@openpalm/ui 0.13.0-beta.6 → 0.13.0-beta.8

package/build/server/chunks/features-D8Ez2vwC.js

@@ -0,0 +1,101 @@
+import { P as PLATFORM_VERSION, ah as listEnabledAddonIds } from './src-B2wHibme.js';
+import { g as getState } from './state-JIy0tegD.js';
+
+var package_default = {
+	version: "0.13.0-beta.8"};
+//#endregion
+//#region src/lib/server/features.ts
+/**
+* Server runtime context — RuntimeContext v2 (issue #509). Computed server-side on every request via
+* +layout.server.ts and served publicly at GET /api/runtime (the
+* contract-version handshake for remote/hosted clients).
+*
+* Admin capability is an Electron-or-CLI-only security boundary — there is no
+* per-mode capability matrix and no env self-grant footgun (a served/container
+* build must never be able to claim host mode). A single boolean:
+*   OP_INSIDE_ELECTRON=1 (injected by packages/electron/src/main.ts) OR
+*   OP_ENABLE_ADMIN=1    (local dev / `openpalm admin`) → adminCapable
+* Every process gets the base capability set; only an adminCapable process
+* additionally gets host:*.
+*/
+/**
+* True when this process is admin-capable — running inside Electron or
+* explicitly opted into admin. This is the ONLY gate for host:* capabilities;
+* a served/container/PWA build is never admin-capable.
+*/
+function isAdminCapable() {
+	return process.env.OP_INSIDE_ELECTRON === "1" || process.env.OP_ENABLE_ADMIN === "1";
+}
+/** Base capabilities granted to EVERY process. The browser owns
+*  connections uniformly — multiple assistants + switching work everywhere. */
+var BASE_CAPABILITIES = [
+	"chat",
+	"connections:read",
+	"connections:manage",
+	"connections:switch",
+	"assistant-settings:read",
+	"assistant-settings:write",
+	"pwa:install"
+];
+/** The host:* capability set — added only when adminCapable. */
+var HOST_CAPABILITIES = [
+	"host:setup",
+	"host:stack:read",
+	"host:stack:write",
+	"host:containers",
+	"host:addons",
+	"host:updates",
+	"host:logs",
+	"host:secrets",
+	"host:recovery",
+	"host:akm-sharing"
+];
+/**
+* Voice advertisement for the runtime handshake: the same-origin path of the
+* /voice pass-through, present when this process can actually serve it — an
+* admin-capable process (the host process is the only one with a loopback
+* path to the voice container) with the voice addon enabled. Same-origin, so
+* no host/port resolution and nothing request-derived.
+*
+* Deliberately NOT part of computeServerRuntimeContext(): that function runs
+* on requireCapability's per-request hot path, and this one reads the stack
+* env from disk. Only the two runtime-context producers (+layout.server.ts
+* and GET /api/runtime) call it.
+*/
+function computeVoiceRuntime() {
+	if (!isAdminCapable()) return void 0;
+	try {
+		if (!listEnabledAddonIds(getState().homeDir).includes("voice")) return void 0;
+		return { url: "/voice" };
+	} catch {
+		return;
+	}
+}
+function computeServerRuntimeContext(event) {
+	const admin = isAdminCapable();
+	return {
+		version: 2,
+		admin,
+		serverCapabilities: admin ? [...BASE_CAPABILITIES, ...HOST_CAPABILITIES] : [...BASE_CAPABILITIES],
+		publicBaseUrl: event.url?.origin ?? "",
+		uiVersion: package_default.version,
+		skeletonVersion: process.env.OP_SKELETON_VERSION?.trim() || PLATFORM_VERSION,
+		routes: admin ? {
+			chat: "/chat",
+			connections: "/connections",
+			host: "/host",
+			setup: "/setup"
+		} : {
+			chat: "/chat",
+			connections: "/connections"
+		},
+		security: {
+			hostAdminLoopbackOnly: true,
+			requiresHttpsForRemoteConnections: !admin,
+			csrfMode: admin ? "loopback-origin" : "same-site"
+		}
+	};
+}
+
+export { computeVoiceRuntime as a, computeServerRuntimeContext as c, isAdminCapable as i };
+//# sourceMappingURL=features-D8Ez2vwC.js.map

