@openpalm/ui 0.13.0-beta.6 → 0.13.0-beta.8

package/build/server/chunks/voice-state.svelte-DU9g_xEh.js

@@ -0,0 +1,1610 @@
+//#region src/lib/notifications.svelte.ts
+var DEFAULT_TIMEOUTS = {
+	info: 4e3,
+	success: 5e3,
+	error: 8e3
+};
+var Notifications = class {
+	toasts = [];
+	timers = /* @__PURE__ */ new Map();
+	push(kind, message, opts = {}) {
+		const id = opts.replaceId ?? (typeof crypto !== "undefined" && "randomUUID" in crypto ? crypto.randomUUID() : `t-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+		const ttlMs = opts.sticky ? null : opts.ttlMs ?? DEFAULT_TIMEOUTS[kind];
+		const toast = {
+			id,
+			kind,
+			message,
+			ttlMs
+		};
+		const existingTimer = this.timers.get(id);
+		if (existingTimer) {
+			clearTimeout(existingTimer);
+			this.timers.delete(id);
+		}
+		const existingIdx = this.toasts.findIndex((t) => t.id === id);
+		if (existingIdx >= 0) {
+			const next = [...this.toasts];
+			next[existingIdx] = toast;
+			this.toasts = next;
+		} else this.toasts = [...this.toasts, toast];
+		if (ttlMs !== null) {
+			const timer = setTimeout(() => this.dismiss(id), ttlMs);
+			this.timers.set(id, timer);
+		}
+		return id;
+	}
+	dismiss(id) {
+		const timer = this.timers.get(id);
+		if (timer) {
+			clearTimeout(timer);
+			this.timers.delete(id);
+		}
+		this.toasts = this.toasts.filter((t) => t.id !== id);
+	}
+	clear() {
+		for (const timer of this.timers.values()) clearTimeout(timer);
+		this.timers.clear();
+		this.toasts = [];
+	}
+};
+var notifications = new Notifications();
+//#endregion
+//#region src/lib/theme-state.svelte.ts
+var THEME_STORAGE_KEY = "openpalm.theme";
+var THEME_ATTR = "data-theme";
+var DARK_THEME_COLOR = "#161c22";
+var LIGHT_THEME_COLOR = "#f9fafb";
+function isThemePreference(value) {
+	return value === "light" || value === "dark" || value === "system";
+}
+var ThemeService = class {
+	preference = "system";
+	resolved = "light";
+	initialized = false;
+	#mediaQuery = null;
+	#mediaChangeHandler = () => {
+		if (this.preference !== "system") return;
+		this.resolved = this.#resolvePreference("system");
+		this.#applyResolvedTheme();
+	};
+	init() {
+		if (typeof window === "undefined" || this.initialized) return;
+		this.preference = this.#readStoredPreference();
+		this.resolved = this.#resolvePreference(this.preference);
+		this.#subscribeToSystemTheme();
+		this.#applyResolvedTheme();
+		this.initialized = true;
+	}
+	setPreference(preference) {
+		this.preference = preference;
+		this.resolved = this.#resolvePreference(preference);
+		this.#writeStoredPreference(preference);
+		this.#applyResolvedTheme();
+	}
+	toggle() {
+		const next = this.preference === "system" ? "light" : this.preference === "light" ? "dark" : "system";
+		this.setPreference(next);
+	}
+	dispose() {
+		if (this.#mediaQuery) if (typeof this.#mediaQuery.removeEventListener === "function") this.#mediaQuery.removeEventListener("change", this.#mediaChangeHandler);
+		else this.#mediaQuery.removeListener(this.#mediaChangeHandler);
+		this.#mediaQuery = null;
+		this.initialized = false;
+	}
+	#readStoredPreference() {
+		if (typeof window === "undefined") return "system";
+		try {
+			const stored = window.localStorage.getItem(THEME_STORAGE_KEY);
+			return isThemePreference(stored) ? stored : "system";
+		} catch {
+			return "system";
+		}
+	}
+	#writeStoredPreference(preference) {
+		if (typeof window === "undefined") return;
+		try {
+			window.localStorage.setItem(THEME_STORAGE_KEY, preference);
+		} catch {}
+	}
+	#resolvePreference(preference) {
+		if (preference === "light" || preference === "dark") return preference;
+		if (typeof window === "undefined" || typeof window.matchMedia !== "function") return "light";
+		return window.matchMedia("(prefers-color-scheme: dark)").matches ? "dark" : "light";
+	}
+	#subscribeToSystemTheme() {
+		if (typeof window === "undefined" || typeof window.matchMedia !== "function") return;
+		const nextQuery = window.matchMedia("(prefers-color-scheme: dark)");
+		if (this.#mediaQuery === nextQuery) return;
+		if (this.#mediaQuery) if (typeof this.#mediaQuery.removeEventListener === "function") this.#mediaQuery.removeEventListener("change", this.#mediaChangeHandler);
+		else this.#mediaQuery.removeListener(this.#mediaChangeHandler);
+		this.#mediaQuery = nextQuery;
+		if (typeof nextQuery.addEventListener === "function") nextQuery.addEventListener("change", this.#mediaChangeHandler);
+		else nextQuery.addListener(this.#mediaChangeHandler);
+	}
+	#applyResolvedTheme() {
+		if (typeof document === "undefined") return;
+		const root = document.documentElement;
+		root.setAttribute(THEME_ATTR, this.resolved);
+		root.style.colorScheme = this.resolved;
+		const themeColorMeta = document.querySelector("meta[name=\"theme-color\"]");
+		if (themeColorMeta) themeColorMeta.content = this.resolved === "dark" ? DARK_THEME_COLOR : LIGHT_THEME_COLOR;
+		const colorSchemeMeta = document.querySelector("meta[name=\"color-scheme\"]");
+		if (colorSchemeMeta) colorSchemeMeta.content = this.resolved;
+	}
+};
+var themeService = new ThemeService();
+//#endregion
+//#region src/lib/random-id.ts
+/**
+* Random id generation that works in EVERY browsing context.
+*
+* `crypto.randomUUID()` is secure-context-only: on a plain-http LAN origin
+* (the LAN-served tier) it is undefined and calling it throws. Every
+* browser-side id mint (connection ids, secret refs, request ids, local chat
+* entry ids) must go through this guard instead of bare `crypto.randomUUID()`
+* — the fallback builds a v4 UUID from `crypto.getRandomValues`, which IS
+* available in insecure contexts.
+*
+* Zero-import leaf module so any $lib code can use it without cycles.
+*/
+function randomId() {
+	if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") return crypto.randomUUID();
+	const b = crypto.getRandomValues(new Uint8Array(16));
+	b[6] = b[6] & 15 | 64;
+	b[8] = b[8] & 63 | 128;
+	const h = Array.from(b, (x) => x.toString(16).padStart(2, "0")).join("");
+	return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`;
+}
+//#endregion
+//#region src/lib/connections/url-policy.ts
+/**
+* Browser-owned connection URL policy (Phase 3a — "One UI, delete the split").
+*
+* A leaf module with zero imports so both the direct transport
+* (`probeHealth()` short-circuit) and the connections form can consult it
+* without pulling in the IndexedDB store module. There is no guardian
+* `/oc`-appending helper — Guardian is a transparent OpenCode proxy now, so
+* the user provides the exact baseUrl and no path inference is performed.
+*
+* The ONLY refusal trigger: a plain-http, non-loopback connection URL is
+* refused iff the app itself runs on an https: origin. This is exactly the
+* platform mixed-content rule (an https origin cannot `fetch()` a plain-http
+* cross-origin target — the request would never leave the browser), not a
+* broader "https or non-loopback origin" check. Preserves:
+*   - loopback TARGETS from any origin (mixed-content loopback exemption —
+*     `http://127.0.0.1`/`localhost`/`::1` are "potentially trustworthy"),
+*   - plain-http LAN targets from a loopback-origin client (the zero-TLS
+*     desktop default — a `http://127.0.0.1` origin is a secure context),
+*   - plain-http LAN targets from a non-loopback http ORIGIN (the LAN-served
+*     tier: `rewriteLoopbackUrlForBrowserHost` in `./store.ts`).
