@openpalm/ui 0.13.0-beta.6 → 0.13.0-beta.8

package/build/server/chunks/endpoints-IFTldlrt.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"endpoints-IFTldlrt.js","sources":["../../../.svelte-kit/adapter-node/chunks/endpoints.js"],"sourcesContent":["import { Y as readStackEnv, it as readSecret } from \"./compose-args.js\";\nimport \"./src.js\";\nimport { t as getState } from \"./state.js\";\nimport { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from \"node:fs\";\nimport { dirname } from \"node:path\";\nimport { randomUUID } from \"node:crypto\";\n//#region src/lib/server/basic-auth.ts\n/**\n* Shared HTTP Basic-auth encoding for host-UI → OpenCode/guardian calls.\n*\n* PR #564 P2-1: every host forwarder MUST send the exact same UTF-8 byte\n* sequence the assistant and guardian expect. Two divergences caused correct\n* passwords to 401 from the host:\n*  - `btoa()` is Latin-1-only and throws / corrupts on non-Latin-1 bytes\n*    (accents, CJK, emoji). Encode UTF-8 first (matches the guardian's\n*    `Buffer.from(..., 'utf-8')`).\n*  - the file-backed password was `.trim()`-ed, stripping surrounding spaces,\n*    while the assistant entrypoint (`$(cat)`) and the guardian strip only\n*    trailing newlines. Use `stripTrailingNewlines` so a password like\n*    `\"päss 🔒 \"` authenticates identically everywhere.\n*/\n/** OpenCode's server default Basic-auth username (the shipped assistant compose never overrides it). */\nvar DEFAULT_OPENCODE_USERNAME$1 = \"opencode\";\n/** UTF-8-safe Basic auth header — identical byte sequence to the guardian's encoder. */\nfunction basicAuthHeader(username, password) {\n\treturn `Basic ${Buffer.from(`${username}:${password}`, \"utf-8\").toString(\"base64\")}`;\n}\n/**\n* Strip only trailing newlines from a file-backed secret, matching the\n* assistant entrypoint's `$(cat file)` and the guardian's reader. Surrounding\n* spaces/tabs are preserved so the bytes match across every consumer.\n*/\nfunction stripTrailingNewlines(value) {\n\treturn value.replace(/\\n+$/, \"\");\n}\n//#endregion\n//#region src/lib/server/endpoints.ts\n/**\n* Assistant connections — list of OpenCode servers the UI can target, with\n* one marked active. The internal model uses \"connection\" language (plan\n* ui-runtime-modes-plan.md §6.6, Phase 2 / #486); the on-disk file keeps its\n* historical name and schema keys — `endpoints.json` with\n* `{ activeId, endpoints }` — and is NEVER renamed or migrated.\n*\n* The \"default\" entry is synthesized from environment (OP_OPENCODE_URL /\n* OP_ASSISTANT_URL / OP_ASSISTANT_PORT) and cannot be deleted. User-added\n* connections are persisted to a JSON file in the config directory (it's\n* user-owned configuration, not service state — see Phase 5 / D4 in\n* docs/technical/auth-and-proxy-refactor-plan.md).\n*\n* File: ${configDir}/endpoints.json (mode 0600)\n* Shape: { activeId: string | null, endpoints: ConnectionEntry[] }\n*   - activeId === null or \"default\" → use the env-derived default\n*   - activeId === \"<id>\" → use the matching user entry (falls back to default if not found)\n*\n* Legacy path: ${dataDir}/admin/endpoints.json. Old installs are\n* migrated lazily on first read by maybeMigrateLegacyEndpointsFile().\n*/\n/**\n* Read-time kind defaulting (plan §6.6): a user-persisted record without a\n* `kind` key is a remote OpenCode connection — that is the only thing the\n* pre-Phase-2 UI let users add. Explicit kinds pass through untouched.\n*/\nfunction kindOf(entry) {\n\treturn entry.kind ?? \"remote-opencode\";\n}\nvar DEFAULT_ID = \"default\";\n/**\n* OpenCode's server default Basic-auth username. The shipped assistant compose\n* never overrides OPENCODE_SERVER_USERNAME, and the guardian's upstream auth\n* sends `opencode:<password>`, so every host-UI forwarder must default here or\n* a correct password 401s (PR #564 r3566888629). User-added connections may\n* still carry an explicit username.\n*/\nvar DEFAULT_OPENCODE_USERNAME = DEFAULT_OPENCODE_USERNAME$1;\nvar LOCAL_ELECTRON_ID = \"local-electron\";\nvar remoteStatusCache = null;\nfunction endpointsPath() {\n\treturn `${getState().configDir}/endpoints.json`;\n}\n/**\n* Legacy path used before Phase 5 of the auth/proxy refactor.\n* See docs/technical/auth-and-proxy-refactor-plan.md § Phase 5 / D4.\n*/\nfunction legacyEndpointsPath() {\n\treturn `${getState().dataDir}/admin/endpoints.json`;\n}\n/**\n* One-shot lazy migration from the legacy data/ path to the new config/ path.\n*\n* Phase 5 of docs/technical/auth-and-proxy-refactor-plan.md (D6 step 3):\n*   - If the new path already exists → no-op (already migrated).\n*   - If the legacy path doesn't exist → no-op (fresh install).\n*   - Otherwise copy contents to the new path (mode 0600), then unlink legacy.\n*\n* If the migration fails partway, the legacy file is left in place so reads\n* fall back to it for the remainder of this session. Idempotent across\n* process restarts because the existence check makes it a no-op after the\n* first successful run.\n*/\nfunction maybeMigrateLegacyEndpointsFile() {\n\tconst newPath = endpointsPath();\n\tif (existsSync(newPath)) return;\n\tconst oldPath = legacyEndpointsPath();\n\tif (!existsSync(oldPath)) return;\n\ttry {\n\t\tmkdirSync(dirname(newPath), { recursive: true });\n\t\twriteFileSync(newPath, readFileSync(oldPath), { mode: 384 });\n\t\ttry {\n\t\t\tchmodSync(newPath, 384);\n\t\t} catch {}\n\t\tunlinkSync(oldPath);\n\t} catch (e) {\n\t\tconsole.warn(\"[endpoints] Failed to migrate legacy endpoints.json from data/ to config/. Leaving the old file in place; reads will fall back to it for this session.\", e);\n\t}\n}\nfunction localRuntimePath() {\n\treturn `${getState().dataDir}/local-opencode.runtime.json`;\n}\n/**\n* Read the Electron-written runtime.json each time it's needed. The file is\n* 0600 and is rewritten on each Electron launch (random password per launch),\n* so callers must NOT cache the result.\n*/\nfunction readLocalRuntime() {\n\tconst path = localRuntimePath();\n\tif (!existsSync(path)) return null;\n\ttry {\n\t\tconst parsed = JSON.parse(readFileSync(path, \"utf-8\"));\n\t\tif (!parsed || typeof parsed.url !== \"string\" || !parsed.url) return null;\n\t\treturn {\n\t\t\turl: parsed.url,\n\t\t\tusername: typeof parsed.username === \"string\" ? parsed.username : void 0,\n\t\t\tpassword: typeof parsed.password === \"string\" ? parsed.password : void 0,\n\t\t\tpid: typeof parsed.pid === \"number\" ? parsed.pid : void 0,\n\t\t\tstartedAt: typeof parsed.startedAt === \"string\" ? parsed.startedAt : void 0\n\t\t};\n\t} catch (e) {\n\t\tconsole.warn(\"[endpoints] Failed to parse local-opencode.runtime.json:\", e);\n\t\treturn null;\n\t}\n}\nfunction localEndpoint() {\n\tconst rt = readLocalRuntime();\n\tif (!rt) return null;\n\treturn {\n\t\tid: LOCAL_ELECTRON_ID,\n\t\tlabel: \"OpenPalm Admin\",\n\t\turl: normalizeBrowserFacingUrl(rt.url),\n\t\tusername: rt.username || DEFAULT_OPENCODE_USERNAME,\n\t\t...rt.password ? { password: rt.password } : {},\n\t\tkind: \"local-opencode\",\n\t\tisDefault: false,\n\t\tisLocal: true\n\t};\n}\nfunction normalizeBrowserFacingUrl(raw) {\n\ttry {\n\t\tconst url = new URL(raw);\n\t\turl.username = \"\";\n\t\turl.password = \"\";\n\t\tconst host = url.hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n\t\tif (host === \"0.0.0.0\" || host === \"::\") url.hostname = \"127.0.0.1\";\n\t\treturn url.toString().replace(/\\/$/, \"\");\n\t} catch {\n\t\treturn raw;\n\t}\n}\n/** Strip legacy URL userinfo before a connection reaches a serializer or view. */\nfunction redactEndpointUrlUserinfo(raw) {\n\treturn normalizeBrowserFacingUrl(raw);\n}\nfunction redactEntryUrl(entry) {\n\tconst url = redactEndpointUrlUserinfo(entry.url);\n\treturn url === entry.url ? entry : {\n\t\t...entry,\n\t\turl\n\t};\n}\nfunction readFile() {\n\tmaybeMigrateLegacyEndpointsFile();\n\tlet path = endpointsPath();\n\tif (!existsSync(path)) {\n\t\tconst legacy = legacyEndpointsPath();\n\t\tif (!existsSync(legacy)) return {\n\t\t\tactiveId: null,\n\t\t\tendpoints: []\n\t\t};\n\t\tpath = legacy;\n\t}\n\ttry {\n\t\tconst parsed = JSON.parse(readFileSync(path, \"utf-8\"));\n\t\treturn {\n\t\t\tactiveId: typeof parsed.activeId === \"string\" ? parsed.activeId : null,\n\t\t\tendpoints: Array.isArray(parsed.endpoints) ? parsed.endpoints.filter(isValidEntry).map(redactEntryUrl) : []\n\t\t};\n\t} catch (e) {\n\t\tconsole.warn(\"[endpoints] Failed to parse endpoints.json, resetting:\", e);\n\t\treturn {\n\t\t\tactiveId: null,\n\t\t\tendpoints: []\n\t\t};\n\t}\n}\nfunction isValidEntry(e) {\n\tif (!e || typeof e !== \"object\") return false;\n\tconst o = e;\n\treturn typeof o.id === \"string\" && typeof o.label === \"string\" && typeof o.url === \"string\";\n}\nfunction writeFile(data) {\n\tconst path = endpointsPath();\n\tmkdirSync(dirname(path), { recursive: true });\n\tconst safeData = {\n\t\t...data,\n\t\tendpoints: data.endpoints.map(redactEntryUrl)\n\t};\n\twriteFileSync(path, JSON.stringify(safeData, null, 2), {\n\t\tencoding: \"utf-8\",\n\t\tmode: 384\n\t});\n\ttry {\n\t\tchmodSync(path, 384);\n\t} catch {}\n}\nfunction defaultEndpoint() {\n\tconst persisted = readStackEnv(getState().homeDir);\n\tconst url = process.env.OP_OPENCODE_URL ?? process.env.OP_ASSISTANT_URL ?? `http://127.0.0.1:${process.env.OP_ASSISTANT_PORT ?? persisted.OP_ASSISTANT_PORT ?? \"3800\"}`;\n\tconst username = process.env.OPENCODE_SERVER_USERNAME || DEFAULT_OPENCODE_USERNAME;\n\tconst presetPassword = /^(true|1|yes)$/i.test((persisted.OPENCODE_AUTH ?? process.env.OPENCODE_AUTH ?? \"\").trim()) ? ((raw) => raw ? stripTrailingNewlines(raw) : void 0)(readSecret(getState().homeDir, \"op_opencode_password\") ?? void 0) || process.env.OP_OPENCODE_PASSWORD : void 0;\n\tconst password = process.env.OPENCODE_SERVER_PASSWORD || presetPassword || void 0;\n\treturn {\n\t\tid: DEFAULT_ID,\n\t\tlabel: \"Local Assistant\",\n\t\turl: normalizeBrowserFacingUrl(url),\n\t\tusername,\n\t\tpassword,\n\t\tkind: \"local-opencode\",\n\t\tisDefault: true\n\t};\n}\n/**\n* Discriminated validator that callers (admin routes) use to surface\n* specific error messages. Plain HTTP is allowed for any host — OpenPalm is\n* LAN-first, so remote instances on a private network are reached over http://.\n*/\nfunction validateEndpointUrl(input) {\n\tlet u;\n\ttry {\n\t\tu = new URL(input.trim());\n\t} catch {\n\t\treturn {\n\t\t\tok: false,\n\t\t\treason: \"invalid_url\"\n\t\t};\n\t}\n\tif (u.protocol !== \"http:\" && u.protocol !== \"https:\") return {\n\t\tok: false,\n\t\treason: \"invalid_scheme\"\n\t};\n\tif (!u.hostname) return {\n\t\tok: false,\n\t\treason: \"missing_host\"\n\t};\n\tif (u.username || u.password) return {\n\t\tok: false,\n\t\treason: \"userinfo_not_allowed\"\n\t};\n\tif (u.search || u.hash) return {\n\t\tok: false,\n\t\treason: \"unexpected_query_or_fragment\"\n\t};\n\treturn {\n\t\tok: true,\n\t\turl: u.toString().replace(/\\/$/, \"\")\n\t};\n}\n/**\n* Validate a URL string — must be http(s) with a host. Returns the normalized\n* URL or null. For finer-grained errors, use `validateEndpointUrl`.\n*/\nfunction normalizeEndpointUrl(input) {\n\tconst result = validateEndpointUrl(input);\n\treturn result.ok ? result.url : null;\n}\n/**\n* Returns: [local-electron (if Electron is running it), default, ...user entries].\n* The local-electron entry is synthesized at call time from\n* state/local-opencode.runtime.json — never persisted to endpoints.json.\n*/\nfunction listConnections() {\n\tconst { endpoints } = readFile();\n\tconst local = localEndpoint();\n\treturn [\n\t\t...local ? [local] : [],\n\t\tdefaultEndpoint(),\n\t\t...endpoints.map((e) => ({\n\t\t\t...e,\n\t\t\tkind: kindOf(e),\n\t\t\tisDefault: false\n\t\t}))\n\t];\n}\n/**\n* Returns the active connection, falling back to the default if no active id\n* is set OR if the active id is `local-electron` but the runtime.json isn't\n* there (e.g. the Electron child died). Re-reads runtime.json each call so a\n* password rotated by a new Electron launch is picked up immediately.\n*/\nfunction getActiveConnection() {\n\tconst { activeId, endpoints } = readFile();\n\tif (activeId === LOCAL_ELECTRON_ID) {\n\t\tconst local = localEndpoint();\n\t\tif (local) return local;\n\t\treturn defaultEndpoint();\n\t}\n\tif (!activeId || activeId === DEFAULT_ID) return defaultEndpoint();\n\tconst found = endpoints.find((e) => e.id === activeId);\n\tif (!found) return defaultEndpoint();\n\treturn {\n\t\t...found,\n\t\tkind: kindOf(found),\n\t\tisDefault: false\n\t};\n}\nfunction setActiveConnectionId(id) {\n\tconst data = readFile();\n\tif (!id || id === DEFAULT_ID) data.activeId = null;\n\telse if (id === LOCAL_ELECTRON_ID) {\n\t\tif (!localEndpoint()) throw new Error(\"Local OpenCode is not running (Electron only)\");\n\t\tdata.activeId = LOCAL_ELECTRON_ID;\n\t} else {\n\t\tif (!data.endpoints.some((e) => e.id === id)) throw new Error(`Endpoint not found: ${id}`);\n\t\tdata.activeId = id;\n\t}\n\twriteFile(data);\n\treturn getActiveConnection();\n}\n/**\n* User-addable connection kinds (#486 D2). `local-opencode` is reserved for\n* synthesized entries (the env-derived default, the Electron local-runtime\n* entry) and is never accepted from a write path.\n*/\nvar USER_ADDABLE_CONNECTION_KINDS = [\"remote-opencode\", \"openpalm-client-api\"];\n/**\n* Normalize a guardian ('openpalm-client-api'-kind) connection URL so it\n* always ends in `/oc` — the guardian's direct-ingress base path\n* (#486 D2). Operates on an ALREADY `normalizeEndpointUrl`-ed string (no\n* trailing slash), so only the `/oc` suffix logic is needed here.\n*\n* `packages/client/src/lib/connections/url-policy.ts` carries a deliberate\n* CLIENT-side twin (`normalizeGuardianUrl`) with the same rule — the client\n* artifact may not import host code and vice versa, so this is the same\n* accepted duplication as `validateConnectionUrl`/`validateEndpointUrl`.\n* Both are pinned by their own tests.\n*/\nfunction normalizeGuardianOcUrl(url) {\n\treturn url.endsWith(\"/oc\") ? url : `${url}/oc`;\n}\nfunction assertAddableKind(kind) {\n\tif (kind === void 0) return;\n\tif (!USER_ADDABLE_CONNECTION_KINDS.includes(kind)) throw new Error(\"Invalid connection kind\");\n}\nfunction addConnection(input) {\n\tconst label = input.label.trim();\n\tif (!label) throw new Error(\"Label is required\");\n\tlet url = normalizeEndpointUrl(input.url);\n\tif (!url) throw new Error(\"URL must be a valid http(s) URL\");\n\tassertAddableKind(input.kind);\n\tif (input.kind === \"openpalm-client-api\") url = normalizeGuardianOcUrl(url);\n\tconst data = readFile();\n\tconst entry = {\n\t\tid: randomUUID(),\n\t\tlabel,\n\t\turl,\n\t\t...input.password ? { password: input.password } : {},\n\t\t...input.kind ? { kind: input.kind } : {}\n\t};\n\tdata.endpoints.push(entry);\n\twriteFile(data);\n\treturn entry;\n}\nfunction updateConnection(id, patch) {\n\tif (id === DEFAULT_ID) throw new Error(\"Cannot edit the default endpoint\");\n\tif (id === LOCAL_ELECTRON_ID) throw new Error(\"Cannot edit the local Electron OpenCode entry (it is ephemeral and per-launch)\");\n\tassertAddableKind(patch.kind);\n\tconst data = readFile();\n\tconst idx = data.endpoints.findIndex((e) => e.id === id);\n\tif (idx === -1) throw new Error(`Endpoint not found: ${id}`);\n\tconst next = { ...data.endpoints[idx] };\n\tif (patch.label !== void 0) {\n\t\tconst label = patch.label.trim();\n\t\tif (!label) throw new Error(\"Label cannot be empty\");\n\t\tnext.label = label;\n\t}\n\tif (patch.url !== void 0) {\n\t\tconst url = normalizeEndpointUrl(patch.url);\n\t\tif (!url) throw new Error(\"URL must be a valid http(s) URL\");\n\t\tnext.url = url;\n\t}\n\tif (patch.password === null) delete next.password;\n\telse if (typeof patch.password === \"string\") next.password = patch.password;\n\tif (patch.kind !