@openpalm/ui 0.13.0-beta.4 → 0.13.0-beta.6

package/build/server/chunks/{docker2-oBEn_Si9.js → docker2-BYFlumV1.js}

@@ -1,7 +1,8 @@
-import { u as composeDownProject, N as detectExistingProject, aT as resolveComposeProjectName } from './src-CQ2F7hgb.js';
+import { u as composeDownProject, M as detectExistingProject, aM as resolveComposeProjectName } from './src-DbArH65P.js';
 import './chunk-DOvWTNp_.js';
 import 'node:module';
 import './network-preset-CJ1RRnki.js';
+import './dist-DtzrgNJ1.js';
 import 'node:fs';
 import 'node:child_process';
 import 'node:path';
@@ -23,4 +24,4 @@ import 'node:fs/promises';
 
 
 export { composeDownProject, detectExistingProject, resolveComposeProjectName };
-//# sourceMappingURL=docker2-oBEn_Si9.js.map
+//# sourceMappingURL=docker2-BYFlumV1.js.map

package/build/server/chunks/docker2-BYFlumV1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker2-BYFlumV1.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;"}

package/build/server/chunks/{docker3-Dn-Mm2cT.js → docker3-CtXDh00O.js}

@@ -1,4 +1,4 @@
-import { y as composeRestart$1, w as composePreflight, aT as resolveComposeProjectName } from './src-CQ2F7hgb.js';
+import { y as composeRestart$1, w as composePreflight, aM as resolveComposeProjectName } from './src-DbArH65P.js';
 
 //#region src/lib/server/docker.ts
 async function runPreflight(options) {
@@ -17,4 +17,4 @@ async function composeRestart(services, options) {
 }
 
 export { composeRestart as c };
-//# sourceMappingURL=docker3-Dn-Mm2cT.js.map
+//# sourceMappingURL=docker3-CtXDh00O.js.map

package/build/server/chunks/{docker3-Dn-Mm2cT.js.map → docker3-CtXDh00O.js.map}

@@ -1 +1 @@
-{"version":3,"file":"docker3-Dn-Mm2cT.js","sources":["../../../.svelte-kit/adapter-node/chunks/docker3.js"],"sourcesContent":["import { h as composeRestart$1, j as resolveComposeProjectName, p as composePreflight } from \"./docker.js\";\nimport \"./src.js\";\n//#region src/lib/server/docker.ts\nasync function runPreflight(options) {\n\tif (options.files.length === 0 || process.env.OP_SKIP_COMPOSE_PREFLIGHT) return;\n\tconst result = await composePreflight(options);\n\tif (!result.ok) {\n\t\tconst project = resolveComposeProjectName();\n\t\tconst fileArgs = options.files.map((f) => `-f ${f}`).join(\" \");\n\t\tconst envArgs = (options.envFiles ?? []).map((f) => `--env-file ${f}`).join(\" \");\n\t\tthrow new Error(`Compose preflight failed: ${result.stderr}\\nResolved command: docker compose ${fileArgs} --project-name ${project} ${envArgs} config --quiet`);\n\t}\n}\nasync function composeRestart(services, options) {\n\tawait runPreflight(options);\n\treturn composeRestart$1(services, options);\n}\n//#endregion\nexport { composeRestart as t };\n"],"names":[],"mappings":";;AAEA;AACA,eAAe,YAAY,CAAC,OAAO,EAAE;AACrC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE;AAC1E,CAAC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC;AAC/C,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE;AACjB,EAAE,MAAM,OAAO,GAAG,yBAAyB,EAAE;AAC7C,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;AAChE,EAAE,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;AAClF,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC,mCAAmC,EAAE,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;AACjK,CAAC;AACD;AACA,eAAe,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE;AACjD,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC;AAC5B,CAAC,OAAO,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC;AAC3C;;;;"}
+{"version":3,"file":"docker3-CtXDh00O.js","sources":["../../../.svelte-kit/adapter-node/chunks/docker3.js"],"sourcesContent":["import { O as resolveComposeProjectName, h as composeRestart$1, p as composePreflight } from \"./docker.js\";\nimport \"./src.js\";\n//#region src/lib/server/docker.ts\nasync function runPreflight(options) {\n\tif (options.files.length === 0 || process.env.OP_SKIP_COMPOSE_PREFLIGHT) return;\n\tconst result = await composePreflight(options);\n\tif (!result.ok) {\n\t\tconst project = resolveComposeProjectName();\n\t\tconst fileArgs = options.files.map((f) => `-f ${f}`).join(\" \");\n\t\tconst envArgs = (options.envFiles ?? []).map((f) => `--env-file ${f}`).join(\" \");\n\t\tthrow new Error(`Compose preflight failed: ${result.stderr}\\nResolved command: docker compose ${fileArgs} --project-name ${project} ${envArgs} config --quiet`);\n\t}\n}\nasync function composeRestart(services, options) {\n\tawait runPreflight(options);\n\treturn composeRestart$1(services, options);\n}\n//#endregion\nexport { composeRestart as t };\n"],"names":[],"mappings":";;AAEA;AACA,eAAe,YAAY,CAAC,OAAO,EAAE;AACrC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE;AAC1E,CAAC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC;AAC/C,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE;AACjB,EAAE,MAAM,OAAO,GAAG,yBAAyB,EAAE;AAC7C,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;AAChE,EAAE,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;AAClF,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,0BAA0B,EAAE,MAAM,CAAC,MAAM,CAAC,mCAAmC,EAAE,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;AACjK,CAAC;AACD;AACA,eAAe,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE;AACjD,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC;AAC5B,CAAC,OAAO,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC;AAC3C;;;;"}

package/build/server/chunks/{endpoints-WTxemTcn.js → endpoints-IFTldlrt.js}

@@ -1,5 +1,5 @@
-import { aD as readStackEnv, aA as readSecret } from './src-CQ2F7hgb.js';
-import { g as getState } from './state-CsIDHNPN.js';
+import { ax as readStackEnv, au as readSecret } from './src-DbArH65P.js';
+import { g as getState } from './state-Bq8fep3F.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, chmodSync, unlinkSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { randomUUID } from 'node:crypto';
@@ -157,6 +157,8 @@ function localEndpoint() {
 function normalizeBrowserFacingUrl(raw) {
 	try {
 		const url = new URL(raw);
+		url.username = "";
+		url.password = "";
 		const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
 		if (host === "0.0.0.0" || host === "::") url.hostname = "127.0.0.1";
 		return url.toString().replace(/\/$/, "");
@@ -164,6 +166,17 @@ function normalizeBrowserFacingUrl(raw) {
 		return raw;
 	}
 }
+/** Strip legacy URL userinfo before a connection reaches a serializer or view. */
+function redactEndpointUrlUserinfo(raw) {
+	return normalizeBrowserFacingUrl(raw);
+}
+function redactEntryUrl(entry) {
+	const url = redactEndpointUrlUserinfo(entry.url);
+	return url === entry.url ? entry : {
+		...entry,
+		url
+	};
+}
 function readFile() {
 	maybeMigrateLegacyEndpointsFile();
 	let path = endpointsPath();
@@ -179,7 +192,7 @@ function readFile() {
 		const parsed = JSON.parse(readFileSync(path, "utf-8"));
 		return {
 			activeId: typeof parsed.activeId === "string" ? parsed.activeId : null,
-			endpoints: Array.isArray(parsed.endpoints) ? parsed.endpoints.filter(isValidEntry) : []
+			endpoints: Array.isArray(parsed.endpoints) ? parsed.endpoints.filter(isValidEntry).map(redactEntryUrl) : []
 		};
 	} catch (e) {
 		console.warn("[endpoints] Failed to parse endpoints.json, resetting:", e);
@@ -197,7 +210,11 @@ function isValidEntry(e) {
 function writeFile(data) {
 	const path = endpointsPath();
 	mkdirSync(dirname(path), { recursive: true });
-	writeFileSync(path, JSON.stringify(data, null, 2), {
+	const safeData = {
+		...data,
+		endpoints: data.endpoints.map(redactEntryUrl)
+	};
+	writeFileSync(path, JSON.stringify(safeData, null, 2), {
 		encoding: "utf-8",
 		mode: 384
 	});
@@ -244,6 +261,10 @@ function validateEndpointUrl(input) {
 		ok: false,
 		reason: "missing_host"
 	};
+	if (u.username || u.password) return {
+		ok: false,
+		reason: "userinfo_not_allowed"
+	};
 	if (u.search || u.hash) return {
 		ok: false,
 		reason: "unexpected_query_or_fragment"
@@ -448,5 +469,5 @@ async function listRemoteStatuses() {
 	return statuses.map((status) => ({ ...status }));
 }
 
-export { USER_ADDABLE_CONNECTION_KINDS as U, addConnection as a, basicAuthHeader as b, listRemoteStatuses as c, deleteConnection as d, getActiveConnection as g, listConnections as l, setActiveConnectionId as s, updateConnection as u, validateEndpointUrl as v };
-//# sourceMappingURL=endpoints-WTxemTcn.js.map
+export { USER_ADDABLE_CONNECTION_KINDS as U, addConnection as a, basicAuthHeader as b, listRemoteStatuses as c, deleteConnection as d, getActiveConnection as g, listConnections as l, redactEndpointUrlUserinfo as r, setActiveConnectionId as s, updateConnection as u, validateEndpointUrl as v };
+//# sourceMappingURL=endpoints-IFTldlrt.js.map

