@openpalm/ui 0.13.0-beta.2 → 0.13.0-beta.4

package/build/server/chunks/{_page.svelte-BXeh8wzh.js → _page.svelte-C36XsgXY.js}

@@ -1,12 +1,13 @@
 import { F as head, d as attr, q as ensure_array_like, e as attr_class, s as escape_html, p as derived, f as attr_style, a9 as stringify, a0 as run } from './dev-D85DamNs.js';
 import 'node:module';
-import { b as addonProfileId, O as OLLAMA_DEFAULT_CHAT_MODEL, K as KNOWN_EMBEDDING_MODEL_DIMS } from './provider-constants-1s1k8kbj.js';
-import { a as LOCAL_PROVIDER_IDS, f as friendlyProviderName, b as PROVIDERS, L as LOCAL_PROVIDERS, P as PORTALS, F as FRIENDLY_PROVIDER_NAMES, W as WIZARD_EXCLUDED_PROVIDERS } from './constants-B7J5DDaI.js';
-import { r as resolve } from './paths-tzRSDsKc.js';
+import { d as addonProfileId, O as OLLAMA_DEFAULT_CHAT_MODEL, K as KNOWN_EMBEDDING_MODEL_DIMS, N as NETWORK_ACCESS_PRESETS, a as NETWORK_PRESET_LABELS, g as isNetworkAccessPreset } from './network-preset-CJ1RRnki.js';
+import { a as LOCAL_PROVIDER_IDS, f as friendlyProviderName, b as PROVIDERS, L as LOCAL_PROVIDERS, P as PORTALS, F as FRIENDLY_PROVIDER_NAMES, W as WIZARD_EXCLUDED_PROVIDERS } from './constants-1vPYIIwP.js';
+import { r as resolve } from './paths-DRVrMQrI.js';
 import { I as IconLogo } from './IconLogo-BRmPVDI_.js';
 import { S as Spinner, I as IconMic } from './IconMic-BbjkE_nG.js';
 import { I as IconAgent, a as IconAlert } from './IconAgent-DeBWj6Gr.js';
-import './internal-G-Uk-kCA.js';
+import { I as IconLock } from './IconLock-Bz5zHCBQ.js';
+import './internal-D9Kp0SbJ.js';
 import './environment-BYp8JQYM.js';
 
 //#region src/lib/client/helpers.ts
@@ -268,7 +269,7 @@ function voicePayload(v) {
 *  - llm/embedding go directly to akm config; voice sides only when explicit.
 */
 function buildSetupPayload(input) {
-	const { modelSelection, verifiedProviders, providerState, ollamaEnabled, hostLocalLlmRunning, persistedVoiceTts, persistedVoiceStt, selectedVoiceProfile, selectedOllamaProfile, portalSelection, uiLoginPassword, imageTag, hostAkmEnabled } = input;
+	const { modelSelection, verifiedProviders, providerState, ollamaEnabled, hostLocalLlmRunning, persistedVoiceTts, persistedVoiceStt, selectedVoiceProfile, selectedOllamaProfile, portalSelection, uiLoginPassword, keepExistingUiLoginPassword, imageTag, hostAkmEnabled, networkPreset, opencodePassword } = input;
 	const llm = modelSelection.llm;
 	const emb = modelSelection.embedding;
 	const small = modelSelection.small;
@@ -310,7 +311,7 @@ function buildSetupPayload(input) {
 	const result = {
 		version: 2,
 		addons,
-		security: { uiLoginPassword },
+		security: keepExistingUiLoginPassword ? {} : { uiLoginPassword },
 		connections: capabilities
 	};
 	if (llmProvider && llm?.model) result.llm = {
@@ -333,6 +334,10 @@ function buildSetupPayload(input) {
 	if (Object.keys(portalCredentials).length > 0) result.portalCredentials = portalCredentials;
 	if (imageTag.trim()) result.imageTag = imageTag.trim();
 	if (hostAkmEnabled) result.hostAkm = true;
+	if (networkPreset !== null) result.network = networkPreset === "home-password" ? {
+		preset: networkPreset,
+		opencodePassword
+	} : { preset: networkPreset };
 	return result;
 }
 /**
@@ -379,7 +384,20 @@ function parseSetupConfig(data) {
 	result.enabledAddons = enabled;
 	if (enabled.includes("ollama")) result.ollamaEnabled = true;
 	if (data.ollama?.selectedProfile && typeof data.ollama.selectedProfile === "string") result.selectedOllamaProfile = data.ollama.selectedProfile;