== void 0) next.kind = patch.kind;\n\tif (next.kind === \"openpalm-client-api\") next.url = normalizeGuardianOcUrl(next.url);\n\tdata.endpoints[idx] = next;\n\twriteFile(data);\n\treturn next;\n}\nfunction deleteConnection(id) {\n\tif (id === DEFAULT_ID) throw new Error(\"Cannot delete the default endpoint\");\n\tif (id === LOCAL_ELECTRON_ID) throw new Error(\"Cannot delete the local Electron OpenCode entry (managed by Electron lifecycle)\");\n\tconst data = readFile();\n\tconst idx = data.endpoints.findIndex((e) => e.id === id);\n\tif (idx === -1) throw new Error(`Endpoint not found: ${id}`);\n\tdata.endpoints.splice(idx, 1);\n\tif (data.activeId === id) data.activeId = null;\n\twriteFile(data);\n}\nasync function probeEndpoint(endpoint) {\n\tconst headers = new Headers();\n\tif (endpoint.password) {\n\t\tconst username = endpoint.username ?? DEFAULT_OPENCODE_USERNAME;\n\t\theaders.set(\"authorization\", basicAuthHeader(username, endpoint.password));\n\t}\n\tconst probeUrl = endpoint.kind === \"openpalm-client-api\" ? `${endpoint.url}/session` : endpoint.url;\n\ttry {\n\t\tconst response = await fetch(probeUrl, {\n\t\t\tmethod: \"GET\",\n\t\t\theaders,\n\t\t\tredirect: \"manual\",\n\t\t\tsignal: AbortSignal.timeout(2e3)\n\t\t});\n\t\tif (response.status === 401 || response.status === 403) return {\n\t\t\tid: endpoint.id,\n\t\t\tname: endpoint.label,\n\t\t\turl: endpoint.url,\n\t\t\tstate: \"unauthorized\",\n\t\t\tdetail: `HTTP ${response.status}`\n\t\t};\n\t\tif (response.ok || response.status >= 300 && response.status < 400) return {\n\t\t\tid: endpoint.id,\n\t\t\tname: endpoint.label,\n\t\t\turl: endpoint.url,\n\t\t\tstate: \"accessible\"\n\t\t};\n\t\treturn {\n\t\t\tid: endpoint.id,\n\t\t\tname: endpoint.label,\n\t\t\turl: endpoint.url,\n\t\t\tstate: \"unreachable\",\n\t\t\tdetail: `HTTP ${response.status}`\n\t\t};\n\t} catch (error) {\n\t\treturn {\n\t\t\tid: endpoint.id,\n\t\t\tname: endpoint.label,\n\t\t\turl: endpoint.url,\n\t\t\tstate: \"unreachable\",\n\t\t\tdetail: error instanceof Error ? error.message : String(error)\n\t\t};\n\t}\n}\nasync function listRemoteStatuses() {\n\tif (remoteStatusCache && remoteStatusCache.expiresAt > Date.now()) return remoteStatusCache.value.map((status) => ({ ...status }));\n\tconst statuses = await Promise.all(listConnections().map((endpoint) => probeEndpoint(endpoint)));\n\tremoteStatusCache = {\n\t\tvalue: statuses,\n\t\texpiresAt: Date.now() + 5e3\n\t};\n\treturn statuses.map((status) => ({ ...status }));\n}\n//#endregion\nexport { listConnections as a, setActiveConnectionId as c, basicAuthHeader as d, getActiveConnection as i, updateConnection as l, addConnection as n, listRemoteStatuses as o, deleteConnection as r, redactEndpointUrlUserinfo as s, USER_ADDABLE_CONNECTION_KINDS as t, validateEndpointUrl as u };\n"],"names":[],"mappings":";;;;;;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,2BAA2B,GAAG,UAAU;AAC5C;AACA,SAAS,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE;AAC7C,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrF;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,KAAK,EAAE;AACtC,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;AACjC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,MAAM,CAAC,KAAK,EAAE;AACvB,CAAC,OAAO,KAAK,CAAC,IAAI,IAAI,iBAAiB;AACvC;AACA,IAAI,UAAU,GAAG,SAAS;AAC1B;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,yBAAyB,GAAG,2BAA2B;AAC3D,IAAI,iBAAiB,GAAG,gBAAgB;AACxC,IAAI,iBAAiB,GAAG,IAAI;AAC5B,SAAS,aAAa,GAAG;AACzB,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,eAAe,CAAC;AAChD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,GAAG;AAC/B,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC;AACpD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,+BAA+B,GAAG;AAC3C,CAAC,MAAM,OAAO,GAAG,aAAa,EAAE;AAChC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE;AAC1B,CAAC,MAAM,OAAO,GAAG,mBAAmB,EAAE;AACtC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;AAC3B,CAAC,IAAI;AACL,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAClD,EAAE,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC9D,EAAE,IAAI;AACN,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC;AAC1B,EAAE,CAAC,CAAC,MAAM,CAAC;AACX,EAAE,UAAU,CAAC,OAAO,CAAC;AACrB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,CAAC,IAAI,CAAC,wJAAwJ,EAAE,CAAC,CAAC;AAC3K,CAAC;AACD;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,4BAA4B,CAAC;AAC3D;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,IAAI,GAAG,gBAAgB,EAAE;AAChC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AACnC,CAAC,IAAI;AACL,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACxD,EAAE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI;AAC3E,EAAE,OAAO;AACT,GAAG,GAAG,EAAE,MAAM,CAAC,GAAG;AAClB,GAAG,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;AAC3E,GAAG,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;AAC3E,GAAG,GAAG,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,GAAG,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC;AAC5D,GAAG,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,GAAG,MAAM,CAAC,SAAS,GAAG,KAAK;AAC7E,GAAG;AACH,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,CAAC,IAAI,CAAC,0DAA0D,EAAE,CAAC,CAAC;AAC7E,EAAE,OAAO,IAAI;AACb,CAAC;AACD;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,MAAM,EAAE,GAAG,gBAAgB,EAAE;AAC9B,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,IAAI;AACrB,CAAC,OAAO;AACR,EAAE,EAAE,EAAE,iBAAiB;AACvB,EAAE,KAAK,EAAE,gBAAgB;AACzB,EAAE,GAAG,EAAE,yBAAyB,CAAC,EAAE,CAAC,GAAG,CAAC;AACxC,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,yBAAyB;AACpD,EAAE,GAAG,EAAE,CAAC,QAAQ,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;AACjD,EAAE,IAAI,EAAE,gBAAgB;AACxB,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,OAAO,EAAE;AACX,EAAE;AACF;AACA,SAAS,yBAAyB,CAAC,GAAG,EAAE;AACxC,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC;AAC1B,EAAE,GAAG,CAAC,QAAQ,GAAG,EAAE;AACnB,EAAE,GAAG,CAAC,QAAQ,GAAG,EAAE;AACnB,EAAE,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;AACjE,EAAE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,GAAG,CAAC,QAAQ,GAAG,WAAW;AACrE,EAAE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AAC1C,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,GAAG;AACZ,CAAC;AACD;AACA;AACA,SAAS,yBAAyB,CAAC,GAAG,EAAE;AACxC,CAAC,OAAO,yBAAyB,CAAC,GAAG,CAAC;AACtC;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,MAAM,GAAG,GAAG,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC;AACjD,CAAC,OAAO,GAAG,KAAK,KAAK,CAAC,GAAG,GAAG,KAAK,GAAG;AACpC,EAAE,GAAG,KAAK;AACV,EAAE;AACF,EAAE;AACF;AACA,SAAS,QAAQ,GAAG;AACpB,CAAC,+BAA+B,EAAE;AAClC,CAAC,IAAI,IAAI,GAAG,aAAa,EAAE;AAC3B,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;AACxB,EAAE,MAAM,MAAM,GAAG,mBAAmB,EAAE;AACtC,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,OAAO;AAClC,GAAG,QAAQ,EAAE,IAAI;AACjB,GAAG,SAAS,EAAE;AACd,GAAG;AACH,EAAE,IAAI,GAAG,MAAM;AACf,CAAC;AACD,CAAC,IAAI;AACL,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACxD,EAAE,OAAO;AACT,GAAG,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,IAAI;AACzE,GAAG,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG;AAC5G,GAAG;AACH,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,CAAC,IAAI,CAAC,wDAAwD,EAAE,CAAC,CAAC;AAC3E,EAAE,OAAO;AACT,GAAG,QAAQ,EAAE,IAAI;AACjB,GAAG,SAAS,EAAE;AACd,GAAG;AACH,CAAC;AACD;AACA,SAAS,YAAY,CAAC,CAAC,EAAE;AACzB,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,OAAO,KAAK;AAC9C,CAAC,MAAM,CAAC,GAAG,CAAC;AACZ,CAAC,OAAO,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;AAC5F;AACA,SAAS,SAAS,CAAC,IAAI,EAAE;AACzB,CAAC,MAAM,IAAI,GAAG,aAAa,EAAE;AAC7B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC,MAAM,QAAQ,GAAG;AAClB,EAAE,GAAG,IAAI;AACT,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,cAAc;AAC9C,EAAE;AACF,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;AACxD,EAAE,QAAQ,EAAE,OAAO;AACnB,EAAE,IAAI,EAAE;AACR,EAAE,CAAC;AACH,CAAC,IAAI;AACL,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC;AACtB,CAAC,CAAC,CAAC,MAAM,CAAC;AACV;AACA,SAAS,eAAe,GAAG;AAC3B,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC;AACnD,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,SAAS,CAAC,iBAAiB,IAAI,MAAM,CAAC,CAAC;AACxK,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,yBAAyB;AACnF,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,GAAG,GAAG,qBAAqB,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,sBAAsB,CAAC,IAAI,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,MAAM;AACzR,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,cAAc,IAAI,MAAM;AAClF,CAAC,OAAO;AACR,EAAE,EAAE,EAAE,UAAU;AAChB,EAAE,KAAK,EAAE,iBAAiB;AAC1B,EAAE,GAAG,EAAE,yBAAyB,CAAC,GAAG,CAAC;AACrC,EAAE,QAAQ;AACV,EAAE,QAAQ;AACV,EAAE,IAAI,EAAE,gBAAgB;AACxB,EAAE,SAAS,EAAE;AACb,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE;AACpC,CAAC,IAAI,CAAC;AACN,CAAC,IAAI;AACL,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO;AACT,GAAG,EAAE,EAAE,KAAK;AACZ,GAAG,MAAM,EAAE;AACX,GAAG;AACH,CAAC;AACD,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,OAAO;AAC/D,EAAE,EAAE,EAAE,KAAK;AACX,EAAE,MAAM,EAAE;AACV,EAAE;AACF,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO;AACzB,EAAE,EAAE,EAAE,KAAK;AACX,EAAE,MAAM,EAAE;AACV,EAAE;AACF,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO;AACtC,EAAE,EAAE,EAAE,KAAK;AACX,EAAE,MAAM,EAAE;AACV,EAAE;AACF,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO;AAChC,EAAE,EAAE,EAAE,KAAK;AACX,EAAE,MAAM,EAAE;AACV,EAAE;AACF,CAAC,OAAO;AACR,EAAE,EAAE,EAAE,IAAI;AACV,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE;AACrC,EAAE;AACF;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,KAAK,EAAE;AACrC,CAAC,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC;AAC1C,CAAC,OAAO,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI;AACrC;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,eAAe,GAAG;AAC3B,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE;AACjC,CAAC,MAAM,KAAK,GAAG,aAAa,EAAE;AAC9B,CAAC,OAAO;AACR,EAAE,GAAG,KAAK,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;AACzB,EAAE,eAAe,EAAE;AACnB,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AAC3B,GAAG,GAAG,CAAC;AACP,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AAClB,GAAG,SAAS,EAAE;AACd,GAAG,CAAC;AACJ,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,GAAG;AAC/B,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE;AAC3C,CAAC,IAAI,QAAQ,KAAK,iBAAiB,EAAE;AACrC,EAAE,MAAM,KAAK,GAAG,aAAa,EAAE;AAC/B,EAAE,IAAI,KAAK,EAAE,OAAO,KAAK;AACzB,EAAE,OAAO,eAAe,EAAE;AAC1B,CAAC;AACD,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,UAAU,EAAE,OAAO,eAAe,EAAE;AACnE,CAAC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC;AACvD,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,eAAe,EAAE;AACrC,CAAC,OAAO;AACR,EAAE,GAAG,KAAK;AACV,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC;AACrB,EAAE,SAAS,EAAE;AACb,EAAE;AACF;AACA,SAAS,qBAAqB,CAAC,EAAE,EAAE;AACnC,CAAC,MAAM,IAAI,GAAG,QAAQ,EAAE;AACxB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,UAAU,EAAE,IAAI,CAAC,QAAQ,GAAG,IAAI;AACnD,MAAM,IAAI,EAAE,KAAK,iBAAiB,EAAE;AACpC,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC;AACxF,EAAE,IAAI,CAAC,QAAQ,GAAG,iBAAiB;AACnC,CAAC,CAAC,MAAM;AACR,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAC;AAC5F,EAAE,IAAI,CAAC,QAAQ,GAAG,EAAE;AACpB,CAAC;AACD,CAAC,SAAS,CAAC,IAAI,CAAC;AAChB,CAAC,OAAO,mBAAmB,EAAE;AAC7B;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,6BAA6B,GAAG,CAAC,iBAAiB,EAAE,qBAAqB;AAC7E;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,sBAAsB,CAAC,GAAG,EAAE;AACrC,CAAC,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;AAC/C;AACA,SAAS,iBAAiB,CAAC,IAAI,EAAE;AACjC,CAAC,IAAI,IAAI,KAAK,MAAM,EAAE;AACtB,CAAC,IAAI,CAAC,6BAA6B,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC;AAC9F;AACA,SAAS,aAAa,CAAC,KAAK,EAAE;AAC9B,CAAC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE;AACjC,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC;AACjD,CAAC,IAAI,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC;AAC1C,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC;AAC7D,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC;AAC9B,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,EAAE,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC;AAC5E,CAAC,MAAM,IAAI,GAAG,QAAQ,EAAE;AACxB,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,EAAE,EAAE,UAAU,EAAE;AAClB,EAAE,KAAK;AACP,EAAE,GAAG;AACL,EAAE,GAAG,KAAK,CAAC,QAAQ,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE;AACvD,EAAE,GAAG,KAAK,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG;AACzC,EAAE;AACF,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;AAC3B,CAAC,SAAS,CAAC,IAAI,CAAC;AAChB,CAAC,OAAO,KAAK;AACb;AACA,SAAS,gBAAgB,CAAC,EAAE,EAAE,KAAK,EAAE;AACrC,CAAC,IAAI,EAAE,KAAK,UAAU,EAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC;AAC3E,CAAC,IAAI,EAAE,KAAK,iBAAiB,EAAE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC;AAChI,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC;AAC9B,CAAC,MAAM,IAAI,GAAG,QAAQ,EAAE;AACxB,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;AACzD,CAAC,IAAI,GAAG,KAAK,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE;AACxC,CAAC,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,EAAE;AAC7B,EAAE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE;AAClC,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC;AACtD,EAAE,IAAI,CAAC,KAAK,GAAG,KAAK;AACpB,CAAC;AACD,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,EAAE;AAC3B,EAAE,MAAM,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC;AAC7C,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC;AAC9D,EAAE,IAAI,CAAC,GAAG,GAAG,GAAG;AAChB,CAAC;AACD,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,OAAO,IAAI,CAAC,QAAQ;AAClD,MAAM,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ;AAC5E,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI;AAClD,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE,IAAI,CAAC,GAAG,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;AACrF,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI;AAC3B,CAAC,SAAS,CAAC,IAAI,CAAC;AAChB,CAAC,OAAO,IAAI;AACZ;AACA,SAAS,gBAAgB,CAAC,EAAE,EAAE;AAC9B,CAAC,IAAI,EAAE,KAAK,UAAU,EAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC;AAC7E,CAAC,IAAI,EAAE,KAAK,iBAAiB,EAAE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC;AACjI,CAAC,MAAM,IAAI,GAAG,QAAQ,EAAE;AACxB,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;AACzD,CAAC,IAAI,GAAG,KAAK,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;AAC9B,CAAC,IAAI,IAAI,CAAC,QAAQ,KAAK,EAAE,EAAE,IAAI,CAAC,QAAQ,GAAG,IAAI;AAC/C,CAAC,SAAS,CAAC,IAAI,CAAC;AAChB;AACA,eAAe,aAAa,CAAC,QAAQ,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE;AAC9B,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE;AACxB,EAAE,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,yBAAyB;AACjE,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC5E,CAAC;AACD,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,KAAK,qBAAqB,GAAG,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC,GAAG;AACpG,CAAC,IAAI;AACL,EAAE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;AACzC,GAAG,MAAM,EAAE,KAAK;AAChB,GAAG,OAAO;AACV,GAAG,QAAQ,EAAE,QAAQ;AACrB,GAAG,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG;AAClC,GAAG,CAAC;AACJ,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,OAAO;AACjE,GAAG,EAAE,EAAE,QAAQ,CAAC,EAAE;AAClB,GAAG,IAAI,EAAE,QAAQ,CAAC,KAAK;AACvB,GAAG,GAAG,EAAE,QAAQ,CAAC,GAAG;AACpB,GAAG,KAAK,EAAE,cAAc;AACxB,GAAG,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC;AACnC,GAAG;AACH,EAAE,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO;AAC7E,GAAG,EAAE,EAAE,QAAQ,CAAC,EAAE;AAClB,GAAG,IAAI,EAAE,QAAQ,CAAC,KAAK;AACvB,GAAG,GAAG,EAAE,QAAQ,CAAC,GAAG;AACpB,GAAG,KAAK,EAAE;AACV,GAAG;AACH,EAAE,OAAO;AACT,GAAG,EAAE,EAAE,QAAQ,CAAC,EAAE;AAClB,GAAG,IAAI,EAAE,QAAQ,CAAC,KAAK;AACvB,GAAG,GAAG,EAAE,QAAQ,CAAC,GAAG;AACpB,GAAG,KAAK,EAAE,aAAa;AACvB,GAAG,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC;AACnC,GAAG;AACH,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE;AACjB,EAAE,OAAO;AACT,GAAG,EAAE,EAAE,QAAQ,CAAC,EAAE;AAClB,GAAG,IAAI,EAAE,QAAQ,CAAC,KAAK;AACvB,GAAG,GAAG,EAAE,QAAQ,CAAC,GAAG;AACpB,GAAG,KAAK,EAAE,aAAa;AACvB,GAAG,MAAM,EAAE,KAAK,YAAY,KAAK,GAAG,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK;AAChE,GAAG;AACH,CAAC;AACD;AACA,eAAe,kBAAkB,GAAG;AACpC,CAAC,IAAI,iBAAiB,IAAI,iBAAiB,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AACnI,CAAC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;AACjG,CAAC,iBAAiB,GAAG;AACrB,EAAE,KAAK,EAAE,QAAQ;AACjB,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG;AAC1B,EAAE;AACF,CAAC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AACjD;;;;"}

package/build/server/chunks/features-BW-bVsl8.js

@@ -1,118 +0,0 @@
-import { aL as resolveClientAppPort, P as PLATFORM_VERSION } from './src-DbArH65P.js';
-
-var package_default = {
-	version: "0.13.0-beta.6"};
-//#endregion
-//#region src/lib/server/features.ts
-/**
-* Server runtime context — RuntimeContext v2 (plan ui-runtime-modes-plan.md
-* §6.1, issue #509). Computed server-side on every request via
-* +layout.server.ts and served publicly at GET /api/runtime (the
-* contract-version handshake for remote/hosted clients).
