@openpalm/ui 0.13.0-beta.5 → 0.13.0-beta.7

package/build/server/chunks/opencode-target-DYD2zQ4l.js

@@ -0,0 +1,203 @@
+import { ax as readStackEnv, au as readSecret } from './src-B2-r_9oB.js';
+import { g as getState } from './state-Dkjz2T4C.js';
+import { existsSync, readFileSync } from 'node:fs';
+
+/** UTF-8-safe Basic auth header — identical byte sequence to the guardian's encoder. */
+function basicAuthHeader(username, password) {
+	return `Basic ${Buffer.from(`${username}:${password}`, "utf-8").toString("base64")}`;
+}
+/**
+* Strip only trailing newlines from a file-backed secret, matching the
+* assistant entrypoint's `$(cat file)` and the guardian's reader. Surrounding
+* spaces/tabs are preserved so the bytes match across every consumer.
+*/
+function stripTrailingNewlines(value) {
+	return value.replace(/\n+$/, "");
+}
+//#endregion
+//#region src/lib/server/opencode-target.ts
+/**
+* The host's OWN OpenCode target — the local admin assistant the host UI's
+* server routes talk to (config, catalog, health, landing reachability).
+*
+* Phase 3b ("One UI, delete the split"): the browser owns connections and talks
+* to OpenCode directly, so the host connection STORE (`endpoints.json` CRUD +
+* the host assistant proxy broker + the `/api/connections` list/switch surface)
+* is gone. What remains is this: the host process still runs (or points at) one
+* local OpenCode, derived from environment — or, under Electron, the
+* per-launch child advertised in `local-opencode.runtime.json`.
+*
+* This is deliberately small: env/runtime derivation + a liveness probe + a URL
+* validator (for the surviving pairing MINT route). No persistence, no active
+* selection, no user entries — those belong to the browser now.
+*/
+var DEFAULT_ID = "default";
+var LOCAL_ELECTRON_ID = "local-electron";
+function normalizeBrowserFacingUrl(raw) {
+	try {
+		const url = new URL(raw);
+		url.username = "";
+		url.password = "";
+		const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+		if (host === "0.0.0.0" || host === "::") url.hostname = "127.0.0.1";
+		return url.toString().replace(/\/$/, "");
+	} catch {
+		return raw;
+	}
+}
+/**
+* Read the Electron-written runtime.json each time it's needed. The file is
+* 0600 and is rewritten on each Electron launch (random password per launch),
+* so callers must NOT cache the result.
+*/
+function readLocalRuntime() {
+	const path = `${getState().dataDir}/local-opencode.runtime.json`;
+	if (!existsSync(path)) return null;
+	try {
+		const parsed = JSON.parse(readFileSync(path, "utf-8"));
+		if (!parsed || typeof parsed.url !== "string" || !parsed.url) return null;
+		return {
+			url: parsed.url,
+			username: typeof parsed.username === "string" ? parsed.username : void 0,
+			password: typeof parsed.password === "string" ? parsed.password : void 0
+		};
+	} catch (e) {
+		console.warn("[opencode-target] Failed to parse local-opencode.runtime.json:", e);
+		return null;
+	}
+}
+function localTarget() {
+	const rt = readLocalRuntime();
+	if (!rt) return null;
+	return {
+		id: LOCAL_ELECTRON_ID,
+		label: "OpenPalm Admin",
+		url: normalizeBrowserFacingUrl(rt.url),
+		username: rt.username || "opencode",
+		...rt.password ? { password: rt.password } : {},
+		isDefault: false
+	};
+}
+function defaultTarget() {
+	const persisted = readStackEnv(getState().homeDir);
+	const url = process.env.OP_OPENCODE_URL ?? process.env.OP_ASSISTANT_URL ?? `http://127.0.0.1:${process.env.OP_ASSISTANT_PORT ?? persisted.OP_ASSISTANT_PORT ?? "3800"}`;
+	const username = process.env.OPENCODE_SERVER_USERNAME || "opencode";
+	const authEnabled = /^(true|1|yes)$/i.test((persisted.OPENCODE_AUTH ?? process.env.OPENCODE_AUTH ?? "").trim());
+	let presetPassword;
+	if (authEnabled) {
+		const raw = readSecret(getState().homeDir, "op_opencode_password");
+		presetPassword = (raw ? stripTrailingNewlines(raw) : void 0) || process.env.OP_OPENCODE_PASSWORD;
+	}
+	const password = process.env.OPENCODE_SERVER_PASSWORD || presetPassword || void 0;
+	return {
+		id: DEFAULT_ID,
+		label: "Local Assistant",
+		url: normalizeBrowserFacingUrl(url),
+		username,
+		password,
+		isDefault: true
+	};
+}
+/**
+* The host's own OpenCode target: the Electron-spawned local child when its
+* runtime.json is present, otherwise the env-derived default. Re-read each call
+* so a password rotated by a new Electron launch is picked up immediately.
+*/
+function getHostOpencodeTarget() {
+	return localTarget() ?? defaultTarget();
+}
+/**
+* Discriminated validator for a connection/guardian BASE URL. Plain HTTP is
+* allowed for any host (OpenPalm is LAN-first). A query or fragment is rejected
+* because callers concatenate API paths onto the base (`${base}/session`).
+*/
+function validateConnectionUrl(input) {
+	let u;
+	try {
+		u = new URL(input.trim());
+	} catch {
+		return {
+			ok: false,
+			reason: "invalid_url"
+		};
+	}
+	if (u.protocol !== "http:" && u.protocol !== "https:") return {
+		ok: false,
+		reason: "invalid_scheme"
+	};
+	if (!u.hostname) return {
+		ok: false,
+		reason: "missing_host"
+	};
+	if (u.username || u.password) return {
+		ok: false,
+		reason: "userinfo_not_allowed"
+	};
+	if (u.search || u.hash) return {
+		ok: false,
+		reason: "unexpected_query_or_fragment"
+	};
+	return {
+		ok: true,
+		url: u.toString().replace(/\/$/, "")
+	};
+}
+var remoteStatusCache = null;
+async function probeTarget(target) {
+	const headers = new Headers();
+	if (target.password) headers.set("authorization", basicAuthHeader(target.username ?? "opencode", target.password));
+	const probeUrl = `${target.url}/session`;
+	try {
+		const response = await fetch(probeUrl, {
+			method: "GET",
+			headers,
+			redirect: "manual",
+			signal: AbortSignal.timeout(2e3)
+		});
+		if (response.status === 401 || response.status === 403) return {
+			id: target.id,
+			name: target.label,
+			url: target.url,
+			state: "unauthorized",
+			detail: `HTTP ${response.status}`
+		};
+		if (response.ok || response.status >= 300 && response.status < 400) return {
+			id: target.id,
+			name: target.label,
+			url: target.url,
+			state: "accessible"
+		};
+		return {
+			id: target.id,
+			name: target.label,
+			url: target.url,
+			state: "unreachable",
+			detail: `HTTP ${response.status}`
+		};
+	} catch (error) {
+		return {
+			id: target.id,
+			name: target.label,
+			url: target.url,
+			state: "unreachable",
+			detail: error instanceof Error ? error.message : String(error)
+		};
+	}
+}
+/**
+* Probe the host's own OpenCode target, cached in-memory for 5s. Feeds the
+* host-admin landing's reachability signal (`deriveLaunchStatus`). Never
+* written to disk.
+*/
+async function listRemoteStatuses() {
+	if (remoteStatusCache && remoteStatusCache.expiresAt > Date.now()) return remoteStatusCache.value.map((status) => ({ ...status }));
+	const statuses = [await probeTarget(getHostOpencodeTarget())];
+	remoteStatusCache = {
+		value: statuses,
+		expiresAt: Date.now() + 5e3
+	};
+	return statuses.map((status) => ({ ...status }));
+}
+
+export { basicAuthHeader as b, getHostOpencodeTarget as g, listRemoteStatuses as l, validateConnectionUrl as v };
+//# sourceMappingURL=opencode-target-DYD2zQ4l.js.map

