@openpalm/ui 0.12.52 → 0.13.0-beta.2

package/build/server/chunks/_server.ts-Dj6nwJgl.js

@@ -0,0 +1,42 @@
+import { d as getRequestId, l as requireCapability, r as requireAdmin, k as jsonResponse } from './helpers-q4Ng8QTq.js';
+import { l as loadProviderPage } from './catalog-7z8dgrJF.js';
+import './src-BwQUi60U.js';
+import './provider-constants-1s1k8kbj.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:fs';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+import './endpoints-B9ePqrMw.js';
+import './state-Dm7U51xT.js';
+import './features-0lgyQreD.js';
+import './coercion-TNFJisCC.js';
+import './http-jBNJXVHg.js';
+import './config-I5hb-W80.js';
+
+//#region src/routes/api/host/providers/+server.ts
+var GET = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:secrets", requestId);
+	if (capabilityError) return capabilityError;
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	return jsonResponse(200, await loadProviderPage(), requestId);
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts-Dj6nwJgl.js.map

package/build/server/chunks/_server.ts-Dj6nwJgl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-Dj6nwJgl.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/host/providers/_server.ts.js"],"sourcesContent":["import { a as getRequestId, c as jsonResponse, d as requireCapability, u as requireAdmin } from \"../../../../../chunks/helpers.js\";\nimport { t as loadProviderPage } from \"../../../../../chunks/catalog.js\";\n//#region src/routes/api/host/providers/+server.ts\nvar GET = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:secrets\", requestId);\n\tif (capabilityError) return capabilityError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\treturn jsonResponse(200, await loadProviderPage(), requestId);\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA;AACG,IAAC,GAAG,GAAG,OAAO,KAAK,KAAK;AAC3B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC;AAC5E,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,OAAO,YAAY,CAAC,GAAG,EAAE,MAAM,gBAAgB,EAAE,EAAE,SAAS,CAAC;AAC9D;;;;"}

package/build/server/chunks/_server.ts-Dl-Rn5Ku.js

@@ -0,0 +1,68 @@
+import { X as dismissSecretStripNotice, aD as readSecretStripNotice, G as createLogger } from './src-BwQUi60U.js';
+import { g as getState } from './state-Dm7U51xT.js';
+import { d as getRequestId, l as requireCapability, r as requireAdmin, k as jsonResponse, e as errorResponse } from './helpers-q4Ng8QTq.js';
+import './provider-constants-1s1k8kbj.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:fs';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+import './endpoints-B9ePqrMw.js';
+import './features-0lgyQreD.js';
+
+//#region src/routes/api/host/secret-notice/+server.ts
+var logger = createLogger("secret-notice");
+/**
+* #502 — one-time notice that secret-looking keys were removed from stack.env.
+* The strip itself is correct per the secret-boundary contract; this surfaces
+* it so the user knows where their value went and how to re-add it.
+*/
+var GET = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:secrets", requestId);
+	if (capabilityError) return capabilityError;
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	const state = getState();
+	try {
+		return jsonResponse(200, {
+			ok: true,
+			notice: readSecretStripNotice(state)
+		}, requestId);
+	} catch (e) {
+		return errorResponse(500, "secret_notice_failed", e instanceof Error ? e.message : String(e), {}, requestId);
+	}
+};
+/** Dismiss the one-time notice. */
+var DELETE = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:secrets", requestId);
+	if (capabilityError) return capabilityError;
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	const state = getState();
+	try {
+		dismissSecretStripNotice(state);
+		logger.info("secret-strip notice dismissed", { requestId });
+		return jsonResponse(200, { ok: true }, requestId);
+	} catch (e) {
+		return errorResponse(500, "secret_notice_dismiss_failed", e instanceof Error ? e.message : String(e), {}, requestId);
+	}
+};
+
+export { DELETE, GET };
+//# sourceMappingURL=_server.ts-Dl-Rn5Ku.js.map

package/build/server/chunks/_server.ts-Dl-Rn5Ku.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-Dl-Rn5Ku.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/host/secret-notice/_server.ts.js"],"sourcesContent":["import { N as dismissSecretStripNotice, Nt as createLogger, P as readSecretStripNotice } from \"../../../../../chunks/compose-args.js\";\nimport \"../../../../../chunks/src.js\";\nimport { t as getState } from \"../../../../../chunks/state.js\";\nimport { a as getRequestId, c as jsonResponse, d as requireCapability, r as errorResponse, u as requireAdmin } from \"../../../../../chunks/helpers.js\";\n//#region src/routes/api/host/secret-notice/+server.ts\nvar logger = createLogger(\"secret-notice\");\n/**\n* #502 — one-time notice that secret-looking keys were removed from stack.env.\n* The strip itself is correct per the secret-boundary contract; this surfaces\n* it so the user knows where their value went and how to re-add it.\n*/\nvar GET = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:secrets\", requestId);\n\tif (capabilityError) return capabilityError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst state = getState();\n\ttry {\n\t\treturn jsonResponse(200, {\n\t\t\tok: true,\n\t\t\tnotice: readSecretStripNotice(state)\n\t\t}, requestId);\n\t} catch (e) {\n\t\treturn errorResponse(500, \"secret_notice_failed\", e instanceof Error ? e.message : String(e), {}, requestId);\n\t}\n};\n/** Dismiss the one-time notice. */\nvar DELETE = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:secrets\", requestId);\n\tif (capabilityError) return capabilityError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst state = getState();\n\ttry {\n\t\tdismissSecretStripNotice(state);\n\t\tlogger.info(\"secret-strip notice dismissed\", { requestId });\n\t\treturn jsonResponse(200, { ok: true }, requestId);\n\t} catch (e) {\n\t\treturn errorResponse(500, \"secret_notice_dismiss_failed\", e instanceof Error ? e.message : String(e), {}, requestId);\n\t}\n};\n//#endregion\nexport { DELETE, GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAIA;AACA,IAAI,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC;AAC1C;AACA;AACA;AACA;AACA;AACG,IAAC,GAAG,GAAG,OAAO,KAAK,KAAK;AAC3B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC;AAC5E,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,KAAK,GAAG,QAAQ,EAAE;AACzB,CAAC,IAAI;AACL,EAAE,OAAO,YAAY,CAAC,GAAG,EAAE;AAC3B,GAAG,EAAE,EAAE,IAAI;AACX,GAAG,MAAM,EAAE,qBAAqB,CAAC,KAAK;AACtC,GAAG,EAAE,SAAS,CAAC;AACf,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,sBAAsB,EAAE,CAAC,YAAY,KAAK,GAAG,CAAC,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC;AAC9G,CAAC;AACD;AACA;AACG,IAAC,MAAM,GAAG,OAAO,KAAK,KAAK;AAC9B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC;AAC5E,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,KAAK,GAAG,QAAQ,EAAE;AACzB,CAAC,IAAI;AACL,EAAE,wBAAwB,CAAC,KAAK,CAAC;AACjC,EAAE,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,SAAS,EAAE,CAAC;AAC7D,EAAE,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,CAAC;AACnD,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,8BAA8B,EAAE,CAAC,YAAY,KAAK,GAAG,CAAC,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC;AACtH,CAAC;AACD;;;;"}