-	result.portalCredentials = data.portalCredentials ?? {};
+	const rawPortalCreds = data.portalCredentials ?? {};
+	const cleanedPortalCreds = {};
+	for (const [portal, fields] of Object.entries(rawPortalCreds)) {
+		if (!fields || typeof fields !== "object") continue;
+		const stringFields = {};
+		for (const [field, value] of Object.entries(fields)) if (typeof value === "string") stringFields[field] = value;
+		if (Object.keys(stringFields).length > 0) cleanedPortalCreds[portal] = stringFields;
+	}
+	result.portalCredentials = cleanedPortalCreds;
+	if (data.network !== void 0 && data.network !== null) {
+		const preset = data.network.preset;
+		result.networkPreset = isNetworkAccessPreset(preset) ? preset : null;
+	}
+	if (typeof data.hasOpencodePassword === "boolean") result.hasOpencodePassword = data.hasOpencodePassword;
 	return result;
 }
 //#endregion
@@ -536,6 +554,7 @@ var INITIAL = {
 	modelMode: "cloud",
 	voiceEnabled: false,
 	uiLoginPassword: "",
+	uiLoginPasswordDirty: false,
 	step0Error: "",
 	autoModeImporting: false,
 	gpuDetected: false,
@@ -577,6 +596,11 @@ var INITIAL = {
 	selectedOllamaProfile: "",
 	imageTag: "",
 	hostAkmEnabled: false,
+	networkPreset: "this-pc",
+	opencodePassword: "",
+	homeOpenAck: false,
+	networkDirty: false,
+	hasExistingOpencodePassword: false,
 	installError: "",
 	installing: false,
 	emptyAiAck: false,
@@ -600,6 +624,7 @@ var SetupState = class {
 	modelMode = INITIAL.modelMode;
 	voiceEnabled = INITIAL.voiceEnabled;
 	uiLoginPassword = INITIAL.uiLoginPassword;
+	uiLoginPasswordDirty = INITIAL.uiLoginPasswordDirty;
 	step0Error = INITIAL.step0Error;
 	autoModeImporting = INITIAL.autoModeImporting;
 	gpuDetected = INITIAL.gpuDetected;
@@ -634,6 +659,11 @@ var SetupState = class {
 	selectedOllamaProfile = INITIAL.selectedOllamaProfile;
 	imageTag = INITIAL.imageTag;
 	hostAkmEnabled = INITIAL.hostAkmEnabled;
+	networkPreset = INITIAL.networkPreset;
+	opencodePassword = INITIAL.opencodePassword;
+	homeOpenAck = INITIAL.homeOpenAck;
+	networkDirty = INITIAL.networkDirty;
+	hasExistingOpencodePassword = INITIAL.hasExistingOpencodePassword;
 	installError = INITIAL.installError;
 	installing = INITIAL.installing;
 	emptyAiAck = INITIAL.emptyAiAck;
@@ -744,6 +774,18 @@ var SetupState = class {
 	set persistedVoiceStt($$value) {
 		return this.#persistedVoiceStt($$value);
 	}
+	#networkChoiceValid = derived(() => {
+		if (this.isRerun && !this.networkDirty) return true;
+		if (this.networkPreset === "home-open") return this.homeOpenAck;
+		if (this.networkPreset === "home-password") return this.opencodePassword.length >= 8;
+		return true;
+	});
+	get networkChoiceValid() {
+		return this.#networkChoiceValid();
+	}
+	set networkChoiceValid($$value) {
+		return this.#networkChoiceValid($$value);
+	}
 	#payload = derived(() => buildSetupPayload({
 		modelSelection: this.modelSelection,
 		verifiedProviders: this.verifiedProviders,
@@ -756,8 +798,11 @@ var SetupState = class {
 		selectedOllamaProfile: this.selectedOllamaProfile,
 		portalSelection: this.portalSelection,
 		uiLoginPassword: this.uiLoginPassword,
+		keepExistingUiLoginPassword: this.isRerun && !this.uiLoginPasswordDirty,
 		imageTag: this.imageTag,
-		hostAkmEnabled: this.hostAkmEnabled
+		hostAkmEnabled: this.hostAkmEnabled,
+		networkPreset: !this.isRerun || this.networkDirty ? this.networkPreset : null,
+		opencodePassword: this.opencodePassword
 	}));
 	get payload() {
 		return this.#payload();