package/build/server/chunks/opencode-target-DYD2zQ4l.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opencode-target-DYD2zQ4l.js","sources":["../../../.svelte-kit/adapter-node/chunks/opencode-target.js"],"sourcesContent":["import { Y as readStackEnv, it as readSecret } from \"./compose-args.js\";\nimport \"./src.js\";\nimport { t as getState } from \"./state.js\";\nimport { existsSync, readFileSync } from \"node:fs\";\n/** UTF-8-safe Basic auth header — identical byte sequence to the guardian's encoder. */\nfunction basicAuthHeader(username, password) {\n\treturn `Basic ${Buffer.from(`${username}:${password}`, \"utf-8\").toString(\"base64\")}`;\n}\n/**\n* Strip only trailing newlines from a file-backed secret, matching the\n* assistant entrypoint's `$(cat file)` and the guardian's reader. Surrounding\n* spaces/tabs are preserved so the bytes match across every consumer.\n*/\nfunction stripTrailingNewlines(value) {\n\treturn value.replace(/\\n+$/, \"\");\n}\n//#endregion\n//#region src/lib/server/opencode-target.ts\n/**\n* The host's OWN OpenCode target — the local admin assistant the host UI's\n* server routes talk to (config, catalog, health, landing reachability).\n*\n* Phase 3b (\"One UI, delete the split\"): the browser owns connections and talks\n* to OpenCode directly, so the host connection STORE (`endpoints.json` CRUD +\n* the host assistant proxy broker + the `/api/connections` list/switch surface)\n* is gone. What remains is this: the host process still runs (or points at) one\n* local OpenCode, derived from environment — or, under Electron, the\n* per-launch child advertised in `local-opencode.runtime.json`.\n*\n* This is deliberately small: env/runtime derivation + a liveness probe + a URL\n* validator (for the surviving pairing MINT route). No persistence, no active\n* selection, no user entries — those belong to the browser now.\n*/\nvar DEFAULT_ID = \"default\";\nvar LOCAL_ELECTRON_ID = \"local-electron\";\nfunction normalizeBrowserFacingUrl(raw) {\n\ttry {\n\t\tconst url = new URL(raw);\n\t\turl.username = \"\";\n\t\turl.password = \"\";\n\t\tconst host = url.hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n\t\tif (host === \"0.0.0.0\" || host === \"::\") url.hostname = \"127.0.0.1\";\n\t\treturn url.toString().replace(/\\/$/, \"\");\n\t} catch {\n\t\treturn raw;\n\t}\n}\n/**\n* Read the Electron-written runtime.json each time it's needed. The file is\n* 0600 and is rewritten on each Electron launch (random password per launch),\n* so callers must NOT cache the result.\n*/\nfunction readLocalRuntime() {\n\tconst path = `${getState().dataDir}/local-opencode.runtime.json`;\n\tif (!existsSync(path)) return null;\n\ttry {\n\t\tconst parsed = JSON.parse(readFileSync(path, \"utf-8\"));\n\t\tif (!parsed || typeof parsed.url !== \"string\" || !parsed.url) return null;\n\t\treturn {\n\t\t\turl: parsed.url,\n\t\t\tusername: typeof parsed.username === \"string\" ? parsed.username : void 0,\n\t\t\tpassword: typeof parsed.password === \"string\" ? parsed.password : void 0\n\t\t};\n\t} catch (e) {\n\t\tconsole.warn(\"[opencode-target] Failed to parse local-opencode.runtime.json:\", e);\n\t\treturn null;\n\t}\n}\nfunction localTarget() {\n\tconst rt = readLocalRuntime();\n\tif (!rt) return null;\n\treturn {\n\t\tid: LOCAL_ELECTRON_ID,\n\t\tlabel: \"OpenPalm Admin\",\n\t\turl: normalizeBrowserFacingUrl(rt.url),\n\t\tusername: rt.username || \"opencode\",\n\t\t...rt.password ? { password: rt.password } : {},\n\t\tisDefault: false\n\t};\n}\nfunction defaultTarget() {\n\tconst persisted = readStackEnv(getState().homeDir);\n\tconst url = process.env.OP_OPENCODE_URL ?? process.env.OP_ASSISTANT_URL ?? `http://127.0.0.1:${process.env.OP_ASSISTANT_PORT ?? persisted.OP_ASSISTANT_PORT ?? \"3800\"}`;\n\tconst username = process.env.OPENCODE_SERVER_USERNAME || \"opencode\";\n\tconst authEnabled = /^(true|1|yes)$/i.test((persisted.OPENCODE_AUTH ?? process.env.OPENCODE_AUTH ?? \"\").trim());\n\tlet presetPassword;\n\tif (authEnabled) {\n\t\tconst raw = readSecret(getState().homeDir, \"op_opencode_password\");\n\t\tpresetPassword = (raw ? stripTrailingNewlines(raw) : void 0) || process.env.OP_OPENCODE_PASSWORD;\n\t}\n\tconst password = process.env.OPENCODE_SERVER_PASSWORD || presetPassword || void 0;\n\treturn {\n\t\tid: DEFAULT_ID,\n\t\tlabel: \"Local Assistant\",\n\t\turl: normalizeBrowserFacingUrl(url),\n\t\tusername,\n\t\tpassword,\n\t\tisDefault: true\n\t};\n}\n/**\n* The host's own OpenCode target: the Electron-spawned local child when its\n* runtime.json is present, otherwise the env-derived default. Re-read each call\n* so a password rotated by a new Electron launch is picked up immediately.