@openpalm/ui 0.13.0-beta.3 → 0.13.0-beta.4

package/build/server/chunks/{landing-DvVXSE_x.js.map → landing-DKXNel0Q.js.map}

@@ -1 +1 @@
-{"version":3,"file":"landing-DvVXSE_x.js","sources":["../../../.svelte-kit/adapter-node/chunks/landing.js"],"sourcesContent":["import { t as buildComposeOptions } from \"./compose-args.js\";\nimport { m as composePs } from \"./docker.js\";\nimport { F as classifyLocalInstall, I as deriveLaunchStatus, L as deriveLocalStackState, R as detectRuntime } from \"./src.js\";\nimport { t as getState } from \"./state.js\";\nimport { a as listRemoteStatuses } from \"./endpoints.js\";\nimport { t as computeServerRuntimeContext } from \"./features.js\";\nimport { i as resolveCapabilities } from \"./runtime-context.svelte.js\";\n//#region src/lib/resolve-landing.ts\n/**\n* Where the host admin surface lives. Phase 4 moved it from /admin to /host\n* (/admin/* is a dead namespace — router 404, no alias).\n*/\nvar HOST_ADMIN_LANDING = \"/host\";\n/**\n* The blocking-migration landing surface.\n*\n* K4 (review 2026-07-11): callers that need to know whether a resolved\n* landing is BLOCKING (usage routes must not bypass it) must check\n* membership in BLOCKING_LANDINGS below — never string-compare against this\n* literal directly. Blocking-ness is a property of the landing STATE, not a\n* magic string duplicated at each call site; encoding it only as a literal\n* comparison means a future second blocking landing would return a new\n* string and every literal-match call site would silently keep exempting\n* usage routes from it.\n*/\nvar HOST_ATTENTION_LANDING = \"/attention\";\n/**\n* Landings that block the usage routes (/chat, /advanced, /connections)\n* from bypassing the launch-routing redirect (hooks.server.ts). Today only\n* HOST_ATTENTION_LANDING is blocking; adding a future second blocking\n* landing means adding it here — the usage-route gate then covers it\n* automatically, with no call-site changes required.\n*/\nvar BLOCKING_LANDINGS = new Set([HOST_ATTENTION_LANDING]);\n/** Resolve the landing path for a session (plan §6.5). Pure — no I/O, no\n*  global state; the gate is CAPABILITY-driven, not hostMode-driven. */\nfunction resolveLanding(ctx, state) {\n\tif (ctx.effectiveCapabilities.includes(\"host:setup\")) {\n\t\tif (state.migration.status === \"pending\") return HOST_ATTENTION_LANDING;\n\t\tif (state.local.state === \"not_installed\") return state.connections.length === 0 ? \"/setup\" : \"/chat\";\n\t\tif (state.local.state === \"setup_incomplete\") return \"/setup\";\n\t\tif (state.local.state === \"installed_offline\") return HOST_ADMIN_LANDING;\n\t\tif (state.local.state === \"installed_broken\") return `${HOST_ADMIN_LANDING}?tab=diagnostics`;\n\t\treturn \"/chat\";\n\t}\n\tif (ctx.hostMode === \"assistant-container\") return \"/chat\";\n\tif (ctx.hostMode === \"pwa-static\") return state.connections.length === 0 ? \"/connections/new\" : \"/chat\";\n\treturn \"/chat\";\n}\n//#endregion\n//#region src/lib/server/landing.ts\nvar launchRoutingCache = null;\nvar installStateCache = null;\n/** Test-only: clear the 5s launch-routing cache so each test resolves fresh. */\nfunction _resetLaunchCache() {\n\tlaunchRoutingCache = null;\n\tinstallStateCache = null;\n}\n/**\n* classifyLocalInstall, cached for 5s (K3). Shared by hooks.server.ts's\n* setup guard and resolveLaunchRouting() below, so a request that touches\n* both call sites only classifies the install once.\n*/\nfunction getCachedLocalInstallState(stackDir, homeDir) {\n\tif (installStateCache && installStateCache.expiresAt > Date.now()) return installStateCache.value;\n\tconst value = classifyLocalInstall(stackDir, homeDir);\n\tinstallStateCache = {\n\t\tvalue,\n\t\texpiresAt: Date.now() + 5e3\n\t};\n\treturn value;\n}\nfunction parseComposePsServices(stdout) {\n\tconst services = [];\n\tfor (const line of stdout.split(\"\\n\")) {\n\t\tconst trimmed = line.trim();\n\t\tif (!trimmed) continue;\n\t\ttry {\n\t\t\tconst parsed = JSON.parse(trimmed);\n\t\t\tservices.push({\n\t\t\t\tservice: String(parsed.Service ?? parsed.Name ?? \"\"),\n\t\t\t\tstate: String(parsed.State ?? \"\"),\n\t\t\t\thealth: String(parsed.Health ?? \"\")\n\t\t\t});\n\t\t} catch {}\n\t}\n\treturn services;\n}\nasync function resolveLaunchRouting() {\n\tif (launchRoutingCache && launchRoutingCache.expiresAt > Date.now()) return launchRoutingCache.value;\n\tconst state = getState();\n\tconst installState = getCachedLocalInstallState(state.stackDir, state.homeDir);\n\tconst composeResult = await composePs(buildComposeOptions(state));\n\tconst value = {\n\t\tinstallState,\n\t\tlaunch: deriveLaunchStatus({\n\t\t\tlocal: {\n\t\t\t\tstate: deriveLocalStackState(installState, composeResult.ok ? parseComposePsServices(composeResult.stdout) : []),\n\t\t\t\truntime: installState === \"not_installed\" ? await detectRuntime() : void 0,\n\t\t\t\tdetail: { installState }\n\t\t\t},\n\t\t\tremotes: await listRemoteStatuses()\n\t\t})\n\t};\n\tlaunchRoutingCache = {\n\t\tvalue,\n\t\texpiresAt: Date.now() + 5e3\n\t};\n\treturn value;\n}\n/**\n* Resolve the landing path for a request via resolveLanding() (plan §6.5).\n* May return a path with a query string (e.g. '/host?tab=diagnostics').\n*/\nasync function resolveRequestLanding(event) {\n\tconst serverCtx = computeServerRuntimeContext(event);\n\tconst clientContext = { displayMode: \"browser\" };\n\tconst ctx = {\n\t\t...serverCtx,\n\t\tclientContext,\n\t\teffectiveCapabilities: resolveCapabilities(serverCtx.serverCapabilities, clientContext)\n\t};\n\tconst { installState, launch } = await resolveLaunchRouting();\n\tconst localState = installState === \"setup_incomplete\" && launch.local.state === \"running\" ? \"setup_incomplete\" : launch.local.state;\n\tconst connections = [...launch.hasHealthyLocal ? [{ id: \"default\" }] : [], ...launch.remotes.filter((r) => r.state === \"accessible\")];\n\treturn resolveLanding(ctx, {\n\t\tmigration: { status: \"none\" },\n\t\tlocal: { state: localState },\n\t\tconnections\n\t});\n}\n//#endregion\nexport { BLOCKING_LANDINGS as i, getCachedLocalInstallState as n, resolveRequestLanding as r, _resetLaunchCache as t };\n"],"names":[],"mappings":";;;;;;AAOA;AACA;AACA;AACA;AACA;AACA,IAAI,kBAAkB,GAAG,OAAO;AAChC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,sBAAsB,GAAG,YAAY;AACzC;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,sBAAsB,CAAC;AACxD;AACA;AACA,SAAS,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE;AACpC,CAAC,IAAI,GAAG,CAAC,qBAAqB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE;AACvD,EAAE,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,OAAO,sBAAsB;AACzE,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,eAAe,EAAE,OAAO,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,GAAG,QAAQ,GAAG,OAAO;AACvG,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,kBAAkB,EAAE,OAAO,QAAQ;AAC/D,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,mBAAmB,EAAE,OAAO,kBAAkB;AAC1E,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,kBAAkB,EAAE,OAAO,CAAC,EAAE,kBAAkB,CAAC,gBAAgB,CAAC;AAC9F,EAAE,OAAO,OAAO;AAChB,CAAC;AACD,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,qBAAqB,EAAE,OAAO,OAAO;AAC3D,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,OAAO,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,GAAG,kBAAkB,GAAG,OAAO;AACxG,CAAC,OAAO,OAAO;AACf;AACA;AACA;AACA,IAAI,kBAAkB,GAAG,IAAI;AAC7B,IAAI,iBAAiB,GAAG,IAAI;AAC5B;AACA,SAAS,iBAAiB,GAAG;AAC7B,CAAC,kBAAkB,GAAG,IAAI;AAC1B,CAAC,iBAAiB,GAAG,IAAI;AACzB;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,0BAA0B,CAAC,QAAQ,EAAE,OAAO,EAAE;AACvD,CAAC,IAAI,iBAAiB,IAAI,iBAAiB,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,iBAAiB,CAAC,KAAK;AAClG,CAAC,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC;AACtD,CAAC,iBAAiB,GAAG;AACrB,EAAE,KAAK;AACP,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG;AAC1B,EAAE;AACF,CAAC,OAAO,KAAK;AACb;AACA,SAAS,sBAAsB,CAAC,MAAM,EAAE;AACxC,CAAC,MAAM,QAAQ,GAAG,EAAE;AACpB,CAAC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;AACxC,EAAE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE;AAC7B,EAAE,IAAI,CAAC,OAAO,EAAE;AAChB,EAAE,IAAI;AACN,GAAG,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;AACrC,GAAG,QAAQ,CAAC,IAAI,CAAC;AACjB,IAAI,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;AACxD,IAAI,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;AACrC,IAAI,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE;AACtC,IAAI,CAAC;AACL,EAAE,CAAC,CAAC,MAAM,CAAC;AACX,CAAC;AACD,CAAC,OAAO,QAAQ;AAChB;AACA,eAAe,oBAAoB,GAAG;AACtC,CAAC,IAAI,kBAAkB,IAAI,kBAAkB,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,kBAAkB,CAAC,KAAK;AACrG,CAAC,MAAM,KAAK,GAAG,QAAQ,EAAE;AACzB,CAAC,MAAM,YAAY,GAAG,0BAA0B,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC;AAC/E,CAAC,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,YAAY;AACd,EAAE,MAAM,EAAE,kBAAkB,CAAC;AAC7B,GAAG,KAAK,EAAE;AACV,IAAI,KAAK,EAAE,qBAAqB,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE,GAAG,sBAAsB,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;AACpH,IAAI,OAAO,EAAE,YAAY,KAAK,eAAe,GAAG,MAAM,aAAa,EAAE,GAAG,MAAM;AAC9E,IAAI,MAAM,EAAE,EAAE,YAAY;AAC1B,IAAI;AACJ,GAAG,OAAO,EAAE,MAAM,kBAAkB;AACpC,GAAG;AACH,EAAE;AACF,CAAC,kBAAkB,GAAG;AACtB,EAAE,KAAK;AACP,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG;AAC1B,EAAE;AACF,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA,eAAe,qBAAqB,CAAC,KAAK,EAAE;AAC5C,CAAC,MAAM,SAAS,GAAG,2BAA2B,CAAC,KAAK,CAAC;AACrD,CAAC,MAAM,aAAa,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE;AACjD,CAAC,MAAM,GAAG,GAAG;AACb,EAAE,GAAG,SAAS;AACd,EACE,qBAAqB,EAAE,mBAAmB,CAAC,SAAS,CAAC,kBAAkB,EAAE,aAAa;AACxF,EAAE;AACF,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,oBAAoB,EAAE;AAC9D,CAAC,MAAM,UAAU,GAAG,YAAY,KAAK,kBAAkB,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,GAAG,kBAAkB,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK;AACrI,CAAC,MAAM,WAAW,GAAG,CAAC,GAAG,MAAM,CAAC,eAAe,GAAG,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC;AACtI,CAAC,OAAO,cAAc,CAAC,GAAG,EAAE;AAC5B,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;AAC/B,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE;AAC9B,EAAE;AACF,EAAE,CAAC;AACH;;;;"}