package/build/server/chunks/_server.ts-DnczK3Pw.js

@@ -0,0 +1,49 @@
+import { j as json } from './exports-CcmcYU0M.js';
+import { g as getState } from './state-Dm7U51xT.js';
+import { g as getDeployState } from './setup-deploy-DleJTifu.js';
+import './utils-OXHIhUb5.js';
+import './src-BwQUi60U.js';
+import './provider-constants-1s1k8kbj.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:fs';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+
+//#region src/routes/api/setup/deploy-status/+server.ts
+function resolvePorts() {
+	return {
+		admin: Number(process.env.OP_HOST_UI_PORT) || 3880,
+		assistant: Number(process.env.OP_HOST_ASSISTANT_PORT) || 3800
+	};
+}
+var GET = () => {
+	const state = getDeployState(getState());
+	return json({
+		ok: true,
+		setupComplete: state.setupComplete,
+		deploying: state.deploying,
+		deployStatus: state.deployStatus,
+		deployError: state.deployError,
+		imageWarning: state.imageWarning,
+		phase: state.phase,
+		ports: resolvePorts()
+	});
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts-DnczK3Pw.js.map

package/build/server/chunks/_server.ts-DnczK3Pw.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-DnczK3Pw.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/setup/deploy-status/_server.ts.js"],"sourcesContent":["import { r as json } from \"../../../../../chunks/exports.js\";\nimport { t as getState } from \"../../../../../chunks/state.js\";\nimport { t as getDeployState } from \"../../../../../chunks/setup-deploy.js\";\n//#region src/routes/api/setup/deploy-status/+server.ts\nfunction resolvePorts() {\n\treturn {\n\t\tadmin: Number(process.env.OP_HOST_UI_PORT) || 3880,\n\t\tassistant: Number(process.env.OP_HOST_ASSISTANT_PORT) || 3800\n\t};\n}\nvar GET = () => {\n\tconst state = getDeployState(getState());\n\treturn json({\n\t\tok: true,\n\t\tsetupComplete: state.setupComplete,\n\t\tdeploying: state.deploying,\n\t\tdeployStatus: state.deployStatus,\n\t\tdeployError: state.deployError,\n\t\timageWarning: state.imageWarning,\n\t\tphase: state.phase,\n\t\tports: resolvePorts()\n\t});\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAGA;AACA,SAAS,YAAY,GAAG;AACxB,CAAC,OAAO;AACR,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI;AACpD,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI;AAC3D,EAAE;AACF;AACG,IAAC,GAAG,GAAG,MAAM;AAChB,CAAC,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC;AACzC,CAAC,OAAO,IAAI,CAAC;AACb,EAAE,EAAE,EAAE,IAAI;AACV,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa;AACpC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS;AAC5B,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;AAClC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;AAChC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;AAClC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK;AACpB,EAAE,KAAK,EAAE,YAAY;AACrB,EAAE,CAAC;AACH;;;;"}

package/build/server/chunks/_server.ts-Dq4RvC5F.js

@@ -0,0 +1,69 @@
+import { af as isAllowedService, p as checkDocker, aL as reconcileHostOwnership, H as HostSwapBlockedError, B as composeStart, n as buildComposeOptions, G as createLogger } from './src-BwQUi60U.js';
+import { g as getState } from './state-Dm7U51xT.js';
+import { d as getRequestId, l as requireCapability, r as requireAdmin, p as parseJsonBody, j as jsonBodyError, e as errorResponse, k as jsonResponse } from './helpers-q4Ng8QTq.js';
+import './provider-constants-1s1k8kbj.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:fs';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+import './endpoints-B9ePqrMw.js';
+import './features-0lgyQreD.js';
+
+//#region src/routes/api/host/containers/up/+server.ts
+var logger = createLogger("containers-up");
+var POST = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:containers", requestId);
+	if (capabilityError) return capabilityError;
+	logger.info("container start request received", { requestId });
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	const state = getState();
+	const result = await parseJsonBody(event.request);
+	if ("error" in result) return jsonBodyError(result, requestId);
+	const body = result.data;
+	const service = typeof body.service === "string" ? body.service : "";
+	logger.info("starting service", {
+		requestId,
+		service
+	});
+	if (!isAllowedService(service, state.configDir)) return errorResponse(400, "invalid_service", "Service is not in allowlist", { service }, requestId);
+	if ((await checkDocker()).ok) {
+		try {
+			await reconcileHostOwnership(state, { services: [service] });
+		} catch (err) {
+			if (err instanceof HostSwapBlockedError) return errorResponse(409, "host_swap_blocked", "OP_HOME appears to have moved from another host. Ownership must be adopted for this host before starting. Run `openpalm start --adopt-host` from the host CLI, then retry.", {
+				service,
+				previousHost: err.previousIdentity?.host ?? null,
+				currentHost: err.currentIdentity.host
+			}, requestId);
+			throw err;
+		}
+		const result = await composeStart([service], buildComposeOptions(state));
+		if (result.ok) state.services[service] = "running";
+		else return errorResponse(500, "docker_error", `Failed to start service: ${result.stderr}`, { service }, requestId);
+	} else state.services[service] = "running";
+	return jsonResponse(200, {
+		ok: true,
+		service,
+		status: state.services[service]
+	}, requestId);
+};
+
+export { POST };
+//# sourceMappingURL=_server.ts-Dq4RvC5F.js.map