\n*/\nfunction getHostOpencodeTarget() {\n\treturn localTarget() ?? defaultTarget();\n}\n/**\n* Discriminated validator for a connection/guardian BASE URL. Plain HTTP is\n* allowed for any host (OpenPalm is LAN-first). A query or fragment is rejected\n* because callers concatenate API paths onto the base (`${base}/session`).\n*/\nfunction validateConnectionUrl(input) {\n\tlet u;\n\ttry {\n\t\tu = new URL(input.trim());\n\t} catch {\n\t\treturn {\n\t\t\tok: false,\n\t\t\treason: \"invalid_url\"\n\t\t};\n\t}\n\tif (u.protocol !== \"http:\" && u.protocol !== \"https:\") return {\n\t\tok: false,\n\t\treason: \"invalid_scheme\"\n\t};\n\tif (!u.hostname) return {\n\t\tok: false,\n\t\treason: \"missing_host\"\n\t};\n\tif (u.username || u.password) return {\n\t\tok: false,\n\t\treason: \"userinfo_not_allowed\"\n\t};\n\tif (u.search || u.hash) return {\n\t\tok: false,\n\t\treason: \"unexpected_query_or_fragment\"\n\t};\n\treturn {\n\t\tok: true,\n\t\turl: u.toString().replace(/\\/$/, \"\")\n\t};\n}\nvar remoteStatusCache = null;\nasync function probeTarget(target) {\n\tconst headers = new Headers();\n\tif (target.password) headers.set(\"authorization\", basicAuthHeader(target.username ?? \"opencode\", target.password));\n\tconst probeUrl = `${target.url}/session`;\n\ttry {\n\t\tconst response = await fetch(probeUrl, {\n\t\t\tmethod: \"GET\",\n\t\t\theaders,\n\t\t\tredirect: \"manual\",\n\t\t\tsignal: AbortSignal.timeout(2e3)\n\t\t});\n\t\tif (response.status === 401 || response.status === 403) return {\n\t\t\tid: target.id,\n\t\t\tname: target.label,\n\t\t\turl: target.url,\n\t\t\tstate: \"unauthorized\",\n\t\t\tdetail: `HTTP ${response.status}`\n\t\t};\n\t\tif (response.ok || response.status >= 300 && response.status < 400) return {\n\t\t\tid: target.id,\n\t\t\tname: target.label,\n\t\t\turl: target.url,\n\t\t\tstate: \"accessible\"\n\t\t};\n\t\treturn {\n\t\t\tid: target.id,\n\t\t\tname: target.label,\n\t\t\turl: target.url,\n\t\t\tstate: \"unreachable\",\n\t\t\tdetail: `HTTP ${response.status}`\n\t\t};\n\t} catch (error) {\n\t\treturn {\n\t\t\tid: target.id,\n\t\t\tname: target.label,\n\t\t\turl: target.url,\n\t\t\tstate: \"unreachable\",\n\t\t\tdetail: error instanceof Error ? error.message : String(error)\n\t\t};\n\t}\n}\n/**\n* Probe the host's own OpenCode target, cached in-memory for 5s. Feeds the\n* host-admin landing's reachability signal (`deriveLaunchStatus`). Never\n* written to disk.\n*/\nasync function listRemoteStatuses() {\n\tif (remoteStatusCache && remoteStatusCache.expiresAt > Date.now()) return remoteStatusCache.value.map((status) => ({ ...status }));\n\tconst statuses = [await probeTarget(getHostOpencodeTarget())];\n\tremoteStatusCache = {\n\t\tvalue: statuses,\n\t\texpiresAt: Date.now() + 5e3\n\t};\n\treturn statuses.map((status) => ({ ...status }));\n}\n//#endregion\nexport { basicAuthHeader as i, listRemoteStatuses as n, validateConnectionUrl as r, getHostOpencodeTarget as t };\n"],"names":[],"mappings":";;;;AAIA;AACA,SAAS,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE;AAC7C,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrF;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,KAAK,EAAE;AACtC,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;AACjC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,UAAU,GAAG,SAAS;AAC1B,IAAI,iBAAiB,GAAG,gBAAgB;AACxC,SAAS,yBAAyB,CAAC,GAAG,EAAE;AACxC,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC;AAC1B,EAAE,GAAG,CAAC,QAAQ,GAAG,EAAE;AACnB,EAAE,GAAG,CAAC,QAAQ,GAAG,EAAE;AACnB,EAAE,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;AACjE,EAAE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,WAAW;AACrE,EAAE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AAC1C,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,GAAG;AACZ,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,IAAI,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,4BAA4B,CAAC;AACjE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AACnC,CAAC,IAAI;AACL,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACxD,EAAE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI;AAC3E,EAAE,OAAO;AACT,GAAG,GAAG,EAAE,MAAM,CAAC,GAAG;AAClB,GAAG,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;AAC3E,GAAG,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,KAAK;AAC1E,GAAG;AACH,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,CAAC,IAAI,CAAC,gEAAgE,EAAE,CAAC,CAAC;AACnF,EAAE,OAAO,IAAI;AACb,CAAC;AACD;AACA,SAAS,WAAW,GAAG;AACvB,CAAC,MAAM,EAAE,GAAG,gBAAgB,EAAE;AAC9B,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,IAAI;AACrB,CAAC,OAAO;AACR,EAAE,EAAE,EAAE,iBAAiB;AACvB,EAAE,KAAK,EAAE,gBAAgB;AACzB,EAAE,GAAG,EAAE,yBAAyB,CAAC,EAAE,CAAC,GAAG,CAAC;AACxC,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,UAAU;AACrC,EAAE,GAAG,EAAE,CAAC,QAAQ,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;AACjD,EAAE,SAAS,EAAE;AACb,EAAE;AACF;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC;AACnD,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,SAAS,CAAC,iBAAiB,IAAI,MAAM,CAAC,CAAC;AACxK,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,UAAU;AACpE,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC;AAChH,CAAC,IAAI,cAAc;AACnB,CAAC,IAAI,WAAW,EAAE;AAClB,EAAE,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,sBAAsB,CAAC;AACpE,EAAE,cAAc,GAAG,CAAC,GAAG,GAAG,qBAAqB,CAAC,GAAG,CAAC,GAAG,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,oBAAoB;AAClG,CAAC;AACD,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,cAAc,IAAI,MAAM;AAClF,CAAC,OAAO;AACR,EAAE,EAAE,EAAE,UAAU;AAChB,EAAE,KAAK,EAAE,iBAAiB;AAC1B,EAAE,GAAG,EAAE,yBAAyB,CAAC,GAAG,CAAC;AACrC,EAAE,QAAQ;AACV,EAAE,QAAQ;AACV,EAAE,SAAS,EAAE;AACb,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,GAAG;AACjC,CAAC,OAAO,WAAW,EAAE,IAAI,aAAa,EAAE;AACxC;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,KAAK,EAAE;AACtC,CAAC,IAAI,CAAC;AACN,CAAC,IAAI;AACL,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO;AACT,GAAG,EAAE,EAAE,KAAK;AACZ,GAAG,MAAM,EAAE;AACX,GAAG;AACH,CAAC;AACD,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,OAAO;AAC/D,EAAE,EAAE,EAAE,KAAK;AACX,EAAE,MAAM,EAAE;AACV,EAAE;AACF,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO;AACzB,EAAE,EAAE,EAAE,KAAK;AACX,EAAE,MAAM,EAAE;AACV,EAAE;AACF,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO;AACtC,EAAE,EAAE,EAAE,KAAK;AACX,EAAE,MAAM,EAAE;AACV,EAAE;AACF,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO;AAChC,EAAE,EAAE,EAAE,KAAK;AACX,EAAE,MAAM,EAAE;AACV,EAAE;AACF,CAAC,OAAO;AACR,EAAE,EAAE,EAAE,IAAI;AACV,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE;AACrC,EAAE;AACF;AACA,IAAI,iBAAiB,GAAG,IAAI;AAC5B,eAAe,WAAW,CAAC,MAAM,EAAE;AACnC,CAAC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE;AAC9B,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,eAAe,CAAC,MAAM,CAAC,QAAQ,IAAI,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;AACnH,CAAC,MAAM,QAAQ,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;AACzC,CAAC,IAAI;AACL,EAAE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;AACzC,GAAG,MAAM,EAAE,KAAK;AAChB,GAAG,OAAO;AACV,GAAG,QAAQ,EAAE,QAAQ;AACrB,GAAG,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG;AAClC,GAAG,CAAC;AACJ,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,OAAO;AACjE,GAAG,EAAE,EAAE,MAAM,CAAC,EAAE;AAChB,GAAG,IAAI,EAAE,MAAM,CAAC,KAAK;AACrB,GAAG,GAAG,EAAE,MAAM,CAAC,GAAG;AAClB,GAAG,KAAK,EAAE,cAAc;AACxB,GAAG,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC;AACnC,GAAG;AACH,EAAE,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO;AAC7E,GAAG,EAAE,EAAE,MAAM,CAAC,EAAE;AAChB,GAAG,IAAI,EAAE,MAAM,CAAC,KAAK;AACrB,GAAG,GAAG,EAAE,MAAM,CAAC,GAAG;AAClB,GAAG,KAAK,EAAE;AACV,GAAG;AACH,EAAE,OAAO;AACT,GAAG,EAAE,EAAE,MAAM,CAAC,EAAE;AAChB,GAAG,IAAI,EAAE,MAAM,CAAC,KAAK;AACrB,GAAG,GAAG,EAAE,MAAM,CAAC,GAAG;AAClB,GAAG,KAAK,EAAE,aAAa;AACvB,GAAG,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC;AACnC,GAAG;AACH,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE;AACjB,EAAE,OAAO;AACT,GAAG,EAAE,EAAE,MAAM,CAAC,EAAE;AAChB,GAAG,IAAI,EAAE,MAAM,CAAC,KAAK;AACrB,GAAG,GAAG,EAAE,MAAM,CAAC,GAAG;AAClB,GAAG,KAAK,EAAE,aAAa;AACvB,GAAG,MAAM,EAAE,KAAK,YAAY,KAAK,GAAG,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK;AAChE,GAAG;AACH,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,kBAAkB,GAAG;AACpC,CAAC,IAAI,iBAAiB,IAAI,iBAAiB,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AACnI,CAAC,MAAM,QAAQ,GAAG,CAAC,MAAM,WAAW,CAAC,qBAAqB,EAAE,CAAC,CAAC;AAC9D,CAAC,iBAAiB,GAAG;AACrB,EAAE,KAAK,EAAE,QAAQ;AACjB,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG;AAC1B,EAAE;AACF,CAAC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AACjD;;;;"}

