@openpalm/ui 0.13.0-beta.6 → 0.13.0-beta.7

package/build/server/chunks/endpoints-IFTldlrt.js

@@ -1,473 +0,0 @@
-import { ax as readStackEnv, au as readSecret } from './src-DbArH65P.js';
-import { g as getState } from './state-Bq8fep3F.js';
-import { existsSync, readFileSync, mkdirSync, writeFileSync, chmodSync, unlinkSync } from 'node:fs';
-import { dirname } from 'node:path';
-import { randomUUID } from 'node:crypto';
-
-//#region src/lib/server/basic-auth.ts
-/**
-* Shared HTTP Basic-auth encoding for host-UI → OpenCode/guardian calls.
-*
-* PR #564 P2-1: every host forwarder MUST send the exact same UTF-8 byte
-* sequence the assistant and guardian expect. Two divergences caused correct
-* passwords to 401 from the host:
-*  - `btoa()` is Latin-1-only and throws / corrupts on non-Latin-1 bytes
-*    (accents, CJK, emoji). Encode UTF-8 first (matches the guardian's
-*    `Buffer.from(..., 'utf-8')`).
-*  - the file-backed password was `.trim()`-ed, stripping surrounding spaces,
-*    while the assistant entrypoint (`$(cat)`) and the guardian strip only
-*    trailing newlines. Use `stripTrailingNewlines` so a password like
-*    `"päss 🔒 "` authenticates identically everywhere.
-*/
-/** OpenCode's server default Basic-auth username (the shipped assistant compose never overrides it). */
-var DEFAULT_OPENCODE_USERNAME$1 = "opencode";
-/** UTF-8-safe Basic auth header — identical byte sequence to the guardian's encoder. */
-function basicAuthHeader(username, password) {
-	return `Basic ${Buffer.from(`${username}:${password}`, "utf-8").toString("base64")}`;
-}
-/**
-* Strip only trailing newlines from a file-backed secret, matching the
-* assistant entrypoint's `$(cat file)` and the guardian's reader. Surrounding
-* spaces/tabs are preserved so the bytes match across every consumer.
-*/
-function stripTrailingNewlines(value) {
-	return value.replace(/\n+$/, "");
-}
-//#endregion
-//#region src/lib/server/endpoints.ts
-/**
-* Assistant connections — list of OpenCode servers the UI can target, with
-* one marked active. The internal model uses "connection" language (plan
-* ui-runtime-modes-plan.md §6.6, Phase 2 / #486); the on-disk file keeps its
-* historical name and schema keys — `endpoints.json` with
-* `{ activeId, endpoints }` — and is NEVER renamed or migrated.
-*
-* The "default" entry is synthesized from environment (OP_OPENCODE_URL /
-* OP_ASSISTANT_URL / OP_ASSISTANT_PORT) and cannot be deleted. User-added
-* connections are persisted to a JSON file in the config directory (it's
-* user-owned configuration, not service state — see Phase 5 / D4 in
-* docs/technical/auth-and-proxy-refactor-plan.md).
-*
-* File: ${configDir}/endpoints.json (mode 0600)
-* Shape: { activeId: string | null, endpoints: ConnectionEntry[] }
-*   - activeId === null or "default" → use the env-derived default
-*   - activeId === "<id>" → use the matching user entry (falls back to default if not found)
-*
-* Legacy path: ${dataDir}/admin/endpoints.json. Old installs are
-* migrated lazily on first read by maybeMigrateLegacyEndpointsFile().
-*/
-/**
-* Read-time kind defaulting (plan §6.6): a user-persisted record without a
-* `kind` key is a remote OpenCode connection — that is the only thing the
-* pre-Phase-2 UI let users add. Explicit kinds pass through untouched.
-*/
-function kindOf(entry) {
-	return entry.kind ?? "remote-opencode";
-}
-var DEFAULT_ID = "default";
-/**
-* OpenCode's server default Basic-auth username. The shipped assistant compose
-* never overrides OPENCODE_SERVER_USERNAME, and the guardian's upstream auth
-* sends `opencode:<password>`, so every host-UI forwarder must default here or
-* a correct password 401s (PR #564 r3566888629). User-added connections may
-* still carry an explicit username.
-*/
-var DEFAULT_OPENCODE_USERNAME = DEFAULT_OPENCODE_USERNAME$1;
-var LOCAL_ELECTRON_ID = "local-electron";
-var remoteStatusCache = null;
-function endpointsPath() {
-	return `${getState().configDir}/endpoints.json`;
-}
-/**
-* Legacy path used before Phase 5 of the auth/proxy refactor.
-* See docs/technical/auth-and-proxy-refactor-plan.md § Phase 5 / D4.
-*/
-function legacyEndpointsPath() {
-	return `${getState().dataDir}/admin/endpoints.json`;
-}
-/**
-* One-shot lazy migration from the legacy data/ path to the new config/ path.
-*
-* Phase 5 of docs/technical/auth-and-proxy-refactor-plan.md (D6 step 3):
-*   - If the new path already exists → no-op (already migrated).
-*   - If the legacy path doesn't exist → no-op (fresh install).
-*   - Otherwise copy contents to the new path (mode 0600), then unlink legacy.
-*
-* If the migration fails partway, the legacy file is left in place so reads
-* fall back to it for the remainder of this session. Idempotent across
-* process restarts because the existence check makes it a no-op after the
-* first successful run.
-*/
-function maybeMigrateLegacyEndpointsFile() {
-	const newPath = endpointsPath();
-	if (existsSync(newPath)) return;
-	const oldPath = legacyEndpointsPath();
-	if (!existsSync(oldPath)) return;
-	try {
-		mkdirSync(dirname(newPath), { recursive: true });
-		writeFileSync(newPath, readFileSync(oldPath), { mode: 384 });
-		try {
-			chmodSync(newPath, 384);
-		} catch {}
-		unlinkSync(oldPath);
-	} catch (e) {
-		console.warn("[endpoints] Failed to migrate legacy endpoints.json from data/ to config/. Leaving the old file in place; reads will fall back to it for this session.", e);
-	}
-}
-function localRuntimePath() {
-	return `${getState().dataDir}/local-opencode.runtime.json`;
-}
-/**
-* Read the Electron-written runtime.json each time it's needed. The file is
-* 0600 and is rewritten on each Electron launch (random password per launch),
-* so callers must NOT cache the result.