+{"version":3,"file":"landing-DKXNel0Q.js","sources":["../../../.svelte-kit/adapter-node/chunks/landing.js"],"sourcesContent":["import { t as buildComposeOptions } from \"./compose-args.js\";\nimport { m as composePs } from \"./docker.js\";\nimport { I as classifyLocalInstall, L as deriveLaunchStatus, R as deriveLocalStackState, z as detectRuntime } from \"./src.js\";\nimport { t as getState } from \"./state.js\";\nimport { o as listRemoteStatuses } from \"./endpoints.js\";\nimport { t as computeServerRuntimeContext } from \"./features.js\";\nimport { i as resolveCapabilities } from \"./runtime-context.svelte.js\";\n//#region src/lib/resolve-landing.ts\n/**\n* Where the host admin surface lives. Phase 4 moved it from /admin to /host\n* (/admin/* is a dead namespace — router 404, no alias).\n*/\nvar HOST_ADMIN_LANDING = \"/host\";\n/**\n* The blocking-migration landing surface.\n*\n* K4 (review 2026-07-11): callers that need to know whether a resolved\n* landing is BLOCKING (usage routes must not bypass it) must check\n* membership in BLOCKING_LANDINGS below — never string-compare against this\n* literal directly. Blocking-ness is a property of the landing STATE, not a\n* magic string duplicated at each call site; encoding it only as a literal\n* comparison means a future second blocking landing would return a new\n* string and every literal-match call site would silently keep exempting\n* usage routes from it.\n*/\nvar HOST_ATTENTION_LANDING = \"/attention\";\n/**\n* Landings that block the usage routes (/chat, /advanced, /connections)\n* from bypassing the launch-routing redirect (hooks.server.ts). Today only\n* HOST_ATTENTION_LANDING is blocking; adding a future second blocking\n* landing means adding it here — the usage-route gate then covers it\n* automatically, with no call-site changes required.\n*/\nvar BLOCKING_LANDINGS = new Set([HOST_ATTENTION_LANDING]);\n/** Resolve the landing path for a session (plan §6.5). Pure — no I/O, no\n*  global state; the gate is CAPABILITY-driven, not hostMode-driven. */\nfunction resolveLanding(ctx, state) {\n\tif (ctx.effectiveCapabilities.includes(\"host:setup\")) {\n\t\tif (state.migration.status === \"pending\") return HOST_ATTENTION_LANDING;\n\t\tif (state.local.state === \"not_installed\") return state.connections.length === 0 ? \"/setup\" : \"/chat\";\n\t\tif (state.local.state === \"setup_incomplete\") return \"/setup\";\n\t\tif (state.local.state === \"installed_offline\") return HOST_ADMIN_LANDING;\n\t\tif (state.local.state === \"installed_broken\") return `${HOST_ADMIN_LANDING}?tab=diagnostics`;\n\t\treturn \"/chat\";\n\t}\n\tif (ctx.hostMode === \"assistant-container\") return \"/chat\";\n\tif (ctx.hostMode === \"pwa-static\") return state.connections.length === 0 ? \"/connections/new\" : \"/chat\";\n\treturn \"/chat\";\n}\n//#endregion\n//#region src/lib/server/landing.ts\nvar launchRoutingCache = null;\nvar installStateCache = null;\n/** Test-only: clear the 5s launch-routing cache so each test resolves fresh. */\nfunction _resetLaunchCache() {\n\tlaunchRoutingCache = null;\n\tinstallStateCache = null;\n}\n/**\n* classifyLocalInstall, cached for 5s (K3). Shared by hooks.server.ts's\n* setup guard and resolveLaunchRouting() below, so a request that touches\n* both call sites only classifies the install once.\n*/\nfunction getCachedLocalInstallState(stackDir, homeDir) {\n\tif (installStateCache && installStateCache.expiresAt > Date.now()) return installStateCache.value;\n\tconst value = classifyLocalInstall(stackDir, homeDir);\n\tinstallStateCache = {\n\t\tvalue,\n\t\texpiresAt: Date.now() + 5e3\n\t};\n\treturn value;\n}\nfunction parseComposePsServices(stdout) {\n\tconst services = [];\n\tfor (const line of stdout.split(\"\\n\")) {\n\t\tconst trimmed = line.trim();\n\t\tif (!trimmed) continue;\n\t\ttry {\n\t\t\tconst parsed = JSON.parse(trimmed);\n\t\t\tservices.push({\n\t\t\t\tservice: String(parsed.Service ?? parsed.Name ?? \"\"),\n\t\t\t\tstate: String(parsed.State ?? \"\"),\n\t\t\t\thealth: String(parsed.Health ?? \"\")\n\t\t\t});\n\t\t} catch {}\n\t}\n\treturn services;\n}\nasync function resolveLaunchRouting() {\n\tif (launchRoutingCache && launchRoutingCache.expiresAt > Date.now()) return launchRoutingCache.value;\n\tconst state = getState();\n\tconst installState = getCachedLocalInstallState(state.stackDir, state.homeDir);\n\tconst composeResult = await composePs(buildComposeOptions(state));\n\tconst value = {\n\t\tinstallState,\n\t\tlaunch: deriveLaunchStatus({\n\t\t\tlocal: {\n\t\t\t\tstate: deriveLocalStackState(installState, composeResult.ok ? parseComposePsServices(composeResult.stdout) : []),\n\t\t\t\truntime: installState === \"not_installed\" ? await detectRuntime() : void 0,\n\t\t\t\tdetail: { installState }\n\t\t\t},\n\t\t\tremotes: await listRemoteStatuses()\n\t\t})\n\t};\n\tlaunchRoutingCache = {\n\t\tvalue,\n\t\texpiresAt: Date.now() + 5e3\n\t};\n\treturn value;\n}\n/**\n* Resolve the landing path for a request via resolveLanding() (plan §6.5).\n* May return a path with a query string (e.g. '/host?tab=diagnostics').\n*/\nasync function resolveRequestLanding(event) {\n\tconst serverCtx = computeServerRuntimeContext(event);\n\tconst clientContext = { displayMode: \"browser\" };\n\tconst ctx = {\n\t\t...serverCtx,\n\t\tclientContext,\n\t\teffectiveCapabilities: resolveCapabilities(serverCtx.serverCapabilities, clientContext)\n\t};\n\tconst { installState, launch } = await resolveLaunchRouting();\n\tconst localState = installState === \"setup_incomplete\" && launch.local.state === \"running\" ? \"setup_incomplete\" : launch.local.state;\n\tconst connections = [...launch.hasHealthyLocal ? [{ id: \"default\" }] : [], ...launch.remotes.filter((r) => r.state === \"accessible\")];\n\treturn resolveLanding(ctx, {\n\t\tmigration: { status: \"none\" },\n\t\tlocal: { state: localState },\n\t\tconnections\n\t});\n}\n//#endregion\nexport { BLOCKING_LANDINGS as i, getCachedLocalInstallState as n, resolveRequestLanding as r, _resetLaunchCache as t };\n"],"names":[],"mappings":";;;;;;AAOA;AACA;AACA;AACA;AACA;AACA,IAAI,kBAAkB,GAAG,OAAO;AAChC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,sBAAsB,GAAG,YAAY;AACzC;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,sBAAsB,CAAC;AACxD;AACA;AACA,SAAS,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE;AACpC,CAAC,IAAI,GAAG,CAAC,qBAAqB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE;AACvD,EAAE,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,OAAO,sBAAsB;AACzE,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,eAAe,EAAE,OAAO,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,GAAG,QAAQ,GAAG,OAAO;AACvG,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,kBAAkB,EAAE,OAAO,QAAQ;AAC/D,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,mBAAmB,EAAE,OAAO,kBAAkB;AAC1E,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,kBAAkB,EAAE,OAAO,CAAC,EAAE,kBAAkB,CAAC,gBAAgB,CAAC;AAC9F,EAAE,OAAO,OAAO;AAChB,CAAC;AACD,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,qBAAqB,EAAE,OAAO,OAAO;AAC3D,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,OAAO,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,GAAG,kBAAkB,GAAG,OAAO;AACxG,CAAC,OAAO,OAAO;AACf;AACA;AACA;AACA,IAAI,kBAAkB,GAAG,IAAI;AAC7B,IAAI,iBAAiB,GAAG,IAAI;AAC5B;AACA,SAAS,iBAAiB,GAAG;AAC7B,CAAC,kBAAkB,GAAG,IAAI;AAC1B,CAAC,iBAAiB,GAAG,IAAI;AACzB;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,0BAA0B,CAAC,QAAQ,EAAE,OAAO,EAAE;AACvD,CAAC,IAAI,iBAAiB,IAAI,iBAAiB,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,iBAAiB,CAAC,KAAK;AAClG,CAAC,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC;AACtD,CAAC,iBAAiB,GAAG;AACrB,EAAE,KAAK;AACP,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG;AAC1B,EAAE;AACF,CAAC,OAAO,KAAK;AACb;AACA,SAAS,sBAAsB,CAAC,MAAM,EAAE;AACxC,CAAC,MAAM,QAAQ,GAAG,EAAE;AACpB,CAAC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;AACxC,EAAE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE;AAC7B,EAAE,IAAI,CAAC,OAAO,EAAE;AAChB,EAAE,IAAI;AACN,GAAG,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;AACrC,GAAG,QAAQ,CAAC,IAAI,CAAC;AACjB,IAAI,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;AACxD,IAAI,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;AACrC,IAAI,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE;AACtC,IAAI,CAAC;AACL,EAAE,CAAC,CAAC,MAAM,CAAC;AACX,CAAC;AACD,CAAC,OAAO,QAAQ;AAChB;AACA,eAAe,oBAAoB,GAAG;AACtC,CAAC,IAAI,kBAAkB,IAAI,kBAAkB,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,kBAAkB,CAAC,KAAK;AACrG,CAAC,MAAM,KAAK,GAAG,QAAQ,EAAE;AACzB,CAAC,MAAM,YAAY,GAAG,0BAA0B,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC;AAC/E,CAAC,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,YAAY;AACd,EAAE,MAAM,EAAE,kBAAkB,CAAC;AAC7B,GAAG,KAAK,EAAE;AACV,IAAI,KAAK,EAAE,qBAAqB,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE,GAAG,sBAAsB,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;AACpH,IAAI,OAAO,EAAE,YAAY,KAAK,eAAe,GAAG,MAAM,aAAa,EAAE,GAAG,MAAM;AAC9E,IAAI,MAAM,EAAE,EAAE,YAAY;AAC1B,IAAI;AACJ,GAAG,OAAO,EAAE,MAAM,kBAAkB;AACpC,GAAG;AACH,EAAE;AACF,CAAC,kBAAkB,GAAG;AACtB,EAAE,KAAK;AACP,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG;AAC1B,EAAE;AACF,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA,eAAe,qBAAqB,CAAC,KAAK,EAAE;AAC5C,CAAC,MAAM,SAAS,GAAG,2BAA2B,CAAC,KAAK,CAAC;AACrD,CAAC,MAAM,aAAa,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE;AACjD,CAAC,MAAM,GAAG,GAAG;AACb,EAAE,GAAG,SAAS;AACd,EACE,qBAAqB,EAAE,mBAAmB,CAAC,SAAS,CAAC,kBAAkB,EAAE,aAAa;AACxF,EAAE;AACF,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,oBAAoB,EAAE;AAC9D,CAAC,MAAM,UAAU,GAAG,YAAY,KAAK,kBAAkB,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,GAAG,kBAAkB,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK;AACrI,CAAC,MAAM,WAAW,GAAG,CAAC,GAAG,MAAM,CAAC,eAAe,GAAG,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC;AACtI,CAAC,OAAO,cAAc,CAAC,GAAG,EAAE;AAC5B,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;AAC/B,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE;AAC9B,EAAE;AACF,EAAE,CAAC;AACH;;;;"}

