@openpalm/ui 0.12.52 → 0.13.0-beta.2

package/build/server/chunks/helpers-q4Ng8QTq.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers-q4Ng8QTq.js","sources":["../../../.svelte-kit/adapter-node/chunks/helpers.js"],"sourcesContent":["import { Tt as resolveOpenPalmHome, at as readSecret } from \"./compose-args.js\";\nimport { W as createOpenCodeClient, r as isRemoteSetupAllowed } from \"./src.js\";\nimport { r as getActiveConnection } from \"./endpoints.js\";\nimport { t as computeServerRuntimeContext } from \"./features.js\";\nimport { createHash, createHmac, timingSafeEqual } from \"node:crypto\";\n//#region src/lib/server/session-store.ts\n/**\n* Stateless signed session tokens.\n*\n* Token format: `<expiresAt>.<hmac-sha256-hex>`\n*   expiresAt — unix ms timestamp when the session expires\n*   signature — HMAC-SHA256(expiresAt, login password)\n*\n* Tokens are self-validating: the server holds no per-session state and\n* sessions survive UI server restarts. Signing with the login password means\n* a password change invalidates all existing sessions — correct behaviour.\n*\n* The signing secret is resolved exactly like login verification\n* (`getUiLoginPassword`): `process.env.OP_UI_LOGIN_PASSWORD` first, then the\n* on-disk stack secret. When NEITHER exists, minting throws and validation\n* fails closed — there is deliberately no fallback secret, because a constant\n* key would let anyone forge an admin token. Reading the file per call also\n* means tokens minted right after the setup wizard writes the password are\n* signed with the real secret, without waiting for a process restart.\n*\n* Logout semantics (known trade-off of stateless tokens): logout revokes the\n* single token the browser presented (in-memory list, cleared on restart) and\n* clears the cookie. Earlier tokens issued to the same browser by sliding\n* renewal remain cryptographically valid until they expire — logout is\n* \"forget my cookie\", not \"kill every credential ever issued\". A real\n* kill-switch is changing the login password, which invalidates everything.\n*/\n/** Session lifetime for both the token expiry and the cookie Max-Age. 14 days. */\nvar SESSION_TTL_MS = 12096e5;\n/** Cookie Max-Age in seconds (Set-Cookie uses seconds, not ms). */\nvar SESSION_TTL_SECONDS = SESSION_TTL_MS / 1e3;\nvar _revoked = /* @__PURE__ */ new Set();\nvar _testOverrides = /* @__PURE__ */ new Set();\n/**\n* Read the operator UI login password from the host environment or the\n* file-based stack secret (`knowledge/secrets/op_ui_login_password`).\n*\n* This is the single source of truth for the password — login verification\n* (helpers.ts) and token signing below both use it, so they can never\n* disagree about whether a password exists. Returns \"\" when neither source\n* has a value (first boot, before the wizard runs).\n*/\nfunction getUiLoginPassword() {\n\tconst envValue = process.env.OP_UI_LOGIN_PASSWORD;\n\tif (envValue) return envValue;\n\treturn readSecret(resolveOpenPalmHome(), \"op_ui_login_password\")?.trimEnd() ?? \"\";\n}\n/** Sign `expiresAt` with the login password. Returns null when no password is configured. */\nfunction signToken(expiresAt) {\n\tconst secret = getUiLoginPassword();\n\tif (!secret) return null;\n\treturn createHmac(\"sha256\", secret).update(String(expiresAt)).digest(\"hex\");\n}\n/**\n* Mint a new signed session token with a 14-day TTL.\n* Place the result in the `op_session` cookie.\n* Throws when no login password is configured — callers must verify a\n* password exists (they all do: login/session/setup-complete check first).\n*/\nfunction createSession() {\n\tconst expiresAt = Date.now() + SESSION_TTL_MS;\n\tconst sig = signToken(expiresAt);\n\tif (sig === null) throw new Error(\"Cannot mint a session: no UI login password is configured.\");\n\treturn `${expiresAt}.${sig}`;\n}\n/**\n* Return true iff `token` is a valid, non-expired, non-revoked session.\n*/\nfunction validateSession(token) {\n\tif (!token) return false;\n\tif (_testOverrides.has(token)) return true;\n\tif (_revoked.has(token)) return false;\n\tconst dot = token.lastIndexOf(\".\");\n\tif (dot < 0) return false;\n\tconst expiresAt = Number(token.slice(0, dot));\n\tif (!Number.isFinite(expiresAt) || Date.now() >= expiresAt) return false;\n\tconst sig = token.slice(dot + 1);\n\tconst expected = signToken(expiresAt);\n\tif (expected === null) return false;\n\tif (sig.length !== expected.length) return false;\n\treturn timingSafeEqual(Buffer.from(sig), Buffer.from(expected));\n}\n/**\n* Sliding renewal: validate the old token, return a new one with a fresh\n* 14-day TTL, or return false if the old token is invalid/expired.\n* The caller must place the returned token in the `op_session` cookie.\n*/\nfunction touchSession(token) {\n\tif (!validateSession(token)) return false;\n\treturn createSession();\n}\n/**\n* Revoke a token (logout). The browser cookie must also be cleared by the caller.\n* The revocation list survives until the next server restart. Entries whose\n* embedded expiry has passed are pruned on each call — an expired token fails\n* validation anyway, so keeping it listed is pure memory growth.