package/build/server/chunks/endpoints-IFTldlrt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints-IFTldlrt.js","sources":["../../../.svelte-kit/adapter-node/chunks/endpoints.js"],"sourcesContent":["import { Y as readStackEnv, it as readSecret } from \"./compose-args.js\";\nimport \"./src.js\";\nimport { t as getState } from \"./state.js\";\nimport { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from \"node:fs\";\nimport { dirname } from \"node:path\";\nimport { randomUUID } from \"node:crypto\";\n//#region src/lib/server/basic-auth.ts\n/**\n* Shared HTTP Basic-auth encoding for host-UI → OpenCode/guardian calls.\n*\n* PR #564 P2-1: every host forwarder MUST send the exact same UTF-8 byte\n* sequence the assistant and guardian expect. Two divergences caused correct\n* passwords to 401 from the host:\n*  - `btoa()` is Latin-1-only and throws / corrupts on non-Latin-1 bytes\n*    (accents, CJK, emoji). Encode UTF-8 first (matches the guardian's\n*    `Buffer.from(..., 'utf-8')`).\n*  - the file-backed password was `.trim()`-ed, stripping surrounding spaces,\n*    while the assistant entrypoint (`$(cat)`) and the guardian strip only\n*    trailing newlines. Use `stripTrailingNewlines` so a password like\n*    `\"päss 🔒 \"` authenticates identically everywhere.\n*/\n/** OpenCode's server default Basic-auth username (the shipped assistant compose never overrides it). */\nvar DEFAULT_OPENCODE_USERNAME$1 = \"opencode\";\n/** UTF-8-safe Basic auth header — identical byte sequence to the guardian's encoder. */\nfunction basicAuthHeader(username, password) {\n\treturn `Basic ${Buffer.from(`${username}:${password}`, \"utf-8\").toString(\"base64\")}`;\n}\n/**\n* Strip only trailing newlines from a file-backed secret, matching the\n* assistant entrypoint's `$(cat file)` and the guardian's reader. Surrounding\n* spaces/tabs are preserved so the bytes match across every consumer.\n*/\nfunction stripTrailingNewlines(value) {\n\treturn value.replace(/\\n+$/, \"\");\n}\n//#endregion\n//#region src/lib/server/endpoints.ts\n/**\n* Assistant connections — list of OpenCode servers the UI can target, with\n* one marked active. The internal model uses \"connection\" language (plan\n* ui-runtime-modes-plan.md §6.6, Phase 2 / #486); the on-disk file keeps its\n* historical name and schema keys — `endpoints.json` with\n* `{ activeId, endpoints }` — and is NEVER renamed or migrated.\n*\n* The \"default\" entry is synthesized from environment (OP_OPENCODE_URL /\n* OP_ASSISTANT_URL / OP_ASSISTANT_PORT) and cannot be deleted. User-added\n* connections are persisted to a JSON file in the config directory (it's\n* user-owned configuration, not service state — see Phase 5 / D4 in\n* docs/technical/auth-and-proxy-refactor-plan.md).\n*\n* File: ${configDir}/endpoints.json (mode 0600)\n* Shape: { activeId: string | null, endpoints: ConnectionEntry[] }\n*   - activeId === null or \"default\" → use the env-derived default\n*   - activeId === \"<id>\" → use the matching user entry (falls back to default if not found)\n*\n* Legacy path: ${dataDir}/admin/endpoints.json. Old installs are\n* migrated lazily on first read by maybeMigrateLegacyEndpointsFile().\n*/\n/**\n* Read-time kind defaulting (plan §6.6): a user-persisted record without a\n* `kind` key is a remote OpenCode connection — that is the only thing the\n* pre-Phase-2 UI let users add. Explicit kinds pass through untouched.\n*/\nfunction kindOf(entry) {\n\treturn entry.kind ?? \"remote-opencode\";\n}\nvar DEFAULT_ID = \"default\";\n/**\n* OpenCode's server default Basic-auth username. The shipped assistant compose\n* never overrides OPENCODE_SERVER_USERNAME, and the guardian's upstream auth\n* sends `opencode:<password>`, so every host-UI forwarder must default here or\n* a correct password 401s (PR #564 r3566888629). User-added connections may\n* still carry an explicit username.\n*/\nvar DEFAULT_OPENCODE_USERNAME = DEFAULT_OPENCODE_USERNAME$1;\nvar LOCAL_ELECTRON_ID = \"local-electron\";\nvar remoteStatusCache = null;\nfunction endpointsPath() {\n\treturn `${getState().configDir}/endpoints.json`;\n}\n/**\n* Legacy path used before Phase 5 of the auth/proxy refactor.\n* See docs/technical/auth-and-proxy-refactor-plan.md § Phase 5 / D4.\n*/\nfunction legacyEndpointsPath() {\n\treturn `${getState().dataDir}/admin/endpoints.json`;\n}\n/**\n* One-shot lazy migration from the legacy data/ path to the new config/ path.\n*\n* Phase 5 of docs/technical/auth-and-proxy-refactor-plan.md (D6 step 3):\n*   - If the new path already exists → no-op (already migrated).\n*   - If the legacy path doesn't exist → no-op (fresh install).\n*   - Otherwise copy contents to the new path (mode 0600), then unlink legacy.\n*\n* If the migration fails partway, the legacy file is left in place so reads\n* fall back to it for the remainder of this session. Idempotent across\n* process restarts because the existence check makes it a no-op after the\n* first successful run.\n*/\nfunction maybeMigrateLegacyEndpointsFile() {\n\tconst newPath = endpointsPath();\n\tif (existsSync(newPath)) return;\n\tconst oldPath = legacyEndpointsPath();\n\tif (!existsSync(oldPath)) return;\n\ttry {\n\t\tmkdirSync(dirname(newPath), { recursive: true });\n\t\twriteFileSync(newPath, readFileSync(oldPath), { mode: 384 });\n\t\ttry {\n\t\t\tchmodSync(newPath, 384);\n\t\t} catch {}\n\t\tunlinkSync(oldPath);\n\t} catch (e) {\n\t\tconsole.warn(\"[endpoints] Failed to migrate legacy endpoints.json from data/ to config/. Leaving the old file in place; reads will fall back to it for this session.\", e);\n\t}\n}\nfunction localRuntimePath() {\n\treturn `${getState().dataDir}/local-opencode.runtime.json`;\n}\n/**\n* Read the Electron-written runtime.json each time it's needed. The file is\n* 0600 and is rewritten on each Electron launch (random password per launch),\n* so callers must NOT cache the result.\n*/\nfunction readLocalRuntime() {\n\tconst path = localRuntimePath();\n\tif (!existsSync(path)) return null;\n\ttry {\n\t\tconst parsed = JSON.parse(readFileSync(path, \"utf-8\"));\n\t\tif (!parsed || typeof parsed.url !== \"string\" || !parsed.url) return null;\n\t\treturn {\n\t\t\turl: parsed.url,\n\t\t\tusername: typeof parsed.username === \"string\" ? parsed.username : void 0,\n\t\t\tpassword: typeof parsed.password === \"string\" ? parsed.password : void 0,\n\t\t\tpid: typeof parsed.pid === \"number\" ? parsed.pid : void 0,\n\t\t\tstartedAt: typeof parsed.startedAt === \"string\" ? parsed.startedAt : void 0\n\t\t};\n\t} catch (e) {\n\t\tconsole.warn(\"[endpoints] Failed to parse local-opencode.runtime.json:\", e);\n\t\treturn null;\n\t}\n}\nfunction localEndpoint() {\n\tconst rt = readLocalRuntime();\n\tif (!rt) return null;\n\treturn {\n\t\tid: LOCAL_ELECTRON_ID,\n\t\tlabel: \"OpenPalm Admin\",\n\t\turl: normalizeBrowserFacingUrl(rt.url),\n\t\tusername: rt.username || DEFAULT_OPENCODE_USERNAME,\n\t\t...rt.password ? { password: rt.password } : {},\n\t\tkind: \"local-opencode\",\n\t\tisDefault: false,\n\t\tisLocal: true\n\t};\n}\nfunction normalizeBrowserFacingUrl(raw) {\n\ttry {\n\t\tconst url = new URL(raw);\n\t\turl.username = \"\";\n\t\turl.password = \"\";\n\t\tconst host = url.hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n\t\tif (host === \"0.0.0.0\" || host === \"::\") url.hostname = \"127.0.0.1\";\n\t\treturn url.toString().replace(/\\/$/, \"\");\n\t} catch {\n\t\treturn raw;\n\t}\n}\n/** Strip legacy URL userinfo before a connection reaches a serializer or view. */\nfunction redactEndpointUrlUserinfo(raw) {\n\treturn normalizeBrowserFacingUrl(raw);\n}\nfunction redactEntryUrl(entry) {\n\tconst url = redactEndpointUrlUserinfo(entry.url);\n\treturn url === entry.url ? entry : {\n\t\t...entry,\n\t\turl\n\t};\n}\nfunction readFile() {\n\tmaybeMigrateLegacyEndpointsFile();\n\tlet path = endpointsPath();\n\tif (!existsSync(path)) {\n\t\tconst legacy = legacyEndpointsPath();\n\t\tif (!existsSync(legacy)) return {\n\t\t\tactiveId: null,\n\t\t\tendpoints: []\n\t\t};\n\t\tpath = legacy;\n\t}\n\ttry {\n\t\tconst parsed = JSON.parse(readFileSync(path, \"utf-8\"));\n\t\treturn {\n\t\t\tactiveId: typeof parsed.activeId === \"string\" ? parsed.activeId : null,\n\t\t\tendpoints: Array.isArray(parsed.endpoints) ? parsed.endpoints.filter(isValidEntry).map(redactEntryUrl) : []\n\t\t};\n\t} catch (e) {\n\t\tconsole.warn(\"[endpoints] Failed to parse endpoints.json, resetting:\", e);\n\t\treturn {\n\t\t\tactiveId: null,\n\t\t\tendpoints: []\n\t\t};\n\t}\n}\nfunction isValidEntry(e) {\n\tif (!e || typeof e !== \"object\") return false;\n\tconst o = e;\n\treturn typeof o.id === \"string\" && typeof o.label === \"string\" && typeof o.url === \"string\";\n}\nfunction writeFile(data) {\n\tconst path = endpointsPath();\n\tmkdirSync(dirname(path), { recursive: true });\n\tconst safeData = {\n\t\t...data,\n\t\tendpoints: data.endpoints.map(redactEntryUrl)\n\t};\n\twriteFileSync(path, JSON.stringify(safeData, null, 2), {\n\t\tencoding: \"utf-8\",\n\t\tmode: 384\n\t});\n\ttry {\n\t\tchmodSync(path, 384);\n\t} catch {}\n}\nfunction defaultEndpoint() {\n\tconst persisted = readStackEnv(getState().homeDir);\n\tconst url = process.env.OP_OPENCODE_URL ?? process.env.OP_ASSISTANT_URL ?? `http://127.0.0.1:${process.env.OP_ASSISTANT_PORT ?? persisted.OP_ASSISTANT_PORT ?? \"3800\"}`;\n\tconst username = process.env.OPENCODE_SERVER_USERNAME || DEFAULT_OPENCODE_USERNAME;\n\tconst presetPassword = /^(true|1|yes)$/i.test((persisted.OPENCODE_AUTH ?? process.env.OPENCODE_AUTH ?? \"\").trim()) ? ((raw) => raw ? stripTrailingNewlines(raw) : void 0)(readSecret(getState().homeDir, \"op_opencode_password\") ?? void 0) || process.env.OP_OPENCODE_PASSWORD : void 0;\n\tconst password = process.env.OPENCODE_SERVER_PASSWORD || presetPassword || void 0;\n\treturn {\n\t\tid: DEFAULT_ID,\n\t\tlabel: \"Local Assistant\",\n\t\turl: normalizeBrowserFacingUrl(url),\n\t\tusername,\n\t\tpassword,\n\t\tkind: \"local-opencode\",\n\t\tisDefault: true\n\t};\n}\n/**\n* Discriminated validator that callers (admin routes) use to surface\n* specific error messages. Plain HTTP is allowed for any host — OpenPalm is\n* LAN-first, so remote instances on a private network are reached over http://.\n*/\nfunction validateEndpointUrl(input) {\n\tlet u;\n\ttry {\n\t\tu = new URL(input.trim());\n\t} catch {\n\t\treturn {\n\t\t\tok: false,\n\t\t\treason: \"invalid_url\"\n\t\t};\n\t}\n\tif (u.protocol !== \"http:\" && u.protocol !== \"https:\") return {\n\t\tok: false,\n\t\treason: \"invalid_scheme\"\n\t};\n\tif (!u.hostname) return {\n\t\tok: false,\n\t\treason: \"missing_host\"\n\t};\n\tif (u.username || u.password) return {\n\t\tok: false,\n\t\treason: \"userinfo_not_allowed\"\n\t};\n\tif (u.search || u.hash) return {\n\t\tok: false,\n\t\treason: \"unexpected_query_or_fragment\"\n\t};\n\treturn {\n\t\tok: true,\n\t\turl: u.toString().replace(/\\/$/, \"\")\n\t};\n}\n/**\n* Validate a URL string — must be http(s) with a host. Returns the normalized\n* URL or null. For finer-grained errors, use `validateEndpointUrl`.\n*/\nfunction normalizeEndpointUrl(input) {\n\tconst result = validateEndpointUrl(input);\n\treturn result.ok ? result.url : null;\n}\n/**\n* Returns: [local-electron (if Electron is running it), default, ...user entries].\n* The local-electron entry is synthesized at call time from\n* state/local-opencode.runtime.json — never persisted to endpoints.json.\n*/\nfunction listConnections() {\n\tconst { endpoints } = readFile();\n\tconst local = localEndpoint();\n\treturn [\n\t\t...local ? [local] : [],\n\t\tdefaultEndpoint(),\n\t\t...endpoints.map((e) => ({\n\t\t\t...e,\n\t\t\tkind: kindOf(e),\n\t\t\tisDefault: false\n\t\t}))\n\t];\n}\n/**\n* Returns the active connection, falling back to the default if no active id\n* is set OR if the active id is `local-electron` but the runtime.json isn't\n* there (e.g. the Electron child died). Re-reads runtime.json each call so a\n* password rotated by a new Electron launch is picked up immediately.\n*/\nfunction getActiveConnection() {\n\tconst { activeId, endpoints } = readFile();\n\tif (activeId === LOCAL_ELECTRON_ID) {\n\t\tconst local = localEndpoint();\n\t\tif (local) return local;\n\t\treturn defaultEndpoint();\n\t}\n\tif (!activeId || activeId === DEFAULT_ID) return defaultEndpoint();\n\tconst found = endpoints.find((e) => e.id === activeId);\n\tif (!found) return defaultEndpoint();\n\treturn {\n\t\t...found,\n\t\tkind: kindOf(found),\n\t\tisDefault: false\n\t};\n}\nfunction setActiveConnectionId(id) {\n\tconst data = readFile();\n\tif (!id || id === DEFAULT_ID) data.activeId = null;\n\telse if (id === LOCAL_ELECTRON_ID) {\n\t\tif (!localEndpoint()) throw new Error(\"Local OpenCode is not running (Electron only)\");\n\t\tdata.activeId = LOCAL_ELECTRON_ID;\n\t} else {\n\t\tif (!data.endpoints.some((e) => e.id === id)) throw new Error(`Endpoint not found: ${id}`);\n\t\tdata.activeId = id;\n\t}\n\twriteFile(data);\n\treturn getActiveConnection();\n}\n/**\n* User-addable connection kinds (#486 D2). `local-opencode` is reserved for\n* synthesized entries (the env-derived default, the Electron local-runtime\n* entry) and is never accepted from a write path.\n*/\nvar USER_ADDABLE_CONNECTION_KINDS = [\"remote-opencode\", \"openpalm-client-api\"];\n/**\n* Normalize a guardian ('openpalm-client-api'-kind) connection URL so it\n* always ends in `/oc` — the guardian's direct-ingress base path\n* (#486 D2). Operates on an ALREADY `normalizeEndpointUrl`-ed string (no\n* trailing slash), so only the `/oc` suffix logic is needed here.\n*\n* `packages/client/src/lib/connections/url-policy.ts` carries a deliberate\n* CLIENT-side twin (`normalizeGuardianUrl`) with the same rule — the client\n* artifact may not import host code and vice versa, so this is the same\n* accepted duplication as `validateConnectionUrl`/`validateEndpointUrl`.\n* Both are pinned by their own tests.\n*/\nfunction normalizeGuardianOcUrl(url) {\n\treturn url.endsWith(\"/oc\") ? url : `${url}/oc`;\n}\nfunction assertAddableKind(kind) {\n\tif (kind === void 0) return;\n\tif (!USER_ADDABLE_CONNECTION_KINDS.includes(kind)) throw new Error(\"Invalid connection kind\");\n}\nfunction addConnection(input) {\n\tconst label = input.label.trim();\n\tif (!label) throw new Error(\"Label is required\");\n\tlet url = normalizeEndpointUrl(input.url);\n\tif (!url) throw new Error(\"URL must be a valid http(s) URL\");\n\tassertAddableKind(input.kind);\n\tif (input.kind === \"openpalm-client-api\") url = normalizeGuardianOcUrl(url);\n\tconst data = readFile();\n\tconst entry = {\n\t\tid: randomUUID(),\n\t\tlabel,\n\t\turl,\n\t\t...input.password ? { password: input.password } : {},\n\t\t...input.kind ? { kind: input.kind } : {}\n\t};\n\tdata.endpoints.push(entry);\n\twriteFile(data);\n\treturn entry;\n}\nfunction updateConnection(id, patch) {\n\tif (id === DEFAULT_ID) throw new Error(\"Cannot edit the default endpoint\");\n\tif (id === LOCAL_ELECTRON_ID) throw new Error(\"Cannot edit the local Electron OpenCode entry (it is ephemeral and per-launch)\");\n\tassertAddableKind(patch.kind);\n\tconst data = readFile();\n\tconst idx = data.endpoints.findIndex((e) => e.id === id);\n\tif (idx === -1) throw new Error(`Endpoint not found: ${id}`);\n\tconst next = { ...data.endpoints[idx] };\n\tif (patch.label !== void 0) {\n\t\tconst label = patch.label.trim();\n\t\tif (!label) throw new Error(\"Label cannot be empty\");\n\t\tnext.label = label;\n\t}\n\tif (patch.url !== void 0) {\n\t\tconst url = normalizeEndpointUrl(patch.url);\n\t\tif (!url) throw new Error(\"URL must be a valid http(s) URL\");\n\t\tnext.url = url;\n\t}\n\tif (patch.password === null) delete next.password;\n\telse if (typeof patch.password === \"string\") next.password = patch.password;\n\tif (patch.kind !== void 0) next.kind = patch.kind;\n\tif (next.kind === \"openpalm-client-api\") next.url = normalizeGuardianOcUrl(next.url);\n\tdata.endpoints[idx] = next;\n\twriteFile(data);\n\treturn next;\n}\nfunction deleteConnection(id) {\n\tif (id === DEFAULT_ID) throw new Error(\"Cannot delete the default endpoint\");\n\tif (id === LOCAL_ELECTRON_ID) throw new Error(\"Cannot delete the local Electron OpenCode entry (managed by Electron lifecycle)\");\n\tconst data = readFile();\n\tconst idx = data.endpoints.findIndex((e) => e.id === id);\n\tif (idx === -1) throw new Error(`Endpoint not found: ${id}`);\n\tdata.endpoints.splice(idx, 1);\n\tif (data.activeId === id) data.activeId = null;\n\twriteFile(data);\n}\nasync function probeEndpoint(endpoint) {\n\tconst headers = new Headers();\n\tif (endpoint.password) {\n\t\tconst username = endpoint.username ?? DEFAULT_OPENCODE_USERNAME;\n\t\theaders.set(\"authorization\", basicAuthHeader(username, endpoint.password));\n\t}\n\tconst probeUrl = endpoint.kind === \"openpalm-client-api\" ? `${endpoint.url}/session` : endpoint.url;\n\ttry {\n\t\tconst response = await fetch(probeUrl, {\n\t\t\tmethod: \"GET\",\n\t\t\theaders,\n\t\t\tredirect: \"manual\",\n\t\t\tsignal: AbortSignal.timeout(2e3)\n\t\t});\n\t\tif (response.status === 401 || response.status === 403) return {\n\t\t\tid: endpoint.id,\n\t\t\tname: endpoint.label,\n\t\t\turl: endpoint.url,\n\t\t\tstate: \"unauthorized\",\n\t\t\tdetail: `HTTP ${response.status}`\n\t\t};\n\t\tif (response.ok || response.status >= 300 && response.status < 400) return {\n\t\t\tid: endpoint.id,\n\t\t\tname: endpoint.label,\n\t\t\turl: endpoint.url,\n\t\t\tstate: \"accessible\"\n\t\t};\n\t\treturn {\n\t\t\tid: endpoint.id,\n\t\t\tname: endpoint.label,\n\t\t\turl: endpoint.url,\n\t\t\tstate: \"unreachable\",\n\t\t\tdetail: `HTTP ${response.status}`\n\t\t};\n\t} catch (error) {\n\t\treturn {\n\t\t\tid: endpoint.id,\n\t\t\tname: endpoint.label,\n\t\t\turl: endpoint.url,\n\t\t\tstate: \"unreachable\",\n\t\t\tdetail: error instanceof Error ? error.message : String(error)\n\t\t};\n\t}\n}\nasync function listRemoteStatuses() {\n\tif (remoteStatusCache && remoteStatusCache.expiresAt > Date.now()) return remoteStatusCache.value.map((status) => ({ ...status }));\n\tconst statuses = await Promise.all(listConnections().map((endpoint) => probeEndpoint(endpoint)));\n\tremoteStatusCache = {\n\t\tvalue: statuses,\n\t\texpiresAt: Date.now() + 5e3\n\t};\n\treturn statuses.map((status) => ({ ...status }));\n}\n//#endregion\nexport { listConnections as a, setActiveConnectionId as c, basicAuthHeader as d, getActiveConnection as i, updateConnection as l, addConnection as n, listRemoteStatuses as o, deleteConnection as r, redactEndpointUrlUserinfo as s, USER_ADDABLE_CONNECTION_KINDS as t, validateEndpointUrl as u };\n"],"names":[],"mappings":";;;;;;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,2BAA2B,GAAG,UAAU;AAC5C;AACA,SAAS,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE;AAC7C,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrF;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,KAAK,EAAE;AACtC,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;AACjC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,MAAM,CAAC,KAAK,EAAE;AACvB,CAAC,OAAO,KAAK,CAAC,IAAI,IAAI,iBAAiB;AACvC;AACA,IAAI,UAAU,GAAG,SAAS;AAC1B;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,yBAAyB,GAAG,2BAA2B;AAC3D,IAAI,iBAAiB,GAAG,gBAAgB;AACxC,IAAI,iBAAiB,GAAG,IAAI;AAC5B,SAAS,aAAa,GAAG;AACzB,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,eAAe,CAAC;AAChD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,GAAG;AAC/B,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC;AACpD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,+BAA+B,GAAG;AAC3C,CAAC,MAAM,OAAO,GAAG,aAAa,EAAE;AAChC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE;AAC1B,CAAC,MAAM,OAAO,GAAG,mBAAmB,EAAE;AACtC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;AAC3B,CAAC,IAAI;AACL,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAClD,EAAE,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC9D,EAAE,IAAI;AACN,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC;AAC1B,EAAE,CAAC,CAAC,MAAM,CAAC;AACX,EAAE,UAAU,CAAC,OAAO,CAAC;AACrB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,CAAC,IAAI,CAAC,wJAAwJ,EAAE,CAAC,CAAC;AAC3K,CAAC;AACD;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,4BAA4B,CAAC;AAC3D;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,IAAI,GAAG,gBAAgB,EAAE;AAChC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AACnC,CAAC,IAAI;AACL,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACxD,EAAE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI;AAC3E,EAAE,OAAO;AACT,GAAG,GAAG,EAAE,MAAM,CAAC,GAAG;AAClB,GAAG,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;AAC3E,GAAG,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;AAC3E,GAAG,GAAG,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,GAAG,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC;AAC5D,GAAG,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,GAAG,MAAM,CAAC,SAAS,GAAG,KAAK;AAC7E,GAAG;AACH,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,CAAC,IAAI,CAAC,0DAA0D,EAAE,CAAC,CAAC;AAC7E,EAAE,OAAO,IAAI;AACb,CAAC;AACD;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,MAAM,EAAE,GAAG,gBAAgB,EAAE;AAC9B,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,IAAI;AACrB,CAAC,OAAO;AACR,EAAE,EAAE,EAAE,iBAAiB;AACvB,EAAE,KAAK,EAAE,gBAAgB;AACzB,EAAE,GAAG,EAAE,yBAAyB,CAAC,EAAE,CAAC,GAAG,CAAC;AACxC,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,yBAAyB;AACpD,EAAE,GAAG,EAAE,CAAC,QAAQ,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;AACjD,EAAE,IAAI,EAAE,gBAAgB;AACxB,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,OAAO,EAAE;AACX,EAAE;AACF;AACA,SAAS,yBAAyB,CAAC,GAAG,EAAE;AACxC,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC;AAC1B,EAAE,GAAG,CAAC,QAAQ,GAAG,EAAE;AACnB,EAAE,GAAG,CAAC,QAAQ,GAAG,EAAE;AACnB,EAAE,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;AACjE,EAAE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,WAAW;AACrE,EAAE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AAC1C,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,GAAG;AACZ,CAAC;AACD;AACA;AACA,SAAS,yBAAyB,CAAC,GAAG,EAAE;AACxC,CAAC,OAAO,yBAAyB,CAAC,GAAG,CAAC;AACtC;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,MAAM,GAAG,GAAG,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC;AACjD,CAAC,OAAO,GAAG,KAAK,KAAK,CAAC,GAAG,GAAG,KAAK,GAAG;AACpC,EAAE,GAAG,KAAK;AACV,EAAE;AACF,EAAE;AACF;AACA,SAAS,QAAQ,GAAG;AACpB,CAAC,+BAA+B,EAAE;AAClC,CAAC,IAAI,IAAI,GAAG,aAAa,EAAE;AAC3B,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;AACxB,EAAE,MAAM,MAAM,GAAG,mBAAmB,EAAE;AACtC,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,OAAO;AAClC,GAAG,QAAQ,EAAE,IAAI;AACjB,GAAG,SAAS,EAAE;AACd,GAAG;AACH,EAAE,IAAI,GAAG,MAAM;AACf,CAAC;AACD,CAAC,IAAI;AACL,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACxD,EAAE,OAAO;AACT,GAAG,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,IAAI;AACzE,GAAG,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG;AAC5G,GAAG;AACH,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,CAAC,IAAI,CAAC,wDAAwD,EAAE,CAAC,CAAC;AAC3E,EAAE,OAAO;AACT,GAAG,QAAQ,EAAE,IAAI;AACjB,GAAG,SAAS,EAAE;AACd,GAAG;AACH,CAAC;AACD;AACA,SAAS,YAAY,CAAC,CAAC,EAAE;AACzB,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,OAAO,KAAK;AAC9C,CAAC,MAAM,CAAC,GAAG,CAAC;AACZ,CAAC,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;AAC5F;AACA,SAAS,SAAS,CAAC,IAAI,EAAE;AACzB,CAAC,MAAM,IAAI,GAAG,aAAa,EAAE;AAC7B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC,MAAM,QAAQ,GAAG;AAClB,EAAE,GAAG,IAAI;AACT,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,cAAc;AAC9C,EAAE;AACF,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;AACxD,EAAE,QAAQ,EAAE,OAAO;AACnB,EAAE,IAAI,EAAE;AACR,EAAE,CAAC;AACH,CAAC,IAAI;AACL,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC;AACtB,CAAC,CAAC,CAAC,MAAM,CAAC;AACV;AACA,SAAS,eAAe,GAAG;AAC3B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC;AACnD,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,SAAS,CAAC,iBAAiB,IAAI,MAAM,CAAC,CAAC;AACxK,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,yBAAyB;AACnF,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,GAAG,GAAG,qBAAqB,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,sBAAsB,CAAC,IAAI,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,MAAM;AACzR,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,cAAc,IAAI,MAAM;AAClF,CAAC,OAAO;AACR,EAAE,EAAE,EAAE,UAAU;AAChB,EAAE,KAAK,EAAE,iBAAiB;AAC1B,EAAE,GAAG,EAAE,yBAAyB,CAAC,GAAG,CAAC;AACrC,EAAE,QAAQ;AACV,EAAE,QAAQ;AACV,EAAE,IAAI,EAAE,gBAAgB;AACxB,EAAE,SAAS,EAAE;AACb,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE;AACpC,CAAC,IAAI,CAAC;AACN,CAAC,IAAI;AACL,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO;AACT,GAAG,EAAE,EAAE,KAAK;AACZ,GAAG,MAAM,EAAE;AACX,GAAG;AACH,CAAC;AACD,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,OAAO;AAC/D,EAAE,EAAE,EAAE,KAAK;AACX,EAAE,MAAM,EAAE;AACV,EAAE;AACF,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO;AACzB,EAAE,EAAE,EAAE,KAAK;AACX,EAAE,MAAM,EAAE;AACV,EAAE;AACF,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO;AACtC,EAAE,EAAE,EAAE,KAAK;AACX,EAAE,MAAM,EAAE;AACV,EAAE;AACF,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO;AAChC,EAAE,EAAE,EAAE,KAAK;AACX,EAAE,MAAM,EAAE;AACV,EAAE;AACF,CAAC,OAAO;AACR,EAAE,EAAE,EAAE,IAAI;AACV,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE;AACrC,EAAE;AACF;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,KAAK,EAAE;AACrC,CAAC,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC;AAC1C,CAAC,OAAO,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI;AACrC;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,eAAe,GAAG;AAC3B,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE;AACjC,CAAC,MAAM,KAAK,GAAG,aAAa,EAAE;AAC9B,CAAC,OAAO;AACR,EAAE,GAAG,KAAK,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;AACzB,EAAE,eAAe,EAAE;AACnB,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AAC3B,GAAG,GAAG,CAAC;AACP,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AAClB,GAAG,SAAS,EAAE;AACd,GAAG,CAAC;AACJ,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,GAAG;AAC/B,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE;AAC3C,CAAC,IAAI,QAAQ,KAAK,iBAAiB,EAAE;AACrC,EAAE,MAAM,KAAK,GAAG,aAAa,EAAE;AAC/B,EAAE,IAAI,KAAK,EAAE,OAAO,KAAK;AACzB,EAAE,OAAO,eAAe,EAAE;AAC1B,CAAC;AACD,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,UAAU,EAAE,OAAO,eAAe,EAAE;AACnE,CAAC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC;AACvD,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,eAAe,EAAE;AACrC,CAAC,OAAO;AACR,EAAE,GAAG,KAAK;AACV,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC;AACrB,EAAE,SAAS,EAAE;AACb,EAAE;AACF;AACA,SAAS,qBAAqB,CAAC,EAAE,EAAE;AACnC,CAAC,MAAM,IAAI,GAAG,QAAQ,EAAE;AACxB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,UAAU,EAAE,IAAI,CAAC,QAAQ,GAAG,IAAI;AACnD,MAAM,IAAI,EAAE,KAAK,iBAAiB,EAAE;AACpC,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC;AACxF,EAAE,IAAI,CAAC,QAAQ,GAAG,iBAAiB;AACnC,CAAC,CAAC,MAAM;AACR,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAC;AAC5F,EAAE,IAAI,CAAC,QAAQ,GAAG,EAAE;AACpB,CAAC;AACD,CAAC,SAAS,CAAC,IAAI,CAAC;AAChB,CAAC,OAAO,mBAAmB,EAAE;AAC7B;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,6BAA6B,GAAG,CAAC,iBAAiB,EAAE,qBAAqB;AAC7E;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,sBAAsB,CAAC,GAAG,EAAE;AACrC,CAAC,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;AAC/C;AACA,SAAS,iBAAiB,CAAC,IAAI,EAAE;AACjC,CAAC,IAAI,IAAI,KAAK,MAAM,EAAE;AACtB,CAAC,IAAI,CAAC,6BAA6B,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC;AAC9F;AACA,SAAS,aAAa,CAAC,KAAK,EAAE;AAC9B,CAAC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE;AACjC,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC;AACjD,CAAC,IAAI,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC;AAC1C,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC;AAC7D,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC;AAC9B,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,EAAE,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC;AAC5E,CAAC,MAAM,IAAI,GAAG,QAAQ,EAAE;AACxB,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,KAAK;AACP,EAAE,GAAG;AACL,EAAE,GAAG,KAAK,CAAC,QAAQ,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE;AACvD,EAAE,GAAG,KAAK,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG;AACzC,EAAE;AACF,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;AAC3B,CAAC,SAAS,CAAC,IAAI,CAAC;AAChB,CAAC,OAAO,KAAK;AACb;AACA,SAAS,gBAAgB,CAAC,EAAE,EAAE,KAAK,EAAE;AACrC,CAAC,IAAI,EAAE,KAAK,UAAU,EAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC;AAC3E,CAAC,IAAI,EAAE,KAAK,iBAAiB,EAAE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC;AAChI,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC;AAC9B,CAAC,MAAM,IAAI,GAAG,QAAQ,EAAE;AACxB,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;AACzD,CAAC,IAAI,GAAG,KAAK,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE;AACxC,CAAC,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,EAAE;AAC7B,EAAE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE;AAClC,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC;AACtD,EAAE,IAAI,CAAC,KAAK,GAAG,KAAK;AACpB,CAAC;AACD,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,EAAE;AAC3B,EAAE,MAAM,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC;AAC7C,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC;AAC9D,EAAE,IAAI,CAAC,GAAG,GAAG,GAAG;AAChB,CAAC;AACD,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,OAAO,IAAI,CAAC,QAAQ;AAClD,MAAM,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ;AAC5E,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI;AAClD,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE,IAAI,CAAC,GAAG,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;AACrF,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI;AAC3B,CAAC,SAAS,CAAC,IAAI,CAAC;AAChB,CAAC,OAAO,IAAI;AACZ;AACA,SAAS,gBAAgB,CAAC,EAAE,EAAE;AAC9B,CAAC,IAAI,EAAE,KAAK,UAAU,EAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC;AAC7E,CAAC,IAAI,EAAE,KAAK,iBAAiB,EAAE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC;AACjI,CAAC,MAAM,IAAI,GAAG,QAAQ,EAAE;AACxB,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;AACzD,CAAC,IAAI,GAAG,KAAK,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;AAC9B,CAAC,IAAI,IAAI,CAAC,QAAQ,KAAK,EAAE,EAAE,IAAI,CAAC,QAAQ,GAAG,IAAI;AAC/C,CAAC,SAAS,CAAC,IAAI,CAAC;AAChB;AACA,eAAe,aAAa,CAAC,QAAQ,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE;AAC9B,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE;AACxB,EAAE,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,yBAAyB;AACjE,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC5E,CAAC;AACD,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,KAAK,qBAAqB,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC,GAAG;AACpG,CAAC,IAAI;AACL,EAAE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;AACzC,GAAG,MAAM,EAAE,KAAK;AAChB,GAAG,OAAO;AACV,GAAG,QAAQ,EAAE,QAAQ;AACrB,GAAG,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG;AAClC,GAAG,CAAC;AACJ,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,OAAO;AACjE,GAAG,EAAE,EAAE,QAAQ,CAAC,EAAE;AAClB,GAAG,IAAI,EAAE,QAAQ,CAAC,KAAK;AACvB,GAAG,GAAG,EAAE,QAAQ,CAAC,GAAG;AACpB,GAAG,KAAK,EAAE,cAAc;AACxB,GAAG,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC;AACnC,GAAG;AACH,EAAE,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO;AAC7E,GAAG,EAAE,EAAE,QAAQ,CAAC,EAAE;AAClB,GAAG,IAAI,EAAE,QAAQ,CAAC,KAAK;AACvB,GAAG,GAAG,EAAE,QAAQ,CAAC,GAAG;AACpB,GAAG,KAAK,EAAE;AACV,GAAG;AACH,EAAE,OAAO;AACT,GAAG,EAAE,EAAE,QAAQ,CAAC,EAAE;AAClB,GAAG,IAAI,EAAE,QAAQ,CAAC,KAAK;AACvB,GAAG,GAAG,EAAE,QAAQ,CAAC,GAAG;AACpB,GAAG,KAAK,EAAE,aAAa;AACvB,GAAG,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC;AACnC,GAAG;AACH,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE;AACjB,EAAE,OAAO;AACT,GAAG,EAAE,EAAE,QAAQ,CAAC,EAAE;AAClB,GAAG,IAAI,EAAE,QAAQ,CAAC,KAAK;AACvB,GAAG,GAAG,EAAE,QAAQ,CAAC,GAAG;AACpB,GAAG,KAAK,EAAE,aAAa;AACvB,GAAG,MAAM,EAAE,KAAK,YAAY,KAAK,GAAG,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK;AAChE,GAAG;AACH,CAAC;AACD;AACA,eAAe,kBAAkB,GAAG;AACpC,CAAC,IAAI,iBAAiB,IAAI,iBAAiB,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AACnI,CAAC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;AACjG,CAAC,iBAAiB,GAAG;AACrB,EAAE,KAAK,EAAE,QAAQ;AACjB,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG;AAC1B,EAAE;AACF,CAAC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AACjD;;;;"}