package/build/server/chunks/network-preset-CJ1RRnki.js

@@ -0,0 +1,431 @@
+//#region ../lib/src/control-plane/addon-ids.ts
+/**
+* Canonical list of built-in addon IDs.
+*
+* Single source of truth — imported by both addons.ts and migrations.ts.
+* Update THIS file (and only this file) when adding or removing a built-in addon.
+*
+* Intentionally a pure-constants file with no imports so it can be safely
+* imported from anywhere without risk of circular dependencies.
+*/
+var BUILTIN_ADDON_IDS = [
+	"api",
+	"chat",
+	"discord",
+	"gateway",
+	"ollama",
+	"slack",
+	"voice"
+];
+/**
+* Addons whose ingress is served by the guardian container.
+*
+* Single source of truth for guardian deploy gating. Must mirror the Compose
+* profile gate on the guardian service in
+* `packages/skeleton/system/stack/portals.compose.yml`
+* (`profiles: [addon.chat, addon.api, addon.discord, addon.slack, addon.gateway]`):
+* enabling any of these requires the guardian, so the deploy set, the
+* expected-service seed, and the activation loop all deploy/health-wait on it.
+*
+* NOTE: broader than PORTAL_SECRET_ADDON_IDS — `gateway` uses the guardian but
+* has no portal secret of its own (see below). Keep the two lists distinct.
+*/
+var GUARDIAN_INGRESS_ADDON_IDS = [
+	"api",
+	"chat",
+	"discord",
+	"gateway",
+	"slack"
+];
+/**
+* First-party portals that own a dedicated `portal_<id>_secret`.
+*
+* Single source of truth for portal-secret provisioning (`ensurePortalSecret`).
+* Must mirror the `portal_*_secret` set the guardian mounts in
+* `portals.compose.yml` (chat, api, discord, slack). Excludes `gateway`, which
+* is guardian ingress but has no portal secret of its own.
+*/
+var PORTAL_SECRET_ADDON_IDS = [
+	"api",
+	"chat",
+	"discord",
+	"slack"
+];
+
+//#region ../lib/src/provider-constants.ts
+/** Default base URLs per provider. */
+var PROVIDER_DEFAULT_URLS = {
+	openai: "https://api.openai.com",
+	groq: "https://api.groq.com/openai",
+	mistral: "https://api.mistral.ai",
+	together: "https://api.together.xyz",
+	deepseek: "https://api.deepseek.com",
+	xai: "https://api.x.ai",
+	lmstudio: "http://host.docker.internal:1234",
+	ollama: "http://host.docker.internal:11434",
+	"model-runner": "http://model-runner.docker.internal/engines",
+	google: "https://generativelanguage.googleapis.com",
+	huggingface: "https://router.huggingface.co/v1"
+};
+/** Map provider name → env var for the API key. */
+var PROVIDER_KEY_MAP = {
+	openai: "OPENAI_API_KEY",
+	groq: "GROQ_API_KEY",
+	mistral: "MISTRAL_API_KEY",
+	google: "GOOGLE_API_KEY",
+	deepseek: "DEEPSEEK_API_KEY",
+	together: "TOGETHER_API_KEY",
+	xai: "XAI_API_KEY",
+	huggingface: "HF_TOKEN"
+};
+/** Known embedding model dimensions. Keyed by `provider/model`. */
+var EMBEDDING_DIMS = {
+	"openai/text-embedding-3-small": 1536,
+	"openai/text-embedding-3-large": 3072,
+	"openai/text-embedding-ada-002": 1536,
+	"ollama/nomic-embed-text": 768,
+	"ollama/mxbai-embed-large": 1024,
+	"ollama/mxbai-embed-large-v1": 1024,
+	"ollama/all-minilm": 384,
+	"ollama/snowflake-arctic-embed": 1024,
+	"model-runner/ai/mxbai-embed-large-v1": 1024,
+	"mistral/mistral-embed": 1024,
+	"google/text-embedding-004": 768,
+	"huggingface/sentence-transformers/all-MiniLM-L6-v2": 384,
+	"huggingface/intfloat/multilingual-e5-large": 1024
+};
+/** Bare model-name lookup used by the browser wizard helpers. */
+var KNOWN_EMBEDDING_MODEL_DIMS = Object.fromEntries(Object.entries(EMBEDDING_DIMS).map(([key, dims]) => [key.slice(key.indexOf("/") + 1), dims]));
+/**
+* Look up embedding model dimensions. Tries the full key first, then strips
+* any trailing `:tag` from the model name (Ollama-style versions).
+* Returns 0 when no match is found.
+*/
+function lookupEmbeddingDims(provider, model) {
+	if (!provider || !model) return 0;
+	const key = `${provider}/${model}`;
+	if (EMBEDDING_DIMS[key]) return EMBEDDING_DIMS[key];
+	const colon = model.lastIndexOf(":");
+	if (colon > 0) {
+		const bare = `${provider}/${model.slice(0, colon)}`;
+		if (EMBEDDING_DIMS[bare]) return EMBEDDING_DIMS[bare];
+	}
+	return 0;
+}
+var OLLAMA_DEFAULT_CHAT_MODEL = {
+	chat: "llama3.2:latest"}.chat;
+function addonProfileId(addon, variant) {
+	return `addon.${addon}.${variant}`;
+}
+
+//#region ../lib/src/control-plane/bind-warning.ts
+/**
+* Startup warning for non-loopback bind addresses.
+*
+* When OP_BIND_ADDRESS is set to a non-loopback value (anything other than
+* 127.0.0.1, localhost, or ::1), services are exposed on the host network
+* interface. This helper produces a structured list of warning lines that
+* callers should log at WARN level so operators are aware.
+*
+* Per-service overrides (e.g. OP_CHAT_BIND_ADDRESS, OP_VOICE_BIND_ADDRESS)
+* are also checked and reported individually.
+*/
+/**
+* True when OP_ENABLED_ADDONS names at least one guardian-ingress addon — i.e.
+* a guardian proxy is actually deployed in front of the exposed services.
+* Parses the comma-separated OP_ENABLED_ADDONS directly (no dependency on
+* addons.ts, to keep this module import-light and cycle-free).
+*/
+function hasGuardianIngress(env) {
+	return (env.OP_ENABLED_ADDONS ?? "").split(",").map((s) => s.trim()).filter(Boolean).some((a) => GUARDIAN_INGRESS_ADDON_IDS.includes(a));
+}
+/** Known per-service bind address env var names (mirrors compose files). */
+var PER_SERVICE_BIND_VARS = [
+	"OP_ASSISTANT_BIND_ADDRESS",
+	"OP_CLIENT_BIND_ADDRESS",
+	"OP_CHAT_BIND_ADDRESS",
+	"OP_API_BIND_ADDRESS",
+	"OP_VOICE_BIND_ADDRESS"
+];
+/**
+* #563 D9 — per-var warnings lead with WHAT is exposed and which network
+* access preset (packages/lib/src/control-plane/network-preset.ts)
+* deliberately configures that exposure, so operators reading the log can
+* tell "I did this on purpose" from "something hand-edited this". Only
+* `OP_ASSISTANT_BIND_ADDRESS` (the Home network presets) and
+* `OP_BIND_ADDRESS` (the Shared network preset) are ever set by a preset;
+* the other per-service vars (client/chat/api/voice) are never preset-managed
+* so they keep generic wording naming no preset.
+*/
+var PRESET_FRAMING = {
+	OP_BIND_ADDRESS: "Shared network, guardian protected",
+	OP_ASSISTANT_BIND_ADDRESS: "Home network"
+};
+/** Exported for reuse by mdns-responder.ts's bind-gating logic (#488). */
+function isLoopback(value) {
+	const v = value.trim();
+	return v === "127.0.0.1" || v === "localhost" || v === "::1";
+}
+/**
+* Opt-in: allow the web UI (including the first-run setup wizard) to be reached
+* from a remote machine. When set, the UI server binds all interfaces and the
+* Host/Origin allowlist + the setup-localhost-only gate are relaxed.
+*
+* This deliberately reopens the owner-race the setup gate normally prevents, so
+* it is OFF by default and must be explicitly enabled by the operator. Reach the
+* UI over an SSH tunnel or a reverse proxy instead when you can.
+*/
+function isRemoteSetupAllowed(env = process.env) {
+	const v = env.OP_ALLOW_REMOTE_SETUP?.trim().toLowerCase();
+	return v === "1" || v === "true" || v === "yes";
+}
+/**
+* Inspect `env` for non-loopback bind address settings and return one warning
+* line per problematic variable.  Returns an empty array when everything is
+* loopback (or unset, since the compose default is 127.0.0.1).
+*
+* @param env - The environment to inspect; typically `process.env`.
+*/
+function collectBindAddressWarnings(env) {
+	const warnings = [];
+	const globalBind = env.OP_BIND_ADDRESS;
+	if (globalBind && !isLoopback(globalBind)) warnings.push(hasGuardianIngress(env) ? `${PRESET_FRAMING.OP_BIND_ADDRESS} exposure — OP_BIND_ADDRESS is set to "${globalBind}", exposing services on the host network interface, not just loopback. Ensure a firewall is in place if this host is reachable from untrusted networks.` : `Unprotected LAN exposure — OP_BIND_ADDRESS is set to "${globalBind}" but no guardian-ingress addon is enabled, so services are exposed directly on the host network interface with no guardian proxy in front. Enable a guardian-ingress addon (chat/api/gateway/discord/slack) or keep this loopback-only.`);
+	for (const key of PER_SERVICE_BIND_VARS) {
+		const val = env[key];
+		if (val && !isLoopback(val)) {
+			const framing = PRESET_FRAMING[key];
+			warnings.push(framing ? `${framing} exposure — ${key} is set to "${val}", exposing this service on the host network interface.` : `${key} is set to "${val}" — this service will be exposed on the host network interface.`);
+		}
+	}
+	if (isRemoteSetupAllowed(env)) warnings.push("OP_ALLOW_REMOTE_SETUP is enabled — the web UI is reachable from remote machines and the setup wizard is no longer restricted to the host. Only use this on a trusted network behind a firewall.");
+	return warnings;
+}
+//#endregion
+//#region ../lib/src/control-plane/network-preset.ts
+/**
+* Network access preset resolver (#563).
+*
+* A single "network access" choice bundles bind-address exposure, OpenCode
+* Basic auth, and mDNS advertisement intent into one operator-facing decision
+* instead of four independently-tunable env vars. This module is the ONLY
+* place that knows the preset → env-var mapping; the wizard, the CLI headless
+* spec path, and the admin "detect current preset" surface all resolve
+* through it so they can never drift from each other.
+*
+* Browser-safe: this module imports ONLY `isLoopback`, `collectBindAddressWarnings`,
+* and `isRemoteSetupAllowed` from `./bind-warning.js` — no `node:*` imports and
+* never `./mdns-responder.js` (which pulls in `node:dgram`). The wizard
+* (packages/ui, a browser bundle) imports this module directly via the
+* `@openpalm/lib/control-plane/network-preset.js` subpath, precedent:
+* `provider-constants.ts`.
+*
+* D1 (mDNS mechanism): per-preset mDNS is delivered entirely by the #488 host
+* mDNS responder (`mdns-responder.ts`), which gates advertisement on exactly
+* the bind vars this resolver writes (`OP_ASSISTANT_BIND_ADDRESS` for the