-*/
-function readLocalRuntime() {
-	const path = localRuntimePath();
-	if (!existsSync(path)) return null;
-	try {
-		const parsed = JSON.parse(readFileSync(path, "utf-8"));
-		if (!parsed || typeof parsed.url !== "string" || !parsed.url) return null;
-		return {
-			url: parsed.url,
-			username: typeof parsed.username === "string" ? parsed.username : void 0,
-			password: typeof parsed.password === "string" ? parsed.password : void 0,
-			pid: typeof parsed.pid === "number" ? parsed.pid : void 0,
-			startedAt: typeof parsed.startedAt === "string" ? parsed.startedAt : void 0
-		};
-	} catch (e) {
-		console.warn("[endpoints] Failed to parse local-opencode.runtime.json:", e);
-		return null;
-	}
-}
-function localEndpoint() {
-	const rt = readLocalRuntime();
-	if (!rt) return null;
-	return {
-		id: LOCAL_ELECTRON_ID,
-		label: "OpenPalm Admin",
-		url: normalizeBrowserFacingUrl(rt.url),
-		username: rt.username || DEFAULT_OPENCODE_USERNAME,
-		...rt.password ? { password: rt.password } : {},
-		kind: "local-opencode",
-		isDefault: false,
-		isLocal: true
-	};
-}
-function normalizeBrowserFacingUrl(raw) {
-	try {
-		const url = new URL(raw);
-		url.username = "";
-		url.password = "";
-		const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
-		if (host === "0.0.0.0" || host === "::") url.hostname = "127.0.0.1";
-		return url.toString().replace(/\/$/, "");
-	} catch {
-		return raw;
-	}
-}
-/** Strip legacy URL userinfo before a connection reaches a serializer or view. */
-function redactEndpointUrlUserinfo(raw) {
-	return normalizeBrowserFacingUrl(raw);
-}
-function redactEntryUrl(entry) {
-	const url = redactEndpointUrlUserinfo(entry.url);
-	return url === entry.url ? entry : {
-		...entry,
-		url
-	};
-}
-function readFile() {
-	maybeMigrateLegacyEndpointsFile();
-	let path = endpointsPath();
-	if (!existsSync(path)) {
-		const legacy = legacyEndpointsPath();
-		if (!existsSync(legacy)) return {
-			activeId: null,
-			endpoints: []
-		};
-		path = legacy;
-	}
-	try {
-		const parsed = JSON.parse(readFileSync(path, "utf-8"));
-		return {
-			activeId: typeof parsed.activeId === "string" ? parsed.activeId : null,
-			endpoints: Array.isArray(parsed.endpoints) ? parsed.endpoints.filter(isValidEntry).map(redactEntryUrl) : []
-		};
-	} catch (e) {
-		console.warn("[endpoints] Failed to parse endpoints.json, resetting:", e);
-		return {
-			activeId: null,
-			endpoints: []
-		};
-	}
-}
-function isValidEntry(e) {
-	if (!e || typeof e !== "object") return false;
-	const o = e;
-	return typeof o.id === "string" && typeof o.label === "string" && typeof o.url === "string";
-}
-function writeFile(data) {
-	const path = endpointsPath();
-	mkdirSync(dirname(path), { recursive: true });
-	const safeData = {
-		...data,
-		endpoints: data.endpoints.map(redactEntryUrl)
-	};
-	writeFileSync(path, JSON.stringify(safeData, null, 2), {
-		encoding: "utf-8",
-		mode: 384
-	});
-	try {
-		chmodSync(path, 384);
-	} catch {}
-}
-function defaultEndpoint() {
-	const persisted = readStackEnv(getState().homeDir);
-	const url = process.env.OP_OPENCODE_URL ?? process.env.OP_ASSISTANT_URL ?? `http://127.0.0.1:${process.env.OP_ASSISTANT_PORT ?? persisted.OP_ASSISTANT_PORT ?? "3800"}`;
-	const username = process.env.OPENCODE_SERVER_USERNAME || DEFAULT_OPENCODE_USERNAME;
-	const presetPassword = /^(true|1|yes)$/i.test((persisted.OPENCODE_AUTH ?? process.env.OPENCODE_AUTH ?? "").trim()) ? ((raw) => raw ? stripTrailingNewlines(raw) : void 0)(readSecret(getState().homeDir, "op_opencode_password") ?? void 0) || process.env.OP_OPENCODE_PASSWORD : void 0;
-	const password = process.env.OPENCODE_SERVER_PASSWORD || presetPassword || void 0;
-	return {
-		id: DEFAULT_ID,
-		label: "Local Assistant",
-		url: normalizeBrowserFacingUrl(url),
-		username,
-		password,
-		kind: "local-opencode",
-		isDefault: true
-	};
-}
-/**
-* Discriminated validator that callers (admin routes) use to surface
-* specific error messages. Plain HTTP is allowed for any host — OpenPalm is
-* LAN-first, so remote instances on a private network are reached over http://.
-*/
-function validateEndpointUrl(input) {
-	let u;
-	try {
-		u = new URL(input.trim());
-	} catch {
-		return {
-			ok: false,
-			reason: "invalid_url"
-		};
-	}
-	if (u.protocol !== "http:" && u.protocol !== "https:") return {
-		ok: false,
-		reason: "invalid_scheme"
-	};
-	if (!u.hostname) return {
-		ok: false,
-		reason: "missing_host"
-	};
-	if (u.username || u.password) return {
-		ok: false,
-		reason: "userinfo_not_allowed"
-	};
-	if (u.search || u.hash) return {
-		ok: false,
-		reason: "unexpected_query_or_fragment"
-	};
-	return {
-		ok: true,
-		url: u.toString().replace(/\/$/, "")
-	};
-}
-/**
-* Validate a URL string — must be http(s) with a host. Returns the normalized
-* URL or null. For finer-grained errors, use `validateEndpointUrl`.
-*/
-function normalizeEndpointUrl(input) {
-	const result = validateEndpointUrl(input);
-	return result.ok ? result.url : null;
-}
-/**
-* Returns: [local-electron (if Electron is running it), default, ...user entries].
-* The local-electron entry is synthesized at call time from
-* state/local-opencode.runtime.json — never persisted to endpoints.json.
-*/
-function listConnections() {
-	const { endpoints } = readFile();
-	const local = localEndpoint();
-	return [
-		...local ? [local] : [],
-		defaultEndpoint(),
-		...endpoints.map((e) => ({
-			...e,
-			kind: kindOf(e),
-			isDefault: false
-		}))
-	];
-}
-/**
-* Returns the active connection, falling back to the default if no active id
-* is set OR if the active id is `local-electron` but the runtime.json isn't
-* there (e.g. the Electron child died). Re-reads runtime.json each call so a
-* password rotated by a new Electron launch is picked up immediately.
-*/
-function getActiveConnection() {
-	const { activeId, endpoints } = readFile();
-	if (activeId === LOCAL_ELECTRON_ID) {
-		const local = localEndpoint();
-		if (local) return local;
-		return defaultEndpoint();
-	}
-	if (!activeId || activeId === DEFAULT_ID) return defaultEndpoint();
-	const found = endpoints.find((e) => e.id === activeId);
-	if (!found) return defaultEndpoint();
-	return {
-		...found,
-		kind: kindOf(found),
-		isDefault: false
-	};
-}
-function setActiveConnectionId(id) {
-	const data = readFile();
-	if (!id || id === DEFAULT_ID) data.activeId = null;
-	else if (id === LOCAL_ELECTRON_ID) {
-		if (!localEndpoint()) throw new Error("Local OpenCode is not running (Electron only)");
-		data.activeId = LOCAL_ELECTRON_ID;
-	} else {
-		if (!data.endpoints.some((e) => e.id === id)) throw new Error(`Endpoint not found: ${id}`);
-		data.activeId = id;
-	}
-	writeFile(data);
-	return getActiveConnection();
-}
-/**
-* User-addable connection kinds (#486 D2). `local-opencode` is reserved for
-* synthesized entries (the env-derived default, the Electron local-runtime
-* entry) and is never accepted from a write path.
-*/
-var USER_ADDABLE_CONNECTION_KINDS = ["remote-opencode", "openpalm-client-api"];
-/**
-* Normalize a guardian ('openpalm-client-api'-kind) connection URL so it
-* always ends in `/oc` — the guardian's direct-ingress base path
-* (#486 D2). Operates on an ALREADY `normalizeEndpointUrl`-ed string (no
-* trailing slash), so only the `/oc` suffix logic is needed here.
-*
-* `packages/client/src/lib/connections/url-policy.ts` carries a deliberate
-* CLIENT-side twin (`normalizeGuardianUrl`) with the same rule — the client
-* artifact may not import host code and vice versa, so this is the same
-* accepted duplication as `validateConnectionUrl`/`validateEndpointUrl`.
-* Both are pinned by their own tests.