@@ -1089,6 +1134,10 @@ var SetupState = class {
 	async handleInstall() {
 		if (this.installing) return;
 		this.installError = "";
+		if (!this.networkChoiceValid) {
+			this.installError = "Finish the network access step before installing.";
+			return;
+		}
 		if (!!!this.payload.llm && !this.isRerun && !this.emptyAiAck) {
 			if (!window.confirm("No AI is set up here. You can connect this app to an assistant running on another computer, or add a provider later from your dashboard.\n\nInstall now?")) return;
 			this.emptyAiAck = true;
@@ -1173,6 +1222,29 @@ var SetupState = class {
 		const sel = this.portalSelection[chId];
 		if (typeof sel === "object" && sel !== null) sel[credKey] = value;
 	}
+	/**
+	* Switch the network access preset. Pre-fills a fresh generated password
+	* ONLY when switching TO home-password with an empty field (never
+	* force-regenerates an existing user-typed password, D5); clears the
+	* home-open risk acknowledgement when LEAVING home-open (re-selecting it
+	* does not re-prompt). Event-handler-driven — no `$effect`.
+	*/
+	handleNetworkPresetChange(preset) {
+		const keepExistingHomePassword = preset === "home-password" && this.networkPreset === "home-password" && this.isRerun && this.hasExistingOpencodePassword && !this.opencodePassword;
+		if (this.networkPreset === "home-open" && preset !== "home-open") this.homeOpenAck = false;
+		this.networkPreset = preset;
+		if (keepExistingHomePassword) return;
+		if (preset === "home-password" && !this.opencodePassword) this.opencodePassword = generatePassword();
+		this.networkDirty = true;
+	}
+	handleOpencodePasswordInput(value) {
+		this.opencodePassword = value;
+		this.networkDirty = true;
+	}
+	handleHomeOpenAckChange(value) {
+		this.homeOpenAck = value;
+		this.networkDirty = true;
+	}
 	async handleDeployRetry() {
 		this.installing = false;
 		this.deployError = null;
@@ -1309,7 +1381,6 @@ var SetupState = class {
 		if (this.isRerun) {
 			this.systemCheckPassed = true;
 			this.maxVisitedStep = 3;
-			this.uiLoginPassword = generatePassword();
 			fetchCurrentConfig().then((data) => {
 				if (!data) return;
 				const parsed = parseSetupConfig(data);
@@ -1323,12 +1394,16 @@ var SetupState = class {
 				if (parsed.importedSmallModel) this.importedSmallModel = parsed.importedSmallModel;
 				if (parsed.ollamaEnabled) this.ollamaEnabled = true;
 				if (parsed.selectedOllamaProfile) this.selectedOllamaProfile = parsed.selectedOllamaProfile;
+				this.networkPreset = parsed.networkPreset ?? null;
+				if (parsed.hasOpencodePassword !== void 0) this.hasExistingOpencodePassword = parsed.hasOpencodePassword;
 				for (const chId of ["discord", "slack"]) {
 					const sel = this.portalSelection[chId];
 					if (typeof sel === "object" && sel !== null) {
 						if (parsed.enabledAddons.includes(chId)) sel.enabled = true;
 						const c = parsed.portalCredentials[chId];
-						if (c && typeof c === "object") Object.assign(sel, c);
+						if (c && typeof c === "object") {
+							for (const [field, value] of Object.entries(c)) if (typeof value === "string") sel[field] = value;
+						}
 					}
 				}
 			}).catch((e) => {
@@ -1911,6 +1986,58 @@ function Screen2ExtrasStep($$renderer, $$props) {
 	});
 }
 //#endregion
+//#region src/routes/setup/steps/NetworkAccessStep.svelte
+function NetworkAccessStep($$renderer, $$props) {
+	$$renderer.component(($$renderer) => {
+		/**
+		* NetworkAccessStep — the wizard's network access preset selector (#563 D5).