+* assistant name, `OP_BIND_ADDRESS` for the guardian name). This resolver only
+* exposes `assistantMdns`/`guardianMdns` INTENT flags mirroring those gates —
+* it never touches mDNS config directly. `network-preset.test.ts` T7 pins the
+* two together so they can never silently diverge.
+*
+* D4 (managed key matrix): every preset writes ALL of `OP_BIND_ADDRESS`,
+* `OP_ASSISTANT_BIND_ADDRESS`, `OP_CLIENT_BIND_ADDRESS`, `OP_VOICE_BIND_ADDRESS`,
+* and `OPENCODE_AUTH` explicitly (loopback rather than "leave unset"), so
+* switching between presets always converges regardless of prior state.
+* `OP_CHAT_BIND_ADDRESS` / `OP_API_BIND_ADDRESS` are deliberately NOT managed —
+* those are listeners inside the guardian container, fail-closed
+* API-key-authenticated, so they are left to ride the `OP_BIND_ADDRESS`
+* cascade (guardian-protected exposure is the intended behavior under
+* shared-guardian). `GUARDIAN_DIRECT_INGRESS` is never touched by any preset —
+* presets configure exposure, not ingress enablement.
+*/
+var NETWORK_ACCESS_PRESETS = [
+	"this-pc",
+	"home-password",
+	"home-open",
+	"shared-guardian"
+];
+/** Single source of copy for the wizard, the admin tab, and warning text. */
+var NETWORK_PRESET_LABELS = {
+	"this-pc": "This PC only",
+	"home-password": "Home network, with password",
+	"home-open": "Home network, open access",
+	"shared-guardian": "Shared network, guardian protected"
+};
+function isNetworkAccessPreset(value) {
+	return typeof value === "string" && NETWORK_ACCESS_PRESETS.includes(value);
+}
+var LOOPBACK_DEFAULT = "127.0.0.1";
+var LAN_VALUE = "0.0.0.0";
+/** Managed bind-address env keys every preset writes explicitly. */
+var MANAGED_BIND_KEYS = [
+	"OP_BIND_ADDRESS",
+	"OP_ASSISTANT_BIND_ADDRESS",
+	"OP_CLIENT_BIND_ADDRESS",
+	"OP_VOICE_BIND_ADDRESS"
+];
+var ALL_LOOPBACK = {
+	OP_BIND_ADDRESS: LOOPBACK_DEFAULT,
+	OP_ASSISTANT_BIND_ADDRESS: LOOPBACK_DEFAULT,
+	OP_CLIENT_BIND_ADDRESS: LOOPBACK_DEFAULT,
+	OP_VOICE_BIND_ADDRESS: LOOPBACK_DEFAULT,
+	OPENCODE_AUTH: "false"
+};
+/**
+* Resolve one of the four network access presets into its complete managed
+* env row + mDNS intent flags. Throws on a password-contract violation
+* (missing/empty password for `home-password`, or a password supplied for any
+* other preset) — these are operator errors, not silent drops.
+*/
+function resolveNetworkPreset(preset, opts) {
+	const password = opts?.opencodePassword;
+	if (preset === "home-password") {
+		if (!password) throw new Error("network.opencodePassword is required for the \"home-password\" network access preset.");
+	} else if (password) throw new Error(`network.opencodePassword must not be supplied for the "${preset}" network access preset.`);
+	switch (preset) {
+		case "this-pc": return {
+			preset,
+			env: { ...ALL_LOOPBACK },
+			assistantMdns: false,
+			guardianMdns: false
+		};
+		case "home-password": return {
+			preset,
+			env: {
+				...ALL_LOOPBACK,
+				OP_ASSISTANT_BIND_ADDRESS: LAN_VALUE,
+				OPENCODE_AUTH: "true"
+			},
+			opencodePassword: password,
+			assistantMdns: true,
+			guardianMdns: false
+		};
+		case "home-open": return {
+			preset,
+			env: {
+				...ALL_LOOPBACK,
+				OP_ASSISTANT_BIND_ADDRESS: LAN_VALUE
+			},
+			assistantMdns: true,
+			guardianMdns: false
+		};
+		case "shared-guardian": return {
+			preset,
+			env: {
+				...ALL_LOOPBACK,
+				OP_BIND_ADDRESS: LAN_VALUE
+			},
+			assistantMdns: false,
+			guardianMdns: true
+		};
+		default: throw new Error(`Unknown network access preset: ${String(preset)}`);
+	}
+}
+/**
+* Per-service binds whose compose host-port default NESTS `${OP_BIND_ADDRESS}`
+* (core.compose.yml OP_CLIENT / services.compose.yml OP_VOICE:
+* `${OP_X_BIND_ADDRESS:-${OP_BIND_ADDRESS:-127.0.0.1}}`). An unset value
+* therefore inherits the GLOBAL bind, not loopback. `OP_ASSISTANT_BIND_ADDRESS`
+* is deliberately absent — its host-port line defaults straight to 127.0.0.1
+* with no OP_BIND_ADDRESS fallback.
+*/
+var OP_BIND_CASCADING_KEYS = new Set(["OP_CLIENT_BIND_ADDRESS", "OP_VOICE_BIND_ADDRESS"]);
+function boundValue(env, key) {
+	const raw = env[key]?.trim();
+	if (raw) return raw;
+	if (OP_BIND_CASCADING_KEYS.has(key)) {
+		const globalBind = env.OP_BIND_ADDRESS?.trim();
+		if (globalBind) return globalBind;
+	}
+	return LOOPBACK_DEFAULT;
+}
+function isExposed(env, key) {
+	return !isLoopback(boundValue(env, key));
+}
+function isAuthOn(env) {
+	const v = (env.OPENCODE_AUTH ?? "").trim().toLowerCase();
+	return v === "true" || v === "1" || v === "yes";
+}
+/**
+* Reverse the resolver: given a (possibly hand-edited) env record, identify
+* which preset it matches, if any. Unset managed keys are treated as the
+* compose loopback default. Unmanaged keys (e.g. `OP_CHAT_BIND_ADDRESS`) are
+* ignored entirely — they are reported by `collectNetworkExposureWarnings`
+* instead, never by detection. Returns `null` on drift (a combination no
+* preset produces), which the caller reports as "custom".
+*/
+function detectNetworkPreset(env) {
+	const globalExposed = isExposed(env, "OP_BIND_ADDRESS");
+	const assistantExposed = isExposed(env, "OP_ASSISTANT_BIND_ADDRESS");
+	const clientExposed = isExposed(env, "OP_CLIENT_BIND_ADDRESS");
+	const voiceExposed = isExposed(env, "OP_VOICE_BIND_ADDRESS");
+	const authOn = isAuthOn(env);
+	if (!globalExposed && !assistantExposed && !clientExposed && !voiceExposed && !authOn) return "this-pc";
+	if (!globalExposed && assistantExposed && !clientExposed && !voiceExposed) return authOn ? "home-password" : "home-open";
+	if (globalExposed && !assistantExposed && !clientExposed && !voiceExposed && !authOn) return "shared-guardian";
+	return null;
+}
+/**
+* Validate a target preset against the HOST PROCESS env (as opposed to
+* stack.env) it will be layered under. Compose gives process env precedence
+* over `--env-file`, so a leftover `OP_ASSISTANT_BIND_ADDRESS=0.0.0.0` in the
+* host process would silently defeat a preset's loopback pin even though the
+* resolver correctly writes the loopback row to stack.env.
+*
+* Presets that pin a bind to loopback must fail closed if the host env would
+* override it: `shared-guardian` pins the assistant (PR #564), and `this-pc`
+* pins BOTH the assistant and the guardian (PR #564 r3566887693 — otherwise a
+* leftover host-env bind exposes an unauthenticated OpenCode / guardian on the
+* LAN despite the operator's "This PC only" choice). The home presets
+* deliberately expose the assistant, so they have nothing to guard.
+*/
+function validateNetworkPresetEnv(preset, env) {
+	const label = NETWORK_PRESET_LABELS[preset];
+	const errors = [];
+	const rejectExposed = (key) => {
+		if (isExposed(env, key)) errors.push(`The "${preset}" (${label}) network access preset requires ${key} to stay loopback-only, but the current environment already exposes ${key}="${env[key]}". Unset it (or set it to 127.0.0.1) in the host process environment before switching to ${preset}.`);
+	};
+	if (preset === "this-pc") {
+		rejectExposed("OP_ASSISTANT_BIND_ADDRESS");
+		rejectExposed("OP_BIND_ADDRESS");
+	} else if (preset === "shared-guardian") rejectExposed("OP_ASSISTANT_BIND_ADDRESS");
+	return {
+		valid: errors.length === 0,
+		errors
+	};
+}
+/** The env var shown as the deliberate-exposure detail for each preset's line. */
+function presetExposureLine(preset) {
+	switch (preset) {
+		case "home-password": return `${NETWORK_PRESET_LABELS["home-password"]} is configured — the assistant is reachable from other devices on your network and requires the sign-in password you set (env: OP_ASSISTANT_BIND_ADDRESS).`;
+		case "home-open": return `${NETWORK_PRESET_LABELS["home-open"]} is configured — the assistant is reachable from any device on your network WITHOUT a password (env: OP_ASSISTANT_BIND_ADDRESS). Anyone on this network can use it.`;
+		case "shared-guardian": return `${NETWORK_PRESET_LABELS["shared-guardian"]} is configured — the guardian's protected front door is reachable from your network (env: OP_BIND_ADDRESS); the assistant itself stays private on this PC (loopback, 127.0.0.1).`;
+		case "this-pc": return "";
+	}
+}
+/** Force the managed keys back to their loopback default so collectBindAddressWarnings skips them. */
+function suppressManagedKeys(env) {
+	const copy = { ...env };
+	for (const key of MANAGED_BIND_KEYS) copy[key] = LOOPBACK_DEFAULT;
+	return copy;
+}
+/**
+* Compose the operator-facing exposure warning list for `env`. When `env`
+* exactly matches a preset row, the managed-var noise collapses into ONE
+* preset-framed line (informational — this exposure was deliberately
+* configured), plus per-var warnings for any non-loopback var OUTSIDE the
+* managed set (e.g. a hand-set `OP_CHAT_BIND_ADDRESS`) and the unchanged
+* `OP_ALLOW_REMOTE_SETUP` line. When nothing matches (drifted/custom env),
+* the full per-var list from `collectBindAddressWarnings` is returned
+* unchanged — unexplained exposure stays loud.
+*/
+function collectNetworkExposureWarnings(env) {
+	const preset = detectNetworkPreset(env);
+	const warnings = [];
+	if (preset && preset !== "this-pc") warnings.push(presetExposureLine(preset));
+	const effectiveEnv = preset ? suppressManagedKeys(env) : env;
+	warnings.push(...collectBindAddressWarnings(effectiveEnv));
+	return warnings;
+}
+
+export { BUILTIN_ADDON_IDS as B, GUARDIAN_INGRESS_ADDON_IDS as G, KNOWN_EMBEDDING_MODEL_DIMS as K, NETWORK_ACCESS_PRESETS as N, OLLAMA_DEFAULT_CHAT_MODEL as O, PORTAL_SECRET_ADDON_IDS as P, NETWORK_PRESET_LABELS as a, PROVIDER_DEFAULT_URLS as b, PROVIDER_KEY_MAP as c, addonProfileId as d, collectNetworkExposureWarnings as e, detectNetworkPreset as f, isNetworkAccessPreset as g, isRemoteSetupAllowed as h, isLoopback as i, lookupEmbeddingDims as l, resolveNetworkPreset as r, validateNetworkPresetEnv as v };
+//# sourceMappingURL=network-preset-CJ1RRnki.js.map