package/build/server/chunks/environment-BYp8JQYM.js.map

@@ -1 +1 @@
-{"version":3,"file":"environment-BYp8JQYM.js","sources":["../../../.svelte-kit/adapter-node/chunks/environment.js"],"sourcesContent":["//#region ../../node_modules/.bun/@sveltejs+kit@2.61.0+a890f0b024b6eaa9/node_modules/@sveltejs/kit/src/runtime/app/paths/internal/server.js\nvar base = \"\";\nvar assets = base;\nvar app_dir = \"_app\";\nvar initial = {\n\tbase,\n\tassets\n};\n/**\n* `base` could be overridden during rendering to be relative;\n* this one's the original non-relative base path\n*/\nvar initial_base = initial.base;\n/**\n* @param {{ base: string, assets: string }} paths\n*/\nfunction override(paths) {\n\tbase = paths.base;\n\tassets = paths.assets;\n}\nfunction reset() {\n\tbase = initial.base;\n\tassets = initial.assets;\n}\n/** @param {string} path */\nfunction set_assets(path) {\n\tassets = initial.assets = path;\n}\n/**\n* `$env/dynamic/public`\n* @type {Record<string, string>}\n*/\nvar public_env = {};\n/** @type {(environment: Record<string, string>) => void} */\nfunction set_private_env(environment) {}\n/** @type {(environment: Record<string, string>) => void} */\nfunction set_public_env(environment) {\n\tpublic_env = environment;\n}\n//#endregion\n//#region \\0virtual:__sveltekit/environment\nvar version = \"0.13.0-beta.4\";\nvar prerendering = false;\nfunction set_building() {}\nfunction set_prerendering() {\n\tprerendering = true;\n}\n//#endregion\nexport { public_env as a, app_dir as c, initial_base as d, override as f, version as i, assets as l, set_assets as m, set_building as n, set_private_env as o, reset as p, set_prerendering as r, set_public_env as s, prerendering as t, base as u };\n"],"names":[],"mappings":"AAAA;AACG,IAAC,IAAI,GAAG;AACR,IAAC,MAAM,GAAG;AACV,IAAC,OAAO,GAAG;AACd,IAAI,OAAO,GAAG;AACd,CAAC,IAAI;AACL,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACG,IAAC,YAAY,GAAG,OAAO,CAAC;AAC3B;AACA;AACA;AACA,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI;AAClB,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;AACtB;AACA,SAAS,KAAK,GAAG;AACjB,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI;AACpB,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM;AACxB;AAKA;AACA;AACA;AACA;AACG,IAAC,UAAU,GAAG;AACjB;AACA,SAAS,eAAe,CAAC,WAAW,EAAE,CAAC;AACvC;AACA,SAAS,cAAc,CAAC,WAAW,EAAE;AACrC,CAAC,UAAU,GAAG,WAAW;AACzB;;;;"}
+{"version":3,"file":"environment-BYp8JQYM.js","sources":["../../../.svelte-kit/adapter-node/chunks/environment.js"],"sourcesContent":["//#region ../../node_modules/.bun/@sveltejs+kit@2.61.0+a890f0b024b6eaa9/node_modules/@sveltejs/kit/src/runtime/app/paths/internal/server.js\nvar base = \"\";\nvar assets = base;\nvar app_dir = \"_app\";\nvar initial = {\n\tbase,\n\tassets\n};\n/**\n* `base` could be overridden during rendering to be relative;\n* this one's the original non-relative base path\n*/\nvar initial_base = initial.base;\n/**\n* @param {{ base: string, assets: string }} paths\n*/\nfunction override(paths) {\n\tbase = paths.base;\n\tassets = paths.assets;\n}\nfunction reset() {\n\tbase = initial.base;\n\tassets = initial.assets;\n}\n/** @param {string} path */\nfunction set_assets(path) {\n\tassets = initial.assets = path;\n}\n/**\n* `$env/dynamic/public`\n* @type {Record<string, string>}\n*/\nvar public_env = {};\n/** @type {(environment: Record<string, string>) => void} */\nfunction set_private_env(environment) {}\n/** @type {(environment: Record<string, string>) => void} */\nfunction set_public_env(environment) {\n\tpublic_env = environment;\n}\n//#endregion\n//#region \\0virtual:__sveltekit/environment\nvar version = \"0.13.0-beta.6\";\nvar prerendering = false;\nfunction set_building() {}\nfunction set_prerendering() {\n\tprerendering = true;\n}\n//#endregion\nexport { public_env as a, app_dir as c, initial_base as d, override as f, version as i, assets as l, set_assets as m, set_building as n, set_private_env as o, reset as p, set_prerendering as r, set_public_env as s, prerendering as t, base as u };\n"],"names":[],"mappings":"AAAA;AACG,IAAC,IAAI,GAAG;AACR,IAAC,MAAM,GAAG;AACV,IAAC,OAAO,GAAG;AACd,IAAI,OAAO,GAAG;AACd,CAAC,IAAI;AACL,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACG,IAAC,YAAY,GAAG,OAAO,CAAC;AAC3B;AACA;AACA;AACA,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI;AAClB,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;AACtB;AACA,SAAS,KAAK,GAAG;AACjB,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI;AACpB,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM;AACxB;AAKA;AACA;AACA;AACA;AACG,IAAC,UAAU,GAAG;AACjB;AACA,SAAS,eAAe,CAAC,WAAW,EAAE,CAAC;AACvC;AACA,SAAS,cAAc,CAAC,WAAW,EAAE;AACrC,CAAC,UAAU,GAAG,WAAW;AACzB;;;;"}

package/build/server/chunks/{error.svelte-C2CWdm9K.js → error.svelte-DWK4R1_M.js}

@@ -1,10 +1,10 @@
 import { s as escape_html } from './dev-D85DamNs.js';
-import { p as page } from './state2-jnbE3tAu.js';
+import { p as page } from './state2-Cna2OZrd.js';
 import 'node:module';
-import './client-ClRLlB_c.js';
+import './client-Dn-H0hgG.js';
 import './exports2-BjzhbhYA.js';
 import './utils-OXHIhUb5.js';
-import './internal-D9Kp0SbJ.js';
+import './internal-BcbUGF7Z.js';
 import './chunk-DOvWTNp_.js';
 
 //#region ../../node_modules/.bun/@sveltejs+kit@2.61.0+a890f0b024b6eaa9/node_modules/@sveltejs/kit/src/runtime/components/svelte-5/error.svelte
@@ -15,4 +15,4 @@ function Error($$renderer, $$props) {
 }
 
 export { Error as default };
-//# sourceMappingURL=error.svelte-C2CWdm9K.js.map
+//# sourceMappingURL=error.svelte-DWK4R1_M.js.map

package/build/server/chunks/{error.svelte-C2CWdm9K.js.map → error.svelte-DWK4R1_M.js.map}

@@ -1 +1 @@
-{"version":3,"file":"error.svelte-C2CWdm9K.js","sources":["../../../.svelte-kit/adapter-node/entries/fallbacks/error.svelte.js"],"sourcesContent":["import { U as escape_html } from \"../../chunks/dev.js\";\nimport { t as page } from \"../../chunks/state2.js\";\n//#region ../../node_modules/.bun/@sveltejs+kit@2.61.0+a890f0b024b6eaa9/node_modules/@sveltejs/kit/src/runtime/components/svelte-5/error.svelte\nfunction Error($$renderer, $$props) {\n\t$$renderer.component(($$renderer) => {\n\t\t$$renderer.push(`<h1>${escape_html(page.status)}</h1> <p>${escape_html(page.error?.message)}</p>`);\n\t});\n}\n//#endregion\nexport { Error as default };\n"],"names":[],"mappings":";;;;;;;;;AAEA;AACA,SAAS,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE;AACpC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,KAAK;AACtC,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;AACpG,CAAC,CAAC,CAAC;AACH;;;;"}
+{"version":3,"file":"error.svelte-DWK4R1_M.js","sources":["../../../.svelte-kit/adapter-node/entries/fallbacks/error.svelte.js"],"sourcesContent":["import { U as escape_html } from \"../../chunks/dev.js\";\nimport { t as page } from \"../../chunks/state2.js\";\n//#region ../../node_modules/.bun/@sveltejs+kit@2.61.0+a890f0b024b6eaa9/node_modules/@sveltejs/kit/src/runtime/components/svelte-5/error.svelte\nfunction Error($$renderer, $$props) {\n\t$$renderer.component(($$renderer) => {\n\t\t$$renderer.push(`<h1>${escape_html(page.status)}</h1> <p>${escape_html(page.error?.message)}</p>`);\n\t});\n}\n//#endregion\nexport { Error as default };\n"],"names":[],"mappings":";;;;;;;;;AAEA;AACA,SAAS,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE;AACpC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,KAAK;AACtC,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;AACpG,CAAC,CAAC,CAAC;AACH;;;;"}

package/build/server/chunks/{features-BE2x1a_a.js → features-BW-bVsl8.js}

@@ -1,7 +1,7 @@
-import { aR as resolveClientAppPort, P as PLATFORM_VERSION } from './src-CQ2F7hgb.js';
+import { aL as resolveClientAppPort, P as PLATFORM_VERSION } from './src-DbArH65P.js';
 
 var package_default = {
-	version: "0.13.0-beta.4"};
+	version: "0.13.0-beta.6"};
 //#endregion
 //#region src/lib/server/features.ts
 /**
@@ -115,4 +115,4 @@ function computeServerRuntimeContext(event) {
 }
 
 export { computeServerRuntimeContext as c };
-//# sourceMappingURL=features-BE2x1a_a.js.map
+//# sourceMappingURL=features-BW-bVsl8.js.map

package/build/server/chunks/{features-BE2x1a_a.js.map → features-BW-bVsl8.js.map}