-*
-* hostMode resolution (Phase 1):
-*   OP_UI_HOST_MODE (explicit) → that mode
-*   else OP_INSIDE_ELECTRON=1  → 'electron-host' (legacy, injected by
-*                                 packages/electron/src/main.ts)
-*   else OP_ENABLE_ADMIN=1     → 'host-ui' (legacy, local dev / openpalm admin)
-*   else                       → 'pwa-static' baseline
-*/
-var HOST_MODES = [
-	"electron-host",
-	"host-ui",
-	"assistant-container",
-	"pwa-static"
-];
-function isUiHostMode(value) {
-	return HOST_MODES.includes(value);
-}
-function resolveHostMode() {
-	const explicit = process.env.OP_UI_HOST_MODE?.trim() ?? "";
-	if (isUiHostMode(explicit)) return explicit;
-	if (process.env.OP_INSIDE_ELECTRON === "1") return "electron-host";
-	if (process.env.OP_ENABLE_ADMIN === "1") return "host-ui";
-	return "pwa-static";
-}
-/** Capabilities of a host-capable process (electron-host / host-ui). Note:
-*  never 'connections:single' — that marker is the assistant-container
-*  branch key in resolveCapabilities() (plan §6.2). */
-var HOST_MODE_CAPABILITIES = [
-	"chat",
-	"connections:read",
-	"connections:manage",
-	"connections:switch",
-	"assistant-settings:read",
-	"assistant-settings:write",
-	...[
-		"host:setup",
-		"host:stack:read",
-		"host:stack:write",
-		"host:containers",
-		"host:addons",
-		"host:updates",
-		"host:logs",
-		"host:secrets",
-		"host:recovery",
-		"host:akm-sharing"
-	]
-];
-var SERVER_CAPABILITIES = {
-	"electron-host": HOST_MODE_CAPABILITIES,
-	"host-ui": HOST_MODE_CAPABILITIES,
-	"assistant-container": [
-		"connections:single",
-		"chat",
-		"assistant-settings:read",
-		"assistant-settings:write"
-	],
-	"pwa-static": [
-		"chat",
-		"connections:read",
-		"connections:manage",
-		"connections:switch",
-		"pwa:install"
-	]
-};
-/** Route pointers per mode — current-truth URLs. Phase 2 (#486) moved
-*  connections to /connections; Phase 4 moved the host dashboard to /host
-*  (/admin/* is a dead namespace — router 404, no alias). */
-function routesForMode(mode) {
-	switch (mode) {
-		case "electron-host":
-		case "host-ui": return {
-			chat: "/chat",
-			connections: "/connections",
-			host: "/host",
-			setup: "/setup"
-		};
-		case "assistant-container": return { chat: "/chat" };
-		case "pwa-static": return {
-			chat: "/chat",
-			connections: "/connections"
-		};
-	}
-}
-function computeServerRuntimeContext(event) {
-	const hostMode = resolveHostMode();
-	const isHostCapable = hostMode === "electron-host" || hostMode === "host-ui";
-	const clientAppUrl = hostMode === "assistant-container" ? void 0 : `http://127.0.0.1:${resolveClientAppPort(process.env)}`;
-	return {
-		version: 2,
-		hostMode,
-		serverCapabilities: [...SERVER_CAPABILITIES[hostMode]],
-		publicBaseUrl: event.url?.origin ?? "",
-		uiVersion: package_default.version,
-		skeletonVersion: process.env.OP_SKELETON_VERSION?.trim() || PLATFORM_VERSION,
-		activeConnectionMode: hostMode === "assistant-container" ? "single" : "multi",
-		...clientAppUrl !== void 0 ? { clientAppUrl } : {},
-		routes: routesForMode(hostMode),
-		security: {
-			hostAdminLoopbackOnly: true,
-			requiresHttpsForRemoteConnections: hostMode === "pwa-static",
-			csrfMode: isHostCapable ? "loopback-origin" : hostMode === "assistant-container" ? "same-site" : "bearer-token"
-		}
-	};
-}
-
-export { computeServerRuntimeContext as c };
-//# sourceMappingURL=features-BW-bVsl8.js.map

package/build/server/chunks/features-BW-bVsl8.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"features-BW-bVsl8.js","sources":["../../../.svelte-kit/adapter-node/chunks/features.js"],"sourcesContent":["import { mt as PLATFORM_VERSION } from \"./compose-args.js\";\nimport { r as resolveClientAppPort } from \"./src.js\";\nvar package_default = {\n\tname: \"@openpalm/ui\",\n\tdescription: \"SvelteKit web UI and API for OpenPalm stack management\",\n\tversion: \"0.13.0-beta.6\",\n\tlicense: \"MPL-2.0\",\n\ttype: \"module\",\n\t\"//minHarnessContract\": \"Minimum native Electron harness contract this UI build requires (design §5.3). The harness refuses to self-update onto a build whose minHarnessContract exceeds the contract it provides and prompts an app re-download instead. Bump ONLY when the UI starts depending on a new IPC method / spawn env key; keep in lockstep with packages/electron/src/harness-contract.ts HARNESS_CONTRACT_VERSION.\",\n\tminHarnessContract: 1,\n\trepository: {\n\t\t\"type\": \"git\",\n\t\t\"url\": \"https://github.com/itlackey/openpalm.git\",\n\t\t\"directory\": \"packages/ui\"\n\t},\n\tpublishConfig: { \"access\": \"public\" },\n\tfiles: [\"build\"],\n\tscripts: {\n\t\t\"dev\": \"PORT=${PORT:-5173} vite dev\",\n\t\t\"ux:audit\": \"NODE_PATH=\\\"$PWD/node_modules\\\" bun \\\"${AKM_HOME:-$HOME/akm}/skills/web-ux/ux-dom-audit/scripts/audit.ts\\\" e2e/ux-audit.config.json\",\n\t\t\"ux:audit:wizard\": \"NODE_PATH=\\\"$PWD/node_modules\\\" bun \\\"${AKM_HOME:-$HOME/akm}/skills/web-ux/ux-dom-audit/scripts/audit.ts\\\" e2e/ux-audit.wizard.config.json\",\n\t\t\"dev:local\": \"PORT=${PORT:-5173} OP_OPENCODE_URL=${OP_OPENCODE_URL:-http://localhost:3800} vite dev\",\n\t\t\"build\": \"svelte-kit sync && vite build && node scripts/stamp-version.mjs\",\n\t\t\"clean:build\": \"rm -rf .svelte-kit build\",\n\t\t\"preview\": \"vite preview\",\n\t\t\"check\": \"svelte-kit sync && svelte-check --tsconfig ./tsconfig.json\",\n\t\t\"test:e2e\": \"playwright test\",\n\t\t\"test\": \"npm run test:unit -- --run && npm run test:e2e\",\n\t\t\"test:unit\": \"vitest\",\n\t\t\"test:browsers\": \"playwright install --with-deps chromium\",\n\t\t\"lint\": \"eslint .\",\n\t\t\"format\": \"prettier --write .\",\n\t\t\"start\": \"node build/index.js\"\n\t},\n\tdevDependencies: {\n\t\t\"@axe-core/playwright\": \"^4.11.3\",\n\t\t\"@eslint/compat\": \"^2.0.2\",\n\t\t\"@eslint/js\": \"^10.0.1\",\n\t\t\"@openpalm/lib\": \"workspace:*\",\n\t\t\"@openpalm/ui-kit\": \"workspace:*\",\n\t\t\"@playwright/test\": \"^1.58.1\",\n\t\t\"@sveltejs/adapter-node\": \"^5.5.4\",\n\t\t\"@sveltejs/kit\": \"^2.53.3\",\n\t\t\"@sveltejs/vite-plugin-svelte\": \"^7.1.2\",\n\t\t\"@types/markdown-it\": \"^14.1.2\",\n\t\t\"@types/node\": \"^25.9.1\",\n\t\t\"@vitest/browser-playwright\": \"^4.0.18\",\n\t\t\"@vitest/coverage-v8\": \"^4.0.18\",\n\t\t\"croner\": \"^10.0.1\",\n\t\t\"dotenv\": \"^17.4.2\",\n\t\t\"eslint\": \"^10.4.0\",\n\t\t\"eslint-config-prettier\": \"^10.1.8\",\n\t\t\"eslint-plugin-svelte\": \"^3.14.0\",\n\t\t\"globals\": \"^17.3.0\",\n\t\t\"markdown-it\": \"^14.1.1\",\n\t\t\"playwright\": \"^1.58.1\",\n\t\t\"prettier\": \"^3.8.1\",\n\t\t\"prettier-plugin-svelte\": \"^4.0.1\",\n\t\t\"svelte\": \"^5.53.5\",\n\t\t\"svelte-check\": \"^4.1.1\",\n\t\t\"typescript\": \"^6.0.3\",\n\t\t\"typescript-eslint\": \"^8.54.0\",\n\t\t\"uqr\": \"0.1.3\",\n\t\t\"vite\": \"^8.0.14\",\n\t\t\"vite-plugin-devtools-json\": \"^1.0.0\",\n\t\t\"vitest\": \"^4.0.18\",\n\t\t\"vitest-browser-svelte\": \"^2.0.2\",\n\t\t\"yaml\": \"^2.8.0\"\n\t}\n};\n//#endregion\n//#region src/lib/server/features.ts\n/**\n* Server runtime context — RuntimeContext v2 (plan ui-runtime-modes-plan.md\n* §6.1, issue #509). Computed server-side on every request via\n* +layout.server.ts and served publicly at GET /api/runtime (the\n* contract-version handshake for remote/hosted clients).\n*\n* hostMode resolution (Phase 1):\n*   OP_UI_HOST_MODE (explicit) → that mode\n*   else OP_INSIDE_ELECTRON=1  → 'electron-host' (legacy, injected by\n*                                 packages/electron/src/main.ts)\n*   else OP_ENABLE_ADMIN=1     → 'host-ui' (legacy, local dev / openpalm admin)\n*   else                       → 'pwa-static' baseline\n*/\nvar HOST_MODES = [\n\t\"electron-host\",\n\t\"host-ui\",\n\t\"assistant-container\",\n\t\"pwa-static\"\n];\nfunction isUiHostMode(value) {\n\treturn HOST_MODES.includes(value);\n}\nfunction resolveHostMode() {\n\tconst explicit = process.env.OP_UI_HOST_MODE?.trim() ?? \"\";\n\tif (isUiHostMode(explicit)) return explicit;\n\tif (process.env.OP_INSIDE_ELECTRON === \"1\") return \"electron-host\";\n\tif (process.env.OP_ENABLE_ADMIN === \"1\") return \"host-ui\";\n\treturn \"pwa-static\";\n}\n/** Capabilities of a host-capable process (electron-host / host-ui). Note:\n*  never 'connections:single' — that marker is the assistant-container\n*  branch key in resolveCapabilities() (plan §6.2). */\nvar HOST_MODE_CAPABILITIES = [\n\t\"chat\",\n\t\"connections:read\",\n\t\"connections:manage\",\n\t\"connections:switch\",\n\t\"assistant-settings:read\",\n\t\"assistant-settings:write\",\n\t...[\n\t\t\"host:setup\",\n\t\t\"host:stack:read\",\n\t\t\"host:stack:write\",\n\t\t\"host:containers\",\n\t\t\"host:addons\",\n\t\t\"host:updates\",\n\t\t\"host:logs\",\n\t\t\"host:secrets\",\n\t\t\"host:recovery\",\n\t\t\"host:akm-sharing\"\n\t]\n];\nvar SERVER_CAPABILITIES = {\n\t\"electron-host\": HOST_MODE_CAPABILITIES,\n\t\"host-ui\": HOST_MODE_CAPABILITIES,\n\t\"assistant-container\": [\n\t\t\"connections:single\",\n\t\t\"chat\",\n\t\t\"assistant-settings:read\",\n\t\t\"assistant-settings:write\"\n\t],\n\t\"pwa-static\": [\n\t\t\"chat\",\n\t\t\"connections:read\",\n\t\t\"connections:manage\",\n\t\t\"connections:switch\",\n\t\t\"pwa:install\"\n\t]\n};\n/** Route pointers per mode — current-truth URLs. Phase 2 (#486) moved\n*  connections to /connections; Phase 4 moved the host dashboard to /host\n*  (/admin/* is a dead namespace — router 404, no alias). */\nfunction routesForMode(mode) {\n\tswitch (mode) {\n\t\tcase \"electron-host\":\n\t\tcase \"host-ui\": return {\n\t\t\tchat: \"/chat\",\n\t\t\tconnections: \"/connections\",\n\t\t\thost: \"/host\",\n\t\t\tsetup: \"/setup\"\n\t\t};\n\t\tcase \"assistant-container\": return { chat: \"/chat\" };\n\t\tcase \"pwa-static\": return {\n\t\t\tchat: \"/chat\",\n\t\t\tconnections: \"/connections\"\n\t\t};\n\t}\n}\nfunction computeServerRuntimeContext(event) {\n\tconst hostMode = resolveHostMode();\n\tconst isHostCapable = hostMode === \"electron-host\" || hostMode === \"host-ui\";\n\tconst clientAppUrl = hostMode === \"assistant-container\" ? void 0 : `http://127.0.0.1:${resolveClientAppPort(process.env)}`;\n\treturn {\n\t\tversion: 2,\n\t\thostMode,\n\t\tserverCapabilities: [...SERVER_CAPABILITIES[hostMode]],\n\t\tpublicBaseUrl: event.url?.origin ?? \"\",\n\t\tuiVersion: package_default.version,\n\t\tskeletonVersion: process.env.OP_SKELETON_VERSION?.trim() || PLATFORM_VERSION,\n\t\tactiveConnectionMode: hostMode === \"assistant-container\" ? \"single\" : \"multi\",\n\t\t...clientAppUrl !== void 0 ? { clientAppUrl } : {},\n\t\troutes: routesForMode(hostMode),\n\t\tsecurity: {\n\t\t\thostAdminLoopbackOnly: true,\n\t\t\trequiresHttpsForRemoteConnections: hostMode === \"pwa-static\",\n\t\t\tcsrfMode: isHostCapable ? \"loopback-origin\" : hostMode === \"assistant-container\" ? \"same-site\" : \"bearer-token\"\n\t\t}\n\t};\n}\n//#endregion\nexport { computeServerRuntimeContext as t };\n"],"names":[],"mappings":";;AAEA,IAAI,eAAe,GAAG;AACtB,CAEC,OAAO,EAAE,eAgEV,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,UAAU,GAAG;AACjB,CAAC,eAAe;AAChB,CAAC,SAAS;AACV,CAAC,qBAAqB;AACtB,CAAC;AACD,CAAC;AACD,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,OAAO,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;AAClC;AACA,SAAS,eAAe,GAAG;AAC3B,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE;AAC3D,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,OAAO,QAAQ;AAC5C,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG,EAAE,OAAO,eAAe;AACnE,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,GAAG,EAAE,OAAO,SAAS;AAC1D,CAAC,OAAO,YAAY;AACpB;AACA;AACA;AACA;AACA,IAAI,sBAAsB,GAAG;AAC7B,CAAC,MAAM;AACP,CAAC,kBAAkB;AACnB,CAAC,oBAAoB;AACrB,CAAC,oBAAoB;AACrB,CAAC,yBAAyB;AAC1B,CAAC,0BAA0B;AAC3B,CAAC,GAAG;AACJ,EAAE,YAAY;AACd,EAAE,iBAAiB;AACnB,EAAE,kBAAkB;AACpB,EAAE,iBAAiB;AACnB,EAAE,aAAa;AACf,EAAE,cAAc;AAChB,EAAE,WAAW;AACb,EAAE,cAAc;AAChB,EAAE,eAAe;AACjB,EAAE;AACF;AACA,CAAC;AACD,IAAI,mBAAmB,GAAG;AAC1B,CAAC,eAAe,EAAE,sBAAsB;AACxC,CAAC,SAAS,EAAE,sBAAsB;AAClC,CAAC,qBAAqB,EAAE;AACxB,EAAE,oBAAoB;AACtB,EAAE,MAAM;AACR,EAAE,yBAAyB;AAC3B,EAAE;AACF,EAAE;AACF,CAAC,YAAY,EAAE;AACf,EAAE,MAAM;AACR,EAAE,kBAAkB;AACpB,EAAE,oBAAoB;AACtB,EAAE,oBAAoB;AACtB,EAAE;AACF;AACA,CAAC;AACD;AACA;AACA;AACA,SAAS,aAAa,CAAC,IAAI,EAAE;AAC7B,CAAC,QAAQ,IAAI;AACb,EAAE,KAAK,eAAe;AACtB,EAAE,KAAK,SAAS,EAAE,OAAO;AACzB,GAAG,IAAI,EAAE,OAAO;AAChB,GAAG,WAAW,EAAE,cAAc;AAC9B,GAAG,IAAI,EAAE,OAAO;AAChB,GAAG,KAAK,EAAE;AACV,GAAG;AACH,EAAE,KAAK,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;AACtD,EAAE,KAAK,YAAY,EAAE,OAAO;AAC5B,GAAG,IAAI,EAAE,OAAO;AAChB,GAAG,WAAW,EAAE;AAChB,GAAG;AACH;AACA;AACA,SAAS,2BAA2B,CAAC,KAAK,EAAE;AAC5C,CAAC,MAAM,QAAQ,GAAG,eAAe,EAAE;AACnC,CAAC,MAAM,aAAa,GAAG,QAAQ,KAAK,eAAe,IAAI,QAAQ,KAAK,SAAS;AAC7E,CAAC,MAAM,YAAY,GAAG,QAAQ,KAAK,qBAAqB,GAAG,MAAM,GAAG,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3H,CAAC,OAAO;AACR,EAAE,OAAO,EAAE,CAAC;AACZ,EAAE,QAAQ;AACV,EAAE,kBAAkB,EAAE,CAAC,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AACxD,EAAE,aAAa,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE;AACxC,EAAE,SAAS,EAAE,eAAe,CAAC,OAAO;AACpC,EAAE,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,gBAAgB;AAC9E,EAAE,oBAAoB,EAAE,QAAQ,KAAK,qBAAqB,GAAG,QAAQ,GAAG,OAAO;AAC/E,EAAE,GAAG,YAAY,KAAK,MAAM,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE;AACpD,EAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC;AACjC,EAAE,QAAQ,EAAE;AACZ,GAAG,qBAAqB,EAAE,IAAI;AAC9B,GAAG,iCAAiC,EAAE,QAAQ,KAAK,YAAY;AAC/D,GAAG,QAAQ,EAAE,aAAa,GAAG,iBAAiB,GAAG,QAAQ,KAAK,qBAAqB,GAAG,WAAW,GAAG;AACpG;AACA,EAAE;AACF;;;;"}

package/build/server/chunks/helpers-DxodR6tq.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"helpers-DxodR6tq.js","sources":["../../../.svelte-kit/adapter-node/chunks/helpers.js"],"sourcesContent":["import { bt as resolveOpenPalmHome, it as readSecret } from \"./compose-args.js\";\nimport { q as createOpenCodeClient } from \"./src.js\";\nimport { l as isRemoteSetupAllowed } from \"./network-preset.js\";\nimport { i as getActiveConnection } from \"./endpoints.js\";\nimport { t as computeServerRuntimeContext } from \"./features.js\";\nimport { createHash, createHmac, timingSafeEqual } from \"node:crypto\";\n//#region src/lib/server/session-store.ts\n/**\n* Stateless signed session tokens.\n*\n* Token format: `<expiresAt>.<hmac-sha256-hex>`\n*   expiresAt — unix ms timestamp when the session expires\n*   signature — HMAC-SHA256(expiresAt, login password)\n*\n* Tokens are self-validating: the server holds no per-session state and\n* sessions survive UI server restarts. Signing with the login password means\n* a password change invalidates all existing sessions — correct behaviour.\n*\n* The signing secret is resolved exactly like login verification\n* (`getUiLoginPassword`): `process.env.OP_UI_LOGIN_PASSWORD` first, then the\n* on-disk stack secret. When NEITHER exists, minting throws and validation\n* fails closed — there is deliberately no fallback secret, because a constant\n* key would let anyone forge an admin token. Reading the file per call also\n* means tokens minted right after the setup wizard writes the password are\n* signed with the real secret, without waiting for a process restart.\n*\n* Logout semantics (known trade-off of stateless tokens): logout revokes the\n* single token the browser presented (in-memory list, cleared on restart) and\n* clears the cookie. Earlier tokens issued to the same browser by sliding\n* renewal remain cryptographically valid until they expire — logout is\n* \"forget my cookie\", not \"kill every credential ever issued\". A real\n* kill-switch is changing the login password, which invalidates everything.\n*/\n/** Session lifetime for both the token expiry and the cookie Max-Age. 14 days. */\nvar SESSION_TTL_MS = 12096e5;\n/** Cookie Max-Age in seconds (Set-Cookie uses seconds, not ms). */\nvar SESSION_TTL_SECONDS = SESSION_TTL_MS / 1e3;\nvar _revoked = /* @__PURE__ */ new Set();\nvar _testOverrides = /* @__PURE__ */ new Set();\n/**\n* Read the operator UI login password from the host environment or the\n* file-based stack secret (`knowledge/secrets/op_ui_login_password`).\n*\n* This is the single source of truth for the password — login verification\n* (helpers.ts) and token signing below both use it, so they can never\n* disagree about whether a password exists. Returns \"\" when neither source\n* has a value (first boot, before the wizard runs).\n*/\nfunction getUiLoginPassword() {\n\tconst envValue = process.env.OP_UI_LOGIN_PASSWORD;\n\tif (envValue) return envValue;\n\treturn readSecret(resolveOpenPalmHome(), \"op_ui_login_password\")?.trimEnd() ?? \"\";\n}\n/** Sign `expiresAt` with the login password. Returns null when no password is configured. */\nfunction signToken(expiresAt) {\n\tconst secret = getUiLoginPassword();\n\tif (!secret) return null;\n\treturn createHmac(\"sha256\", secret).update(String(expiresAt)).digest(\"hex\");\n}\n/**\n* Mint a new signed session token with a 14-day TTL.