+*/
+/** Canonical deep link to the TLS integration guide. Pinned by a test that
+* the path segment names a real file, so a docs rename breaks CI instead of
+* shipping a dead link. */
+var TLS_GUIDE_URL = "https://github.com/itlackey/openpalm/blob/main/docs/remote-access-tls.md";
+function isLoopbackHost(hostname) {
+	return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
+}
+/** Remove legacy URL-embedded credentials before a URL reaches UI or storage. */
+function redactUrlUserinfo(rawUrl) {
+	try {
+		const url = new URL(rawUrl);
+		url.username = "";
+		url.password = "";
+		return url.toString().replace(/\/$/, url.pathname === "/" && !rawUrl.endsWith("/") ? "" : "/");
+	} catch {
+		return rawUrl;
+	}
+}
+/**
+* Refuse a plain-http non-loopback connection URL iff the app's own origin is
+* https: (mixed content — the request could never succeed, so refuse up front
+* with guidance instead of a generic fetch failure).
+*
+* `origin` defaults to `globalThis.location`; a null/undefined origin
+* (non-browser context — tests, SSR) always allows, since there is no browser
+* mixed-content policy to enforce there.
+*/
+function validateConnectionUrl(rawUrl, origin = globalThis.location ?? null) {
+	let url;
+	try {
+		url = new URL(rawUrl);
+	} catch {
+		return {
+			ok: false,
+			reason: "invalid-url",
+			message: "Enter a valid URL."
+		};
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") return {
+		ok: false,
+		reason: "invalid-url",
+		message: "The URL must use http:// or https://."
+	};
+	if (url.username || url.password) return {
+		ok: false,
+		reason: "userinfo-not-allowed",
+		message: "Do not put credentials in the URL. Use the Authentication fields instead."
+	};
+	if (url.protocol === "https:") return { ok: true };
+	if (isLoopbackHost(url.hostname)) return { ok: true };
+	if (origin?.protocol !== "https:") return { ok: true };
+	return {
+		ok: false,
+		reason: "insecure-remote",
+		message: "This app runs on a secure (https) origin, so browsers block plain-HTTP connections to remote servers. Use an https:// URL — see the TLS setup guide.",
+		guideUrl: TLS_GUIDE_URL
+	};
+}
+//#endregion
+//#region src/lib/connections/store.ts
+/**
+* Browser-owned connection store (Phase 3a — "One UI, delete the split").
+*
+* Connection records persist behind a storage abstraction so the same store
+* logic runs over IndexedDB in the browser (offline-readable) and over an
+* in-memory backend in tests. The store API is async throughout (IndexedDB is
+* async) and keeps NO state in store-instance fields — a page reload
+* constructs a new store over the same backend and must see identical state.
+*
+* Locked/default entries are seeded from a runtime-config.json fetched from
+* the app's own origin at boot. Absent file = no default connection.
+*
+* The Connection shape is `{ id, label, baseUrl, auth }` with auth narrowed to
+* none | basic (Guardian is a transparent OpenCode proxy — Basic is the only
+* connection credential model).
+*/
+function rewriteLoopbackUrlForBrowserHost(rawUrl) {
+	const locationLike = globalThis.location;
+	const redactedUrl = redactUrlUserinfo(rawUrl);
+	if (!locationLike || isLoopbackHost(locationLike.hostname)) return redactedUrl;
+	try {
+		const url = new URL(redactedUrl);
+		if (!isLoopbackHost(url.hostname)) return redactedUrl;
+		url.hostname = locationLike.hostname;
+		return url.toString();
+	} catch {
+		return redactedUrl;
+	}
+}
+function redactEntryUrl(entry) {
+	const baseUrl = redactUrlUserinfo(entry.baseUrl);
+	return baseUrl === entry.baseUrl ? entry : {
+		...entry,
+		baseUrl
+	};
+}
+function assertUrlHasNoUserinfo(rawUrl) {
+	let url;
+	try {
+		url = new URL(rawUrl);
+	} catch {
+		return;
+	}
+	if (url.username || url.password) throw new Error("Credentials must use the Authentication fields, not the connection URL.");
+}
+function adaptRuntimeConfigForBrowser(config) {
+	return { connections: config.connections.map((entry) => ({
+		...redactEntryUrl(entry),
+		baseUrl: entry.locked ? rewriteLoopbackUrlForBrowserHost(entry.baseUrl) : redactUrlUserinfo(entry.baseUrl)
+	})) };
+}
+var ACTIVE_ID_KEY = "activeId";
+function clone(value) {
+	return structuredClone(value);
+}
+/** In-memory storage backend — same semantics as the IndexedDB one. */
+function createMemoryStorage() {
+	const entries = /* @__PURE__ */ new Map();
+	const meta = /* @__PURE__ */ new Map();
+	let cryptoKey = null;
+	return {
+		async getAll() {
+			return [...entries.values()].map(clone);
+		},
+		async get(id) {
+			const entry = entries.get(id);
+			return entry ? clone(entry) : null;
+		},
+		async put(entry) {
+			entries.set(entry.id, clone(redactEntryUrl(entry)));
+		},
+		async delete(id) {
+			entries.delete(id);
+		},
+		async getMeta(key) {
+			return meta.get(key) ?? null;
+		},
+		async setMeta(key, value) {
+			if (value === null) meta.delete(key);
+			else meta.set(key, value);
+		},
+		async getCryptoKey() {
+			return cryptoKey;
+		},
+		async setCryptoKey(key) {
+			cryptoKey = key;
+		}
+	};
+}
+var IDB_NAME = "openpalm-ui-connections";
+var IDB_VERSION = 1;
+var STORE_CONNECTIONS = "connections";
+var STORE_META = "meta";
+var STORE_KEYS = "keys";
+var CRYPTO_KEY_ID = "secret-store-aes-gcm-key";
+function idbRequest(request) {
+	return new Promise((resolve, reject) => {
+		request.onsuccess = () => resolve(request.result);
+		request.onerror = () => reject(request.error ?? /* @__PURE__ */ new Error("IndexedDB request failed"));
+	});
+}
+/**
+* F11 hardening: an IDB version bump with no `onblocked` handler and no
+* `versionchange` listener can leave a boot hung forever with no error
+* surfaced anywhere. `onblocked` rejects the open promise; `onVersionChange`
+* is invoked once a successfully-opened connection later receives its OWN
+* `versionchange` event (some other tab needs an upgrade): the connection
+* closes itself immediately so it can't go on to block that upgrade in turn,
+* and the caller uses the callback to drop its cached db promise so the NEXT
+* storage operation reopens fresh.
+*/
+function openDatabase(onVersionChange) {
+	return new Promise((resolve, reject) => {
+		const request = indexedDB.open(IDB_NAME, IDB_VERSION);
+		request.onupgradeneeded = () => {
+			const db = request.result;
+			if (!db.objectStoreNames.contains(STORE_CONNECTIONS)) db.createObjectStore(STORE_CONNECTIONS, { keyPath: "id" });
+			if (!db.objectStoreNames.contains(STORE_META)) db.createObjectStore(STORE_META);
+			if (!db.objectStoreNames.contains(STORE_KEYS)) db.createObjectStore(STORE_KEYS);
+		};
+		request.onsuccess = () => {
+			const db = request.result;
+			db.onversionchange = () => {
+				db.close();
+				onVersionChange();
+			};
+			resolve(db);
+		};
+		request.onerror = () => reject(request.error ?? /* @__PURE__ */ new Error("IndexedDB open failed"));
+		request.onblocked = () => reject(/* @__PURE__ */ new Error("IndexedDB upgrade blocked by another open connection (close other tabs of this app and retry)"));
+	});
+}
+/**
+* IndexedDB storage backend (raw IDB API, no deps). Lazily opens the database
+* on first use; each operation runs in its own short transaction.