package/build/server/chunks/_server.ts-Dq4RvC5F.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-Dq4RvC5F.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/host/containers/up/_server.ts.js"],"sourcesContent":["import { Nt as createLogger, _ as HostSwapBlockedError, t as buildComposeOptions, v as reconcileHostOwnership } from \"../../../../../../chunks/compose-args.js\";\nimport { g as composeStart, i as checkDocker } from \"../../../../../../chunks/docker.js\";\nimport { O as isAllowedService } from \"../../../../../../chunks/src.js\";\nimport { t as getState } from \"../../../../../../chunks/state.js\";\nimport { a as getRequestId, c as jsonResponse, d as requireCapability, l as parseJsonBody, r as errorResponse, s as jsonBodyError, u as requireAdmin } from \"../../../../../../chunks/helpers.js\";\n//#region src/routes/api/host/containers/up/+server.ts\nvar logger = createLogger(\"containers-up\");\nvar POST = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:containers\", requestId);\n\tif (capabilityError) return capabilityError;\n\tlogger.info(\"container start request received\", { requestId });\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst state = getState();\n\tconst result = await parseJsonBody(event.request);\n\tif (\"error\" in result) return jsonBodyError(result, requestId);\n\tconst body = result.data;\n\tconst service = typeof body.service === \"string\" ? body.service : \"\";\n\tlogger.info(\"starting service\", {\n\t\trequestId,\n\t\tservice\n\t});\n\tif (!isAllowedService(service, state.configDir)) return errorResponse(400, \"invalid_service\", \"Service is not in allowlist\", { service }, requestId);\n\tif ((await checkDocker()).ok) {\n\t\ttry {\n\t\t\tawait reconcileHostOwnership(state, { services: [service] });\n\t\t} catch (err) {\n\t\t\tif (err instanceof HostSwapBlockedError) return errorResponse(409, \"host_swap_blocked\", \"OP_HOME appears to have moved from another host. Ownership must be adopted for this host before starting. Run `openpalm start --adopt-host` from the host CLI, then retry.\", {\n\t\t\t\tservice,\n\t\t\t\tpreviousHost: err.previousIdentity?.host ?? null,\n\t\t\t\tcurrentHost: err.currentIdentity.host\n\t\t\t}, requestId);\n\t\t\tthrow err;\n\t\t}\n\t\tconst result = await composeStart([service], buildComposeOptions(state));\n\t\tif (result.ok) state.services[service] = \"running\";\n\t\telse return errorResponse(500, \"docker_error\", `Failed to start service: ${result.stderr}`, { service }, requestId);\n\t} else state.services[service] = \"running\";\n\treturn jsonResponse(200, {\n\t\tok: true,\n\t\tservice,\n\t\tstatus: state.services[service]\n\t}, requestId);\n};\n//#endregion\nexport { POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAKA;AACA,IAAI,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC;AACvC,IAAC,IAAI,GAAG,OAAO,KAAK,KAAK;AAC5B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,EAAE,SAAS,CAAC;AAC/E,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,SAAS,EAAE,CAAC;AAC/D,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,KAAK,GAAG,QAAQ,EAAE;AACzB,CAAC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;AAClD,CAAC,IAAI,OAAO,IAAI,MAAM,EAAE,OAAO,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC;AAC/D,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI;AACzB,CAAC,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,GAAG,IAAI,CAAC,OAAO,GAAG,EAAE;AACrE,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE;AACjC,EAAE,SAAS;AACX,EAAE;AACF,EAAE,CAAC;AACH,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC;AACrJ,CAAC,IAAI,CAAC,MAAM,WAAW,EAAE,EAAE,EAAE,EAAE;AAC/B,EAAE,IAAI;AACN,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;AAC/D,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,IAAI,GAAG,YAAY,oBAAoB,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,mBAAmB,EAAE,4KAA4K,EAAE;AACzQ,IAAI,OAAO;AACX,IAAI,YAAY,EAAE,GAAG,CAAC,gBAAgB,EAAE,IAAI,IAAI,IAAI;AACpD,IAAI,WAAW,EAAE,GAAG,CAAC,eAAe,CAAC;AACrC,IAAI,EAAE,SAAS,CAAC;AAChB,GAAG,MAAM,GAAG;AACZ,EAAE;AACF,EAAE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC;AAC1E,EAAE,IAAI,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,SAAS;AACpD,OAAO,OAAO,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,CAAC,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC;AACrH,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,SAAS;AAC3C,CAAC,OAAO,YAAY,CAAC,GAAG,EAAE;AAC1B,EAAE,EAAE,EAAE,IAAI;AACV,EAAE,OAAO;AACT,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;AAChC,EAAE,EAAE,SAAS,CAAC;AACd;;;;"}