-*/
-function normalizeGuardianOcUrl(url) {
-	return url.endsWith("/oc") ? url : `${url}/oc`;
-}
-function assertAddableKind(kind) {
-	if (kind === void 0) return;
-	if (!USER_ADDABLE_CONNECTION_KINDS.includes(kind)) throw new Error("Invalid connection kind");
-}
-function addConnection(input) {
-	const label = input.label.trim();
-	if (!label) throw new Error("Label is required");
-	let url = normalizeEndpointUrl(input.url);
-	if (!url) throw new Error("URL must be a valid http(s) URL");
-	assertAddableKind(input.kind);
-	if (input.kind === "openpalm-client-api") url = normalizeGuardianOcUrl(url);
-	const data = readFile();
-	const entry = {
-		id: randomUUID(),
-		label,
-		url,
-		...input.password ? { password: input.password } : {},
-		...input.kind ? { kind: input.kind } : {}
-	};
-	data.endpoints.push(entry);
-	writeFile(data);
-	return entry;
-}
-function updateConnection(id, patch) {
-	if (id === DEFAULT_ID) throw new Error("Cannot edit the default endpoint");
-	if (id === LOCAL_ELECTRON_ID) throw new Error("Cannot edit the local Electron OpenCode entry (it is ephemeral and per-launch)");
-	assertAddableKind(patch.kind);
-	const data = readFile();
-	const idx = data.endpoints.findIndex((e) => e.id === id);
-	if (idx === -1) throw new Error(`Endpoint not found: ${id}`);
-	const next = { ...data.endpoints[idx] };
-	if (patch.label !== void 0) {
-		const label = patch.label.trim();
-		if (!label) throw new Error("Label cannot be empty");
-		next.label = label;
-	}
-	if (patch.url !== void 0) {
-		const url = normalizeEndpointUrl(patch.url);
-		if (!url) throw new Error("URL must be a valid http(s) URL");
-		next.url = url;
-	}
-	if (patch.password === null) delete next.password;
-	else if (typeof patch.password === "string") next.password = patch.password;
-	if (patch.kind !== void 0) next.kind = patch.kind;
-	if (next.kind === "openpalm-client-api") next.url = normalizeGuardianOcUrl(next.url);
-	data.endpoints[idx] = next;
-	writeFile(data);
-	return next;
-}
-function deleteConnection(id) {
-	if (id === DEFAULT_ID) throw new Error("Cannot delete the default endpoint");
-	if (id === LOCAL_ELECTRON_ID) throw new Error("Cannot delete the local Electron OpenCode entry (managed by Electron lifecycle)");
-	const data = readFile();
-	const idx = data.endpoints.findIndex((e) => e.id === id);
-	if (idx === -1) throw new Error(`Endpoint not found: ${id}`);
-	data.endpoints.splice(idx, 1);
-	if (data.activeId === id) data.activeId = null;
-	writeFile(data);
-}
-async function probeEndpoint(endpoint) {
-	const headers = new Headers();
-	if (endpoint.password) {
-		const username = endpoint.username ?? DEFAULT_OPENCODE_USERNAME;
-		headers.set("authorization", basicAuthHeader(username, endpoint.password));
-	}
-	const probeUrl = endpoint.kind === "openpalm-client-api" ? `${endpoint.url}/session` : endpoint.url;
-	try {
-		const response = await fetch(probeUrl, {
-			method: "GET",
-			headers,
-			redirect: "manual",
-			signal: AbortSignal.timeout(2e3)
-		});
-		if (response.status === 401 || response.status === 403) return {
-			id: endpoint.id,
-			name: endpoint.label,
-			url: endpoint.url,
-			state: "unauthorized",
-			detail: `HTTP ${response.status}`
-		};
-		if (response.ok || response.status >= 300 && response.status < 400) return {
-			id: endpoint.id,
-			name: endpoint.label,
-			url: endpoint.url,
-			state: "accessible"
-		};
-		return {
-			id: endpoint.id,
-			name: endpoint.label,
-			url: endpoint.url,
-			state: "unreachable",
-			detail: `HTTP ${response.status}`
-		};
-	} catch (error) {
-		return {
-			id: endpoint.id,
-			name: endpoint.label,
-			url: endpoint.url,
-			state: "unreachable",
-			detail: error instanceof Error ? error.message : String(error)
-		};
-	}
-}
-async function listRemoteStatuses() {
-	if (remoteStatusCache && remoteStatusCache.expiresAt > Date.now()) return remoteStatusCache.value.map((status) => ({ ...status }));
-	const statuses = await Promise.all(listConnections().map((endpoint) => probeEndpoint(endpoint)));
-	remoteStatusCache = {
-		value: statuses,
-		expiresAt: Date.now() + 5e3
-	};
-	return statuses.map((status) => ({ ...status }));
-}
-
-export { USER_ADDABLE_CONNECTION_KINDS as U, addConnection as a, basicAuthHeader as b, listRemoteStatuses as c, deleteConnection as d, getActiveConnection as g, listConnections as l, redactEndpointUrlUserinfo as r, setActiveConnectionId as s, updateConnection as u, validateEndpointUrl as v };
-//# sourceMappingURL=endpoints-IFTldlrt.js.map

package/build/server/chunks/endpoints-IFTldlrt.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"endpoints-IFTldlrt.js","sources":["../../../.svelte-kit/adapter-node/chunks/endpoints.js"],"sourcesContent":["import { Y as readStackEnv, it as readSecret } from \"./compose-args.js\";\nimport \"./src.js\";\nimport { t as getState } from \"./state.js\";\nimport { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from \"node:fs\";\nimport { dirname } from \"node:path\";\nimport { randomUUID } from \"node:crypto\";\n//#region src/lib/server/basic-auth.ts\n/**\n* Shared HTTP Basic-auth encoding for host-UI → OpenCode/guardian calls.\n*\n* PR #564 P2-1: every host forwarder MUST send the exact same UTF-8 byte\n* sequence the assistant and guardian expect. Two divergences caused correct\n* passwords to 401 from the host:\n*  - `btoa()` is Latin-1-only and throws / corrupts on non-Latin-1 bytes\n*    (accents, CJK, emoji). Encode UTF-8 first (matches the guardian's\n*    `Buffer.from(..., 'utf-8')`).\n*  - the file-backed password was `.trim()`-ed, stripping surrounding spaces,\n*    while the assistant entrypoint (`$(cat)`) and the guardian strip only\n*    trailing newlines. Use `stripTrailingNewlines` so a password like\n*    `\"päss 🔒 \"` authenticates identically everywhere.\n*/\n/** OpenCode's server default Basic-auth username (the shipped assistant compose never overrides it). */\nvar DEFAULT_OPENCODE_USERNAME$1 = \"opencode\";\n/** UTF-8-safe Basic auth header — identical byte sequence to the guardian's encoder. */\nfunction basicAuthHeader(username, password) {\n\treturn `Basic ${Buffer.from(`${username}:${password}`, \"utf-8\").toString(\"base64\")}`;\n}\n/**\n* Strip only trailing newlines from a file-backed secret, matching the\n* assistant entrypoint's `$(cat file)` and the guardian's reader. Surrounding\n* spaces/tabs are preserved so the bytes match across every consumer.\n*/\nfunction stripTrailingNewlines(value) {\n\treturn value.replace(/\\n+$/, \"\");\n}\n//#endregion\n//#region src/lib/server/endpoints.ts\n/**\n* Assistant connections — list of OpenCode servers the UI can target, with\n* one marked active. The internal model uses \"connection\" language (plan\n* ui-runtime-modes-plan.md §6.6, Phase 2 / #486); the on-disk file keeps its\n* historical name and schema keys — `endpoints.json` with\n* `{ activeId, endpoints }` — and is NEVER renamed or migrated.