+*/
+function createIndexedDbStorage() {
+	let db = null;
+	const invalidate = () => {
+		db = null;
+	};
+	const database = () => {
+		db ??= openDatabase(invalidate);
+		return db;
+	};
+	const store = async (name, mode) => (await database()).transaction(name, mode).objectStore(name);
+	return {
+		async getAll() {
+			return idbRequest((await store(STORE_CONNECTIONS, "readonly")).getAll());
+		},
+		async get(id) {
+			return await idbRequest((await store(STORE_CONNECTIONS, "readonly")).get(id)) ?? null;
+		},
+		async put(entry) {
+			await idbRequest((await store(STORE_CONNECTIONS, "readwrite")).put(redactEntryUrl(entry)));
+		},
+		async delete(id) {
+			await idbRequest((await store(STORE_CONNECTIONS, "readwrite")).delete(id));
+		},
+		async getMeta(key) {
+			return await idbRequest((await store(STORE_META, "readonly")).get(key)) ?? null;
+		},
+		async setMeta(key, value) {
+			const metaStore = await store(STORE_META, "readwrite");
+			if (value === null) await idbRequest(metaStore.delete(key));
+			else await idbRequest(metaStore.put(value, key));
+		},
+		async getCryptoKey() {
+			return await idbRequest((await store(STORE_KEYS, "readonly")).get(CRYPTO_KEY_ID)) ?? null;
+		},
+		async setCryptoKey(key) {
+			await idbRequest((await store(STORE_KEYS, "readwrite")).put(key, CRYPTO_KEY_ID));
+		}
+	};
+}
+function createConnectionStore(options) {
+	const { storage } = options;
+	async function readEntry(id) {
+		const stored = await storage.get(id);
+		if (!stored) return null;
+		const entry = redactEntryUrl(stored);
+		if (entry.baseUrl !== stored.baseUrl) await storage.put(entry);
+		return entry;
+	}
+	async function requireEntry(id) {
+		const entry = await readEntry(id);
+		if (!entry) throw new Error(`Unknown connection: ${id}`);
+		return entry;
+	}
+	return {
+		async list() {
+			const stored = await storage.getAll();
+			const entries = stored.map(redactEntryUrl);
+			await Promise.all(entries.map((entry, index) => entry.baseUrl === stored[index]?.baseUrl ? Promise.resolve() : storage.put(entry)));
+			return entries;
+		},
+		get(id) {
+			return readEntry(id);
+		},
+		async add(input) {
+			assertUrlHasNoUserinfo(input.baseUrl);
+			const id = input.id ?? randomId();
+			if (await readEntry(id)) throw new Error(`Connection already exists: ${id}`);
+			const entry = {
+				...input,
+				id
+			};
+			await storage.put(entry);
+			return clone(entry);
+		},
+		async update(id, patch) {
+			if (patch.baseUrl !== void 0) assertUrlHasNoUserinfo(patch.baseUrl);
+			const entry = await requireEntry(id);
+			if (entry.locked) throw new Error(`Connection is locked (config-owned): ${id}`);
+			const updated = {
+				...entry,
+				...patch,
+				id
+			};
+			await storage.put(updated);
+			return clone(updated);
+		},
+		async remove(id) {
+			if ((await requireEntry(id)).locked) throw new Error(`Connection is locked (config-owned): ${id}`);
+			await storage.delete(id);
+			if (await storage.getMeta(ACTIVE_ID_KEY) === id) await storage.setMeta(ACTIVE_ID_KEY, null);
+		},
+		async setSecretRef(id, auth) {
+			const updated = {
+				...await requireEntry(id),
+				auth,
+				id
+			};
+			await storage.put(updated);
+			return clone(updated);
+		},
+		getActiveId() {
+			return storage.getMeta(ACTIVE_ID_KEY);
+		},
+		async getActive() {
+			const id = await storage.getMeta(ACTIVE_ID_KEY);
+			return id === null ? null : readEntry(id);
+		},
+		async setActive(id) {
+			await requireEntry(id);
+			await storage.setMeta(ACTIVE_ID_KEY, id);
+		},
+		async clearActive() {
+			await storage.setMeta(ACTIVE_ID_KEY, null);
+		},
+		async seedFromRuntimeConfig(config) {
+			if (!config) return;
+			const activeId = await storage.getMeta(ACTIVE_ID_KEY);
+			const configIds = new Set(config.connections.map((entry) => entry.id));
+			for (const existing of await storage.getAll()) {
+				if (!existing.locked || configIds.has(existing.id)) continue;
+				await storage.delete(existing.id);
+				if (activeId === existing.id) await storage.setMeta(ACTIVE_ID_KEY, null);
+			}
+			for (const entry of config.connections) {
+				const seededEntry = redactEntryUrl(entry);
+				const existing = await readEntry(entry.id);
+				if (!existing) await storage.put(clone(seededEntry));
+				else if (existing.locked) {
+					const seeded = clone(seededEntry);
+					const preserveAuth = existing.auth && existing.auth.mode !== "none";
+					await storage.put(preserveAuth ? {
+						...seeded,
+						auth: existing.auth
+					} : seeded);
+				}
+			}
+			if (await storage.getMeta(ACTIVE_ID_KEY) !== null) return;
+			const fallback = config.connections.find((entry) => entry.isDefault);
+			if (fallback && await storage.get(fallback.id)) await storage.setMeta(ACTIVE_ID_KEY, fallback.id);
+		}
+	};
+}
+/**
+* Fetch '/runtime-config.json' from the app's OWN origin (relative URL — the
+* static server ships the file beside the build; the app holds no other
+* trusted origin at boot). Absent (404), unreachable (offline), or malformed
+* -> null; never throws, so an offline PWA boot still reaches the stored
+* connection list.
+*/
+async function loadRuntimeConfig(fetchImpl = globalThis.fetch) {
+	try {
+		const response = await fetchImpl("/runtime-config.json", {
+			method: "GET",
+			headers: { accept: "application/json" },
+			credentials: "omit"
+		});
+		if (!response.ok) return null;
+		const parsed = await response.json();
+		if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.connections)) return null;
+		return adaptRuntimeConfigForBrowser(parsed);
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/lib/connections/secrets.ts
+var META_PREFIX = "secret:";
+var ENCRYPTED_MARKER = 2;
+var AES_GCM_LENGTH = 256;
+var IV_BYTES = 12;
+/**
+* WebCrypto's `SubtleCrypto` is secure-context-only: on a plain-http LAN origin
+* (the LAN-served tier) `crypto.subtle` is undefined, so encryption is simply
+* not available there. Callers degrade to the legacy plaintext record shape —
+* which `readMaterial` already reads — rather than throwing and blocking the
+* user from saving a credential at all.