@@ -1 +1 @@
-{"version":3,"file":"features-BE2x1a_a.js","sources":["../../../.svelte-kit/adapter-node/chunks/features.js"],"sourcesContent":["import { ht as PLATFORM_VERSION } from \"./compose-args.js\";\nimport { t as resolveClientAppPort } from \"./src.js\";\nvar package_default = {\n\tname: \"@openpalm/ui\",\n\tdescription: \"SvelteKit web UI and API for OpenPalm stack management\",\n\tversion: \"0.13.0-beta.4\",\n\tlicense: \"MPL-2.0\",\n\ttype: \"module\",\n\t\"//minHarnessContract\": \"Minimum native Electron harness contract this UI build requires (design §5.3). The harness refuses to self-update onto a build whose minHarnessContract exceeds the contract it provides and prompts an app re-download instead. Bump ONLY when the UI starts depending on a new IPC method / spawn env key; keep in lockstep with packages/electron/src/harness-contract.ts HARNESS_CONTRACT_VERSION.\",\n\tminHarnessContract: 1,\n\trepository: {\n\t\t\"type\": \"git\",\n\t\t\"url\": \"https://github.com/itlackey/openpalm.git\",\n\t\t\"directory\": \"packages/ui\"\n\t},\n\tpublishConfig: { \"access\": \"public\" },\n\tfiles: [\"build\"],\n\tscripts: {\n\t\t\"dev\": \"PORT=${PORT:-5173} vite dev\",\n\t\t\"ux:audit\": \"NODE_PATH=\\\"$PWD/node_modules\\\" bun \\\"${AKM_HOME:-$HOME/akm}/skills/web-ux/ux-dom-audit/scripts/audit.ts\\\" e2e/ux-audit.config.json\",\n\t\t\"ux:audit:wizard\": \"NODE_PATH=\\\"$PWD/node_modules\\\" bun \\\"${AKM_HOME:-$HOME/akm}/skills/web-ux/ux-dom-audit/scripts/audit.ts\\\" e2e/ux-audit.wizard.config.json\",\n\t\t\"dev:local\": \"PORT=${PORT:-5173} OP_OPENCODE_URL=${OP_OPENCODE_URL:-http://localhost:3800} vite dev\",\n\t\t\"build\": \"svelte-kit sync && vite build && node scripts/stamp-version.mjs\",\n\t\t\"clean:build\": \"rm -rf .svelte-kit build\",\n\t\t\"preview\": \"vite preview\",\n\t\t\"check\": \"svelte-kit sync && svelte-check --tsconfig ./tsconfig.json\",\n\t\t\"test:e2e\": \"playwright test\",\n\t\t\"test\": \"npm run test:unit -- --run && npm run test:e2e\",\n\t\t\"test:unit\": \"vitest\",\n\t\t\"test:browsers\": \"playwright install --with-deps chromium\",\n\t\t\"lint\": \"eslint .\",\n\t\t\"format\": \"prettier --write .\",\n\t\t\"start\": \"node build/index.js\"\n\t},\n\tdevDependencies: {\n\t\t\"@axe-core/playwright\": \"^4.11.3\",\n\t\t\"@eslint/compat\": \"^2.0.2\",\n\t\t\"@eslint/js\": \"^10.0.1\",\n\t\t\"@openpalm/lib\": \"workspace:*\",\n\t\t\"@openpalm/ui-kit\": \"workspace:*\",\n\t\t\"@playwright/test\": \"^1.58.1\",\n\t\t\"@sveltejs/adapter-node\": \"^5.5.4\",\n\t\t\"@sveltejs/kit\": \"^2.53.3\",\n\t\t\"@sveltejs/vite-plugin-svelte\": \"^7.1.2\",\n\t\t\"@types/markdown-it\": \"^14.1.2\",\n\t\t\"@types/node\": \"^25.9.1\",\n\t\t\"@vitest/browser-playwright\": \"^4.0.18\",\n\t\t\"@vitest/coverage-v8\": \"^4.0.18\",\n\t\t\"croner\": \"^10.0.1\",\n\t\t\"dotenv\": \"^17.4.2\",\n\t\t\"eslint\": \"^10.4.0\",\n\t\t\"eslint-config-prettier\": \"^10.1.8\",\n\t\t\"eslint-plugin-svelte\": \"^3.14.0\",\n\t\t\"globals\": \"^17.3.0\",\n\t\t\"markdown-it\": \"^14.1.1\",\n\t\t\"playwright\": \"^1.58.1\",\n\t\t\"prettier\": \"^3.8.1\",\n\t\t\"prettier-plugin-svelte\": \"^4.0.1\",\n\t\t\"svelte\": \"^5.53.5\",\n\t\t\"svelte-check\": \"^4.1.1\",\n\t\t\"typescript\": \"^6.0.3\",\n\t\t\"typescript-eslint\": \"^8.54.0\",\n\t\t\"uqr\": \"0.1.3\",\n\t\t\"vite\": \"^8.0.14\",\n\t\t\"vite-plugin-devtools-json\": \"^1.0.0\",\n\t\t\"vitest\": \"^4.0.18\",\n\t\t\"vitest-browser-svelte\": \"^2.0.2\",\n\t\t\"yaml\": \"^2.8.0\"\n\t}\n};\n//#endregion\n//#region src/lib/server/features.ts\n/**\n* Server runtime context — RuntimeContext v2 (plan ui-runtime-modes-plan.md\n* §6.1, issue #509). Computed server-side on every request via\n* +layout.server.ts and served publicly at GET /api/runtime (the\n* contract-version handshake for remote/hosted clients).\n*\n* hostMode resolution (Phase 1):\n*   OP_UI_HOST_MODE (explicit) → that mode\n*   else OP_INSIDE_ELECTRON=1  → 'electron-host' (legacy, injected by\n*                                 packages/electron/src/main.ts)\n*   else OP_ENABLE_ADMIN=1     → 'host-ui' (legacy, local dev / openpalm admin)\n*   else                       → 'pwa-static' baseline\n*/\nvar HOST_MODES = [\n\t\"electron-host\",\n\t\"host-ui\",\n\t\"assistant-container\",\n\t\"pwa-static\"\n];\nfunction isUiHostMode(value) {\n\treturn HOST_MODES.includes(value);\n}\nfunction resolveHostMode() {\n\tconst explicit = process.env.OP_UI_HOST_MODE?.trim() ?? \"\";\n\tif (isUiHostMode(explicit)) return explicit;\n\tif (process.env.OP_INSIDE_ELECTRON === \"1\") return \"electron-host\";\n\tif (process.env.OP_ENABLE_ADMIN === \"1\") return \"host-ui\";\n\treturn \"pwa-static\";\n}\n/** Capabilities of a host-capable process (electron-host / host-ui). Note:\n*  never 'connections:single' — that marker is the assistant-container\n*  branch key in resolveCapabilities() (plan §6.2). */\nvar HOST_MODE_CAPABILITIES = [\n\t\"chat\",\n\t\"connections:read\",\n\t\"connections:manage\",\n\t\"connections:switch\",\n\t\"assistant-settings:read\",\n\t\"assistant-settings:write\",\n\t...[\n\t\t\"host:setup\",\n\t\t\"host:stack:read\",\n\t\t\"host:stack:write\",\n\t\t\"host:containers\",\n\t\t\"host:addons\",\n\t\t\"host:updates\",\n\t\t\"host:logs\",\n\t\t\"host:secrets\",\n\t\t\"host:recovery\",\n\t\t\"host:akm-sharing\"\n\t]\n];\nvar SERVER_CAPABILITIES = {\n\t\"electron-host\": HOST_MODE_CAPABILITIES,\n\t\"host-ui\": HOST_MODE_CAPABILITIES,\n\t\"assistant-container\": [\n\t\t\"connections:single\",\n\t\t\"chat\",\n\t\t\"assistant-settings:read\",\n\t\t\"assistant-settings:write\"\n\t],\n\t\"pwa-static\": [\n\t\t\"chat\",\n\t\t\"connections:read\",\n\t\t\"connections:manage\",\n\t\t\"connections:switch\",\n\t\t\"pwa:install\"\n\t]\n};\n/** Route pointers per mode — current-truth URLs. Phase 2 (#486) moved\n*  connections to /connections; Phase 4 moved the host dashboard to /host\n*  (/admin/* is a dead namespace — router 404, no alias). */\nfunction routesForMode(mode) {\n\tswitch (mode) {\n\t\tcase \"electron-host\":\n\t\tcase \"host-ui\": return {\n\t\t\tchat: \"/chat\",\n\t\t\tconnections: \"/connections\",\n\t\t\thost: \"/host\",\n\t\t\tsetup: \"/setup\"\n\t\t};\n\t\tcase \"assistant-container\": return { chat: \"/chat\" };\n\t\tcase \"pwa-static\": return {\n\t\t\tchat: \"/chat\",\n\t\t\tconnections: \"/connections\"\n\t\t};\n\t}\n}\nfunction computeServerRuntimeContext(event) {\n\tconst hostMode = resolveHostMode();\n\tconst isHostCapable = hostMode === \"electron-host\" || hostMode === \"host-ui\";\n\tconst clientAppUrl = hostMode === \"assistant-container\" ? void 0 : `http://127.0.0.1:${resolveClientAppPort(process.env)}`;\n\treturn {\n\t\tversion: 2,\n\t\thostMode,\n\t\tserverCapabilities: [...SERVER_CAPABILITIES[hostMode]],\n\t\tpublicBaseUrl: event.url?.origin ?? \"\",\n\t\tuiVersion: package_default.version,\n\t\tskeletonVersion: process.env.OP_SKELETON_VERSION?.trim() || PLATFORM_VERSION,\n\t\tactiveConnectionMode: hostMode === \"assistant-container\" ? \"single\" : \"multi\",\n\t\t...clientAppUrl !== void 0 ? { clientAppUrl } : {},\n\t\troutes: routesForMode(hostMode),\n\t\tsecurity: {\n\t\t\thostAdminLoopbackOnly: true,\n\t\t\trequiresHttpsForRemoteConnections: hostMode === \"pwa-static\",\n\t\t\tcsrfMode: isHostCapable ? \"loopback-origin\" : hostMode === \"assistant-container\" ? \"same-site\" : \"bearer-token\"\n\t\t}\n\t};\n}\n//#endregion\nexport { computeServerRuntimeContext as t };\n"],"names":[],"mappings":";;AAEA,IAAI,eAAe,GAAG;AACtB,CAEC,OAAO,EAAE,eAgEV,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,UAAU,GAAG;AACjB,CAAC,eAAe;AAChB,CAAC,SAAS;AACV,CAAC,qBAAqB;AACtB,CAAC;AACD,CAAC;AACD,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,OAAO,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;AAClC;AACA,SAAS,eAAe,GAAG;AAC3B,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE;AAC3D,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,OAAO,QAAQ;AAC5C,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG,EAAE,OAAO,eAAe;AACnE,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,GAAG,EAAE,OAAO,SAAS;AAC1D,CAAC,OAAO,YAAY;AACpB;AACA;AACA;AACA;AACA,IAAI,sBAAsB,GAAG;AAC7B,CAAC,MAAM;AACP,CAAC,kBAAkB;AACnB,CAAC,oBAAoB;AACrB,CAAC,oBAAoB;AACrB,CAAC,yBAAyB;AAC1B,CAAC,0BAA0B;AAC3B,CAAC,GAAG;AACJ,EAAE,YAAY;AACd,EAAE,iBAAiB;AACnB,EAAE,kBAAkB;AACpB,EAAE,iBAAiB;AACnB,EAAE,aAAa;AACf,EAAE,cAAc;AAChB,EAAE,WAAW;AACb,EAAE,cAAc;AAChB,EAAE,eAAe;AACjB,EAAE;AACF;AACA,CAAC;AACD,IAAI,mBAAmB,GAAG;AAC1B,CAAC,eAAe,EAAE,sBAAsB;AACxC,CAAC,SAAS,EAAE,sBAAsB;AAClC,CAAC,qBAAqB,EAAE;AACxB,EAAE,oBAAoB;AACtB,EAAE,MAAM;AACR,EAAE,yBAAyB;AAC3B,EAAE;AACF,EAAE;AACF,CAAC,YAAY,EAAE;AACf,EAAE,MAAM;AACR,EAAE,kBAAkB;AACpB,EAAE,oBAAoB;AACtB,EAAE,oBAAoB;AACtB,EAAE;AACF;AACA,CAAC;AACD;AACA;AACA;AACA,SAAS,aAAa,CAAC,IAAI,EAAE;AAC7B,CAAC,QAAQ,IAAI;AACb,EAAE,KAAK,eAAe;AACtB,EAAE,KAAK,SAAS,EAAE,OAAO;AACzB,GAAG,IAAI,EAAE,OAAO;AAChB,GAAG,WAAW,EAAE,cAAc;AAC9B,GAAG,IAAI,EAAE,OAAO;AAChB,GAAG,KAAK,EAAE;AACV,GAAG;AACH,EAAE,KAAK,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;AACtD,EAAE,KAAK,YAAY,EAAE,OAAO;AAC5B,GAAG,IAAI,EAAE,OAAO;AAChB,GAAG,WAAW,EAAE;AAChB,GAAG;AACH;AACA;AACA,SAAS,2BAA2B,CAAC,KAAK,EAAE;AAC5C,CAAC,MAAM,QAAQ,GAAG,eAAe,EAAE;AACnC,CAAC,MAAM,aAAa,GAAG,QAAQ,KAAK,eAAe,IAAI,QAAQ,KAAK,SAAS;AAC7E,CAAC,MAAM,YAAY,GAAG,QAAQ,KAAK,qBAAqB,GAAG,MAAM,GAAG,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3H,CAAC,OAAO;AACR,EAAE,OAAO,EAAE,CAAC;AACZ,EAAE,QAAQ;AACV,EAAE,kBAAkB,EAAE,CAAC,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AACxD,EAAE,aAAa,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE;AACxC,EAAE,SAAS,EAAE,eAAe,CAAC,OAAO;AACpC,EAAE,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,gBAAgB;AAC9E,EAAE,oBAAoB,EAAE,QAAQ,KAAK,qBAAqB,GAAG,QAAQ,GAAG,OAAO;AAC/E,EAAE,GAAG,YAAY,KAAK,MAAM,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE;AACpD,EAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC;AACjC,EAAE,QAAQ,EAAE;AACZ,GAAG,qBAAqB,EAAE,IAAI;AAC9B,GAAG,iCAAiC,EAAE,QAAQ,KAAK,YAAY;AAC/D,GAAG,QAAQ,EAAE,aAAa,GAAG,iBAAiB,GAAG,QAAQ,KAAK,qBAAqB,GAAG,WAAW,GAAG;AACpG;AACA,EAAE;AACF;;;;"}
+{"version":3,"file":"features-BW-bVsl8.js","sources":["../../../.svelte-kit/adapter-node/chunks/features.js"],"sourcesContent":["import { mt as PLATFORM_VERSION } from \"./compose-args.js\";\nimport { r as resolveClientAppPort } from \"./src.js\";\nvar package_default = {\n\tname: \"@openpalm/ui\",\n\tdescription: \"SvelteKit web UI and API for OpenPalm stack management\",\n\tversion: \"0.13.0-beta.6\",\n\tlicense: \"MPL-2.0\",\n\ttype: \"module\",\n\t\"//minHarnessContract\": \"Minimum native Electron harness contract this UI build requires (design §5.3). The harness refuses to self-update onto a build whose minHarnessContract exceeds the contract it provides and prompts an app re-download instead. Bump ONLY when the UI starts depending on a new IPC method / spawn env key; keep in lockstep with packages/electron/src/harness-contract.ts HARNESS_CONTRACT_VERSION.\",\n\tminHarnessContract: 1,\n\trepository: {\n\t\t\"type\": \"git\",\n\t\t\"url\": \"https://github.com/itlackey/openpalm.git\",\n\t\t\"directory\": \"packages/ui\"\n\t},\n\tpublishConfig: { \"access\": \"public\" },\n\tfiles: [\"build\"],\n\tscripts: {\n\t\t\"dev\": \"PORT=${PORT:-5173} vite dev\",\n\t\t\"ux:audit\": \"NODE_PATH=\\\"$PWD/node_modules\\\" bun \\\"${AKM_HOME:-$HOME/akm}/skills/web-ux/ux-dom-audit/scripts/audit.ts\\\" e2e/ux-audit.config.json\",\n\t\t\"ux:audit:wizard\": \"NODE_PATH=\\\"$PWD/node_modules\\\" bun \\\"${AKM_HOME:-$HOME/akm}/skills/web-ux/ux-dom-audit/scripts/audit.ts\\\" e2e/ux-audit.wizard.config.json\",\n\t\t\"dev:local\": \"PORT=${PORT:-5173} OP_OPENCODE_URL=${OP_OPENCODE_URL:-http://localhost:3800} vite dev\",\n\t\t\"build\": \"svelte-kit sync && vite build && node scripts/stamp-version.mjs\",\n\t\t\"clean:build\": \"rm -rf .svelte-kit build\",\n\t\t\"preview\": \"vite preview\",\n\t\t\"check\": \"svelte-kit sync && svelte-check --tsconfig ./tsconfig.json\",\n\t\t\"test:e2e\": \"playwright test\",\n\t\t\"test\": \"npm run test:unit -- --run && npm run test:e2e\",\n\t\t\"test:unit\": \"vitest\",\n\t\t\"test:browsers\": \"playwright install --with-deps chromium\",\n\t\t\"lint\": \"eslint .\",\n\t\t\"format\": \"prettier --write .\",\n\t\t\"start\": \"node build/index.js\"\n\t},\n\tdevDependencies: {\n\t\t\"@axe-core/playwright\": \"^4.11.3\",\n\t\t\"@eslint/compat\": \"^2.0.2\",\n\t\t\"@eslint/js\": \"^10.0.1\",\n\t\t\"@openpalm/lib\": \"workspace:*\",\n\t\t\"@openpalm/ui-kit\": \"workspace:*\",\n\t\t\"@playwright/test\": \"^1.58.1\",\n\t\t\"@sveltejs/adapter-node\": \"^5.5.4\",\n\t\t\"@sveltejs/kit\": \"^2.53.3\",\n\t\t\"@sveltejs/vite-plugin-svelte\": \"^7.1.2\",\n\t\t\"@types/markdown-it\": \"^14.1.2\",\n\t\t\"@types/node\": \"^25.9.1\",\n\t\t\"@vitest/browser-playwright\": \"^4.0.18\",\n\t\t\"@vitest/coverage-v8\": \"^4.0.18\",\n\t\t\"croner\": \"^10.0.1\",\n\t\t\"dotenv\": \"^17.4.2\",\n\t\t\"eslint\": \"^10.4.0\",\n\t\t\"eslint-config-prettier\": \"^10.1.8\",\n\t\t\"eslint-plugin-svelte\": \"^3.14.0\",\n\t\t\"globals\": \"^17.3.0\",\n\t\t\"markdown-it\": \"^14.1.1\",\n\t\t\"playwright\": \"^1.58.1\",\n\t\t\"prettier\": \"^3.8.1\",\n\t\t\"prettier-plugin-svelte\": \"^4.0.1\",\n\t\t\"svelte\": \"^5.53.5\",\n\t\t\"svelte-check\": \"^4.1.1\",\n\t\t\"typescript\": \"^6.0.3\",\n\t\t\"typescript-eslint\": \"^8.54.0\",\n\t\t\"uqr\": \"0.1.3\",\n\t\t\"vite\": \"^8.0.14\",\n\t\t\"vite-plugin-devtools-json\": \"^1.0.0\",\n\t\t\"vitest\": \"^4.0.18\",\n\t\t\"vitest-browser-svelte\": \"^2.0.2\",\n\t\t\"yaml\": \"^2.8.0\"\n\t}\n};\n//#endregion\n//#region src/lib/server/features.ts\n/**\n* Server runtime context — RuntimeContext v2 (plan ui-runtime-modes-plan.md\n* §6.1, issue #509). Computed server-side on every request via\n* +layout.server.ts and served publicly at GET /api/runtime (the\n* contract-version handshake for remote/hosted clients).\n*\n* hostMode resolution (Phase 1):\n*   OP_UI_HOST_MODE (explicit) → that mode\n*   else OP_INSIDE_ELECTRON=1  → 'electron-host' (legacy, injected by\n*                                 packages/electron/src/main.ts)\n*   else OP_ENABLE_ADMIN=1     → 'host-ui' (legacy, local dev / openpalm admin)\n*   else                       → 'pwa-static' baseline\n*/\nvar HOST_MODES = [\n\t\"electron-host\",\n\t\"host-ui\",\n\t\"assistant-container\",\n\t\"pwa-static\"\n];\nfunction isUiHostMode(value) {\n\treturn HOST_MODES.includes(value);\n}\nfunction resolveHostMode() {\n\tconst explicit = process.env.OP_UI_HOST_MODE?.trim() ?? \"\";\n\tif (isUiHostMode(explicit)) return explicit;\n\tif (process.env.OP_INSIDE_ELECTRON === \"1\") return \"electron-host\";\n\tif (process.env.OP_ENABLE_ADMIN === \"1\") return \"host-ui\";\n\treturn \"pwa-static\";\n}\n/** Capabilities of a host-capable process (electron-host / host-ui). Note:\n*  never 'connections:single' — that marker is the assistant-container\n*  branch key in resolveCapabilities() (plan §6.2). */\nvar HOST_MODE_CAPABILITIES = [\n\t\"chat\",\n\t\"connections:read\",\n\t\"connections:manage\",\n\t\"connections:switch\",\n\t\"assistant-settings:read\",\n\t\"assistant-settings:write\",\n\t...[\n\t\t\"host:setup\",\n\t\t\"host:stack:read\",\n\t\t\"host:stack:write\",\n\t\t\"host:containers\",\n\t\t\"host:addons\",\n\t\t\"host:updates\",\n\t\t\"host:logs\",\n\t\t\"host:secrets\",\n\t\t\"host:recovery\",\n\t\t\"host:akm-sharing\"\n\t]\n];\nvar SERVER_CAPABILITIES = {\n\t\"electron-host\": HOST_MODE_CAPABILITIES,\n\t\"host-ui\": HOST_MODE_CAPABILITIES,\n\t\"assistant-container\": [\n\t\t\"connections:single\",\n\t\t\"chat\",\n\t\t\"assistant-settings:read\",\n\t\t\"assistant-settings:write\"\n\t],\n\t\"pwa-static\": [\n\t\t\"chat\",\n\t\t\"connections:read\",\n\t\t\"connections:manage\",\n\t\t\"connections:switch\",\n\t\t\"pwa:install\"\n\t]\n};\n/** Route pointers per mode — current-truth URLs. Phase 2 (#486) moved\n*  connections to /connections; Phase 4 moved the host dashboard to /host\n*  (/admin/* is a dead namespace — router 404, no alias). */\nfunction routesForMode(mode) {\n\tswitch (mode) {\n\t\tcase \"electron-host\":\n\t\tcase \"host-ui\": return {\n\t\t\tchat: \"/chat\",\n\t\t\tconnections: \"/connections\",\n\t\t\thost: \"/host\",\n\t\t\tsetup: \"/setup\"\n\t\t};\n\t\tcase \"assistant-container\": return { chat: \"/chat\" };\n\t\tcase \"pwa-static\": return {\n\t\t\tchat: \"/chat\",\n\t\t\tconnections: \"/connections\"\n\t\t};\n\t}\n}\nfunction computeServerRuntimeContext(event) {\n\tconst hostMode = resolveHostMode();\n\tconst isHostCapable = hostMode === \"electron-host\" || hostMode === \"host-ui\";\n\tconst clientAppUrl = hostMode === \"assistant-container\" ? void 0 : `http://127.0.0.1:${resolveClientAppPort(process.env)}`;\n\treturn {\n\t\tversion: 2,\n\t\thostMode,\n\t\tserverCapabilities: [...SERVER_CAPABILITIES[hostMode]],\n\t\tpublicBaseUrl: event.url?.origin ?? \"\",\n\t\tuiVersion: package_default.version,\n\t\tskeletonVersion: process.env.OP_SKELETON_VERSION?.trim() || PLATFORM_VERSION,\n\t\tactiveConnectionMode: hostMode === \"assistant-container\" ? \"single\" : \"multi\",\n\t\t...clientAppUrl !== void 0 ? { clientAppUrl } : {},\n\t\troutes: routesForMode(hostMode),\n\t\tsecurity: {\n\t\t\thostAdminLoopbackOnly: true,\n\t\t\trequiresHttpsForRemoteConnections: hostMode === \"pwa-static\",\n\t\t\tcsrfMode: isHostCapable ? \"loopback-origin\" : hostMode === \"assistant-container\" ? \"same-site\" : \"bearer-token\"\n\t\t}\n\t};\n}\n//#endregion\nexport { computeServerRuntimeContext as t };\n"],"names":[],"mappings":";;AAEA,IAAI,eAAe,GAAG;AACtB,CAEC,OAAO,EAAE,eAgEV,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,UAAU,GAAG;AACjB,CAAC,eAAe;AAChB,CAAC,SAAS;AACV,CAAC,qBAAqB;AACtB,CAAC;AACD,CAAC;AACD,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,OAAO,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;AAClC;AACA,SAAS,eAAe,GAAG;AAC3B,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE;AAC3D,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,OAAO,QAAQ;AAC5C,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG,EAAE,OAAO,eAAe;AACnE,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,GAAG,EAAE,OAAO,SAAS;AAC1D,CAAC,OAAO,YAAY;AACpB;AACA;AACA;AACA;AACA,IAAI,sBAAsB,GAAG;AAC7B,CAAC,MAAM;AACP,CAAC,kBAAkB;AACnB,CAAC,oBAAoB;AACrB,CAAC,oBAAoB;AACrB,CAAC,yBAAyB;AAC1B,CAAC,0BAA0B;AAC3B,CAAC,GAAG;AACJ,EAAE,YAAY;AACd,EAAE,iBAAiB;AACnB,EAAE,kBAAkB;AACpB,EAAE,iBAAiB;AACnB,EAAE,aAAa;AACf,EAAE,cAAc;AAChB,EAAE,WAAW;AACb,EAAE,cAAc;AAChB,EAAE,eAAe;AACjB,EAAE;AACF;AACA,CAAC;AACD,IAAI,mBAAmB,GAAG;AAC1B,CAAC,eAAe,EAAE,sBAAsB;AACxC,CAAC,SAAS,EAAE,sBAAsB;AAClC,CAAC,qBAAqB,EAAE;AACxB,EAAE,oBAAoB;AACtB,EAAE,MAAM;AACR,EAAE,yBAAyB;AAC3B,EAAE;AACF,EAAE;AACF,CAAC,YAAY,EAAE;AACf,EAAE,MAAM;AACR,EAAE,kBAAkB;AACpB,EAAE,oBAAoB;AACtB,EAAE,oBAAoB;AACtB,EAAE;AACF;AACA,CAAC;AACD;AACA;AACA;AACA,SAAS,aAAa,CAAC,IAAI,EAAE;AAC7B,CAAC,QAAQ,IAAI;AACb,EAAE,KAAK,eAAe;AACtB,EAAE,KAAK,SAAS,EAAE,OAAO;AACzB,GAAG,IAAI,EAAE,OAAO;AAChB,GAAG,WAAW,EAAE,cAAc;AAC9B,GAAG,IAAI,EAAE,OAAO;AAChB,GAAG,KAAK,EAAE;AACV,GAAG;AACH,EAAE,KAAK,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;AACtD,EAAE,KAAK,YAAY,EAAE,OAAO;AAC5B,GAAG,IAAI,EAAE,OAAO;AAChB,GAAG,WAAW,EAAE;AAChB,GAAG;AACH;AACA;AACA,SAAS,2BAA2B,CAAC,KAAK,EAAE;AAC5C,CAAC,MAAM,QAAQ,GAAG,eAAe,EAAE;AACnC,CAAC,MAAM,aAAa,GAAG,QAAQ,KAAK,eAAe,IAAI,QAAQ,KAAK,SAAS;AAC7E,CAAC,MAAM,YAAY,GAAG,QAAQ,KAAK,qBAAqB,GAAG,MAAM,GAAG,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3H,CAAC,OAAO;AACR,EAAE,OAAO,EAAE,CAAC;AACZ,EAAE,QAAQ;AACV,EAAE,kBAAkB,EAAE,CAAC,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AACxD,EAAE,aAAa,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE;AACxC,EAAE,SAAS,EAAE,eAAe,CAAC,OAAO;AACpC,EAAE,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,gBAAgB;AAC9E,EAAE,oBAAoB,EAAE,QAAQ,KAAK,qBAAqB,GAAG,QAAQ,GAAG,OAAO;AAC/E,EAAE,GAAG,YAAY,KAAK,MAAM,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE;AACpD,EAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC;AACjC,EAAE,QAAQ,EAAE;AACZ,GAAG,qBAAqB,EAAE,IAAI;AAC9B,GAAG,iCAAiC,EAAE,QAAQ,KAAK,YAAY;AAC/D,GAAG,QAAQ,EAAE,aAAa,GAAG,iBAAiB,GAAG,QAAQ,KAAK,qBAAqB,GAAG,WAAW,GAAG;AACpG;AACA,EAAE;AACF;;;;"}

