@synap-core/eve 0.1.0

package/dist/chunk-O5WTCVMZ.js

@@ -0,0 +1,3391 @@
+import { createRequire as __eveCreateRequire } from 'module'; const require = __eveCreateRequire(import.meta.url);
+import {
+  readAgentKeyOrLegacy,
+  readAgentKeyOrLegacySync,
+  readEveSecrets,
+  writeEveSecrets
+} from "./chunk-T7GCAJK5.js";
+import {
+  appendOperationalEvent
+} from "./chunk-HRF6TNXX.js";
+import {
+  __require
+} from "./chunk-FAE5UZFE.js";
+
+// ../@eve/dna/dist/chunk-7ERVFFFQ.js
+import { existsSync, mkdirSync, writeFileSync, copyFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+import { randomBytes } from "crypto";
+import { existsSync as existsSync2 } from "fs";
+import { execSync } from "child_process";
+import { join as join2 } from "path";
+import { execSync as execSync3 } from "child_process";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join4, dirname as dirname2 } from "path";
+import { Socket } from "net";
+import { execSync as execSync2 } from "child_process";
+import { readFileSync, existsSync as existsSync3 } from "fs";
+import { createRequire } from "module";
+import { createHash } from "crypto";
+import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
+import { fileURLToPath } from "url";
+import { dirname, join as join3 } from "path";
+var COMPONENTS = [
+  {
+    id: "traefik",
+    organ: "legs",
+    label: "Traefik",
+    emoji: "\u{1F9BF}",
+    description: "Reverse proxy & routing. Handles domain exposure, SSL termination, and service discovery for all Eve services. Always installed.",
+    longDescription: `Traefik is the front door of your stack. It listens on ports 80 and 443, terminates SSL with automatic Let's Encrypt certificates, and routes incoming requests to the right container based on the hostname.
+
+Every other Eve service hides behind it \u2014 Synap pod, Open WebUI, OpenClaw, the dashboard itself. When you set a domain (e.g. \`mystack.com\`), Traefik provisions certs for every \`<service>.mystack.com\` subdomain and routes traffic by container name on the shared \`eve-network\`.
+
+Traefik is always-on infrastructure. It can't be removed; the rest of the stack depends on it for any externally-reachable URL.`,
+    homepage: "https://traefik.io",
+    category: "infrastructure",
+    alwaysInstall: true,
+    service: {
+      containerName: "eve-legs-traefik",
+      internalPort: 80,
+      hostPort: 80,
+      subdomain: null,
+      // Traefik itself isn't routed by Traefik
+      healthPath: "/"
+    },
+    materializers: ["traefik-routes"],
+    health: { kind: "docker" },
+    lifecycle: { restartStrategy: "restart" },
+    doctor: { critical: true }
+  },
+  {
+    id: "freellmapi",
+    organ: "brain",
+    label: "FreeLLMAPI",
+    emoji: "\u{1F3B0}",
+    description: "Self-hosted gateway pooling free-tier LLM quota behind one OpenAI-compatible endpoint.",
+    longDescription: `FreeLLMAPI is a self-hosted router that sits in front of ~34 providers'
+FREE TIERS and exposes them as a single OpenAI-compatible \`/v1\` endpoint. You supply your own
+free-tier keys through its dashboard; it tracks per-key quota, scores models, and fails over on
+429/5xx.
+
+Inside Eve it is registered as a LOW-PRIORITY provider in your pod's ai_providers table, which
+means the Intelligence Service reaches for it only after your paid providers \u2014 a free fallback
+lane for when OpenRouter credits run dry, not the default brain.
+
+Two things worth knowing. It is capability-aware about TOOL CALLING: requests carrying \`tools\`
+are routed only to models that can emit structured tool_calls, and it repairs tool calls a
+failover model emitted in another model's dialect. And its own README is explicit that free tiers
+are "not a stable, supported inference substrate" \u2014 your agreement with each upstream provider
+still governs traffic proxied through it, so this is for personal experimentation, not production
+load.`,
+    homepage: "https://github.com/tashfeenahmed/freellmapi",
+    category: "add-on",
+    requires: ["traefik"],
+    service: {
+      containerName: "eve-brain-freellmapi",
+      // ONE port serves both the dashboard and the /v1 API — not a split.