+*/
+function subtleAvailable() {
+	return typeof crypto !== "undefined" && !!crypto.subtle;
+}
+function isEncryptedRecord(value) {
+	return !!value && typeof value === "object" && value.v === ENCRYPTED_MARKER && typeof value.iv === "string" && typeof value.ciphertext === "string";
+}
+function bytesToBase64(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary);
+}
+function base64ToBytes(b64) {
+	const binary = atob(b64);
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return bytes;
+}
+var pendingKeys = /* @__PURE__ */ new WeakMap();
+/** Generate-once, reuse-forever non-extractable AES-GCM key for this storage backend. */
+async function getOrCreateKey(storage) {
+	const existing = await storage.getCryptoKey();
+	if (existing) return existing;
+	let pending = pendingKeys.get(storage);
+	if (!pending) {
+		pending = (async () => {
+			const key = await crypto.subtle.generateKey({
+				name: "AES-GCM",
+				length: AES_GCM_LENGTH
+			}, false, ["encrypt", "decrypt"]);
+			await storage.setCryptoKey(key);
+			return key;
+		})();
+		pendingKeys.set(storage, pending);
+		pending.catch(() => {
+			pendingKeys.delete(storage);
+		});
+	}
+	return pending;
+}
+async function encryptMaterial(key, material) {
+	const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
+	const plaintext = new TextEncoder().encode(JSON.stringify(material));
+	const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv
+	}, key, plaintext));
+	return {
+		v: ENCRYPTED_MARKER,
+		iv: bytesToBase64(iv),
+		ciphertext: bytesToBase64(ciphertext)
+	};
+}
+async function decryptRecord(key, record) {
+	const iv = base64ToBytes(record.iv);
+	const ciphertext = base64ToBytes(record.ciphertext);
+	const plaintext = await crypto.subtle.decrypt({
+		name: "AES-GCM",
+		iv
+	}, key, ciphertext);
+	return JSON.parse(new TextDecoder().decode(plaintext));
+}
+async function writeMaterial(storage, ref, material) {
+	if (!subtleAvailable()) {
+		await storage.setMeta(META_PREFIX + ref, JSON.stringify(material));
+		return;
+	}
+	const record = await encryptMaterial(await getOrCreateKey(storage), material);
+	await storage.setMeta(META_PREFIX + ref, JSON.stringify(record));
+}
+/**
+* Read+decrypt a stored secret. Transparently migrates a legacy plaintext
+* record by re-encrypting it in place before returning. Returns null for a
+* missing ref or anything that can't be parsed/decrypted — the caller degrades
+* gracefully rather than throwing.
+*/
+async function readMaterial(storage, ref) {
+	const raw = await storage.getMeta(META_PREFIX + ref);
+	if (raw === null) return null;
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return null;
+	}
+	if (isEncryptedRecord(parsed)) try {
+		return await decryptRecord(await getOrCreateKey(storage), parsed);
+	} catch {
+		return null;
+	}
+	const material = parsed;
+	if (subtleAvailable()) try {
+		await writeMaterial(storage, ref, material);
+	} catch {}
+	return material;
+}
+function createSecretStore(storage) {
+	return {
+		async set(ref, material) {
+			await writeMaterial(storage, ref, material);
+		},
+		async delete(ref) {
+			await storage.setMeta(META_PREFIX + ref, null);
+		},
+		get(ref) {
+			return readMaterial(storage, ref);
+		},
+		async resolveAuth(entry) {
+			if (entry.auth.mode !== "basic" || !entry.auth.secretRef) return { mode: "none" };
+			const material = await readMaterial(storage, entry.auth.secretRef);
+			if (!material || typeof material.password !== "string") return { mode: "none" };
+			const username = entry.auth.username || material.username;
+			return username ? {
+				mode: "basic",
+				username,
+				password: material.password
+			} : {
+				mode: "basic",
+				password: material.password
+			};
+		},
+		async updateUsername(ref, username) {
+			const material = await readMaterial(storage, ref);
+			if (!material) return;
+			const updated = { ...material };
+			if (username === void 0) delete updated.username;
+			else updated.username = username;
+			await writeMaterial(storage, ref, updated);
+		}
+	};
+}
+//#endregion
+//#region src/lib/chat/session-events.ts
+/**
+* SSE consumer for OpenCode's `/event` stream.
+*
+* Phase 3b ("One UI, delete the split"): the underlying stream is now opened by
+* the browser-owned direct transport (`$lib/connections/boot.getTransport()`
+* → `subscribeEvents(onFrame, signal)`), which talks to the active connection's
+* OpenCode/Guardian base URL directly (no host proxy, no admin cookie) and
+* REUSES this module's `parseFrame`. Reconnect/backoff, session-scoped dispatch,
+* and abort semantics stay here — the chat layer's concern, not the transport's.
+*
+* Phase D of docs/technical/multi-endpoint-session-ux.md.
+*/
+var INITIAL_BACKOFF_MS = 1e3;
+var MAX_BACKOFF_MS = 3e4;
+/**
+* Parse one `\n\n`-delimited SSE frame. Multi-line `data:` fields are
+* concatenated with `\n` per the SSE spec. Reused by the direct transport.
+*/
+function parseFrame(chunk) {
+	const frame = {};
+	const dataLines = [];
+	for (const rawLine of chunk.split("\n")) {
+		if (!rawLine || rawLine.startsWith(":")) continue;
+		if (rawLine.startsWith("data:")) dataLines.push(rawLine.replace(/^data:\s?/, ""));
+		else if (rawLine.startsWith("event:")) frame.event = rawLine.replace(/^event:\s?/, "");
+		else if (rawLine.startsWith("id:")) frame.id = rawLine.replace(/^id:\s?/, "");
+	}
+	if (dataLines.length > 0) frame.data = dataLines.join("\n");
+	return frame;
+}
+function dispatch(handlers, payload) {
+	const info = payload.properties?.info;
+	const id = info?.id ?? payload.sessionID;
+	if (!id) return;
+	switch (payload.type) {
+		case "session.created":
+			handlers.onCreated(id);
+			return;
+		case "session.updated":
+			handlers.onUpdated(id, {
+				title: info?.title,
+				updatedAt: info?.time?.updated
+			});
+			return;
+		case "session.deleted":
+			handlers.onDeleted(id);
+			return;
+		default: return;
+	}
+}
+/**
+* Open the active connection's `/event` SSE stream (via the direct transport)
+* and dispatch session-scoped events. Returns an unsubscribe function that
+* aborts the stream and prevents reconnection.
+*
+* `onConnect` fires on the first frame of each (re)connected stream — the point
+* at which live updates are demonstrably flowing. The transport owns the fetch;
+* this loop owns exponential-backoff reconnect and abort.
+*/
+function subscribeSessionEvents(handlers) {
+	let stopped = false;
+	let controller = new AbortController();
+	const sleep = (ms) => new Promise((resolve) => {
+		const timer = setTimeout(resolve, ms);
+		controller.signal.addEventListener("abort", () => {
+			clearTimeout(timer);
+			resolve();
+		}, { once: true });
+	});
+	async function readStream() {
+		let connected = false;
+		await getTransport().subscribeEvents((event) => {
+			if (!connected) {
+				connected = true;
+				handlers.onConnect?.();
+			}
+			const payload = event;
+			handlers.onEvent?.(payload);
+			dispatch(handlers, payload);
+		}, controller.signal);
+	}
+	(async () => {
+		let attempt = 0;
+		while (!stopped) try {
+			attempt++;
+			await readStream();
+			attempt = 0;
+			if (!stopped) await sleep(500);
+		} catch (err) {
+			if (stopped) return;
+			const error = err instanceof Error ? err : new Error(String(err));
+			if (error.name !== "AbortError") {
+				console.warn("[session-events] SSE error, reconnecting", error);
+				handlers.onDisconnect?.(error);
+			}
+			await sleep(Math.min(INITIAL_BACKOFF_MS * 2 ** Math.max(0, attempt - 1), MAX_BACKOFF_MS));
+			if (controller.signal.aborted && !stopped) controller = new AbortController();
+		}
+	})();
+	return () => {
+		stopped = true;
+		try {
+			controller.abort();
+		} catch {}
+	};
+}
+//#endregion
+//#region src/lib/transport/direct.ts
+/**
+* Minimal browser-owned direct transport (Phase 3a — "One UI, delete the
+* split").
+*
+* Talks to a connection's OpenCode/Guardian base URL directly from the
+* browser — no proxy, NO COOKIES (`credentials: 'omit'`). This is deliberately
+* small: it exposes only the calls the ui chat layer needs and REUSES ui's
+* existing SSE frame parser (`$lib/chat/session-events.ts` `parseFrame`) and
+* event envelope type (`$lib/chat/oc-events.ts` `RawEvent`) rather than
+* re-implementing them. Reconnect/backoff and session-scoped filtering are the
+* chat layer's concern, not this transport's.