package/build/server/chunks/{paths-CADLTBzK.js → paths-BVdkvR9U.js}

@@ -1,4 +1,4 @@
-import { e as resolve_route, t as try_get_request_store } from './internal-DbH28JEx.js';
+import { e as resolve_route, t as try_get_request_store } from './internal-BNSUwl-r.js';
 import { i as initial_base, c as base } from './environment-BYp8JQYM.js';
 
 //#region ../../node_modules/.bun/@sveltejs+kit@2.61.0+a890f0b024b6eaa9/node_modules/@sveltejs/kit/src/runtime/app/paths/server.js
@@ -14,4 +14,4 @@ function resolve(id, params) {
 }
 
 export { resolve as r };
-//# sourceMappingURL=paths-CADLTBzK.js.map
+//# sourceMappingURL=paths-BVdkvR9U.js.map

package/build/server/chunks/{paths-CADLTBzK.js.map → paths-BVdkvR9U.js.map}

@@ -1 +1 @@
-{"version":3,"file":"paths-CADLTBzK.js","sources":["../../../.svelte-kit/adapter-node/chunks/paths.js"],"sourcesContent":["import { r as try_get_request_store } from \"./server.js\";\nimport { d as initial_base, u as base } from \"./environment.js\";\nimport { n as resolve_route } from \"./routing.js\";\nimport \"./internal.js\";\n//#region ../../node_modules/.bun/@sveltejs+kit@2.61.0+a890f0b024b6eaa9/node_modules/@sveltejs/kit/src/runtime/app/paths/server.js\n/** @type {import('./client.js').resolve} */\nfunction resolve(id, params) {\n\tif (!id.startsWith(\"/\")) throw new Error(`Cannot use \\`resolve(...)\\` with a non-absolute pathname or route ID (got \"${id}\"). \\`resolve\\` is only for internal pathnames and route IDs; external URLs should be used directly.`);\n\tconst resolved = resolve_route(id, params);\n\t{\n\t\tconst store = try_get_request_store();\n\t\tif (store && !store.state.prerendering?.fallback) return (store.event.url.pathname.slice(initial_base.length).split(\"/\").slice(2).map(() => \"..\").join(\"/\") || \".\") + resolved;\n\t}\n\treturn base + resolved;\n}\n//#endregion\nexport { resolve as t };\n"],"names":[],"mappings":";;;AAIA;AACA;AACA,SAAS,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE;AAC7B,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,2EAA2E,EAAE,EAAE,CAAC,oGAAoG,CAAC,CAAC;AACjO,CAAC,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC;AAC3C,CAAC;AACD,EAAE,MAAM,KAAK,GAAG,qBAAqB,EAAE;AACvC,EAAE,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,QAAQ;AAChL,CAAC;AACD,CAAC,OAAO,IAAI,GAAG,QAAQ;AACvB;;;;"}
+{"version":3,"file":"paths-BVdkvR9U.js","sources":["../../../.svelte-kit/adapter-node/chunks/paths.js"],"sourcesContent":["import { r as try_get_request_store } from \"./server.js\";\nimport { d as initial_base, u as base } from \"./environment.js\";\nimport { n as resolve_route } from \"./routing.js\";\nimport \"./internal.js\";\n//#region ../../node_modules/.bun/@sveltejs+kit@2.61.0+a890f0b024b6eaa9/node_modules/@sveltejs/kit/src/runtime/app/paths/server.js\n/** @type {import('./client.js').resolve} */\nfunction resolve(id, params) {\n\tif (!id.startsWith(\"/\")) throw new Error(`Cannot use \\`resolve(...)\\` with a non-absolute pathname or route ID (got \"${id}\"). \\`resolve\\` is only for internal pathnames and route IDs; external URLs should be used directly.`);\n\tconst resolved = resolve_route(id, params);\n\t{\n\t\tconst store = try_get_request_store();\n\t\tif (store && !store.state.prerendering?.fallback) return (store.event.url.pathname.slice(initial_base.length).split(\"/\").slice(2).map(() => \"..\").join(\"/\") || \".\") + resolved;\n\t}\n\treturn base + resolved;\n}\n//#endregion\nexport { resolve as t };\n"],"names":[],"mappings":";;;AAIA;AACA;AACA,SAAS,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE;AAC7B,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,2EAA2E,EAAE,EAAE,CAAC,oGAAoG,CAAC,CAAC;AACjO,CAAC,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC;AAC3C,CAAC;AACD,EAAE,MAAM,KAAK,GAAG,qBAAqB,EAAE;AACvC,EAAE,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,QAAQ;AAChL,CAAC;AACD,CAAC,OAAO,IAAI,GAAG,QAAQ;AACvB;;;;"}

package/build/server/chunks/{runtime-context.svelte-C5zNEC6u.js → runtime-context.svelte-CRT-b6Ae.js}