package/build/server/chunks/features-D8Ez2vwC.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features-D8Ez2vwC.js","sources":["../../../.svelte-kit/adapter-node/chunks/features.js"],"sourcesContent":["import { O as listEnabledAddonIds, pt as PLATFORM_VERSION } from \"./compose-args.js\";\nimport \"./src.js\";\nimport { t as getState } from \"./state.js\";\nvar package_default = {\n\tname: \"@openpalm/ui\",\n\tdescription: \"SvelteKit web UI and API for OpenPalm stack management\",\n\tversion: \"0.13.0-beta.8\",\n\tlicense: \"MPL-2.0\",\n\ttype: \"module\",\n\t\"//minHarnessContract\": \"Minimum native Electron harness contract this UI build requires (design §5.3). The harness refuses to self-update onto a build whose minHarnessContract exceeds the contract it provides and prompts an app re-download instead. Bump ONLY when the UI starts depending on a new IPC method / spawn env key; keep in lockstep with packages/electron/src/harness-contract.ts HARNESS_CONTRACT_VERSION.\",\n\tminHarnessContract: 1,\n\trepository: {\n\t\t\"type\": \"git\",\n\t\t\"url\": \"https://github.com/itlackey/openpalm.git\",\n\t\t\"directory\": \"packages/ui\"\n\t},\n\tpublishConfig: { \"access\": \"public\" },\n\tfiles: [\"build\"],\n\tscripts: {\n\t\t\"dev\": \"PORT=${PORT:-5173} vite dev\",\n\t\t\"ux:audit\": \"NODE_PATH=\\\"$PWD/node_modules\\\" bun \\\"${AKM_HOME:-$HOME/akm}/skills/web-ux/ux-dom-audit/scripts/audit.ts\\\" e2e/ux-audit.config.json\",\n\t\t\"ux:audit:wizard\": \"NODE_PATH=\\\"$PWD/node_modules\\\" bun \\\"${AKM_HOME:-$HOME/akm}/skills/web-ux/ux-dom-audit/scripts/audit.ts\\\" e2e/ux-audit.wizard.config.json\",\n\t\t\"dev:local\": \"PORT=${PORT:-5173} OP_OPENCODE_URL=${OP_OPENCODE_URL:-http://localhost:3800} vite dev\",\n\t\t\"build\": \"svelte-kit sync && vite build && node scripts/stamp-version.mjs\",\n\t\t\"clean:build\": \"rm -rf .svelte-kit build\",\n\t\t\"preview\": \"vite preview\",\n\t\t\"check\": \"svelte-kit sync && svelte-check --tsconfig ./tsconfig.json\",\n\t\t\"test:e2e\": \"playwright test\",\n\t\t\"test\": \"npm run test:unit -- --run && npm run test:e2e\",\n\t\t\"test:unit\": \"vitest\",\n\t\t\"test:browsers\": \"playwright install --with-deps chromium\",\n\t\t\"lint\": \"eslint .\",\n\t\t\"format\": \"prettier --write .\",\n\t\t\"start\": \"node build/index.js\"\n\t},\n\tdevDependencies: {\n\t\t\"@axe-core/playwright\": \"^4.11.3\",\n\t\t\"@eslint/compat\": \"^2.0.2\",\n\t\t\"@eslint/js\": \"^10.0.1\",\n\t\t\"@openpalm/lib\": \"workspace:*\",\n\t\t\"@openpalm/ui-kit\": \"workspace:*\",\n\t\t\"@playwright/test\": \"^1.58.1\",\n\t\t\"@sveltejs/adapter-node\": \"^5.5.4\",\n\t\t\"@sveltejs/kit\": \"^2.53.3\",\n\t\t\"@sveltejs/vite-plugin-svelte\": \"^7.1.2\",\n\t\t\"@types/markdown-it\": \"^14.1.2\",\n\t\t\"@types/node\": \"^25.9.1\",\n\t\t\"@vitest/browser-playwright\": \"^4.0.18\",\n\t\t\"@vitest/coverage-v8\": \"^4.0.18\",\n\t\t\"croner\": \"^10.0.1\",\n\t\t\"dotenv\": \"^17.4.2\",\n\t\t\"eslint\": \"^10.4.0\",\n\t\t\"eslint-config-prettier\": \"^10.1.8\",\n\t\t\"eslint-plugin-svelte\": \"^3.14.0\",\n\t\t\"globals\": \"^17.3.0\",\n\t\t\"markdown-it\": \"^14.1.1\",\n\t\t\"playwright\": \"^1.58.1\",\n\t\t\"prettier\": \"^3.8.1\",\n\t\t\"prettier-plugin-svelte\": \"^4.0.1\",\n\t\t\"svelte\": \"^5.53.5\",\n\t\t\"svelte-check\": \"^4.1.1\",\n\t\t\"typescript\": \"^6.0.3\",\n\t\t\"typescript-eslint\": \"^8.54.0\",\n\t\t\"uqr\": \"0.1.3\",\n\t\t\"vite\": \"^8.0.14\",\n\t\t\"vite-plugin-devtools-json\": \"^1.0.0\",\n\t\t\"vitest\": \"^4.0.18\",\n\t\t\"vitest-browser-svelte\": \"^2.0.2\",\n\t\t\"yaml\": \"^2.8.0\"\n\t}\n};\n//#endregion\n//#region src/lib/server/features.ts\n/**\n* Server runtime context — RuntimeContext v2 (issue #509). Computed server-side on every request via\n* +layout.server.ts and served publicly at GET /api/runtime (the\n* contract-version handshake for remote/hosted clients).\n*\n* Admin capability is an Electron-or-CLI-only security boundary — there is no\n* per-mode capability matrix and no env self-grant footgun (a served/container\n* build must never be able to claim host mode). A single boolean:\n*   OP_INSIDE_ELECTRON=1 (injected by packages/electron/src/main.ts) OR\n*   OP_ENABLE_ADMIN=1    (local dev / `openpalm admin`) → adminCapable\n* Every process gets the base capability set; only an adminCapable process\n* additionally gets host:*.\n*/\n/**\n* True when this process is admin-capable — running inside Electron or\n* explicitly opted into admin. This is the ONLY gate for host:* capabilities;\n* a served/container/PWA build is never admin-capable.\n*/\nfunction isAdminCapable() {\n\treturn process.env.OP_INSIDE_ELECTRON === \"1\" || process.env.OP_ENABLE_ADMIN === \"1\";\n}\n/** Base capabilities granted to EVERY process. The browser owns\n*  connections uniformly — multiple assistants + switching work everywhere. */\nvar BASE_CAPABILITIES = [\n\t\"chat\",\n\t\"connections:read\",\n\t\"connections:manage\",\n\t\"connections:switch\",\n\t\"assistant-settings:read\",\n\t\"assistant-settings:write\",\n\t\"pwa:install\"\n];\n/** The host:* capability set — added only when adminCapable. */\nvar HOST_CAPABILITIES = [\n\t\"host:setup\",\n\t\"host:stack:read\",\n\t\"host:stack:write\",\n\t\"host:containers\",\n\t\"host:addons\",\n\t\"host:updates\",\n\t\"host:logs\",\n\t\"host:secrets\",\n\t\"host:recovery\",\n\t\"host:akm-sharing\"\n];\n/**\n* Voice advertisement for the runtime handshake: the same-origin path of the\n* /voice pass-through, present when this process can actually serve it — an\n* admin-capable process (the host process is the only one with a loopback\n* path to the voice container) with the voice addon enabled. Same-origin, so\n* no host/port resolution and nothing request-derived.\n*\n* Deliberately NOT part of computeServerRuntimeContext(): that function runs\n* on requireCapability's per-request hot path, and this one reads the stack\n* env from disk. Only the two runtime-context producers (+layout.server.ts\n* and GET /api/runtime) call it.\n*/\nfunction computeVoiceRuntime() {\n\tif (!isAdminCapable()) return void 0;\n\ttry {\n\t\tif (!listEnabledAddonIds(getState().homeDir).includes(\"voice\")) return void 0;\n\t\treturn { url: \"/voice\" };\n\t} catch {\n\t\treturn;\n\t}\n}\nfunction computeServerRuntimeContext(event) {\n\tconst admin = isAdminCapable();\n\treturn {\n\t\tversion: 2,\n\t\tadmin,\n\t\tserverCapabilities: admin ? [...BASE_CAPABILITIES, ...HOST_CAPABILITIES] : [...BASE_CAPABILITIES],\n\t\tpublicBaseUrl: event.url?.origin ?? \"\",\n\t\tuiVersion: package_default.version,\n\t\tskeletonVersion: process.env.OP_SKELETON_VERSION?.trim() || PLATFORM_VERSION,\n\t\troutes: admin ? {\n\t\t\tchat: \"/chat\",\n\t\t\tconnections: \"/connections\",\n\t\t\thost: \"/host\",\n\t\t\tsetup: \"/setup\"\n\t\t} : {\n\t\t\tchat: \"/chat\",\n\t\t\tconnections: \"/connections\"\n\t\t},\n\t\tsecurity: {\n\t\t\thostAdminLoopbackOnly: true,\n\t\t\trequiresHttpsForRemoteConnections: !admin,\n\t\t\tcsrfMode: admin ? \"loopback-origin\" : \"same-site\"\n\t\t}\n\t};\n}\n//#endregion\nexport { computeVoiceRuntime as n, isAdminCapable as r, computeServerRuntimeContext as t };\n"],"names":[],"mappings":";;;AAGA,IAAI,eAAe,GAAG;AACtB,CAEC,OAAO,EAAE,eAgEV,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,GAAG;AAC1B,CAAC,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,GAAG;AACrF;AACA;AACA;AACA,IAAI,iBAAiB,GAAG;AACxB,CAAC,MAAM;AACP,CAAC,kBAAkB;AACnB,CAAC,oBAAoB;AACrB,CAAC,oBAAoB;AACrB,CAAC,yBAAyB;AAC1B,CAAC,0BAA0B;AAC3B,CAAC;AACD,CAAC;AACD;AACA,IAAI,iBAAiB,GAAG;AACxB,CAAC,YAAY;AACb,CAAC,iBAAiB;AAClB,CAAC,kBAAkB;AACnB,CAAC,iBAAiB;AAClB,CAAC,aAAa;AACd,CAAC,cAAc;AACf,CAAC,WAAW;AACZ,CAAC,cAAc;AACf,CAAC,eAAe;AAChB,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,GAAG;AAC/B,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,OAAO,MAAM;AACrC,CAAC,IAAI;AACL,EAAE,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;AAC/E,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE;AAC1B,CAAC,CAAC,CAAC,MAAM;AACT,EAAE;AACF,CAAC;AACD;AACA,SAAS,2BAA2B,CAAC,KAAK,EAAE;AAC5C,CAAC,MAAM,KAAK,GAAG,cAAc,EAAE;AAC/B,CAAC,OAAO;AACR,EAAE,OAAO,EAAE,CAAC;AACZ,EAAE,KAAK;AACP,EAAE,kBAAkB,EAAE,KAAK,GAAG,CAAC,GAAG,iBAAiB,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC;AACnG,EAAE,aAAa,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE;AACxC,EAAE,SAAS,EAAE,eAAe,CAAC,OAAO;AACpC,EAAE,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,gBAAgB;AAC9E,EAAE,MAAM,EAAE,KAAK,GAAG;AAClB,GAAG,IAAI,EAAE,OAAO;AAChB,GAAG,WAAW,EAAE,cAAc;AAC9B,GAAG,IAAI,EAAE,OAAO;AAChB,GAAG,KAAK,EAAE;AACV,GAAG,GAAG;AACN,GAAG,IAAI,EAAE,OAAO;AAChB,GAAG,WAAW,EAAE;AAChB,GAAG;AACH,EAAE,QAAQ,EAAE;AACZ,GAAG,qBAAqB,EAAE,IAAI;AAC9B,GAAG,iCAAiC,EAAE,CAAC,KAAK;AAC5C,GAAG,QAAQ,EAAE,KAAK,GAAG,iBAAiB,GAAG;AACzC;AACA,EAAE;AACF;;;;"}

package/build/server/chunks/{helpers-DxodR6tq.js → helpers-BrD1e__f.js}

@@ -1,7 +1,7 @@
-import { au as readSecret, aP as resolveOpenPalmHome, F as createOpenCodeClient } from './src-DbArH65P.js';
-import { h as isRemoteSetupAllowed } from './network-preset-CJ1RRnki.js';
-import { g as getActiveConnection } from './endpoints-IFTldlrt.js';
-import { c as computeServerRuntimeContext } from './features-BW-bVsl8.js';
+import { au as readSecret, aO as resolveOpenPalmHome, F as createOpenCodeClient } from './src-B2wHibme.js';
+import { h as isRemoteSetupAllowed } from './network-preset-BvVAoagy.js';
+import { g as getHostOpencodeTarget } from './opencode-target-D4BxXYHJ.js';
+import { c as computeServerRuntimeContext } from './features-D8Ez2vwC.js';
 import { timingSafeEqual, createHmac, createHash } from 'node:crypto';
 