\n*/\nfunction invalidateSession(token) {\n\tconst now = Date.now();\n\tfor (const revoked of _revoked) {\n\t\tconst expiresAt = Number(revoked.slice(0, revoked.lastIndexOf(\".\")));\n\t\tif (!Number.isFinite(expiresAt) || expiresAt <= now) _revoked.delete(revoked);\n\t}\n\t_revoked.add(token);\n}\n//#endregion\n//#region src/lib/server/helpers.ts\n/**\n* Lazy OpenCode client bound to the currently active endpoint. The client is\n* recreated whenever the active endpoint URL changes so user switches in the\n* UI take effect on the next call.\n*/\nvar _openCodeClient;\nvar _openCodeClientUrl;\nfunction getOpenCodeClient() {\n\tconst { url } = getActiveConnection();\n\tif (!_openCodeClient || url !== _openCodeClientUrl) {\n\t\t_openCodeClient = createOpenCodeClient({ baseUrl: url });\n\t\t_openCodeClientUrl = url;\n\t}\n\treturn _openCodeClient;\n}\nfunction safeTokenCompare(a, b) {\n\tif (typeof a !== \"string\" || typeof b !== \"string\") return false;\n\tif (!a || !b) return false;\n\treturn timingSafeEqual(createHash(\"sha256\").update(a).digest(), createHash(\"sha256\").update(b).digest());\n}\n/** Standard JSON response with request ID header */\nfunction jsonResponse(status, body, requestId = \"\") {\n\treturn new Response(JSON.stringify(body), {\n\t\tstatus,\n\t\theaders: {\n\t\t\t\"content-type\": \"application/json\",\n\t\t\t...requestId ? { \"x-request-id\": requestId } : {}\n\t\t}\n\t});\n}\n/** Standard error envelope */\nfunction errorResponse(status, error, message, details = {}, requestId = \"\") {\n\treturn jsonResponse(status, {\n\t\terror,\n\t\tmessage,\n\t\tdetails,\n\t\trequestId\n\t}, requestId);\n}\n/** Extract or generate request ID */\nfunction getRequestId(event) {\n\treturn event.request.headers.get(\"x-request-id\") || crypto.randomUUID();\n}\n/**\n* Extract raw session token from the `op_session` cookie.\n*\n* Phase 2 of the auth/proxy refactor (docs/technical/auth-and-proxy-refactor-plan.md)\n* removed the legacy `x-admin-token` / `Authorization: Bearer` header fallbacks.\n* The cookie is HttpOnly + SameSite=Strict and is the ONLY credential the browser\n* holds; XSS cannot read it and out-of-process callers must obtain a session via\n* `POST /api/auth/login` (or `/session`) and present the cookie on subsequent\n* requests.\n*/\nfunction extractToken(event) {\n\tconst match = (event.request.headers.get(\"cookie\") ?? \"\").match(/(?:^|;\\s*)op_session=([^;]+)/);\n\tif (match) return match[1];\n\treturn \"\";\n}\n/** Check admin auth — returns error Response or null if OK */\nfunction requireAdmin(event, requestId) {\n\tif (!getUiLoginPassword()) return errorResponse(503, \"admin_not_configured\", \"OP_UI_LOGIN_PASSWORD has not been set. Complete setup first.\", {}, requestId);\n\tif (!validateSession(extractToken(event))) return errorResponse(401, \"unauthorized\", \"Missing or invalid credentials\", {}, requestId);\n\treturn null;\n}\n/**\n* Server-side capability guard (plan ui-runtime-modes-plan.md §6.4, §8.5).\n*\n* Returns a 403 JSON error Response when the resolved host mode does not\n* expose `capability`, or null when it does. This is the SECURITY boundary —\n* the browser-side `hasCapability()` is UX only. The check is deliberately\n* capability-based, not session-based: a valid admin session in a mode\n* without the capability (e.g. `connections:manage` in assistant-container)\n* is still refused. Capability→mode logic itself lives ONLY in\n* computeServerRuntimeContext / resolveCapabilities (plan §8.6); this helper\n* just reads the advertised server capability set.\n*/\nfunction requireCapability(event, capability, requestId) {\n\tconst ctx = computeServerRuntimeContext(event);\n\tif (!ctx.serverCapabilities.includes(capability)) return errorResponse(403, \"capability_not_available\", `This deployment (${ctx.hostMode}) does not provide the '${capability}' capability.`, {\n\t\tcapability,\n\t\thostMode: ctx.hostMode\n\t}, requestId);\n\treturn null;\n}\n/**\n* Identify caller by the presented `op_session` cookie.\n*\n* Returns \"admin\" when the cookie holds a valid session token.\n*/\nfunction identifyCallerByToken(event) {\n\tif (!getUiLoginPassword()) return null;\n\tif (validateSession(extractToken(event))) return \"admin\";\n\treturn null;\n}\n/** Parse JSON body safely — returns discriminated result with error type */\nasync function parseJsonBody(request, maxBytes = 1048576) {\n\ttry {\n\t\tconst contentLength = request.headers.get(\"content-length\");\n\t\tif (contentLength && parseInt(contentLength, 10) > maxBytes) return { error: \"too_large\" };\n\t\treturn { data: await request.json() };\n\t} catch (e) {\n\t\tconsole.warn(\"[helpers] Failed to parse JSON request body\", e);\n\t\treturn { error: \"invalid_json\" };\n\t}\n}\n/** Convert a ParseJsonBodyError to an appropriate HTTP error response */\nfunction jsonBodyError(err, requestId) {\n\tif (err.error === \"too_large\") return errorResponse(413, \"too_large\", \"Request body too large\", {}, requestId);\n\treturn errorResponse(400, \"invalid_json\", \"Request body must be valid JSON\", {}, requestId);\n}\n/**\n* Auth + JSON body wrapper for admin POST/DELETE handlers.