+*/
+var PROBE_TIMEOUT_MS = 5e3;
+/**
+* UTF-8-encode before base64ing: `btoa()` alone only accepts Latin-1 code
+* points and throws a synchronous `InvalidCharacterError` for any password
+* containing e.g. Cyrillic/CJK/emoji characters, before any network I/O.
+*/
+function base64Utf8(value) {
+	const bytes = new TextEncoder().encode(value);
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary);
+}
+/**
+* Build the `Authorization` header value for a resolved auth, or null for
+* `{ mode: 'none' }`. Basic username defaults to `'opencode'` (OpenCode's own
+* server default and what the host app sends).
+*/
+function authorizationHeader(auth) {
+	if (auth.mode === "basic") return `Basic ${base64Utf8(`${auth.username ?? "opencode"}:${auth.password}`)}`;
+	return null;
+}
+function createDirectTransport(getConnection, resolveAuth, fetchImpl = globalThis.fetch) {
+	function requireConnection() {
+		const connection = getConnection();
+		if (!connection) throw new Error("No active connection");
+		return connection;
+	}
+	/** Trailing-slash and path-prefix safe: reverse-proxied instances keep their prefix. */
+	function baseFor(connection) {
+		return connection.baseUrl.replace(/\/+$/, "");
+	}
+	async function authHeaders(connection) {
+		const { authorization } = await resolveAuth(connection);
+		return authorization ? { authorization } : {};
+	}
+	return {
+		async request(method, path, body) {
+			const connection = requireConnection();
+			const init = {
+				method,
+				headers: {
+					...body === void 0 ? {} : { "content-type": "application/json" },
+					...await authHeaders(connection)
+				},
+				credentials: "omit"
+			};
+			if (body !== void 0) init.body = JSON.stringify(body);
+			const response = await fetchImpl(`${baseFor(connection)}${path}`, init);
+			if (!response.ok) throw Object.assign(/* @__PURE__ */ new Error(`HTTP ${response.status}`), { status: response.status });
+			return response;
+		},
+		async subscribeEvents(onFrame, signal) {
+			const connection = requireConnection();
+			const response = await fetchImpl(`${baseFor(connection)}/event`, {
+				method: "GET",
+				headers: {
+					accept: "text/event-stream",
+					...await authHeaders(connection)
+				},
+				credentials: "omit",
+				signal
+			});
+			if (!response.ok || !response.body) throw Object.assign(/* @__PURE__ */ new Error(`SSE stream failed: HTTP ${response.status}`), { status: response.status });
+			const reader = response.body.getReader();
+			const decoder = new TextDecoder();
+			let buffer = "";
+			try {
+				while (true) {
+					const { done, value } = await reader.read();
+					if (done) break;
+					buffer += decoder.decode(value, { stream: true });
+					const chunks = buffer.split("\n\n");
+					buffer = chunks.pop() ?? "";
+					for (const chunk of chunks) {
+						if (!chunk) continue;
+						const frame = parseFrame(chunk);
+						if (!frame.data) continue;
+						let event;
+						try {
+							event = JSON.parse(frame.data);
+						} catch {
+							continue;
+						}
+						onFrame(event);
+					}
+				}
+			} finally {
+				try {
+					reader.releaseLock();
+				} catch {}
+			}
+		},
+		async probeHealth() {
+			const connection = getConnection();
+			if (!connection) return { status: "unreachable" };
+			const base = baseFor(connection);
+			const verdict = validateConnectionUrl(base);
+			if (!verdict.ok && verdict.reason === "insecure-remote") return { status: "insecure" };
+			try {
+				const response = await fetchImpl(`${base}/`, {
+					method: "GET",
+					headers: await authHeaders(connection),
+					credentials: "omit",
+					cache: "no-store",
+					signal: AbortSignal.timeout(PROBE_TIMEOUT_MS)
+				});
+				if (response.status === 401 || response.status === 403) return { status: "unauthorized" };
+				if (response.ok || response.status >= 300 && response.status < 400) return { status: "accessible" };
+				return { status: "unreachable" };
+			} catch {
+				return { status: "unreachable" };
+			}
+		}
+	};
+}
+//#endregion
+//#region src/lib/connections/boot.ts
+/**
+* Browser connection boot (Phase 3b — "One UI, delete the split").
+*
+* One storage backend + one ConnectionStore + one SecretStore + one direct
+* transport per browsing session, created lazily on first access. The chat
+* layer (`$lib/api/chat.ts`, `$lib/chat/session-events.ts`) and the connection
+* switcher (`$lib/endpoints-state.svelte.ts`) all share these singletons so the
+* browser owns connections and talks to OpenCode/Guardian DIRECTLY — no host
+* proxy, no admin cookie.
+*
+* The transport reads the active connection SYNCHRONOUSLY from a snapshot the
+* connection store owner (`endpoints-state`) keeps in sync via
+* `setActiveConnection()`. The store's own `getActive()` is async (IndexedDB),
+* so it can't back the transport's synchronous `getConnection` directly.
+*
+* IndexedDB is the persistent backend; private-browsing modes that refuse it
+* degrade to an in-memory backend (session-only) rather than a blank page —
+* mirroring the client's `pickStorage`.
+*/
+var store = null;
+var secrets = null;
+var transport = null;
+/** Synchronous snapshot of the active connection for the transport. */
+var activeConnection = null;
+/**
+* Some private-browsing modes refuse IndexedDB entirely; degrade to a
+* session-only in-memory backend rather than a blank page (mirrors the
+* client's pickStorage).
+*/
+function pickStorage() {
+	try {
+		if (typeof indexedDB !== "undefined") return createIndexedDbStorage();
+	} catch {}
+	return createMemoryStorage();
+}
+function ensure() {
+	if (store && secrets && transport) return;
+	const storage = pickStorage();
+	const connectionStore = createConnectionStore({ storage });
+	const secretStore = createSecretStore(storage);
+	const directTransport = createDirectTransport(() => activeConnection, async (connection) => {
+		return { authorization: authorizationHeader(await secretStore.resolveAuth(connection)) ?? void 0 };
+	});
+	store = connectionStore;
+	secrets = secretStore;
+	transport = directTransport;
+}
+function getConnectionStore() {
+	ensure();
+	return store;
+}
+function getSecretStore() {
+	ensure();
+	return secrets;
+}
+function getTransport() {
+	ensure();
+	return transport;
+}
+/**
+* Point the direct transport at `connection` (or clear it). Called by the
+* connection-store owner (`endpoints-state`) on load/activate — a plain
+* function, no `$effect`, so the transport's synchronous `getConnection`
+* always sees the current active connection.
+*/
+function setActiveConnection(connection) {
+	activeConnection = connection;
+}
+//#endregion
+//#region src/lib/voice/settings-store.ts
+var STORAGE_KEY = "openpalm.voice.settings";
+var PROVIDER_IDS = [
+	"disabled",
+	"browser",
+	"openpalm-voice",
+	"openai-compatible"
+];
+function safeLocalStorage() {
+	try {
+		return globalThis.localStorage ?? null;
+	} catch {
+		return null;
+	}
+}
+function readSection(raw) {
+	if (!raw || typeof raw !== "object") return null;
+	const r = raw;
+	if (!PROVIDER_IDS.includes(r.provider)) return null;
+	const section = { provider: r.provider };
+	for (const key of [
+		"baseURL",
+		"model",
+		"language",
+		"voice",
+		"secretRef"
+	]) if (typeof r[key] === "string" && r[key]) section[key] = r[key];
+	return section;
+}
+/** Read + validate the persisted settings. Null = never saved / unreadable
+* (callers fall back to capability-based defaults). */
+function loadVoiceSettings() {
+	const raw = safeLocalStorage()?.getItem(STORAGE_KEY);
+	if (!raw) return null;
+	try {
+		const parsed = JSON.parse(raw);
+		const stt = readSection(parsed.stt);
+		const tts = readSection(parsed.tts);
+		if (!stt || !tts) return null;
+		return {
+			version: 1,
+			stt,
+			tts
+		};
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/lib/voice/providers.ts
+/**
+* Browser-side speech-provider transport.