package/build/server/chunks/network-preset-CJ1RRnki.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-preset-CJ1RRnki.js","sources":["../../../.svelte-kit/adapter-node/chunks/addon-ids.js","../../../.svelte-kit/adapter-node/chunks/provider-constants.js","../../../.svelte-kit/adapter-node/chunks/network-preset.js"],"sourcesContent":["//#region ../lib/src/control-plane/addon-ids.ts\n/**\n* Canonical list of built-in addon IDs.\n*\n* Single source of truth — imported by both addons.ts and migrations.ts.\n* Update THIS file (and only this file) when adding or removing a built-in addon.\n*\n* Intentionally a pure-constants file with no imports so it can be safely\n* imported from anywhere without risk of circular dependencies.\n*/\nvar BUILTIN_ADDON_IDS = [\n\t\"api\",\n\t\"chat\",\n\t\"discord\",\n\t\"gateway\",\n\t\"ollama\",\n\t\"slack\",\n\t\"voice\"\n];\n/**\n* Addons whose ingress is served by the guardian container.\n*\n* Single source of truth for guardian deploy gating. Must mirror the Compose\n* profile gate on the guardian service in\n* `packages/skeleton/system/stack/portals.compose.yml`\n* (`profiles: [addon.chat, addon.api, addon.discord, addon.slack, addon.gateway]`):\n* enabling any of these requires the guardian, so the deploy set, the\n* expected-service seed, and the activation loop all deploy/health-wait on it.\n*\n* NOTE: broader than PORTAL_SECRET_ADDON_IDS — `gateway` uses the guardian but\n* has no portal secret of its own (see below). Keep the two lists distinct.\n*/\nvar GUARDIAN_INGRESS_ADDON_IDS = [\n\t\"api\",\n\t\"chat\",\n\t\"discord\",\n\t\"gateway\",\n\t\"slack\"\n];\n/**\n* First-party portals that own a dedicated `portal_<id>_secret`.\n*\n* Single source of truth for portal-secret provisioning (`ensurePortalSecret`).\n* Must mirror the `portal_*_secret` set the guardian mounts in\n* `portals.compose.yml` (chat, api, discord, slack). Excludes `gateway`, which\n* is guardian ingress but has no portal secret of its own.\n*/\nvar PORTAL_SECRET_ADDON_IDS = [\n\t\"api\",\n\t\"chat\",\n\t\"discord\",\n\t\"slack\"\n];\n//#endregion\nexport { GUARDIAN_INGRESS_ADDON_IDS as n, PORTAL_SECRET_ADDON_IDS as r, BUILTIN_ADDON_IDS as t };\n","//#region ../lib/src/provider-constants.ts\n/** Default base URLs per provider. */\nvar PROVIDER_DEFAULT_URLS = {\n\topenai: \"https://api.openai.com\",\n\tgroq: \"https://api.groq.com/openai\",\n\tmistral: \"https://api.mistral.ai\",\n\ttogether: \"https://api.together.xyz\",\n\tdeepseek: \"https://api.deepseek.com\",\n\txai: \"https://api.x.ai\",\n\tlmstudio: \"http://host.docker.internal:1234\",\n\tollama: \"http://host.docker.internal:11434\",\n\t\"model-runner\": \"http://model-runner.docker.internal/engines\",\n\tgoogle: \"https://generativelanguage.googleapis.com\",\n\thuggingface: \"https://router.huggingface.co/v1\"\n};\n/** Map provider name → env var for the API key. */\nvar PROVIDER_KEY_MAP = {\n\topenai: \"OPENAI_API_KEY\",\n\tgroq: \"GROQ_API_KEY\",\n\tmistral: \"MISTRAL_API_KEY\",\n\tgoogle: \"GOOGLE_API_KEY\",\n\tdeepseek: \"DEEPSEEK_API_KEY\",\n\ttogether: \"TOGETHER_API_KEY\",\n\txai: \"XAI_API_KEY\",\n\thuggingface: \"HF_TOKEN\"\n};\n/** Known embedding model dimensions. Keyed by `provider/model`. */\nvar EMBEDDING_DIMS = {\n\t\"openai/text-embedding-3-small\": 1536,\n\t\"openai/text-embedding-3-large\": 3072,\n\t\"openai/text-embedding-ada-002\": 1536,\n\t\"ollama/nomic-embed-text\": 768,\n\t\"ollama/mxbai-embed-large\": 1024,\n\t\"ollama/mxbai-embed-large-v1\": 1024,\n\t\"ollama/all-minilm\": 384,\n\t\"ollama/snowflake-arctic-embed\": 1024,\n\t\"model-runner/ai/mxbai-embed-large-v1\": 1024,\n\t\"mistral/mistral-embed\": 1024,\n\t\"google/text-embedding-004\": 768,\n\t\"huggingface/sentence-transformers/all-MiniLM-L6-v2\": 384,\n\t\"huggingface/intfloat/multilingual-e5-large\": 1024\n};\n/** Bare model-name lookup used by the browser wizard helpers. */\nvar KNOWN_EMBEDDING_MODEL_DIMS = Object.fromEntries(Object.entries(EMBEDDING_DIMS).map(([key, dims]) => [key.slice(key.indexOf(\"/\") + 1), dims]));\n/**\n* Look up embedding model dimensions. Tries the full key first, then strips\n* any trailing `:tag` from the model name (Ollama-style versions).\n* Returns 0 when no match is found.\n*/\nfunction lookupEmbeddingDims(provider, model) {\n\tif (!provider || !model) return 0;\n\tconst key = `${provider}/${model}`;\n\tif (EMBEDDING_DIMS[key]) return EMBEDDING_DIMS[key];\n\tconst colon = model.lastIndexOf(\":\");\n\tif (colon > 0) {\n\t\tconst bare = `${provider}/${model.slice(0, colon)}`;\n\t\tif (EMBEDDING_DIMS[bare]) return EMBEDDING_DIMS[bare];\n\t}\n\treturn 0;\n}\nvar OLLAMA_DEFAULT_CHAT_MODEL = {\n\tchat: \"llama3.2:latest\",\n\tembedding: \"nomic-embed-text\"\n}.chat;\nfunction addonProfileId(addon, variant) {\n\treturn `addon.${addon}.${variant}`;\n}\n//#endregion\nexport { addonProfileId as a, PROVIDER_KEY_MAP as i, OLLAMA_DEFAULT_CHAT_MODEL as n, lookupEmbeddingDims as o, PROVIDER_DEFAULT_URLS as r, KNOWN_EMBEDDING_MODEL_DIMS as t };\n","import { n as GUARDIAN_INGRESS_ADDON_IDS } from \"./addon-ids.js\";\n//#region ../lib/src/control-plane/bind-warning.ts\n/**\n* Startup warning for non-loopback bind addresses.\n*\n* When OP_BIND_ADDRESS is set to a non-loopback value (anything other than\n* 127.0.0.1, localhost, or ::1), services are exposed on the host network\n* interface. This helper produces a structured list of warning lines that\n* callers should log at WARN level so operators are aware.\n*\n* Per-service overrides (e.g. OP_CHAT_BIND_ADDRESS, OP_VOICE_BIND_ADDRESS)\n* are also checked and reported individually.\n*/\n/**\n* True when OP_ENABLED_ADDONS names at least one guardian-ingress addon — i.e.\n* a guardian proxy is actually deployed in front of the exposed services.\n* Parses the comma-separated OP_ENABLED_ADDONS directly (no dependency on\n* addons.ts, to keep this module import-light and cycle-free).\n*/\nfunction hasGuardianIngress(env) {\n\treturn (env.OP_ENABLED_ADDONS ?? \"\").split(\",\").map((s) => s.trim()).filter(Boolean).some((a) => GUARDIAN_INGRESS_ADDON_IDS.includes(a));\n}\n/** Known per-service bind address env var names (mirrors compose files). */\nvar PER_SERVICE_BIND_VARS = [\n\t\"OP_ASSISTANT_BIND_ADDRESS\",\n\t\"OP_CLIENT_BIND_ADDRESS\",\n\t\"OP_CHAT_BIND_ADDRESS\",\n\t\"OP_API_BIND_ADDRESS\",\n\t\"OP_VOICE_BIND_ADDRESS\"\n];\n/**\n* #563 D9 — per-var warnings lead with WHAT is exposed and which network\n* access preset (packages/lib/src/control-plane/network-preset.ts)\n* deliberately configures that exposure, so operators reading the log can\n* tell \"I did this on purpose\" from \"something hand-edited this\". Only\n* `OP_ASSISTANT_BIND_ADDRESS` (the Home network presets) and\n* `OP_BIND_ADDRESS` (the Shared network preset) are ever set by a preset;\n* the other per-service vars (client/chat/api/voice) are never preset-managed\n* so they keep generic wording naming no preset.\n*/\nvar PRESET_FRAMING = {\n\tOP_BIND_ADDRESS: \"Shared network, guardian protected\",\n\tOP_ASSISTANT_BIND_ADDRESS: \"Home network\"\n};\n/** Exported for reuse by mdns-responder.ts's bind-gating logic (#488). */\nfunction isLoopback(value) {\n\tconst v = value.trim();\n\treturn v === \"127.0.0.1\" || v === \"localhost\" || v === \"::1\";\n}\n/**\n* Opt-in: allow the web UI (including the first-run setup wizard) to be reached\n* from a remote machine. When set, the UI server binds all interfaces and the\n* Host/Origin allowlist + the setup-localhost-only gate are relaxed.\n*\n* This deliberately reopens the owner-race the setup gate normally prevents, so\n* it is OFF by default and must be explicitly enabled by the operator. Reach the\n* UI over an SSH tunnel or a reverse proxy instead when you can.\n*/\nfunction isRemoteSetupAllowed(env = process.env) {\n\tconst v = env.OP_ALLOW_REMOTE_SETUP?.trim().toLowerCase();\n\treturn v === \"1\" || v === \"true\" || v === \"yes\";\n}\n/**\n* Inspect `env` for non-loopback bind address settings and return one warning\n* line per problematic variable.  Returns an empty array when everything is\n* loopback (or unset, since the compose default is 127.0.0.1).\n*\n* @param env - The environment to inspect; typically `process.env`.\n*/\nfunction collectBindAddressWarnings(env) {\n\tconst warnings = [];\n\tconst globalBind = env.OP_BIND_ADDRESS;\n\tif (globalBind && !isLoopback(globalBind)) warnings.push(hasGuardianIngress(env) ? `${PRESET_FRAMING.OP_BIND_ADDRESS} exposure — OP_BIND_ADDRESS is set to \"${globalBind}\", exposing services on the host network interface, not just loopback. Ensure a firewall is in place if this host is reachable from untrusted networks.` : `Unprotected LAN exposure — OP_BIND_ADDRESS is set to \"${globalBind}\" but no guardian-ingress addon is enabled, so services are exposed directly on the host network interface with no guardian proxy in front. Enable a guardian-ingress addon (chat/api/gateway/discord/slack) or keep this loopback-only.`);\n\tfor (const key of PER_SERVICE_BIND_VARS) {\n\t\tconst val = env[key];\n\t\tif (val && !isLoopback(val)) {\n\t\t\tconst framing = PRESET_FRAMING[key];\n\t\t\twarnings.push(framing ? `${framing} exposure — ${key} is set to \"${val}\", exposing this service on the host network interface.` : `${key} is set to \"${val}\" — this service will be exposed on the host network interface.`);\n\t\t}\n\t}\n\tif (isRemoteSetupAllowed(env)) warnings.push(\"OP_ALLOW_REMOTE_SETUP is enabled — the web UI is reachable from remote machines and the setup wizard is no longer restricted to the host. Only use this on a trusted network behind a firewall.\");\n\treturn warnings;\n}\n//#endregion\n//#region ../lib/src/control-plane/network-preset.ts\n/**\n* Network access preset resolver (#563).