+      internalPort: 3001,
+      hostPort: null,
+      subdomain: "llm",
+      healthPath: "/api/ping"
+    },
+    health: { kind: "http", path: "/api/ping" },
+    lifecycle: { restartStrategy: "restart" },
+    doctor: { critical: false }
+  },
+  {
+    id: "nango",
+    organ: "arms",
+    label: "Nango",
+    emoji: "\u{1F517}",
+    description: "Self-hosted OAuth integration platform. Connects Google, Slack, GitHub and 300+ services to your pod \u2014 tokens stay on your server.",
+    longDescription: `Nango is the integration layer that lets your pod speak OAuth with the outside world. Connect Google Contacts, Gmail, Google Calendar, Slack, GitHub, and hundreds more \u2014 without routing credentials through any third-party cloud.
+
+Why a sovereign stack needs Nango: most SaaS APIs require OAuth. Without it, you either paste API keys manually or give a cloud service access to your tokens. Nango self-hosted handles the full OAuth dance on your machine \u2014 the access tokens and refresh tokens never leave your server.
+
+Once Nango is running, Synap's CRM can sync Google Contacts \u2192 contacts, Gmail threads \u2192 notes, and Google Calendar events \u2192 activity. Eve can trigger real-time enrichment from any connected service. You configure OAuth app credentials once (Google Cloud Console, Slack app settings) and Nango handles the rest.
+
+Requires Postgres (already part of the Brain). Listens on port 3003, accessible only within the Eve network \u2014 not exposed publicly.`,
+    homepage: "https://nango.dev",
+    category: "infrastructure",
+    requires: ["traefik", "synap"],
+    service: {
+      containerName: "eve-arms-nango",
+      internalPort: 3003,
+      hostPort: null,
+      subdomain: "nango",
+      healthPath: "/health",
+      additionalSubdomains: [{
+        subdomain: "connect",
+        internalPort: 3009,
+        // env.js is dynamically generated by the API (port 3003), not the static SPA server
+        pathProxies: [{ path: "/env.js", internalPort: 3003 }]
+      }]
+    },
+    health: { kind: "http", path: "/health" },
+    lifecycle: { restartStrategy: "restart" },
+    doctor: { critical: false }
+  },
+  {
+    id: "ollama",
+    organ: "brain",
+    label: "Ollama",
+    emoji: "\u{1F916}",
+    description: "Local AI inference engine. Runs open-source models (Llama, Mistral, etc.) on your server. Keeps your data private.",
+    longDescription: `Ollama is a local model runtime \u2014 a self-contained LLM server you can pull models into and call via an OpenAI-compatible API. Llama, Mistral, Qwen, Gemma \u2014 pick what fits your hardware.
+
+Why a sovereign stack runs Ollama: your prompts and outputs never leave the machine. Synap IS will route to Ollama as a provider just like it routes to Anthropic or OpenAI, so agents and Open WebUI can use a local model without any code change.
+
+Heads up: model quality and speed depend heavily on your server's RAM and GPU. A 7B model is the practical baseline on CPU; 13B+ benefits from a GPU.`,
+    homepage: "https://ollama.ai",
+    category: "data",
+    requires: ["traefik"],
+    service: {
+      containerName: "eve-brain-ollama",
+      internalPort: 11434,
+      hostPort: 11434,
+      subdomain: "ai",
+      healthPath: "/"
+    },
+    health: { kind: "http", path: "/" },
+    lifecycle: { restartStrategy: "restart" },
+    doctor: { critical: false }
+  },
+  {
+    id: "synap",
+    organ: "brain",
+    label: "Synap Data Pod",
+    emoji: "\u{1F9E0}",
+    description: "Your sovereign second brain. Stores and organises all your data \u2014 notes, tasks, contacts, bookmarks. The foundation of your personal AI infrastructure.",
+    longDescription: `Synap is the data store every other component reads from. It captures notes, tasks, contacts, bookmarks, and any other entity type you define \u2014 typed JSONB profiles in Postgres, indexed by Typesense and pgvector for full-text and semantic search.
+
+The pod exposes both a tRPC API (for the Synap web/desktop apps) and a REST Hub Protocol (for AI agents like OpenClaw and external connectors). Once installed, agents can read and write data through Synap rather than each maintaining their own private store.