package/build/server/chunks/{helpers-CfpNg3il.js → helpers-DxodR6tq.js}

@@ -1,7 +1,7 @@
-import { aA as readSecret, aX as resolveOpenPalmHome, G as createOpenCodeClient } from './src-CQ2F7hgb.js';
+import { au as readSecret, aP as resolveOpenPalmHome, F as createOpenCodeClient } from './src-DbArH65P.js';
 import { h as isRemoteSetupAllowed } from './network-preset-CJ1RRnki.js';
-import { g as getActiveConnection } from './endpoints-WTxemTcn.js';
-import { c as computeServerRuntimeContext } from './features-BE2x1a_a.js';
+import { g as getActiveConnection } from './endpoints-IFTldlrt.js';
+import { c as computeServerRuntimeContext } from './features-BW-bVsl8.js';
 import { timingSafeEqual, createHmac, createHash } from 'node:crypto';
 
 //#region src/lib/server/session-store.ts
@@ -322,4 +322,4 @@ function checkOriginHeader(request, csrfMode = "loopback-origin", requestId) {
 Number(process.env.PORT ?? 3880);
 
 export { SESSION_TTL_SECONDS as S, checkOriginHeader as a, createSession as b, checkHostHeader as c, getRequestId as d, errorResponse as e, getUiLoginPassword as f, getOpenCodeClient as g, invalidateSession as h, identifyCallerByToken as i, jsonBodyError as j, jsonResponse as k, requireCapability as l, parseJsonBody as p, requireAdmin as r, safeTokenCompare as s, touchSession as t, withAdminBody as w };
-//# sourceMappingURL=helpers-CfpNg3il.js.map
+//# sourceMappingURL=helpers-DxodR6tq.js.map