+*
+* The chat client owns its TTS/STT provider choice and calls the provider's
+* OpenAI-shaped /v1/audio endpoints from the browser — there is no
+* config-holding relay anymore (the old /api/speak and /api/transcribe
+* proxies read host-global stack.env config, which conflated per-device
+* preference with host state). Two transports:
+*
+*   - 'openpalm-voice'    → the SAME-ORIGIN `/voice` pass-through the host
+*                           advertises in the runtime handshake. Same-origin
+*                           means no CORS and no exposed container port; the
+*                           session cookie rides along automatically
+*                           (fetch's default same-origin credentials mode).
+*   - 'openai-compatible' → the user's configured endpoint, called directly
+*                           with the API key held in the browser's encrypted
+*                           secret store — the same trust model as
+*                           connection passwords.
+*
+* "OpenPalm Voice" resolution: the handshake's `voice.url` (present when the
+* host process can serve the pass-through and the addon is enabled). We
+* fetch the handshake lazily (once per page load; `refreshAdvertisedVoiceUrl`
+* re-probes) instead of reading the reactive runtime-context store, so
+* resolution works regardless of layout-mount ordering and in non-component
+* callers.
+*/
+var OPENPALM_VOICE_TTS_MODEL = "kokoro";
+var OPENPALM_VOICE_STT_MODEL = "whisper-1";
+var UPSTREAM_TIMEOUT_MS = 6e4;
+var HANDSHAKE_TIMEOUT_MS = 5e3;
+var advertisedUrl;
+var advertisedFetch = null;
+async function fetchAdvertisedUrl() {
+	try {
+		const res = await fetch("/api/runtime", {
+			headers: { accept: "application/json" },
+			credentials: "omit",
+			cache: "no-store",
+			signal: AbortSignal.timeout(HANDSHAKE_TIMEOUT_MS)
+		});
+		if (!res.ok) return null;
+		const data = await res.json();
+		return typeof data.voice?.url === "string" && data.voice.url ? data.voice.url : null;
+	} catch {
+		return null;
+	}
+}
+function startAdvertisedFetch() {
+	const inFlight = fetchAdvertisedUrl().then((url) => {
+		{
+			advertisedUrl = url;
+			advertisedFetch = null;
+		}
+		return url;
+	});
+	advertisedFetch = inFlight;
+	return inFlight;
+}
+/**
+* The host's advertised voice pass-through URL, or null when the voice addon
+* is disabled / the handshake is unreachable. Cached between refreshes;
+* concurrent callers share one fetch. `initVoice` refreshes on every run (a
+* cheap same-origin GET), so an addon toggle is picked up on the next chat
+* mount without a hard reload.
+*/
+function advertisedVoiceUrl() {
+	if (advertisedUrl !== void 0) return Promise.resolve(advertisedUrl);
+	return advertisedFetch ?? startAdvertisedFetch();
+}
+async function apiKeyFor(secretRef) {
+	if (!secretRef) return void 0;
+	try {
+		return (await getSecretStore().get(secretRef))?.password || void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* The advertised OpenPalm Voice pass-through target, or null when the host
+* offers none. Model is fixed by the container; `voice` is deliberately
+* omitted so the host's configured default (OP_VOICE_KOKORO_VOICE) applies.
+*/
+async function openpalmVoiceTarget(section, kind) {
+	const url = await advertisedVoiceUrl();
+	if (!url) return null;
+	return {
+		baseURL: url,
+		model: kind === "tts" ? OPENPALM_VOICE_TTS_MODEL : OPENPALM_VOICE_STT_MODEL,
+		language: kind === "stt" ? section?.language : void 0
+	};
+}
+async function resolveTarget(section, kind) {
+	const provider = section?.provider;
+	if (!provider) return openpalmVoiceTarget(section, kind);
+	if (provider === "openpalm-voice") return openpalmVoiceTarget(section, kind);
+	if (provider === "openai-compatible") {
+		const baseURL = section?.baseURL?.trim();
+		if (!baseURL) return null;
+		return {
+			baseURL,
+			model: section?.model?.trim() || (kind === "tts" ? "tts-1" : "whisper-1"),
+			voice: kind === "tts" ? section?.voice?.trim() : void 0,
+			language: kind === "stt" ? section?.language : void 0,
+			apiKey: await apiKeyFor(section?.secretRef)
+		};
+	}
+	return null;
+}
+function resolveTtsTarget() {
+	return resolveTarget(loadVoiceSettings()?.tts, "tts");
+}
+/**
+* Resolve the OpenAI-shaped API base from the user's configured endpoint.
+*
+* OpenAI and every compatible service (OpenRouter, Groq, LM Studio, vLLM,
+* Ollama, …) document a `base_url` that already ends in a version segment —
+* almost always `/v1`. We respect a version the user supplied and add `/v1`
+* only when absent, so pasting the provider's documented base URL Just
+* Works whether or not it includes `/v1` (no double `/v1/v1`, no hint to
+* remember). The openpalm-voice pass-through base (`/voice`) has no version,
+* so it also gets `/v1`, matching the container's `/v1/audio/*` surface.
+*
+* Sub-paths are then appended WITHOUT a leading `/v1` (e.g. `/audio/speech`).
+*/
+function openaiApiBase(baseURL) {
+	const trimmed = baseURL.replace(/\/+$/, "");
+	return /\/v\d+$/.test(trimmed) ? trimmed : `${trimmed}/v1`;
+}
+/**
+* Synthesize speech for `text` against the configured TTS provider
+* (OpenAI-shape POST /v1/audio/speech). Returns the raw Response (audio
+* bytes on 200) or null when no server-side TTS provider is configured;
+* network failures reject.
+*/
+async function synthesize(text, opts) {
+	const target = await resolveTtsTarget();
+	if (!target) return null;
+	const headers = { "content-type": "application/json" };
+	if (target.apiKey) headers.authorization = `Bearer ${target.apiKey}`;
+	return fetch(`${openaiApiBase(target.baseURL)}/audio/speech`, {
+		method: "POST",
+		headers,
+		body: JSON.stringify({
+			model: target.model,
+			input: text,
+			...target.voice ? { voice: target.voice } : {},
+			response_format: "wav"
+		}),
+		signal: AbortSignal.timeout(UPSTREAM_TIMEOUT_MS)
+	});
+}
+//#endregion
+//#region src/lib/voice/speakable-text.ts
+/**
+* Deterministic markdown-to-speech text stripping. Pure and dependency-free
+* so both the browser TTS fallback (audio-playback.ts) and the server TTS
+* provider transport (voice/providers.ts) can run the exact same rules without
+* ever handing raw markdown syntax to a speech engine.
+*
+* Order matters: fenced code blocks and inline code are handled before any
+* other markdown stripping so their contents are never mistaken for
+* headings/emphasis/list markers. Whitespace collapsing runs last.