@@ -1,31 +1,28 @@
 //#region src/lib/runtime-context.svelte.ts
 function resolveCapabilities(serverCaps, clientCtx) {
 	const { displayMode, activeConnection } = clientCtx;
-	if (displayMode === "electron") return serverCaps;
-	if (serverCaps.includes("host:stack:read") && displayMode === "browser") return serverCaps.filter((c) => true);
-	if (serverCaps.includes("connections:single")) return serverCaps.filter((c) => c === "chat" || c.startsWith("assistant-settings"));
-	let caps = serverCaps.filter((c) => c.startsWith("connections") || c === "chat" || c === "pwa:install");
+	if (displayMode === "electron" || serverCaps.includes("host:stack:read") && displayMode === "browser") return serverCaps;
+	let caps = serverCaps.filter((c) => !c.startsWith("host:"));
 	if (activeConnection?.grantedCapabilities) caps = [...new Set([...caps, ...activeConnection.grantedCapabilities])];
 	return caps;
 }
 /**
-* Reactive runtime context. Starts at the unprivileged pwa-static baseline
+* Reactive runtime context. Starts at the unprivileged non-admin baseline
 * with zero capabilities until +layout.svelte initializes it — capabilities
 * are opted INTO from server data, never defaulted on.
 */
 var runtimeContext = {
 	version: 2,
-	hostMode: "pwa-static",
+	admin: false,
 	serverCapabilities: [],
 	publicBaseUrl: "",
 	uiVersion: "",
 	skeletonVersion: "",
-	activeConnectionMode: "multi",
 	routes: {},
 	security: {
 		hostAdminLoopbackOnly: true,
 		requiresHttpsForRemoteConnections: true,
-		csrfMode: "loopback-origin"
+		csrfMode: "same-site"
 	},
 	clientContext: { displayMode: "browser" },
 	effectiveCapabilities: []
@@ -35,7 +32,7 @@ function hasCapability(cap) {
 }
 /**
 * Populate ONLY the server half of the store (everything ServerRuntimeContext
-* carries — capabilities, routes, hostMode, security, versions) and re-derive
+* carries — capabilities, routes, admin, security, versions) and re-derive
 * `effectiveCapabilities` against whatever clientContext is already in the
 * store (the 'browser' baseline until the client half runs).
 *
@@ -59,7 +56,7 @@ function hasCapability(cap) {
 * field (`event.url.origin`), and during SSR this store is process-global
 * under adapter-node — writing it here would leak one request's Host-derived
 * origin to every later reader (PR #562 review). SSR chrome only needs
-* capabilities/hostMode/routes; the browser writes publicBaseUrl per-tab via
+* capabilities/admin/routes; the browser writes publicBaseUrl per-tab via
 * `initializeRuntimeContext` in `onMount`.
 */
 function initializeServerRuntimeContext(serverCtx) {
@@ -69,4 +66,4 @@ function initializeServerRuntimeContext(serverCtx) {
 }
 
 export { runtimeContext as a, hasCapability as h, initializeServerRuntimeContext as i, resolveCapabilities as r };
-//# sourceMappingURL=runtime-context.svelte-C5zNEC6u.js.map
+//# sourceMappingURL=runtime-context.svelte-CRT-b6Ae.js.map

package/build/server/chunks/runtime-context.svelte-CRT-b6Ae.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-context.svelte-CRT-b6Ae.js","sources":["../../../.svelte-kit/adapter-node/chunks/runtime-context.svelte.js"],"sourcesContent":["import \"./dev.js\";\n//#region src/lib/runtime-context.svelte.ts\nfunction resolveCapabilities(serverCaps, clientCtx) {\n\tconst { displayMode, activeConnection } = clientCtx;\n\tif (displayMode === \"electron\" || serverCaps.includes(\"host:stack:read\") && displayMode === \"browser\") return serverCaps;\n\tlet caps = serverCaps.filter((c) => !c.startsWith(\"host:\"));\n\tif (activeConnection?.grantedCapabilities) caps = [...new Set([...caps, ...activeConnection.grantedCapabilities])];\n\treturn caps;\n}\n/**\n* Reactive runtime context. Starts at the unprivileged non-admin baseline\n* with zero capabilities until +layout.svelte initializes it — capabilities\n* are opted INTO from server data, never defaulted on.\n*/\nvar runtimeContext = {\n\tversion: 2,\n\tadmin: false,\n\tserverCapabilities: [],\n\tpublicBaseUrl: \"\",\n\tuiVersion: \"\",\n\tskeletonVersion: \"\",\n\troutes: {},\n\tsecurity: {\n\t\thostAdminLoopbackOnly: true,\n\t\trequiresHttpsForRemoteConnections: true,\n\t\tcsrfMode: \"same-site\"\n\t},\n\tclientContext: { displayMode: \"browser\" },\n\teffectiveCapabilities: []\n};\nfunction hasCapability(cap) {\n\treturn runtimeContext.effectiveCapabilities.includes(cap);\n}\n/**\n* Populate the store from layout data + browser-detected client context and\n* re-derive `effectiveCapabilities`. Called from +layout.svelte (client-only).\n*/\nfunction initializeRuntimeContext(serverCtx, clientCtx) {\n\tObject.assign(runtimeContext, serverCtx);\n\truntimeContext.clientContext = clientCtx;\n\truntimeContext.effectiveCapabilities = resolveCapabilities(serverCtx.serverCapabilities, clientCtx);\n}\n/**\n* Populate ONLY the server half of the store (everything ServerRuntimeContext\n* carries — capabilities, routes, admin, security, versions) and re-derive\n* `effectiveCapabilities` against whatever clientContext is already in the\n* store (the 'browser' baseline until the client half runs).\n*\n* Review 2026-07-10 K2: pre-migration, the equivalent `featuresService.init()`\n* ran directly in +layout.svelte's script body (an `untrack()`-wrapped call,\n* not inside `onMount`) — so it executed during SSR too, and the FIRST\n* server-rendered HTML already reflected the real capabilities (e.g. the\n* admin button was present in SSR output). At HEAD, `initializeRuntimeContext`\n* only ran in `onMount`, which never fires during SSR — every full/hard load\n* server-rendered with the store still at its all-capabilities-empty default,\n* producing a flash of missing chrome until client-side hydration ran.\n*\n* `detectClientDisplayMode()` (the other half) still genuinely needs the\n* browser (matchMedia / navigator), so it stays client-only in `onMount` —\n* only the server half moves earlier. The 'browser' clientContext default is\n* correct for the common case (regular browser tab), so capabilities\n* resolved here already match what `onMount` would (re)compute for that case;\n* `onMount` only changes the outcome for electron / standalone-pwa displays.\n*\n* `publicBaseUrl` is deliberately EXCLUDED: it is the one request-derived\n* field (`event.url.origin`), and during SSR this store is process-global\n* under adapter-node — writing it here would leak one request's Host-derived\n* origin to every later reader (PR #562 review). SSR chrome only needs\n* capabilities/admin/routes; the browser writes publicBaseUrl per-tab via\n* `initializeRuntimeContext` in `onMount`.\n*/\nfunction initializeServerRuntimeContext(serverCtx) {\n\tconst { publicBaseUrl: _requestDerived, ...envDerived } = serverCtx;\n\tObject.assign(runtimeContext, envDerived);\n\truntimeContext.effectiveCapabilities = resolveCapabilities(serverCtx.serverCapabilities, runtimeContext.clientContext);\n}\n//#endregion\nexport { runtimeContext as a, resolveCapabilities as i, initializeRuntimeContext as n, initializeServerRuntimeContext as r, hasCapability as t };\n"],"names":[],"mappings":"AACA;AACA,SAAS,mBAAmB,CAAC,UAAU,EAAE,SAAS,EAAE;AACpD,CAAC,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,SAAS;AACpD,CAAC,IAAI,WAAW,KAAK,UAAU,IAAI,UAAU,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,WAAW,KAAK,SAAS,EAAE,OAAO,UAAU;AACzH,CAAC,IAAI,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAC5D,CAAC,IAAI,gBAAgB,EAAE,mBAAmB,EAAE,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,CAAC,CAAC;AACnH,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,cAAc,GAAG;AACrB,CAAC,OAAO,EAAE,CAAC;AACX,CAAC,KAAK,EAAE,KAAK;AACb,CAAC,kBAAkB,EAAE,EAAE;AACvB,CAAC,aAAa,EAAE,EAAE;AAClB,CAAC,SAAS,EAAE,EAAE;AACd,CAAC,eAAe,EAAE,EAAE;AACpB,CAAC,MAAM,EAAE,EAAE;AACX,CAAC,QAAQ,EAAE;AACX,EAAE,qBAAqB,EAAE,IAAI;AAC7B,EAAE,iCAAiC,EAAE,IAAI;AACzC,EAAE,QAAQ,EAAE;AACZ,EAAE;AACF,CAAC,aAAa,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE;AAC1C,CAAC,qBAAqB,EAAE;AACxB;AACA,SAAS,aAAa,CAAC,GAAG,EAAE;AAC5B,CAAC,OAAO,cAAc,CAAC,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC;AAC1D;AAUA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,8BAA8B,CAAC,SAAS,EAAE;AACnD,CAAC,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,GAAG,UAAU,EAAE,GAAG,SAAS;AACpE,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,UAAU,CAAC;AAC1C,CAAC,cAAc,CAAC,qBAAqB,GAAG,mBAAmB,CAAC,SAAS,CAAC,kBAAkB,EAAE,cAAc,CAAC,aAAa,CAAC;AACvH;;;;"}