package/build/server/chunks/{helpers-CfpNg3il.js.map → helpers-DxodR6tq.js.map}

@@ -1 +1 @@
-{"version":3,"file":"helpers-CfpNg3il.js","sources":["../../../.svelte-kit/adapter-node/chunks/helpers.js"],"sourcesContent":["import { Tt as resolveOpenPalmHome, at as readSecret } from \"./compose-args.js\";\nimport { K as createOpenCodeClient } from \"./src.js\";\nimport { l as isRemoteSetupAllowed } from \"./network-preset.js\";\nimport { i as getActiveConnection } from \"./endpoints.js\";\nimport { t as computeServerRuntimeContext } from \"./features.js\";\nimport { createHash, createHmac, timingSafeEqual } from \"node:crypto\";\n//#region src/lib/server/session-store.ts\n/**\n* Stateless signed session tokens.\n*\n* Token format: `<expiresAt>.<hmac-sha256-hex>`\n*   expiresAt — unix ms timestamp when the session expires\n*   signature — HMAC-SHA256(expiresAt, login password)\n*\n* Tokens are self-validating: the server holds no per-session state and\n* sessions survive UI server restarts. Signing with the login password means\n* a password change invalidates all existing sessions — correct behaviour.\n*\n* The signing secret is resolved exactly like login verification\n* (`getUiLoginPassword`): `process.env.OP_UI_LOGIN_PASSWORD` first, then the\n* on-disk stack secret. When NEITHER exists, minting throws and validation\n* fails closed — there is deliberately no fallback secret, because a constant\n* key would let anyone forge an admin token. Reading the file per call also\n* means tokens minted right after the setup wizard writes the password are\n* signed with the real secret, without waiting for a process restart.\n*\n* Logout semantics (known trade-off of stateless tokens): logout revokes the\n* single token the browser presented (in-memory list, cleared on restart) and\n* clears the cookie. Earlier tokens issued to the same browser by sliding\n* renewal remain cryptographically valid until they expire — logout is\n* \"forget my cookie\", not \"kill every credential ever issued\". A real\n* kill-switch is changing the login password, which invalidates everything.\n*/\n/** Session lifetime for both the token expiry and the cookie Max-Age. 14 days. */\nvar SESSION_TTL_MS = 12096e5;\n/** Cookie Max-Age in seconds (Set-Cookie uses seconds, not ms). */\nvar SESSION_TTL_SECONDS = SESSION_TTL_MS / 1e3;\nvar _revoked = /* @__PURE__ */ new Set();\nvar _testOverrides = /* @__PURE__ */ new Set();\n/**\n* Read the operator UI login password from the host environment or the\n* file-based stack secret (`knowledge/secrets/op_ui_login_password`).\n*\n* This is the single source of truth for the password — login verification\n* (helpers.ts) and token signing below both use it, so they can never\n* disagree about whether a password exists. Returns \"\" when neither source\n* has a value (first boot, before the wizard runs).\n*/\nfunction getUiLoginPassword() {\n\tconst envValue = process.env.OP_UI_LOGIN_PASSWORD;\n\tif (envValue) return envValue;\n\treturn readSecret(resolveOpenPalmHome(), \"op_ui_login_password\")?.trimEnd() ?? \"\";\n}\n/** Sign `expiresAt` with the login password. Returns null when no password is configured. */\nfunction signToken(expiresAt) {\n\tconst secret = getUiLoginPassword();\n\tif (!secret) return null;\n\treturn createHmac(\"sha256\", secret).update(String(expiresAt)).digest(\"hex\");\n}\n/**\n* Mint a new signed session token with a 14-day TTL.\n* Place the result in the `op_session` cookie.\n* Throws when no login password is configured — callers must verify a\n* password exists (they all do: login/session/setup-complete check first).\n*/\nfunction createSession() {\n\tconst expiresAt = Date.now() + SESSION_TTL_MS;\n\tconst sig = signToken(expiresAt);\n\tif (sig === null) throw new Error(\"Cannot mint a session: no UI login password is configured.\");\n\treturn `${expiresAt}.${sig}`;\n}\n/**\n* Return true iff `token` is a valid, non-expired, non-revoked session.\n*/\nfunction validateSession(token) {\n\tif (!token) return false;\n\tif (_testOverrides.has(token)) return true;\n\tif (_revoked.has(token)) return false;\n\tconst dot = token.lastIndexOf(\".\");\n\tif (dot < 0) return false;\n\tconst expiresAt = Number(token.slice(0, dot));\n\tif (!Number.isFinite(expiresAt) || Date.now() >= expiresAt) return false;\n\tconst sig = token.slice(dot + 1);\n\tconst expected = signToken(expiresAt);\n\tif (expected === null) return false;\n\tif (sig.length !== expected.length) return false;\n\treturn timingSafeEqual(Buffer.from(sig), Buffer.from(expected));\n}\n/**\n* Sliding renewal: validate the old token, return a new one with a fresh\n* 14-day TTL, or return false if the old token is invalid/expired.\n* The caller must place the returned token in the `op_session` cookie.\n*/\nfunction touchSession(token) {\n\tif (!validateSession(token)) return false;\n\treturn createSession();\n}\n/**\n* Revoke a token (logout). The browser cookie must also be cleared by the caller.\n* The revocation list survives until the next server restart. Entries whose\n* embedded expiry has passed are pruned on each call — an expired token fails\n* validation anyway, so keeping it listed is pure memory growth.\n*/\nfunction invalidateSession(token) {\n\tconst now = Date.now();\n\tfor (const revoked of _revoked) {\n\t\tconst expiresAt = Number(revoked.slice(0, revoked.lastIndexOf(\".\")));\n\t\tif (!Number.isFinite(expiresAt) || expiresAt <= now) _revoked.delete(revoked);\n\t}\n\t_revoked.add(token);\n}\n//#endregion\n//#region src/lib/server/helpers.ts\n/**\n* Lazy OpenCode client bound to the currently active endpoint. The client is\n* recreated whenever the active endpoint URL changes so user switches in the\n* UI take effect on the next call.\n*/\nvar _openCodeClient;\nvar _openCodeClientUrl;\nfunction getOpenCodeClient() {\n\tconst { url } = getActiveConnection();\n\tif (!_openCodeClient || url !== _openCodeClientUrl) {\n\t\t_openCodeClient = createOpenCodeClient({ baseUrl: url });\n\t\t_openCodeClientUrl = url;\n\t}\n\treturn _openCodeClient;\n}\nfunction safeTokenCompare(a, b) {\n\tif (typeof a !== \"string\" || typeof b !== \"string\") return false;\n\tif (!a || !b) return false;\n\treturn timingSafeEqual(createHash(\"sha256\").update(a).digest(), createHash(\"sha256\").update(b).digest());\n}\n/** Standard JSON response with request ID header */\nfunction jsonResponse(status, body, requestId = \"\") {\n\treturn new Response(JSON.stringify(body), {\n\t\tstatus,\n\t\theaders: {\n\t\t\t\"content-type\": \"application/json\",\n\t\t\t...requestId ? { \"x-request-id\": requestId } : {}\n\t\t}\n\t});\n}\n/** Standard error envelope */\nfunction errorResponse(status, error, message, details = {}, requestId = \"\") {\n\treturn jsonResponse(status, {\n\t\terror,\n\t\tmessage,\n\t\tdetails,\n\t\trequestId\n\t}, requestId);\n}\n/** Extract or generate request ID */\nfunction getRequestId(event) {\n\treturn event.request.headers.get(\"x-request-id\") || crypto.randomUUID();\n}\n/**\n* Extract raw session token from the `op_session` cookie.\n*\n* Phase 2 of the auth/proxy refactor (docs/technical/auth-and-proxy-refactor-plan.md)\n* removed the legacy `x-admin-token` / `Authorization: Bearer` header fallbacks.\n* The cookie is HttpOnly + SameSite=Strict and is the ONLY credential the browser\n* holds; XSS cannot read it and out-of-process callers must obtain a session via\n* `POST /api/auth/login` (or `/session`) and present the cookie on subsequent\n* requests.\n*/\nfunction extractToken(event) {\n\tconst match = (event.request.headers.get(\"cookie\") ?? \"\").match(/(?:^|;\\s*)op_session=([^;]+)/);\n\tif (match) return match[1];\n\treturn \"\";\n}\n/** Check admin auth — returns error Response or null if OK */\nfunction requireAdmin(event, requestId) {\n\tif (!getUiLoginPassword()) return errorResponse(503, \"admin_not_configured\", \"OP_UI_LOGIN_PASSWORD has not been set. Complete setup first.\", {}, requestId);\n\tif (!validateSession(extractToken(event))) return errorResponse(401, \"unauthorized\", \"Missing or invalid credentials\", {}, requestId);\n\treturn null;\n}\n/**\n* Server-side capability guard (plan ui-runtime-modes-plan.md §6.4, §8.5).\n*\n* Returns a 403 JSON error Response when the resolved host mode does not\n* expose `capability`, or null when it does. This is the SECURITY boundary —\n* the browser-side `hasCapability()` is UX only. The check is deliberately\n* capability-based, not session-based: a valid admin session in a mode\n* without the capability (e.g. `connections:manage` in assistant-container)\n* is still refused. Capability→mode logic itself lives ONLY in\n* computeServerRuntimeContext / resolveCapabilities (plan §8.6); this helper\n* just reads the advertised server capability set.\n*/\nfunction requireCapability(event, capability, requestId) {\n\tconst ctx = computeServerRuntimeContext(event);\n\tif (!ctx.serverCapabilities.includes(capability)) return errorResponse(403, \"capability_not_available\", `This deployment (${ctx.hostMode}) does not provide the '${capability}' capability.`, {\n\t\tcapability,\n\t\thostMode: ctx.hostMode\n\t}, requestId);\n\treturn null;\n}\n/**\n* Identify caller by the presented `op_session` cookie.\n*\n* Returns \"admin\" when the cookie holds a valid session token.\n*/\nfunction identifyCallerByToken(event) {\n\tif (!getUiLoginPassword()) return null;\n\tif (validateSession(extractToken(event))) return \"admin\";\n\treturn null;\n}\n/** Parse JSON body safely — returns discriminated result with error type */\nasync function parseJsonBody(request, maxBytes = 1048576) {\n\ttry {\n\t\tconst contentLength = request.headers.get(\"content-length\");\n\t\tif (contentLength && parseInt(contentLength, 10) > maxBytes) return { error: \"too_large\" };\n\t\tconst parsed = await request.json();\n\t\tif (parsed === null || typeof parsed !== \"object\" || Array.isArray(parsed)) return { error: \"invalid_json\" };\n\t\treturn { data: parsed };\n\t} catch (e) {\n\t\tconsole.warn(\"[helpers] Failed to parse JSON request body\", e);\n\t\treturn { error: \"invalid_json\" };\n\t}\n}\n/** Convert a ParseJsonBodyError to an appropriate HTTP error response */\nfunction jsonBodyError(err, requestId) {\n\tif (err.error === \"too_large\") return errorResponse(413, \"too_large\", \"Request body too large\", {}, requestId);\n\treturn errorResponse(400, \"invalid_json\", \"Request body must be valid JSON\", {}, requestId);\n}\n/**\n* Auth + JSON body wrapper for admin POST/DELETE handlers.\n*\n* Replaces the 4-line boilerplate copy-pasted across 30+ routes:\n*   const requestId = getRequestId(event);\n*   const authError = requireAdmin(event, requestId);\n*   if (authError) return authError;\n*   const result = await parseJsonBody(event.request);\n*   if ('error' in result) return jsonBodyError(result, requestId);\n*\n* Use for routes that need both auth and a JSON body. For auth-only or\n* GET routes, call `requireAdmin` directly.\n*/\nasync function withAdminBody(event, handler) {\n\tconst requestId = getRequestId(event);\n\tconst { security } = computeServerRuntimeContext(event);\n\tconst originError = checkOriginHeader(event.request, security.csrfMode, requestId);\n\tif (originError) return originError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst result = await parseJsonBody(event.request);\n\tif (\"error\" in result) return jsonBodyError(result, requestId);\n\treturn handler({\n\t\trequestId,\n\t\tbody: result.data\n\t});\n}\nfunction hostNameFromHeader(hostHeader) {\n\tconst normalized = hostHeader.trim().replace(/\\.$/, \"\");\n\ttry {\n\t\treturn new URL(`http://${normalized}`).hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n\t} catch {\n\t\treturn null;\n\t}\n}\nfunction isLoopbackHost(hostHeader) {\n\tconst hostname = hostNameFromHeader(hostHeader);\n\tif (!hostname) return false;\n\treturn hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"::1\";\n}\nfunction isSameSite(request, origin) {\n\tconst requestHost = hostNameFromHeader(request.headers.get(\"host\") ?? \"\");\n\tif (!requestHost) return false;\n\treturn requestHost === origin.hostname.toLowerCase();\n}\nfunction checkHostHeader(request, requestId) {\n\tconst host = request.headers.get(\"host\") ?? \"\";\n\tif (isLoopbackHost(host) || isRemoteSetupAllowed()) return null;\n\treturn new Response(JSON.stringify({\n\t\terror: \"invalid_host\",\n\t\thost: host.trim().replace(/\\.$/, \"\"),\n\t\tmessage: \"Request rejected: Host header does not match allowed hosts. The UI binds to loopback (127.0.0.1) only; reach it via localhost or an SSH tunnel/reverse proxy, or set OP_ALLOW_REMOTE_SETUP=1 to allow remote access.\",\n\t\t...requestId ? { requestId } : {}\n\t}), {\n\t\tstatus: 400,\n\t\theaders: { \"content-type\": \"application/json\" }\n\t});\n}\n/**\n* Reject POST/PUT/DELETE requests whose Origin header does not match\n* localhost or 127.0.0.1. Requests with no Origin (non-browser clients)\n* are always allowed.\n*\n* @param request  Incoming Request\n* @returns        A 403 Response if the origin is rejected; null if allowed\n*/\nfunction checkOriginHeader(request, csrfMode = \"loopback-origin\", requestId) {\n\tconst method = request.method.toUpperCase();\n\tif (method === \"GET\" || method === \"HEAD\" || method === \"OPTIONS\") return null;\n\tconst origin = request.headers.get(\"origin\");\n\tif (!origin) return null;\n\ttry {\n\t\tconst u = new URL(origin);\n\t\tswitch (csrfMode) {\n\t\t\tcase \"loopback-origin\":\n\t\t\t\tif (isLoopbackHost(u.host)) return null;\n\t\t\t\tif (isRemoteSetupAllowed() && u.host === (request.headers.get(\"host\") ?? \"\").trim()) return null;\n\t\t\t\tbreak;\n\t\t\tcase \"same-site\":\n\t\t\t\tif (isSameSite(request, u)) return null;\n\t\t\t\tbreak;\n\t\t\tcase \"bearer-token\":\n\t\t\t\tif (request.headers.get(\"authorization\")) return null;\n\t\t\t\tif (isSameSite(request, u)) return null;\n\t\t\t\tbreak;\n\t\t}\n\t} catch {}\n\treturn new Response(JSON.stringify({\n\t\terror: \"forbidden_origin\",\n\t\torigin,\n\t\t...requestId ? { requestId } : {}\n\t}), {\n\t\tstatus: 403,\n\t\theaders: { \"content-type\": \"application/json\" }\n\t});\n}\nNumber(process.env.PORT ?? 3880);\n//#endregion\nexport { invalidateSession as _, getRequestId as a, jsonResponse as c, requireCapability as d, safeTokenCompare as f, getUiLoginPassword as g, createSession as h, getOpenCodeClient as i, parseJsonBody as l, SESSION_TTL_SECONDS as m, checkOriginHeader as n, identifyCallerByToken as o, withAdminBody as p, errorResponse as r, jsonBodyError as s, checkHostHeader as t, requireAdmin as u, touchSession as v };\n"],"names":[],"mappings":";;;;;;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,cAAc,GAAG,OAAO;AAC5B;AACG,IAAC,mBAAmB,GAAG,cAAc,GAAG;AAC3C,IAAI,QAAQ,mBAAmB,IAAI,GAAG,EAAE;AACxC,IAAI,cAAc,mBAAmB,IAAI,GAAG,EAAE;AAC9C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,GAAG;AAC9B,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB;AAClD,CAAC,IAAI,QAAQ,EAAE,OAAO,QAAQ;AAC9B,CAAC,OAAO,UAAU,CAAC,mBAAmB,EAAE,EAAE,sBAAsB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;AAClF;AACA;AACA,SAAS,SAAS,CAAC,SAAS,EAAE;AAC9B,CAAC,MAAM,MAAM,GAAG,kBAAkB,EAAE;AACpC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI;AACzB,CAAC,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;AAC5E;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc;AAC9C,CAAC,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC;AACjC,CAAC,IAAI,GAAG,KAAK,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC;AAChG,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7B;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,KAAK,EAAE;AAChC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,KAAK;AACzB,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,IAAI;AAC3C,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK;AACtC,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC;AACnC,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,OAAO,KAAK;AAC1B,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,EAAE,OAAO,KAAK;AACzE,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;AACjC,CAAC,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC;AACtC,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,OAAO,KAAK;AACpC,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,OAAO,KAAK;AACjD,CAAC,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAChE;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK;AAC1C,CAAC,OAAO,aAAa,EAAE;AACvB;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;AACvB,CAAC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE;AACjC,EAAE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;AACtE,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;AAC/E,CAAC;AACD,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;AACpB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,eAAe;AACnB,IAAI,kBAAkB;AACtB,SAAS,iBAAiB,GAAG;AAC7B,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,mBAAmB,EAAE;AACtC,CAAC,IAAI,CAAC,eAAe,IAAI,GAAG,KAAK,kBAAkB,EAAE;AACrD,EAAE,eAAe,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC1D,EAAE,kBAAkB,GAAG,GAAG;AAC1B,CAAC;AACD,CAAC,OAAO,eAAe;AACvB;AACA,SAAS,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE;AAChC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,OAAO,KAAK;AACjE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,KAAK;AAC3B,CAAC,OAAO,eAAe,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AACzG;AACA;AACA,SAAS,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,EAAE,EAAE;AACpD,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;AAC3C,EAAE,MAAM;AACR,EAAE,OAAO,EAAE;AACX,GAAG,cAAc,EAAE,kBAAkB;AACrC,GAAG,GAAG,SAAS,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG;AAClD;AACA,EAAE,CAAC;AACH;AACA;AACA,SAAS,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,EAAE;AAC7E,CAAC,OAAO,YAAY,CAAC,MAAM,EAAE;AAC7B,EAAE,KAAK;AACP,EAAE,OAAO;AACT,EAAE,OAAO;AACT,EAAE;AACF,EAAE,EAAE,SAAS,CAAC;AACd;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE;AACxE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,8BAA8B,CAAC;AAChG,CAAC,IAAI,KAAK,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC;AAC3B,CAAC,OAAO,EAAE;AACV;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE;AACxC,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,sBAAsB,EAAE,8DAA8D,EAAE,EAAE,EAAE,SAAS,CAAC;AAC5J,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,gCAAgC,EAAE,EAAE,EAAE,SAAS,CAAC;AACtI,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE;AACzD,CAAC,MAAM,GAAG,GAAG,2BAA2B,CAAC,KAAK,CAAC;AAC/C,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,0BAA0B,EAAE,CAAC,iBAAiB,EAAE,GAAG,CAAC,QAAQ,CAAC,wBAAwB,EAAE,UAAU,CAAC,aAAa,CAAC,EAAE;AAC/L,EAAE,UAAU;AACZ,EAAE,QAAQ,EAAE,GAAG,CAAC;AAChB,EAAE,EAAE,SAAS,CAAC;AACd,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,KAAK,EAAE;AACtC,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,OAAO,IAAI;AACvC,CAAC,IAAI,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,OAAO;AACzD,CAAC,OAAO,IAAI;AACZ;AACA;AACA,eAAe,aAAa,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,EAAE;AAC1D,CAAC,IAAI;AACL,EAAE,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;AAC7D,EAAE,IAAI,aAAa,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE;AAC5F,EAAE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE;AACrC,EAAE,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE;AAC9G,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;AACzB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,CAAC,IAAI,CAAC,6CAA6C,EAAE,CAAC,CAAC;AAChE,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE;AAClC,CAAC;AACD;AACA;AACA,SAAS,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE;AACvC,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,EAAE,EAAE,SAAS,CAAC;AAC/G,CAAC,OAAO,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,iCAAiC,EAAE,EAAE,EAAE,SAAS,CAAC;AAC5F;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC;AACxD,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;AACnF,CAAC,IAAI,WAAW,EAAE,OAAO,WAAW;AACpC,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;AAClD,CAAC,IAAI,OAAO,IAAI,MAAM,EAAE,OAAO,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC;AAC/D,CAAC,OAAO,OAAO,CAAC;AAChB,EAAE,SAAS;AACX,EAAE,IAAI,EAAE,MAAM,CAAC;AACf,EAAE,CAAC;AACH;AACA,SAAS,kBAAkB,CAAC,UAAU,EAAE;AACxC,CAAC,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AACxD,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;AACvF,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,IAAI;AACb,CAAC;AACD;AACA,SAAS,cAAc,CAAC,UAAU,EAAE;AACpC,CAAC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,UAAU,CAAC;AAChD,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AAC5B,CAAC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK;AAClF;AACA,SAAS,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE;AACrC,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAC1E,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,KAAK;AAC/B,CAAC,OAAO,WAAW,KAAK,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE;AACrD;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE;AAC7C,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;AAC/C,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,oBAAoB,EAAE,EAAE,OAAO,IAAI;AAChE,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AACpC,EAAE,KAAK,EAAE,cAAc;AACvB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AACtC,EAAE,OAAO,EAAE,sNAAsN;AACjO,EAAE,GAAG,SAAS,GAAG,EAAE,SAAS,EAAE,GAAG;AACjC,EAAE,CAAC,EAAE;AACL,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AAC/C,EAAE,CAAC;AACH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,OAAO,EAAE,QAAQ,GAAG,iBAAiB,EAAE,SAAS,EAAE;AAC7E,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;AAC5C,CAAC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,OAAO,IAAI;AAC/E,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC7C,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI;AACzB,CAAC,IAAI;AACL,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC;AAC3B,EAAE,QAAQ,QAAQ;AAClB,GAAG,KAAK,iBAAiB;AACzB,IAAI,IAAI,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AAC3C,IAAI,IAAI,oBAAoB,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,IAAI;AACpG,IAAI;AACJ,GAAG,KAAK,WAAW;AACnB,IAAI,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,OAAO,IAAI;AAC3C,IAAI;AACJ,GAAG,KAAK,cAAc;AACtB,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,OAAO,IAAI;AACzD,IAAI,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,OAAO,IAAI;AAC3C,IAAI;AACJ;AACA,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AACpC,EAAE,KAAK,EAAE,kBAAkB;AAC3B,EAAE,MAAM;AACR,EAAE,GAAG,SAAS,GAAG,EAAE,SAAS,EAAE,GAAG;AACjC,EAAE,CAAC,EAAE;AACL,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AAC/C,EAAE,CAAC;AACH;AACA,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC;;;;"}
+{"version":3,"file":"helpers-DxodR6tq.js","sources":["../../../.svelte-kit/adapter-node/chunks/helpers.js"],"sourcesContent":["import { bt as resolveOpenPalmHome, it as readSecret } from \"./compose-args.js\";\nimport { q as createOpenCodeClient } from \"./src.js\";\nimport { l as isRemoteSetupAllowed } from \"./network-preset.js\";\nimport { i as getActiveConnection } from \"./endpoints.js\";\nimport { t as computeServerRuntimeContext } from \"./features.js\";\nimport { createHash, createHmac, timingSafeEqual } from \"node:crypto\";\n//#region src/lib/server/session-store.ts\n/**\n* Stateless signed session tokens.\n*\n* Token format: `<expiresAt>.<hmac-sha256-hex>`\n*   expiresAt — unix ms timestamp when the session expires\n*   signature — HMAC-SHA256(expiresAt, login password)\n*\n* Tokens are self-validating: the server holds no per-session state and\n* sessions survive UI server restarts. Signing with the login password means\n* a password change invalidates all existing sessions — correct behaviour.\n*\n* The signing secret is resolved exactly like login verification\n* (`getUiLoginPassword`): `process.env.OP_UI_LOGIN_PASSWORD` first, then the\n* on-disk stack secret. When NEITHER exists, minting throws and validation\n* fails closed — there is deliberately no fallback secret, because a constant\n* key would let anyone forge an admin token. Reading the file per call also\n* means tokens minted right after the setup wizard writes the password are\n* signed with the real secret, without waiting for a process restart.\n*\n* Logout semantics (known trade-off of stateless tokens): logout revokes the\n* single token the browser presented (in-memory list, cleared on restart) and\n* clears the cookie. Earlier tokens issued to the same browser by sliding\n* renewal remain cryptographically valid until they expire — logout is\n* \"forget my cookie\", not \"kill every credential ever issued\". A real\n* kill-switch is changing the login password, which invalidates everything.\n*/\n/** Session lifetime for both the token expiry and the cookie Max-Age. 14 days. */\nvar SESSION_TTL_MS = 12096e5;\n/** Cookie Max-Age in seconds (Set-Cookie uses seconds, not ms). */\nvar SESSION_TTL_SECONDS = SESSION_TTL_MS / 1e3;\nvar _revoked = /* @__PURE__ */ new Set();\nvar _testOverrides = /* @__PURE__ */ new Set();\n/**\n* Read the operator UI login password from the host environment or the\n* file-based stack secret (`knowledge/secrets/op_ui_login_password`).\n*\n* This is the single source of truth for the password — login verification\n* (helpers.ts) and token signing below both use it, so they can never\n* disagree about whether a password exists. Returns \"\" when neither source\n* has a value (first boot, before the wizard runs).\n*/\nfunction getUiLoginPassword() {\n\tconst envValue = process.env.OP_UI_LOGIN_PASSWORD;\n\tif (envValue) return envValue;\n\treturn readSecret(resolveOpenPalmHome(), \"op_ui_login_password\")?.trimEnd() ?? \"\";\n}\n/** Sign `expiresAt` with the login password. Returns null when no password is configured. */\nfunction signToken(expiresAt) {\n\tconst secret = getUiLoginPassword();\n\tif (!secret) return null;\n\treturn createHmac(\"sha256\", secret).update(String(expiresAt)).digest(\"hex\");\n}\n/**\n* Mint a new signed session token with a 14-day TTL.\n* Place the result in the `op_session` cookie.\n* Throws when no login password is configured — callers must verify a\n* password exists (they all do: login/session/setup-complete check first).\n*/\nfunction createSession() {\n\tconst expiresAt = Date.now() + SESSION_TTL_MS;\n\tconst sig = signToken(expiresAt);\n\tif (sig === null) throw new Error(\"Cannot mint a session: no UI login password is configured.\");\n\treturn `${expiresAt}.${sig}`;\n}\n/**\n* Return true iff `token` is a valid, non-expired, non-revoked session.\n*/\nfunction validateSession(token) {\n\tif (!token) return false;\n\tif (_testOverrides.has(token)) return true;\n\tif (_revoked.has(token)) return false;\n\tconst dot = token.lastIndexOf(\".\");\n\tif (dot < 0) return false;\n\tconst expiresAt = Number(token.slice(0, dot));\n\tif (!Number.isFinite(expiresAt) || Date.now() >= expiresAt) return false;\n\tconst sig = token.slice(dot + 1);\n\tconst expected = signToken(expiresAt);\n\tif (expected === null) return false;\n\tif (sig.length !== expected.length) return false;\n\treturn timingSafeEqual(Buffer.from(sig), Buffer.from(expected));\n}\n/**\n* Sliding renewal: validate the old token, return a new one with a fresh\n* 14-day TTL, or return false if the old token is invalid/expired.\n* The caller must place the returned token in the `op_session` cookie.\n*/\nfunction touchSession(token) {\n\tif (!validateSession(token)) return false;\n\treturn createSession();\n}\n/**\n* Revoke a token (logout). The browser cookie must also be cleared by the caller.\n* The revocation list survives until the next server restart. Entries whose\n* embedded expiry has passed are pruned on each call — an expired token fails\n* validation anyway, so keeping it listed is pure memory growth.\n*/\nfunction invalidateSession(token) {\n\tconst now = Date.now();\n\tfor (const revoked of _revoked) {\n\t\tconst expiresAt = Number(revoked.slice(0, revoked.lastIndexOf(\".\")));\n\t\tif (!Number.isFinite(expiresAt) || expiresAt <= now) _revoked.delete(revoked);\n\t}\n\t_revoked.add(token);\n}\n//#endregion\n//#region src/lib/server/helpers.ts\n/**\n* Lazy OpenCode client bound to the currently active endpoint. The client is\n* recreated whenever the active endpoint URL changes so user switches in the\n* UI take effect on the next call.\n*/\nvar _openCodeClient;\nvar _openCodeClientUrl;\nfunction getOpenCodeClient() {\n\tconst { url } = getActiveConnection();\n\tif (!_openCodeClient || url !== _openCodeClientUrl) {\n\t\t_openCodeClient = createOpenCodeClient({ baseUrl: url });\n\t\t_openCodeClientUrl = url;\n\t}\n\treturn _openCodeClient;\n}\nfunction safeTokenCompare(a, b) {\n\tif (typeof a !== \"string\" || typeof b !== \"string\") return false;\n\tif (!a || !b) return false;\n\treturn timingSafeEqual(createHash(\"sha256\").update(a).digest(), createHash(\"sha256\").update(b).digest());\n}\n/** Standard JSON response with request ID header */\nfunction jsonResponse(status, body, requestId = \"\") {\n\treturn new Response(JSON.stringify(body), {\n\t\tstatus,\n\t\theaders: {\n\t\t\t\"content-type\": \"application/json\",\n\t\t\t...requestId ? { \"x-request-id\": requestId } : {}\n\t\t}\n\t});\n}\n/** Standard error envelope */\nfunction errorResponse(status, error, message, details = {}, requestId = \"\") {\n\treturn jsonResponse(status, {\n\t\terror,\n\t\tmessage,\n\t\tdetails,\n\t\trequestId\n\t}, requestId);\n}\n/** Extract or generate request ID */\nfunction getRequestId(event) {\n\treturn event.request.headers.get(\"x-request-id\") || crypto.randomUUID();\n}\n/**\n* Extract raw session token from the `op_session` cookie.\n*\n* Phase 2 of the auth/proxy refactor (docs/technical/auth-and-proxy-refactor-plan.md)\n* removed the legacy `x-admin-token` / `Authorization: Bearer` header fallbacks.\n* The cookie is HttpOnly + SameSite=Strict and is the ONLY credential the browser\n* holds; XSS cannot read it and out-of-process callers must obtain a session via\n* `POST /api/auth/login` (or `/session`) and present the cookie on subsequent\n* requests.\n*/\nfunction extractToken(event) {\n\tconst match = (event.request.headers.get(\"cookie\") ?? \"\").match(/(?:^|;\\s*)op_session=([^;]+)/);\n\tif (match) return match[1];\n\treturn \"\";\n}\n/** Check admin auth — returns error Response or null if OK */\nfunction requireAdmin(event, requestId) {\n\tif (!getUiLoginPassword()) return errorResponse(503, \"admin_not_configured\", \"OP_UI_LOGIN_PASSWORD has not been set. Complete setup first.\", {}, requestId);\n\tif (!validateSession(extractToken(event))) return errorResponse(401, \"unauthorized\", \"Missing or invalid credentials\", {}, requestId);\n\treturn null;\n}\n/**\n* Server-side capability guard (plan ui-runtime-modes-plan.md §6.4, §8.5).\n*\n* Returns a 403 JSON error Response when the resolved host mode does not\n* expose `capability`, or null when it does. This is the SECURITY boundary —\n* the browser-side `hasCapability()` is UX only. The check is deliberately\n* capability-based, not session-based: a valid admin session in a mode\n* without the capability (e.g. `connections:manage` in assistant-container)\n* is still refused. Capability→mode logic itself lives ONLY in\n* computeServerRuntimeContext / resolveCapabilities (plan §8.6); this helper\n* just reads the advertised server capability set.\n*/\nfunction requireCapability(event, capability, requestId) {\n\tconst ctx = computeServerRuntimeContext(event);\n\tif (!ctx.serverCapabilities.includes(capability)) return errorResponse(403, \"capability_not_available\", `This deployment (${ctx.hostMode}) does not provide the '${capability}' capability.`, {\n\t\tcapability,\n\t\thostMode: ctx.hostMode\n\t}, requestId);\n\treturn null;\n}\n/**\n* Identify caller by the presented `op_session` cookie.\n*\n* Returns \"admin\" when the cookie holds a valid session token.\n*/\nfunction identifyCallerByToken(event) {\n\tif (!getUiLoginPassword()) return null;\n\tif (validateSession(extractToken(event))) return \"admin\";\n\treturn null;\n}\n/** Parse JSON body safely — returns discriminated result with error type */\nasync function parseJsonBody(request, maxBytes = 1048576) {\n\ttry {\n\t\tconst contentLength = request.headers.get(\"content-length\");\n\t\tif (contentLength && parseInt(contentLength, 10) > maxBytes) return { error: \"too_large\" };\n\t\tconst parsed = await request.json();\n\t\tif (parsed === null || typeof parsed !== \"object\" || Array.isArray(parsed)) return { error: \"invalid_json\" };\n\t\treturn { data: parsed };\n\t} catch (e) {\n\t\tconsole.warn(\"[helpers] Failed to parse JSON request body\", e);\n\t\treturn { error: \"invalid_json\" };\n\t}\n}\n/** Convert a ParseJsonBodyError to an appropriate HTTP error response */\nfunction jsonBodyError(err, requestId) {\n\tif (err.error === \"too_large\") return errorResponse(413, \"too_large\", \"Request body too large\", {}, requestId);\n\treturn errorResponse(400, \"invalid_json\", \"Request body must be valid JSON\", {}, requestId);\n}\n/**\n* Auth + JSON body wrapper for admin POST/DELETE handlers.\n*\n* Replaces the 4-line boilerplate copy-pasted across 30+ routes:\n*   const requestId = getRequestId(event);\n*   const authError = requireAdmin(event, requestId);\n*   if (authError) return authError;\n*   const result = await parseJsonBody(event.request);\n*   if ('error' in result) return jsonBodyError(result, requestId);\n*\n* Use for routes that need both auth and a JSON body. For auth-only or\n* GET routes, call `requireAdmin` directly.\n*/\nasync function withAdminBody(event, handler) {\n\tconst requestId = getRequestId(event);\n\tconst { security } = computeServerRuntimeContext(event);\n\tconst originError = checkOriginHeader(event.request, security.csrfMode, requestId);\n\tif (originError) return originError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst result = await parseJsonBody(event.request);\n\tif (\"error\" in result) return jsonBodyError(result, requestId);\n\treturn handler({\n\t\trequestId,\n\t\tbody: result.data\n\t});\n}\nfunction hostNameFromHeader(hostHeader) {\n\tconst normalized = hostHeader.trim().replace(/\\.$/, \"\");\n\ttry {\n\t\treturn new URL(`http://${normalized}`).hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n\t} catch {\n\t\treturn null;\n\t}\n}\nfunction isLoopbackHost(hostHeader) {\n\tconst hostname = hostNameFromHeader(hostHeader);\n\tif (!hostname) return false;\n\treturn hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"::1\";\n}\nfunction isSameSite(request, origin) {\n\tconst requestHost = hostNameFromHeader(request.headers.get(\"host\") ?? \"\");\n\tif (!requestHost) return false;\n\treturn requestHost === origin.hostname.toLowerCase();\n}\nfunction checkHostHeader(request, requestId) {\n\tconst host = request.headers.get(\"host\") ?? \"\";\n\tif (isLoopbackHost(host) || isRemoteSetupAllowed()) return null;\n\treturn new Response(JSON.stringify({\n\t\terror: \"invalid_host\",\n\t\thost: host.trim().replace(/\\.$/, \"\"),\n\t\tmessage: \"Request rejected: Host header does not match allowed hosts. The UI binds to loopback (127.0.0.1) only; reach it via localhost or an SSH tunnel/reverse proxy, or set OP_ALLOW_REMOTE_SETUP=1 to allow remote access.\",\n\t\t...requestId ? { requestId } : {}\n\t}), {\n\t\tstatus: 400,\n\t\theaders: { \"content-type\": \"application/json\" }\n\t});\n}\n/**\n* Reject POST/PUT/DELETE requests whose Origin header does not match\n* localhost or 127.0.0.1. Requests with no Origin (non-browser clients)\n* are always allowed.\n*\n* @param request  Incoming Request\n* @returns        A 403 Response if the origin is rejected; null if allowed\n*/\nfunction checkOriginHeader(request, csrfMode = \"loopback-origin\", requestId) {\n\tconst method = request.method.toUpperCase();\n\tif (method === \"GET\" || method === \"HEAD\" || method === \"OPTIONS\") return null;\n\tconst origin = request.headers.get(\"origin\");\n\tif (!origin) return null;\n\ttry {\n\t\tconst u = new URL(origin);\n\t\tswitch (csrfMode) {\n\t\t\tcase \"loopback-origin\":\n\t\t\t\tif (isLoopbackHost(u.host)) return null;\n\t\t\t\tif (isRemoteSetupAllowed() && u.host === (request.headers.get(\"host\") ?? \"\").trim()) return null;\n\t\t\t\tbreak;\n\t\t\tcase \"same-site\":\n\t\t\t\tif (isSameSite(request, u)) return null;\n\t\t\t\tbreak;\n\t\t\tcase \"bearer-token\":\n\t\t\t\tif (request.headers.get(\"authorization\")) return null;\n\t\t\t\tif (isSameSite(request, u)) return null;\n\t\t\t\tbreak;\n\t\t}\n\t} catch {}\n\treturn new Response(JSON.stringify({\n\t\terror: \"forbidden_origin\",\n\t\torigin,\n\t\t...requestId ? { requestId } : {}\n\t}), {\n\t\tstatus: 403,\n\t\theaders: { \"content-type\": \"application/json\" }\n\t});\n}\nNumber(process.env.PORT ?? 3880);\n//#endregion\nexport { invalidateSession as _, getRequestId as a, jsonResponse as c, requireCapability as d, safeTokenCompare as f, getUiLoginPassword as g, createSession as h, getOpenCodeClient as i, parseJsonBody as l, SESSION_TTL_SECONDS as m, checkOriginHeader as n, identifyCallerByToken as o, withAdminBody as p, errorResponse as r, jsonBodyError as s, checkHostHeader as t, requireAdmin as u, touchSession as v };\n"],"names":[],"mappings":";;;;;;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,cAAc,GAAG,OAAO;AAC5B;AACG,IAAC,mBAAmB,GAAG,cAAc,GAAG;AAC3C,IAAI,QAAQ,mBAAmB,IAAI,GAAG,EAAE;AACxC,IAAI,cAAc,mBAAmB,IAAI,GAAG,EAAE;AAC9C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,GAAG;AAC9B,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB;AAClD,CAAC,IAAI,QAAQ,EAAE,OAAO,QAAQ;AAC9B,CAAC,OAAO,UAAU,CAAC,mBAAmB,EAAE,EAAE,sBAAsB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;AAClF;AACA;AACA,SAAS,SAAS,CAAC,SAAS,EAAE;AAC9B,CAAC,MAAM,MAAM,GAAG,kBAAkB,EAAE;AACpC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI;AACzB,CAAC,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;AAC5E;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc;AAC9C,CAAC,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC;AACjC,CAAC,IAAI,GAAG,KAAK,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC;AAChG,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7B;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,KAAK,EAAE;AAChC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,KAAK;AACzB,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,IAAI;AAC3C,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK;AACtC,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC;AACnC,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,OAAO,KAAK;AAC1B,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,EAAE,OAAO,KAAK;AACzE,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;AACjC,CAAC,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC;AACtC,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,OAAO,KAAK;AACpC,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,OAAO,KAAK;AACjD,CAAC,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAChE;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK;AAC1C,CAAC,OAAO,aAAa,EAAE;AACvB;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;AACvB,CAAC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE;AACjC,EAAE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;AACtE,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;AAC/E,CAAC;AACD,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;AACpB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,eAAe;AACnB,IAAI,kBAAkB;AACtB,SAAS,iBAAiB,GAAG;AAC7B,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,mBAAmB,EAAE;AACtC,CAAC,IAAI,CAAC,eAAe,IAAI,GAAG,KAAK,kBAAkB,EAAE;AACrD,EAAE,eAAe,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC1D,EAAE,kBAAkB,GAAG,GAAG;AAC1B,CAAC;AACD,CAAC,OAAO,eAAe;AACvB;AACA,SAAS,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE;AAChC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,OAAO,KAAK;AACjE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,KAAK;AAC3B,CAAC,OAAO,eAAe,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AACzG;AACA;AACA,SAAS,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,EAAE,EAAE;AACpD,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;AAC3C,EAAE,MAAM;AACR,EAAE,OAAO,EAAE;AACX,GAAG,cAAc,EAAE,kBAAkB;AACrC,GAAG,GAAG,SAAS,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG;AAClD;AACA,EAAE,CAAC;AACH;AACA;AACA,SAAS,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,EAAE;AAC7E,CAAC,OAAO,YAAY,CAAC,MAAM,EAAE;AAC7B,EAAE,KAAK;AACP,EAAE,OAAO;AACT,EAAE,OAAO;AACT,EAAE;AACF,EAAE,EAAE,SAAS,CAAC;AACd;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE;AACxE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,8BAA8B,CAAC;AAChG,CAAC,IAAI,KAAK,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC;AAC3B,CAAC,OAAO,EAAE;AACV;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE;AACxC,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,sBAAsB,EAAE,8DAA8D,EAAE,EAAE,EAAE,SAAS,CAAC;AAC5J,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,gCAAgC,EAAE,EAAE,EAAE,SAAS,CAAC;AACtI,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE;AACzD,CAAC,MAAM,GAAG,GAAG,2BAA2B,CAAC,KAAK,CAAC;AAC/C,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,0BAA0B,EAAE,CAAC,iBAAiB,EAAE,GAAG,CAAC,QAAQ,CAAC,wBAAwB,EAAE,UAAU,CAAC,aAAa,CAAC,EAAE;AAC/L,EAAE,UAAU;AACZ,EAAE,QAAQ,EAAE,GAAG,CAAC;AAChB,EAAE,EAAE,SAAS,CAAC;AACd,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,KAAK,EAAE;AACtC,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,OAAO,IAAI;AACvC,CAAC,IAAI,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,OAAO;AACzD,CAAC,OAAO,IAAI;AACZ;AACA;AACA,eAAe,aAAa,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,EAAE;AAC1D,CAAC,IAAI;AACL,EAAE,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;AAC7D,EAAE,IAAI,aAAa,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE;AAC5F,EAAE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE;AACrC,EAAE,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE;AAC9G,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;AACzB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,CAAC,IAAI,CAAC,6CAA6C,EAAE,CAAC,CAAC;AAChE,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE;AAClC,CAAC;AACD;AACA;AACA,SAAS,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE;AACvC,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,EAAE,EAAE,SAAS,CAAC;AAC/G,CAAC,OAAO,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,iCAAiC,EAAE,EAAE,EAAE,SAAS,CAAC;AAC5F;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC;AACxD,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;AACnF,CAAC,IAAI,WAAW,EAAE,OAAO,WAAW;AACpC,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;AAClD,CAAC,IAAI,OAAO,IAAI,MAAM,EAAE,OAAO,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC;AAC/D,CAAC,OAAO,OAAO,CAAC;AAChB,EAAE,SAAS;AACX,EAAE,IAAI,EAAE,MAAM,CAAC;AACf,EAAE,CAAC;AACH;AACA,SAAS,kBAAkB,CAAC,UAAU,EAAE;AACxC,CAAC,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AACxD,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;AACvF,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,IAAI;AACb,CAAC;AACD;AACA,SAAS,cAAc,CAAC,UAAU,EAAE;AACpC,CAAC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,UAAU,CAAC;AAChD,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AAC5B,CAAC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK;AAClF;AACA,SAAS,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE;AACrC,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAC1E,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,KAAK;AAC/B,CAAC,OAAO,WAAW,KAAK,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE;AACrD;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE;AAC7C,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;AAC/C,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,oBAAoB,EAAE,EAAE,OAAO,IAAI;AAChE,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AACpC,EAAE,KAAK,EAAE,cAAc;AACvB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AACtC,EAAE,OAAO,EAAE,sNAAsN;AACjO,EAAE,GAAG,SAAS,GAAG,EAAE,SAAS,EAAE,GAAG;AACjC,EAAE,CAAC,EAAE;AACL,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AAC/C,EAAE,CAAC;AACH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,OAAO,EAAE,QAAQ,GAAG,iBAAiB,EAAE,SAAS,EAAE;AAC7E,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;AAC5C,CAAC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,OAAO,IAAI;AAC/E,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC7C,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI;AACzB,CAAC,IAAI;AACL,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC;AAC3B,EAAE,QAAQ,QAAQ;AAClB,GAAG,KAAK,iBAAiB;AACzB,IAAI,IAAI,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AAC3C,IAAI,IAAI,oBAAoB,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,IAAI;AACpG,IAAI;AACJ,GAAG,KAAK,WAAW;AACnB,IAAI,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,OAAO,IAAI;AAC3C,IAAI;AACJ,GAAG,KAAK,cAAc;AACtB,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,OAAO,IAAI;AACzD,IAAI,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,OAAO,IAAI;AAC3C,IAAI;AACJ;AACA,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AACpC,EAAE,KAAK,EAAE,kBAAkB;AAC3B,EAAE,MAAM;AACR,EAAE,GAAG,SAAS,GAAG,EAAE,SAAS,EAAE,GAAG;AACjC,EAAE,CAAC,EAAE;AACL,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AAC/C,EAAE,CAAC;AACH;AACA,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC;;;;"}