+*/
+var HTML_ENTITIES = {
+	"&amp;": "&",
+	"&lt;": "<",
+	"&gt;": ">",
+	"&quot;": "\"",
+	"&#39;": "'"
+};
+function decodeEntities(text) {
+	return text.replace(/&amp;|&lt;|&gt;|&quot;|&#39;/g, (match) => HTML_ENTITIES[match] ?? match);
+}
+function urlToHostname(url) {
+	try {
+		return new URL(url).hostname;
+	} catch {
+		return url;
+	}
+}
+function toSpeakableText(text) {
+	let out = text;
+	out = out.replace(/```[\s\S]*?```/g, " Code omitted. ");
+	out = out.replace(/`([^`]+)`/g, "$1");
+	out = out.replace(/!\[([^\]]*)\]\([^)]*\)/g, "$1");
+	out = out.replace(/\[([^\]]*)\]\([^)]*\)/g, "$1");
+	out = out.replace(/https?:\/\/[^\s)<>"']+/g, (match) => urlToHostname(match));
+	out = out.replace(/<[^>]+>/g, "");
+	out = out.replace(/^\s*(?:-{3,}|\*{3,}|_{3,})\s*$/gm, "");
+	const keptLines = [];
+	for (const line of out.split("\n")) {
+		let l = line;
+		if (/^\s*\|?[\s:|-]+\|?\s*$/.test(l) && l.includes("-") && l.includes("|")) continue;
+		l = l.replace(/^\s*>\s?/, "");
+		l = l.replace(/^\s*#{1,6}\s+/, "");
+		const wasListItem = /^\s*(?:[-*+]|\d+\.)\s+/.test(l);
+		l = l.replace(/^\s*(?:[-*+]|\d+\.)\s+/, "");
+		if (l.includes("|")) l = l.replace(/^\s*\|/, "").replace(/\|\s*$/, "").split("|").map((cell) => cell.trim()).join(", ");
+		l = l.trim();
+		if (wasListItem && l && !/[.!?:]$/.test(l)) l += ".";
+		keptLines.push(l);
+	}
+	out = keptLines.join("\n");
+	out = out.replace(/~~(.+?)~~/g, "$1");
+	out = out.replace(/\*\*(.+?)\*\*/g, "$1");
+	out = out.replace(/__(.+?)__/g, "$1");
+	out = out.replace(/\*(.+?)\*/g, "$1");
+	out = out.replace(/(?<![A-Za-z0-9_])_(.+?)_(?![A-Za-z0-9_])/g, "$1");
+	out = decodeEntities(out);
+	out = out.replace(/<\/?[A-Za-z][A-Za-z0-9-]*(?:\s[^<>]*)?\/?>/g, "");
+	out = out.replace(/\n{3,}/g, "\n\n");
+	out = out.replace(/[^\S\n]{2,}/g, " ");
+	return out.trim();
+}
+//#endregion
+//#region src/lib/voice/audio-playback.ts
+/**
+* AudioPlaybackController — the imperative TTS audio engine extracted from
+* voice-state.svelte.ts. Owns the speak queue, the HTMLAudioElement +
+* blob-URL lifecycle, the browser autoplay-policy fallback, and the
+* per-utterance playback (playOne). The reactive `voiceState` store
+* composes an instance of this and delegates speak/resume/stop to it.
+*
+* The controller never holds reactive `$state` itself — it mutates the
+* host store's reactive fields (status / errorMessage / autoplayBlocked)
+* through the `AudioPlaybackHost` it is constructed with, exactly as the
+* old module-global engine mutated `voiceState` directly.
+*
+* Only touch browser APIs (window, Audio, AudioContext, speechSynthesis)
+* from methods — never at construction — for SSR safety.
+*/
+var SPEAK_QUEUE_MAX = 20;
+var AudioPlaybackController = class {
+	host;
+	/**
+	* Optional hook fired when the speak queue fully drains (the last
+	* utterance reached a terminal state with nothing queued behind it).
+	* Conversation mode uses this to re-arm listening — an explicit
+	* callback instead of polling reactive status. Deliberately NOT fired
+	* from stop(): an explicit stop (barge-in, toggle off) must not re-arm
+	* anything by itself.
+	*/
+	onQueueDrained = null;
+	activeAudio = null;
+	activeAudioUrl = null;
+	speakQueue = [];
+	busy = false;
+	generation = 0;
+	overflowNoticed = false;
+	pendingAutoplayAudio = null;
+	pendingAutoplayUrl = null;
+	constructor(host) {
+		this.host = host;
+	}
+	/**
+	* Play a 1-frame silent AudioBuffer through a transient AudioContext to
+	* register the current user gesture with the browser's autoplay policy.
+	* Safe to call repeatedly; failures are swallowed.
+	*/
+	primeForAutoplay() {
+		if (typeof window === "undefined") return;
+		const Ctor = window.AudioContext ?? window.webkitAudioContext;
+		if (!Ctor) return;
+		try {
+			const ctx = new Ctor();
+			const buffer = ctx.createBuffer(1, 1, 22050);
+			const source = ctx.createBufferSource();
+			source.buffer = buffer;
+			source.connect(ctx.destination);
+			source.start(0);
+			setTimeout(() => {
+				ctx.close().catch(() => {});
+			}, 100);
+		} catch {}
+	}
+	teardownActiveAudio() {
+		if (this.activeAudio) {
+			this.activeAudio.onerror = null;
+			this.activeAudio.onended = null;
+			try {
+				this.activeAudio.pause();
+			} catch {}
+			this.activeAudio.src = "";
+			this.activeAudio = null;
+		}
+		if (this.activeAudioUrl) {
+			URL.revokeObjectURL(this.activeAudioUrl);
+			this.activeAudioUrl = null;
+		}
+	}
+	teardownPendingAutoplay() {
+		if (this.pendingAutoplayAudio) {
+			this.pendingAutoplayAudio.onerror = null;
+			this.pendingAutoplayAudio.onended = null;
+			try {
+				this.pendingAutoplayAudio.pause();
+			} catch {}
+			this.pendingAutoplayAudio.src = "";
+			this.pendingAutoplayAudio = null;
+		}
+		if (this.pendingAutoplayUrl) {
+			URL.revokeObjectURL(this.pendingAutoplayUrl);
+			this.pendingAutoplayUrl = null;
+		}
+		this.host.autoplayBlocked = false;
+	}
+	/**
+	* User clicked the "click to resume" banner — promote the stashed audio
+	* to the active slot and play. Called from VoiceControl's banner button;
+	* the click on the button itself satisfies the autoplay-policy gesture
+	* requirement.
+	*/
+	resume() {
+		const a = this.pendingAutoplayAudio;
+		if (!a) {
+			this.host.autoplayBlocked = false;
+			return;
+		}
+		this.host.autoplayBlocked = false;
+		this.host.errorMessage = "";
+		this.host.status = "speaking";
+		this.busy = true;
+		this.activeAudio = a;
+		this.activeAudioUrl = this.pendingAutoplayUrl;
+		this.pendingAutoplayAudio = null;
+		this.pendingAutoplayUrl = null;
+		a.play().catch(() => {
+			this.host.status = "idle";
+			this.host.errorMessage = "Audio playback failed.";
+			this.teardownActiveAudio();
+			this.drainNext();
+		});
+	}
+	/**
+	* Read text aloud. Tries server-side TTS via the provider transport first (when the
+	* configured engine is openpalm-voice or remote); falls back to browser
+	* speech synthesis. Silent no-op if neither path is available.
+	*
+	* If a previous utterance is still synthesizing, playing, or stashed
+	* behind an autoplay block, queues this one (FIFO, cap 20) instead of
+	* cutting it off mid-sentence.
+	*/
+	async speak(text) {
+		if (typeof window === "undefined" || !text.trim()) return;
+		if (this.busy) {
+			this.speakQueue.push(text);
+			let dropped = 0;
+			while (this.speakQueue.length > SPEAK_QUEUE_MAX) {
+				this.speakQueue.shift();
+				dropped += 1;
+			}
+			if (dropped > 0 && !this.overflowNoticed) {
+				this.overflowNoticed = true;
+				notifications.push("info", `Skipped ${dropped} spoken ${dropped === 1 ? "reply" : "replies"} — too much overlap. Lower the auto-speak chat rate.`);
+			}
+			return;
+		}
+		await this.playOne(text);
+	}
+	/**
+	* Advance the pump: play the next queued utterance, or release the busy
+	* flag so a future speak() can start a fresh burst. Every terminal path
+	* of an utterance must land here (or hold `busy` deliberately, as the
+	* autoplay-block stash does).