 //#region src/lib/server/session-store.ts
@@ -119,7 +119,7 @@ function invalidateSession(token) {
 var _openCodeClient;
 var _openCodeClientUrl;
 function getOpenCodeClient() {
-	const { url } = getActiveConnection();
+	const { url } = getHostOpencodeTarget();
 	if (!_openCodeClient || url !== _openCodeClientUrl) {
 		_openCodeClient = createOpenCodeClient({ baseUrl: url });
 		_openCodeClientUrl = url;
@@ -159,7 +159,7 @@ function getRequestId(event) {
 *
 * Phase 2 of the auth/proxy refactor (docs/technical/auth-and-proxy-refactor-plan.md)
 * removed the legacy `x-admin-token` / `Authorization: Bearer` header fallbacks.
-* The cookie is HttpOnly + SameSite=Strict and is the ONLY credential the browser
+* The cookie is HttpOnly + SameSite=Lax and is the ONLY credential the browser
 * holds; XSS cannot read it and out-of-process callers must obtain a session via
 * `POST /api/auth/login` (or `/session`) and present the cookie on subsequent
 * requests.
@@ -176,22 +176,21 @@ function requireAdmin(event, requestId) {
 	return null;
 }
 /**
-* Server-side capability guard (plan ui-runtime-modes-plan.md §6.4, §8.5).
+* Server-side capability guard.
 *
-* Returns a 403 JSON error Response when the resolved host mode does not
-* expose `capability`, or null when it does. This is the SECURITY boundary —
-* the browser-side `hasCapability()` is UX only. The check is deliberately
-* capability-based, not session-based: a valid admin session in a mode
-* without the capability (e.g. `connections:manage` in assistant-container)
-* is still refused. Capability→mode logic itself lives ONLY in
-* computeServerRuntimeContext / resolveCapabilities (plan §8.6); this helper
-* just reads the advertised server capability set.
+* Returns a 403 JSON error Response when this process does not expose
+* `capability`, or null when it does. This is the SECURITY boundary — the
+* browser-side `hasCapability()` is UX only. The check is deliberately
+* capability-based, not session-based: a valid admin session in a non-admin
+* process (host:* absent) is still refused. Capability computation itself
+* lives ONLY in computeServerRuntimeContext / resolveCapabilities;
+* this helper just reads the advertised server capability set.
 */
 function requireCapability(event, capability, requestId) {
 	const ctx = computeServerRuntimeContext(event);
-	if (!ctx.serverCapabilities.includes(capability)) return errorResponse(403, "capability_not_available", `This deployment (${ctx.hostMode}) does not provide the '${capability}' capability.`, {
+	if (!ctx.serverCapabilities.includes(capability)) return errorResponse(403, "capability_not_available", `This deployment (admin=${ctx.admin}) does not provide the '${capability}' capability.`, {
 		capability,
-		hostMode: ctx.hostMode
+		admin: ctx.admin
 	}, requestId);
 	return null;
 }
@@ -304,10 +303,6 @@ function checkOriginHeader(request, csrfMode = "loopback-origin", requestId) {
 			case "same-site":
 				if (isSameSite(request, u)) return null;
 				break;
-			case "bearer-token":
-				if (request.headers.get("authorization")) return null;
-				if (isSameSite(request, u)) return null;
-				break;
 		}
 	} catch {}
 	return new Response(JSON.stringify({
@@ -322,4 +317,4 @@ function checkOriginHeader(request, csrfMode = "loopback-origin", requestId) {
 Number(process.env.PORT ?? 3880);
 
 export { SESSION_TTL_SECONDS as S, checkOriginHeader as a, createSession as b, checkHostHeader as c, getRequestId as d, errorResponse as e, getUiLoginPassword as f, getOpenCodeClient as g, invalidateSession as h, identifyCallerByToken as i, jsonBodyError as j, jsonResponse as k, requireCapability as l, parseJsonBody as p, requireAdmin as r, safeTokenCompare as s, touchSession as t, withAdminBody as w };
-//# sourceMappingURL=helpers-DxodR6tq.js.map
+//# sourceMappingURL=helpers-BrD1e__f.js.map