\n* Place the result in the `op_session` cookie.\n* Throws when no login password is configured — callers must verify a\n* password exists (they all do: login/session/setup-complete check first).\n*/\nfunction createSession() {\n\tconst expiresAt = Date.now() + SESSION_TTL_MS;\n\tconst sig = signToken(expiresAt);\n\tif (sig === null) throw new Error(\"Cannot mint a session: no UI login password is configured.\");\n\treturn `${expiresAt}.${sig}`;\n}\n/**\n* Return true iff `token` is a valid, non-expired, non-revoked session.\n*/\nfunction validateSession(token) {\n\tif (!token) return false;\n\tif (_testOverrides.has(token)) return true;\n\tif (_revoked.has(token)) return false;\n\tconst dot = token.lastIndexOf(\".\");\n\tif (dot < 0) return false;\n\tconst expiresAt = Number(token.slice(0, dot));\n\tif (!Number.isFinite(expiresAt) || Date.now() >= expiresAt) return false;\n\tconst sig = token.slice(dot + 1);\n\tconst expected = signToken(expiresAt);\n\tif (expected === null) return false;\n\tif (sig.length !== expected.length) return false;\n\treturn timingSafeEqual(Buffer.from(sig), Buffer.from(expected));\n}\n/**\n* Sliding renewal: validate the old token, return a new one with a fresh\n* 14-day TTL, or return false if the old token is invalid/expired.\n* The caller must place the returned token in the `op_session` cookie.\n*/\nfunction touchSession(token) {\n\tif (!validateSession(token)) return false;\n\treturn createSession();\n}\n/**\n* Revoke a token (logout). The browser cookie must also be cleared by the caller.\n* The revocation list survives until the next server restart. Entries whose\n* embedded expiry has passed are pruned on each call — an expired token fails\n* validation anyway, so keeping it listed is pure memory growth.\n*/\nfunction invalidateSession(token) {\n\tconst now = Date.now();\n\tfor (const revoked of _revoked) {\n\t\tconst expiresAt = Number(revoked.slice(0, revoked.lastIndexOf(\".\")));\n\t\tif (!Number.isFinite(expiresAt) || expiresAt <= now) _revoked.delete(revoked);\n\t}\n\t_revoked.add(token);\n}\n//#endregion\n//#region src/lib/server/helpers.ts\n/**\n* Lazy OpenCode client bound to the currently active endpoint. The client is\n* recreated whenever the active endpoint URL changes so user switches in the\n* UI take effect on the next call.\n*/\nvar _openCodeClient;\nvar _openCodeClientUrl;\nfunction getOpenCodeClient() {\n\tconst { url } = getActiveConnection();\n\tif (!_openCodeClient || url !== _openCodeClientUrl) {\n\t\t_openCodeClient = createOpenCodeClient({ baseUrl: url });\n\t\t_openCodeClientUrl = url;\n\t}\n\treturn _openCodeClient;\n}\nfunction safeTokenCompare(a, b) {\n\tif (typeof a !== \"string\" || typeof b !== \"string\") return false;\n\tif (!a || !b) return false;\n\treturn timingSafeEqual(createHash(\"sha256\").update(a).digest(), createHash(\"sha256\").update(b).digest());\n}\n/** Standard JSON response with request ID header */\nfunction jsonResponse(status, body, requestId = \"\") {\n\treturn new Response(JSON.stringify(body), {\n\t\tstatus,\n\t\theaders: {\n\t\t\t\"content-type\": \"application/json\",\n\t\t\t...requestId ? { \"x-request-id\": requestId } : {}\n\t\t}\n\t});\n}\n/** Standard error envelope */\nfunction errorResponse(status, error, message, details = {}, requestId = \"\") {\n\treturn jsonResponse(status, {\n\t\terror,\n\t\tmessage,\n\t\tdetails,\n\t\trequestId\n\t}, requestId);\n}\n/** Extract or generate request ID */\nfunction getRequestId(event) {\n\treturn event.request.headers.get(\"x-request-id\") || crypto.randomUUID();\n}\n/**\n* Extract raw session token from the `op_session` cookie.\n*\n* Phase 2 of the auth/proxy refactor (docs/technical/auth-and-proxy-refactor-plan.md)\n* removed the legacy `x-admin-token` / `Authorization: Bearer` header fallbacks.\n* The cookie is HttpOnly + SameSite=Strict and is the ONLY credential the browser\n* holds; XSS cannot read it and out-of-process callers must obtain a session via\n* `POST /api/auth/login` (or `/session`) and present the cookie on subsequent\n* requests.\n*/\nfunction extractToken(event) {\n\tconst match = (event.request.headers.get(\"cookie\") ?? \"\").match(/(?:^|;\\s*)op_session=([^;]+)/);\n\tif (match) return match[1];\n\treturn \"\";\n}\n/** Check admin auth — returns error Response or null if OK */\nfunction requireAdmin(event, requestId) {\n\tif (!getUiLoginPassword()) return errorResponse(503, \"admin_not_configured\", \"OP_UI_LOGIN_PASSWORD has not been set. Complete setup first.\", {}, requestId);\n\tif (!validateSession(extractToken(event))) return errorResponse(401, \"unauthorized\", \"Missing or invalid credentials\", {}, requestId);\n\treturn null;\n}\n/**\n* Server-side capability guard (plan ui-runtime-modes-plan.md §6.4, §8.5).\n*\n* Returns a 403 JSON error Response when the resolved host mode does not\n* expose `capability`, or null when it does. This is the SECURITY boundary —\n* the browser-side `hasCapability()` is UX only. The check is deliberately\n* capability-based, not session-based: a valid admin session in a mode\n* without the capability (e.g. `connections:manage` in assistant-container)\n* is still refused. Capability→mode logic itself lives ONLY in\n* computeServerRuntimeContext / resolveCapabilities (plan §8.6); this helper\n* just reads the advertised server capability set.\n*/\nfunction requireCapability(event, capability, requestId) {\n\tconst ctx = computeServerRuntimeContext(event);\n\tif (!ctx.serverCapabilities.includes(capability)) return errorResponse(403, \"capability_not_available\", `This deployment (${ctx.hostMode}) does not provide the '${capability}' capability.`, {\n\t\tcapability,\n\t\thostMode: ctx.hostMode\n\t}, requestId);\n\treturn null;\n}\n/**\n* Identify caller by the presented `op_session` cookie.\n*\n* Returns \"admin\" when the cookie holds a valid session token.\n*/\nfunction identifyCallerByToken(event) {\n\tif (!getUiLoginPassword()) return null;\n\tif (validateSession(extractToken(event))) return \"admin\";\n\treturn null;\n}\n/** Parse JSON body safely — returns discriminated result with error type */\nasync function parseJsonBody(request, maxBytes = 1048576) {\n\ttry {\n\t\tconst contentLength = request.headers.get(\"content-length\");\n\t\tif (contentLength && parseInt(contentLength, 10) > maxBytes) return { error: \"too_large\" };\n\t\tconst parsed = await request.json();\n\t\tif (parsed === null || typeof parsed !== \"object\" || Array.isArray(parsed)) return { error: \"invalid_json\" };\n\t\treturn { data: parsed };\n\t} catch (e) {\n\t\tconsole.warn(\"[helpers] Failed to parse JSON request body\", e);\n\t\treturn { error: \"invalid_json\" };\n\t}\n}\n/** Convert a ParseJsonBodyError to an appropriate HTTP error response */\nfunction jsonBodyError(err, requestId) {\n\tif (err.error === \"too_large\") return errorResponse(413, \"too_large\", \"Request body too large\", {}, requestId);\n\treturn errorResponse(400, \"invalid_json\", \"Request body must be valid JSON\", {}, requestId);\n}\n/**\n* Auth + JSON body wrapper for admin POST/DELETE handlers.\n*\n* Replaces the 4-line boilerplate copy-pasted across 30+ routes:\n*   const requestId = getRequestId(event);\n*   const authError = requireAdmin(event, requestId);\n*   if (authError) return authError;\n*   const result = await parseJsonBody(event.request);\n*   if ('error' in result) return jsonBodyError(result, requestId);\n*\n* Use for routes that need both auth and a JSON body. For auth-only or\n* GET routes, call `requireAdmin` directly.\n*/\nasync function withAdminBody(event, handler) {\n\tconst requestId = getRequestId(event);\n\tconst { security } = computeServerRuntimeContext(event);\n\tconst originError = checkOriginHeader(event.request, security.csrfMode, requestId);\n\tif (originError) return originError;\n\tconst authError = requireAdmin(event, requestId);\n\tif (authError) return authError;\n\tconst result = await parseJsonBody(event.request);\n\tif (\"error\" in result) return jsonBodyError(result, requestId);\n\treturn handler({\n\t\trequestId,\n\t\tbody: result.data\n\t});\n}\nfunction hostNameFromHeader(hostHeader) {\n\tconst normalized = hostHeader.trim().replace(/\\.$/, \"\");\n\ttry {\n\t\treturn new URL(`http://${normalized}`).hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n\t} catch {\n\t\treturn null;\n\t}\n}\nfunction isLoopbackHost(hostHeader) {\n\tconst hostname = hostNameFromHeader(hostHeader);\n\tif (!hostname) return false;\n\treturn hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"::1\";\n}\nfunction isSameSite(request, origin) {\n\tconst requestHost = hostNameFromHeader(request.headers.get(\"host\") ?? \"\");\n\tif (!requestHost) return false;\n\treturn requestHost === origin.hostname.toLowerCase();\n}\nfunction checkHostHeader(request, requestId) {\n\tconst host = request.headers.get(\"host\") ?? \"\";\n\tif (isLoopbackHost(host) || isRemoteSetupAllowed()) return null;\n\treturn new Response(JSON.stringify({\n\t\terror: \"invalid_host\",\n\t\thost: host.trim().replace(/\\.$/, \"\"),\n\t\tmessage: \"Request rejected: Host header does not match allowed hosts. The UI binds to loopback (127.0.0.1) only; reach it via localhost or an SSH tunnel/reverse proxy, or set OP_ALLOW_REMOTE_SETUP=1 to allow remote access.\",\n\t\t...requestId ? { requestId } : {}\n\t}), {\n\t\tstatus: 400,\n\t\theaders: { \"content-type\": \"application/json\" }\n\t});\n}\n/**\n* Reject POST/PUT/DELETE requests whose Origin header does not match\n* localhost or 127.0.0.1. Requests with no Origin (non-browser clients)\n* are always allowed.\n*\n* @param request  Incoming Request\n* @returns        A 403 Response if the origin is rejected; null if allowed\n*/\nfunction checkOriginHeader(request, csrfMode = \"loopback-origin\", requestId) {\n\tconst method = request.method.toUpperCase();\n\tif (method === \"GET\" || method === \"HEAD\" || method === \"OPTIONS\") return null;\n\tconst origin = request.headers.get(\"origin\");\n\tif (!origin) return null;\n\ttry {\n\t\tconst u = new URL(origin);\n\t\tswitch (csrfMode) {\n\t\t\tcase \"loopback-origin\":\n\t\t\t\tif (isLoopbackHost(u.host)) return null;\n\t\t\t\tif (isRemoteSetupAllowed() && u.host === (request.headers.get(\"host\") ?? \"\").trim()) return null;\n\t\t\t\tbreak;\n\t\t\tcase \"same-site\":\n\t\t\t\tif (isSameSite(request, u)) return null;\n\t\t\t\tbreak;\n\t\t\tcase \"bearer-token\":\n\t\t\t\tif (request.headers.get(\"authorization\")) return null;\n\t\t\t\tif (isSameSite(request, u)) return null;\n\t\t\t\tbreak;\n\t\t}\n\t} catch {}\n\treturn new Response(JSON.stringify({\n\t\terror: \"forbidden_origin\",\n\t\torigin,\n\t\t...requestId ? { requestId } : {}\n\t}), {\n\t\tstatus: 403,\n\t\theaders: { \"content-type\": \"application/json\" }\n\t});\n}\nNumber(process.env.PORT ?? 3880);\n//#endregion\nexport { invalidateSession as _, getRequestId as a, jsonResponse as c, requireCapability as d, safeTokenCompare as f, getUiLoginPassword as g, createSession as h, getOpenCodeClient as i, parseJsonBody as l, SESSION_TTL_SECONDS as m, checkOriginHeader as n, identifyCallerByToken as o, withAdminBody as p, errorResponse as r, jsonBodyError as s, checkHostHeader as t, requireAdmin as u, touchSession as v };\n"],"names":[],"mappings":";;;;;;AAMA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,cAAc,GAAG,OAAO;AAC5B;AACG,IAAC,mBAAmB,GAAG,cAAc,GAAG;AAC3C,IAAI,QAAQ,mBAAmB,IAAI,GAAG,EAAE;AACxC,IAAI,cAAc,mBAAmB,IAAI,GAAG,EAAE;AAC9C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,GAAG;AAC9B,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB;AAClD,CAAC,IAAI,QAAQ,EAAE,OAAO,QAAQ;AAC9B,CAAC,OAAO,UAAU,CAAC,mBAAmB,EAAE,EAAE,sBAAsB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;AAClF;AACA;AACA,SAAS,SAAS,CAAC,SAAS,EAAE;AAC9B,CAAC,MAAM,MAAM,GAAG,kBAAkB,EAAE;AACpC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI;AACzB,CAAC,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;AAC5E;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc;AAC9C,CAAC,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC;AACjC,CAAC,IAAI,GAAG,KAAK,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC;AAChG,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7B;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,KAAK,EAAE;AAChC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,KAAK;AACzB,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,IAAI;AAC3C,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK;AACtC,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC;AACnC,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,OAAO,KAAK;AAC1B,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,EAAE,OAAO,KAAK;AACzE,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;AACjC,CAAC,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC;AACtC,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,OAAO,KAAK;AACpC,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,OAAO,KAAK;AACjD,CAAC,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAChE;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK;AAC1C,CAAC,OAAO,aAAa,EAAE;AACvB;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE;AAClC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;AACvB,CAAC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE;AACjC,EAAE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;AACtE,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;AAC/E,CAAC;AACD,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;AACpB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,eAAe;AACnB,IAAI,kBAAkB;AACtB,SAAS,iBAAiB,GAAG;AAC7B,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,mBAAmB,EAAE;AACtC,CAAC,IAAI,CAAC,eAAe,IAAI,GAAG,KAAK,kBAAkB,EAAE;AACrD,EAAE,eAAe,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC1D,EAAE,kBAAkB,GAAG,GAAG;AAC1B,CAAC;AACD,CAAC,OAAO,eAAe;AACvB;AACA,SAAS,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE;AAChC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,OAAO,KAAK;AACjE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,KAAK;AAC3B,CAAC,OAAO,eAAe,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AACzG;AACA;AACA,SAAS,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,EAAE,EAAE;AACpD,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;AAC3C,EAAE,MAAM;AACR,EAAE,OAAO,EAAE;AACX,GAAG,cAAc,EAAE,kBAAkB;AACrC,GAAG,GAAG,SAAS,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG;AAClD;AACA,EAAE,CAAC;AACH;AACA;AACA,SAAS,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,EAAE;AAC7E,CAAC,OAAO,YAAY,CAAC,MAAM,EAAE;AAC7B,EAAE,KAAK;AACP,EAAE,OAAO;AACT,EAAE,OAAO;AACT,EAAE;AACF,EAAE,EAAE,SAAS,CAAC;AACd;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE;AACxE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE;AAC7B,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,8BAA8B,CAAC;AAChG,CAAC,IAAI,KAAK,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC;AAC3B,CAAC,OAAO,EAAE;AACV;AACA;AACA,SAAS,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE;AACxC,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,sBAAsB,EAAE,8DAA8D,EAAE,EAAE,EAAE,SAAS,CAAC;AAC5J,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,gCAAgC,EAAE,EAAE,EAAE,SAAS,CAAC;AACtI,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE;AACzD,CAAC,MAAM,GAAG,GAAG,2BAA2B,CAAC,KAAK,CAAC;AAC/C,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,0BAA0B,EAAE,CAAC,iBAAiB,EAAE,GAAG,CAAC,QAAQ,CAAC,wBAAwB,EAAE,UAAU,CAAC,aAAa,CAAC,EAAE;AAC/L,EAAE,UAAU;AACZ,EAAE,QAAQ,EAAE,GAAG,CAAC;AAChB,EAAE,EAAE,SAAS,CAAC;AACd,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,KAAK,EAAE;AACtC,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,OAAO,IAAI;AACvC,CAAC,IAAI,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,OAAO;AACzD,CAAC,OAAO,IAAI;AACZ;AACA;AACA,eAAe,aAAa,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,EAAE;AAC1D,CAAC,IAAI;AACL,EAAE,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;AAC7D,EAAE,IAAI,aAAa,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE;AAC5F,EAAE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE;AACrC,EAAE,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE;AAC9G,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;AACzB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,OAAO,CAAC,IAAI,CAAC,6CAA6C,EAAE,CAAC,CAAC;AAChE,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE;AAClC,CAAC;AACD;AACA;AACA,SAAS,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE;AACvC,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,EAAE,OAAO,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,EAAE,EAAE,SAAS,CAAC;AAC/G,CAAC,OAAO,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,iCAAiC,EAAE,EAAE,EAAE,SAAS,CAAC;AAC5F;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC;AACxD,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;AACnF,CAAC,IAAI,WAAW,EAAE,OAAO,WAAW;AACpC,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;AACjD,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC;AAClD,CAAC,IAAI,OAAO,IAAI,MAAM,EAAE,OAAO,