc,EAAE,EAAE,CAAC;AACvB,IAAI;AACJ,EAAE;AACF,EAAE,UAAU,CAAC,GAAG,CAAC,GAAG;AACpB,GAAG,OAAO,EAAE,YAAY;AACxB,GAAG,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC;AACtB,GAAG,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI;AAChC,GAAG;AACH,CAAC;AACD,CAAC,OAAO,IAAI,CAAC;AACb,EAAE,UAAU;AACZ,EAAE,OAAO;AACT,EAAE,eAAe,EAAE,gBAAgB,CAAC,gBAAgB,CAAC;AACrD,EAAE,QAAQ;AACV,EAAE,UAAU,EAAE,GAAG,CAAC,cAAc,KAAK;AACrC,EAAE,CAAC;AACH;AACG,IAAC,KAAK,GAAG,OAAO,KAAK,KAAK;AAC7B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC;AAC5E,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,KAAK,GAAG,QAAQ,EAAE;AACzB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,iBAAiB,EAAE,gCAAgC,EAAE,EAAE,EAAE,SAAS,CAAC;AACnH,CAAC,IAAI,IAAI;AACT,CAAC,IAAI;AACL,EAAE,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;AACnC,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,2BAA2B,EAAE,EAAE,EAAE,SAAS,CAAC;AACvF,CAAC;AACD,CAAC,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ;AAChC,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,qCAAqC,EAAE,EAAE,EAAE,SAAS,CAAC;AAC/I,CAAC,MAAM,cAAc,GAAG,EAAE;AAC1B,CAAC,MAAM,cAAc,GAAG,EAAE;AAC1B,CAAC,IAAI,aAAa;AAClB,CAAC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;AACtD,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,qBAAqB,EAAE,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC;AACpH,EAAE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,uBAAuB,EAAE,CAAC,UAAU,EAAE,GAAG,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC;AACvI,EAAE,IAAI,GAAG,KAAK,YAAY,EAAE,aAAa,GAAG,KAAK;AACjD,OAAO,IAAI,GAAG,KAAK,gBAAgB,EAAE,cAAc,CAAC,GAAG,CAAC,GAAG,KAAK;AAChE,OAAO,cAAc,CAAC,GAAG,CAAC,GAAG,KAAK;AAClC,CAAC;AACD,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;AAC7C,EAAE,aAAa,CAAC,KAAK,EAAE,cAAc,CAAC;AACtC,EAAE,eAAe,CAAC,KAAK,EAAE;AACzB,CAAC;AACD,CAAC,IAAI,aAAa,KAAK,MAAM,EAAE,IAAI;AACnC,EAAE,sBAAsB,CAAC,KAAK,EAAE,aAAa,CAAC;AAC9C,EAAE,eAAe,CAAC,KAAK,EAAE;AACzB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,iBAAiB,EAAE,CAAC,YAAY,KAAK,GAAG,CAAC,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC;AACzG,CAAC;AACD,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;AAC7C,EAAE,MAAM,IAAI,GAAG,YAAY,EAAE;AAC7B,EAAE,aAAa,CAAC,IAAI,EAAE,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC1H,CAAC;AACD,CAAC,OAAO,IAAI,CAAC;AACb,EAAE,EAAE,EAAE,IAAI;AACV,EAAE,QAAQ,EAAE,YAAY,CAAC,KAAK;AAC9B,EAAE,CAAC;AACH;;;;"}

package/build/server/chunks/_server.ts-BjjicBDy.js

@@ -0,0 +1,173 @@
+import { ak as listAvailableAddonIds, aa as getRegistryAddonConfig, aG as readStackSecretEnv, aE as readStackEnv, b8 as writeStackSecretEnv, au as patchSecretsEnvFile, G as createLogger } from './src-BwQUi60U.js';
+import { g as getState } from './state-Dm7U51xT.js';
+import { d as getRequestId, l as requireCapability, r as requireAdmin, e as errorResponse, k as jsonResponse, p as parseJsonBody, j as jsonBodyError } from './helpers-q4Ng8QTq.js';
+import './provider-constants-1s1k8kbj.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:fs';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+import './endpoints-B9ePqrMw.js';
+import './features-0lgyQreD.js';
+
+//#region src/routes/api/host/addons/[name]/credentials/+server.ts
+var logger = createLogger("addons.name.credentials");
+/**
+* Parse a `.env.schema` file into structured fields.
+*
+* Schema conventions:
+*   - Lines starting with `#` are comments; consecutive comment lines
+*     accumulate as the *description* of the next KEY=VALUE line.