package/build/server/chunks/{session-cookie-9GKSbczI.js → session-cookie-D2_H1UEW.js}

@@ -1,4 +1,4 @@
-import { S as SESSION_TTL_SECONDS } from './helpers-9U7R7yqL.js';
+import { S as SESSION_TTL_SECONDS } from './helpers-DWpoPvHz.js';
 
 //#region src/lib/server/session-cookie.ts
 /**
@@ -71,4 +71,4 @@ function clearSessionCookieHeader(request) {
 }
 
 export { SESSION_COOKIE_NAME as S, clearSessionCookieHeader as c, sessionCookieHeader as s };
-//# sourceMappingURL=session-cookie-9GKSbczI.js.map
+//# sourceMappingURL=session-cookie-D2_H1UEW.js.map

package/build/server/chunks/{session-cookie-9GKSbczI.js.map → session-cookie-D2_H1UEW.js.map}

@@ -1 +1 @@
-{"version":3,"file":"session-cookie-9GKSbczI.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}
+{"version":3,"file":"session-cookie-D2_H1UEW.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}

package/build/server/chunks/{setup-deploy-32URXYdb.js → setup-deploy-C1h733rH.js}

@@ -1,4 +1,4 @@
-import { k as backupSetupInputs, aZ as runDeploy, aV as resolveDeployJournalPath, af as isSetupComplete, aX as resolveOpenPalmHome, ay as readDeployJournal, ao as markSetupComplete } from './src-AHSKeKr0.js';
+import { j as backupSetupInputs, aT as runDeploy, aM as resolveDeployJournalPath, ad as isSetupComplete, aO as resolveOpenPalmHome, at as readDeployJournal, al as markSetupComplete } from './src-B2-r_9oB.js';
 
 //#region src/lib/server/setup-deploy.ts
 var _state = {
@@ -72,4 +72,4 @@ function prepareSetupRestorePoint(state) {
 }
 
 export { getDeployState as g, prepareSetupRestorePoint as p, resetDeployState as r, startDeploy as s };
-//# sourceMappingURL=setup-deploy-32URXYdb.js.map
+//# sourceMappingURL=setup-deploy-C1h733rH.js.map

package/build/server/chunks/{setup-deploy-32URXYdb.js.map → setup-deploy-C1h733rH.js.map}