package/build/server/chunks/_server.ts-DrGzrygC.js

@@ -0,0 +1,103 @@
+import { j as json } from './exports-CcmcYU0M.js';
+import { a as PROVIDER_KEY_MAP } from './provider-constants-1s1k8kbj.js';
+import { ah as isSetupComplete, aV as resolveOpenPalmHome, Q as detectGpu, T as detectLocalProviders, R as detectHostOpenCode, aK as recommendSetup, j as authJsonPath } from './src-BwQUi60U.js';
+import { g as getState } from './state-Dm7U51xT.js';
+import { r as requireAdmin, d as getRequestId, g as getOpenCodeClient } from './helpers-q4Ng8QTq.js';
+import { a as LOCAL_PROVIDER_IDS } from './constants-B7J5DDaI.js';
+import { existsSync, readFileSync } from 'node:fs';
+import './utils-OXHIhUb5.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+import './endpoints-B9ePqrMw.js';
+import './features-0lgyQreD.js';
+
+//#region src/routes/api/setup/recommend/+server.ts
+/**
+* Providers to exclude from the detected "cloud" list: everything that runs on
+* this computer (LOCAL_PROVIDER_IDS) plus `openai-compatible`. Custom
+* openai-compatible endpoints are detected separately as host providers, so
+* counting them as cloud would double-count them here — this is a server-side
+* recommendation concern only, which is why it stays a superset rather than
+* being folded into the shared LOCAL_PROVIDER_IDS.
+*/
+var CLOUD_EXCLUDED_PROVIDER_IDS = new Set([...LOCAL_PROVIDER_IDS, "openai-compatible"]);
+/** Providers that have credentials stored in OP_HOME auth.json (API key or OAuth). */
+function authJsonConnected() {
+	try {
+		const path = authJsonPath(getState());
+		if (!existsSync(path)) return [];
+		const data = JSON.parse(readFileSync(path, "utf-8"));
+		return Object.keys(data ?? {});
+	} catch {
+		return [];
+	}
+}
+/** Fallback: providers whose API-key env var is present in the process env. */
+function envKeyConnected() {
+	const out = [];
+	for (const [provider, envVar] of Object.entries(PROVIDER_KEY_MAP)) if (process.env[envVar]) out.push(provider);
+	return out;
+}
+/** Cloud providers = OpenCode connected[] ∪ auth.json credentials, minus locals.
+*  Falls back to env-key detection when OpenCode is unavailable. */
+async function detectCloudProviders() {
+	let connected;
+	try {
+		const client = getOpenCodeClient();
+		if (await client.isAvailable()) {
+			const catalog = await client.proxy("/provider");
+			const raw = catalog.ok ? catalog.data : {};
+			connected = Array.from(new Set([...raw.connected ?? [], ...authJsonConnected()]));
+		} else connected = Array.from(new Set([...authJsonConnected(), ...envKeyConnected()]));
+	} catch {
+		connected = Array.from(new Set([...authJsonConnected(), ...envKeyConnected()]));
+	}
+	return connected.filter((id) => !CLOUD_EXCLUDED_PROVIDER_IDS.has(id));
+}
+var GET = async (event) => {
+	if (isSetupComplete(resolveOpenPalmHome())) {
+		const authError = requireAdmin(event, getRequestId(event));
+		if (authError) return authError;
+	}
+	const [cloudProviders, gpu, localDetections, hostOpenCode] = await Promise.all([
+		detectCloudProviders(),
+		detectGpu(),
+		detectLocalProviders(),
+		Promise.resolve(detectHostOpenCode())
+	]);
+	const hostProviders = localDetections.filter((p) => p.available).map((p) => ({
+		provider: p.provider,
+		url: p.url
+	}));
+	return json({
+		ok: true,
+		recommendation: recommendSetup({
+			cloudProviders,
+			hostProviders,
+			gpu,
+			hostCredentialCount: hostOpenCode.credentialCount
+		}),
+		gpu,
+		cloudProviders,
+		hostProviders
+	});
+};
+
+export { GET };
+//# sourceMappingURL=_server.ts-DrGzrygC.js.map

package/build/server/chunks/_server.ts-DrGzrygC.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-DrGzrygC.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/setup/recommend/_server.ts.js"],"sourcesContent":["import { r as json } from \"../../../../../chunks/exports.js\";\nimport { i as PROVIDER_KEY_MAP } from \"../../../../../chunks/provider-constants.js\";\nimport { Tt as resolveOpenPalmHome, dt as authJsonPath } from \"../../../../../chunks/compose-args.js\";\nimport { d as detectGpu, f as detectLocalProviders, o as detectHostOpenCode, u as recommendSetup, z as isSetupComplete } from \"../../../../../chunks/src.js\";\nimport { t as getState } from \"../../../../../chunks/state.js\";\nimport { a as getRequestId, i as getOpenCodeClient, u as requireAdmin } from \"../../../../../chunks/helpers.js\";\nimport { r as LOCAL_PROVIDER_IDS } from \"../../../../../chunks/constants.js\";\nimport { existsSync, readFileSync } from \"node:fs\";\n//#region src/routes/api/setup/recommend/+server.ts\n/**\n* Providers to exclude from the detected \"cloud\" list: everything that runs on\n* this computer (LOCAL_PROVIDER_IDS) plus `openai-compatible`. Custom\n* openai-compatible endpoints are detected separately as host providers, so\n* counting them as cloud would double-count them here — this is a server-side\n* recommendation concern only, which is why it stays a superset rather than\n* being folded into the shared LOCAL_PROVIDER_IDS.