+*   - `# @sensitive` marks the next field as sensitive (renders as a
+*     password input and is masked on GET).
+*   - `# ---` resets the accumulator (used as a section separator).
+*   - `KEY=DEFAULT` declares the field; default may be empty.
+*/
+function parseEnvSchema(text) {
+	const fields = [];
+	let commentBuffer = [];
+	let sensitive = false;
+	for (const rawLine of text.split(/\r?\n/)) {
+		const line = rawLine.trim();
+		if (!line) continue;
+		if (line.startsWith("#")) {
+			const body = line.slice(1).trim();
+			if (body === "---") {
+				commentBuffer = [];
+				sensitive = false;
+				continue;
+			}
+			if (body.startsWith("@")) {
+				if (/\B@sensitive\b/.test(body)) sensitive = true;
+				continue;
+			}
+			commentBuffer.push(body);
+			continue;
+		}
+		const eq = line.indexOf("=");
+		if (eq <= 0) continue;
+		const key = line.slice(0, eq).trim();
+		if (!key) continue;
+		const def = line.slice(eq + 1).trim();
+		fields.push({
+			key,
+			sensitive,
+			description: commentBuffer.join(" ").trim(),
+			default: def
+		});
+		commentBuffer = [];
+		sensitive = false;
+	}
+	return fields;
+}
+var GET = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:addons", requestId);
+	if (capabilityError) return capabilityError;
+	const authErr = requireAdmin(event, requestId);
+	if (authErr) return authErr;
+	const state = getState();
+	const name = event.params.name;
+	if (!listAvailableAddonIds().includes(name)) return errorResponse(404, "not_found", `Addon "${name}" is not available`, { name }, requestId);
+	let config;
+	try {
+		config = getRegistryAddonConfig(name);
+	} catch (error) {
+		logger.error("schema read failed", {
+			name,
+			error: String(error),
+			requestId
+		});
+		return errorResponse(500, "internal_error", `Addon "${name}" schema is unavailable`, {}, requestId);
+	}
+	const schemaFields = parseEnvSchema(config.envSchema);
+	const secretEnv = readStackSecretEnv(state.homeDir);
+	const stackEnv = readStackEnv(state.homeDir);
+	return jsonResponse(200, {
+		name,
+		fields: schemaFields.map((f) => {
+			const set = ((f.sensitive ? secretEnv[f.key] : stackEnv[f.key]) ?? "").length > 0;
+			return {
+				key: f.key,
+				sensitive: f.sensitive,
+				description: f.description,
+				default: f.default,
+				set,
+				secret: {
+					envKey: f.key,
+					present: set
+				},
+				value: ""
+			};
+		})
+	}, requestId);
+};
+var POST = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:addons", requestId);
+	if (capabilityError) return capabilityError;
+	const authErr = requireAdmin(event, requestId);
+	if (authErr) return authErr;
+	const state = getState();
+	const name = event.params.name;
+	if (!listAvailableAddonIds().includes(name)) return errorResponse(404, "not_found", `Addon "${name}" is not available`, { name }, requestId);
+	const parsed = await parseJsonBody(event.request);
+	if ("error" in parsed) return jsonBodyError(parsed, requestId);
+	const valuesRaw = parsed.data.values ?? {};
+	let config;
+	try {
+		config = getRegistryAddonConfig(name);
+	} catch (error) {
+		logger.error("schema read failed (post)", {
+			name,
+			error: String(error),
+			requestId
+		});
+		return errorResponse(500, "internal_error", `Addon "${name}" schema is unavailable`, {}, requestId);
+	}
+	const schemaFields = parseEnvSchema(config.envSchema);
+	const sensitiveKeys = new Set(schemaFields.filter((f) => f.sensitive).map((f) => f.key));
+	const allowedKeys = new Set(schemaFields.map((f) => f.key));
+	const sensitiveUpdates = {};
+	const configUpdates = {};
+	for (const [k, v] of Object.entries(valuesRaw)) {
+		if (!allowedKeys.has(k)) continue;
+		const val = typeof v === "string" ? v : "";
+		if (sensitiveKeys.has(k)) sensitiveUpdates[k] = val;
+		else configUpdates[k] = val;
+	}
+	if (Object.keys(sensitiveUpdates).length === 0 && Object.keys(configUpdates).length === 0) return errorResponse(400, "bad_request", "no schema-declared keys supplied", {}, requestId);
+	try {