package/build/server/chunks/{hooks.server-DEVjSu3V.js → hooks.server-Bzj8OieV.js}

@@ -1,15 +1,16 @@
 import { r as redirect } from './exports-CcmcYU0M.js';
-import { aX as resolveOpenPalmHome, af as isSetupComplete, b1 as stackDirFor, aA as readSecret, aE as readStackRuntimeEnv, aL as reconcileMdnsResponder, F as createLogger } from './src-CQ2F7hgb.js';
+import { aP as resolveOpenPalmHome, ad as isSetupComplete, aX as stackDirFor, au as readSecret, ay as readStackRuntimeEnv, aF as reconcileMdnsResponder, D as createLogger } from './src-DbArH65P.js';
 import { h as isRemoteSetupAllowed, e as collectNetworkExposureWarnings } from './network-preset-CJ1RRnki.js';
-import { g as getState } from './state-CsIDHNPN.js';
-import { d as getRequestId, c as checkHostHeader, a as checkOriginHeader, i as identifyCallerByToken, t as touchSession } from './helpers-CfpNg3il.js';
-import { c as computeServerRuntimeContext } from './features-BE2x1a_a.js';
-import { S as SESSION_COOKIE_NAME, s as sessionCookieHeader } from './session-cookie-CDynAOx3.js';
-import { g as getCachedLocalInstallState, r as resolveRequestLanding, B as BLOCKING_LANDINGS } from './landing-DKXNel0Q.js';
-export { _ as _resetLaunchCache } from './landing-DKXNel0Q.js';
+import { g as getState } from './state-Bq8fep3F.js';
+import { d as getRequestId, c as checkHostHeader, a as checkOriginHeader, i as identifyCallerByToken, t as touchSession } from './helpers-DxodR6tq.js';
+import { c as computeServerRuntimeContext } from './features-BW-bVsl8.js';
+import { S as SESSION_COOKIE_NAME, s as sessionCookieHeader } from './session-cookie-C8DcD6bt.js';
+import { g as getCachedLocalInstallState, r as resolveRequestLanding, B as BLOCKING_LANDINGS } from './landing-DhaVkN2f.js';
+export { _ as _resetLaunchCache } from './landing-DhaVkN2f.js';
 import './utils-OXHIhUb5.js';
 import './chunk-DOvWTNp_.js';
 import 'node:module';
+import './dist-DtzrgNJ1.js';
 import 'node:fs';
 import 'node:child_process';
 import 'node:path';
@@ -27,7 +28,7 @@ import 'assert';
 import 'zlib';
 import 'node:assert';
 import 'node:fs/promises';
-import './endpoints-WTxemTcn.js';
+import './endpoints-IFTldlrt.js';
 import './runtime-context.svelte-C5zNEC6u.js';
 
 //#region src/hooks.server.ts
@@ -114,4 +115,4 @@ var handle = async ({ event, resolve }) => {
 };
 
 export { handle };
-//# sourceMappingURL=hooks.server-DEVjSu3V.js.map
+//# sourceMappingURL=hooks.server-Bzj8OieV.js.map

package/build/server/chunks/{hooks.server-DEVjSu3V.js.map → hooks.server-Bzj8OieV.js.map}