\n*/\nvar CLOUD_EXCLUDED_PROVIDER_IDS = new Set([...LOCAL_PROVIDER_IDS, \"openai-compatible\"]);\n/** Providers that have credentials stored in OP_HOME auth.json (API key or OAuth). */\nfunction authJsonConnected() {\n\ttry {\n\t\tconst path = authJsonPath(getState());\n\t\tif (!existsSync(path)) return [];\n\t\tconst data = JSON.parse(readFileSync(path, \"utf-8\"));\n\t\treturn Object.keys(data ?? {});\n\t} catch {\n\t\treturn [];\n\t}\n}\n/** Fallback: providers whose API-key env var is present in the process env. */\nfunction envKeyConnected() {\n\tconst out = [];\n\tfor (const [provider, envVar] of Object.entries(PROVIDER_KEY_MAP)) if (process.env[envVar]) out.push(provider);\n\treturn out;\n}\n/** Cloud providers = OpenCode connected[] ∪ auth.json credentials, minus locals.\n*  Falls back to env-key detection when OpenCode is unavailable. */\nasync function detectCloudProviders() {\n\tlet connected;\n\ttry {\n\t\tconst client = getOpenCodeClient();\n\t\tif (await client.isAvailable()) {\n\t\t\tconst catalog = await client.proxy(\"/provider\");\n\t\t\tconst raw = catalog.ok ? catalog.data : {};\n\t\t\tconnected = Array.from(new Set([...raw.connected ?? [], ...authJsonConnected()]));\n\t\t} else connected = Array.from(new Set([...authJsonConnected(), ...envKeyConnected()]));\n\t} catch {\n\t\tconnected = Array.from(new Set([...authJsonConnected(), ...envKeyConnected()]));\n\t}\n\treturn connected.filter((id) => !CLOUD_EXCLUDED_PROVIDER_IDS.has(id));\n}\nvar GET = async (event) => {\n\tif (isSetupComplete(resolveOpenPalmHome())) {\n\t\tconst authError = requireAdmin(event, getRequestId(event));\n\t\tif (authError) return authError;\n\t}\n\tconst [cloudProviders, gpu, localDetections, hostOpenCode] = await Promise.all([\n\t\tdetectCloudProviders(),\n\t\tdetectGpu(),\n\t\tdetectLocalProviders(),\n\t\tPromise.resolve(detectHostOpenCode())\n\t]);\n\tconst hostProviders = localDetections.filter((p) => p.available).map((p) => ({\n\t\tprovider: p.provider,\n\t\turl: p.url\n\t}));\n\treturn json({\n\t\tok: true,\n\t\trecommendation: recommendSetup({\n\t\t\tcloudProviders,\n\t\t\thostProviders,\n\t\t\tgpu,\n\t\t\thostCredentialCount: hostOpenCode.credentialCount\n\t\t}),\n\t\tgpu,\n\t\tcloudProviders,\n\t\thostProviders\n\t});\n};\n//#endregion\nexport { GET };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,2BAA2B,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;AACvF;AACA,SAAS,iBAAiB,GAAG;AAC7B,CAAC,IAAI;AACL,EAAE,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;AACvC,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE;AAClC,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACtD,EAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;AAChC,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,EAAE;AACX,CAAC;AACD;AACA;AACA,SAAS,eAAe,GAAG;AAC3B,CAAC,MAAM,GAAG,GAAG,EAAE;AACf,CAAC,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;AAC/G,CAAC,OAAO,GAAG;AACX;AACA;AACA;AACA,eAAe,oBAAoB,GAAG;AACtC,CAAC,IAAI,SAAS;AACd,CAAC,IAAI;AACL,EAAE,MAAM,MAAM,GAAG,iBAAiB,EAAE;AACpC,EAAE,IAAI,MAAM,MAAM,CAAC,WAAW,EAAE,EAAE;AAClC,GAAG,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;AAClD,GAAG,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,GAAG,EAAE;AAC7C,GAAG,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,SAAS,IAAI,EAAE,EAAE,GAAG,iBAAiB,EAAE,CAAC,CAAC,CAAC;AACpF,EAAE,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,iBAAiB,EAAE,EAAE,GAAG,eAAe,EAAE,CAAC,CAAC,CAAC;AACxF,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,iBAAiB,EAAE,EAAE,GAAG,eAAe,EAAE,CAAC,CAAC,CAAC;AACjF,CAAC;AACD,CAAC,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACtE;AACG,IAAC,GAAG,GAAG,OAAO,KAAK,KAAK;AAC3B,CAAC,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAC,EAAE;AAC7C,EAAE,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;AAC5D,EAAE,IAAI,SAAS,EAAE,OAAO,SAAS;AACjC,CAAC;AACD,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,eAAe,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;AAChF,EAAE,oBAAoB,EAAE;AACxB,EAAE,SAAS,EAAE;AACb,EAAE,oBAAoB,EAAE;AACxB,EAAE,OAAO,CAAC,OAAO,CAAC,kBAAkB,EAAE;AACtC,EAAE,CAAC;AACH,CAAC,MAAM,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AAC9E,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;AACtB,EAAE,GAAG,EAAE,CAAC,CAAC;AACT,EAAE,CAAC,CAAC;AACJ,CAAC,OAAO,IAAI,CAAC;AACb,EAAE,EAAE,EAAE,IAAI;AACV,EAAE,cAAc,EAAE,cAAc,CAAC;AACjC,GAAG,cAAc;AACjB,GAAG,aAAa;AAChB,GAAG,GAAG;AACN,GAAG,mBAAmB,EAAE,YAAY,CAAC;AACrC,GAAG,CAAC;AACJ,EAAE,GAAG;AACL,EAAE,cAAc;AAChB,EAAE;AACF,EAAE,CAAC;AACH;;;;"}