+		if (Object.keys(sensitiveUpdates).length > 0) writeStackSecretEnv(state, sensitiveUpdates);
+		if (Object.keys(configUpdates).length > 0) patchSecretsEnvFile(state.homeDir, configUpdates);
+	} catch (err) {
+		logger.error("write failed", {
+			name,
+			error: String(err),
+			requestId
+		});
+		return errorResponse(500, "internal_error", err instanceof Error ? err.message : "write failed", {}, requestId);
+	}
+	return jsonResponse(200, {
+		ok: true,
+		name,
+		updated: [...Object.keys(sensitiveUpdates), ...Object.keys(configUpdates)].sort()
+	}, requestId);
+};
+
+export { GET, POST };
+//# sourceMappingURL=_server.ts-BjjicBDy.js.map

package/build/server/chunks/_server.ts-BjjicBDy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-BjjicBDy.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/host/addons/_name_/credentials/_server.ts.js"],"sourcesContent":["import { C as getRegistryAddonConfig, J as patchSecretsEnvFile, Nt as createLogger, Q as readStackSecretEnv, T as listAvailableAddonIds, X as readStackEnv, tt as writeStackSecretEnv } from \"../../../../../../../chunks/compose-args.js\";\nimport \"../../../../../../../chunks/src.js\";\nimport { t as getState } from \"../../../../../../../chunks/state.js\";\nimport { a as getRequestId, c as jsonResponse, d as requireCapability, l as parseJsonBody, r as errorResponse, s as jsonBodyError, u as requireAdmin } from \"../../../../../../../chunks/helpers.js\";\n//#region src/routes/api/host/addons/[name]/credentials/+server.ts\nvar logger = createLogger(\"addons.name.credentials\");\n/**\n* Parse a `.env.schema` file into structured fields.\n*\n* Schema conventions:\n*   - Lines starting with `#` are comments; consecutive comment lines\n*     accumulate as the *description* of the next KEY=VALUE line.\n*   - `# @sensitive` marks the next field as sensitive (renders as a\n*     password input and is masked on GET).\n*   - `# ---` resets the accumulator (used as a section separator).\n*   - `KEY=DEFAULT` declares the field; default may be empty.\n*/\nfunction parseEnvSchema(text) {\n\tconst fields = [];\n\tlet commentBuffer = [];\n\tlet sensitive = false;\n\tfor (const rawLine of text.split(/\\r?\\n/)) {\n\t\tconst line = rawLine.trim();\n\t\tif (!line) continue;\n\t\tif (line.startsWith(\"#\")) {\n\t\t\tconst body = line.slice(1).trim();\n\t\t\tif (body === \"---\") {\n\t\t\t\tcommentBuffer = [];\n\t\t\t\tsensitive = false;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (body.startsWith(\"@\")) {\n\t\t\t\tif (/\\B@sensitive\\b/.test(body)) sensitive = true;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tcommentBuffer.push(body);\n\t\t\tcontinue;\n\t\t}\n\t\tconst eq = line.indexOf(\"=\");\n\t\tif (eq <= 0) continue;\n\t\tconst key = line.slice(0, eq).trim();\n\t\tif (!key) continue;\n\t\tconst def = line.slice(eq + 1).trim();\n\t\tfields.push({\n\t\t\tkey,\n\t\t\tsensitive,\n\t\t\tdescription: commentBuffer.join(\" \").trim(),\n\t\t\tdefault: def\n\t\t});\n\t\tcommentBuffer = [];\n\t\tsensitive = false;\n\t}\n\treturn fields;\n}\nvar GET = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:addons\", requestId);\n\tif (capabilityError) return capabilityError;\n\tconst authErr = requireAdmin(event, requestId);\n\tif (authErr) return authErr;\n\tconst state = getState();\n\tconst name = event.params.name;\n\tif (!listAvailableAddonIds().includes(name)) return errorResponse(404, \"not_found\", `Addon \"${name}\" is not available`, { name }, requestId);\n\tlet config;\n\ttry {\n\t\tconfig = getRegistryAddonConfig(name);\n\t} catch (error) {\n\t\tlogger.error(\"schema read failed\", {\n\t\t\tname,\n\t\t\terror: String(error),\n\t\t\trequestId\n\t\t});\n\t\treturn errorResponse(500, \"internal_error\", `Addon \"${name}\" schema is unavailable`, {}, requestId);\n\t}\n\tconst schemaFields = parseEnvSchema(config.envSchema);\n\tconst secretEnv = readStackSecretEnv(state.homeDir);\n\tconst stackEnv = readStackEnv(state.homeDir);\n\treturn jsonResponse(200, {\n\t\tname,\n\t\tfields: schemaFields.map((f) => {\n\t\t\tconst