@@ -1 +1 @@
-{"version":3,"file":"setup-deploy-32URXYdb.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { Tt as resolveOpenPalmHome } from \"./compose-args.js\";\nimport { A as backupSetupInputs, B as isSetupComplete, M as readDeployJournal, N as resolveDeployJournalPath, P as runDeploy, j as markSetupComplete } from \"./src.js\";\n//#region src/lib/server/setup-deploy.ts\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\timageWarning: null,\n\tphase: \"writing-config\"\n};\nvar _deployPromise = null;\nfunction deployStateFromJournal(state) {\n\tconst journal = readDeployJournal(resolveDeployJournalPath(state));\n\treturn {\n\t\tdeploying: journal.deploying,\n\t\tinterrupted: journal.interrupted,\n\t\tsetupComplete: journal.setupComplete || isSetupComplete(resolveOpenPalmHome()),\n\t\tdeployStatus: journal.deployStatus,\n\t\tdeployError: journal.deployError,\n\t\timageWarning: journal.imageWarning,\n\t\tphase: journal.phase\n\t};\n}\nfunction getDeployState(state) {\n\tif (state) _state = deployStateFromJournal(state);\n\telse if (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveOpenPalmHome())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: _state.deployStatus.map((entry) => ({ ...entry }))\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\timageWarning: null,\n\t\tphase: \"writing-config\"\n\t};\n}\nfunction startDeploy(state) {\n\tif (_deployPromise) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\treturn;\n\t}\n\t_deployPromise = (async () => {\n\t\tawait runDeploy(state, {\n\t\t\tjournalPath: resolveDeployJournalPath(state),\n\t\t\tonUpdate(progress) {\n\t\t\t\t_state = {\n\t\t\t\t\tdeploying: progress.deploying,\n\t\t\t\t\tinterrupted: progress.interrupted,\n\t\t\t\t\tsetupComplete: progress.setupComplete,\n\t\t\t\t\tdeployStatus: progress.deployStatus,\n\t\t\t\t\tdeployError: progress.deployError,\n\t\t\t\t\timageWarning: progress.imageWarning,\n\t\t\t\t\tphase: progress.phase\n\t\t\t\t};\n\t\t\t},\n\t\t\tmarkSetupComplete() {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t}\n\t\t});\n\t})().finally(() => {\n\t\t_deployPromise = null;\n\t});\n}\nfunction prepareSetupRestorePoint(state) {\n\treturn backupSetupInputs(state);\n}\n//#endregion\nexport { startDeploy as i, prepareSetupRestorePoint as n, resetDeployState as r, getDeployState as t };\n"],"names":[],"mappings":";;AAEA;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,YAAY,EAAE,IAAI;AACnB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,IAAI,cAAc,GAAG,IAAI;AACzB,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;AAC9B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAC;AAChF,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,KAAK,EAAE,OAAO,CAAC;AACjB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,IAAI,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAClD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AAC3H,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AACjE,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,YAAY,EAAE,IAAI;AACpB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,cAAc,EAAE;AACrB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE;AACF,CAAC;AACD,CAAC,cAAc,GAAG,CAAC,YAAY;AAC/B,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;AACzB,GAAG,WAAW,EAAE,wBAAwB,CAAC,KAAK,CAAC;AAC/C,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,MAAM,GAAG;AACb,KAAK,SAAS,EAAE,QAAQ,CAAC,SAAS;AAClC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,aAAa,EAAE,QAAQ,CAAC,aAAa;AAC1C,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,KAAK,EAAE,QAAQ,CAAC;AACrB,KAAK;AACL,GAAG,CAAC;AACJ,GAAG,iBAAiB,GAAG;AACvB,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;AACpB,EAAE,cAAc,GAAG,IAAI;AACvB,CAAC,CAAC,CAAC;AACH;AACA,SAAS,wBAAwB,CAAC,KAAK,EAAE;AACzC,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC;AAChC;;;;"}
+{"version":3,"file":"setup-deploy-C1h733rH.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { bt as resolveOpenPalmHome } from \"./compose-args.js\";\nimport { A as backupSetupInputs, B as isSetupComplete, M as readDeployJournal, N as resolveDeployJournalPath, P as runDeploy, j as markSetupComplete } from \"./src.js\";\n//#region src/lib/server/setup-deploy.ts\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\timageWarning: null,\n\tphase: \"writing-config\"\n};\nvar _deployPromise = null;\nfunction deployStateFromJournal(state) {\n\tconst journal = readDeployJournal(resolveDeployJournalPath(state));\n\treturn {\n\t\tdeploying: journal.deploying,\n\t\tinterrupted: journal.interrupted,\n\t\tsetupComplete: journal.setupComplete || isSetupComplete(resolveOpenPalmHome()),\n\t\tdeployStatus: journal.deployStatus,\n\t\tdeployError: journal.deployError,\n\t\timageWarning: journal.imageWarning,\n\t\tphase: journal.phase\n\t};\n}\nfunction getDeployState(state) {\n\tif (state) _state = deployStateFromJournal(state);\n\telse if (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveOpenPalmHome())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: _state.deployStatus.map((entry) => ({ ...entry }))\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\timageWarning: null,\n\t\tphase: \"writing-config\"\n\t};\n}\nfunction startDeploy(state) {\n\tif (_deployPromise) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\treturn;\n\t}\n\t_deployPromise = (async () => {\n\t\tawait runDeploy(state, {\n\t\t\tjournalPath: resolveDeployJournalPath(state),\n\t\t\tonUpdate(progress) {\n\t\t\t\t_state = {\n\t\t\t\t\tdeploying: progress.deploying,\n\t\t\t\t\tinterrupted: progress.interrupted,\n\t\t\t\t\tsetupComplete: progress.setupComplete,\n\t\t\t\t\tdeployStatus: progress.deployStatus,\n\t\t\t\t\tdeployError: progress.deployError,\n\t\t\t\t\timageWarning: progress.imageWarning,\n\t\t\t\t\tphase: progress.phase\n\t\t\t\t};\n\t\t\t},\n\t\t\tmarkSetupComplete() {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t}\n\t\t});\n\t})().finally(() => {\n\t\t_deployPromise = null;\n\t});\n}\nfunction prepareSetupRestorePoint(state) {\n\treturn backupSetupInputs(state);\n}\n//#endregion\nexport { startDeploy as i, prepareSetupRestorePoint as n, resetDeployState as r, getDeployState as t };\n"],"names":[],"mappings":";;AAEA;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,YAAY,EAAE,IAAI;AACnB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,IAAI,cAAc,GAAG,IAAI;AACzB,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;AAC9B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAC;AAChF,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,KAAK,EAAE,OAAO,CAAC;AACjB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,IAAI,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAClD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AAC3H,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AACjE,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,YAAY,EAAE,IAAI;AACpB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,cAAc,EAAE;AACrB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE;AACF,CAAC;AACD,CAAC,cAAc,GAAG,CAAC,YAAY;AAC/B,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;AACzB,GAAG,WAAW,EAAE,wBAAwB,CAAC,KAAK,CAAC;AAC/C,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,MAAM,GAAG;AACb,KAAK,SAAS,EAAE,QAAQ,CAAC,SAAS;AAClC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,aAAa,EAAE,QAAQ,CAAC,aAAa;AAC1C,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,KAAK,EAAE,QAAQ,CAAC;AACrB,KAAK;AACL,GAAG,CAAC;AACJ,GAAG,iBAAiB,GAAG;AACvB,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;AACpB,EAAE,cAAc,GAAG,IAAI;AACvB,CAAC,CAAC,CAAC;AACH;AACA,SAAS,wBAAwB,CAAC,KAAK,EAAE;AACzC,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC;AAChC;;;;"}