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC;AAC/D,CAAC,OAAO,OAAO,CAAC;AAChB,EAAE,SAAS;AACX,EAAE,IAAI,EAAE,MAAM,CAAC;AACf,EAAE,CAAC;AACH;AACA,SAAS,kBAAkB,CAAC,UAAU,EAAE;AACxC,CAAC,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AACxD,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;AACvF,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,IAAI;AACb,CAAC;AACD;AACA,SAAS,cAAc,CAAC,UAAU,EAAE;AACpC,CAAC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,UAAU,CAAC;AAChD,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AAC5B,CAAC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK;AAClF;AACA,SAAS,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE;AACrC,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAC1E,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,KAAK;AAC/B,CAAC,OAAO,WAAW,KAAK,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE;AACrD;AACA,SAAS,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE;AAC7C,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;AAC/C,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,oBAAoB,EAAE,EAAE,OAAO,IAAI;AAChE,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AACpC,EAAE,KAAK,EAAE,cAAc;AACvB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AACtC,EAAE,OAAO,EAAE,sNAAsN;AACjO,EAAE,GAAG,SAAS,GAAG,EAAE,SAAS,EAAE,GAAG;AACjC,EAAE,CAAC,EAAE;AACL,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AAC/C,EAAE,CAAC;AACH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,OAAO,EAAE,QAAQ,GAAG,iBAAiB,EAAE,SAAS,EAAE;AAC7E,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;AAC5C,CAAC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,OAAO,IAAI;AAC/E,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC7C,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI;AACzB,CAAC,IAAI;AACL,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC;AAC3B,EAAE,QAAQ,QAAQ;AAClB,GAAG,KAAK,iBAAiB;AACzB,IAAI,IAAI,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AAC3C,IAAI,IAAI,oBAAoB,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,IAAI;AACpG,IAAI;AACJ,GAAG,KAAK,WAAW;AACnB,IAAI,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,OAAO,IAAI;AAC3C,IAAI;AACJ,GAAG,KAAK,cAAc;AACtB,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,OAAO,IAAI;AACzD,IAAI,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,OAAO,IAAI;AAC3C,IAAI;AACJ;AACA,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AACpC,EAAE,KAAK,EAAE,kBAAkB;AAC3B,EAAE,MAAM;AACR,EAAE,GAAG,SAAS,GAAG,EAAE,SAAS,EAAE,GAAG;AACjC,EAAE,CAAC,EAAE;AACL,EAAE,MAAM,EAAE,GAAG;AACb,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AAC/C,EAAE,CAAC;AACH;AACA,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC;;;;"}

package/build/server/chunks/hooks.server-Bzj8OieV.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"hooks.server-Bzj8OieV.js","sources":["../../../.svelte-kit/adapter-node/entries/hooks.server.js"],"sourcesContent":["import { i as redirect } from \"../chunks/exports.js\";\nimport { Ot as createLogger, St as stackDirFor, X as readStackRuntimeEnv, bt as resolveOpenPalmHome, it as readSecret } from \"../chunks/compose-args.js\";\nimport { V as isSetupComplete, i as reconcileMdnsResponder } from \"../chunks/src.js\";\nimport { l as isRemoteSetupAllowed, r as collectNetworkExposureWarnings } from \"../chunks/network-preset.js\";\nimport { t as getState } from \"../chunks/state.js\";\nimport { a as getRequestId, n as checkOriginHeader, o as identifyCallerByToken, t as checkHostHeader, v as touchSession } from \"../chunks/helpers.js\";\nimport { t as computeServerRuntimeContext } from \"../chunks/features.js\";\nimport { r as sessionCookieHeader, t as SESSION_COOKIE_NAME } from \"../chunks/session-cookie.js\";\nimport { i as BLOCKING_LANDINGS, n as getCachedLocalInstallState, r as resolveRequestLanding, t as _resetLaunchCache } from \"../chunks/landing.js\";\n//#region src/hooks.server.ts\nvar logger = createLogger(\"admin\");\nvar startupApplyDone = false;\nfunction loadProcessEnv() {\n\tif (startupApplyDone) return;\n\tstartupApplyDone = true;\n\tfor (const line of collectNetworkExposureWarnings(process.env)) logger.warn(line);\n\ttry {\n\t\tconst state = getState();\n\t\tif (!process.env.OP_UI_LOGIN_PASSWORD) {\n\t\t\tconst pw = readSecret(state.homeDir, \"op_ui_login_password\");\n\t\t\tif (pw) process.env.OP_UI_LOGIN_PASSWORD = pw.trimEnd();\n\t\t}\n\t\tconst stackVars = readStackRuntimeEnv(state.homeDir);\n\t\tfor (const [k, v] of Object.entries(stackVars)) if (v && !process.env[k]) process.env[k] = v;\n\t\treconcileMdnsResponder(state.homeDir);\n\t} catch (err) {\n\t\tlogger.error(\"process env load failed\", { error: String(err) });\n\t}\n}\nloadProcessEnv();\nvar SETUP_PATHS = [\n\t\"/setup\",\n\t\"/api/setup\",\n\t\"/health\",\n\t\"/guardian/health\"\n];\nfunction isLocalhostAddress(ip) {\n\treturn ip === \"127.0.0.1\" || ip === \"::1\" || ip === \"::ffff:127.0.0.1\";\n}\nvar handle = async ({ event, resolve }) => {\n\tconst runtimeContext = computeServerRuntimeContext(event);\n\tconst requestId = getRequestId(event);\n\tconst hostError = checkHostHeader(event.request, requestId);\n\tif (hostError) return hostError;\n\tconst originError = checkOriginHeader(event.request, runtimeContext.security.csrfMode, requestId);\n\tif (originError) return originError;\n\tconst path = event.url.pathname;\n\tconst isAuthPath = path === \"/login\" || path.startsWith(\"/login/\");\n\tconst wantsHtml = event.request.method === \"GET\" && (event.request.headers.get(\"accept\") ?? \"\").includes(\"text/html\");\n\tif ((path === \"/host\" || path.startsWith(\"/host/\")) && !runtimeContext.serverCapabilities.includes(\"host:stack:read\")) redirect(302, \"/chat\");\n\tconst isSetupPath = SETUP_PATHS.some((p) => path === p || path.startsWith(`${p}/`));\n\tconst homeDir = resolveOpenPalmHome();\n\tconst setupComplete = isSetupComplete(homeDir);\n\tconst localInstallState = getCachedLocalInstallState(stackDirFor(homeDir), homeDir);\n\tif (wantsHtml && !setupComplete && localInstallState !== \"not_installed\" && !isSetupPath && !isAuthPath && !path.startsWith(\"/admin\")) redirect(302, \"/setup\");\n\tif (isSetupPath && !setupComplete && !isRemoteSetupAllowed()) {\n\t\tif (!isLocalhostAddress(event.getClientAddress())) return new Response(JSON.stringify({\n\t\t\terror: \"setup_localhost_only\",\n\t\t\tmessage: \"Setup is only accessible from the host machine until installation is complete.\"\n\t\t}), {\n\t\t\tstatus: 403,\n\t\t\theaders: { \"content-type\": \"application/json\" }\n\t\t});\n\t}\n\tif (!isSetupPath) {\n\t\tconst landing = await resolveRequestLanding(event);\n\t\tconst [landingPath] = landing.split(\"?\");\n\t\tconst usageExempt = (path.startsWith(\"/chat\") || path.startsWith(\"/advanced\") || path.startsWith(\"/connections\")) && !BLOCKING_LANDINGS.has(landingPath);\n\t\tconst exempt = path.startsWith(\"/api/\") || path.startsWith(\"/proxy/\") || path.startsWith(\"/login\") || path.startsWith(\"/health\") || path.startsWith(\"/guardian/health\") || path.startsWith(\"/host\") || path.startsWith(\"/admin\") || usageExempt;\n\t\tif (path === \"/\" || path !== landingPath && !exempt) redirect(302, landing);\n\t}\n\tevent.locals.role = identifyCallerByToken(event);\n\tlet renewedCookie = null;\n\tif (event.locals.role === \"admin\") {\n\t\tconst match = (event.request.headers.get(\"cookie\") ?? \"\").match(new RegExp(`(?:^|;\\\\s*)${SESSION_COOKIE_NAME}=([^;]+)`));\n\t\tconst renewed = match ? touchSession(match[1]) : false;\n\t\tif (renewed) renewedCookie = sessionCookieHeader(renewed, event.request);\n\t}\n\tif (wantsHtml && !event.locals.role && !isSetupPath && !isAuthPath) {\n\t\tconst redirectTo = path + event.url.search;\n\t\tredirect(302, `/login?redirectTo=${encodeURIComponent(redirectTo)}`);\n\t}\n\tconst response = await resolve(event);\n\tif (renewedCookie) {\n\t\tif (!(response.headers.get(\"set-cookie\") ?? \"\").includes(`op_session=`)) response.headers.append(\"set-cookie\", renewedCookie);\n\t}\n\tresponse.headers.set(\"X-Frame-Options\", path === \"/api/host/akm/health-report\" ? \"SAMEORIGIN\" : \"DENY\");\n\tresponse.headers.set(\"X-Content-Type-Options\", \"nosniff\");\n\tresponse.headers.set(\"Referrer-Policy\", \"no-referrer\");\n\treturn response;\n};\n//#endregion\nexport { _resetLaunchCache, handle };\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AASA;AACA,IAAI,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC;AAClC,IAAI,gBAAgB,GAAG,KAAK;AAC5B,SAAS,cAAc,GAAG;AAC1B,CAAC,IAAI,gBAAgB,EAAE;AACvB,CAAC,gBAAgB,GAAG,IAAI;AACxB,CAAC,KAAK,MAAM,IAAI,IAAI,8BAA8B,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;AAClF,CAAC,IAAI;AACL,EAAE,MAAM,KAAK,GAAG,QAAQ,EAAE;AAC1B,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE;AACzC,GAAG,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,sBAAsB,CAAC;AAC/D,GAAG,IAAI,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,EAAE,CAAC,OAAO,EAAE;AAC1D,EAAE;AACF,EAAE,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC;AACtD,EAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC9F,EAAE,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC;AACvC,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AACjE,CAAC;AACD;AACA,cAAc,EAAE;AAChB,IAAI,WAAW,GAAG;AAClB,CAAC,QAAQ;AACT,CAAC,YAAY;AACb,CAAC,SAAS;AACV,CAAC;AACD,CAAC;AACD,SAAS,kBAAkB,CAAC,EAAE,EAAE;AAChC,CAAC,OAAO,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,kBAAkB;AACvE;AACG,IAAC,MAAM,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;AAC3C,CAAC,MAAM,cAAc,GAAG,2BAA2B,CAAC,KAAK,CAAC;AAC1D,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC;AACtC,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC;AAC5D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS;AAChC,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;AAClG,CAAC,IAAI,WAAW,EAAE,OAAO,WAAW;AACpC,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ;AAChC,CAAC,MAAM,UAAU,GAAG,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;AACnE,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,WAAW,CAAC;AACtH,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,kBAAkB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;AAC9I,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC,MAAM,OAAO,GAAG,mBAAmB,EAAE;AACtC,CAAC,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC;AAC/C,CAAC,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;AACpF,CAAC,IAAI,SAAS,IAAI,CAAC,aAAa,IAAI,iBAAiB,KAAK,eAAe,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;AAC/J,CAAC,IAAI,WAAW,IAAI,CAAC,aAAa,IAAI,CAAC,oBAAoB,EAAE,EAAE;AAC/D,EAAE,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;AACxF,GAAG,KAAK,EAAE,sBAAsB;AAChC,GAAG,OAAO,EAAE;AACZ,GAAG,CAAC,EAAE;AACN,GAAG,MAAM,EAAE,GAAG;AACd,GAAG,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;AAChD,GAAG,CAAC;AACJ,CAAC;AACD,CAAC,IAAI,CAAC,WAAW,EAAE;AACnB,EAAE,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC;AACpD,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;AAC1C,EAAE,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1J,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,WAAW;AACjP,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,WAAW,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;AAC7E,CAAC;AACD,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC;AACjD,CAAC,IAAI,aAAa,GAAG,IAAI;AACzB,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE;AACpC,EAAE,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1H,EAAE,MAAM,OAAO,GAAG,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK;AACxD,EAAE,IAAI,OAAO,EAAE,aAAa,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;AAC1E,CAAC;AACD,CAAC,IAAI,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,EAAE;AACrE,EAAE,MAAM,UAAU,GAAG,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM;AAC5C,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AACD,CAAC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC;AACtC,CAAC,IAAI,aAAa,EAAE;AACpB,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC;AAC/H,CAAC;AACD,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,KAAK,6BAA6B,GAAG,YAAY,GAAG,MAAM,CAAC;AACxG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC;AAC1D,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC;AACvD,CAAC,OAAO,QAAQ;AAChB;;;;"}

package/build/server/chunks/http-CfHMreaI.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"http-CfHMreaI.js","sources":["../../../.svelte-kit/adapter-node/chunks/http.js"],"sourcesContent":["import { d as basicAuthHeader, i as getActiveConnection } from \"./endpoints.js\";\n//#region src/lib/server/opencode/http.ts\n/**\n* HTTP transport for talking to the active OpenCode endpoint.\n*\n* Used by sibling modules (`config.ts`, `catalog.ts`) — not part of the\n* public API of `$lib/server/opencode`. Reads the active endpoint per-call\n* so user switches in the UI take effect immediately.\n*/\nasync function opencodeFetch(path, init) {\n\tconst endpoint = getActiveConnection();\n\tconst headers = {\n\t\t\"content-type\": \"application/json\",\n\t\t...init?.headers\n\t};\n\tif (endpoint.password) headers.authorization = basicAuthHeader(endpoint.username || \"opencode\", endpoint.password);\n\tconst response = await fetch(`${endpoint.url}${path}`, {\n\t\t...init,\n\t\theaders\n\t});\n\tif (!response.ok) throw new Error(`${init?.method ?? \"GET\"} ${path} failed with ${response.status}`);\n\tif (response.status === 204) return;\n\treturn await response.json();\n}\n//#endregion\nexport { opencodeFetch as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE;AACzC,CAAC,MAAM,QAAQ,GAAG,mBAAmB,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG;AACjB,EAAE,cAAc,EAAE,kBAAkB;AACpC,EAAE,GAAG,IAAI,EAAE;AACX,EAAE;AACF,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,GAAG,eAAe,CAAC,QAAQ,CAAC,QAAQ,IAAI,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC;AACnH,CAAC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE;AACxD,EAAE,GAAG,IAAI;AACT,EAAE;AACF,EAAE,CAAC;AACH,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACrG,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE;AAC9B,CAAC,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE;AAC7B;;;;"}

package/build/server/chunks/landing-DhaVkN2f.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"landing-DhaVkN2f.js","sources":["../../../.svelte-kit/adapter-node/chunks/landing.js"],"sourcesContent":["import { t as buildComposeOptions } from \"./compose-args.js\";\nimport { m as composePs } from \"./docker.js\";\nimport { B as detectRuntime, L as classifyLocalInstall, R as deriveLaunchStatus, z as deriveLocalStackState } from \"./src.js\";\nimport { t as getState } from \"./state.js\";\nimport { o as listRemoteStatuses } from \"./endpoints.js\";\nimport { t as computeServerRuntimeContext } from \"./features.js\";\nimport { i as resolveCapabilities } from \"./runtime-context.svelte.js\";\n//#region src/lib/resolve-landing.ts\n/**\n* Where the host admin surface lives. Phase 4 moved it from /admin to /host\n* (/admin/* is a dead namespace — router 404, no alias).\n*/\nvar HOST_ADMIN_LANDING = \"/host\";\n/**\n* The blocking-migration landing surface.\n*\n* K4 (review 2026-07-11): callers that need to know whether a resolved\n* landing is BLOCKING (usage routes must not bypass it) must check\n* membership in BLOCKING_LANDINGS below — never string-compare against this\n* literal directly. Blocking-ness is a property of the landing STATE, not a\n* magic string duplicated at each call site; encoding it only as a literal\n* comparison means a future second blocking landing would return a new\n* string and every literal-match call site would silently keep exempting\n* usage routes from it.\n*/\nvar HOST_ATTENTION_LANDING = \"/attention\";\n/**\n* Landings that block the usage routes (/chat, /advanced, /connections)\n* from bypassing the launch-routing redirect (hooks.server.ts). Today only\n* HOST_ATTENTION_LANDING is blocking; adding a future second blocking\n* landing means adding it here — the usage-route gate then covers it\n* automatically, with no call-site changes required.\n*/\nvar BLOCKING_LANDINGS = new Set([HOST_ATTENTION_LANDING]);\n/** Resolve the landing path for a session (plan §6.5). Pure — no I/O, no\n*  global state; the gate is CAPABILITY-driven, not hostMode-driven. */\nfunction resolveLanding(ctx, state) {\n\tif (ctx.effectiveCapabilities.includes(\"host:setup\")) {\n\t\tif (state.migration.status === \"pending\") return HOST_ATTENTION_LANDING;\n\t\tif (state.local.state === \"not_installed\") return state.connections.length === 0 ? \"/setup\" : \"/chat\";\n\t\tif (state.local.state === \"setup_incomplete\") return \"/setup\";\n\t\tif (state.local.state === \"installed_offline\") return HOST_ADMIN_LANDING;\n\t\tif (state.local.state === \"installed_broken\") return `${HOST_ADMIN_LANDING}?tab=diagnostics`;\n\t\treturn \"/chat\";\n\t}\n\tif (ctx.hostMode === \"assistant-container\") return \"/chat\";\n\tif (ctx.hostMode === \"pwa-static\") return state.connections.length === 0 ? \"/connections/new\" : \"/chat\";\n\treturn \"/chat\";\n}\n//#endregion\n//#region src/lib/server/landing.ts\nvar launchRoutingCache = null;\nvar installStateCache = null;\n/** Test-only: clear the 5s launch-routing cache so each test resolves fresh. */\nfunction _resetLaunchCache() {\n\tlaunchRoutingCache = null;\n\tinstallStateCache = null;\n}\n/**\n* classifyLocalInstall, cached for 5s (K3). Shared by hooks.server.ts's\n* setup guard and resolveLaunchRouting() below, so a request that touches\n* both call sites only classifies the install once.