\n*\n* The \"default\" entry is synthesized from environment (OP_OPENCODE_URL /\n* OP_ASSISTANT_URL / OP_ASSISTANT_PORT) and cannot be deleted. User-added\n* connections are persisted to a JSON file in the config directory (it's\n* user-owned configuration, not service state — see Phase 5 / D4 in\n* docs/technical/auth-and-proxy-refactor-plan.md).\n*\n* File: ${configDir}/endpoints.json (mode 0600)\n* Shape: { activeId: string | null, endpoints: ConnectionEntry[] }\n*   - activeId === null or \"default\" → use the env-derived default\n*   - activeId === \"<id>\" → use the matching user entry (falls back to default if not found)\n*\n* Legacy path: ${dataDir}/admin/endpoints.json. Old installs are\n* migrated lazily on first read by maybeMigrateLegacyEndpointsFile().\n*/\n/**\n* Read-time kind defaulting (plan §6.6): a user-persisted record without a\n* `kind` key is a remote OpenCode connection — that is the only thing the\n* pre-Phase-2 UI let users add. Explicit kinds pass through untouched.\n*/\nfunction kindOf(entry) {\n\treturn entry.kind ?? \"remote-opencode\";\n}\nvar DEFAULT_ID = \"default\";\n/**\n* OpenCode's server default Basic-auth username. The shipped assistant compose\n* never overrides OPENCODE_SERVER_USERNAME, and the guardian's upstream auth\n* sends `opencode:<password>`, so every host-UI forwarder must default here or\n* a correct password 401s (PR #564 r3566888629). User-added connections may\n* still carry an explicit username.\n*/\nvar DEFAULT_OPENCODE_USERNAME = DEFAULT_OPENCODE_USERNAME$1;\nvar LOCAL_ELECTRON_ID = \"local-electron\";\nvar remoteStatusCache = null;\nfunction endpointsPath() {\n\treturn `${getState().configDir}/endpoints.json`;\n}\n/**\n* Legacy path used before Phase 5 of the auth/proxy refactor.\n* See docs/technical/auth-and-proxy-refactor-plan.md § Phase 5 / D4.\n*/\nfunction legacyEndpointsPath() {\n\treturn `${getState().dataDir}/admin/endpoints.json`;\n}\n/**\n* One-shot lazy migration from the legacy data/ path to the new config/ path.\n*\n* Phase 5 of docs/technical/auth-and-proxy-refactor-plan.md (D6 step 3):\n*   - If the new path already exists → no-op (already migrated).\n*   - If the legacy path doesn't exist → no-op (fresh install).\n*   - Otherwise copy contents to the new path (mode 0600), then unlink legacy.\n*\n* If the migration fails partway, the legacy file is left in place so reads\n* fall back to it for the remainder of this session. Idempotent across\n* process restarts because the existence check makes it a no-op after the\n* first successful run.\n*/\nfunction maybeMigrateLegacyEndpointsFile() {\n\tconst newPath = endpointsPath();\n\tif (existsSync(newPath)) return;\n\tconst oldPath = legacyEndpointsPath();\n\tif (!existsSync(oldPath)) return;\n\ttry {\n\t\tmkdirSync(dirname(newPath), { recursive: true });\n\t\twriteFileSync(newPath, readFileSync(oldPath), { mode: 384 });\n\t\ttry {\n\t\t\tchmodSync(newPath, 384);\n\t\t} catch {}\n\t\tunlinkSync(oldPath);\n\t} catch (e) {\n\t\tconsole.warn(\"[endpoints] Failed to migrate legacy endpoints.json from data/ to config/. Leaving the old file in place; reads will fall back to it for this session.\", e);\n\t}\n}\nfunction localRuntimePath() {\n\treturn `${getState().dataDir}/local-opencode.runtime.json`;\n}\n/**\n* Read the Electron-written runtime.json each time it's needed. The file is\n* 0600 and is rewritten on each Electron launch (random password per launch),\n* so callers must NOT cache the result.\n*/\nfunction readLocalRuntime() {\n\tconst path = localRuntimePath();\n\tif (!existsSync(path)) return null;\n\ttry {\n\t\tconst parsed = JSON.parse(readFileSync(path, \"utf-8\"));\n\t\tif (!parsed || typeof parsed.url !== \"string\" || !parsed.url) return null;\n\t\treturn {\n\t\t\turl: parsed.url,\n\t\t\tusername: typeof parsed.username === \"string\" ? parsed.username : void 0,\n\t\t\tpassword: typeof parsed.password === \"string\" ? parsed.password : void 0,\n\t\t\tpid: typeof parsed.pid === \"number\" ? parsed.pid : void 0,\n\t\t\tstartedAt: typeof parsed.startedAt === \"string\" ? parsed.startedAt : void 0\n\t\t};\n\t} catch (e) {\n\t\tconsole.warn(\"[endpoints] Failed to parse local-opencode.runtime.json:\", e);\n\t\treturn null;\n\t}\n}\nfunction localEndpoint() {\n\tconst rt = readLocalRuntime();\n\tif (!rt) return null;\n\treturn {\n\t\tid: LOCAL_ELECTRON_ID,\n\t\tlabel: \"OpenPalm Admin\",\n\t\turl: normalizeBrowserFacingUrl(rt.url),\n\t\tusername: rt.username || DEFAULT_OPENCODE_USERNAME,\n\t\t...rt.password ? { password: rt.password } : {},\n\t\tkind: \"local-opencode\",\n\t\tisDefault: false,\n\t\tisLocal: true\n\t};\n}\nfunction normalizeBrowserFacingUrl(raw) {\n\ttry {\n\t\tconst url = new URL(raw);\n\t\turl.username = \"\";\n\t\turl.password = \"\";\n\t\tconst host = url.hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n\t\tif (host === \"0.0.0.0\" || host === \"::\") url.hostname = \"127.0.0.1\";\n\t\treturn url.toString().replace(/\\/$/, \"\");\n\t} catch {\n\t\treturn raw;\n\t}\n}\n/** Strip legacy URL userinfo before a connection reaches a serializer or view. */\nfunction redactEndpointUrlUserinfo(raw) {\n\treturn normalizeBrowserFacingUrl(raw);\n}\nfunction redactEntryUrl(entry) {\n\tconst url = redactEndpointUrlUserinfo(entry.url);\n\treturn url === entry.url ? entry : {\n\t\t...entry,\n\t\turl\n\t};\n}\nfunction readFile() {\n\tmaybeMigrateLegacyEndpointsFile();\n\tlet path = endpointsPath();\n\tif (!existsSync(path)) {\n\t\tconst legacy = legacyEndpointsPath();\n\t\tif (!existsSync(legacy)) return {\n\t\t\tactiveId: null,\n\t\t\tendpoints: []\n\t\t};\n\t\tpath = legacy;\n\t}\n\ttry {\n\t\tconst parsed = JSON.parse(readFileSync(path, \"utf-8\"));\n\t\treturn {\n\t\t\tactiveId: typeof parsed.activeId === \"string\" ? parsed.activeId : null,\n\t\t\tendpoints: Array.isArray(parsed.endpoints) ? parsed.endpoints.filter(isValidEntry).map(redactEntryUrl) : []\n\t\t};\n\t} catch (e) {\n\t\tconsole.warn(\"[endpoints] Failed to parse endpoints.json, resetting:\", e);\n\t\treturn {\n\t\t\tactiveId: null,\n\t\t\tendpoints: []\n\t\t};\n\t}\n}\nfunction isValidEntry(e) {\n\tif (!e || typeof e !