\n*\n* Replaces the 4-line boilerplate copy-pasted across 30+ routes:\n*   const requestId = getRequestId(event);\n*   const authError = requireAdmin(event, requestId);\n*   if (authError) return authError;\n*   const result = await parseJsonBody(event.request);\n*   if ('error' in result) return jsonBodyError(result, requestId);\n*\n* Use for routes that need both auth and a JSON body. For auth-only or\n* GET routes, call `requireAdmin` directly.\n*/\nasync function withAdminBody(event, handler) {\n\tconst requestId = getRequestId(event);\n\tconst { security } = computeServerRuntimeContext(event);\n\tconst originError = checkOriginHeader(event.request, security.csrfMode);\n\tif (originError) return originError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst result = await parseJsonBody(event.request);\n\tif (\"error\" in result) return jsonBodyError(result, requestId);\n\treturn handler({\n\t\trequestId,\n\t\tbody: result.data\n\t});\n}\nfunction hostNameFromHeader(hostHeader) {\n\tconst normalized = hostHeader.trim().replace(/\\.$/, \"\");\n\ttry {\n\t\treturn new URL(`http://${normalized}`).hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n\t} catch {\n\t\treturn null;\n\t}\n}\nfunction isLoopbackHost(hostHeader) {\n\tconst hostname = hostNameFromHeader(hostHeader);\n\tif (!hostname) return false;\n\treturn hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"::1\";\n}\nfunction isSameSite(request, origin) {\n\tconst requestHost = hostNameFromHeader(request.headers.get(\"host\") ?? \"\");\n\tif (!requestHost) return false;\n\treturn requestHost === origin.hostname.toLowerCase();\n}\nfunction checkHostHeader(request) {\n\tconst host = request.headers.get(\"host\") ?? \"\";\n\tif (isLoopbackHost(host) || isRemoteSetupAllowed()) return null;\n\treturn new Response(JSON.stringify({\n\t\terror: \"invalid_host\",\n\t\thost: host.trim().replace(/\\.$/, \"\"),\n\t\tmessage: \"Request rejected: Host header does not match allowed hosts. The UI binds to loopback (127.0.0.1) only; reach it via localhost or an SSH tunnel/reverse proxy, or set OP_ALLOW_REMOTE_SETUP=1 to allow remote access.\"\n\t}), {\n\t\tstatus: 400,\n\t\theaders: { \"content-type\": \"application/json\" }\n\t});\n}\n/**\n* Reject POST/PUT/DELETE requests whose Origin header does not match\n* localhost or 127.0.0.1. Requests with no Origin (non-browser clients)\n* are always allowed.\n*\n* @param request  Incoming Request\n* @returns        A 403 Response if the origin is rejected; null if allowed\n*/\nfunction checkOriginHeader(request, csrfMode = \"loopback-origin\") {\n\tconst method = request.method.toUpperCase();\n\tif (method === \"GET\" || method === \"HEAD\" || method === \"OPTIONS\") return null;\n\tconst origin = request.headers.get(\"origin\");\n\tif (!origin) return null;\n\ttry {\n\t\tconst u = new URL(origin);\n\t\tswitch (csrfMode) {\n\t\t\tcase \"loopback-origin\":\n\t\t\t\tif (isLoopbackHost(u.host)) return null;\n\t\t\t\tif (isRemoteSetupAllowed() && u.host === (request.headers.get(\"host\") ?? \"\").trim()) return null;\n\t\t\t\tbreak;\n\t\t\tcase \"same-site\":\n\t\t\t\tif (isSameSite(request, u)) return null;\n\t\t\t\tbreak;\n\t\t\tcase \"bearer-token\":\n\t\t\t\tif (request.headers.get(\"authorization\")) return null;\n\t\t\t\tif (isSameSite(request, u)) return null;\n\t\t\t\tbreak;\n\t\t}\n\t} catch {}\n\treturn new Response(JSON.stringify({\n\t\terror: \"forbidden_origin\",\n\t\torigin\n\t}), {\n\t\tstatus: 403,\n\t\theaders: { \"content-type\": \"application/json\" }\n\t});\n}\nNumber(process.env.PORT ?? 3880);\n//#endregion\nexport { invalidateSession as _, getRequestId as a, jsonResponse as c, requireCapability as d, safeTokenCompare as f, getUiLoginPassword as g, createSession as h, getOpenCodeClient as i, parseJsonBody as l, SESSION_TTL_SECONDS as m, checkOriginHeader as n, identifyCallerByToken as o, withAdminBody as p, errorResponse as r, jsonBodyError as s, checkHostHeader as t, requireAdmin as u, touchSession as v };\n"],"names":[],"mappings":";;;;;AAKA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,cAAc,GAAG,OAAO;AAC5B;AACG,IAAC,mBAAmB,GAAG,cAAc,GAAG;AAC3C,IAAI,QAAQ,mBAAmB,IAAI,GAAG,EAAE;AACxC,IAAI,cAAc,mBAAmB,IAAI,GAAG,EAAE;AAC9C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,GAAG;AAC9B,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB;AAClD,CAAC,IAAI,QAAQ,EAAE,OAAO,QAAQ;AAC9B,CAAC,OAAO,UAAU,CAAC,mBAAmB,EAAE,EAAE,sBAAsB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;AAClF;AACA;AACA,SAAS,SAAS,CAAC,SAAS,EAAE;AAC9B,CAAC,MAAM,MAAM,GAAG,kBAAkB,EAAE;AACpC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI;AACzB,CAAC,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;AAC5E;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc;AAC9C,CAAC,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC;AACjC,CAAC,IAAI,GAAG,KAAK,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC;AAChG,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7B;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,KAAK,EAAE;AAChC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,KAAK;AACzB,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,IAAI;AAC3C,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK;AACtC,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC;AACnC,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,OAAO,KAAK;AAC1B,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