\n*\n* A single \"network access\" choice bundles bind-address exposure, OpenCode\n* Basic auth, and mDNS advertisement intent into one operator-facing decision\n* instead of four independently-tunable env vars. This module is the ONLY\n* place that knows the preset → env-var mapping; the wizard, the CLI headless\n* spec path, and the admin \"detect current preset\" surface all resolve\n* through it so they can never drift from each other.\n*\n* Browser-safe: this module imports ONLY `isLoopback`, `collectBindAddressWarnings`,\n* and `isRemoteSetupAllowed` from `./bind-warning.js` — no `node:*` imports and\n* never `./mdns-responder.js` (which pulls in `node:dgram`). The wizard\n* (packages/ui, a browser bundle) imports this module directly via the\n* `@openpalm/lib/control-plane/network-preset.js` subpath, precedent:\n* `provider-constants.ts`.\n*\n* D1 (mDNS mechanism): per-preset mDNS is delivered entirely by the #488 host\n* mDNS responder (`mdns-responder.ts`), which gates advertisement on exactly\n* the bind vars this resolver writes (`OP_ASSISTANT_BIND_ADDRESS` for the\n* assistant name, `OP_BIND_ADDRESS` for the guardian name). This resolver only\n* exposes `assistantMdns`/`guardianMdns` INTENT flags mirroring those gates —\n* it never touches mDNS config directly. `network-preset.test.ts` T7 pins the\n* two together so they can never silently diverge.\n*\n* D4 (managed key matrix): every preset writes ALL of `OP_BIND_ADDRESS`,\n* `OP_ASSISTANT_BIND_ADDRESS`, `OP_CLIENT_BIND_ADDRESS`, `OP_VOICE_BIND_ADDRESS`,\n* and `OPENCODE_AUTH` explicitly (loopback rather than \"leave unset\"), so\n* switching between presets always converges regardless of prior state.\n* `OP_CHAT_BIND_ADDRESS` / `OP_API_BIND_ADDRESS` are deliberately NOT managed —\n* those are listeners inside the guardian container, fail-closed\n* API-key-authenticated, so they are left to ride the `OP_BIND_ADDRESS`\n* cascade (guardian-protected exposure is the intended behavior under\n* shared-guardian). `GUARDIAN_DIRECT_INGRESS` is never touched by any preset —\n* presets configure exposure, not ingress enablement.\n*/\nvar NETWORK_ACCESS_PRESETS = [\n\t\"this-pc\",\n\t\"home-password\",\n\t\"home-open\",\n\t\"shared-guardian\"\n];\n/** Single source of copy for the wizard, the admin tab, and warning text. */\nvar NETWORK_PRESET_LABELS = {\n\t\"this-pc\": \"This PC only\",\n\t\"home-password\": \"Home network, with password\",\n\t\"home-open\": \"Home network, open access\",\n\t\"shared-guardian\": \"Shared network, guardian protected\"\n};\nfunction isNetworkAccessPreset(value) {\n\treturn typeof value === \"string\" && NETWORK_ACCESS_PRESETS.includes(value);\n}\nvar LOOPBACK_DEFAULT = \"127.0.0.1\";\nvar LAN_VALUE = \"0.0.0.0\";\n/** Managed bind-address env keys every preset writes explicitly. */\nvar MANAGED_BIND_KEYS = [\n\t\"OP_BIND_ADDRESS\",\n\t\"OP_ASSISTANT_BIND_ADDRESS\",\n\t\"OP_CLIENT_BIND_ADDRESS\",\n\t\"OP_VOICE_BIND_ADDRESS\"\n];\nvar ALL_LOOPBACK = {\n\tOP_BIND_ADDRESS: LOOPBACK_DEFAULT,\n\tOP_ASSISTANT_BIND_ADDRESS: LOOPBACK_DEFAULT,\n\tOP_CLIENT_BIND_ADDRESS: LOOPBACK_DEFAULT,\n\tOP_VOICE_BIND_ADDRESS: LOOPBACK_DEFAULT,\n\tOPENCODE_AUTH: \"false\"\n};\n/**\n* Resolve one of the four network access presets into its complete managed\n* env row + mDNS intent flags. Throws on a password-contract violation\n* (missing/empty password for `home-password`, or a password supplied for any\n* other preset) — these are operator errors, not silent drops.\n*/\nfunction resolveNetworkPreset(preset, opts) {\n\tconst password = opts?.opencodePassword;\n\tif (preset === \"home-password\") {\n\t\tif (!password) throw new Error(\"network.opencodePassword is required for the \\\"home-password\\\" network access preset.\");\n\t} else if (password) throw new Error(`network.opencodePassword must not be supplied for the \"${preset}\" network access preset.`);\n\tswitch (preset) {\n\t\tcase \"this-pc\": return {\n\t\t\tpreset,\n\t\t\tenv: { ...ALL_LOOPBACK },\n\t\t\tassistantMdns: false,\n\t\t\tguardianMdns: false\n\t\t};\n\t\tcase \"home-password\": return {\n\t\t\tpreset,\n\t\t\tenv: {\n\t\t\t\t...ALL_LOOPBACK,\n\t\t\t\tOP_ASSISTANT_BIND_ADDRESS: LAN_VALUE,\n\t\t\t\tOPENCODE_AUTH: \"true\"\n\t\t\t},\n\t\t\topencodePassword: password,\n\t\t\tassistantMdns: true,\n\t\t\tguardianMdns: false\n\t\t};\n\t\tcase \"home-open\": return {\n\t\t\tpreset,\n\t\t\tenv: {\n\t\t\t\t...ALL_LOOPBACK,\n\t\t\t\tOP_ASSISTANT_BIND_ADDRESS: LAN_VALUE\n\t\t\t},\n\t\t\tassistantMdns: true,\n\t\t\tguardianMdns: false\n\t\t};\n\t\tcase \"shared-guardian\": return {\n\t\t\tpreset,\n\t\t\tenv: {\n\t\t\t\t...ALL_LOOPBACK,\n\t\t\t\tOP_BIND_ADDRESS: LAN_VALUE\n\t\t\t},\n\t\t\tassistantMdns: false,\n\t\t\tguardianMdns: true\n\t\t};\n\t\tdefault: throw new Error(`Unknown network access preset: ${String(preset)}`);\n\t}\n}\n/**\n* Per-service binds whose compose host-port default NESTS `${OP_BIND_ADDRESS}`\n* (core.compose.yml OP_CLIENT / services.compose.yml OP_VOICE:\n* `${OP_X_BIND_ADDRESS:-${OP_BIND_ADDRESS:-127.0.0.1}}`). An unset value\n* therefore inherits the GLOBAL bind, not loopback. `OP_ASSISTANT_BIND_ADDRESS`\n* is deliberately absent — its host-port line defaults straight to 127.0.0.1\n* with no OP_BIND_ADDRESS fallback.\n*/\nvar OP_BIND_CASCADING_KEYS = new Set([\"OP_CLIENT_BIND_ADDRESS\", \"OP_VOICE_BIND_ADDRESS\"]);\nfunction boundValue(env, key) {\n\tconst raw = env[key]?.trim();\n\tif (raw) return raw;\n\tif (OP_BIND_CASCADING_KEYS.has(key)) {\n\t\tconst globalBind = env.OP_BIND_ADDRESS?.trim();\n\t\tif (globalBind) return globalBind;\n\t}\n\treturn LOOPBACK_DEFAULT;\n}\nfunction isExposed(env, key) {\n\treturn !isLoopback(boundValue(env, key));\n}\nfunction isAuthOn(env) {\n\tconst v = (env.OPENCODE_AUTH ?? \"\").trim().toLowerCase();\n\treturn v === \"true\" || v === \"1\" || v === \"yes\";\n}\n/**\n* Reverse the resolver: given a (possibly hand-edited) env record, identify\n* which preset it matches, if any. Unset managed keys are treated as the\n* compose loopback default. Unmanaged keys (e.g. `OP_CHAT_BIND_ADDRESS`) are\n* ignored entirely — they are reported by `collectNetworkExposureWarnings`\n* instead, never by detection. Returns `null` on drift (a combination no\n* preset produces), which the caller reports as \"custom\".\n*/\nfunction detectNetworkPreset(env) {\n\tconst globalExposed = isExposed(env, \"OP_BIND_ADDRESS\");\n\tconst assistantExposed = isExposed(env, \"OP_ASSISTANT_BIND_ADDRESS\");\n\tconst clientExposed = isExposed(env, \"OP_CLIENT_BIND_ADDRESS\");\n\tconst voiceExposed = isExposed(env, \"OP_VOICE_BIND_ADDRESS\");\n\tconst authOn = isAuthOn(env);\n\tif (!globalExposed && !assistantExposed && !clientExposed && !voiceExposed && !authOn) return \"this-pc\";\n\tif (!globalExposed && assistantExposed && !clientExposed && !voiceExposed) return authOn ? \"home-password\" : \"home-open\";\n\tif (globalExposed && !assistantExposed && !clientExposed && !voiceExposed && !authOn) return \"shared-guardian\";\n\treturn null;\n}\n/**\n* Validate a target preset against the HOST PROCESS env (as opposed to\n* stack.env) it will be layered under. Compose gives process env precedence\n* over `--env-file`, so a leftover `OP_ASSISTANT_BIND_ADDRESS=0.0.0.0` in the\n* host process would silently defeat a preset's loopback pin even though the\n* resolver correctly writes the loopback row to stack.env.\n*\n* Presets that pin a bind to loopback must fail closed if the host env would\n* override it: `shared-guardian` pins the assistant (PR #564), and `this-pc`\n* pins BOTH the assistant and the guardian (PR #564 r3566887693 — otherwise a\n* leftover host-env bind exposes an unauthenticated OpenCode / guardian on the\n* LAN despite the operator's \"This PC only\" choice). The home presets\n* deliberately expose the assistant, so they have nothing to guard.\n*/\nfunction validateNetworkPresetEnv(preset, env) {\n\tconst label = NETWORK_PRESET_LABELS[preset];\n\tconst errors = [];\n\tconst rejectExposed = (key) => {\n\t\tif (isExposed(env, key)) errors.push(`The \"${preset}\" (${label}) network access preset requires ${key} to stay loopback-only, but the current environment already exposes ${key}=\"${env[key]}\". Unset it (or set it to 127.0.0.1) in the host process environment before switching to ${preset}.`);\n\t};\n\tif (preset === \"this-pc\") {\n\t\trejectExposed(\"OP_ASSISTANT_BIND_ADDRESS\");\n\t\trejectExposed(\"OP_BIND_ADDRESS\");\n\t} else if (preset === \"shared-guardian\") rejectExposed(\"OP_ASSISTANT_BIND_ADDRESS\");\n\treturn {\n\t\tvalid: errors.length === 0,\n\t\terrors\n\t};\n}\n/** The env var shown as the deliberate-exposure detail for each preset's line. */\nfunction presetExposureLine(preset) {\n\tswitch (preset) {\n\t\tcase \"home-password\": return `${NETWORK_PRESET_LABELS[\"home-password\"]} is configured — the assistant is reachable from other devices on your network and requires the sign-in password you set (env: OP_ASSISTANT_BIND_ADDRESS).`;\n\t\tcase \"home-open\": return `${NETWORK_PRESET_LABELS[\"home-open\"]} is configured — the assistant is reachable from any device on your network WITHOUT a password (env: OP_ASSISTANT_BIND_ADDRESS). Anyone on this network can use it.`;\n\t\tcase \"shared-guardian\": return `${NETWORK_PRESET_LABELS[\"shared-guardian\"]} is configured — the guardian's protected front door is reachable from your network (env: OP_BIND_ADDRESS); the assistant itself stays private on this PC (loopback, 127.0.0.1).`;\n\t\tcase \"this-pc\": return \"\";\n\t}\n}\n/** Force the managed keys back to their loopback default so collectBindAddressWarnings skips them. */\nfunction suppressManagedKeys(env) {\n\tconst copy = { ...env };\n\tfor (const key of MANAGED_BIND_KEYS) copy[key] = LOOPBACK_DEFAULT;\n\treturn copy;\n}\n/**\n* Compose the operator-facing exposure warning list for `env`. When `env`\n* exactly matches a preset row, the managed-var noise collapses into ONE\n* preset-framed line (informational — this exposure was deliberately\n* configured), plus per-var warnings for any non-loopback var OUTSIDE the\n* managed set (e.g. a hand-set `OP_CHAT_BIND_ADDRESS`) and the unchanged\n* `OP_ALLOW_REMOTE_SETUP` line. When nothing matches (drifted/custom env),\n* the full per-var list from `collectBindAddressWarnings` is returned\n* unchanged — unexplained exposure stays loud.