\n*/\nfunction getCachedLocalInstallState(stackDir, homeDir) {\n\tif (installStateCache && installStateCache.expiresAt > Date.now()) return installStateCache.value;\n\tconst value = classifyLocalInstall(stackDir, homeDir);\n\tinstallStateCache = {\n\t\tvalue,\n\t\texpiresAt: Date.now() + 5e3\n\t};\n\treturn value;\n}\nfunction parseComposePsServices(stdout) {\n\tconst services = [];\n\tfor (const line of stdout.split(\"\\n\")) {\n\t\tconst trimmed = line.trim();\n\t\tif (!trimmed) continue;\n\t\ttry {\n\t\t\tconst parsed = JSON.parse(trimmed);\n\t\t\tservices.push({\n\t\t\t\tservice: String(parsed.Service ?? parsed.Name ?? \"\"),\n\t\t\t\tstate: String(parsed.State ?? \"\"),\n\t\t\t\thealth: String(parsed.Health ?? \"\")\n\t\t\t});\n\t\t} catch {}\n\t}\n\treturn services;\n}\nasync function resolveLaunchRouting() {\n\tif (launchRoutingCache && launchRoutingCache.expiresAt > Date.now()) return launchRoutingCache.value;\n\tconst state = getState();\n\tconst installState = getCachedLocalInstallState(state.stackDir, state.homeDir);\n\tconst composeResult = await composePs(buildComposeOptions(state));\n\tconst value = {\n\t\tinstallState,\n\t\tlaunch: deriveLaunchStatus({\n\t\t\tlocal: {\n\t\t\t\tstate: deriveLocalStackState(installState, composeResult.ok ? parseComposePsServices(composeResult.stdout) : []),\n\t\t\t\truntime: installState === \"not_installed\" ? await detectRuntime() : void 0,\n\t\t\t\tdetail: { installState }\n\t\t\t},\n\t\t\tremotes: await listRemoteStatuses()\n\t\t})\n\t};\n\tlaunchRoutingCache = {\n\t\tvalue,\n\t\texpiresAt: Date.now() + 5e3\n\t};\n\treturn value;\n}\n/**\n* Resolve the landing path for a request via resolveLanding() (plan §6.5).\n* May return a path with a query string (e.g. '/host?tab=diagnostics').\n*/\nasync function resolveRequestLanding(event) {\n\tconst serverCtx = computeServerRuntimeContext(event);\n\tconst clientContext = { displayMode: \"browser\" };\n\tconst ctx = {\n\t\t...serverCtx,\n\t\tclientContext,\n\t\teffectiveCapabilities: resolveCapabilities(serverCtx.serverCapabilities, clientContext)\n\t};\n\tconst { installState, launch } = await resolveLaunchRouting();\n\tconst localState = installState === \"setup_incomplete\" && launch.local.state === \"running\" ? \"setup_incomplete\" : launch.local.state;\n\tconst connections = [...launch.hasHealthyLocal ? [{ id: \"default\" }] : [], ...launch.remotes.filter((r) => r.state === \"accessible\")];\n\treturn resolveLanding(ctx, {\n\t\tmigration: { status: \"none\" },\n\t\tlocal: { state: localState },\n\t\tconnections\n\t});\n}\n//#endregion\nexport { BLOCKING_LANDINGS as i, getCachedLocalInstallState as n, resolveRequestLanding as r, _resetLaunchCache as t };\n"],"names":[],"mappings":";;;;;;AAOA;AACA;AACA;AACA;AACA;AACA,IAAI,kBAAkB,GAAG,OAAO;AAChC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,sBAAsB,GAAG,YAAY;AACzC;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,sBAAsB,CAAC;AACxD;AACA;AACA,SAAS,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE;AACpC,CAAC,IAAI,GAAG,CAAC,qBAAqB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE;AACvD,EAAE,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,OAAO,sBAAsB;AACzE,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,eAAe,EAAE,OAAO,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,GAAG,QAAQ,GAAG,OAAO;AACvG,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,kBAAkB,EAAE,OAAO,QAAQ;AAC/D,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,mBAAmB,EAAE,OAAO,kBAAkB;AAC1E,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,kBAAkB,EAAE,OAAO,CAAC,EAAE,kBAAkB,CAAC,gBAAgB,CAAC;AAC9F,EAAE,OAAO,OAAO;AAChB,CAAC;AACD,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,qBAAqB,EAAE,OAAO,OAAO;AAC3D,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,OAAO,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,GAAG,kBAAkB,GAAG,OAAO;AACxG,CAAC,OAAO,OAAO;AACf;AACA;AACA;AACA,IAAI,kBAAkB,GAAG,IAAI;AAC7B,IAAI,iBAAiB,GAAG,IAAI;AAC5B;AACA,SAAS,iBAAiB,GAAG;AAC7B,CAAC,kBAAkB,GAAG,IAAI;AAC1B,CAAC,iBAAiB,GAAG,IAAI;AACzB;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,0BAA0B,CAAC,QAAQ,EAAE,OAAO,EAAE;AACvD,CAAC,IAAI,iBAAiB,IAAI,iBAAiB,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,iBAAiB,CAAC,KAAK;AAClG,CAAC,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC;AACtD,CAAC,iBAAiB,GAAG;AACrB,EAAE,KAAK;AACP,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG;AAC1B,EAAE;AACF,CAAC,OAAO,KAAK;AACb;AACA,SAAS,sBAAsB,CAAC,MAAM,EAAE;AACxC,CAAC,MAAM,QAAQ,GAAG,EAAE;AACpB,CAAC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;AACxC,EAAE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE;AAC7B,EAAE,IAAI,CAAC,OAAO,EAAE;AAChB,EAAE,IAAI;AACN,GAAG,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;AACrC,GAAG,QAAQ,CAAC,IAAI,CAAC;AACjB,IAAI,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;AACxD,IAAI,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;AACrC,IAAI,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE;AACtC,IAAI,CAAC;AACL,EAAE,CAAC,CAAC,MAAM,CAAC;AACX,CAAC;AACD,CAAC,OAAO,QAAQ;AAChB;AACA,eAAe,oBAAoB,GAAG;AACtC,CAAC,IAAI,kBAAkB,IAAI,kBAAkB,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,kBAAkB,CAAC,KAAK;AACrG,CAAC,MAAM,KAAK,GAAG,QAAQ,EAAE;AACzB,CAAC,MAAM,YAAY,GAAG,0BAA0B,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC;AAC/E,CAAC,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,YAAY;AACd,EAAE,MAAM,EAAE,kBAAkB,CAAC;AAC7B,GAAG,KAAK,EAAE;AACV,IAAI,KAAK,EAAE,qBAAqB,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE,GAAG,sBAAsB,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;AACpH,IAAI,OAAO,EAAE,YAAY,KAAK,eAAe,GAAG,MAAM,aAAa,EAAE,GAAG,MAAM;AAC9E,IAAI,MAAM,EAAE,EAAE,YAAY;AAC1B,IAAI;AACJ,GAAG,OAAO,EAAE,MAAM,kBAAkB;AACpC,GAAG;AACH,EAAE;AACF,CAAC,kBAAkB,GAAG;AACtB,EAAE,KAAK;AACP,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG;AAC1B,EAAE;AACF,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA,eAAe,qBAAqB,CAAC,KAAK,EAAE;AAC5C,CAAC,MAAM,SAAS,GAAG,2BAA2B,CAAC,KAAK,CAAC;AACrD,CAAC,MAAM,aAAa,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE;AACjD,CAAC,MAAM,GAAG,GAAG;AACb,EAAE,GAAG,SAAS;AACd,EACE,qBAAqB,EAAE,mBAAmB,CAAC,SAAS,CAAC,kBAAkB,EAAE,aAAa;AACxF,EAAE;AACF,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,oBAAoB,EAAE;AAC9D,CAAC,MAAM,UAAU,GAAG,YAAY,KAAK,kBAAkB,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,GAAG,kBAAkB,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK;AACrI,CAAC,MAAM,WAAW,GAAG,CAAC,GAAG,MAAM,CAAC,eAAe,GAAG,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC;AACtI,CAAC,OAAO,cAAc,CAAC,GAAG,EAAE;AAC5B,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;AAC/B,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE;AAC9B,EAAE;AACF,EAAE,CAAC;AACH;;;;"}

package/build/server/chunks/network-preset-CJ1RRnki.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"network-preset-CJ1RRnki.js","sources":["../../../.svelte-kit/adapter-node/chunks/addon-ids.js","../../../.svelte-kit/adapter-node/chunks/provider-constants.js","../../../.svelte-kit/adapter-node/chunks/network-preset.js"],"sourcesContent":["//#region ../lib/src/control-plane/addon-ids.ts\n/**\n* Canonical list of built-in addon IDs.\n*\n* Single source of truth — imported by both addons.ts and migrations.ts.\n* Update THIS file (and only this file) when adding or removing a built-in addon.\n*\n* Intentionally a pure-constants file with no imports so it can be safely\n* imported from anywhere without risk of circular dependencies.\n*/\nvar BUILTIN_ADDON_IDS = [\n\t\"api\",\n\t\"chat\",\n\t\"discord\",\n\t\"gateway\",\n\t\"ollama\",\n\t\"slack\",\n\t\"voice\"\n];\n/**\n* Addons whose ingress is served by the guardian container.\n*\n* Single source of truth for guardian deploy gating. Must mirror the Compose\n* profile gate on the guardian service in\n* `packages/skeleton/system/stack/portals.compose.yml`\n* (`profiles: [addon.chat, addon.api, addon.discord, addon.slack, addon.gateway]`):\n* enabling any of these requires the guardian, so the deploy set, the\n* expected-service seed, and the activation loop all deploy/health-wait on it.\n*\n* NOTE: broader than PORTAL_SECRET_ADDON_IDS — `gateway` uses the guardian but\n* has no portal secret of its own (see below). Keep the two lists distinct.\n*/\nvar GUARDIAN_INGRESS_ADDON_IDS = [\n\t\"api\",\n\t\"chat\",\n\t\"discord\",\n\t\"gateway\",\n\t\"slack\"\n];\n/**\n* First-party portals that own a dedicated `portal_<id>_secret`.\n*\n* Single source of truth for portal-secret provisioning (`ensurePortalSecret`).\n* Must mirror the `portal_*_secret` set the guardian mounts in\n* `portals.compose.yml` (chat, api, discord, slack). Excludes `gateway`, which\n* is guardian ingress but has no portal secret of its own.\n*/\nvar PORTAL_SECRET_ADDON_IDS = [\n\t\"api\",\n\t\"chat\",\n\t\"discord\",\n\t\"slack\"\n];\n//#endregion\nexport { GUARDIAN_INGRESS_ADDON_IDS as n, PORTAL_SECRET_ADDON_IDS as r, BUILTIN_ADDON_IDS as t };\n","//#region ../lib/src/provider-constants.ts\n/** Default base URLs per provider. */\nvar PROVIDER_DEFAULT_URLS = {\n\topenai: \"https://api.openai.com\",\n\tgroq: \"https://api.groq.com/openai\",\n\tmistral: \"https://api.mistral.ai\",\n\ttogether: \"https://api.together.xyz\",\n\tdeepseek: \"https://api.deepseek.com\",\n\txai: \"https://api.x.ai\",\n\tlmstudio: \"http://host.docker.internal:1234\",\n\tollama: \"http://host.docker.internal:11434\",\n\t\"model-runner\": \"http://model-runner.docker.internal/engines\",\n\tgoogle: \"https://generativelanguage.googleapis.com\",\n\thuggingface: \"https://router.huggingface.co/v1\"\n};\n/** Map provider name → env var for the API key. */\nvar PROVIDER_KEY_MAP = {\n\topenai: \"OPENAI_API_KEY\",\n\tgroq: \"GROQ_API_KEY\",\n\tmistral: \"MISTRAL_API_KEY\",\n\tgoogle: \"GOOGLE_API_KEY\",\n\tdeepseek: \"DEEPSEEK_API_KEY\",\n\ttogether: \"TOGETHER_API_KEY\",\n\txai: \"XAI_API_KEY\",\n\thuggingface: \"HF_TOKEN\"\n};\n/** Known embedding model dimensions. Keyed by `provider/model`. */\nvar EMBEDDING_DIMS = {\n\t\"openai/text-embedding-3-small\": 1536,\n\t\"openai/text-embedding-3-large\": 3072,\n\t\"openai/text-embedding-ada-002\": 1536,\n\t\"ollama/nomic-embed-text\": 768,\n\t\"ollama/mxbai-embed-large\": 1024,\n\t\"ollama/mxbai-embed-large-v1\": 1024,\n\t\"ollama/all-minilm\": 384,\n\t\"ollama/snowflake-arctic-embed\": 1024,\n\t\"model-runner/ai/mxbai-embed-large-v1\": 1024,\n\t\"mistral/mistral-embed\": 1024,\n\t\"google/text-embedding-004\": 768,\n\t\"huggingface/sentence-transformers/all-MiniLM-L6-v2\": 384,\n\t\"huggingface/intfloat/multilingual-e5-large\": 1024\n};\n/** Bare model-name lookup used by the browser wizard helpers. */\nvar KNOWN_EMBEDDING_MODEL_DIMS = Object.fromEntries(Object.entries(EMBEDDING_DIMS).map(([key, dims]) => [key.slice(key.indexOf(\"/\") + 1), dims]));\n/**\n* Look up embedding model dimensions. Tries the full key first, then strips\n* any trailing `:tag` from the model name (Ollama-style versions).\n* Returns 0 when no match is found.\n*/\nfunction lookupEmbeddingDims(provider, model) {\n\tif (!provider || !model) return 0;\n\tconst key = `${provider}/${model}`;\n\tif (EMBEDDING_DIMS[key]) return EMBEDDING_DIMS[key];\n\tconst colon = model.lastIndexOf(\":\");\n\tif (colon > 0) {\n\t\tconst bare = `${provider}/${model.slice(0, colon)}`;\n\t\tif (EMBEDDING_DIMS[bare]) return EMBEDDING_DIMS[bare];\n\t}\n\treturn 0;\n}\nvar OLLAMA_DEFAULT_CHAT_MODEL = {\n\tchat: \"llama3.2:latest\",\n\tembedding: \"nomic-embed-text\"\n}.chat;\nfunction addonProfileId(addon, variant) {\n\treturn `addon.${addon}.${variant}`;\n}\n//#endregion\nexport { addonProfileId as a, PROVIDER_KEY_MAP as i, OLLAMA_DEFAULT_CHAT_MODEL as n, lookupEmbeddingDims as o, PROVIDER_DEFAULT_URLS as r, KNOWN_EMBEDDING_MODEL_DIMS as t };\n","import { n as GUARDIAN_INGRESS_ADDON_IDS } from \"./addon-ids.js\";\n//#region ../lib/src/control-plane/bind-warning.ts\n/**\n* Startup warning for non-loopback bind addresses.\n*\n* When OP_BIND_ADDRESS is set to a non-loopback value (anything other than\n* 127.0.0.1, localhost, or ::1), services are exposed on the host network\n* interface. This helper produces a structured list of warning lines that\n* callers should log at WARN level so operators are aware.\n*\n* Per-service overrides (e.g. OP_CHAT_BIND_ADDRESS, OP_VOICE_BIND_ADDRESS)\n* are also checked and reported individually.\n*/\n/**\n* True when OP_ENABLED_ADDONS names at least one guardian-ingress addon — i.e.\n* a guardian proxy is actually deployed in front of the exposed services.\n* Parses the comma-separated OP_ENABLED_ADDONS directly (no dependency on\n* addons.ts, to keep this module import-light and cycle-free).\n*/\nfunction hasGuardianIngress(env) {\n\treturn (env.OP_ENABLED_ADDONS ?? \"\").split(\",\").map((s) => s.trim()).filter(Boolean).some((a) => GUARDIAN_INGRESS_ADDON_IDS.includes(a));\n}\n/** Known per-service bind address env var names (mirrors compose files). */\nvar PER_SERVICE_BIND_VARS = [\n\t\"OP_ASSISTANT_BIND_ADDRESS\",\n\t\"OP_CLIENT_BIND_ADDRESS\",\n\t\"OP_CHAT_BIND_ADDRESS\",\n\t\"OP_API_BIND_ADDRESS\",\n\t\"OP_VOICE_BIND_ADDRESS\"\n];\n/**\n* #563 D9 — per-var warnings lead with WHAT is exposed and which network\n* access preset (packages/lib/src/control-plane/network-preset.ts)\n* deliberately configures that exposure, so operators reading the log can\n* tell \"I did this on purpose\" from \"something hand-edited this\". Only\n* `OP_ASSISTANT_BIND_ADDRESS` (the Home network presets) and\n* `OP_BIND_ADDRESS` (the Shared network preset) are ever set by a preset;\n* the other per-service vars (client/chat/api/voice) are never preset-managed\n* so they keep generic wording naming no preset.\n*/\nvar PRESET_FRAMING = {\n\tOP_BIND_ADDRESS: \"Shared network, guardian protected\",\n\tOP_ASSISTANT_BIND_ADDRESS: \"Home network\"\n};\n/** Exported for reuse by mdns-responder.ts's bind-gating logic (#488). */\nfunction isLoopback(value) {\n\tconst v = value.trim();\n\treturn v === \"127.0.0.1\" || v === \"localhost\" || v === \"::1\";\n}\n/**\n* Opt-in: allow the web UI (including the first-run setup wizard) to be reached\n* from a remote machine. When set, the UI server binds all interfaces and the\n* Host/Origin allowlist + the setup-localhost-only gate are relaxed.\n*\n* This deliberately reopens the owner-race the setup gate normally prevents, so\n* it is OFF by default and must be explicitly enabled by the operator. Reach the\n* UI over an SSH tunnel or a reverse proxy instead when you can.\n*/\nfunction isRemoteSetupAllowed(env = process.env) {\n\tconst v = env.OP_ALLOW_REMOTE_SETUP?.trim().toLowerCase();\n\treturn v === \"1\" || v === \"true\" || v === \"yes\";\n}\n/**\n* Inspect `env` for non-loopback bind address settings and return one warning\n* line per problematic variable.  Returns an empty array when everything is\n* loopback (or unset, since the compose default is 127.0.0.1).\n*\n* @param env - The environment to inspect; typically `process.env`.\n*/\nfunction collectBindAddressWarnings(env) {\n\tconst warnings = [];\n\tconst globalBind = env.OP_BIND_ADDRESS;\n\tif (globalBind && !isLoopback(globalBind)) warnings.push(hasGuardianIngress(env) ? `${PRESET_FRAMING.OP_BIND_ADDRESS} exposure — OP_BIND_ADDRESS is set to \"${globalBind}\", exposing services on the host network interface, not just loopback. Ensure a firewall is in place if this host is reachable from untrusted networks.` : `Unprotected LAN exposure — OP_BIND_ADDRESS is set to \"${globalBind}\" but no guardian-ingress addon is enabled, so services are exposed directly on the host network interface with no guardian proxy in front. Enable a guardian-ingress addon (chat/api/gateway/discord/slack) or keep this loopback-only.`);\n\tfor (const key of PER_SERVICE_BIND_VARS) {\n\t\tconst val = env[key];\n\t\tif (val && !isLoopback(val)) {\n\t\t\tconst framing = PRESET_FRAMING[key];\n\t\t\twarnings.push(framing ? `${framing} exposure — ${key} is set to \"${val}\", exposing this service on the host network interface.` : `${key} is set to \"${val}\" — this service will be exposed on the host network interface.`);\n\t\t}\n\t}\n\tif (isRemoteSetupAllowed(env)) warnings.push(\"OP_ALLOW_REMOTE_SETUP is enabled — the web UI is reachable from remote machines and the setup wizard is no longer restricted to the host. Only use this on a trusted network behind a firewall.\");\n\treturn warnings;\n}\n//#endregion\n//#region ../lib/src/control-plane/network-preset.ts\n/**\n* Network access preset resolver (#563).