+	*/
+	drainNext() {
+		const next = this.speakQueue.shift();
+		if (next) this.playOne(next);
+		else {
+			this.busy = false;
+			this.overflowNoticed = false;
+			this.onQueueDrained?.();
+		}
+	}
+	/** Internal: actually trigger the audio for one text chunk. */
+	async playOne(text) {
+		if (typeof window === "undefined") return;
+		this.busy = true;
+		const gen = this.generation;
+		const speakableText = toSpeakableText(text);
+		if (!speakableText) {
+			this.drainNext();
+			return;
+		}
+		this.teardownActiveAudio();
+		if ("speechSynthesis" in window) window.speechSynthesis.cancel();
+		this.host.errorMessage = "";
+		const engine = this.host.ttsEngine;
+		const useServer = engine === "openpalm-voice" || engine === "remote";
+		if (useServer) {
+			let res;
+			try {
+				res = await synthesize(speakableText);
+			} catch {}
+			if (gen !== this.generation) return;
+			if (res?.ok && res.headers.get("content-type")?.startsWith("audio/")) {
+				const blob = await res.blob();
+				if (gen !== this.generation) return;
+				const url = URL.createObjectURL(blob);
+				const audio = new Audio(url);
+				this.activeAudio = audio;
+				this.activeAudioUrl = url;
+				audio.onended = () => {
+					this.host.status = "idle";
+					this.teardownActiveAudio();
+					this.drainNext();
+				};
+				audio.onerror = () => {
+					this.host.status = "idle";
+					this.host.errorMessage = "Audio playback failed.";
+					this.teardownActiveAudio();
+					this.drainNext();
+				};
+				this.host.status = "speaking";
+				try {
+					await audio.play();
+				} catch {
+					this.host.status = "idle";
+					this.pendingAutoplayAudio = audio;
+					this.pendingAutoplayUrl = url;
+					this.activeAudio = null;
+					this.activeAudioUrl = null;
+					this.host.autoplayBlocked = true;
+				}
+				return;
+			}
+			if (res && !res.ok) {
+				const errMsg = await this.extractSpeakError(res);
+				this.host.errorMessage = errMsg;
+			}
+		}
+		if (!("speechSynthesis" in window)) {
+			this.drainNext();
+			return;
+		}
+		if (useServer) this.host.errorMessage = "";
+		const utterance = new SpeechSynthesisUtterance(speakableText);
+		utterance.onstart = () => {
+			if (gen !== this.generation) return;
+			this.host.status = "speaking";
+		};
+		utterance.onend = () => {
+			if (gen !== this.generation) return;
+			this.host.status = "idle";
+			this.drainNext();
+		};
+		utterance.onerror = () => {
+			if (gen !== this.generation) return;
+			this.host.status = "idle";
+			this.drainNext();
+		};
+		window.speechSynthesis.speak(utterance);
+	}
+	/**
+	* Convert a non-OK synthesis response into a human-readable string.
+	* Recognises the /voice pass-through's structured codes; any other 5xx
+	* (a provider whose model is still loading) reads as "warming up".
+	*/
+	async extractSpeakError(res) {
+		let code;
+		try {
+			const data = await res.clone().json();
+			if (typeof data.error === "string") code = data.error;
+		} catch {}
+		if (code === "voice_unavailable") return "OpenPalm Voice is not enabled on this host.";
+		if (code === "voice_unreachable" || res.status >= 500) return "Voice engine is warming up — try again in a moment.";
+		return `TTS failed (HTTP ${res.status}).`;
+	}
+	/** Cancel speech synthesis. Drops the entire queue. */
+	stop() {
+		this.speakQueue.length = 0;
+		this.busy = false;
+		this.generation += 1;
+		this.overflowNoticed = false;
+		this.teardownPendingAutoplay();
+		this.teardownActiveAudio();
+		if (typeof window !== "undefined" && "speechSynthesis" in window) window.speechSynthesis.cancel();
+		this.host.status = "idle";
+	}
+};
+var VoiceState = class {
+	status = "idle";
+	/** True when the configured STT engine is actually usable from this browser. */
+	sttSupported = false;
+	ttsSupported = false;
+	errorMessage = "";
+	/** Partial transcript text while browser STT is mid-utterance. Cleared on stop/error. */
+	interimTranscript = "";
+	/** Active engine resolved from the client-owned voice settings. */
+	sttEngine = "disabled";
+	ttsEngine = "disabled";
+	/** Optional language hint (forwarded to the STT provider). */
+	sttLanguage = "";
+	/** Global toggle: when true, assistant chat replies are spoken automatically. */
+	ttsAutoEnabled = false;
+	/**
+	* True when an audio.play() was rejected by the browser's autoplay
+	* policy and we have a pending utterance waiting for a user gesture.
+	* The chat UI renders a small "click to resume" banner; clicking it
+	* calls resumeAutoplay() to actually play.
+	*/
+	autoplayBlocked = false;
+	/**
+	* True while hands-free conversation mode owns the mic (the chat page's
+	* listen → deliver → speak → listen loop). `status` keeps cycling
+	* through the normal VoiceStatus values while this is set.
+	*/
+	conversationActive = false;
+	/**
+	* Set when the configured STT engine is technically present in the
+	* window but known to fail at runtime on this UA (e.g. iOS Safari
+	* exposes SpeechRecognition but `start()` immediately errors with
+	* `service-not-allowed`). The Voice settings tab uses this to hide or
+	* disable the Browser STT card with the reason as a tooltip.
+	*/
+	browserSttUnsupportedReason = "";
+};
+var voiceState = new VoiceState();
+/**
+* The imperative TTS audio engine (speak queue, blob-URL lifecycle,
+* autoplay fallback, playOne). The reactive store composes it and
+* delegates the exported speak/resume/stop wrappers below to it; the
+* controller mutates `voiceState`'s reactive fields in place.
+*/
+var audioPlayback = new AudioPlaybackController(voiceState);
+audioPlayback.onQueueDrained = () => {
+	if (voiceState.conversationActive && voiceState.status === "idle") voiceState.status = "recording";
+};
+/** Exit conversation mode and tear down the listening loop (whichever engine). */
+function stopConversation() {
+	if (!voiceState.conversationActive) return;
+	voiceState.conversationActive = false;
+	voiceState.interimTranscript = "";
+	if (voiceState.status === "recording" || voiceState.status === "transcribing") voiceState.status = "idle";
+}
+/**
+* Read text aloud. Tries server-side TTS via the provider transport first (when the
+* configured engine is openpalm-voice or remote); falls back to browser
+* speech synthesis. Silent no-op if neither path is available.
+*
+* If a previous utterance is still playing, queues this one (FIFO, cap 20)
+* instead of cutting it off mid-sentence.
+*/
+function speakText(text) {
+	return audioPlayback.speak(text);
+}
+/** Cancel speech synthesis. Drops the entire queue. */
+function stopSpeaking() {
+	audioPlayback.stop();
+}
+/**
+* Tear down per-component voice resources on unmount. Only cancels
+* any in-flight recording / recognition (including the conversation
+* loop).
+*
+* Deliberately does NOT cancel `speechSynthesis` — that queue is a
+* window-level singleton and the user's auto-TTS toggle is persistent,
+* so a page navigation must not interrupt the assistant mid-utterance.
+* Explicit user actions (logout, mic click, toggle off) call
+* `stopSpeaking` directly.
+*/
+function destroyVoice() {
+	stopConversation();
+	voiceState.interimTranscript = "";
+	voiceState.status = "idle";
+}
+
+export { getTransport as a, speakText as b, stopSpeaking as c, destroyVoice as d, subscribeSessionEvents as e, getConnectionStore as g, isLoopbackHost as i, loadRuntimeConfig as l, notifications as n, randomId as r, setActiveConnection as s, themeService as t, voiceState as v };
+//# sourceMappingURL=voice-state.svelte-DU9g_xEh.js.map