\n*/\nfunction collectNetworkExposureWarnings(env) {\n\tconst preset = detectNetworkPreset(env);\n\tconst warnings = [];\n\tif (preset && preset !== \"this-pc\") warnings.push(presetExposureLine(preset));\n\tconst effectiveEnv = preset ? suppressManagedKeys(env) : env;\n\twarnings.push(...collectBindAddressWarnings(effectiveEnv));\n\treturn warnings;\n}\n//#endregion\nexport { isNetworkAccessPreset as a, isLoopback as c, detectNetworkPreset as i, isRemoteSetupAllowed as l, NETWORK_PRESET_LABELS as n, resolveNetworkPreset as o, collectNetworkExposureWarnings as r, validateNetworkPresetEnv as s, NETWORK_ACCESS_PRESETS as t };\n"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,iBAAiB,GAAG;AACxB,CAAC,KAAK;AACN,CAAC,MAAM;AACP,CAAC,SAAS;AACV,CAAC,SAAS;AACV,CAAC,QAAQ;AACT,CAAC,OAAO;AACR,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,0BAA0B,GAAG;AACjC,CAAC,KAAK;AACN,CAAC,MAAM;AACP,CAAC,SAAS;AACV,CAAC,SAAS;AACV,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,uBAAuB,GAAG;AAC9B,CAAC,KAAK;AACN,CAAC,MAAM;AACP,CAAC,SAAS;AACV,CAAC;AACD;;ACpDA;AACA;AACG,IAAC,qBAAqB,GAAG;AAC5B,CAAC,MAAM,EAAE,wBAAwB;AACjC,CAAC,IAAI,EAAE,6BAA6B;AACpC,CAAC,OAAO,EAAE,wBAAwB;AAClC,CAAC,QAAQ,EAAE,0BAA0B;AACrC,CAAC,QAAQ,EAAE,0BAA0B;AACrC,CAAC,GAAG,EAAE,kBAAkB;AACxB,CAAC,QAAQ,EAAE,kCAAkC;AAC7C,CAAC,MAAM,EAAE,mCAAmC;AAC5C,CAAC,cAAc,EAAE,6CAA6C;AAC9D,CAAC,MAAM,EAAE,2CAA2C;AACpD,CAAC,WAAW,EAAE;AACd;AACA;AACG,IAAC,gBAAgB,GAAG;AACvB,CAAC,MAAM,EAAE,gBAAgB;AACzB,CAAC,IAAI,EAAE,cAAc;AACrB,CAAC,OAAO,EAAE,iBAAiB;AAC3B,CAAC,MAAM,EAAE,gBAAgB;AACzB,CAAC,QAAQ,EAAE,kBAAkB;AAC7B,CAAC,QAAQ,EAAE,kBAAkB;AAC7B,CAAC,GAAG,EAAE,aAAa;AACnB,CAAC,WAAW,EAAE;AACd;AACA;AACA,IAAI,cAAc,GAAG;AACrB,CAAC,+BAA+B,EAAE,IAAI;AACtC,CAAC,+BAA+B,EAAE,IAAI;AACtC,CAAC,+BAA+B,EAAE,IAAI;AACtC,CAAC,yBAAyB,EAAE,GAAG;AAC/B,CAAC,0BAA0B,EAAE,IAAI;AACjC,CAAC,6BAA6B,EAAE,IAAI;AACpC,CAAC,mBAAmB,EAAE,GAAG;AACzB,CAAC,+BAA+B,EAAE,IAAI;AACtC,CAAC,sCAAsC,EAAE,IAAI;AAC7C,CAAC,uBAAuB,EAAE,IAAI;AAC9B,CAAC,2BAA2B,EAAE,GAAG;AACjC,CAAC,oDAAoD,EAAE,GAAG;AAC1D,CAAC,4CAA4C,EAAE;AAC/C,CAAC;AACD;AACG,IAAC,0BAA0B,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAChJ;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,QAAQ,EAAE,KAAK,EAAE;AAC9C,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC;AAClC,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,OAAO,cAAc,CAAC,GAAG,CAAC;AACpD,CAAC,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC;AACrC,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE;AAChB,EAAE,MAAM,IAAI,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AACrD,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,OAAO,cAAc,CAAC,IAAI,CAAC;AACvD,CAAC;AACD,CAAC,OAAO,CAAC;AACT;AACG,IAAC,yBAAyB,GAAG;AAChC,CAAC,IAAI,EAAE,iBAEP,CAAC,CAAC;AACF,SAAS,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE;AACxC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AACnC;;ACjEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,GAAG,EAAE;AACjC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,0BAA0B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACzI;AACA;AACA,IAAI,qBAAqB,GAAG;AAC5B,CAAC,2BAA2B;AAC5B,CAAC,wBAAwB;AACzB,CAAC,sBAAsB;AACvB,CAAC,qBAAqB;AACtB,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,cAAc,GAAG;AACrB,CAAC,eAAe,EAAE,oCAAoC;AACtD,CAAC,yBAAyB,EAAE;AAC5B,CAAC;AACD;AACA,SAAS,UAAU,CAAC,KAAK,EAAE;AAC3B,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE;AACvB,CAAC,OAAO,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,KAAK;AAC7D;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;AACjD,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AAC1D,CAAC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK;AAChD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,0BAA0B,CAAC,GAAG,EAAE;AACzC,CAAC,MAAM,QAAQ,GAAG,EAAE;AACpB,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC,eAAe;AACvC,CAAC,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,eAAe,CAAC,uCAAuC,EAAE,UAAU,CAAC,uJAAuJ,CAAC,GAAG,CAAC,sDAAsD,EAAE,UAAU,CAAC,wOAAwO,CAAC,CAAC;AACnnB,CAAC,KAAK,MAAM,GAAG,IAAI,qBAAqB,EAAE;AAC1C,EAAE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;AACtB,EAAE,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;AAC/B,GAAG,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC;AACtC,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,EAAE,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,uDAAuD,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,+DAA+D,CAAC,CAAC;AAC/N,EAAE;AACF,CAAC;AACD,CAAC,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,iMAAiM,CAAC;AAChP,CAAC,OAAO,QAAQ;AAChB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,sBAAsB,GAAG;AAC7B,CAAC,SAAS;AACV,CAAC,eAAe;AAChB,CAAC,WAAW;AACZ,CAAC;AACD;AACA;AACG,IAAC,qBAAqB,GAAG;AAC5B,CAAC,SAAS,EAAE,cAAc;AAC1B,CAAC,eAAe,EAAE,6BAA6B;AAC/C,CAAC,WAAW,EAAE,2BAA2B;AACzC,CAAC,iBAAiB,EAAE;AACpB;AACA,SAAS,qBAAqB,CAAC,KAAK,EAAE;AACtC,CAAC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC;AAC3E;AACA,IAAI,gBAAgB,GAAG,WAAW;AAClC,IAAI,SAAS,GAAG,SAAS;AACzB;AACA,IAAI,iBAAiB,GAAG;AACxB,CAAC,iBAAiB;AAClB,CAAC,2BAA2B;AAC5B,CAAC,wBAAwB;AACzB,CAAC;AACD,CAAC;AACD,IAAI,YAAY,GAAG;AACnB,CAAC,eAAe,EAAE,gBAAgB;AAClC,CAAC,yBAAyB,EAAE,gBAAgB;AAC5C,CAAC,sBAAsB,EAAE,gBAAgB;AACzC,CAAC,qBAAqB,EAAE,gBAAgB;AACxC,CAAC,aAAa,EAAE;AAChB,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,MAAM,EAAE,IAAI,EAAE;AAC5C,CAAC,MAAM,QAAQ,GAAG,IAAI,EAAE,gBAAgB;AACxC,CAAC,IAAI,MAAM,KAAK,eAAe,EAAE;AACjC,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC;AACzH,CAAC,CAAC,MAAM,IAAI,QAAQ,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,uDAAuD,EAAE,MAAM,CAAC,wBAAwB,CAAC,CAAC;AACjI,CAAC,QAAQ,MAAM;AACf,EAAE,KAAK,SAAS,EAAE,OAAO;AACzB,GAAG,MAAM;AACT,GAAG,GAAG,EAAE,EAAE,GAAG,YAAY,EAAE;AAC3B,GAAG,aAAa,EAAE,KAAK;AACvB,GAAG,YAAY,EAAE;AACjB,GAAG;AACH,EAAE,KAAK,eAAe,EAAE,OAAO;AAC/B,GAAG,MAAM;AACT,GAAG,GAAG,EAAE;AACR,IAAI,GAAG,YAAY;AACnB,IAAI,yBAAyB,EAAE,SAAS;AACxC,IAAI,aAAa,EAAE;AACnB,IAAI;AACJ,GAAG,gBAAgB,EAAE,QAAQ;AAC7B,GAAG,aAAa,EAAE,IAAI;AACtB,GAAG,YAAY,EAAE;AACjB,GAAG;AACH,EAAE,KAAK,WAAW,EAAE,OAAO;AAC3B,GAAG,MAAM;AACT,GAAG,GAAG,EAAE;AACR,IAAI,GAAG,YAAY;AACnB,IAAI,yBAAyB,EAAE;AAC/B,IAAI;AACJ,GAAG,aAAa,EAAE,IAAI;AACtB,GAAG,YAAY,EAAE;AACjB,GAAG;AACH,EAAE,KAAK,iBAAiB,EAAE,OAAO;AACjC,GAAG,MAAM;AACT,GAAG,GAAG,EAAE;AACR,IAAI,GAAG,YAAY;AACnB,IAAI,eAAe,EAAE;AACrB,IAAI;AACJ,GAAG,aAAa,EAAE,KAAK;AACvB,GAAG,YAAY,EAAE;AACjB,GAAG;AACH,EAAE,SAAS,MAAM,IAAI,KAAK,CAAC,CAAC,+BAA+B,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC9E;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,wBAAwB,EAAE,uBAAuB,CAAC,CAAC;AACzF,SAAS,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE;AAC9B,CAAC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;AAC7B,CAAC,IAAI,GAAG,EAAE,OAAO,GAAG;AACpB,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;AACtC,EAAE,MAAM,UAAU,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE;AAChD,EAAE,IAAI,UAAU,EAAE,OAAO,UAAU;AACnC,CAAC;AACD,CAAC,OAAO,gBAAgB;AACxB;AACA,SAAS,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE;AAC7B,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AACzC;AACA,SAAS,QAAQ,CAAC,GAAG,EAAE;AACvB,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACzD,CAAC,OAAO,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK;AAChD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,GAAG,EAAE;AAClC,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,EAAE,iBAAiB,CAAC;AACxD,CAAC,MAAM,gBAAgB,GAAG,SAAS,CAAC,GAAG,EAAE,2BAA2B,CAAC;AACrE,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,EAAE,wBAAwB,CAAC;AAC/D,CAAC,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,EAAE,uBAAuB,CAAC;AAC7D,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC;AAC7B,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,gBAAgB,IAAI,CAAC,aAAa,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,OAAO,SAAS;AACxG,CAAC,IAAI,CAAC,aAAa,IAAI,gBAAgB,IAAI,CAAC,aAAa,IAAI,CAAC,YAAY,EAAE,OAAO,MAAM,GAAG,eAAe,GAAG,WAAW;AACzH,CAAC,IAAI,aAAa,IAAI,CAAC,gBAAgB,IAAI,CAAC,aAAa,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,OAAO,iBAAiB;AAC/G,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,MAAM,EAAE,GAAG,EAAE;AAC/C,CAAC,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,CAAC;AAC5C,CAAC,MAAM,MAAM,GAAG,EAAE;AAClB,CAAC,MAAM,aAAa,GAAG,CAAC,GAAG,KAAK;AAChC,EAAE,IAAI,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,iCAAiC,EAAE,GAAG,CAAC,oEAAoE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,yFAAyF,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACpS,CAAC,CAAC;AACF,CAAC,IAAI,MAAM,KAAK,SAAS,EAAE;AAC3B,EAAE,aAAa,CAAC,2BAA2B,CAAC;AAC5C,EAAE,aAAa,CAAC,iBAAiB,CAAC;AAClC,CAAC,CAAC,MAAM,IAAI,MAAM,KAAK,iBAAiB,EAAE,aAAa,CAAC,2BAA2B,CAAC;AACpF,CAAC,OAAO;AACR,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;AAC5B,EAAE;AACF,EAAE;AACF;AACA;AACA,SAAS,kBAAkB,CAAC,MAAM,EAAE;AACpC,CAAC,QAAQ,MAAM;AACf,EAAE,KAAK,eAAe,EAAE,OAAO,CAAC,EAAE,qBAAqB,CAAC,eAAe,CAAC,CAAC,0JAA0J,CAAC;AACpO,EAAE,KAAK,WAAW,EAAE,OAAO,CAAC,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC,mKAAmK,CAAC;AACrO,EAAE,KAAK,iBAAiB,EAAE,OAAO,CAAC,EAAE,qBAAqB,CAAC,iBAAiB,CAAC,CAAC,gLAAgL,CAAC;AAC9P,EAAE,KAAK,SAAS,EAAE,OAAO,EAAE;AAC3B;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,GAAG,EAAE;AAClC,CAAC,MAAM,IAAI,GAAG,EAAE,GAAG,GAAG,EAAE;AACxB,CAAC,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,gBAAgB;AAClE,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,8BAA8B,CAAC,GAAG,EAAE;AAC7C,CAAC,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC;AACxC,CAAC,MAAM,QAAQ,GAAG,EAAE;AACpB,CAAC,IAAI,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAC9E,CAAC,MAAM,YAAY,GAAG,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,GAAG;AAC7D,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;AAC3D,CAAC,OAAO,QAAQ;AAChB;;;;"}