package/build/server/chunks/helpers-BrD1e__f.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers-BrD1e__f.js","sources":["../../../.svelte-kit/adapter-node/chunks/helpers.js"],"sourcesContent":["import { rt as readSecret, yt as resolveOpenPalmHome } from \"./compose-args.js\";\nimport { G as createOpenCodeClient } from \"./src.js\";\nimport { l as isRemoteSetupAllowed } from \"./network-preset.js\";\nimport { t as getHostOpencodeTarget } from \"./opencode-target.js\";\nimport { t as computeServerRuntimeContext } from \"./features.js\";\nimport { createHash, createHmac, timingSafeEqual } from \"node:crypto\";\n//#region src/lib/server/session-store.ts\n/**\n* Stateless signed session tokens.\n*\n* Token format: `<expiresAt>.<hmac-sha256-hex>`\n*   expiresAt — unix ms timestamp when the session expires\n*   signature — HMAC-SHA256(expiresAt, login password)\n*\n* Tokens are self-validating: the server holds no per-session state and\n* sessions survive UI server restarts. Signing with the login password means\n* a password change invalidates all existing sessions — correct behaviour.\n*\n* The signing secret is resolved exactly like login verification\n* (`getUiLoginPassword`): `process.env.OP_UI_LOGIN_PASSWORD` first, then the\n* on-disk stack secret. When NEITHER exists, minting throws and validation\n* fails closed — there is deliberately no fallback secret, because a constant\n* key would let anyone forge an admin token. Reading the file per call also\n* means tokens minted right after the setup wizard writes the password are\n* signed with the real secret, without waiting for a process restart.\n*\n* Logout semantics (known trade-off of stateless tokens): logout revokes the\n* single token the browser presented (in-memory list, cleared on restart) and\n* clears the cookie. Earlier tokens issued to the same browser by sliding\n* renewal remain cryptographically valid until they expire — logout is\n* \"forget my cookie\", not \"kill every credential ever issued\". A real\n* kill-switch is changing the login password, which invalidates everything.\n*/\n/** Session lifetime for both the token expiry and the cookie Max-Age. 14 days. */\nvar SESSION_TTL_MS = 12096e5;\n/** Cookie Max-Age in seconds (Set-Cookie uses seconds, not ms). */\nvar SESSION_TTL_SECONDS = SESSION_TTL_MS / 1e3;\nvar _revoked = /* @__PURE__ */ new Set();\nvar _testOverrides = /* @__PURE__ */ new Set();\n/**\n* Read the operator UI login password from the host environment or the\n* file-based stack secret (`knowledge/secrets/op_ui_login_password`).\n*\n* This is the single source of truth for the password — login verification\n* (helpers.ts) and token signing below both use it, so they can never\n* disagree about whether a password exists. Returns \"\" when neither source\n* has a value (first boot, before the wizard runs).\n*/\nfunction getUiLoginPassword() {\n\tconst envValue = process.env.OP_UI_LOGIN_PASSWORD;\n\tif (envValue) return envValue;\n\treturn readSecret(resolveOpenPalmHome(), \"op_ui_login_password\")?.trimEnd() ?? \"\";\n}\n/** Sign `expiresAt` with the login password. Returns null when no password is configured. */\nfunction signToken(expiresAt) {\n\tconst secret = getUiLoginPassword();\n\tif (!secret) return null;\n\treturn createHmac(\"sha256\", secret).update(String(expiresAt)).digest(\"hex\");\n}\n/**\n* Mint a new signed session token with a 14-day TTL.\n* Place the result in the `op_session` cookie.\n* Throws when no login password is configured — callers must verify a\n* password exists (they all do: login/session/setup-complete check first).\n*/\nfunction createSession() {\n\tconst expiresAt = Date.now() + SESSION_TTL_MS;\n\tconst sig = signToken(expiresAt);\n\tif (sig === null) throw new Error(\"Cannot mint a session: no UI login password is configured.\");\n\treturn `${expiresAt}.${sig}`;\n}\n/**\n* Return true iff `token` is a valid, non-expired, non-revoked session.\n*/\nfunction validateSession(token) {\n\tif (!token) return false;\n\tif (_testOverrides.has(token)) return true;\n\tif (_revoked.has(token)) return false;\n\tconst dot = token.lastIndexOf(\".\");\n\tif (dot < 0) return false;\n\tconst expiresAt = Number(token.slice(0, dot));\n\tif (!Number.isFinite(expiresAt) || Date.now() >= expiresAt) return false;\n\tconst sig = token.slice(dot + 1);\n\tconst expected = signToken(expiresAt);\n\tif (expected === null) return false;\n\tif (sig.length !== expected.length) return false;\n\treturn timingSafeEqual(Buffer.from(sig), Buffer.from(expected));\n}\n/**\n* Sliding renewal: validate the old token, return a new one with a fresh\n* 14-day TTL, or return false if the old token is invalid/expired.\n* The caller must place the returned token in the `op_session` cookie.\n*/\nfunction touchSession(token) {\n\tif (!validateSession(token)) return false;\n\treturn createSession();\n}\n/**\n* Revoke a token (logout). The browser cookie must also be cleared by the caller.\n* The revocation list survives until the next server restart. Entries whose\n* embedded expiry has passed are pruned on each call — an expired token fails\n* validation anyway, so keeping it listed is pure memory growth.\n*/\nfunction invalidateSession(token) {\n\tconst now = Date.now();\n\tfor (const revoked of _revoked) {\n\t\tconst expiresAt = Number(revoked.slice(0, revoked.lastIndexOf(\".\")));\n\t\tif (!Number.isFinite(expiresAt) || expiresAt <= now) _revoked.delete(revoked);\n\t}\n\t_revoked.add(token);\n}\n//#endregion\n//#region src/lib/server/helpers.ts\n/**\n* Lazy OpenCode client bound to the currently active endpoint. The client is\n* recreated whenever the active endpoint URL changes so user switches in the\n* UI take effect on the next call.\n*/\nvar _openCodeClient;\nvar _openCodeClientUrl;\nfunction getOpenCodeClient() {\n\tconst { url } = getHostOpencodeTarget();\n\tif (!_openCodeClient || url !== _openCodeClientUrl) {\n\t\t_openCodeClient = createOpenCodeClient({ baseUrl: url });\n\t\t_openCodeClientUrl = url;\n\t}\n\treturn _openCodeClient;\n}\nfunction safeTokenCompare(a, b) {\n\tif (typeof a !== \"string\" || typeof b !== \"string\") return false;\n\tif (!a || !b) return false;\n\treturn timingSafeEqual(createHash(\"sha256\").update(a).digest(), createHash(\"sha256\").update(b).digest());\n}\n/** Standard JSON response with request ID header */\nfunction jsonResponse(status, body, requestId = \"\") {\n\treturn new Response(JSON.stringify(body), {\n\t\tstatus,\n\t\theaders: {\n\t\t\t\"content-type\": \"application/json\",\n\t\t\t...requestId ? { \"x-request-id\": requestId } : {}\n\t\t}\n\t});\n}\n/** Standard error envelope */\nfunction errorResponse(status, error, message, details = {}, requestId = \"\") {\n\treturn jsonResponse(status, {\n\t\terror,\n\t\tmessage,\n\t\tdetails,\n\t\trequestId\n\t}, requestId);\n}\n/** Extract or generate request ID */\nfunction getRequestId(event) {\n\treturn event.request.headers.get(\"x-request-id\") || crypto.randomUUID();\n}\n/**\n* Extract raw session token from the `op_session` cookie.\n*\n* Phase 2 of the auth/proxy refactor (docs/technical/auth-and-proxy-refactor-plan.md)\n* removed the legacy `x-admin-token` / `Authorization: Bearer` header fallbacks.\n* The cookie is HttpOnly + SameSite=Lax and is the ONLY credential the browser\n* holds; XSS cannot read it and out-of-process callers must obtain a session via\n* `POST /api/auth/login` (or `/session`) and present the cookie on subsequent\n* requests.\n*/\nfunction extractToken(event) {\n\tconst match = (event.request.headers.get(\"cookie\") ?? \"\").match(/(?:^|;\\s*)op_session=([^;]+)/);\n\tif (match) return match[1];\n\treturn \"\";\n}\n/** Check admin auth — returns error Response or null if OK */\nfunction requireAdmin(event, requestId) {\n\tif (!getUiLoginPassword()) return errorResponse(503, \"admin_not_configured\", \"OP_UI_LOGIN_PASSWORD has not been set. Complete setup first.\", {}, requestId);\n\tif (!validateSession(extractToken(event))) return errorResponse(401, \"unauthorized\", \"Missing or invalid credentials\", {}, requestId);\n\treturn null;\n}\n/**\n* Server-side capability guard.\n*\n* Returns a 403 JSON error Response when this process does not expose\n* `capability`, or null when it does. This is the SECURITY boundary — the\n* browser-side `hasCapability()` is UX only. The check is deliberately\n* capability-based, not session-based: a valid admin session in a non-admin\n* process (host:* absent) is still refused. Capability computation itself\n* lives ONLY in computeServerRuntimeContext / resolveCapabilities;\n* this helper just reads the advertised server capability set.\n*/\nfunction requireCapability(event, capability, requestId) {\n\tconst ctx = computeServerRuntimeContext(event);\n\tif (!ctx.serverCapabilities.includes(capability)) return errorResponse(403, \"capability_not_available\", `This deployment (admin=${ctx.admin}) does not provide the '${capability}' capability.`, {\n\t\tcapability,\n\t\tadmin: ctx.admin\n\t}, requestId);\n\treturn null;\n}\n/**\n* Identify caller by the presented `op_session` cookie.\n*\n* Returns \"admin\" when the cookie holds a valid session token.\n*/\nfunction identifyCallerByToken(event) {\n\tif (!getUiLoginPassword()) return null;\n\tif (validateSession(extractToken(event))) return \"admin\";\n\treturn null;\n}\n/** Parse JSON body safely — returns discriminated result with error type */\nasync function parseJsonBody(request, maxBytes = 1048576) {\n\ttry {\n\t\tconst contentLength = request.headers.get(\"content-length\");\n\t\tif (contentLength && parseInt(contentLength, 10) > maxBytes) return { error: \"too_large\" };\n\t\tconst parsed = await request.json();\n\t\tif (parsed === null || typeof parsed !== \"object\" || Array.isArray(parsed)) return { error: \"invalid_json\" };\n\t\treturn { data: parsed };\n\t} catch (e) {\n\t\tconsole.warn(\"[helpers] Failed to parse JSON request body\", e);\n\t\treturn { error: \"invalid_json\" };\n\t}\n}\n/** Convert a ParseJsonBodyError to an appropriate HTTP error response */\nfunction jsonBodyError(err, requestId) {\n\tif (err.error === \"too_large\") return errorResponse(413, \"too_large\", \"Request body too large\", {}, requestId);\n\treturn errorResponse(400, \"invalid_json\", \"Request body must be valid JSON\", {}, requestId);\n}\n/**\n* Auth + JSON body wrapper for admin POST/DELETE handlers.\n*\n* Replaces the 4-line boilerplate copy-pasted across 30+ routes:\n*   const requestId = getRequestId(event);\n*   const authError = requireAdmin(event, requestId);\n*   if (authError) return authError;\n*   const result = await parseJsonBody(event.request);\n*   if ('error' in result) return jsonBodyError(result, requestId);\n*\n* Use for routes that need both auth and a JSON body. For auth-only or\n* GET routes, call `requireAdmin` directly.