package/build/server/chunks/_server.ts-Ds62LEMU.js

@@ -0,0 +1,162 @@
+import { ad as importHostOpenCode, R as detectHostOpenCode, j as authJsonPath, p as checkDocker, n as buildComposeOptions } from './src-BwQUi60U.js';
+import { g as getState } from './state-Dm7U51xT.js';
+import { d as getRequestId, l as requireCapability, r as requireAdmin, p as parseJsonBody, e as errorResponse, k as jsonResponse } from './helpers-q4Ng8QTq.js';
+import { o as opencodeFetch } from './http-jBNJXVHg.js';
+import { w as withSerialQueue } from './serial-queue-D9FEpYVv.js';
+import { c as composeRestart } from './docker3-Dj9Pc_Pt.js';
+import { existsSync, readFileSync } from 'node:fs';
+import './provider-constants-1s1k8kbj.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+import './endpoints-B9ePqrMw.js';
+import './features-0lgyQreD.js';
+
+//#region src/routes/api/host/providers/import-host/+server.ts
+/**
+* POST /api/host/providers/import-host
+*
+* Copies host OpenCode config + auth into OP_HOME, then pushes each
+* imported credential to the running OpenCode server so the providers
+* appear connected immediately (no restart required).
+*
+* - opencode.json: stripped of plugin/mcp/permission keys, merged with
+*   existing OP_HOME config. Provider conflicts preserved by default.
+* - auth.json: byte-copied and chmodded 0o600. Never logged.
+* - Live push: best-effort PUT to OpenCode /auth/{id} per credential.
+*   If OpenCode is unreachable, the file copy still applies and OpenCode
+*   will pick up the credentials on next restart.
+* - Service restart: assistant is restarted after the import so opencode.json
+*   provider blocks are re-read (live push only updates the auth store, not
+*   config).
+*
+* Body (optional JSON):
+*   { overwriteConflicts?: boolean }   — default false
+*
+* Auth: admin token required.
+*/
+/**
+* Restart services that hold provider state in startup config.
+* Best-effort: the file-level import is the durable part; this is the polish
+* that makes the change visible without the user having to bounce things by hand.
+* OpenCode caches opencode.json provider blocks at startup, so imported
+* provider config needs a fresh assistant process.
+*/
+async function restartProviderConsumers() {
+	const services = ["assistant"];
+	if (!(await checkDocker()).ok) return {
+		restarted: [],
+		failed: services.map((s) => ({
+			service: s,
+			error: "docker unavailable"
+		}))
+	};
+	const opts = buildComposeOptions(getState());
+	const restarted = [];
+	const failed = [];
+	for (const service of services) try {
+		const r = await composeRestart([service], opts);
+		if (r.ok) restarted.push(service);
+		else failed.push({
+			service,
+			error: r.stderr || `exit ${r.code}`
+		});
+	} catch (err) {
+		failed.push({
+			service,
+			error: err instanceof Error ? err.message : String(err)
+		});
+	}
+	return {
+		restarted,
+		failed
+	};
+}
+/** Push each auth.json entry to OpenCode's /auth/{id} so the running process sees them. */
+async function pushAuthToOpenCode(authPath) {
+	let raw;
+	try {
+		raw = JSON.parse(readFileSync(authPath, "utf-8"));
+	} catch {
+		return {
+			pushed: 0,
+			failed: []
+		};
+	}
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return {
+		pushed: 0,
+		failed: []
+	};
+	let pushed = 0;
+	const failed = [];
+	for (const [providerId, value] of Object.entries(raw)) try {
+		await opencodeFetch(`/auth/${encodeURIComponent(providerId)}`, {
+			method: "PUT",
+			body: JSON.stringify(value)
+		});
+		pushed++;
+	} catch {
+		failed.push(providerId);
+	}
+	return {
+		pushed,
+		failed
+	};
+}
+var POST = async (event) => {
+	const requestId = getRequestId(event);
+	const capabilityError = requireCapability(event, "host:secrets", requestId);
+	if (capabilityError) return capabilityError;
+	const authError = requireAdmin(event, requestId);
+	if (authError) return authError;
+	return withSerialQueue("admin:providers:import-host", async () => {
+		const state = getState();
+		let overwriteConflicts = false;
+		if ((event.request.headers.get("content-type") ?? "").includes("application/json")) {
+			const parsed = await parseJsonBody(event.request);
+			if (!("error" in parsed)) overwriteConflicts = parsed.data.overwriteConflicts === true;
+		}
+		let result;
+		try {
+			result = importHostOpenCode(state, { overwriteConflicts });
+		} catch (err) {
+			return errorResponse(500, "import_failed", err instanceof Error ? err.message : "Import failed", {}, requestId);
+		}
+		const hostStatus = detectHostOpenCode();
+		let livePush = {
+			pushed: 0,
+			failed: []
+		};
+		const importedAuthPath = authJsonPath(state);
+		if (existsSync(importedAuthPath)) livePush = await pushAuthToOpenCode(importedAuthPath);
+		else if (hostStatus.authPath) livePush = await pushAuthToOpenCode(hostStatus.authPath);
+		const restart = await restartProviderConsumers();
+		return jsonResponse(200, {
+			ok: true,
+			imported: result.imported,
+			conflicts: result.conflicts,
+			livePushed: livePush.pushed,
+			livePushFailed: livePush.failed,
+			restarted: restart.restarted,
+			restartFailed: restart.failed
+		}, requestId);
+	});
+};
+
+export { POST };
+//# sourceMappingURL=_server.ts-Ds62LEMU.js.map