,EAAE,OAAO,KAAK;AACzE,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;AACjC,CAAC,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC;AACtC,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,OAAO,KAAK;AACpC,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,OAAO,KAAK;AACjD,CAAC,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAChE;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK;AAC1C,CAAC,OAAO,aAAa,EAAE;AACvB;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;AACvB,CAAC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE;AACjC,EAAE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;AACtE,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;AAC/E,CAAC;AACD,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;AACpB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,eAAe;AACnB,IAAI,kBAAkB;AACtB,SAAS,iBAAiB,GAAG;AAC7B,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,mBAAmB,EAAE;AACtC,CAAC,IAAI,CAAC,eAAe,IAAI,GAAG,KAAK,kBAAkB,EAAE;AACrD,EAAE,eAAe,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC1D,EAAE,kBAAkB,GAAG,GAAG;AAC1B,CAAC;AACD,CAAC,OAAO,eAAe;AACvB;AACA,SAAS,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE;AAChC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,OAAO,KAAK;AACjE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,KAAK;AAC3B,CAAC,OAAO,eAAe,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AACzG;AACA;AACA,SAAS,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,EAAE,EAAE;AACpD,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;AAC3C,EAAE,MAAM;AACR,EAAE,OAAO,EAAE;AACX,GAAG,cAAc,EAAE,kBAAkB;AACrC,GAAG,GAAG,SAAS,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG;AAClD;AACA,EAAE,CAAC;AACH;AACA;AACA,SAAS,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,EAAE;AAC7E,CAAC,OAAO,YAAY,CAAC,MAAM,EAAE;AAC7B,EAAE,KAAK;AACP,EAAE,OAAO;AACT,EAAE,OAAO;AACT,EAAE;AACF,EAAE,EAAE,SAAS,CAAC;AACd;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE;AACxE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,8BAA8B,CAAC;AAChG,CAAC,IAAI,KAAK,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC;AAC3B,CAAC,OAAO,EAAE;AACV;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE;AACxC,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,sBAAsB,EAAE,8DAA8D,EAAE,EAAE,EAAE,SAAS,CAAC;AAC5J,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,gCAAgC,EAAE,EAAE,EAAE,SAAS,CAAC;AACtI,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE;AACzD,CAAC,MAAM,GAAG,GAAG,2BAA2B,CAAC,KAAK,CAAC;AAC/C,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,0BAA0B,EAAE,CAAC,iBAAiB,EAAE,GAAG,CAAC,QAAQ,CAAC,wBAAwB,EAAE,UAAU,CAAC,aAAa,CAAC,EAAE;AAC/L,EAAE,UAAU;AACZ,EAAE,QAAQ,EAAE,GAAG,CAAC;AAChB,EAAE,EAAE,SAAS,CAAC;AACd,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,KAAK,EAAE;AACtC,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,OAAO,IAAI;AACvC,CAAC,IAAI,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,OAAO;AACzD,CAAC,OAAO,IAAI;AACZ;AACA;AACA,eAAe,aAAa,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,EAAE;AAC1D,CAAC,IAAI;AACL,EAAE,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;AAC7D,EAAE,IAAI,aAAa,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE;AAC5F,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE;AACvC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,CAAC,IAAI,CAAC,6CAA6C,EAAE,CAAC,CAAC;AAChE,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE;AAClC,CAAC;AACD;AACA;AACA,SAAS,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE;AACvC,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,EAAE,EAAE,SAAS,CAAC;AAC/G,CAAC,OAAO,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,iCAAiC,EAAE,EAAE,EAAE,SAAS,CAAC;AAC5F;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC;AACxD,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC;AACxE,CAAC,IAAI,WAAW,EAAE,OAAO,WAAW;AACpC,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;AAClD,CAAC,IAAI,OAAO,IAAI,MAAM,EAAE,OAAO,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC;AAC/D,CAAC,OAAO,OAAO,CAAC;AAChB,EAAE,SAAS;AACX,EAAE,IAAI,EAAE,MAAM,CAAC;AACf,EAAE,CAAC;AACH;AACA,SAAS,kBAAkB,CAAC,UAAU,EAAE;AACxC,CAAC,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AACxD,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;AACvF,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,IAAI;AACb,CAAC;AACD;AACA,SAAS,cAAc,CAAC,UAAU,EAAE;AACpC,CAAC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,UAAU,CAAC;AAChD,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AAC5B,CAAC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK;AAClF;AACA,SAAS,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE;AACrC,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAC1E,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,KAAK;AAC/B,CAAC,OAAO,WAAW,KAAK,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE;AACrD;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;AAC/C,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,oBAAoB,EAAE,EAAE,OAAO,IAAI;AAChE,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AACpC,EAAE,KAAK,EAAE,cAAc;AACvB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AACtC,EAAE,OAAO,EAAE;AACX,EAAE,CAAC,EAAE;AACL,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AAC/C,EAAE,CAAC;AACH