\n*/\nasync function withAdminBody(event, handler) {\n\tconst requestId = getRequestId(event);\n\tconst { security } = computeServerRuntimeContext(event);\n\tconst originError = checkOriginHeader(event.request, security.csrfMode, requestId);\n\tif (originError) return originError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst result = await parseJsonBody(event.request);\n\tif (\"error\" in result) return jsonBodyError(result, requestId);\n\treturn handler({\n\t\trequestId,\n\t\tbody: result.data\n\t});\n}\nfunction hostNameFromHeader(hostHeader) {\n\tconst normalized = hostHeader.trim().replace(/\\.$/, \"\");\n\ttry {\n\t\treturn new URL(`http://${normalized}`).hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n\t} catch {\n\t\treturn null;\n\t}\n}\nfunction isLoopbackHost(hostHeader) {\n\tconst hostname = hostNameFromHeader(hostHeader);\n\tif (!hostname) return false;\n\treturn hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"::1\";\n}\nfunction isSameSite(request, origin) {\n\tconst requestHost = hostNameFromHeader(request.headers.get(\"host\") ?? \"\");\n\tif (!requestHost) return false;\n\treturn requestHost === origin.hostname.toLowerCase();\n}\nfunction checkHostHeader(request, requestId) {\n\tconst host = request.headers.get(\"host\") ?? \"\";\n\tif (isLoopbackHost(host) || isRemoteSetupAllowed()) return null;\n\treturn new Response(JSON.stringify({\n\t\terror: \"invalid_host\",\n\t\thost: host.trim().replace(/\\.$/, \"\"),\n\t\tmessage: \"Request rejected: Host header does not match allowed hosts. The UI binds to loopback (127.0.0.1) only; reach it via localhost or an SSH tunnel/reverse proxy, or set OP_ALLOW_REMOTE_SETUP=1 to allow remote access.\",\n\t\t...requestId ? { requestId } : {}\n\t}), {\n\t\tstatus: 400,\n\t\theaders: { \"content-type\": \"application/json\" }\n\t});\n}\n/**\n* Reject POST/PUT/DELETE requests whose Origin header does not match\n* localhost or 127.0.0.1. Requests with no Origin (non-browser clients)\n* are always allowed.\n*\n* @param request  Incoming Request\n* @returns        A 403 Response if the origin is rejected; null if allowed\n*/\nfunction checkOriginHeader(request, csrfMode = \"loopback-origin\", requestId) {\n\tconst method = request.method.toUpperCase();\n\tif (method === \"GET\" || method === \"HEAD\" || method === \"OPTIONS\") return null;\n\tconst origin = request.headers.get(\"origin\");\n\tif (!origin) return null;\n\ttry {\n\t\tconst u = new URL(origin);\n\t\tswitch (csrfMode) {\n\t\t\tcase \"loopback-origin\":\n\t\t\t\tif (isLoopbackHost(u.host)) return null;\n\t\t\t\tif (isRemoteSetupAllowed() && u.host === (request.headers.get(\"host\") ?? \"\").trim()) return null;\n\t\t\t\tbreak;\n\t\t\tcase \"same-site\":\n\t\t\t\tif (isSameSite(request, u)) return null;\n\t\t\t\tbreak;\n\t\t}\n\t} catch {}\n\treturn new Response(JSON.stringify({\n\t\terror: \"forbidden_origin\",\n\t\torigin,\n\t\t...requestId ? { requestId } : {}\n\t}), {\n\t\tstatus: 403,\n\t\theaders: { \"content-type\": \"application/json\" }\n\t});\n}\nNumber(process.env.PORT ?? 3880);\n//#endregion\nexport { invalidateSession as _, getRequestId as a, jsonResponse as c, requireCapability as d, safeTokenCompare as f, getUiLoginPassword as g, createSession as h, getOpenCodeClient as i, parseJsonBody as l, SESSION_TTL_SECONDS as m, checkOriginHeader as n, identifyCallerByToken as o, withAdminBody as p, errorResponse as r, jsonBodyError as s, checkHostHeader as t, requireAdmin as u, touchSession as v };\n"],"names":[],"mappings":";;;;;;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,cAAc,GAAG,OAAO;AAC5B;AACG,IAAC,mBAAmB,GAAG,cAAc,GAAG;AAC3C,IAAI,QAAQ,mBAAmB,IAAI,GAAG,EAAE;AACxC,IAAI,cAAc,mBAAmB,IAAI,GAAG,EAAE;AAC9C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,GAAG;AAC9B,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB;AAClD,CAAC,IAAI,QAAQ,EAAE,OAAO,QAAQ;AAC9B,CAAC,OAAO,UAAU,CAAC,mBAAmB,EAAE,EAAE,sBAAsB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;AAClF;AACA;AACA,SAAS,SAAS,CAAC,SAAS,EAAE;AAC9B,CAAC,MAAM,MAAM,GAAG,kBAAkB,EAAE;AACpC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI;AACzB,CAAC,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;AAC5E;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc;AAC9C,CAAC,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC;AACjC,CAAC,IAAI,GAAG,KAAK,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC;AAChG,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7B;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,KAAK,EAAE;AAChC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,KAAK;AACzB,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,IAAI;AAC3C,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK;AACtC,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC;AACnC,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,OAAO,KAAK;AAC1B,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,EAAE,OAAO,KAAK;AACzE,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;AACjC,CAAC,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC;AACtC,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,OAAO,KAAK;AACpC,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,OAAO,KAAK;AACjD,CAAC,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAChE;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK;AAC1C,CAAC,OAAO,aAAa,EAAE;AACvB;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;AACvB,CAAC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE;AACjC,EAAE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;AACtE,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;AAC/E,CAAC;AACD,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;AACpB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,eAAe;AACnB,IAAI,kBAAkB;AACtB,SAAS,iBAAiB,GAAG;AAC7B,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,qBAAqB,EAAE;AACxC,CAAC,IAAI,CAAC,eAAe,IAAI,GAAG,KAAK,kBAAkB,EAAE;AACrD,EAAE,eAAe,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC1D,EAAE,kBAAkB,GAAG,GAAG;AAC1B,CAAC;AACD,CAAC,OAAO,eAAe;AACvB;AACA,SAAS,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE;AAChC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,OAAO,KAAK;AACjE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,KAAK;AAC3B,CAAC,OAAO,eAAe,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AACzG;AACA;AACA,SAAS,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,EAAE,EAAE;AACpD,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;AAC3C,EAAE,MAAM;AACR,EAAE,OAAO,EAAE;AACX,GAAG,cAAc,EAAE,kBAAkB;AACrC,GAAG,GAAG,SAAS,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG;AAClD;AACA,EAAE,CAAC;AACH;AACA;AACA,SAAS,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,EAAE;AAC7E,CAAC,OAAO,YAAY,CAAC,MAAM,EAAE;AAC7B,EAAE,KAAK;AACP,EAAE,OAAO;AACT,EAAE,OAAO;AACT,EAAE;AACF,EAAE,EAAE,SAAS,CAAC;AACd;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE;AACxE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,8BAA8B,CAAC;AAChG,CAAC,IAAI,KAAK,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC;AAC3B,CAAC,OAAO,EAAE;AACV;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE;AACxC,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,sBAAsB,EAAE,8DAA8D,EAAE,EAAE,EAAE,SAAS,CAAC;AAC5J,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,gCAAgC,EAAE,EAAE,EAAE,SAAS,CAAC;AACtI,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE;AACzD,CAAC,MAAM,GAAG,GAAG,2BAA2B,CAAC,KAAK,CAAC;AAC/C,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,0BAA0B,EAAE,CAAC,uBAAuB,EAAE,GAAG,CAAC,KAAK,CAAC,wBAAwB,EAAE,UAAU,CAAC,aAAa,CAAC,EAAE;AAClM,EAAE,UAAU;AACZ,EAAE,KAAK,EAAE,GAAG,CAAC;AACb,EAAE,EAAE,SAAS,CAAC;AACd,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,KAAK,EAAE;AACtC,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,OAAO,IAAI;AACvC,CAAC,IAAI,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,OAAO;AACzD,CAAC,OAAO,IAAI;AACZ;AACA;AACA,eAAe,aAAa,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,EAAE;AAC1D,CAAC,IAAI;AACL,EAAE,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;AAC7D,EAAE,IAAI,aAAa,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE;AAC5F,EAAE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE;AACrC,EAAE,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE;AAC9G,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;AACzB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,CAAC,IAAI,CAAC,6CAA6C,EAAE,CAAC,CAAC;AAChE,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE;AAClC,CAAC;AACD;AACA;AACA,SAAS,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE;AACvC,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,EAAE,EAAE,SAAS,CAAC;AAC/G,CAAC,OAAO,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,iCAAiC,EAAE,EAAE,EAAE,SAAS,CAAC;AAC5F;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC;AACxD,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;AACnF,CAAC,IAAI,WAAW,EAAE,OAAO,WAAW;AACpC,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;AAClD,CAAC,IAAI,OAAO,IAAI,MAAM,EAAE,OAAO,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC;AAC/D,CAAC,OAAO,OAAO,CAAC;AAChB,EAAE,SAAS;AACX,EAAE,IAAI,EAAE,MAAM,CAAC;AACf,EAAE,CAAC;AACH;AACA,SAAS,kBAAkB,CAAC,UAAU,EAAE;AACxC,CAAC,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AACxD,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;AACvF,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,IAAI;AACb,CAAC;AACD;AACA,SAAS,cAAc,CAAC,UAAU,EAAE;AACpC,CAAC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,UAAU,CAAC;AAChD,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AAC5B,CAAC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK;AAClF;AACA,SAAS,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE;AACrC,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAC1E,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,KAAK;AAC/B,CAAC,OAAO,WAAW,KAAK,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE;AACrD;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE;AAC7C,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;AAC/C,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,oBAAoB,EAAE,EAAE,OAAO,IAAI;AAChE,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AACpC,EAAE,KAAK,EAAE,cAAc;AACvB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AACtC,EAAE,OAAO,EAAE,sNAAsN;AACjO,EAAE,GAAG,SAAS,GAAG,EAAE,SAAS,EAAE,GAAG;AACjC,EAAE,CAAC,EAAE;AACL,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AAC/C,EAAE,CAAC;AACH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,OAAO,EAAE,QAAQ,GAAG,iBAAiB,EAAE,SAAS,EAAE;AAC7E,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;AAC5C,CAAC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,OAAO,IAAI;AAC/E,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC7C,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI;AACzB,CAAC,IAAI;AACL,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC;AAC3B,EAAE,QAAQ,QAAQ;AAClB,GAAG,KAAK,iBAAiB;AACzB,IAAI,IAAI,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AAC3C,IAAI,IAAI,oBAAoB,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,IAAI;AACpG,IAAI;AACJ,GAAG,KAAK,WAAW;AACnB,IAAI,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,OAAO,IAAI;AAC3C,IAAI;AACJ;AACA,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AACpC,EAAE,KAAK,EAAE,kBAAkB;AAC3B,EAAE,MAAM;AACR,EAAE,GAAG,SAAS,GAAG,EAAE,SAAS,EAAE,GAAG;AACjC,EAAE,CAAC,EAAE;AACL,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AAC/C,EAAE,CAAC;AACH;AACA,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC;;;;"}