== \"object\") return false;\n\tconst o = e;\n\treturn typeof o.id === \"string\" && typeof o.label === \"string\" && typeof o.url === \"string\";\n}\nfunction writeFile(data) {\n\tconst path = endpointsPath();\n\tmkdirSync(dirname(path), { recursive: true });\n\tconst safeData = {\n\t\t...data,\n\t\tendpoints: data.endpoints.map(redactEntryUrl)\n\t};\n\twriteFileSync(path, JSON.stringify(safeData, null, 2), {\n\t\tencoding: \"utf-8\",\n\t\tmode: 384\n\t});\n\ttry {\n\t\tchmodSync(path, 384);\n\t} catch {}\n}\nfunction defaultEndpoint() {\n\tconst persisted = readStackEnv(getState().homeDir);\n\tconst url = process.env.OP_OPENCODE_URL ?? process.env.OP_ASSISTANT_URL ?? `http://127.0.0.1:${process.env.OP_ASSISTANT_PORT ?? persisted.OP_ASSISTANT_PORT ?? \"3800\"}`;\n\tconst username = process.env.OPENCODE_SERVER_USERNAME || DEFAULT_OPENCODE_USERNAME;\n\tconst presetPassword = /^(true|1|yes)$/i.test((persisted.OPENCODE_AUTH ?? process.env.OPENCODE_AUTH ?? \"\").trim()) ? ((raw) => raw ? stripTrailingNewlines(raw) : void 0)(readSecret(getState().homeDir, \"op_opencode_password\") ?? void 0) || process.env.OP_OPENCODE_PASSWORD : void 0;\n\tconst password = process.env.OPENCODE_SERVER_PASSWORD || presetPassword || void 0;\n\treturn {\n\t\tid: DEFAULT_ID,\n\t\tlabel: \"Local Assistant\",\n\t\turl: normalizeBrowserFacingUrl(url),\n\t\tusername,\n\t\tpassword,\n\t\tkind: \"local-opencode\",\n\t\tisDefault: true\n\t};\n}\n/**\n* Discriminated validator that callers (admin routes) use to surface\n* specific error messages. Plain HTTP is allowed for any host — OpenPalm is\n* LAN-first, so remote instances on a private network are reached over http://.\n*/\nfunction validateEndpointUrl(input) {\n\tlet u;\n\ttry {\n\t\tu = new URL(input.trim());\n\t} catch {\n\t\treturn {\n\t\t\tok: false,\n\t\t\treason: \"invalid_url\"\n\t\t};\n\t}\n\tif (u.protocol !== \"http:\" && u.protocol !== \"https:\") return {\n\t\tok: false,\n\t\treason: \"invalid_scheme\"\n\t};\n\tif (!u.hostname) return {\n\t\tok: false,\n\t\treason: \"missing_host\"\n\t};\n\tif (u.username || u.password) return {\n\t\tok: false,\n\t\treason: \"userinfo_not_allowed\"\n\t};\n\tif (u.search || u.hash) return {\n\t\tok: false,\n\t\treason: \"unexpected_query_or_fragment\"\n\t};\n\treturn {\n\t\tok: true,\n\t\turl: u.toString().replace(/\\/$/, \"\")\n\t};\n}\n/**\n* Validate a URL string — must be http(s) with a host. Returns the normalized\n* URL or null. For finer-grained errors, use `validateEndpointUrl`.\n*/\nfunction normalizeEndpointUrl(input) {\n\tconst result = validateEndpointUrl(input);\n\treturn result.ok ? result.url : null;\n}\n/**\n* Returns: [local-electron (if Electron is running it), default, ...user entries].\n* The local-electron entry is synthesized at call time from\n* state/local-opencode.runtime.json — never persisted to endpoints.json.\n*/\nfunction listConnections() {\n\tconst { endpoints } = readFile();\n\tconst local = localEndpoint();\n\treturn [\n\t\t...local ? [local] : [],\n\t\tdefaultEndpoint(),\n\t\t...endpoints.map((e) => ({\n\t\t\t...e,\n\t\t\tkind: kindOf(e),\n\t\t\tisDefault: false\n\t\t}))\n\t];\n}\n/**\n* Returns the active connection, falling back to the default if no active id\n* is set OR if the active id is `local-electron` but the runtime.json isn't\n* there (e.g. the Electron child died). Re-reads runtime.json each call so a\n* password rotated by a new Electron launch is picked up immediately.\n*/\nfunction getActiveConnection() {\n\tconst { activeId, endpoints } = readFile();\n\tif (activeId === LOCAL_ELECTRON_ID) {\n\t\tconst local = localEndpoint();\n\t\tif (local) return local;\n\t\treturn defaultEndpoint();\n\t}\n\tif (!activeId || activeId === DEFAULT_ID) return defaultEndpoint();\n\tconst found = endpoints.find((e) => e.id === activeId);\n\tif (!found) return defaultEndpoint();\n\treturn {\n\t\t...found,\n\t\tkind: kindOf(found),\n\t\tisDefault: false\n\t};\n}\nfunction setActiveConnectionId(id) {\n\tconst data = readFile();\n\tif (!id || id === DEFAULT_ID) data.activeId = null;\n\telse if (id === LOCAL_ELECTRON_ID) {\n\t\tif (!localEndpoint()) throw new Error(\"Local OpenCode is not running (Electron only)\");\n\t\tdata.activeId = LOCAL_ELECTRON_ID;\n\t} else {\n\t\tif (!data.endpoints.some((e) => e.id === id)) throw new Error(`Endpoint not found: ${id}`);\n\t\tdata.activeId = id;\n\t}\n\twriteFile(data);\n\treturn getActiveConnection();\n}\n/**\n* User-addable connection kinds (#486 D2). `local-opencode` is reserved for\n* synthesized entries (the env-derived default, the Electron local-runtime\n* entry) and is never accepted from a write path.\n*/\nvar USER_ADDABLE_CONNECTION_KINDS = [\"remote-opencode\", \"openpalm-client-api\"];\n/**\n* Normalize a guardian ('openpalm-client-api'-kind) connection URL so it\n* always ends in `/oc` — the guardian's direct-ingress base path\n* (#486 D2). Operates on an ALREADY `normalizeEndpointUrl`-ed string (no\n* trailing slash), so only the `/oc` suffix logic is needed here.\n*\n* `packages/client/src/lib/connections/url-policy.ts` carries a deliberate\n* CLIENT-side twin (`normalizeGuardianUrl`) with the same rule — the client\n* artifact may not import host code and vice versa, so this is the same\n* accepted duplication as `validateConnectionUrl`/`validateEndpointUrl`.\n* Both are pinned by their own tests.\n*/\nfunction normalizeGuardianOcUrl(url) {\n\treturn url.endsWith(\"/oc\") ? url : `${url}/oc`;\n}\nfunction assertAddableKind(kind) {\n\tif (kind === void 0) return;\n\tif (!USER_ADDABLE_CONNECTION_KINDS.includes(kind)) throw new Error(\"Invalid connection kind\");\n}\nfunction addConnection(input) {\n\tconst label = input.label.trim();\n\tif (!label) throw new Error(\"Label is required\");\n\tlet url = normalizeEndpointUrl(input.url);\n\tif (!url) throw new Error(\"URL must be a valid http(s) URL\");\n\tassertAddableKind(input.kind);\n\tif (input.kind === \"openpalm-client-api\") url = normalizeGuardianOcUrl(url);\n\tconst data = readFile();\n\tconst entry = {\n\t\tid: randomUUID(),\n\t\tlabel,\n\t\turl,\n\t\t...input.password ? { password: input.password } : {},\n\t\t...input.kind ? { kind: input.kind } : {}\n\t};\n\tdata.endpoints.push(entry);\n\twriteFile(data);\n\treturn entry;\n}\nfunction updateConnection(id, patch) {\n\tif (id === DEFAULT_ID) throw new Error(\"Cannot edit the default endpoint\");\n\tif (id === LOCAL_ELECTRON_ID) throw new Error(\"Cannot edit the local Electron OpenCode entry (it is ephemeral and per-launch)\");\n\tassertAddableKind(patch.kind);\n\tconst data = readFile();\n\tconst idx = data.endpoints.findIndex((e) => e.id === id);\n\tif (idx === -1) throw new Error(`Endpoint not found: ${id}`);\n\tconst next = { ...data.endpoints[idx] };\n\tif (patch.label !== void 0) {\n\t\tconst label = patch.label.trim();\n\t\tif (!label) throw new Error(\"Label cannot be empty\");\n\t\tnext.label = label;\n\t}\n\tif (patch.url !== void 0) {\n\t\tconst url = normalizeEndpointUrl(patch.url);\n\t\tif (!url) throw new Error(\"URL must be a valid http(s) URL\");\n\t\tnext.url = url;\n\t}\n\tif (patch.password === null) delete next.password;\n\telse if (typeof patch.password === \"string\") next.password = patch.password;\n\tif (patch.kind !