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,OAAO,EAAE,QAAQ,GAAG,iBAAiB,EAAE;AAClE,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;AAC5C,CAAC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,OAAO,IAAI;AAC/E,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC7C,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI;AACzB,CAAC,IAAI;AACL,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC;AAC3B,EAAE,QAAQ,QAAQ;AAClB,GAAG,KAAK,iBAAiB;AACzB,IAAI,IAAI,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AAC3C,IAAI,IAAI,oBAAoB,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,IAAI;AACpG,IAAI;AACJ,GAAG,KAAK,WAAW;AACnB,IAAI,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,OAAO,IAAI;AAC3C,IAAI;AACJ,GAAG,KAAK,cAAc;AACtB,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,OAAO,IAAI;AACzD,IAAI,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,OAAO,IAAI;AAC3C,IAAI;AACJ;AACA,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AACpC,EAAE,KAAK,EAAE,kBAAkB;AAC3B,EAAE;AACF,EAAE,CAAC,EAAE;AACL,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AAC/C,EAAE,CAAC;AACH;AACA,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC;;;;"}

package/build/server/chunks/hooks.server-BTXqUhpH.js

@@ -0,0 +1,121 @@
+import { r as redirect } from './exports-CcmcYU0M.js';
+import { aV as resolveOpenPalmHome, ah as isSetupComplete, ag as isRemoteSetupAllowed, a$ as stackDirFor, s as collectBindAddressWarnings, aB as readSecret, aF as readStackRuntimeEnv, G as createLogger } from './src-BwQUi60U.js';
+import { g as getState } from './state-Dm7U51xT.js';
+import { c as checkHostHeader, a as checkOriginHeader, i as identifyCallerByToken, t as touchSession } from './helpers-q4Ng8QTq.js';
+import { c as computeServerRuntimeContext } from './features-0lgyQreD.js';
+import { S as SESSION_COOKIE_NAME, s as sessionCookieHeader } from './session-cookie-qHDuQboc.js';
+import { g as getCachedLocalInstallState, r as resolveRequestLanding, B as BLOCKING_LANDINGS } from './landing-BR5KUuDz.js';
+export { _ as _resetLaunchCache } from './landing-BR5KUuDz.js';
+import './utils-OXHIhUb5.js';
+import './provider-constants-1s1k8kbj.js';
+import './chunk-CLZ62Ad-.js';
+import 'node:module';
+import 'node:fs';
+import 'node:child_process';
+import 'node:path';
+import 'buffer';
+import 'node:url';
+import 'node:os';
+import 'node:crypto';
+import 'events';
+import 'fs';
+import 'node:events';
+import 'node:stream';
+import 'node:string_decoder';
+import 'path';
+import 'assert';
+import 'zlib';
+import 'node:assert';
+import 'node:fs/promises';
+import './endpoints-B9ePqrMw.js';
+import './runtime-context.svelte-C5zNEC6u.js';
+
+//#region src/hooks.server.ts
+var logger = createLogger("admin");
+var startupApplyDone = false;
+var setupCompleteMemo = false;
+/** Test-only: clear the setup-complete memo so each test resolves fresh. */
+function _resetSetupCompleteMemo() {
+	setupCompleteMemo = false;
+}
+function loadProcessEnv() {
+	if (startupApplyDone) return;
+	startupApplyDone = true;
+	for (const line of collectBindAddressWarnings(process.env)) logger.warn(line);
+	try {
+		const state = getState();
+		if (!process.env.OP_UI_LOGIN_PASSWORD) {
+			const pw = readSecret(state.homeDir, "op_ui_login_password");
+			if (pw) process.env.OP_UI_LOGIN_PASSWORD = pw.trimEnd();
+		}
+		const stackVars = readStackRuntimeEnv(state.homeDir);
+		for (const [k, v] of Object.entries(stackVars)) if (v && !process.env[k]) process.env[k] = v;
+	} catch (err) {
+		logger.error("process env load failed", { error: String(err) });
+	}
+}
+loadProcessEnv();
+var SETUP_PATHS = [
+	"/setup",
+	"/api/setup",
+	"/health",
+	"/guardian/health"
+];
+function isLocalhostAddress(ip) {
+	return ip === "127.0.0.1" || ip === "::1" || ip === "::ffff:127.0.0.1";
+}
+var handle = async ({ event, resolve }) => {
+	const runtimeContext = computeServerRuntimeContext(event);
+	const hostError = checkHostHeader(event.request);
+	if (hostError) return hostError;
+	const originError = checkOriginHeader(event.request, runtimeContext.security.csrfMode);
+	if (originError) return originError;
+	const path = event.url.pathname;
+	const isAuthPath = path === "/login" || path.startsWith("/login/");
+	const wantsHtml = event.request.method === "GET" && (event.request.headers.get("accept") ?? "").includes("text/html");
+	if ((path === "/host" || path.startsWith("/host/")) && !runtimeContext.serverCapabilities.includes("host:stack:read")) redirect(302, "/chat");
+	const isSetupPath = SETUP_PATHS.some((p) => path === p || path.startsWith(`${p}/`));
+	const homeDir = resolveOpenPalmHome();
+	const setupComplete = setupCompleteMemo || isSetupComplete(homeDir);
+	if (setupComplete) setupCompleteMemo = true;
+	const localInstallState = getCachedLocalInstallState(stackDirFor(homeDir), homeDir);
+	if (wantsHtml && !setupComplete && localInstallState !== "not_installed" && !isSetupPath && !isAuthPath && !path.startsWith("/admin")) redirect(302, "/setup");
+	if (isSetupPath && !setupComplete && !isRemoteSetupAllowed()) {
+		if (!isLocalhostAddress(event.getClientAddress())) return new Response(JSON.stringify({
+			error: "setup_localhost_only",
+			message: "Setup is only accessible from the host machine until installation is complete."