+
+This is the brain of the brain organ \u2014 most of what makes your stack feel intelligent depends on Synap being healthy. Watch its logs first when something feels off.`,
+    homepage: "https://github.com/synap-core/synap-backend",
+    category: "data",
+    requires: ["traefik"],
+    service: {
+      containerName: "eve-brain-synap",
+      internalPort: 4e3,
+      hostPort: null,
+      // bound only inside docker network
+      subdomain: "pod",
+      healthPath: "/health"
+    },
+    materializers: ["backend-env", "ai-wiring"],
+    health: { kind: "http", path: "/health" },
+    lifecycle: { restartStrategy: "compose-up", envBound: true },
+    doctor: { critical: true, integrationId: "synap" }
+  },
+  {
+    id: "pod-admin",
+    organ: "brain",
+    label: "Pod Admin Console",
+    emoji: "\u{1F6E0}\uFE0F",
+    description: "Operator console for the Synap pod \u2014 workspaces, users, audit. Replaces the legacy admin SPA.",
+    longDescription: `Pod Admin is the Next.js operator console for your Synap Data Pod. It's where you manage workspaces, users, agent provisioning, and audit logs. After Kratos login the browser redirects here, so it's the surface humans interact with most.
+
+Co-located with the synap pod (same docker-compose project, same image release cadence) but exposed on its own subdomain (\`pod-admin.<root>\`) so the API origin (\`pod.<root>\`) and the UI origin stay clean. Kratos session cookies are scoped to the bare root domain so login at one carries over to the other.`,
+    homepage: "https://github.com/synap-core/synap-backend",
+    category: "data",
+    requires: ["synap"],
+    service: {
+      containerName: "eve-brain-pod-admin",
+      internalPort: 3e3,
+      hostPort: null,
+      subdomain: "pod-admin",
+      healthPath: "/"
+    },
+    health: { kind: "http", path: "/" },
+    lifecycle: { restartStrategy: "compose-up", envBound: true },
+    doctor: { critical: false, integrationId: "synap" }
+  },
+  {
+    id: "openclaw",
+    organ: "arms",
+    label: "OpenClaw",
+    emoji: "\u{1F9BE}",
+    description: "AI action layer. Connects your stack to 24+ messaging platforms and executes agent skills. Prefer Hermes for new installs.",
+    longDescription: `OpenClaw turns your AI from a chat companion into an agent that can act across 24+ platforms \u2014 Telegram, Discord, WhatsApp, iMessage, Slack, Signal, Matrix, and more. It runs as a sandboxed Node.js gateway with shell access, a filesystem, MCP server mode (exposing channels to Claude Code and other MCP clients), and a skill system backed by the ClawHub registry (5,400+ community skills).
+
+Eve wires OpenClaw against Synap as its OpenAI-compatible provider, so the agent's brain is any provider you've configured. When the agent reads or writes data it goes through Synap's Hub Protocol \u2014 full audit trail, proposals when permissions don't allow direct writes.
+
+**Note:** For new installs, Hermes is the recommended agent. Hermes has a contractual memory plugin that guarantees 100% of conversations sync to your Synap pod, better multi-agent orchestration, and a stronger security record. OpenClaw remains fully supported and is the better choice if you need MCP server mode for Claude Code or iMessage support.`,
+    homepage: "https://openclaw.ai",
+    category: "agent",
+    requires: ["synap"],
+    deprecated: true,
+    deprecationNotice: "Prefer Hermes for new installs \u2014 it has native memory plugin integration with Synap, better security, and true multi-agent orchestration. OpenClaw stays fully functional and is the right choice for MCP bridge or iMessage. See docs/openclaw-vs-hermes.md.",
+    replacedBy: "hermes",
+    service: {
+      containerName: "eve-arms-openclaw",
+      internalPort: 18789,
+      hostPort: 18789,
+      subdomain: "openclaw"
+    },
+    materializers: ["openclaw-config", "ai-wiring"],
+    health: { kind: "docker" },
+    lifecycle: { restartStrategy: "recreate", envBound: true },
+    doctor: { critical: false, integrationId: "openclaw-synap" }
+  },
+  {
+    id: "hermes",
+    organ: "arms",
+    label: "Hermes",
+    emoji: "\u{1F9E0}",
+    description: "AI agent with sovereign memory. Routes all conversations and channel messages to your Synap pod \u2014 nothing is lost.",
+    longDescription: `Hermes is the primary AI agent for your Eve stack. It runs as a headless gateway (port 8642) that handles messaging from Telegram, Discord, WhatsApp, Signal, Matrix, Slack, and 14 more platforms. Unlike other agents, Hermes has a contractual memory architecture: a custom Synap plugin (auto-generated by Eve) guarantees that 100% of every conversation turn is synced to your Data Pod.
+
+Key capabilities: true multi-agent orchestration (spawn specialised sub-agents), 7 terminal backends (local, Docker, SSH, Modal, Daytona), 61 built-in tools, self-improving skills (the agent creates and refines its own skills during use), and a dashboard on port 9119.