== void 0) next.kind = patch.kind;\n\tif (next.kind === \"openpalm-client-api\") next.url = normalizeGuardianOcUrl(next.url);\n\tdata.endpoints[idx] = next;\n\twriteFile(data);\n\treturn next;\n}\nfunction deleteConnection(id) {\n\tif (id === DEFAULT_ID) throw new Error(\"Cannot delete the default endpoint\");\n\tif (id === LOCAL_ELECTRON_ID) throw new Error(\"Cannot delete the local Electron OpenCode entry (managed by Electron lifecycle)\");\n\tconst data = readFile();\n\tconst idx = data.endpoints.findIndex((e) => e.id === id);\n\tif (idx === -1) throw new Error(`Endpoint not found: ${id}`);\n\tdata.endpoints.splice(idx, 1);\n\tif (data.activeId === id) data.activeId = null;\n\twriteFile(data);\n}\nasync function probeEndpoint(endpoint) {\n\tconst headers = new Headers();\n\tif (endpoint.password) {\n\t\tconst username = endpoint.username ?? DEFAULT_OPENCODE_USERNAME;\n\t\theaders.set(\"authorization\", basicAuthHeader(username, endpoint.password));\n\t}\n\tconst probeUrl = endpoint.kind === \"openpalm-client-api\" ? `${endpoint.url}/session` : endpoint.url;\n\ttry {\n\t\tconst response = await fetch(probeUrl, {\n\t\t\tmethod: \"GET\",\n\t\t\theaders,\n\t\t\tredirect: \"manual\",\n\t\t\tsignal: AbortSignal.timeout(2e3)\n\t\t});\n\t\tif (response.status === 401 || response.status === 403) return {\n\t\t\tid: endpoint.id,\n\t\t\tname: endpoint.label,\n\t\t\turl: endpoint.url,\n\t\t\tstate: \"unauthorized\",\n\t\t\tdetail: `HTTP ${response.status}`\n\t\t};\n\t\tif (response.ok || response.status >= 300 && response.status < 400) return {\n\t\t\tid: endpoint.id,\n\t\t\tname: endpoint.label,\n\t\t\turl: endpoint.url,\n\t\t\tstate: \"accessible\"\n\t\t};\n\t\treturn {\n\t\t\tid: endpoint.id,\n\t\t\tname: endpoint.label,\n\t\t\turl: endpoint.url,\n\t\t\tstate: \"unreachable\",\n\t\t\tdetail: `HTTP ${response.status}`\n\t\t};\n\t} catch (error) {\n\t\treturn {\n\t\t\tid: endpoint.id,\n\t\t\tname: endpoint.label,\n\t\t\turl: endpoint.url,\n\t\t\tstate: \"unreachable\",\n\t\t\tdetail: error instanceof Error ? error.message : String(error)\n\t\t};\n\t}\n}\nasync function listRemoteStatuses() {\n\tif (remoteStatusCache && remoteStatusCache.expiresAt > Date.now()) return remoteStatusCache.value.map((status) => ({ ...status }));\n\tconst statuses = await Promise.all(listConnections().map((endpoint) => probeEndpoint(endpoint)));\n\tremoteStatusCache = {\n\t\tvalue: statuses,\n\t\texpiresAt: Date.now() + 5e3\n\t};\n\treturn statuses.map((status) => ({ ...status }));\n}\n//#endregion\nexport { listConnections as a, setActiveConnectionId as c, basicAuthHeader as d, getActiveConnection as i, updateConnection as l, addConnection as n, listRemoteStatuses as o, deleteConnection as r, redactEndpointUrlUserinfo as s, USER_ADDABLE_CONNECTION_KINDS as t, validateEndpointUrl as u };\n"],"names":[],"mappings":";;;;;;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,2BAA2B,GAAG,UAAU;AAC5C;AACA,SAAS,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE;AAC7C,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrF;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,KAAK,EAAE;AACtC,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;AACjC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,MAAM,CAAC,KAAK,EAAE;AACvB,CAAC,OAAO,KAAK,CAAC,IAAI,IAAI,iBAAiB;AACvC;AACA,IAAI,UAAU,GAAG,SAAS;AAC1B;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,yBAAyB,GAAG,2BAA2B;AAC3D,IAAI,iBAAiB,GAAG,gBAAgB;AACxC,IAAI,iBAAiB,GAAG,IAAI;AAC5B,SAAS,aAAa,GAAG;AACzB,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,eAAe,CAAC;AAChD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,GAAG;AAC/B,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC;AACpD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,+BAA+B,GAAG;AAC3C,CAAC,MAAM,OAAO,GAAG,aAAa,EAAE;AAChC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE;AAC1B,CAAC,MAAM,OAAO,GAAG,mBAAmB,EAAE;AACtC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;AAC3B,CAAC,IAAI;AACL,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAClD,EAAE,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC9D,EAAE,IAAI;AACN,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC;AAC1B,EAAE,CAAC,CAAC,MAAM,CAAC;AACX,EAAE,UAAU,CAAC,OAAO,CAAC;AACrB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,CAAC,IAAI,CAAC,wJAAwJ,EAAE,CAAC,CAAC;AAC3K,CAAC;AACD;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,4BAA4B,CAAC;AAC3D;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,IAAI,GAAG,gBAAgB,EAAE;AAChC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AACnC,CAAC,IAAI;AACL,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACxD,EAAE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI;AAC3E,EAAE,OAAO;AACT,GAAG,GAAG,EAAE,MAAM,CAAC,GAAG;AAClB,GAAG,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;AAC3E,GAAG,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;AAC3E,GAAG,GAAG,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,GAAG,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC;AAC5D,GAAG,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,GAAG,MAAM,CAAC,SAAS,GAAG,KAAK;AAC7E,GAAG;AACH,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,CAAC,IAAI,CAAC,0DAA0D,EAAE,CAAC,CAAC;AAC7E,EAAE,OAAO,IAAI;AACb,CAAC;AACD;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,MAAM,EAAE,GAAG,gBAAgB,EAAE;AAC9B,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,IAAI;AACrB,CAAC,OAAO;AACR,EAAE,EAAE,EAAE,iBAAiB;AACvB,EAAE,KAAK,EAAE,gBAAgB;AACzB,EAAE,GAAG,EAAE,yBAAyB,CAAC,EAAE,CAAC,GAAG,CAAC;AACxC,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,yBAAyB;AACpD,EAAE,GAAG,EAAE,CAAC,QAAQ,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;AACjD,EAAE,IAAI,EAAE,gBAAgB;AACxB,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,OAAO,EAAE;AACX,EAAE;AACF;AACA,SAAS,yBAAyB,CAAC,GAAG,EAAE;AACxC,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC;AAC1B,EAAE,GAAG,CAAC,QAAQ,GAAG,EAAE;AACnB,EAAE,GAAG,CAAC,QAAQ,GAAG,EAAE;AACnB,EAAE,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;AACjE,EAAE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,WAAW;AACrE,EAAE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AAC1C,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,GAAG;AACZ,CAAC;AACD;AACA;AACA,SAAS,yBAAyB,CAAC,GAAG,EAAE;AACxC,CAAC,OAAO,yBAAyB,CAAC,GAAG,CAAC;AACtC;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,MAAM,GAAG,GAAG,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC;AACjD,CAAC,OAAO,GAAG,KAAK,KAAK,CAAC,GAAG,GAAG,KAAK,GAAG;AACpC,EAAE,GAAG,KAAK;AACV,EAAE;AACF,EAAE;AACF;AACA,SAAS,QAAQ,GAAG;AACpB,CAAC,+BAA+B,EAAE;AAClC,CAAC,IAAI,IAAI,GAAG,aAAa,EAAE;AAC3B,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;AACxB,EAAE,MAAM,MAAM,GAAG,mBAAmB,EAAE;AACtC,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,OAAO;AAClC,GAAG,QAAQ,EAAE,IAAI;AACjB,GAAG,SAAS,EAAE;AACd,GAAG;AACH,EAAE