+		*
+		* Rendered as a section of the Finish step (ReviewStep), not a fourth
+		* screen: the default choice ("This PC only") requires zero interaction, so
+		* a dedicated screen would add a click for every user to serve the
+		* non-default minority.
+		*
+		* Self-contained (ReviewStep pattern): takes NO props, reads/writes the
+		* setup-state store directly so the deferred #506 design pass can promote
+		* it to its own screen without any logic changes.
+		*/
+		const s = setupState;
+		const networkPreset = derived(() => s.networkPreset);
+		const opencodePassword = derived(() => s.opencodePassword);
+		const homeOpenAck = derived(() => s.homeOpenAck);
+		const EXPOSURE_COPY = {
+			"this-pc": "Nothing here is reachable from other devices — only this computer can use the assistant.",
+			"home-password": "Devices on your network can open the assistant (e.g. http://openpalm.local:3800) and sign in with this password. Connected apps use the same password.",
+			"home-open": "Anyone on your network can use the assistant without a password. The built-in browser chat client stays disabled in this mode — LAN users get OpenCode's own web UI instead.",
+			"shared-guardian": "Only the guardian's protected front door is reachable (e.g. http://openpalm-guardian.local); the assistant itself stays private on this PC. Enables the built-in chat portal when no other portal is selected, so the front door actually runs. Connecting apps and devices need credentials you issue from the dashboard (Pair a device / API key)."
+		};
+		$$renderer.push(`<div class="network-step svelte-1clxjuu"><p class="network-step-label svelte-1clxjuu">Network access</p> `);
+		if (networkPreset() === null) {
+			$$renderer.push("<!--[0-->");
+			$$renderer.push(`<p class="network-custom-notice svelte-1clxjuu">Custom network settings detected — kept as-is unless you pick a preset below.</p>`);
+		} else $$renderer.push("<!--[-1-->");
+		$$renderer.push(`<!--]--> <div class="network-option-list svelte-1clxjuu" role="radiogroup" aria-label="Network access preset"><!--[-->`);
+		const each_array = ensure_array_like(NETWORK_ACCESS_PRESETS);
+		for (let $$index = 0, $$length = each_array.length; $$index < $$length; $$index++) {
+			let preset = each_array[$$index];
+			$$renderer.push(`<div class="network-option"><button type="button"${attr_class("network-option-row svelte-1clxjuu", void 0, { "network-option-row--selected": networkPreset() === preset })} role="radio"${attr("aria-checked", networkPreset() === preset)}><div class="network-option-dot svelte-1clxjuu"><div class="network-option-dot-inner svelte-1clxjuu"></div></div> <div class="network-option-body svelte-1clxjuu"><div class="network-option-title svelte-1clxjuu">${escape_html(NETWORK_PRESET_LABELS[preset])}</div> <div class="network-option-sub svelte-1clxjuu">${escape_html(EXPOSURE_COPY[preset])}</div></div></button> `);
+			if (preset === "home-password" && networkPreset() === "home-password") {
+				$$renderer.push("<!--[0-->");
+				$$renderer.push(`<div class="network-option-detail svelte-1clxjuu"><label class="field svelte-1clxjuu" for="network-opencode-password"><span>Password</span> <input id="network-opencode-password" class="control-input mono svelte-1clxjuu" type="text" autocomplete="new-password" spellcheck="false"${attr("value", opencodePassword())}/></label></div>`);
+			} else $$renderer.push("<!--[-1-->");
+			$$renderer.push(`<!--]--> `);
+			if (preset === "home-open" && networkPreset() === "home-open") {
+				$$renderer.push("<!--[0-->");
+				$$renderer.push(`<div class="network-option-detail svelte-1clxjuu"><p class="network-risk-warning svelte-1clxjuu" role="alert">Anyone on your network will be able to use the assistant without a password — only choose this on