package/build/server/chunks/_server.ts-Ds62LEMU.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-Ds62LEMU.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/host/providers/import-host/_server.ts.js"],"sourcesContent":["import { dt as authJsonPath, t as buildComposeOptions } from \"../../../../../../chunks/compose-args.js\";\nimport { i as checkDocker } from \"../../../../../../chunks/docker.js\";\nimport { o as detectHostOpenCode, s as importHostOpenCode } from \"../../../../../../chunks/src.js\";\nimport { t as getState } from \"../../../../../../chunks/state.js\";\nimport { a as getRequestId, c as jsonResponse, d as requireCapability, l as parseJsonBody, r as errorResponse, u as requireAdmin } from \"../../../../../../chunks/helpers.js\";\nimport { t as opencodeFetch } from \"../../../../../../chunks/http.js\";\nimport { t as withSerialQueue } from \"../../../../../../chunks/serial-queue.js\";\nimport { t as composeRestart } from \"../../../../../../chunks/docker3.js\";\nimport { existsSync, readFileSync } from \"node:fs\";\n//#region src/routes/api/host/providers/import-host/+server.ts\n/**\n* POST /api/host/providers/import-host\n*\n* Copies host OpenCode config + auth into OP_HOME, then pushes each\n* imported credential to the running OpenCode server so the providers\n* appear connected immediately (no restart required).\n*\n* - opencode.json: stripped of plugin/mcp/permission keys, merged with\n*   existing OP_HOME config. Provider conflicts preserved by default.\n* - auth.json: byte-copied and chmodded 0o600. Never logged.\n* - Live push: best-effort PUT to OpenCode /auth/{id} per credential.\n*   If OpenCode is unreachable, the file copy still applies and OpenCode\n*   will pick up the credentials on next restart.\n* - Service restart: assistant is restarted after the import so opencode.json\n*   provider blocks are re-read (live push only updates the auth store, not\n*   config).\n*\n* Body (optional JSON):\n*   { overwriteConflicts?: boolean }   — default false\n*\n* Auth: admin token required.\n*/\n/**\n* Restart services that hold provider state in startup config.\n* Best-effort: the file-level import is the durable part; this is the polish\n* that makes the change visible without the user having to bounce things by hand.\n* OpenCode caches opencode.json provider blocks at startup, so imported\n* provider config needs a fresh assistant process.\n*/\nasync function restartProviderConsumers() {\n\tconst services = [\"assistant\"];\n\tif (!(await checkDocker()).ok) return {\n\t\trestarted: [],\n\t\tfailed: services.map((s) => ({\n\t\t\tservice: s,\n\t\t\terror: \"docker unavailable\"\n\t\t}))\n\t};\n\tconst opts = buildComposeOptions(getState());\n\tconst restarted = [];\n\tconst failed = [];\n\tfor (const service of services) try {\n\t\tconst r = await composeRestart([service], opts);\n\t\tif (r.ok) restarted.push(service);\n\t\telse failed.push({\n\t\t\tservice,\n\t\t\terror: r.stderr || `exit ${r.code}`\n\t\t});\n\t} catch (err) {\n\t\tfailed.push({\n\t\t\tservice,\n\t\t\terror: err instanceof Error ? err.message : String(err)\n\t\t});\n\t}\n\treturn {\n\t\trestarted,\n\t\tfailed\n\t};\n}\n/** Push each auth.json entry to OpenCode's /auth/{id} so the running process sees them. */\nasync function pushAuthToOpenCode(authPath) {\n\tlet raw;\n\ttry {\n\t\traw = JSON.parse(readFileSync(authPath, \"utf-8\"));\n\t} catch {\n\t\treturn {\n\t\t\tpushed: 0,\n\t\t\tfailed: []\n\t\t};\n\t}\n\tif (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return {\n\t\tpushed: 0,\n\t\tfailed: []\n\t};\n\tlet pushed = 0;\n\tconst failed = [];\n\tfor (const [providerId, value] of Object.entries(raw)) try {\n\t\tawait opencodeFetch(`/auth/${encodeURIComponent(providerId)}`, {\n\t\t\tmethod: \"PUT\",\n\t\t\tbody: JSON.stringify(value)\n\t\t});\n\t\tpushed++;\n\t} catch {\n\t\tfailed.push(providerId);\n\t}\n\treturn {\n\t\tpushed,\n\t\tfailed\n\t};\n}\nvar POST = async (event) => {\n\tconst requestId = getRequestId(event);\n\tconst capabilityError = requireCapability(event, \"host:secrets\", requestId);\n\tif (capabilityError) return capabilityError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\treturn withSerialQueue(\"admin:providers:import-host\", async () => {\n\t\tconst state = getState();\n\t\tlet overwriteConflicts = false;\n\t\tif ((event.request.headers.get(\"content-type\") ?? \"\").includes(\"application/json\")) {\n\t\t\tconst parsed = await parseJsonBody(event.request);\n\t\t\tif (!(\"error\" in parsed)) overwriteConflicts = parsed.data.overwriteConflicts === true;\n\t\t}\n\t\tlet result;\n\t\ttry {\n\t\t\tresult = importHostOpenCode(state, { overwriteConflicts });\n\t\t} catch (err) {\n\t\t\treturn errorResponse(500, \"import_failed\", err instanceof Error ? err.message : \"Import failed\", {}, requestId);\n\t\t}\n\t\tconst hostStatus = detectHostOpenCode();\n\t\tlet livePush = {\n\t\t\tpushed: 0,\n\t\t\tfailed: []\n\t\t};\n\t\tconst importedAuthPath = authJsonPath(state);\n\t\tif (existsSync(importedAuthPath)) livePush = await pushAuthToOpenCode(importedAuthPath);\n\t\telse if (hostStatus.authPath) livePush = await pushAuthToOpenCode(hostStatus.authPath);\n\t\tconst restart = await restartProviderConsumers();\n\t\treturn jsonResponse(200, {\n\t\t\tok: true,\n\t\t\timported: result.imported,\n\t\t\tconflicts: result.conflicts,\n\t\t\tlivePushed: livePush.pushed,\n\t\t\tlivePushFailed: livePush.failed,\n\t\t\trestarted: restart.restarted,\n\t\t\trestartFailed: restart.failed\n\t\t}, requestId);\n\t});\n};\n//#endregion\nexport { POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AASA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,wBAAwB,GAAG;AAC1C,CAAC,MAAM,QAAQ,GAAG,CAAC,WAAW,CAAC;AAC/B,CAAC,IAAI,CAAC,CAAC,MAAM,WAAW,EAAE,EAAE,EAAE,EAAE,OAAO;AACvC,EAAE,SAAS,EAAE,EAAE;AACf,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AAC/B,GAAG,OAAO,EAAE,CAAC;AACb,GAAG,KAAK,EAAE;AACV,GAAG,CAAC;AACJ,EAAE;AACF,CAAC,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,EAAE,CAAC;AAC7C,CAAC,MAAM,SAAS,GAAG,EAAE;AACrB,CAAC,MAAM,MAAM,GAAG,EAAE;AAClB,CAAC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,IAAI;AACrC,EAAE,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC;AACjD,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;AACnC,OAAO,MAAM,CAAC,IAAI,CAAC;AACnB,GAAG,OAAO;AACV,GAAG,KAAK,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC;AACrC,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,MAAM,CAAC,IAAI,CAAC;AACd,GAAG,OAAO;AACV,GAAG,KAAK,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AACzD,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,OAAO;AACR,EAAE,SAAS;AACX,EAAE;AACF,EAAE;AACF;AACA;AACA,eAAe,kBAAkB,CAAC,QAAQ,EAAE;AAC5C,CAAC,IAAI,GAAG;AACR,CAAC,IAAI;AACL,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO;AACT,GAAG,MAAM,EAAE,CAAC;AACZ,GAAG,MAAM,EAAE;AACX,GAAG;AACH,CAAC;AACD,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO;AACnE,EAAE,MAAM,EAAE,CAAC;AACX,EAAE,MAAM,EAAE;AACV,EAAE;AACF,CAAC,IAAI,MAAM,GAAG,CAAC;AACf,CAAC,MAAM,MAAM,GAAG,EAAE;AAClB,CAAC,KAAK,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI;AAC5D,EAAE,MAAM,aAAa,CAAC,CAAC,MAAM,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;AACjE,GAAG,MAAM,EAAE,KAAK;AAChB,GAAG,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK;AAC7B,GAAG,CAAC;AACJ,EAAE,MAAM,EAAE;AACV,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;AACzB,CAAC;AACD,CAAC,OAAO;AACR,EAAE,MAAM;AACR,EAAE;AACF,EAAE;AACF;AACG,IAAC,IAAI,GAAG,OAAO,KAAK,KAAK;AAC5B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC;AAC5E,CAAC,IAAI,eAAe,EAAE,OAAO,eAAe;AAC5C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,OAAO,eAAe,CAAC,6BAA6B,EAAE,YAAY;AACnE,EAAE,MAAM,KAAK,GAAG,QAAQ,EAAE;AAC1B,EAAE,IAAI,kBAAkB,GAAG,KAAK;AAChC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE;AACtF,GAAG,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;AACpD,GAAG,IAAI,EAAE,OAAO,IAAI,MAAM,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,KAAK,IAAI;AACzF,EAAE;AACF,EAAE,IAAI,MAAM;AACZ,EAAE,IAAI;AACN,GAAG,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE,EAAE,kBAAkB,EAAE,CAAC;AAC7D,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,OAAO,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,eAAe,EAAE,EAAE,EAAE,SAAS,CAAC;AAClH,EAAE;AACF,EAAE,MAAM,UAAU,GAAG,kBAAkB,EAAE;AACzC,EAAE,IAAI,QAAQ,GAAG;AACjB,GAAG,MAAM,EAAE,CAAC;AACZ,GAAG,MAAM,EAAE;AACX,GAAG;AACH,EAAE,MAAM,gBAAgB,GAAG,YAAY,CAAC,KAAK,CAAC;AAC9C,EAAE,IAAI,UAAU,CAAC,gBAAgB,CAAC,EAAE,QAAQ,GAAG,MAAM,kBAAkB,CAAC,gBAAgB,CAAC;AACzF,OAAO,IAAI,UAAU,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,QAAQ,CAAC;AACxF,EAAE,MAAM,OAAO,GAAG,MAAM,wBAAwB,EAAE;AAClD,EAAE,OAAO,YAAY,CAAC,GAAG,EAAE;AAC3B,GAAG,EAAE,EAAE,IAAI;AACX,GAAG,QAAQ,EAAE,MAAM,CAAC,QAAQ;AAC5B,GAAG,SAAS,EAAE,MAAM,CAAC,SAAS;AAC9B,GAAG,UAAU,EAAE,QAAQ,CAAC,MAAM;AAC9B,GAAG,cAAc,EAAE,QAAQ,CAAC,MAAM;AAClC,GAAG,SAAS,EAAE,OAAO,CAAC,SAAS;AAC/B,GAAG,aAAa,EAAE,OAAO,CAAC;AAC1B,GAAG,EAAE,SAAS,CAAC;AACf,CAAC,CAAC,CAAC;AACH;;;;"}