package/build/server/chunks/{hooks.server-Bzj8OieV.js → hooks.server-Blba-Qw7.js}

@@ -1,12 +1,12 @@
 import { r as redirect } from './exports-CcmcYU0M.js';
-import { aP as resolveOpenPalmHome, ad as isSetupComplete, aX as stackDirFor, au as readSecret, ay as readStackRuntimeEnv, aF as reconcileMdnsResponder, D as createLogger } from './src-DbArH65P.js';
-import { h as isRemoteSetupAllowed, e as collectNetworkExposureWarnings } from './network-preset-CJ1RRnki.js';
-import { g as getState } from './state-Bq8fep3F.js';
-import { d as getRequestId, c as checkHostHeader, a as checkOriginHeader, i as identifyCallerByToken, t as touchSession } from './helpers-DxodR6tq.js';
-import { c as computeServerRuntimeContext } from './features-BW-bVsl8.js';
-import { S as SESSION_COOKIE_NAME, s as sessionCookieHeader } from './session-cookie-C8DcD6bt.js';
-import { g as getCachedLocalInstallState, r as resolveRequestLanding, B as BLOCKING_LANDINGS } from './landing-DhaVkN2f.js';
-export { _ as _resetLaunchCache } from './landing-DhaVkN2f.js';
+import { aO as resolveOpenPalmHome, ad as isSetupComplete, aW as stackDirFor, au as readSecret, ay as readStackRuntimeEnv, aF as reconcileMdnsResponder, D as createLogger } from './src-B2wHibme.js';
+import { h as isRemoteSetupAllowed, e as collectNetworkExposureWarnings } from './network-preset-BvVAoagy.js';
+import { g as getState } from './state-JIy0tegD.js';
+import { d as getRequestId, c as checkHostHeader, a as checkOriginHeader, i as identifyCallerByToken, t as touchSession } from './helpers-BrD1e__f.js';
+import { c as computeServerRuntimeContext } from './features-D8Ez2vwC.js';
+import { S as SESSION_COOKIE_NAME, s as sessionCookieHeader } from './session-cookie-5J3xCH94.js';
+import { g as getCachedLocalInstallState, r as resolveRequestLanding, B as BLOCKING_LANDINGS } from './landing-DxFOhZxH.js';
+export { _ as _resetLaunchCache } from './landing-DxFOhZxH.js';
 import './utils-OXHIhUb5.js';
 import './chunk-DOvWTNp_.js';
 import 'node:module';
@@ -28,8 +28,8 @@ import 'assert';
 import 'zlib';
 import 'node:assert';
 import 'node:fs/promises';
-import './endpoints-IFTldlrt.js';
-import './runtime-context.svelte-C5zNEC6u.js';
+import './opencode-target-D4BxXYHJ.js';
+import './runtime-context.svelte-CRT-b6Ae.js';
 
 //#region src/hooks.server.ts
 var logger = createLogger("admin");
@@ -90,7 +90,7 @@ var handle = async ({ event, resolve }) => {
 		const landing = await resolveRequestLanding(event);
 		const [landingPath] = landing.split("?");
 		const usageExempt = (path.startsWith("/chat") || path.startsWith("/advanced") || path.startsWith("/connections")) && !BLOCKING_LANDINGS.has(landingPath);
-		const exempt = path.startsWith("/api/") || path.startsWith("/proxy/") || path.startsWith("/login") || path.startsWith("/health") || path.startsWith("/guardian/health") || path.startsWith("/host") || path.startsWith("/admin") || usageExempt;
+		const exempt = path.startsWith("/api/") || path.startsWith("/login") || path.startsWith("/health") || path.startsWith("/guardian/health") || path.startsWith("/host") || path.startsWith("/admin") || usageExempt;
 		if (path === "/" || path !== landingPath && !exempt) redirect(302, landing);
 	}
 	event.locals.role = identifyCallerByToken(event);
@@ -115,4 +115,4 @@ var handle = async ({ event, resolve }) => {
 };
 
 export { handle };
-//# sourceMappingURL=hooks.server-Bzj8OieV.js.map
+//# sourceMappingURL=hooks.server-Blba-Qw7.js.map