set = ((f.sensitive ? secretEnv[f.key] : stackEnv[f.key]) ?? \"\").length > 0;\n\t\t\treturn {\n\t\t\t\tkey: f.key,\n\t\t\t\tsensitive: f.sensitive,\n\t\t\t\tdescription: f.description,\n\t\t\t\tdefault: f.default,\n\t\t\t\tset,\n\t\t\t\tsecret: {\n\t\t\t\t\tenvKey: f.key,\n\t\t\t\t\tpresent: set\n\t\t\t\t},\n\t\t\t\tvalue: \"\"\n\t\t\t};\n\t\t})\n\t}, requestId);\n};\nvar POST = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:addons\", requestId);\n\tif (capabilityError) return capabilityError;\n\tconst authErr = requireAdmin(event, requestId);\n\tif (authErr) return authErr;\n\tconst state = getState();\n\tconst name = event.params.name;\n\tif (!listAvailableAddonIds().includes(name)) return errorResponse(404, \"not_found\", `Addon \"${name}\" is not available`, { name }, requestId);\n\tconst parsed = await parseJsonBody(event.request);\n\tif (\"error\" in parsed) return jsonBodyError(parsed, requestId);\n\tconst valuesRaw = parsed.data.values ?? {};\n\tlet config;\n\ttry {\n\t\tconfig = getRegistryAddonConfig(name);\n\t} catch (error) {\n\t\tlogger.error(\"schema read failed (post)\", {\n\t\t\tname,\n\t\t\terror: String(error),\n\t\t\trequestId\n\t\t});\n\t\treturn errorResponse(500, \"internal_error\", `Addon \"${name}\" schema is unavailable`, {}, requestId);\n\t}\n\tconst schemaFields = parseEnvSchema(config.envSchema);\n\tconst sensitiveKeys = new Set(schemaFields.filter((f) => f.sensitive).map((f) => f.key));\n\tconst allowedKeys = new Set(schemaFields.map((f) => f.key));\n\tconst sensitiveUpdates = {};\n\tconst configUpdates = {};\n\tfor (const [k, v] of Object.entries(valuesRaw)) {\n\t\tif (!allowedKeys.has(k)) continue;\n\t\tconst val = typeof v === \"string\" ? v : \"\";\n\t\tif (sensitiveKeys.has(k)) sensitiveUpdates[k] = val;\n\t\telse configUpdates[k] = val;\n\t}\n\tif (Object.keys(sensitiveUpdates).length === 0 && Object.keys(configUpdates).length === 0) return errorResponse(400, \"bad_request\", \"no schema-declared keys supplied\", {}, requestId);\n\ttry {\n\t\tif (Object.keys(sensitiveUpdates).length > 0) writeStackSecretEnv(state, sensitiveUpdates);\n\t\tif (Object.keys(configUpdates).length > 0) patchSecretsEnvFile(state.homeDir, configUpdates);\n\t} catch (err) {\n\t\tlogger.error(\"write failed\", {\n\t\t\tname,\n\t\t\terror: String(err),\n\t\t\trequestId\n\t\t});\n\t\treturn errorResponse(500, \"internal_error\", err instanceof Error ? err.message : \"write failed\", {}, requestId);\n\t}\n\treturn jsonResponse(200, {\n\t\tok: true,\n\t\tname,\n\t\tupdated: [...Object.keys(sensitiveUpdates), ...Object.keys(configUpdates)].sort()\n\t}, requestId);\n};\n//#endregion\nexport { GET, POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAIA;AACA,IAAI,MAAM,GAAG,YAAY,CAAC,yBAAyB,CAAC;AACpD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,IAAI,EAAE;AAC9B,CAAC,MAAM,MAAM,GAAG,EAAE;AAClB,CAAC,IAAI,aAAa,GAAG,EAAE;AACvB,CAAC,IAAI,SAAS,GAAG,KAAK;AACtB,CAAC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;AAC5C,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE;AAC7B,EAAE,IAAI,CAAC,IAAI,EAAE;AACb,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;AAC5B,GAAG,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;AACpC,GAAG,IAAI,IAAI,KAAK,KAAK,EAAE;AACvB,IAAI,aAAa,GAAG,EAAE;AACtB,IAAI,SAAS,GAAG,KAAK;AACrB,IAAI;AACJ,GAAG;AACH,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;AAC7B,IAAI,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,GAAG,IAAI;AACrD,IAAI;AACJ,GAAG;AACH,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;AAC3B,GAAG;AACH,EAAE;AACF,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;AAC9B,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;AACf,EAAE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;AACtC,EAAE,IAAI,CAAC,GAAG,EAAE;AACZ,EAAE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE;AACvC,EAAE,MAAM,CAAC,IAAI,CAAC;AACd,GAAG,GAAG;AACN,GAAG,SAAS;AACZ,GAAG,WAAW,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;AAC9C,GAAG,OAAO,EAAE;AACZ,GAAG,CAAC;AACJ,EAAE,aAAa,GAAG,EAAE;AACpB,EAAE,SAAS,GAAG,KAAK;AACnB,CAAC;AACD,CAAC,OAAO,MAAM;AACd;AACG,IAAC,GAAG,GAAG,OAAO,KAAK,KAAK;AAC3B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,CAAC;AAC3E,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AAC/C,CAAC,IAAI,OAAO,EAAE,OAAO,OAAO;AAC5B,CAAC,MAAM,KAAK,GAAG,QAAQ,EAAE;AACzB,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI;AAC/B,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,CAAC;AAC7I,CAAC,IAAI,MAAM;AACX,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC;AACvC,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE;AACjB,EAAE,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE;AACrC,GAAG,IAAI;AACP,GAAG,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;AACvB,GAAG;AACH,GAAG,CAAC;AACJ,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,gBAAgB,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,uBAAuB,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC;AACrG,CAAC;AACD,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC;AACtD,CAAC,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC;AACpD,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC;AAC7C,CAAC,OAAO,YAAY,CAAC,GAAG,EAAE;AAC1B,EAAE,IAAI;AACN,EAAE,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK;AAClC,GAAG,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,GAAG,CAAC;AACpF,GAAG,OAAO;AACV,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG;AACd,IAAI,SAAS,EAAE,CAAC,CAAC,SAAS;AAC1B,IAAI,WAAW,EAAE,CAAC,CAAC,WAAW;AAC9B,IAAI,OAAO,EAAE,CAAC,CAAC,OAAO;AACtB,IAAI,GAAG;AACP,IAAI,MAAM,EAAE;AACZ,KAAK,MAAM,EAAE,CAAC,CAAC,GAAG;AAClB,KAAK,OAAO,EAAE;AACd,KAAK;AACL,IAAI,KAAK,EAAE;AACX,IAAI;AACJ,EAAE,CAAC;AACH,EAAE,EAAE,SAAS,CAAC;AACd;AACG,IAAC,IAAI,GAAG,OAAO,KAAK,KAAK;AAC5B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,CAAC;AAC3E,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AAC/C,CAAC,IAAI,OAAO,EAAE,OAAO,OAAO;AAC5B,CAAC,MAAM,KAAK,GAAG,QAAQ,EAAE;AACzB,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI;AAC/B,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,CAAC;AAC7I,CAAC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;AAClD,CAAC,IAAI,OAAO,IAAI,MAAM,EAAE,OAAO,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC;AAC/D,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE;AAC3C,CAAC,IAAI,MAAM;AACX,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC;AACvC,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE;AACjB,EAAE,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE;AAC5C,GAAG,IAAI;AACP,GAAG,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;AACvB,GAAG;AACH,GAAG,CAAC;AACJ,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,gBAAgB,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,uBAAuB,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC;AACrG,CAAC;AACD,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC;AACtD,CAAC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;AACzF,CAAC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC,MAAM,gBAAgB,GAAG,EAAE;AAC5B,CAAC,MAAM,aAAa,GAAG,EAAE;AACzB,CAAC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;AACjD,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;AAC3B,EAAE,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,QAAQ,GAAG,CAAC,GAAG,EAAE;AAC5C,EAAE,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,GAAG;AACrD,OAAO,aAAa,CAAC,CAAC,CAAC,GAAG,GAAG;AAC7B,CAAC;AACD,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,kCAAkC,EAAE,EAAE,EAAE,SAAS,CAAC;AACvL,CAAC,IAAI;AACL,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,CAAC;AAC5F,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC;AAC9F,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE;AAC/B,GAAG,IAAI;AACP,GAAG,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;AACrB,GAAG;AACH,GAAG,CAAC;AACJ,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,cAAc,EAAE,EAAE,EAAE,SAAS,CAAC;AACjH,CAAC;AACD,CAAC,OAAO,YAAY,CAAC,GAAG,EAAE;AAC1B,EAAE,EAAE,EAAE,IAAI;AACV,EAAE,IAAI;AACN,EAAE,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;AACjF,EAAE,EAAE,SAAS,CAAC;AACd;;;;"}