@@ -1 +1 @@
-{"version":3,"file":"hooks.server-DEVjSu3V.js","sources":["../../../.svelte-kit/adapter-node/entries/hooks.server.js"],"sourcesContent":["import { i as redirect } from \"../chunks/exports.js\";\nimport { Dt as stackDirFor, Nt as createLogger, Tt as resolveOpenPalmHome, Z as readStackRuntimeEnv, at as readSecret } from \"../chunks/compose-args.js\";\nimport { B as isSetupComplete, r as reconcileMdnsResponder } from \"../chunks/src.js\";\nimport { l as isRemoteSetupAllowed, r as collectNetworkExposureWarnings } from \"../chunks/network-preset.js\";\nimport { t as getState } from \"../chunks/state.js\";\nimport { a as getRequestId, n as checkOriginHeader, o as identifyCallerByToken, t as checkHostHeader, v as touchSession } from \"../chunks/helpers.js\";\nimport { t as computeServerRuntimeContext } from \"../chunks/features.js\";\nimport { r as sessionCookieHeader, t as SESSION_COOKIE_NAME } from \"../chunks/session-cookie.js\";\nimport { i as BLOCKING_LANDINGS, n as getCachedLocalInstallState, r as resolveRequestLanding, t as _resetLaunchCache } from \"../chunks/landing.js\";\n//#region src/hooks.server.ts\nvar logger = createLogger(\"admin\");\nvar startupApplyDone = false;\nfunction loadProcessEnv() {\n\tif (startupApplyDone) return;\n\tstartupApplyDone = true;\n\tfor (const line of collectNetworkExposureWarnings(process.env)) logger.warn(line);\n\ttry {\n\t\tconst state = getState();\n\t\tif (!process.env.OP_UI_LOGIN_PASSWORD) {\n\t\t\tconst pw = readSecret(state.homeDir, \"op_ui_login_password\");\n\t\t\tif (pw) process.env.OP_UI_LOGIN_PASSWORD = pw.trimEnd();\n\t\t}\n\t\tconst stackVars = readStackRuntimeEnv(state.homeDir);\n\t\tfor (const [k, v] of Object.entries(stackVars)) if (v && !process.env[k]) process.env[k] = v;\n\t\treconcileMdnsResponder(state.homeDir);\n\t} catch (err) {\n\t\tlogger.error(\"process env load failed\", { error: String(err) });\n\t}\n}\nloadProcessEnv();\nvar SETUP_PATHS = [\n\t\"/setup\",\n\t\"/api/setup\",\n\t\"/health\",\n\t\"/guardian/health\"\n];\nfunction isLocalhostAddress(ip) {\n\treturn ip === \"127.0.0.1\" || ip === \"::1\" || ip === \"::ffff:127.0.0.1\";\n}\nvar handle = async ({ event, resolve }) => {\n\tconst runtimeContext = computeServerRuntimeContext(event);\n\tconst requestId = getRequestId(event);\n\tconst hostError = checkHostHeader(event.request, requestId);\n\tif (hostError) return hostError;\n\tconst originError = checkOriginHeader(event.request, runtimeContext.security.csrfMode, requestId);\n\tif (originError) return originError;\n\tconst path = event.url.pathname;\n\tconst isAuthPath = path === \"/login\" || path.startsWith(\"/login/\");\n\tconst wantsHtml = event.request.method === \"GET\" && (event.request.headers.get(\"accept\") ?? \"\").includes(\"text/html\");\n\tif ((path === \"/host\" || path.startsWith(\"/host/\")) && !runtimeContext.serverCapabilities.includes(\"host:stack:read\")) redirect(302, \"/chat\");\n\tconst isSetupPath = SETUP_PATHS.some((p) => path === p || path.startsWith(`${p}/`));\n\tconst homeDir = resolveOpenPalmHome();\n\tconst setupComplete = isSetupComplete(homeDir);\n\tconst localInstallState = getCachedLocalInstallState(stackDirFor(homeDir), homeDir);\n\tif (wantsHtml && !setupComplete && localInstallState !== \"not_installed\" && !isSetupPath && !isAuthPath && !path.startsWith(\"/admin\")) redirect(302, \"/setup\");\n\tif (isSetupPath && !setupComplete && !isRemoteSetupAllowed()) {\n\t\tif (!isLocalhostAddress(event.getClientAddress())) return new Response(JSON.stringify({\n\t\t\terror: \"setup_localhost_only\",\n\t\t\tmessage: \"Setup is only accessible from the host machine until installation is complete.\"\n\t\t}), {\n\t\t\tstatus: 403,\n\t\t\theaders: { \"content-type\": \"application/json\" }\n\t\t});\n\t}\n\tif (!isSetupPath) {\n\t\tconst landing = await resolveRequestLanding(event);\n\t\tconst [landingPath] = landing.split(\"?\");\n\t\tconst usageExempt = (path.startsWith(\"/chat\") || path.startsWith(\"/advanced\") || path.startsWith(\"/connections\")) && !BLOCKING_LANDINGS.has(landingPath);\n\t\tconst exempt = path.startsWith(\"/api/\") || path.startsWith(\"/proxy/\") || path.startsWith(\"/login\") || path.startsWith(\"/health\") || path.startsWith(\"/guardian/health\") || path.startsWith(\"/host\") || path.startsWith(\"/admin\") || usageExempt;\n\t\tif (path === \"/\" || path !== landingPath && !exempt) redirect(302, landing);\n\t}\n\tevent.locals.role = identifyCallerByToken(event);\n\tlet renewedCookie = null;\n\tif (event.locals.role === \"admin\") {\n\t\tconst match = (event.request.headers.get(\"cookie\") ?? \"\").match(new RegExp(`(?:^|;\\\\s*)${SESSION_COOKIE_NAME}=([^;]+)`));\n\t\tconst renewed = match ? touchSession(match[1]) : false;\n\t\tif (renewed) renewedCookie = sessionCookieHeader(renewed, event.request);\n\t}\n\tif (wantsHtml && !event.locals.role && !isSetupPath && !isAuthPath) {\n\t\tconst redirectTo = path + event.url.search;\n\t\tredirect(302, `/login?redirectTo=${encodeURIComponent(redirectTo)}`);\n\t}\n\tconst response = await resolve(event);\n\tif (renewedCookie) {\n\t\tif (!(response.headers.get(\"set-cookie\") ?? \"\").includes(`op_session=`)) response.headers.append(\"set-cookie\", renewedCookie);\n\t}\n\tresponse.headers.set(\"X-Frame-Options\", path === \"/api/host/akm/health-report\" ? \"SAMEORIGIN\" : \"DENY\");\n\tresponse.headers.set(\"X-Content-Type-Options\", \"nosniff\");\n\tresponse.headers.set(\"Referrer-Policy\", \"no-referrer\");\n\treturn response;\n};\n//#endregion\nexport { _resetLaunchCache, handle };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AASA;AACA,IAAI,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC;AAClC,IAAI,gBAAgB,GAAG,KAAK;AAC5B,SAAS,cAAc,GAAG;AAC1B,CAAC,IAAI,gBAAgB,EAAE;AACvB,CAAC,gBAAgB,GAAG,IAAI;AACxB,CAAC,KAAK,MAAM,IAAI,IAAI,8BAA8B,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;AAClF,CAAC,IAAI;AACL,EAAE,MAAM,KAAK,GAAG,QAAQ,EAAE;AAC1B,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE;AACzC,GAAG,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,sBAAsB,CAAC;AAC/D,GAAG,IAAI,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,EAAE,CAAC,OAAO,EAAE;AAC1D,EAAE;AACF,EAAE,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC;AACtD,EAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC9F,EAAE,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC;AACvC,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AACjE,CAAC;AACD;AACA,cAAc,EAAE;AAChB,IAAI,WAAW,GAAG;AAClB,CAAC,QAAQ;AACT,CAAC,YAAY;AACb,CAAC,SAAS;AACV,CAAC;AACD,CAAC;AACD,SAAS,kBAAkB,CAAC,EAAE,EAAE;AAChC,CAAC,OAAO,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,kBAAkB;AACvE;AACG,IAAC,MAAM,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AAC3C,CAAC,MAAM,cAAc,GAAG,2BAA2B,CAAC,KAAK,CAAC;AAC1D,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC;AAC5D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;AAClG,CAAC,IAAI,WAAW,EAAE,OAAO,WAAW;AACpC,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ;AAChC,CAAC,MAAM,UAAU,GAAG,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;AACnE,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,WAAW,CAAC;AACtH,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,kBAAkB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;AAC9I,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC,MAAM,OAAO,GAAG,mBAAmB,EAAE;AACtC,CAAC,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC;AAC/C,CAAC,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;AACpF,CAAC,IAAI,SAAS,IAAI,CAAC,aAAa,IAAI,iBAAiB,KAAK,eAAe,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;AAC/J,CAAC,IAAI,WAAW,IAAI,CAAC,aAAa,IAAI,CAAC,oBAAoB,EAAE,EAAE;AAC/D,EAAE,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AACxF,GAAG,KAAK,EAAE,sBAAsB;AAChC,GAAG,OAAO,EAAE;AACZ,GAAG,CAAC,EAAE;AACN,GAAG,MAAM,EAAE,GAAG;AACd,GAAG,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AAChD,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,IAAI,CAAC,WAAW,EAAE;AACnB,EAAE,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC;AACpD,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;AAC1C,EAAE,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1J,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,WAAW;AACjP,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,WAAW,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;AAC7E,CAAC;AACD,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC;AACjD,CAAC,IAAI,aAAa,GAAG,IAAI;AACzB,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE;AACpC,EAAE,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1H,EAAE,MAAM,OAAO,GAAG,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK;AACxD,EAAE,IAAI,OAAO,EAAE,aAAa,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;AAC1E,CAAC;AACD,CAAC,IAAI,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,EAAE;AACrE,EAAE,MAAM,UAAU,GAAG,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM;AAC5C,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AACD,CAAC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC;AACtC,CAAC,IAAI,aAAa,EAAE;AACpB,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC;AAC/H,CAAC;AACD,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,KAAK,6BAA6B,GAAG,YAAY,GAAG,MAAM,CAAC;AACxG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC;AAC1D,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC;AACvD,CAAC,OAAO,QAAQ;AAChB;;;;"}
+{"version":3,"file":"hooks.server-Bzj8OieV.js","sources":["../../../.svelte-kit/adapter-node/entries/hooks.server.js"],"sourcesContent":["import { i as redirect } from \"../chunks/exports.js\";\nimport { Ot as createLogger, St as stackDirFor, X as readStackRuntimeEnv, bt as resolveOpenPalmHome, it as readSecret } from \"../chunks/compose-args.js\";\nimport { V as isSetupComplete, i as reconcileMdnsResponder } from \"../chunks/src.js\";\nimport { l as isRemoteSetupAllowed, r as collectNetworkExposureWarnings } from \"../chunks/network-preset.js\";\nimport { t as getState } from \"../chunks/state.js\";\nimport { a as getRequestId, n as checkOriginHeader, o as identifyCallerByToken, t as checkHostHeader, v as touchSession } from \"../chunks/helpers.js\";\nimport { t as computeServerRuntimeContext } from \"../chunks/features.js\";\nimport { r as sessionCookieHeader, t as SESSION_COOKIE_NAME } from \"../chunks/session-cookie.js\";\nimport { i as BLOCKING_LANDINGS, n as getCachedLocalInstallState, r as resolveRequestLanding, t as _resetLaunchCache } from \"../chunks/landing.js\";\n//#region src/hooks.server.ts\nvar logger = createLogger(\"admin\");\nvar startupApplyDone = false;\nfunction loadProcessEnv() {\n\tif (startupApplyDone) return;\n\tstartupApplyDone = true;\n\tfor (const line of collectNetworkExposureWarnings(process.env)) logger.warn(line);\n\ttry {\n\t\tconst state = getState();\n\t\tif (!process.env.OP_UI_LOGIN_PASSWORD) {\n\t\t\tconst pw = readSecret(state.homeDir, \"op_ui_login_password\");\n\t\t\tif (pw) process.env.OP_UI_LOGIN_PASSWORD = pw.trimEnd();\n\t\t}\n\t\tconst stackVars = readStackRuntimeEnv(state.homeDir);\n\t\tfor (const [k, v] of Object.entries(stackVars)) if (v && !process.env[k]) process.env[k] = v;\n\t\treconcileMdnsResponder(state.homeDir);\n\t} catch (err) {\n\t\tlogger.error(\"process env load failed\", { error: String(err) });\n\t}\n}\nloadProcessEnv();\nvar SETUP_PATHS = [\n\t\"/setup\",\n\t\"/api/setup\",\n\t\"/health\",\n\t\"/guardian/health\"\n];\nfunction isLocalhostAddress(ip) {\n\treturn ip === \"127.0.0.1\" || ip === \"::1\" || ip === \"::ffff:127.0.0.1\";\n}\nvar handle = async ({ event, resolve }) => {\n\tconst runtimeContext = computeServerRuntimeContext(event);\n\tconst requestId = getRequestId(event);\n\tconst hostError = checkHostHeader(event.request, requestId);\n\tif (hostError) return hostError;\n\tconst originError = checkOriginHeader(event.request, runtimeContext.security.csrfMode, requestId);\n\tif (originError) return originError;\n\tconst path = event.url.pathname;\n\tconst isAuthPath = path === \"/login\" || path.startsWith(\"/login/\");\n\tconst wantsHtml = event.request.method === \"GET\" && (event.request.headers.get(\"accept\") ?? \"\").includes(\"text/html\");\n\tif ((path === \"/host\" || path.startsWith(\"/host/\")) && !runtimeContext.serverCapabilities.includes(\"host:stack:read\")) redirect(302, \"/chat\");\n\tconst isSetupPath = SETUP_PATHS.some((p) => path === p || path.startsWith(`${p}/`));\n\tconst homeDir = resolveOpenPalmHome();\n\tconst setupComplete = isSetupComplete(homeDir);\n\tconst localInstallState = getCachedLocalInstallState(stackDirFor(homeDir), homeDir);\n\tif (wantsHtml && !setupComplete && localInstallState !== \"not_installed\" && !isSetupPath && !isAuthPath && !path.startsWith(\"/admin\")) redirect(302, \"/setup\");\n\tif (isSetupPath && !setupComplete && !isRemoteSetupAllowed()) {\n\t\tif (!isLocalhostAddress(event.getClientAddress())) return new Response(JSON.stringify({\n\t\t\terror: \"setup_localhost_only\",\n\t\t\tmessage: \"Setup is only accessible from the host machine until installation is complete.\"\n\t\t}), {\n\t\t\tstatus: 403,\n\t\t\theaders: { \"content-type\": \"application/json\" }\n\t\t});\n\t}\n\tif (!isSetupPath) {\n\t\tconst landing = await resolveRequestLanding(event);\n\t\tconst [landingPath] = landing.split(\"?\");\n\t\tconst usageExempt = (path.startsWith(\"/chat\") || path.startsWith(\"/advanced\") || path.startsWith(\"/connections\")) && !BLOCKING_LANDINGS.has(landingPath);\n\t\tconst exempt = path.startsWith(\"/api/\") || path.startsWith(\"/proxy/\") || path.startsWith(\"/login\") || path.startsWith(\"/health\") || path.startsWith(\"/guardian/health\") || path.startsWith(\"/host\") || path.startsWith(\"/admin\") || usageExempt;\n\t\tif (path === \"/\" || path !== landingPath && !exempt) redirect(302, landing);\n\t}\n\tevent.locals.role = identifyCallerByToken(event);\n\tlet renewedCookie = null;\n\tif (event.locals.role === \"admin\") {\n\t\tconst match = (event.request.headers.get(\"cookie\") ?? \"\").match(new RegExp(`(?:^|;\\\\s*)${SESSION_COOKIE_NAME}=([^;]+)`));\n\t\tconst renewed = match ? touchSession(match[1]) : false;\n\t\tif (renewed) renewedCookie = sessionCookieHeader(renewed, event.request);\n\t}\n\tif (wantsHtml && !event.locals.role && !isSetupPath && !isAuthPath) {\n\t\tconst redirectTo = path + event.url.search;\n\t\tredirect(302, `/login?redirectTo=${encodeURIComponent(redirectTo)}`);\n\t}\n\tconst response = await resolve(event);\n\tif (renewedCookie) {\n\t\tif (!(response.headers.get(\"set-cookie\") ?? \"\").includes(`op_session=`)) response.headers.append(\"set-cookie\", renewedCookie);\n\t}\n\tresponse.headers.set(\"X-Frame-Options\", path === \"/api/host/akm/health-report\" ? \"SAMEORIGIN\" : \"DENY\");\n\tresponse.headers.set(\"X-Content-Type-Options\", \"nosniff\");\n\tresponse.headers.set(\"Referrer-Policy\", \"no-referrer\");\n\treturn response;\n};\n//#endregion\nexport { _resetLaunchCache, handle };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AASA;AACA,IAAI,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC;AAClC,IAAI,gBAAgB,GAAG,KAAK;AAC5B,SAAS,cAAc,GAAG;AAC1B,CAAC,IAAI,gBAAgB,EAAE;AACvB,CAAC,gBAAgB,GAAG,IAAI;AACxB,CAAC,KAAK,MAAM,IAAI,IAAI,8BAA8B,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;AAClF,CAAC,IAAI;AACL,EAAE,MAAM,KAAK,GAAG,QAAQ,EAAE;AAC1B,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE;AACzC,GAAG,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,sBAAsB,CAAC;AAC/D,GAAG,IAAI,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,EAAE,CAAC,OAAO,EAAE;AAC1D,EAAE;AACF,EAAE,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC;AACtD,EAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC9F,EAAE,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC;AACvC,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AACjE,CAAC;AACD;AACA,cAAc,EAAE;AAChB,IAAI,WAAW,GAAG;AAClB,CAAC,QAAQ;AACT,CAAC,YAAY;AACb,CAAC,SAAS;AACV,CAAC;AACD,CAAC;AACD,SAAS,kBAAkB,CAAC,EAAE,EAAE;AAChC,CAAC,OAAO,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,kBAAkB;AACvE;AACG,IAAC,MAAM,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AAC3C,CAAC,MAAM,cAAc,GAAG,2BAA2B,CAAC,KAAK,CAAC;AAC1D,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC;AAC5D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;AAClG,CAAC,IAAI,WAAW,EAAE,OAAO,WAAW;AACpC,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ;AAChC,CAAC,MAAM,UAAU,GAAG,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;AACnE,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,WAAW,CAAC;AACtH,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,kBAAkB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;AAC9I,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC,MAAM,OAAO,GAAG,mBAAmB,EAAE;AACtC,CAAC,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC;AAC/C,CAAC,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;AACpF,CAAC,IAAI,SAAS,IAAI,CAAC,aAAa,IAAI,iBAAiB,KAAK,eAAe,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;AAC/J,CAAC,IAAI,WAAW,IAAI,CAAC,aAAa,IAAI,CAAC,oBAAoB,EAAE,EAAE;AAC/D,EAAE,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AACxF,GAAG,KAAK,EAAE,sBAAsB;AAChC,GAAG,OAAO,EAAE;AACZ,GAAG,CAAC,EAAE;AACN,GAAG,MAAM,EAAE,GAAG;AACd,GAAG,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AAChD,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,IAAI,CAAC,WAAW,EAAE;AACnB,EAAE,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC;AACpD,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;AAC1C,EAAE,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1J,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,WAAW;AACjP,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,WAAW,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;AAC7E,CAAC;AACD,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC;AACjD,CAAC,IAAI,aAAa,GAAG,IAAI;AACzB,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE;AACpC,EAAE,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1H,EAAE,MAAM,OAAO,GAAG,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK;AACxD,EAAE,IAAI,OAAO,EAAE,aAAa,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;AAC1E,CAAC;AACD,CAAC,IAAI,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,EAAE;AACrE,EAAE,MAAM,UAAU,GAAG,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM;AAC5C,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AACD,CAAC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC;AACtC,CAAC,IAAI,aAAa,EAAE;AACpB,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC;AAC/H,CAAC;AACD,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,KAAK,6BAA6B,GAAG,YAAY,GAAG,MAAM,CAAC;AACxG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC;AAC1D,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC;AACvD,CAAC,OAAO,QAAQ;AAChB;;;;"}

package/build/server/chunks/{http-WP5cji9-.js → http-CfHMreaI.js}

@@ -1,4 +1,4 @@
-import { g as getActiveConnection, b as basicAuthHeader } from './endpoints-WTxemTcn.js';
+import { g as getActiveConnection, b as basicAuthHeader } from './endpoints-IFTldlrt.js';
 
 //#region src/lib/server/opencode/http.ts
 /**
@@ -25,4 +25,4 @@ async function opencodeFetch(path, init) {
 }
 
 export { opencodeFetch as o };
-//# sourceMappingURL=http-WP5cji9-.js.map
+//# sourceMappingURL=http-CfHMreaI.js.map

package/build/server/chunks/{http-WP5cji9-.js.map → http-CfHMreaI.js.map}

@@ -1 +1 @@
-{"version":3,"file":"http-WP5cji9-.js","sources":["../../../.svelte-kit/adapter-node/chunks/http.js"],"sourcesContent":["import { i as getActiveConnection, u as basicAuthHeader } from \"./endpoints.js\";\n//#region src/lib/server/opencode/http.ts\n/**\n* HTTP transport for talking to the active OpenCode endpoint.\n*\n* Used by sibling modules (`config.ts`, `catalog.ts`) — not part of the\n* public API of `$lib/server/opencode`. Reads the active endpoint per-call\n* so user switches in the UI take effect immediately.\n*/\nasync function opencodeFetch(path, init) {\n\tconst endpoint = getActiveConnection();\n\tconst headers = {\n\t\t\"content-type\": \"application/json\",\n\t\t...init?.headers\n\t};\n\tif (endpoint.password) headers.authorization = basicAuthHeader(endpoint.username || \"opencode\", endpoint.password);\n\tconst response = await fetch(`${endpoint.url}${path}`, {\n\t\t...init,\n\t\theaders\n\t});\n\tif (!response.ok) throw new Error(`${init?.method ?? \"GET\"} ${path} failed with ${response.status}`);\n\tif (response.status === 204) return;\n\treturn await response.json();\n}\n//#endregion\nexport { opencodeFetch as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE;AACzC,CAAC,MAAM,QAAQ,GAAG,mBAAmB,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG;AACjB,EAAE,cAAc,EAAE,kBAAkB;AACpC,EAAE,GAAG,IAAI,EAAE;AACX,EAAE;AACF,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,GAAG,eAAe,CAAC,QAAQ,CAAC,QAAQ,IAAI,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC;AACnH,CAAC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE;AACxD,EAAE,GAAG,IAAI;AACT,EAAE;AACF,EAAE,CAAC;AACH,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACrG,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE;AAC9B,CAAC,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE;AAC7B;;;;"}
+{"version":3,"file":"http-CfHMreaI.js","sources":["../../../.svelte-kit/adapter-node/chunks/http.js"],"sourcesContent":["import { d as basicAuthHeader, i as getActiveConnection } from \"./endpoints.js\";\n//#region src/lib/server/opencode/http.ts\n/**\n* HTTP transport for talking to the active OpenCode endpoint.\n*\n* Used by sibling modules (`config.ts`, `catalog.ts`) — not part of the\n* public API of `$lib/server/opencode`. Reads the active endpoint per-call\n* so user switches in the UI take effect immediately.\n*/\nasync function opencodeFetch(path, init) {\n\tconst endpoint = getActiveConnection();\n\tconst headers = {\n\t\t\"content-type\": \"application/json\",\n\t\t...init?.headers\n\t};\n\tif (endpoint.password) headers.authorization = basicAuthHeader(endpoint.username || \"opencode\", endpoint.password);\n\tconst response = await fetch(`${endpoint.url}${path}`, {\n\t\t...init,\n\t\theaders\n\t});\n\tif (!response.ok) throw new Error(`${init?.method ?? \"GET\"} ${path} failed with ${response.status}`);\n\tif (response.status === 204) return;\n\treturn await response.json();\n}\n//#endregion\nexport { opencodeFetch as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE;AACzC,CAAC,MAAM,QAAQ,GAAG,mBAAmB,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG;AACjB,EAAE,cAAc,EAAE,kBAAkB;AACpC,EAAE,GAAG,IAAI,EAAE;AACX,EAAE;AACF,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,GAAG,eAAe,CAAC,QAAQ,CAAC,QAAQ,IAAI,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC;AACnH,CAAC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE;AACxD,EAAE,GAAG,IAAI;AACT,EAAE;AACF,EAAE,CAAC;AACH,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACrG,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE;AAC9B,CAAC,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE;AAC7B;;;;"}