package/build/server/chunks/hooks.server-Blba-Qw7.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.server-Blba-Qw7.js","sources":["../../../.svelte-kit/adapter-node/entries/hooks.server.js"],"sourcesContent":["import { i as redirect } from \"../chunks/exports.js\";\nimport { Dt as createLogger, Y as readStackRuntimeEnv, rt as readSecret, xt as stackDirFor, yt as resolveOpenPalmHome } from \"../chunks/compose-args.js\";\nimport { r as reconcileMdnsResponder, z as isSetupComplete } from \"../chunks/src.js\";\nimport { l as isRemoteSetupAllowed, r as collectNetworkExposureWarnings } from \"../chunks/network-preset.js\";\nimport { t as getState } from \"../chunks/state.js\";\nimport { a as getRequestId, n as checkOriginHeader, o as identifyCallerByToken, t as checkHostHeader, v as touchSession } from \"../chunks/helpers.js\";\nimport { t as computeServerRuntimeContext } from \"../chunks/features.js\";\nimport { r as sessionCookieHeader, t as SESSION_COOKIE_NAME } from \"../chunks/session-cookie.js\";\nimport { i as BLOCKING_LANDINGS, n as getCachedLocalInstallState, r as resolveRequestLanding, t as _resetLaunchCache } from \"../chunks/landing.js\";\n//#region src/hooks.server.ts\nvar logger = createLogger(\"admin\");\nvar startupApplyDone = false;\nfunction loadProcessEnv() {\n\tif (startupApplyDone) return;\n\tstartupApplyDone = true;\n\tfor (const line of collectNetworkExposureWarnings(process.env)) logger.warn(line);\n\ttry {\n\t\tconst state = getState();\n\t\tif (!process.env.OP_UI_LOGIN_PASSWORD) {\n\t\t\tconst pw = readSecret(state.homeDir, \"op_ui_login_password\");\n\t\t\tif (pw) process.env.OP_UI_LOGIN_PASSWORD = pw.trimEnd();\n\t\t}\n\t\tconst stackVars = readStackRuntimeEnv(state.homeDir);\n\t\tfor (const [k, v] of Object.entries(stackVars)) if (v && !process.env[k]) process.env[k] = v;\n\t\treconcileMdnsResponder(state.homeDir);\n\t} catch (err) {\n\t\tlogger.error(\"process env load failed\", { error: String(err) });\n\t}\n}\nloadProcessEnv();\nvar SETUP_PATHS = [\n\t\"/setup\",\n\t\"/api/setup\",\n\t\"/health\",\n\t\"/guardian/health\"\n];\nfunction isLocalhostAddress(ip) {\n\treturn ip === \"127.0.0.1\" || ip === \"::1\" || ip === \"::ffff:127.0.0.1\";\n}\nvar handle = async ({ event, resolve }) => {\n\tconst runtimeContext = computeServerRuntimeContext(event);\n\tconst requestId = getRequestId(event);\n\tconst hostError = checkHostHeader(event.request, requestId);\n\tif (hostError) return hostError;\n\tconst originError = checkOriginHeader(event.request, runtimeContext.security.csrfMode, requestId);\n\tif (originError) return originError;\n\tconst path = event.url.pathname;\n\tconst isAuthPath = path === \"/login\" || path.startsWith(\"/login/\");\n\tconst wantsHtml = event.request.method === \"GET\" && (event.request.headers.get(\"accept\") ?? \"\").includes(\"text/html\");\n\tif ((path === \"/host\" || path.startsWith(\"/host/\")) && !runtimeContext.serverCapabilities.includes(\"host:stack:read\")) redirect(302, \"/chat\");\n\tconst isSetupPath = SETUP_PATHS.some((p) => path === p || path.startsWith(`${p}/`));\n\tconst homeDir = resolveOpenPalmHome();\n\tconst setupComplete = isSetupComplete(homeDir);\n\tconst localInstallState = getCachedLocalInstallState(stackDirFor(homeDir), homeDir);\n\tif (wantsHtml && !setupComplete && localInstallState !== \"not_installed\" && !isSetupPath && !isAuthPath && !path.startsWith(\"/admin\")) redirect(302, \"/setup\");\n\tif (isSetupPath && !setupComplete && !isRemoteSetupAllowed()) {\n\t\tif (!isLocalhostAddress(event.getClientAddress())) return new Response(JSON.stringify({\n\t\t\terror: \"setup_localhost_only\",\n\t\t\tmessage: \"Setup is only accessible from the host machine until installation is complete.\"\n\t\t}), {\n\t\t\tstatus: 403,\n\t\t\theaders: { \"content-type\": \"application/json\" }\n\t\t});\n\t}\n\tif (!isSetupPath) {\n\t\tconst landing = await resolveRequestLanding(event);\n\t\tconst [landingPath] = landing.split(\"?\");\n\t\tconst usageExempt = (path.startsWith(\"/chat\") || path.startsWith(\"/advanced\") || path.startsWith(\"/connections\")) && !BLOCKING_LANDINGS.has(landingPath);\n\t\tconst exempt = path.startsWith(\"/api/\") || path.startsWith(\"/login\") || path.startsWith(\"/health\") || path.startsWith(\"/guardian/health\") || path.startsWith(\"/host\") || path.startsWith(\"/admin\") || usageExempt;\n\t\tif (path === \"/\" || path !== landingPath && !exempt) redirect(302, landing);\n\t}\n\tevent.locals.role = identifyCallerByToken(event);\n\tlet renewedCookie = null;\n\tif (event.locals.role === \"admin\") {\n\t\tconst match = (event.request.headers.get(\"cookie\") ?? \"\").match(new RegExp(`(?:^|;\\\\s*)${SESSION_COOKIE_NAME}=([^;]+)`));\n\t\tconst renewed = match ? touchSession(match[1]) : false;\n\t\tif (renewed) renewedCookie = sessionCookieHeader(renewed, event.request);\n\t}\n\tif (wantsHtml && !event.locals.role && !isSetupPath && !isAuthPath) {\n\t\tconst redirectTo = path + event.url.search;\n\t\tredirect(302, `/login?redirectTo=${encodeURIComponent(redirectTo)}`);\n\t}\n\tconst response = await resolve(event);\n\tif (renewedCookie) {\n\t\tif (!(response.headers.get(\"set-cookie\") ?? \"\").includes(`op_session=`)) response.headers.append(\"set-cookie\", renewedCookie);\n\t}\n\tresponse.headers.set(\"X-Frame-Options\", path === \"/api/host/akm/health-report\" ? \"SAMEORIGIN\" : \"DENY\");\n\tresponse.headers.set(\"X-Content-Type-Options\", \"nosniff\");\n\tresponse.headers.set(\"Referrer-Policy\", \"no-referrer\");\n\treturn response;\n};\n//#endregion\nexport { _resetLaunchCache, handle };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AASA;AACA,IAAI,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC;AAClC,IAAI,gBAAgB,GAAG,KAAK;AAC5B,SAAS,cAAc,GAAG;AAC1B,CAAC,IAAI,gBAAgB,EAAE;AACvB,CAAC,gBAAgB,GAAG,IAAI;AACxB,CAAC,KAAK,MAAM,IAAI,IAAI,8BAA8B,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;AAClF,CAAC,IAAI;AACL,EAAE,MAAM,KAAK,GAAG,QAAQ,EAAE;AAC1B,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE;AACzC,GAAG,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,sBAAsB,CAAC;AAC/D,GAAG,IAAI,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,EAAE,CAAC,OAAO,EAAE;AAC1D,EAAE;AACF,EAAE,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC;AACtD,EAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC9F,EAAE,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC;AACvC,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AACjE,CAAC;AACD;AACA,cAAc,EAAE;AAChB,IAAI,WAAW,GAAG;AAClB,CAAC,QAAQ;AACT,CAAC,YAAY;AACb,CAAC,SAAS;AACV,CAAC;AACD,CAAC;AACD,SAAS,kBAAkB,CAAC,EAAE,EAAE;AAChC,CAAC,OAAO,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,kBAAkB;AACvE;AACG,IAAC,MAAM,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AAC3C,CAAC,MAAM,cAAc,GAAG,2BAA2B,CAAC,KAAK,CAAC;AAC1D,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC;AAC5D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;AAClG,CAAC,IAAI,WAAW,EAAE,OAAO,WAAW;AACpC,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ;AAChC,CAAC,MAAM,UAAU,GAAG,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;AACnE,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,WAAW,CAAC;AACtH,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,kBAAkB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;AAC9I,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC,MAAM,OAAO,GAAG,mBAAmB,EAAE;AACtC,CAAC,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC;AAC/C,CAAC,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;AACpF,CAAC,IAAI,SAAS,IAAI,CAAC,aAAa,IAAI,iBAAiB,KAAK,eAAe,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;AAC/J,CAAC,IAAI,WAAW,IAAI,CAAC,aAAa,IAAI,CAAC,oBAAoB,EAAE,EAAE;AAC/D,EAAE,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AACxF,GAAG,KAAK,EAAE,sBAAsB;AAChC,GAAG,OAAO,EAAE;AACZ,GAAG,CAAC,EAAE;AACN,GAAG,MAAM,EAAE,GAAG;AACd,GAAG,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AAChD,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,IAAI,CAAC,WAAW,EAAE;AACnB,EAAE,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC;AACpD,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;AAC1C,EAAE,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1J,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,WAAW;AACnN,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,WAAW,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;AAC7E,CAAC;AACD,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC;AACjD,CAAC,IAAI,aAAa,GAAG,IAAI;AACzB,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE;AACpC,EAAE,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1H,EAAE,MAAM,OAAO,GAAG,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK;AACxD,EAAE,IAAI,OAAO,EAAE,aAAa,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;AAC1E,CAAC;AACD,CAAC,IAAI,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,EAAE;AACrE,EAAE,MAAM,UAAU,GAAG,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM;AAC5C,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AACD,CAAC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC;AACtC,CAAC,IAAI,aAAa,EAAE;AACpB,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC;AAC/H,CAAC;AACD,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,KAAK,6BAA6B,GAAG,YAAY,GAAG,MAAM,CAAC;AACxG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC;AAC1D,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC;AACvD,CAAC,OAAO,QAAQ;AAChB;;;;"}

package/build/server/chunks/{http-CfHMreaI.js → http-B4Us23Mo.js}

@@ -1,4 +1,4 @@
-import { g as getActiveConnection, b as basicAuthHeader } from './endpoints-IFTldlrt.js';
+import { g as getHostOpencodeTarget, b as basicAuthHeader } from './opencode-target-D4BxXYHJ.js';
 