+		}), {
+			status: 403,
+			headers: { "content-type": "application/json" }
+		});
+	}
+	if (!isSetupPath) {
+		const landing = await resolveRequestLanding(event);
+		const [landingPath] = landing.split("?");
+		const usageExempt = (path.startsWith("/chat") || path.startsWith("/advanced") || path.startsWith("/connections")) && !BLOCKING_LANDINGS.has(landingPath);
+		const exempt = path.startsWith("/api/") || path.startsWith("/proxy/") || path.startsWith("/login") || path.startsWith("/health") || path.startsWith("/guardian/health") || path.startsWith("/host") || path.startsWith("/admin") || usageExempt;
+		if (path === "/" || path !== landingPath && !exempt) redirect(302, landing);
+	}
+	event.locals.role = identifyCallerByToken(event);
+	let renewedCookie = null;
+	if (event.locals.role === "admin") {
+		const match = (event.request.headers.get("cookie") ?? "").match(new RegExp(`(?:^|;\\s*)${SESSION_COOKIE_NAME}=([^;]+)`));
+		const renewed = match ? touchSession(match[1]) : false;
+		if (renewed) renewedCookie = sessionCookieHeader(renewed, event.request);
+	}
+	if (wantsHtml && !event.locals.role && !isSetupPath && !isAuthPath) {
+		const redirectTo = path + event.url.search;
+		redirect(302, `/login?redirectTo=${encodeURIComponent(redirectTo)}`);
+	}
+	const response = await resolve(event);
+	if (renewedCookie) {
+		if (!(response.headers.get("set-cookie") ?? "").includes(`op_session=`)) response.headers.append("set-cookie", renewedCookie);
+	}
+	response.headers.set("X-Frame-Options", path === "/api/host/akm/health-report" ? "SAMEORIGIN" : "DENY");
+	response.headers.set("X-Content-Type-Options", "nosniff");
+	response.headers.set("Referrer-Policy", "no-referrer");
+	return response;
+};
+
+export { _resetSetupCompleteMemo, handle };
+//# sourceMappingURL=hooks.server-BTXqUhpH.js.map

package/build/server/chunks/hooks.server-BTXqUhpH.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.server-BTXqUhpH.js","sources":["../../../.svelte-kit/adapter-node/entries/hooks.server.js"],"sourcesContent":["import { i as redirect } from \"../chunks/exports.js\";\nimport { Dt as stackDirFor, Nt as createLogger, Tt as resolveOpenPalmHome, Z as readStackRuntimeEnv, at as readSecret } from \"../chunks/compose-args.js\";\nimport { n as collectBindAddressWarnings, r as isRemoteSetupAllowed, z as isSetupComplete } from \"../chunks/src.js\";\nimport { t as getState } from \"../chunks/state.js\";\nimport { n as checkOriginHeader, o as identifyCallerByToken, t as checkHostHeader, v as touchSession } from \"../chunks/helpers.js\";\nimport { t as computeServerRuntimeContext } from \"../chunks/features.js\";\nimport { r as sessionCookieHeader, t as SESSION_COOKIE_NAME } from \"../chunks/session-cookie.js\";\nimport { i as BLOCKING_LANDINGS, n as getCachedLocalInstallState, r as resolveRequestLanding, t as _resetLaunchCache } from \"../chunks/landing.js\";\n//#region src/hooks.server.ts\nvar logger = createLogger(\"admin\");\nvar startupApplyDone = false;\nvar setupCompleteMemo = false;\n/** Test-only: clear the setup-complete memo so each test resolves fresh. */\nfunction _resetSetupCompleteMemo() {\n\tsetupCompleteMemo = false;\n}\nfunction loadProcessEnv() {\n\tif (startupApplyDone) return;\n\tstartupApplyDone = true;\n\tfor (const line of collectBindAddressWarnings(process.env)) logger.warn(line);\n\ttry {\n\t\tconst state = getState();\n\t\tif (!process.env.OP_UI_LOGIN_PASSWORD) {\n\t\t\tconst pw = readSecret(state.homeDir, \"op_ui_login_password\");\n\t\t\tif (pw) process.env.OP_UI_LOGIN_PASSWORD = pw.trimEnd();\n\t\t}\n\t\tconst stackVars = readStackRuntimeEnv(state.homeDir);\n\t\tfor (const [k, v] of Object.entries(stackVars)) if (v && !process.env[k]) process.env[k] = v;\n\t} catch (err) {\n\t\tlogger.error(\"process env load failed\", { error: String(err) });\n\t}\n}\nloadProcessEnv();\nvar SETUP_PATHS = [\n\t\"/setup\",\n\t\"/api/setup\",\n\t\"/health\",\n\t\"/guardian/health\"\n];\nfunction isLocalhostAddress(ip) {\n\treturn ip === \"127.0.0.1\" || ip === \"::1\" || ip === \"::ffff:127.0.0.1\";\n}\nvar handle = async ({ event, resolve }) => {\n\tconst runtimeContext = computeServerRuntimeContext(event);\n\tconst hostError = checkHostHeader(event.request);\n\tif (hostError) return hostError;\n\tconst originError = checkOriginHeader(event.request, runtimeContext.security.csrfMode);\n\tif (originError) return originError;\n\tconst path = event.url.pathname;\n\tconst isAuthPath = path === \"/login\" || path.startsWith(\"/login/\");\n\tconst wantsHtml = event.request.method === \"GET\" && (event.request.headers.get(\"accept\") ?? \"\").includes(\"text/html\");\n\tif ((path === \"/host\" || path.startsWith(\"/host/\")) && !runtimeContext.serverCapabilities.includes(\"host:stack:read\")) redirect(302, \"/chat\");\n\tconst isSetupPath = SETUP_PATHS.some((p) => path === p || path.startsWith(`${p}/`));\n\tconst homeDir = resolveOpenPalmHome();\n\tconst setupComplete = setupCompleteMemo || isSetupComplete(homeDir);\n\tif (setupComplete) setupCompleteMemo = true;\n\tconst localInstallState = getCachedLocalInstallState(stackDirFor(homeDir), homeDir);\n\tif (wantsHtml && !setupComplete && localInstallState !