package/build/server/chunks/{paths-BpdOajoE.js → paths-DRVrMQrI.js}

@@ -1,4 +1,4 @@
-import { e as resolve_route, t as try_get_request_store } from './internal-D66tKQSe.js';
+import { e as resolve_route, t as try_get_request_store } from './internal-D9Kp0SbJ.js';
 import { i as initial_base, c as base } from './environment-BYp8JQYM.js';
 
 //#region ../../node_modules/.bun/@sveltejs+kit@2.61.0+a890f0b024b6eaa9/node_modules/@sveltejs/kit/src/runtime/app/paths/server.js
@@ -14,4 +14,4 @@ function resolve(id, params) {
 }
 
 export { resolve as r };
-//# sourceMappingURL=paths-BpdOajoE.js.map
+//# sourceMappingURL=paths-DRVrMQrI.js.map

package/build/server/chunks/{paths-BpdOajoE.js.map → paths-DRVrMQrI.js.map}

@@ -1 +1 @@
-{"version":3,"file":"paths-BpdOajoE.js","sources":["../../../.svelte-kit/adapter-node/chunks/paths.js"],"sourcesContent":["import { r as try_get_request_store } from \"./server.js\";\nimport { d as initial_base, u as base } from \"./environment.js\";\nimport { n as resolve_route } from \"./routing.js\";\nimport \"./internal.js\";\n//#region ../../node_modules/.bun/@sveltejs+kit@2.61.0+a890f0b024b6eaa9/node_modules/@sveltejs/kit/src/runtime/app/paths/server.js\n/** @type {import('./client.js').resolve} */\nfunction resolve(id, params) {\n\tif (!id.startsWith(\"/\")) throw new Error(`Cannot use \\`resolve(...)\\` with a non-absolute pathname or route ID (got \"${id}\"). \\`resolve\\` is only for internal pathnames and route IDs; external URLs should be used directly.`);\n\tconst resolved = resolve_route(id, params);\n\t{\n\t\tconst store = try_get_request_store();\n\t\tif (store && !store.state.prerendering?.fallback) return (store.event.url.pathname.slice(initial_base.length).split(\"/\").slice(2).map(() => \"..\").join(\"/\") || \".\") + resolved;\n\t}\n\treturn base + resolved;\n}\n//#endregion\nexport { resolve as t };\n"],"names":[],"mappings":";;;AAIA;AACA;AACA,SAAS,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE;AAC7B,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,2EAA2E,EAAE,EAAE,CAAC,oGAAoG,CAAC,CAAC;AACjO,CAAC,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC;AAC3C,CAAC;AACD,EAAE,MAAM,KAAK,GAAG,qBAAqB,EAAE;AACvC,EAAE,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,QAAQ;AAChL,CAAC;AACD,CAAC,OAAO,IAAI,GAAG,QAAQ;AACvB;;;;"}
+{"version":3,"file":"paths-DRVrMQrI.js","sources":["../../../.svelte-kit/adapter-node/chunks/paths.js"],"sourcesContent":["import { r as try_get_request_store } from \"./server.js\";\nimport { d as initial_base, u as base } from \"./environment.js\";\nimport { n as resolve_route } from \"./routing.js\";\nimport \"./internal.js\";\n//#region ../../node_modules/.bun/@sveltejs+kit@2.61.0+a890f0b024b6eaa9/node_modules/@sveltejs/kit/src/runtime/app/paths/server.js\n/** @type {import('./client.js').resolve} */\nfunction resolve(id, params) {\n\tif (!id.startsWith(\"/\")) throw new Error(`Cannot use \\`resolve(...)\\` with a non-absolute pathname or route ID (got \"${id}\"). \\`resolve\\` is only for internal pathnames and route IDs; external URLs should be used directly.`);\n\tconst resolved = resolve_route(id, params);\n\t{\n\t\tconst store = try_get_request_store();\n\t\tif (store && !store.state.prerendering?.fallback) return (store.event.url.pathname.slice(initial_base.length).split(\"/\").slice(2).map(() => \"..\").join(\"/\") || \".\") + resolved;\n\t}\n\treturn base + resolved;\n}\n//#endregion\nexport { resolve as t };\n"],"names":[],"mappings":";;;AAIA;AACA;AACA,SAAS,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE;AAC7B,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,2EAA2E,EAAE,EAAE,CAAC,oGAAoG,CAAC,CAAC;AACjO,CAAC,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC;AAC3C,CAAC;AACD,EAAE,MAAM,KAAK,GAAG,qBAAqB,EAAE;AACvC,EAAE,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,QAAQ;AAChL,CAAC;AACD,CAAC,OAAO,IAAI,GAAG,QAAQ;AACvB;;;;"}

package/build/server/chunks/{session-cookie-B0Fc-L8S.js → session-cookie-CDynAOx3.js}

@@ -1,4 +1,4 @@
-import { S as SESSION_TTL_SECONDS } from './helpers-XmKveZFr.js';
+import { S as SESSION_TTL_SECONDS } from './helpers-CfpNg3il.js';
 
 //#region src/lib/server/session-cookie.ts
 /**
@@ -71,4 +71,4 @@ function clearSessionCookieHeader(request) {
 }
 
 export { SESSION_COOKIE_NAME as S, clearSessionCookieHeader as c, sessionCookieHeader as s };
-//# sourceMappingURL=session-cookie-B0Fc-L8S.js.map
+//# sourceMappingURL=session-cookie-CDynAOx3.js.map

package/build/server/chunks/{session-cookie-B0Fc-L8S.js.map → session-cookie-CDynAOx3.js.map}

@@ -1 +1 @@
-{"version":3,"file":"session-cookie-B0Fc-L8S.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}
+{"version":3,"file":"session-cookie-CDynAOx3.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}

package/build/server/chunks/{setup-deploy-BjJIt1Gf.js → setup-deploy-CRW2KpZR.js}

@@ -1,4 +1,4 @@
-import { k as backupSetupInputs, aX as runDeploy, aU as resolveDeployJournalPath, ah as isSetupComplete, aV as resolveOpenPalmHome, az as readDeployJournal, aq as markSetupComplete } from './src-i2v6xhSC.js';
+import { k as backupSetupInputs, aZ as runDeploy, aV as resolveDeployJournalPath, af as isSetupComplete, aX as resolveOpenPalmHome, ay as readDeployJournal, ao as markSetupComplete } from './src-CQ2F7hgb.js';
 
 //#region src/lib/server/setup-deploy.ts
 var _state = {
@@ -72,4 +72,4 @@ function prepareSetupRestorePoint(state) {
 }
 
 export { getDeployState as g, prepareSetupRestorePoint as p, resetDeployState as r, startDeploy as s };
-//# sourceMappingURL=setup-deploy-BjJIt1Gf.js.map
+//# sourceMappingURL=setup-deploy-CRW2KpZR.js.map