,IAAI,GAAG,MAAM;AACf,CAAC;AACD,CAAC,IAAI;AACL,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACxD,EAAE,OAAO;AACT,GAAG,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,IAAI;AACzE,GAAG,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG;AAC5G,GAAG;AACH,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,CAAC,IAAI,CAAC,wDAAwD,EAAE,CAAC,CAAC;AAC3E,EAAE,OAAO;AACT,GAAG,QAAQ,EAAE,IAAI;AACjB,GAAG,SAAS,EAAE;AACd,GAAG;AACH,CAAC;AACD;AACA,SAAS,YAAY,CAAC,CAAC,EAAE;AACzB,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,OAAO,KAAK;AAC9C,CAAC,MAAM,CAAC,GAAG,CAAC;AACZ,CAAC,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;AAC5F;AACA,SAAS,SAAS,CAAC,IAAI,EAAE;AACzB,CAAC,MAAM,IAAI,GAAG,aAAa,EAAE;AAC7B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC,MAAM,QAAQ,GAAG;AAClB,EAAE,GAAG,IAAI;AACT,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,cAAc;AAC9C,EAAE;AACF,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;AACxD,EAAE,QAAQ,EAAE,OAAO;AACnB,EAAE,IAAI,EAAE;AACR,EAAE,CAAC;AACH,CAAC,IAAI;AACL,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC;AACtB,CAAC,CAAC,CAAC,MAAM,CAAC;AACV;AACA,SAAS,eAAe,GAAG;AAC3B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC;AACnD,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,SAAS,CAAC,iBAAiB,IAAI,MAAM,CAAC,CAAC;AACxK,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,yBAAyB;AACnF,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,GAAG,GAAG,qBAAqB,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,sBAAsB,CAAC,IAAI,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,MAAM;AACzR,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,cAAc,IAAI,MAAM;AAClF,CAAC,OAAO;AACR,EAAE,EAAE,EAAE,UAAU;AAChB,EAAE,KAAK,EAAE,iBAAiB;AAC1B,EAAE,GAAG,EAAE,yBAAyB,CAAC,GAAG,CAAC;AACrC,EAAE,QAAQ;AACV,EAAE,QAAQ;AACV,EAAE,IAAI,EAAE,gBAAgB;AACxB,EAAE,SAAS,EAAE;AACb,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE;AACpC,CAAC,IAAI,CAAC;AACN,CAAC,IAAI;AACL,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO;AACT,GAAG,EAAE,EAAE,KAAK;AACZ,GAAG,MAAM,EAAE;AACX,GAAG;AACH,CAAC;AACD,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,OAAO;AAC/D,EAAE,EAAE,EAAE,KAAK;AACX,EAAE,MAAM,EAAE;AACV,EAAE;AACF,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO;AACzB,EAAE,EAAE,EAAE,KAAK;AACX,EAAE,MAAM,EAAE;AACV,EAAE;AACF,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO;AACtC,EAAE,EAAE,EAAE,KAAK;AACX,EAAE,MAAM,EAAE;AACV,EAAE;AACF,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO;AAChC,EAAE,EAAE,EAAE,KAAK;AACX,EAAE,MAAM,EAAE;AACV,EAAE;AACF,CAAC,OAAO;AACR,EAAE,EAAE,EAAE,IAAI;AACV,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE;AACrC,EAAE;AACF;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,KAAK,EAAE;AACrC,CAAC,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC;AAC1C,CAAC,OAAO,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI;AACrC;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,eAAe,GAAG;AAC3B,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE;AACjC,CAAC,MAAM,KAAK,GAAG,aAAa,EAAE;AAC9B,CAAC,OAAO;AACR,EAAE,GAAG,KAAK,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;AACzB,EAAE,eAAe,EAAE;AACnB,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AAC3B,GAAG,GAAG,CAAC;AACP,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AAClB,GAAG,SAAS,EAAE;AACd,GAAG,CAAC;AACJ,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,GAAG;AAC/B,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE;AAC3C,CAAC,IAAI,QAAQ,KAAK,iBAAiB,EAAE;AACrC,EAAE,MAAM,KAAK,GAAG,aAAa,EAAE;AAC/B,EAAE,IAAI,KAAK,EAAE,OAAO,KAAK;AACzB,EAAE,OAAO,eAAe,EAAE;AAC1B,CAAC;AACD,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,UAAU,EAAE,OAAO,eAAe,EAAE;AACnE,CAAC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC;AACvD,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,eAAe,EAAE;AACrC,CAAC,OAAO;AACR,EAAE,GAAG,KAAK;AACV,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC;AACrB,EAAE,SAAS,EAAE;AACb,EAAE;AACF;AACA,SAAS,qBAAqB,CAAC,EAAE,EAAE;AACnC,CAAC,MAAM,IAAI,GAAG,QAAQ,EAAE;AACxB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,UAAU,EAAE,IAAI,CAAC,QAAQ,GAAG,IAAI;AACnD,MAAM,IAAI,EAAE,KAAK,iBAAiB,EAAE;AACpC,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC;AACxF,EAAE,IAAI,CAAC,QAAQ,GAAG,iBAAiB;AACnC,CAAC,CAAC,MAAM;AACR,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAC;AAC5F,EAAE,IAAI,CAAC,QAAQ,GAAG,EAAE;AACpB,CAAC;AACD,CAAC,SAAS,CAAC,IAAI,CAAC;AAChB,CAAC,OAAO,mBAAmB,EAAE;AAC7B;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,6BAA6B,GAAG,CAAC,iBAAiB,EAAE,qBAAqB;AAC7E;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,sBAAsB,CAAC,GAAG,EAAE;AACrC,CAAC,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;AAC/C;AACA,SAAS,iBAAiB,CAAC,IAAI,EAAE;AACjC,CAAC,IAAI,IAAI,KAAK,MAAM,EAAE;AACtB,CAAC,IAAI,CAAC,6BAA6B,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC;AAC9F;AACA,SAAS,aAAa,CAAC,KAAK,EAAE;AAC9B,CAAC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE;AACjC,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC;AACjD,CAAC,IAAI,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC;AAC1C,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC;AAC7D,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC;AAC9B,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,EAAE,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC;AAC5E,CAAC,MAAM,IAAI,GAAG,QAAQ,EAAE;AACxB,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,KAAK;AACP,EAAE,GAAG;AACL,EAAE,GAAG,KAAK,CAAC,QAAQ,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE;AACvD,EAAE,GAAG,KAAK,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG;AACzC,EAAE;AACF,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;AAC3B,CAAC,SAAS,CAAC,IAAI,CAAC;AAChB,CAAC,OAAO,KAAK;AACb;AACA,SAAS,gBAAgB,CAAC,EAAE,EAAE,KAAK,EAAE;AACrC,CAAC,IAAI,EAAE,KAAK,UAAU,EAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC;AAC3E,CAAC,IAAI,EAAE,KAAK,iBAAiB,EAAE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC;AAChI,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC;AAC9B,CAAC,MAAM,IAAI,GAAG,QAAQ,EAAE;AACxB,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;AACzD,CAAC,IAAI,GAAG,KAAK,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE;AACxC,CAAC,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,EAAE;AAC7B,EAAE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE;AAClC,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC;AACtD,EAAE,IAAI,CAAC,KAAK,GAAG,KAAK;AACpB,CAAC;AACD,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,EAAE;AAC3B,EAAE,MAAM,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC;AAC7C,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC;AAC9D,EAAE,IAAI,CAAC,GAAG,GAAG,GAAG;AAChB,CAAC;AACD,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,OAAO,IAAI,CAAC,QAAQ;AAClD,MAAM,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ;AAC5E,