+              a network you trust.</p> <label class="field-inline svelte-1clxjuu"><input type="checkbox"${attr("checked", homeOpenAck(), true)}/> <span>I understand this exposes the assistant to everyone on my network without a password.</span></label></div>`);
+			} else $$renderer.push("<!--[-1-->");
+			$$renderer.push(`<!--]--></div>`);
+		}
+		$$renderer.push(`<!--]--></div> <p class="network-mdns-note svelte-1clxjuu"><code>.local</code> names are broadcast by the host <code>openpalm</code> process while it runs — the exact
+    names appear after install in Dashboard → Assistant.</p></div>`);
+	});
+}
+//#endregion
 //#region src/routes/setup/steps/ReviewStep.svelte
 function ReviewStep($$renderer, $$props) {
 	$$renderer.component(($$renderer) => {
@@ -1925,6 +2052,8 @@ function ReviewStep($$renderer, $$props) {
 		const installError = derived(() => s.installError);
 		const isRerun = derived(() => s.isRerun);
 		const systemCheckPassed = derived(() => s.systemCheckPassed);
+		const networkPreset = derived(() => s.networkPreset);
+		const networkPresetLabel = derived(() => networkPreset() ? NETWORK_PRESET_LABELS[networkPreset()] : "Custom (kept as-is)");
 		function isPortalEnabled$1(chId, locked) {
 			return isPortalEnabled(portalSelection(), chId, locked);
 		}
@@ -1958,7 +2087,9 @@ function ReviewStep($$renderer, $$props) {
 			$$renderer.push("<!--[-1-->");
 			$$renderer.push(`<div class="password-block svelte-1q74f52"><p class="password-label svelte-1q74f52">Sign-in password</p> <div class="password-row svelte-1q74f52"><span class="password-value password-value--dots svelte-1q74f52" aria-label="Sign-in password">••••••••</span> <div class="password-actions svelte-1q74f52"><span class="rerun-note svelte-1q74f52">Previously set — not changed.</span></div></div></div>`);
 		}
-		$$renderer.push(`<!--]--> <div class="summary-list svelte-1q74f52" aria-label="What's set up"><p class="summary-section-label svelte-1q74f52">What's being set up</p> `);
+		$$renderer.push(`<!--]--> <div id="network-access-section">`);
+		NetworkAccessStep($$renderer);
+		$$renderer.push(`<!----></div> <div class="summary-list svelte-1q74f52" aria-label="What's set up"><p class="summary-section-label svelte-1q74f52">What's being set up</p> `);
 		if (aiLabel()) {
 			$$renderer.push("<!--[0-->");
 			$$renderer.push(`<div class="summary-row svelte-1q74f52"><span class="summary-icon svelte-1q74f52" aria-hidden="true">`);
@@ -1987,7 +2118,9 @@ function ReviewStep($$renderer, $$props) {
 			IconMic($$renderer, { size: 16 });
 			$$renderer.push(`<!----></span> <div class="summary-body svelte-1q74f52"><div class="summary-key svelte-1q74f52">Voice</div> <div class="summary-val svelte-1q74f52">On — built-in voice</div></div> <button type="button" class="btn-change svelte-1q74f52">Change</button></div>`);
 		} else $$renderer.push("<!--[-1-->");
-		$$renderer.push(`<!--]--> <!--[-->`);
+		$$renderer.push(`<!--]--> <div class="summary-row svelte-1q74f52"><span class="summary-icon svelte-1q74f52" aria-hidden="true">`);
+		IconLock($$renderer, { size: 16 });
+		$$renderer.push(`<!----></span> <div class="summary-body svelte-1q74f52"><div class="summary-key svelte-1q74f52">Network access</div> <div class="summary-val svelte-1q74f52">${escape_html(networkPresetLabel())}</div></div> <button type="button" class="btn-change svelte-1q74f52">Change</button></div> <!--[-->`);
 		const each_array = ensure_array_like(activePortals());
 		for (let $$index = 0, $$length = each_array.length; $$index < $$length; $$index++) {
 			let ch = each_array[$$index];
@@ -2422,4 +2555,4 @@ function _page($$renderer, $$props) {
 }
 
 export { _page as default };
-//# sourceMappingURL=_page.svelte-BXeh8wzh.js.map
+//# sourceMappingURL=_page.svelte-C36XsgXY.js.map