 //#region src/lib/server/opencode/http.ts
 /**
@@ -9,7 +9,7 @@ import { g as getActiveConnection, b as basicAuthHeader } from './endpoints-IFTl
 * so user switches in the UI take effect immediately.
 */
 async function opencodeFetch(path, init) {
-	const endpoint = getActiveConnection();
+	const endpoint = getHostOpencodeTarget();
 	const headers = {
 		"content-type": "application/json",
 		...init?.headers
@@ -25,4 +25,4 @@ async function opencodeFetch(path, init) {
 }
 
 export { opencodeFetch as o };
-//# sourceMappingURL=http-CfHMreaI.js.map
+//# sourceMappingURL=http-B4Us23Mo.js.map

package/build/server/chunks/http-B4Us23Mo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-B4Us23Mo.js","sources":["../../../.svelte-kit/adapter-node/chunks/http.js"],"sourcesContent":["import { i as basicAuthHeader, t as getHostOpencodeTarget } from \"./opencode-target.js\";\n//#region src/lib/server/opencode/http.ts\n/**\n* HTTP transport for talking to the active OpenCode endpoint.\n*\n* Used by sibling modules (`config.ts`, `catalog.ts`) — not part of the\n* public API of `$lib/server/opencode`. Reads the active endpoint per-call\n* so user switches in the UI take effect immediately.\n*/\nasync function opencodeFetch(path, init) {\n\tconst endpoint = getHostOpencodeTarget();\n\tconst headers = {\n\t\t\"content-type\": \"application/json\",\n\t\t...init?.headers\n\t};\n\tif (endpoint.password) headers.authorization = basicAuthHeader(endpoint.username || \"opencode\", endpoint.password);\n\tconst response = await fetch(`${endpoint.url}${path}`, {\n\t\t...init,\n\t\theaders\n\t});\n\tif (!response.ok) throw new Error(`${init?.method ?? \"GET\"} ${path} failed with ${response.status}`);\n\tif (response.status === 204) return;\n\treturn await response.json();\n}\n//#endregion\nexport { opencodeFetch as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE;AACzC,CAAC,MAAM,QAAQ,GAAG,qBAAqB,EAAE;AACzC,CAAC,MAAM,OAAO,GAAG;AACjB,EAAE,cAAc,EAAE,kBAAkB;AACpC,EAAE,GAAG,IAAI,EAAE;AACX,EAAE;AACF,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,GAAG,eAAe,CAAC,QAAQ,CAAC,QAAQ,IAAI,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC;AACnH,CAAC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE;AACxD,EAAE,GAAG,IAAI;AACT,EAAE;AACF,EAAE,CAAC;AACH,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACrG,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE;AAC9B,CAAC,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE;AAC7B;;;;"}

package/build/server/chunks/{internal-BcbUGF7Z.js → internal-CSnzBDeT.js}

@@ -850,7 +850,11 @@ var options = {
 				"http:",
 				"https:"
 			],
-			"connect-src": ["self"],
+			"connect-src": [
+				"self",
+				"http:",
+				"https:"
+			],
 			"font-src": ["self", "https://fonts.gstatic.com"],
 			"img-src": ["self", "data:"],
 			"media-src": ["self", "blob:"],
@@ -887,7 +891,7 @@ var options = {
 		app: ({ head, body, assets, nonce, env }) => "<!doctype html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n    <meta name=\"theme-color\" content=\"#ffffff\" />\n    <meta name=\"color-scheme\" content=\"light\" />\n    <script>\n      (() => {\n        const storageKey = 'openpalm.theme';\n        const darkThemeColor = '#161c22';\n        const lightThemeColor = '#f9fafb';\n\n        try {\n          const stored = window.localStorage.getItem(storageKey);\n          const preference = stored === 'light' || stored === 'dark' || stored === 'system' ? stored : 'system';\n          const resolved = preference === 'system'\n            ? (window.matchMedia?.('(prefers-color-scheme: dark)')?.matches ? 'dark' : 'light')\n            : preference;\n          const root = document.documentElement;\n          root.setAttribute('data-theme', resolved);\n          root.style.colorScheme = resolved;\n\n          const themeColorMeta = document.querySelector('meta[name=\"theme-color\"]');\n          if (themeColorMeta) {\n            themeColorMeta.setAttribute('content', resolved === 'dark' ? darkThemeColor : lightThemeColor);\n          }\n\n          const colorSchemeMeta = document.querySelector('meta[name=\"color-scheme\"]');\n          if (colorSchemeMeta) {\n            colorSchemeMeta.setAttribute('content', resolved);\n          }\n        } catch {\n          // Keep the default light metadata if storage access is unavailable.\n        }\n      })();\n    <\/script>\n    <link rel=\"preconnect\" href=\"https://fonts.googleapis.com\" />\n    <link rel=\"preconnect\" href=\"https://fonts.gstatic.com\" crossorigin />\n    <link\n      href=\"https://fonts.googleapis.com/css2?family=Source+Sans+3:wght@400;500;600;700&family=IBM+Plex+Mono:wght@400;500&display=swap\"\n      rel=\"stylesheet\"\n    />\n    " + head + "\n  </head>\n  <body data-sveltekit-preload-data=\"hover\">\n    <div style=\"display: contents\">" + body + "</div>\n  </body>\n</html>\n",
 		error: ({ status, message }) => "<!doctype html>\n<html lang=\"en\">\n	<head>\n		<meta charset=\"utf-8\" />\n		<title>" + message + "</title>\n\n		<style>\n			body {\n				--bg: white;\n				--fg: #222;\n				--divider: #ccc;\n				background: var(--bg);\n				color: var(--fg);\n				font-family:\n					system-ui,\n					-apple-system,\n					BlinkMacSystemFont,\n					'Segoe UI',\n					Roboto,\n					Oxygen,\n					Ubuntu,\n					Cantarell,\n					'Open Sans',\n					'Helvetica Neue',\n					sans-serif;\n				display: flex;\n				align-items: center;\n				justify-content: center;\n				height: 100vh;\n				margin: 0;\n			}\n\n			.error {\n				display: flex;\n				align-items: center;\n				max-width: 32rem;\n				margin: 0 1rem;\n			}\n\n			.status {\n				font-weight: 200;\n				font-size: 3rem;\n				line-height: 1;\n				position: relative;\n				top: -0.05rem;\n			}\n\n			.message {\n				border-left: 1px solid var(--divider);\n				padding: 0 0 0 1rem;\n				margin: 0 0 0 1rem;\n				min-height: 2.5rem;\n				display: flex;\n				align-items: center;\n			}\n\n			.message h1 {\n				font-weight: 400;\n				font-size: 1em;\n				margin: 0;\n			}\n\n			@media (prefers-color-scheme: dark) {\n				body {\n					--bg: #222;\n					--fg: #ddd;\n					--divider: #666;\n				}\n			}\n		</style>\n	</head>\n	<body>\n		<div class=\"error\">\n			<span class=\"status\">" + status + "</span>\n			<div class=\"message\">\n				<h1>" + message + "</h1>\n			</div>\n		</div>\n	</body>\n</html>\n"
 	},
-	version_hash: "cl7e8w"
+	version_hash: "m0btny"
 };
 async function get_hooks() {
 	let handle;
@@ -895,7 +899,7 @@ async function get_hooks() {
 	let handleError;
 	let handleValidationError;
 	let init;
-	({handle, handleFetch, handleError, handleValidationError, init} = await import('./hooks.server-Bzj8OieV.js'));
+	({handle, handleFetch, handleError, handleValidationError, init} = await import('./hooks.server-Blba-Qw7.js'));
 	let reroute;
 	let transport;
 	return {
@@ -910,4 +914,4 @@ async function get_hooks() {
 }
 
 export { IN_WEBCONTAINER as I, NULL_BODY_STATUS as N, disable_search as a, merge_tracing as b, resolve as c, decode_pathname as d, resolve_route as e, find_route as f, get_hooks as g, make_trackable as m, normalize_path as n, options as o, read_implementation as r, set_read_implementation as s, try_get_request_store as t, with_request_store as w };
-//# sourceMappingURL=internal-BcbUGF7Z.js.map
+//# sourceMappingURL=internal-CSnzBDeT.js.map