== \"not_installed\" && !isSetupPath && !isAuthPath && !path.startsWith(\"/admin\")) redirect(302, \"/setup\");\n\tif (isSetupPath && !setupComplete && !isRemoteSetupAllowed()) {\n\t\tif (!isLocalhostAddress(event.getClientAddress())) return new Response(JSON.stringify({\n\t\t\terror: \"setup_localhost_only\",\n\t\t\tmessage: \"Setup is only accessible from the host machine until installation is complete.\"\n\t\t}), {\n\t\t\tstatus: 403,\n\t\t\theaders: { \"content-type\": \"application/json\" }\n\t\t});\n\t}\n\tif (!isSetupPath) {\n\t\tconst landing = await resolveRequestLanding(event);\n\t\tconst [landingPath] = landing.split(\"?\");\n\t\tconst usageExempt = (path.startsWith(\"/chat\") || path.startsWith(\"/advanced\") || path.startsWith(\"/connections\")) && !BLOCKING_LANDINGS.has(landingPath);\n\t\tconst exempt = path.startsWith(\"/api/\") || path.startsWith(\"/proxy/\") || path.startsWith(\"/login\") || path.startsWith(\"/health\") || path.startsWith(\"/guardian/health\") || path.startsWith(\"/host\") || path.startsWith(\"/admin\") || usageExempt;\n\t\tif (path === \"/\" || path !== landingPath && !exempt) redirect(302, landing);\n\t}\n\tevent.locals.role = identifyCallerByToken(event);\n\tlet renewedCookie = null;\n\tif (event.locals.role === \"admin\") {\n\t\tconst match = (event.request.headers.get(\"cookie\") ?? \"\").match(new RegExp(`(?:^|;\\\\s*)${SESSION_COOKIE_NAME}=([^;]+)`));\n\t\tconst renewed = match ? touchSession(match[1]) : false;\n\t\tif (renewed) renewedCookie = sessionCookieHeader(renewed, event.request);\n\t}\n\tif (wantsHtml && !event.locals.role && !isSetupPath && !isAuthPath) {\n\t\tconst redirectTo = path + event.url.search;\n\t\tredirect(302, `/login?redirectTo=${encodeURIComponent(redirectTo)}`);\n\t}\n\tconst response = await resolve(event);\n\tif (renewedCookie) {\n\t\tif (!(response.headers.get(\"set-cookie\") ?? \"\").includes(`op_session=`)) response.headers.append(\"set-cookie\", renewedCookie);\n\t}\n\tresponse.headers.set(\"X-Frame-Options\", path === \"/api/host/akm/health-report\" ? \"SAMEORIGIN\" : \"DENY\");\n\tresponse.headers.set(\"X-Content-Type-Options\", \"nosniff\");\n\tresponse.headers.set(\"Referrer-Policy\", \"no-referrer\");\n\treturn response;\n};\n//#endregion\nexport { _resetLaunchCache, _resetSetupCompleteMemo, handle };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA;AACA,IAAI,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC;AAClC,IAAI,gBAAgB,GAAG,KAAK;AAC5B,IAAI,iBAAiB,GAAG,KAAK;AAC7B;AACA,SAAS,uBAAuB,GAAG;AACnC,CAAC,iBAAiB,GAAG,KAAK;AAC1B;AACA,SAAS,cAAc,GAAG;AAC1B,CAAC,IAAI,gBAAgB,EAAE;AACvB,CAAC,gBAAgB,GAAG,IAAI;AACxB,CAAC,KAAK,MAAM,IAAI,IAAI,0BAA0B,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;AAC9E,CAAC,IAAI;AACL,EAAE,MAAM,KAAK,GAAG,QAAQ,EAAE;AAC1B,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE;AACzC,GAAG,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,sBAAsB,CAAC;AAC/D,GAAG,IAAI,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,EAAE,CAAC,OAAO,EAAE;AAC1D,EAAE;AACF,EAAE,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC;AACtD,EAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC9F,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AACjE,CAAC;AACD;AACA,cAAc,EAAE;AAChB,IAAI,WAAW,GAAG;AAClB,CAAC,QAAQ;AACT,CAAC,YAAY;AACb,CAAC,SAAS;AACV,CAAC;AACD,CAAC;AACD,SAAS,kBAAkB,CAAC,EAAE,EAAE;AAChC,CAAC,OAAO,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,kBAAkB;AACvE;AACG,IAAC,MAAM,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AAC3C,CAAC,MAAM,cAAc,GAAG,2BAA2B,CAAC,KAAK,CAAC;AAC1D,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC;AACvF,CAAC,IAAI,WAAW,EAAE,OAAO,WAAW;AACpC,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ;AAChC,CAAC,MAAM,UAAU,GAAG,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;AACnE,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,WAAW,CAAC;AACtH,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,kBAAkB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;AAC9I,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC,MAAM,OAAO,GAAG,mBAAmB,EAAE;AACtC,CAAC,MAAM,aAAa,GAAG,iBAAiB,IAAI,eAAe,CAAC,OAAO,CAAC;AACpE,CAAC,IAAI,aAAa,EAAE,iBAAiB,GAAG,IAAI;AAC5C,CAAC,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;AACpF,CAAC,IAAI,SAAS,IAAI,CAAC,aAAa,IAAI,iBAAiB,KAAK,eAAe,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;AAC/J,CAAC,IAAI,WAAW,IAAI,CAAC,aAAa,IAAI,CAAC,oBAAoB,EAAE,EAAE;AAC/D,EAAE,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AACxF,GAAG,KAAK,EAAE,sBAAsB;AAChC,GAAG,OAAO,EAAE;AACZ,GAAG,CAAC,EAAE;AACN,GAAG,MAAM,EAAE,GAAG;AACd,GAAG,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AAChD,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,IAAI,CAAC,WAAW,EAAE;AACnB,EAAE,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC;AACpD,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;AAC1C,EAAE,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1J,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,WAAW;AACjP,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,WAAW,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;AAC7E,CAAC;AACD,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC;AACjD,CAAC,IAAI,aAAa,GAAG,IAAI;AACzB,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE;AACpC,EAAE,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1H,EAAE,MAAM,OAAO,GAAG,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK;AACxD,EAAE,IAAI,OAAO,EAAE,aAAa,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;AAC1E,CAAC;AACD,CAAC,IAAI,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,EAAE;AACrE,EAAE,MAAM,UAAU,GAAG,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM;AAC5C,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AACD,CAAC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC;AACtC,CAAC,IAAI,aAAa,EAAE;AACpB,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC;AAC/H,CAAC;AACD,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,KAAK,6BAA6B,GAAG,YAAY,GAAG,MAAM,CAAC;AACxG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC;AAC1D,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC;AACvD,CAAC,OAAO,QAAQ;AAChB;;;;"}

package/build/server/chunks/http-jBNJXVHg.js

@@ -0,0 +1,31 @@
+import { g as getActiveConnection } from './endpoints-B9ePqrMw.js';
+
+//#region src/lib/server/opencode/http.ts
+/**
+* HTTP transport for talking to the active OpenCode endpoint.
+*
+* Used by sibling modules (`config.ts`, `catalog.ts`) — not part of the
+* public API of `$lib/server/opencode`. Reads the active endpoint per-call
+* so user switches in the UI take effect immediately.
+*/
+async function opencodeFetch(path, init) {
+	const endpoint = getActiveConnection();
+	const headers = {
+		"content-type": "application/json",
+		...init?.headers
+	};
+	if (endpoint.password) {
+		const user = endpoint.username || "openpalm";
+		headers.authorization = `Basic ${btoa(`${user}:${endpoint.password}`)}`;
+	}
+	const response = await fetch(`${endpoint.url}${path}`, {
+		...init,
+		headers
+	});
+	if (!response.ok) throw new Error(`${init?.method ?? "GET"} ${path} failed with ${response.status}`);
+	if (response.status === 204) return;
+	return await response.json();
+}
+
+export { opencodeFetch as o };
+//# sourceMappingURL=http-jBNJXVHg.js.map

package/build/server/chunks/http-jBNJXVHg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-jBNJXVHg.js","sources":["../../../.svelte-kit/adapter-node/chunks/http.js"],"sourcesContent":["import { r as getActiveConnection } from \"./endpoints.js\";\n//#region src/lib/server/opencode/http.ts\n/**\n* HTTP transport for talking to the active OpenCode endpoint.\n*\n* Used by sibling modules (`config.ts`, `catalog.ts`) — not part of the\n* public API of `$lib/server/opencode`. Reads the active endpoint per-call\n* so user switches in the UI take effect immediately.\n*/\nasync function opencodeFetch(path, init) {\n\tconst endpoint = getActiveConnection();\n\tconst headers = {\n\t\t\"content-type\": \"application/json\",\n\t\t...init?.headers\n\t};\n\tif (endpoint.password) {\n\t\tconst user = endpoint.username || \"openpalm\";\n\t\theaders.authorization = `Basic ${btoa(`${user}:${endpoint.password}`)}`;\n\t}\n\tconst response = await fetch(`${endpoint.url}${path}`, {\n\t\t...init,\n\t\theaders\n\t});\n\tif (!response.ok) throw new Error(`${init?.method ?? \"GET\"} ${path} failed with ${response.status}`);\n\tif (response.status === 204) return;\n\treturn await response.json();\n}\n//#endregion\nexport { opencodeFetch as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE;AACzC,CAAC,MAAM,QAAQ,GAAG,mBAAmB,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG;AACjB,EAAE,cAAc,EAAE,kBAAkB;AACpC,EAAE,GAAG,IAAI,EAAE;AACX,EAAE;AACF,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE;AACxB,EAAE,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,IAAI,UAAU;AAC9C,EAAE,OAAO,CAAC,aAAa,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AACD,CAAC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE;AACxD,EAAE,GAAG,IAAI;AACT,EAAE;AACF,EAAE,CAAC;AACH,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACrG,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE;AAC9B,CAAC,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE;AAC7B;;;;"}