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI;AAClD,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE,IAAI,CAAC,GAAG,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;AACrF,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI;AAC3B,CAAC,SAAS,CAAC,IAAI,CAAC;AAChB,CAAC,OAAO,IAAI;AACZ;AACA,SAAS,gBAAgB,CAAC,EAAE,EAAE;AAC9B,CAAC,IAAI,EAAE,KAAK,UAAU,EAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC;AAC7E,CAAC,IAAI,EAAE,KAAK,iBAAiB,EAAE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC;AACjI,CAAC,MAAM,IAAI,GAAG,QAAQ,EAAE;AACxB,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;AACzD,CAAC,IAAI,GAAG,KAAK,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;AAC9B,CAAC,IAAI,IAAI,CAAC,QAAQ,KAAK,EAAE,EAAE,IAAI,CAAC,QAAQ,GAAG,IAAI;AAC/C,CAAC,SAAS,CAAC,IAAI,CAAC;AAChB;AACA,eAAe,aAAa,CAAC,QAAQ,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE;AAC9B,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE;AACxB,EAAE,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,yBAAyB;AACjE,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC5E,CAAC;AACD,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,KAAK,qBAAqB,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC,GAAG;AACpG,CAAC,IAAI;AACL,EAAE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;AACzC,GAAG,MAAM,EAAE,KAAK;AAChB,GAAG,OAAO;AACV,GAAG,QAAQ,EAAE,QAAQ;AACrB,GAAG,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG;AAClC,GAAG,CAAC;AACJ,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,OAAO;AACjE,GAAG,EAAE,EAAE,QAAQ,CAAC,EAAE;AAClB,GAAG,IAAI,EAAE,QAAQ,CAAC,KAAK;AACvB,GAAG,GAAG,EAAE,QAAQ,CAAC,GAAG;AACpB,GAAG,KAAK,EAAE,cAAc;AACxB,GAAG,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC;AACnC,GAAG;AACH,EAAE,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO;AAC7E,GAAG,EAAE,EAAE,QAAQ,CAAC,EAAE;AAClB,GAAG,IAAI,EAAE,QAAQ,CAAC,KAAK;AACvB,GAAG,GAAG,EAAE,QAAQ,CAAC,GAAG;AACpB,GAAG,KAAK,EAAE;AACV,GAAG;AACH,EAAE,OAAO;AACT,GAAG,EAAE,EAAE,QAAQ,CAAC,EAAE;AAClB,GAAG,IAAI,EAAE,QAAQ,CAAC,KAAK;AACvB,GAAG,GAAG,EAAE,QAAQ,CAAC,GAAG;AACpB,GAAG,KAAK,EAAE,aAAa;AACvB,GAAG,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC;AACnC,GAAG;AACH,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE;AACjB,EAAE,OAAO;AACT,GAAG,EAAE,EAAE,QAAQ,CAAC,EAAE;AAClB,GAAG,IAAI,EAAE,QAAQ,CAAC,KAAK;AACvB,GAAG,GAAG,EAAE,QAAQ,CAAC,GAAG;AACpB,GAAG,KAAK,EAAE,aAAa;AACvB,GAAG,MAAM,EAAE,KAAK,YAAY,KAAK,GAAG,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK;AAChE,GAAG;AACH,CAAC;AACD;AACA,eAAe,kBAAkB,GAAG;AACpC,CAAC,IAAI,iBAAiB,IAAI,iBAAiB,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AACnI,CAAC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;AACjG,CAAC,iBAAiB,GAAG;AACrB,EAAE,KAAK,EAAE,QAAQ;AACjB,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG;AAC1B,EAAE;AACF,CAAC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AACjD;;;;"}

package/build/server/chunks/features-BW-bVsl8.js

@@ -1,118 +0,0 @@
-import { aL as resolveClientAppPort, P as PLATFORM_VERSION } from './src-DbArH65P.js';
-
-var package_default = {
-	version: "0.13.0-beta.6"};
-//#endregion
-//#region src/lib/server/features.ts
-/**
-* Server runtime context — RuntimeContext v2 (plan ui-runtime-modes-plan.md
-* §6.1, issue #509). Computed server-side on every request via
-* +layout.server.ts and served publicly at GET /api/runtime (the
-* contract-version handshake for remote/hosted clients).
-*
-* hostMode resolution (Phase 1):
-*   OP_UI_HOST_MODE (explicit) → that mode
-*   else OP_INSIDE_ELECTRON=1  → 'electron-host' (legacy, injected by
-*                                 packages/electron/src/main.ts)
-*   else OP_ENABLE_ADMIN=1     → 'host-ui' (legacy, local dev / openpalm admin)
-*   else                       → 'pwa-static' baseline
-*/
-var HOST_MODES = [
-	"electron-host",
-	"host-ui",
-	"assistant-container",
-	"pwa-static"
-];
-function isUiHostMode(value) {
-	return HOST_MODES.includes(value);
-}
-function resolveHostMode() {
-	const explicit = process.env.OP_UI_HOST_MODE?.trim() ?? "";
-	if (isUiHostMode(explicit)) return explicit;
-	if (process.env.OP_INSIDE_ELECTRON === "1") return "electron-host";
-	if (process.env.OP_ENABLE_ADMIN === "1") return "host-ui";
-	return "pwa-static";
-}
-/** Capabilities of a host-capable process (electron-host / host-ui). Note:
-*  never 'connections:single' — that marker is the assistant-container
-*  branch key in resolveCapabilities() (plan §6.2). */
-var HOST_MODE_CAPABILITIES = [
-	"chat",
-	"connections:read",
-	"connections:manage",
-	"connections:switch",
-	"assistant-settings:read",
-	"assistant-settings:write",
-	...[
-		"host:setup",
-		"host:stack:read",
-		"host:stack:write",
-		"host:containers",
-		"host:addons",
-		"host:updates",
-		"host:logs",
-		"host:secrets",
-		"host:recovery",
-		"host:akm-sharing"
-	]
-];
-var SERVER_CAPABILITIES = {
-	"electron-host": HOST_MODE_CAPABILITIES,
-	"host-ui": HOST_MODE_CAPABILITIES,
-	"assistant-container": [
-		"connections:single",
-		"chat",
-		"assistant-settings:read",
-		"assistant-settings:write"
-	],
-	"pwa-static": [
-		"chat",
-		"connections:read",
-		"connections:manage",
-		"connections:switch",
-		"pwa:install"
-	]
-};
-/** Route pointers per mode — current-truth URLs. Phase 2 (#486) moved
-*  connections to /connections; Phase 4 moved the host dashboard to /host
-*  (/admin/* is a dead namespace — router 404, no alias). */
-function routesForMode(mode) {
-	switch (mode) {
-		case "electron-host":
-		case "host-ui": return {
-			chat: "/chat",
-			connections: "/connections",
-			host: "/host",
-			setup: "/setup"
-		};
-		case "assistant-container": return { chat: "/chat" };
-		case "pwa-static": return {
-			chat: "/chat",
-			connections: "/connections"
-		};
-	}
-}
-function computeServerRuntimeContext(event) {
-	const hostMode = resolveHostMode();
-	const isHostCapable = hostMode === "electron-host" || hostMode === "host-ui";
-	const clientAppUrl = hostMode === "assistant-container" ? void 0 : `http://127.0.0.1:${resolveClientAppPort(process.env)}`;
-	return {
-		version: 2,
-		hostMode,
-		serverCapabilities: [...SERVER_CAPABILITIES[hostMode]],
-		publicBaseUrl: event.url?.origin ?? "",
-		uiVersion: package_default.version,
-		skeletonVersion: process.env.OP_SKELETON_VERSION?.trim() || PLATFORM_VERSION,
-		activeConnectionMode: hostMode === "assistant-container" ? "single" : "multi",
-		...clientAppUrl !== void 0 ? { clientAppUrl } : {},
-		routes: routesForMode(hostMode),
-		security: {
-			hostAdminLoopbackOnly: true,
-			requiresHttpsForRemoteConnections: hostMode === "pwa-static",
-			csrfMode: isHostCapable ? "loopback-origin" : hostMode === "assistant-container" ? "same-site" : "bearer-token"
-		}
-	};
-}
-
-export { computeServerRuntimeContext as c };
-//# sourceMappingURL=features-BW-bVsl8.js.map