package/build/server/chunks/_server.ts-DsVbuYhj.js

@@ -0,0 +1,64 @@
+import { d as getRequestId, e as errorResponse, f as getUiLoginPassword, s as safeTokenCompare, b as createSession } from './helpers-q4Ng8QTq.js';
+import { s as sessionCookieHeader } from './session-cookie-qHDuQboc.js';
+import './src-BwQUi60U.js';
+import './provider-constants-1s1k8kbj.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:fs';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+import './endpoints-B9ePqrMw.js';
+import './state-Dm7U51xT.js';
+import './features-0lgyQreD.js';
+
+//#region src/routes/api/auth/session/+server.ts
+/**
+* POST /api/auth/session
+*
+* Issues an `op_session` cookie after verifying the operator-supplied password
+* against `process.env.OP_UI_LOGIN_PASSWORD`.
+*
+* The cookie value is a random UUID session token — NOT the plaintext password.
+* Kept alongside `/api/auth/login` as an alias; both verify the same
+* `password` body field and issue the `op_session` cookie.
+*/
+var POST = async (event) => {
+	const requestId = getRequestId(event);
+	let body;
+	try {
+		body = await event.request.json();
+	} catch {
+		return errorResponse(400, "bad_request", "Invalid JSON body", {}, requestId);
+	}
+	const password = typeof body.password === "string" ? body.password : "";
+	if (!password) return errorResponse(400, "bad_request", "password is required", {}, requestId);
+	const configured = getUiLoginPassword();
+	if (!configured) return errorResponse(503, "admin_not_configured", "OP_UI_LOGIN_PASSWORD has not been set. Complete setup first.", {}, requestId);
+	if (!safeTokenCompare(password, configured)) return errorResponse(401, "unauthorized", "Invalid password", {}, requestId);
+	const sessionToken = createSession();
+	return new Response(JSON.stringify({ ok: true }), {
+		status: 200,
+		headers: {
+			"content-type": "application/json",
+			"set-cookie": sessionCookieHeader(sessionToken, event.request),
+			"x-request-id": requestId
+		}
+	});
+};
+
+export { POST };
+//# sourceMappingURL=_server.ts-DsVbuYhj.js.map

package/build/server/chunks/_server.ts-DsVbuYhj.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_server.ts-DsVbuYhj.js","sources":["../../../.svelte-kit/adapter-node/entries/endpoints/api/auth/session/_server.ts.js"],"sourcesContent":["import { a as getRequestId, f as safeTokenCompare, g as getUiLoginPassword, h as createSession, r as errorResponse } from \"../../../../../chunks/helpers.js\";\nimport { r as sessionCookieHeader } from \"../../../../../chunks/session-cookie.js\";\n//#region src/routes/api/auth/session/+server.ts\n/**\n* POST /api/auth/session\n*\n* Issues an `op_session` cookie after verifying the operator-supplied password\n* against `process.env.OP_UI_LOGIN_PASSWORD`.\n*\n* The cookie value is a random UUID session token — NOT the plaintext password.\n* Kept alongside `/api/auth/login` as an alias; both verify the same\n* `password` body field and issue the `op_session` cookie.\n*/\nvar POST = async (event) => {\n\tconst requestId = getRequestId(event);\n\tlet body;\n\ttry {\n\t\tbody = await event.request.json();\n\t} catch {\n\t\treturn errorResponse(400, \"bad_request\", \"Invalid JSON body\", {}, requestId);\n\t}\n\tconst password = typeof body.password === \"string\" ? body.password : \"\";\n\tif (!password) return errorResponse(400, \"bad_request\", \"password is required\", {}, requestId);\n\tconst configured = getUiLoginPassword();\n\tif (!configured) return errorResponse(503, \"admin_not_configured\", \"OP_UI_LOGIN_PASSWORD has not been set. Complete setup first.\", {}, requestId);\n\tif (!safeTokenCompare(password, configured)) return errorResponse(401, \"unauthorized\", \"Invalid password\", {}, requestId);\n\tconst sessionToken = createSession();\n\treturn new Response(JSON.stringify({ ok: true }), {\n\t\tstatus: 200,\n\t\theaders: {\n\t\t\t\"content-type\": \"application/json\",\n\t\t\t\"set-cookie\": sessionCookieHeader(sessionToken, event.request),\n\t\t\t\"x-request-id\": requestId\n\t\t}\n\t});\n};\n//#endregion\nexport { POST };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,IAAI,GAAG,OAAO,KAAK,KAAK;AAC5B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,IAAI,IAAI;AACT,CAAC,IAAI;AACL,EAAE,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;AACnC,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,mBAAmB,EAAE,EAAE,EAAE,SAAS,CAAC;AAC9E,CAAC;AACD,CAAC,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,GAAG,IAAI,CAAC,QAAQ,GAAG,EAAE;AACxE,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,sBAAsB,EAAE,EAAE,EAAE,SAAS,CAAC;AAC/F,CAAC,MAAM,UAAU,GAAG,kBAAkB,EAAE;AACxC,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,sBAAsB,EAAE,8DAA8D,EAAE,EAAE,EAAE,SAAS,CAAC;AAClJ,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,EAAE,SAAS,CAAC;AAC1H,CAAC,MAAM,YAAY,GAAG,aAAa,EAAE;AACrC,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;AACnD,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,OAAO,EAAE;AACX,GAAG,cAAc,EAAE,kBAAkB;AACrC,GAAG,YAAY,EAAE,mBAAmB,CAAC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC;AACjE,GAAG,cAAc,EAAE;AACnB;AACA,EAAE,CAAC;AACH;;;;"}