\n*\n* A single \"network access\" choice bundles bind-address exposure, OpenCode\n* Basic auth, and mDNS advertisement intent into one operator-facing decision\n* instead of four independently-tunable env vars. This module is the ONLY\n* place that knows the preset → env-var mapping; the wizard, the CLI headless\n* spec path, and the admin \"detect current preset\" surface all resolve\n* through it so they can never drift from each other.\n*\n* Browser-safe: this module imports ONLY `isLoopback`, `collectBindAddressWarnings`,\n* and `isRemoteSetupAllowed` from `./bind-warning.js` — no `node:*` imports and\n* never `./mdns-responder.js` (which pulls in `node:dgram`). The wizard\n* (packages/ui, a browser bundle) imports this module directly via the\n* `@openpalm/lib/control-plane/network-preset.js` subpath, precedent:\n* `provider-constants.ts`.\n*\n* D1 (mDNS mechanism): per-preset mDNS is delivered entirely by the #488 host\n* mDNS responder (`mdns-responder.ts`), which gates advertisement on exactly\n* the bind vars this resolver writes (`OP_ASSISTANT_BIND_ADDRESS` for the\n* assistant name, `OP_BIND_ADDRESS` for the guardian name). This resolver only\n* exposes `assistantMdns`/`guardianMdns` INTENT flags mirroring those gates —\n* it never touches mDNS config directly. `network-preset.test.ts` T7 pins the\n* two together so they can never silently diverge.\n*\n* D4 (managed key matrix): every preset writes ALL of `OP_BIND_ADDRESS`,\n* `OP_ASSISTANT_BIND_ADDRESS`, `OP_CLIENT_BIND_ADDRESS`, `OP_VOICE_BIND_ADDRESS`,\n* and `OPENCODE_AUTH` explicitly (loopback rather than \"leave unset\"), so\n* switching between presets always converges regardless of prior state.\n* `OP_CHAT_BIND_ADDRESS` / `OP_API_BIND_ADDRESS` are deliberately NOT managed —\n* those are listeners inside the guardian container, fail-closed\n* API-key-authenticated, so they are left to ride the `OP_BIND_ADDRESS`\n* cascade (guardian-protected exposure is the intended behavior under\n* shared-guardian). `GUARDIAN_DIRECT_INGRESS` is never touched by any preset —\n* presets configure exposure, not ingress enablement.\n*/\nvar NETWORK_ACCESS_PRESETS = [\n\t\"this-pc\",\n\t\"home-password\",\n\t\"home-open\",\n\t\"shared-guardian\"\n];\n/** Single source of copy for the wizard, the admin tab, and warning text. */\nvar NETWORK_PRESET_LABELS = {\n\t\"this-pc\": \"This PC only\",\n\t\"home-password\": \"Home network, with password\",\n\t\"home-open\": \"Home network, open access\",\n\t\"shared-guardian\": \"Shared network, guardian protected\"\n};\nfunction isNetworkAccessPreset(value) {\n\treturn typeof value === \"string\" && NETWORK_ACCESS_PRESETS.includes(value);\n}\nvar LOOPBACK_DEFAULT = \"127.0.0.1\";\nvar LAN_VALUE = \"0.0.0.0\";\n/** Managed bind-address env keys every preset writes explicitly. */\nvar MANAGED_BIND_KEYS = [\n\t\"OP_BIND_ADDRESS\",\n\t\"OP_ASSISTANT_BIND_ADDRESS\",\n\t\"OP_CLIENT_BIND_ADDRESS\",\n\t\"OP_VOICE_BIND_ADDRESS\"\n];\nvar ALL_LOOPBACK = {\n\tOP_BIND_ADDRESS: LOOPBACK_DEFAULT,\n\tOP_ASSISTANT_BIND_ADDRESS: LOOPBACK_DEFAULT,\n\tOP_CLIENT_BIND_ADDRESS: LOOPBACK_DEFAULT,\n\tOP_VOICE_BIND_ADDRESS: LOOPBACK_DEFAULT,\n\tOPENCODE_AUTH: \"false\"\n};\n/**\n* Resolve one of the four network access presets into its complete managed\n* env row + mDNS intent flags. Throws on a password-contract violation\n* (missing/empty password for `home-password`, or a password supplied for any\n* other preset) — these are operator errors, not silent drops.\n*/\nfunction resolveNetworkPreset(preset, opts) {\n\tconst password = opts?.opencodePassword;\n\tif (preset === \"home-password\") {\n\t\tif (!password) throw new Error(\"network.opencodePassword is required for the \\\"home-password\\\" network access preset.\");\n\t} else if (password) throw new Error(`network.opencodePassword must not be supplied for the \"${preset}\" network access preset.`);\n\tswitch (preset) {\n\t\tcase \"this-pc\": return {\n\t\t\tpreset,\n\t\t\tenv: { ...ALL_LOOPBACK },\n\t\t\tassistantMdns: false,\n\t\t\tguardianMdns: false\n\t\t};\n\t\tcase \"home-password\": return {\n\t\t\tpreset,\n\t\t\tenv: {\n\t\t\t\t...ALL_LOOPBACK,\n\t\t\t\tOP_ASSISTANT_BIND_ADDRESS: LAN_VALUE,\n\t\t\t\tOPENCODE_AUTH: \"true\"\n\t\t\t},\n\t\t\topencodePassword: password,\n\t\t\tassistantMdns: true,\n\t\t\tguardianMdns: false\n\t\t};\n\t\tcase \"home-open\": return {\n\t\t\tpreset,\n\t\t\tenv: {\n\t\t\t\t...ALL_LOOPBACK,\n\t\t\t\tOP_ASSISTANT_BIND_ADDRESS: LAN_VALUE\n\t\t\t},\n\t\t\tassistantMdns: true,\n\t\t\tguardianMdns: false\n\t\t};\n\t\tcase \"shared-guardian\": return {\n\t\t\tpreset,\n\t\t\tenv: {\n\t\t\t\t...ALL_LOOPBACK,\n\t\t\t\tOP_BIND_ADDRESS: LAN_VALUE\n\t\t\t},\n\t\t\tassistantMdns: false,\n\t\t\tguardianMdns: true\n\t\t};\n\t\tdefault: throw new Error(`Unknown network access preset: ${String(preset)}`);\n\t}\n}\n/**\n* Per-service binds whose compose host-port default NESTS `${OP_BIND_ADDRESS}`\n* (core.compose.yml OP_CLIENT / services.compose.yml OP_VOICE:\n* `${OP_X_BIND_ADDRESS:-${OP_BIND_ADDRESS:-127.0.0.1}}`). An unset value\n* therefore inherits the GLOBAL bind, not loopback. `OP_ASSISTANT_BIND_ADDRESS`\n* is deliberately absent — its host-port line defaults straight to 127.0.0.1\n* with no OP_BIND_ADDRESS fallback.\n*/\nvar OP_BIND_CASCADING_KEYS = new Set([\"OP_CLIENT_BIND_ADDRESS\", \"OP_VOICE_BIND_ADDRESS\"]);\nfunction boundValue(env, key) {\n\tconst raw = env[key]?.trim();\n\tif (raw) return raw;\n\tif (OP_BIND_CASCADING_KEYS.has(key)) {\n\t\tconst globalBind = env.OP_BIND_ADDRESS?.trim();\n\t\tif (globalBind) return globalBind;\n\t}\n\treturn LOOPBACK_DEFAULT;\n}\nfunction isExposed(env, key) {\n\treturn !isLoopback(boundValue(env, key));\n}\nfunction isAuthOn(env) {\n\tconst v = (env.OPENCODE_AUTH ?? \"\").trim().toLowerCase();\n\treturn v === \"true\" || v === \"1\" || v === \"yes\";\n}\n/**\n* Reverse the resolver: given a (possibly hand-edited) env record, identify\n* which preset it matches, if any. Unset managed keys are treated as the\n* compose loopback default. Unmanaged keys (e.g. `OP_CHAT_BIND_ADDRESS`) are\n* ignored entirely — they are reported by `collectNetworkExposureWarnings`\n* instead, never by detection. Returns `null` on drift (a combination no\n* preset produces), which the caller reports as \"custom\".\n*/\nfunction detectNetworkPreset(env) {\n\tconst globalExposed = isExposed(env, \"OP_BIND_ADDRESS\");\n\tconst assistantExposed = isExposed(env, \"OP_ASSISTANT_BIND_ADDRESS\");\n\tconst clientExposed = isExposed(env, \"OP_CLIENT_BIND_ADDRESS\");\n\tconst voiceExposed = isExposed(env, \"OP_VOICE_BIND_ADDRESS\");\n\tconst authOn = isAuthOn(env);\n\tif (!globalExposed && !assistantExposed && !clientExposed && !voiceExposed && !authOn) return \"this-pc\";\n\tif (!globalExposed && assistantExposed && !clientExposed && !voiceExposed) return authOn ? \"home-password\" : \"home-open\";\n\tif (globalExposed && !assistantExposed && !clientExposed && !voiceExposed && !authOn) return \"shared-guardian\";\n\treturn null;\n}\n/**\n* Validate a target preset against the HOST PROCESS env (as opposed to\n* stack.env) it will be layered under. Compose gives process env precedence\n* over `--env-file`, so a leftover `OP_ASSISTANT_BIND_ADDRESS=0.0.0.0` in the\n* host process would silently defeat a preset's loopback pin even though the\n* resolver correctly writes the loopback row to stack.env.\n*\n* Presets that pin a bind to loopback must fail closed if the host env would\n* override it: `shared-guardian` pins the assistant (PR #564), and `this-pc`\n* pins BOTH the assistant and the guardian (PR #564 r3566887693 — otherwise a\n* leftover host-env bind exposes an unauthenticated OpenCode / guardian on the\n* LAN despite the operator's \"This PC only\" choice). The home presets\n* deliberately expose the assistant, so they have nothing to guard.\n*/\nfunction validateNetworkPresetEnv(preset, env) {\n\tconst label = NETWORK_PRESET_LABELS[preset];\n\tconst errors = [];\n\tconst rejectExposed = (key) => {\n\t\tif (isExposed(env, key)) errors.push(`The \"${preset}\" (${label}) network access preset requires ${key} to stay loopback-only, but the current environment already exposes ${key}=\"${env[key]}\". Unset it (or set it to 127.0.0.1) in the host process environment before switching to ${preset}.`);\n\t};\n\tif (preset === \"this-pc\") {\n\t\trejectExposed(\"OP_ASSISTANT_BIND_ADDRESS\");\n\t\trejectExposed(\"OP_BIND_ADDRESS\");\n\t} else if (preset === \"shared-guardian\") rejectExposed(\"OP_ASSISTANT_BIND_ADDRESS\");\n\treturn {\n\t\tvalid: errors.length === 0,\n\t\terrors\n\t};\n}\n/** The env var shown as the deliberate-exposure detail for each preset's line. */\nfunction presetExposureLine(preset) {\n\tswitch (preset) {\n\t\tcase \"home-password\": return `${NETWORK_PRESET_LABELS[\"home-password\"]} is configured — the assistant is reachable from other devices on your network and requires the sign-in password you set (env: OP_ASSISTANT_BIND_ADDRESS).`;\n\t\tcase \"home-open\": return `${NETWORK_PRESET_LABELS[\"home-open\"]} is configured — the assistant is reachable from any device on your network WITHOUT a password (env: OP_ASSISTANT_BIND_ADDRESS). Anyone on this network can use it.`;\n\t\tcase \"shared-guardian\": return `${NETWORK_PRESET_LABELS[\"shared-guardian\"]} is configured — the guardian's protected front door is reachable from your network (env: OP_BIND_ADDRESS); the assistant itself stays private on this PC (loopback, 127.0.0.1).`;\n\t\tcase \"this-pc\": return \"\";\n\t}\n}\n/** Force the managed keys back to their loopback default so collectBindAddressWarnings skips them. */\nfunction suppressManagedKeys(env) {\n\tconst copy = { ...env };\n\tfor (const key of MANAGED_BIND_KEYS) copy[key] = LOOPBACK_DEFAULT;\n\treturn copy;\n}\n/**\n* Compose the operator-facing exposure warning list for `env`. When `env`\n* exactly matches a preset row, the managed-var noise collapses into ONE\n* preset-framed line (informational — this exposure was deliberately\n* configured), plus per-var warnings for any non-loopback var OUTSIDE the\n* managed set (e.g. a hand-set `OP_CHAT_BIND_ADDRESS`) and the unchanged\n* `OP_ALLOW_REMOTE_SETUP` line. When nothing matches (drifted/custom env),\n* the full per-var list from `collectBindAddressWarnings` is returned\n* unchanged — unexplained exposure stays loud.\n*/\nfunction collectNetworkExposureWarnings(env) {\n\tconst preset = detectNetworkPreset(env);\n\tconst warnings = [];\n\tif (preset && preset !== \"this-pc\") warnings.push(presetExposureLine(preset));\n\tconst effectiveEnv = preset ? suppressManagedKeys(env) : env;\n\twarnings.push(...collectBindAddressWarnings(effectiveEnv));\n\treturn warnings;\n}\n//#endregion\nexport { isNetworkAccessPreset as a, isLoopback as c, detectNetworkPreset as i, isRemoteSetupAllowed as l, NETWORK_PRESET_LABELS as n, resolveNetworkPreset as o, collectNetworkExposureWarnings as r, validateNetworkPresetEnv as s, NETWORK_ACCESS_PRESETS as t };\n"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,iBAAiB,GAAG;AACxB,CAAC,KAAK;AACN,CAAC,MAAM;AACP,CAAC,SAAS;AACV,CAAC,SAAS;AACV,CAAC,QAAQ;AACT,CAAC,OAAO;AACR,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,0BAA0B,GAAG;AACjC,CAAC,KAAK;AACN,CAAC,MAAM;AACP,CAAC,SAAS;AACV,CAAC,SAAS;AACV,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,uBAAuB,GAAG;AAC9B,CAAC,KAAK;AACN,CAAC,MAAM;AACP,CAAC,SAAS;AACV,CAAC;AACD;;ACpDA;AACA;AACG,IAAC,qBAAqB,GAAG;AAC5B,CAAC,MAAM,EAAE,wBAAwB;AACjC,CAAC,IAAI,EAAE,6BAA6B;AACpC,CAAC,OAAO,EAAE,wBAAwB;AAClC,CAAC,QAAQ,EAAE,0BAA0B;AACrC,CAAC,QAAQ,EAAE,0BAA0B;AACrC,CAAC,GAAG,EAAE,kBAAkB;AACxB,CAAC,QAAQ,EAAE,kCAAkC;AAC7C,CAAC,MAAM,EAAE,mCAAmC;AAC5C,CAAC,cAAc,EAAE,6CAA6C;AAC9D,CAAC,MAAM,EAAE,2CAA2C;AACpD,CAAC,WAAW,EAAE;AACd;AACA;AACG,IAAC,gBAAgB,GAAG;AACvB,CAAC,MAAM,EAAE,gBAAgB;AACzB,CAAC,IAAI,EAAE,cAAc;AACrB,CAAC,OAAO,EAAE,iBAAiB;AAC3B,CAAC,MAAM,EAAE,gBAAgB;AACzB,CAAC,QAAQ,EAAE,kBAAkB;AAC7B,CAAC,QAAQ,EAAE,kBAAkB;AAC7B,CAAC,GAAG,EAAE,aAAa;AACnB,CAAC,WAAW,EAAE;AACd;AACA;AACA,IAAI,cAAc,GAAG;AACrB,CAAC,+BAA+B,EAAE,IAAI;AACtC,CAAC,+BAA+B,EAAE,IAAI;AACtC,CAAC,+BAA+B,EAAE,IAAI;AACtC,CAAC,yBAAyB,EAAE,GAAG;AAC/B,CAAC,0BAA0B,EAAE,IAAI;AACjC,CAAC,6BAA6B,EAAE,IAAI;AACpC,CAAC,mBAAmB,EAAE,GAAG;AACzB,CAAC,+BAA+B,EAAE,IAAI;AACtC,CAAC,sCAAsC,EAAE,IAAI;AAC7C,CAAC,uBAAuB,EAAE,IAAI;AAC9B,CAAC,2BAA2B,EAAE,GAAG;AACjC,CAAC,oDAAoD,EAAE,GAAG;AAC1D,CAAC,4CAA4C,EAAE;AAC/C,CAAC;AACD;AACG,IAAC,0BAA0B,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAChJ;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,QAAQ,EAAE,KAAK,EAAE;AAC9C,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC;AAClC,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,OAAO,cAAc,CAAC,GAAG,CAAC;AACpD,CAAC,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC;AACrC,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE;AAChB,EAAE,MAAM,IAAI,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AACrD,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,OAAO,cAAc,CAAC,IAAI,CAAC;AACvD,CAAC;AACD,CAAC,OAAO,CAAC;AACT;AACG,IAAC,yBAAyB,GAAG;AAChC,CAAC,IAAI,EAAE,iBAEP,CAAC,CAAC;AACF,SAAS,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE;AACxC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AACnC;;ACjEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,GAAG,EAAE;AACjC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,0BAA0B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACzI;AACA;AACA,IAAI,qBAAqB,GAAG;AAC5B,CAAC,2BAA2B;AAC5B,CAAC,wBAAwB;AACzB,CAAC,sBAAsB;AACvB,CAAC,qBAAqB;AACtB,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,cAAc,GAAG;AACrB,CAAC,eAAe,EAAE,oCAAoC;AACtD,CAAC,yBAAyB,EAAE;AAC5B,CAAC;AACD;AACA,SAAS,UAAU,CAAC,KAAK,EAAE;AAC3B,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE;AACvB,CAAC,OAAO,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,KAAK;AAC7D;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;AACjD,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AAC1D,CAAC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK;AAChD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,0BAA0B,CAAC,GAAG,EAAE;AACzC,CAAC,MAAM,QAAQ,GAAG,EAAE;AACpB,CAAC,MAAM,UAAU,GAAG,GAAG,CAAC,eAAe;AACvC,CAAC,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,eAAe,CAAC,uCAAuC,EAAE,UAAU,CAAC,uJAAuJ,CAAC,GAAG,CAAC,sDAAsD,EAAE,UAAU,CAAC,wOAAwO,CAAC,CAAC;AACnnB,CAAC,KAAK,MAAM,GAAG,IAAI,qBAAqB,EAAE;AAC1C,EAAE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;AACtB,EAAE,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;AAC/B,GAAG,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC;AACtC,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,EAAE,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,uDAAuD,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,+DAA+D,CAAC,CAAC;AAC/N,EAAE;AACF,CAAC;AACD,CAAC,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,iMAAiM,CAAC;AAChP,CAAC,OAAO,QAAQ;AAChB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,sBAAsB,GAAG;AAC7B,CAAC,SAAS;AACV,CAAC,eAAe;AAChB,CAAC,WAAW;AACZ,CAAC;AACD;AACA;AACG,IAAC,qBAAqB,GAAG;AAC5B,CAAC,SAAS,EAAE,cAAc;AAC1B,CAAC,eAAe,EAAE,6BAA6B;AAC/C,CAAC,WAAW,EAAE,2BAA2B;AACzC,CAAC,iBAAiB,EAAE;AACpB;AACA,SAAS,qBAAqB,CAAC,KAAK,EAAE;AACtC,CAAC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC;AAC3E;AACA,IAAI,gBAAgB,GAAG,WAAW;AAClC,IAAI,SAAS,GAAG,SAAS;AACzB;AACA,IAAI,iBAAiB,GAAG;AACxB,CAAC,iBAAiB;AAClB,CAAC,2BAA2B;AAC5B,CAAC,wBAAwB;AACzB,CAAC;AACD,CAAC;AACD,IAAI,YAAY,GAAG;AACnB,CAAC,eAAe,EAAE,gBAAgB;AAClC,CAAC,yBAAyB,EAAE,gBAAgB;AAC5C,CAAC,sBAAsB,EAAE,gBAAgB;AACzC,CAAC,qBAAqB,EAAE,gBAAgB;AACxC,CAAC,aAAa,EAAE;AAChB,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,MAAM,EAAE,IAAI,EAAE;AAC5C,CAAC,MAAM,QAAQ,GAAG,IAAI,EAAE,gBAAgB;AACxC,CAAC,IAAI,MAAM,KAAK,eAAe,EAAE;AACjC,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC;AACzH,CAAC,CAAC,MAAM,IAAI,QAAQ,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,uDAAuD,EAAE,MAAM,CAAC,wBAAwB,CAAC,CAAC;AACjI,CAAC,QAAQ,MAAM;AACf,EAAE,KAAK,SAAS,EAAE,OAAO;AACzB,GAAG,MAAM;AACT,GAAG,GAAG,EAAE,EAAE,GAAG,YAAY,EAAE;AAC3B,GAAG,aAAa,EAAE,KAAK;AACvB,GAAG,YAAY,EAAE;AACjB,GAAG;AACH,EAAE,KAAK,eAAe,EAAE,OAAO;AAC/B,GAAG,MAAM;AACT,GAAG,GAAG,EAAE;AACR,IAAI,GAAG,YAAY;AACnB,IAAI,yBAAyB,EAAE,SAAS;AACxC,IAAI,aAAa,EAAE;AACnB,IAAI;AACJ,GAAG,gBAAgB,EAAE,QAAQ;AAC7B,GAAG,aAAa,EAAE,IAAI;AACtB,GAAG,YAAY,EAAE;AACjB,GAAG;AACH,EAAE,KAAK,WAAW,EAAE,OAAO;AAC3B,GAAG,MAAM;AACT,GAAG,GAAG,EAAE;AACR,IAAI,GAAG,YAAY;AACnB,IAAI,yBAAyB,EAAE;AAC/B,IAAI;AACJ,GAAG,aAAa,EAAE,IAAI;AACtB,GAAG,YAAY,EAAE;AACjB,GAAG;AACH,EAAE,KAAK,iBAAiB,EAAE,OAAO;AACjC,GAAG,MAAM;AACT,GAAG,GAAG,EAAE;AACR,IAAI,GAAG,YAAY;AACnB,IAAI,eAAe,EAAE;AACrB,IAAI;AACJ,GAAG,aAAa,EAAE,KAAK;AACvB,GAAG,YAAY,EAAE;AACjB,GAAG;AACH,EAAE,SAAS,MAAM,IAAI,KAAK,CAAC,CAAC,+BAA+B,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC9E;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,wBAAwB,EAAE,uBAAuB,CAAC,CAAC;AACzF,SAAS,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE;AAC9B,CAAC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;AAC7B,CAAC,IAAI,GAAG,EAAE,OAAO,GAAG;AACpB,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;AACtC,EAAE,MAAM,UAAU,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE;AAChD,EAAE,IAAI,UAAU,EAAE,OAAO,UAAU;AACnC,CAAC;AACD,CAAC,OAAO,gBAAgB;AACxB;AACA,SAAS,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE;AAC7B,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AACzC;AACA,SAAS,QAAQ,CAAC,GAAG,EAAE;AACvB,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE;AACzD,CAAC,OAAO,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK;AAChD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,GAAG,EAAE;AAClC,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,EAAE,iBAAiB,CAAC;AACxD,CAAC,MAAM,gBAAgB,GAAG,SAAS,CAAC,GAAG,EAAE,2BAA2B,CAAC;AACrE,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,EAAE,wBAAwB,CAAC;AAC/D,CAAC,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,EAAE,uBAAuB,CAAC;AAC7D,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC;AAC7B,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,gBAAgB,IAAI,CAAC,aAAa,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,OAAO,SAAS;AACxG,CAAC,IAAI,CAAC,aAAa,IAAI,gBAAgB,IAAI,CAAC,aAAa,IAAI,CAAC,YAAY,EAAE,OAAO,MAAM,GAAG,eAAe,GAAG,WAAW;AACzH,CAAC,IAAI,aAAa,IAAI,CAAC,gBAAgB,IAAI,CAAC,aAAa,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,OAAO,iBAAiB;AAC/G,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,MAAM,EAAE,GAAG,EAAE;AAC/C,CAAC,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,CAAC;AAC5C,CAAC,MAAM,MAAM,GAAG,EAAE;AAClB,CAAC,MAAM,aAAa,GAAG,CAAC,GAAG,KAAK;AAChC,EAAE,IAAI,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,iCAAiC,EAAE,GAAG,CAAC,oEAAoE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,yFAAyF,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACpS,CAAC,CAAC;AACF,CAAC,IAAI,MAAM,KAAK,SAAS,EAAE;AAC3B,EAAE,aAAa,CAAC,2BAA2B,CAAC;AAC5C,EAAE,aAAa,CAAC,iBAAiB,CAAC;AAClC,CAAC,CAAC,MAAM,IAAI,MAAM,KAAK,iBAAiB,EAAE,aAAa,CAAC,2BAA2B,CAAC;AACpF,CAAC,OAAO;AACR,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;AAC5B,EAAE;AACF,EAAE;AACF;AACA;AACA,SAAS,kBAAkB,CAAC,MAAM,EAAE;AACpC,CAAC,QAAQ,MAAM;AACf,EAAE,KAAK,eAAe,EAAE,OAAO,CAAC,EAAE,qBAAqB,CAAC,eAAe,CAAC,CAAC,0JAA0J,CAAC;AACpO,EAAE,KAAK,WAAW,EAAE,OAAO,CAAC,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC,mKAAmK,CAAC;AACrO,EAAE,KAAK,iBAAiB,EAAE,OAAO,CAAC,EAAE,qBAAqB,CAAC,iBAAiB,CAAC,CAAC,gLAAgL,CAAC;AAC9P,EAAE,KAAK,SAAS,EAAE,OAAO,EAAE;AAC3B;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,GAAG,EAAE;AAClC,CAAC,MAAM,IAAI,GAAG,EAAE,GAAG,GAAG,EAAE;AACxB,CAAC,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,gBAAgB;AAClE,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,8BAA8B,CAAC,GAAG,EAAE;AAC7C,CAAC,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC;AACxC,CAAC,MAAM,QAAQ,GAAG,EAAE;AACpB,CAAC,IAAI,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAC9E,CAAC,MAAM,YAAY,GAAG,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,GAAG;AAC7D,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;AAC3D,CAAC,OAAO,QAAQ;AAChB;;;;"}

package/build/server/chunks/runtime-context.svelte-C5zNEC6u.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"runtime-context.svelte-C5zNEC6u.js","sources":["../../../.svelte-kit/adapter-node/chunks/runtime-context.svelte.js"],"sourcesContent":["import \"./dev.js\";\n//#region src/lib/runtime-context.svelte.ts\nfunction resolveCapabilities(serverCaps, clientCtx) {\n\tconst { displayMode, activeConnection } = clientCtx;\n\tif (displayMode === \"electron\") return serverCaps;\n\tif (serverCaps.includes(\"host:stack:read\") && displayMode === \"browser\") return serverCaps.filter((c) => !isElectronOnlyCap(c));\n\tif (serverCaps.includes(\"connections:single\")) return serverCaps.filter((c) => c === \"chat\" || c.startsWith(\"assistant-settings\"));\n\tlet caps = serverCaps.filter((c) => c.startsWith(\"connections\") || c === \"chat\" || c === \"pwa:install\");\n\tif (activeConnection?.grantedCapabilities) caps = [...new Set([...caps, ...activeConnection.grantedCapabilities])];\n\treturn caps;\n}\nfunction isElectronOnlyCap(_c) {\n\treturn false;\n}\n/**\n* Reactive runtime context. Starts at the unprivileged pwa-static baseline\n* with zero capabilities until +layout.svelte initializes it — capabilities\n* are opted INTO from server data, never defaulted on.\n*/\nvar runtimeContext = {\n\tversion: 2,\n\thostMode: \"pwa-static\",\n\tserverCapabilities: [],\n\tpublicBaseUrl: \"\",\n\tuiVersion: \"\",\n\tskeletonVersion: \"\",\n\tactiveConnectionMode: \"multi\",\n\troutes: {},\n\tsecurity: {\n\t\thostAdminLoopbackOnly: true,\n\t\trequiresHttpsForRemoteConnections: true,\n\t\tcsrfMode: \"loopback-origin\"\n\t},\n\tclientContext: { displayMode: \"browser\" },\n\teffectiveCapabilities: []\n};\nfunction hasCapability(cap) {\n\treturn runtimeContext.effectiveCapabilities.includes(cap);\n}\n/**\n* Populate the store from layout data + browser-detected client context and\n* re-derive `effectiveCapabilities`. Called from +layout.svelte (client-only).\n*/\nfunction initializeRuntimeContext(serverCtx, clientCtx) {\n\tObject.assign(runtimeContext, serverCtx);\n\truntimeContext.clientContext = clientCtx;\n\truntimeContext.effectiveCapabilities = resolveCapabilities(serverCtx.serverCapabilities, clientCtx);\n}\n/**\n* Populate ONLY the server half of the store (everything ServerRuntimeContext\n* carries — capabilities, routes, hostMode, security, versions) and re-derive\n* `effectiveCapabilities` against whatever clientContext is already in the\n* store (the 'browser' baseline until the client half runs).\n*\n* Review 2026-07-10 K2: pre-migration, the equivalent `featuresService.init()`\n* ran directly in +layout.svelte's script body (an `untrack()`-wrapped call,\n* not inside `onMount`) — so it executed during SSR too, and the FIRST\n* server-rendered HTML already reflected the real capabilities (e.g. the\n* admin button was present in SSR output). At HEAD, `initializeRuntimeContext`\n* only ran in `onMount`, which never fires during SSR — every full/hard load\n* server-rendered with the store still at its all-capabilities-empty default,\n* producing a flash of missing chrome until client-side hydration ran.\n*\n* `detectClientDisplayMode()` (the other half) still genuinely needs the\n* browser (matchMedia / navigator), so it stays client-only in `onMount` —\n* only the server half moves earlier. The 'browser' clientContext default is\n* correct for the common case (regular browser tab), so capabilities\n* resolved here already match what `onMount` would (re)compute for that case;\n* `onMount` only changes the outcome for electron / standalone-pwa displays.\n*\n* `publicBaseUrl` is deliberately EXCLUDED: it is the one request-derived\n* field (`event.url.origin`), and during SSR this store is process-global\n* under adapter-node — writing it here would leak one request's Host-derived\n* origin to every later reader (PR #562 review). SSR chrome only needs\n* capabilities/hostMode/routes; the browser writes publicBaseUrl per-tab via\n* `initializeRuntimeContext` in `onMount`.\n*/\nfunction initializeServerRuntimeContext(serverCtx) {\n\tconst { publicBaseUrl: _requestDerived, ...envDerived } = serverCtx;\n\tObject.assign(runtimeContext, envDerived);\n\truntimeContext.effectiveCapabilities = resolveCapabilities(serverCtx.serverCapabilities, runtimeContext.clientContext);\n}\n//#endregion\nexport { runtimeContext as a, resolveCapabilities as i, initializeRuntimeContext as n, initializeServerRuntimeContext as r, hasCapability as t };\n"],"names":[],"mappings":"AACA;AACA,SAAS,mBAAmB,CAAC,UAAU,EAAE,SAAS,EAAE;AACpD,CAAC,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,SAAS;AACpD,CAAC,IAAI,WAAW,KAAK,UAAU,EAAE,OAAO,UAAU;AAClD,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,WAAW,KAAK,SAAS,EAAE,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAqB,CAAC;AAChI,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;AACnI,CAAC,IAAI,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,aAAa,CAAC;AACxG,CAAC,IAAI,gBAAgB,EAAE,mBAAmB,EAAE,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,CAAC,CAAC;AACnH,CAAC,OAAO,IAAI;AACZ;AAIA;AACA;AACA;AACA;AACA;AACG,IAAC,cAAc,GAAG;AACrB,CAAC,OAAO,EAAE,CAAC;AACX,CAAC,QAAQ,EAAE,YAAY;AACvB,CAAC,kBAAkB,EAAE,EAAE;AACvB,CAAC,aAAa,EAAE,EAAE;AAClB,CAAC,SAAS,EAAE,EAAE;AACd,CAAC,eAAe,EAAE,EAAE;AACpB,CAAC,oBAAoB,EAAE,OAAO;AAC9B,CAAC,MAAM,EAAE,EAAE;AACX,CAAC,QAAQ,EAAE;AACX,EAAE,qBAAqB,EAAE,IAAI;AAC7B,EAAE,iCAAiC,EAAE,IAAI;AACzC,EAAE,QAAQ,EAAE;AACZ,EAAE;AACF,CAAC,aAAa,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE;AAC1C,CAAC,qBAAqB,EAAE;AACxB;AACA,SAAS,aAAa,CAAC,GAAG,EAAE;AAC5B,CAAC,OAAO,cAAc,CAAC,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC;AAC1D;AAUA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,8BAA8B,CAAC,SAAS,EAAE;AACnD,CAAC,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,GAAG,UAAU,EAAE,GAAG,SAAS;AACpE,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,UAAU,CAAC;AAC1C,CAAC,cAAc,CAAC,qBAAqB,GAAG,mBAAmB,CAAC,SAAS,CAAC,kBAAkB,EAAE,cAAc,CAAC,aAAa,CAAC;AACvH;;;;"}

package/build/server/chunks/speakable-text-BflxDDdY.js

@@ -1,65 +0,0 @@
-//#region src/lib/voice/speakable-text.ts
-/**
-* Deterministic markdown-to-speech text stripping. Pure and dependency-free
-* so both the browser TTS fallback (audio-playback.ts) and the server TTS
-* route (routes/api/speak/+server.ts) can run the exact same rules without
-* ever handing raw markdown syntax to a speech engine.
-*
-* Order matters: fenced code blocks and inline code are handled before any
-* other markdown stripping so their contents are never mistaken for
-* headings/emphasis/list markers. Whitespace collapsing runs last.
-*/
-var HTML_ENTITIES = {
-	"&": "&",
-	"&lt;": "<",
-	"&gt;": ">",
-	"&quot;": "\"",
-	"&#39;": "'"
-};
-function decodeEntities(text) {
-	return text.replace(/&amp;|&lt;|&gt;|&quot;|&#39;/g, (match) => HTML_ENTITIES[match] ?? match);
-}
-function urlToHostname(url) {
-	try {
-		return new URL(url).hostname;
-	} catch {
-		return url;
-	}
-}
-function toSpeakableText(text) {
-	let out = text;
-	out = out.replace(/```[\s\S]*?```/g, " Code omitted. ");
-	out = out.replace(/`([^`]+)`/g, "$1");
-	out = out.replace(/!\[([^\]]*)\]\([^)]*\)/g, "$1");
-	out = out.replace(/\[([^\]]*)\]\([^)]*\)/g, "$1");
-	out = out.replace(/https?:\/\/[^\s)<>"']+/g, (match) => urlToHostname(match));
-	out = out.replace(/<[^>]+>/g, "");
-	out = out.replace(/^\s*(?:-{3,}|\*{3,}|_{3,})\s*$/gm, "");
-	const keptLines = [];
-	for (const line of out.split("\n")) {
-		let l = line;
-		if (/^\s*\|?[\s:|-]+\|?\s*$/.test(l) && l.includes("-") && l.includes("|")) continue;
-		l = l.replace(/^\s*>\s?/, "");
-		l = l.replace(/^\s*#{1,6}\s+/, "");
-		const wasListItem = /^\s*(?:[-*+]|\d+\.)\s+/.test(l);
-		l = l.replace(/^\s*(?:[-*+]|\d+\.)\s+/, "");
-		if (l.includes("|")) l = l.replace(/^\s*\|/, "").replace(/\|\s*$/, "").split("|").map((cell) => cell.trim()).join(", ");
-		l = l.trim();
-		if (wasListItem && l && !/[.!?:]$/.test(l)) l += ".";
-		keptLines.push(l);
-	}
-	out = keptLines.join("\n");
-	out = out.replace(/~~(.+?)~~/g, "$1");
-	out = out.replace(/\*\*(.+?)\*\*/g, "$1");
-	out = out.replace(/__(.+?)__/g, "$1");
-	out = out.replace(/\*(.+?)\*/g, "$1");
-	out = out.replace(/(?<![A-Za-z0-9_])_(.+?)_(?![A-Za-z0-9_])/g, "$1");
-	out = decodeEntities(out);
-	out = out.replace(/<\/?[A-Za-z][A-Za-z0-9-]*(?:\s[^<>]*)?\/?>/g, "");
-	out = out.replace(/\n{3,}/g, "\n\n");
-	out = out.replace(/[^\S\n]{2,}/g, " ");
-	return out.trim();
-}
-
-export { toSpeakableText as t };
-//# sourceMappingURL=speakable-text-BflxDDdY.js.map

package/build/server/chunks/speakable-text-BflxDDdY.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"speakable-text-BflxDDdY.js","sources":["../../../.svelte-kit/adapter-node/chunks/speakable-text.js"],"sourcesContent":["//#region src/lib/voice/speakable-text.ts\n/**\n* Deterministic markdown-to-speech text stripping. Pure and dependency-free\n* so both the browser TTS fallback (audio-playback.ts) and the server TTS\n* route (routes/api/speak/+server.ts) can run the exact same rules without\n* ever handing raw markdown syntax to a speech engine.\n*\n* Order matters: fenced code blocks and inline code are handled before any\n* other markdown stripping so their contents are never mistaken for\n* headings/emphasis/list markers. Whitespace collapsing runs last.\n*/\nvar HTML_ENTITIES = {\n\t\"&amp;\": \"&\",\n\t\"&lt;\": \"<\",\n\t\"&gt;\": \">\",\n\t\"&quot;\": \"\\\"\",\n\t\"&#39;\": \"'\"\n};\nfunction decodeEntities(text) {\n\treturn text.replace(/&amp;|&lt;|&gt;|&quot;|&#39;/g, (match) => HTML_ENTITIES[match] ?? match);\n}\nfunction urlToHostname(url) {\n\ttry {\n\t\treturn new URL(url).hostname;\n\t} catch {\n\t\treturn url;\n\t}\n}\nfunction toSpeakableText(text) {\n\tlet out = text;\n\tout = out.replace(/```[\\s\\S]*?```/g, \" Code omitted. \");\n\tout = out.replace(/`([^`]+)`/g, \"$1\");\n\tout = out.replace(/!\\[([^\\]]*)\\]\\([^)]*\\)/g, \"$1\");\n\tout = out.replace(/\\[([^\\]]*)\\]\\([^)]*\\)/g, \"$1\");\n\tout = out.replace(/https?:\\/\\/[^\\s)<>\"']+/g, (match) => urlToHostname(match));\n\tout = out.replace(/<[^>]+>/g, \"\");\n\tout = out.replace(/^\\s*(?:-{3,}|\\*{3,}|_{3,})\\s*$/gm, \"\");\n\tconst keptLines = [];\n\tfor (const line of out.split(\"\\n\")) {\n\t\tlet l = line;\n\t\tif (/^\\s*\\|?[\\s:|-]+\\|?\\s*$/.test(l) && l.includes(\"-\") && l.includes(\"|\")) continue;\n\t\tl = l.replace(/^\\s*>\\s?/, \"\");\n\t\tl = l.replace(/^\\s*#{1,6}\\s+/, \"\");\n\t\tconst wasListItem = /^\\s*(?:[-*+]|\\d+\\.)\\s+/.test(l);\n\t\tl = l.replace(/^\\s*(?:[-*+]|\\d+\\.)\\s+/, \"\");\n\t\tif (l.includes(\"|\")) l = l.replace(/^\\s*\\|/, \"\").replace(/\\|\\s*$/, \"\").split(\"|\").map((cell) => cell.trim()).join(\", \");\n\t\tl = l.trim();\n\t\tif (wasListItem && l && !/[.!?:]$/.test(l)) l += \".\";\n\t\tkeptLines.push(l);\n\t}\n\tout = keptLines.join(\"\\n\");\n\tout = out.replace(/~~(.+?)~~/g, \"$1\");\n\tout = out.replace(/\\*\\*(.+?)\\*\\*/g, \"$1\");\n\tout = out.replace(/__(.+?)__/g, \"$1\");\n\tout = out.replace(/\\*(.+?)\\*/g, \"$1\");\n\tout = out.replace(/(?<![A-Za-z0-9_])_(.+?)_(?![A-Za-z0-9_])/g, \"$1\");\n\tout = decodeEntities(out);\n\tout = out.replace(/<\\/?[A-Za-z][A-Za-z0-9-]*(?:\\s[^<>]*)?\\/?>/g, \"\");\n\tout = out.replace(/\\n{3,}/g, \"\\n\\n\");\n\tout = out.replace(/[^\\S\\n]{2,}/g, \" \");\n\treturn out.trim();\n}\n//#endregion\nexport { toSpeakableText as t };\n"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,aAAa,GAAG;AACpB,CAAC,OAAO,EAAE,GAAG;AACb,CAAC,MAAM,EAAE,GAAG;AACZ,CAAC,MAAM,EAAE,GAAG;AACZ,CAAC,QAAQ,EAAE,IAAI;AACf,CAAC,OAAO,EAAE;AACV,CAAC;AACD,SAAS,cAAc,CAAC,IAAI,EAAE;AAC9B,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,+BAA+B,EAAE,CAAC,KAAK,KAAK,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;AAC/F;AACA,SAAS,aAAa,CAAC,GAAG,EAAE;AAC5B,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;AAC9B,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,GAAG;AACZ,CAAC;AACD;AACA,SAAS,eAAe,CAAC,IAAI,EAAE;AAC/B,CAAC,IAAI,GAAG,GAAG,IAAI;AACf,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;AACxD,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC;AACtC,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,yBAAyB,EAAE,IAAI,CAAC;AACnD,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE,IAAI,CAAC;AAClD,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC,KAAK,KAAK,aAAa,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;AAClC,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,kCAAkC,EAAE,EAAE,CAAC;AAC1D,CAAC,MAAM,SAAS,GAAG,EAAE;AACrB,CAAC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;AACrC,EAAE,IAAI,CAAC,GAAG,IAAI;AACd,EAAE,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;AAC9E,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;AAC/B,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;AACpC,EAAE,MAAM,WAAW,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC;AACtD,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC;AAC7C,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;AACzH,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;AACd,EAAE,IAAI,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG;AACtD,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACnB,CAAC;AACD,CAAC,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;AAC3B,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC;AACtC,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC;AAC1C,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC;AACtC,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC;AACtC,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,2CAA2C,EAAE,IAAI,CAAC;AACrE,CAAC,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC;AAC1B,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,6CAA6C,EAAE,EAAE,CAAC;AACrE,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;AACrC,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;AACvC,CAAC,OAAO,GAAG,CAAC,IAAI,EAAE;AAClB;;;;"}