+
+The Synap plugin is the crown jewel: Eve generates \`synap_provider.py\` into the Hermes plugin directory. Hermes loads it on startup and from that point every turn \u2014 prefetch (memory context injected before each reply) + sync_turn (conversation written to Synap after each reply) + on_session_end (facts extracted at the end) \u2014 all route through Hub Protocol to your pod. Hermes stays stateless; Synap is the brain.`,
+    homepage: "https://hermes-agent.nousresearch.com",
+    category: "agent",
+    requires: ["synap"],
+    service: {
+      containerName: "eve-builder-hermes",
+      internalPort: 8642,
+      hostPort: 8642,
+      subdomain: "hermes",
+      healthPath: "/health"
+    },
+    materializers: ["hermes-env", "ai-wiring"],
+    health: { kind: "http", path: "/health" },
+    lifecycle: { restartStrategy: "recreate", envBound: true },
+    doctor: { critical: false, integrationId: "hermes-synap" }
+  },
+  {
+    id: "stalwart",
+    organ: "mouth",
+    label: "Stalwart Mail",
+    emoji: "\u{1F4E7}",
+    description: "Sovereign mail server. SMTP/IMAP/JMAP in one Rust binary \u2014 own your inbox, no Gmail in the loop.",
+    longDescription: `Stalwart is a complete, self-hosted mail server: SMTP, IMAP, POP3, JMAP and ManageSieve in a single Rust binary. It replaces renting Gmail (and routing your mail through an aggregator) with owning the mailbox outright on your own server.
+
+Why a sovereign stack runs Stalwart: email is the last big piece of your digital life that usually lives in someone else's cloud. With Stalwart, every message \u2014 inbound and outbound \u2014 passes through your machine. DKIM, SPF, DMARC and MTA-STS records are generated for you; you publish them in DNS and your mail authenticates like any major provider.
+
+The HTTP surface (JMAP + admin console) is fronted by Traefik at \`mail.<domain>\`. The raw mail protocols (SMTP 25, submission 465/587, IMAP 143/993, POP3 110/995, ManageSieve 4190) are published directly on the host \u2014 Traefik is HTTP-only, and binding them straight to the container preserves the real sender IP that SPF/DMARC depend on.
+
+Once running, Synap's email channel talks to Stalwart over JMAP: your agent reads threads and drafts replies, and every send is gated by a proposal you approve. Pair it with the Bulwark webmail component for a human inbox at \`webmail.<domain>\`.
+
+Heads up: deliverability needs a PTR/reverse-DNS record set at your VPS provider (the one record Stalwart can't automate), and some providers block outbound port 25 \u2014 \`eve doctor\` checks both. Stalwart is pre-1.0; the image tag is pinned and upgrades may require data migration.`,
+    homepage: "https://stalw.art",
+    category: "data",
+    requires: ["traefik"],
+    service: {
+      containerName: "eve-mouth-stalwart",
+      // HTTP listener (JMAP + admin). Fronted by Traefik via Docker DNS; the
+      // raw-TCP mail ports are published on the host by the install recipe.
+      internalPort: 8080,
+      hostPort: null,
+      subdomain: "mail",
+      healthPath: "/healthz/live"
+    },
+    health: { kind: "http", path: "/healthz/live" },
+    lifecycle: { restartStrategy: "restart" },
+    doctor: { critical: false }
+  },
+  {
+    id: "bulwark",
+    organ: "mouth",
+    label: "Bulwark Webmail",
+    emoji: "\u2709\uFE0F",
+    description: "Modern JMAP webmail for Stalwart. A fast, private inbox UI at webmail.<domain>.",
+    longDescription: `Bulwark is a modern, self-hosted webmail client built for Stalwart over the JMAP protocol \u2014 email, calendar, contacts and files in one fast UI. It's the human front door to the mailbox your Stalwart server hosts.
+
+Eve runs it as a sidecar fronted by Traefik at \`webmail.<domain>\`. On first launch Bulwark's setup wizard asks for the JMAP server URL (\`https://mail.<domain>\`), OAuth, branding and an admin password \u2014 Eve pre-fills the JMAP URL for you.
+
+Install this when you want a browser inbox alongside the agent-driven email channel in Synap. Skip it if you only ever touch email through your AI.`,
+    homepage: "https://bulwarkmail.org",
+    category: "add-on",
+    requires: ["stalwart"],
+    service: {
+      containerName: "eve-mouth-bulwark",
+      internalPort: 3e3,
+      hostPort: null,
+      subdomain: "webmail",
+      healthPath: "/"
+    },
+    health: { kind: "http", path: "/" },
+    lifecycle: { restartStrategy: "restart" },
+    doctor: { critical: false }
+  },
+  {
+    id: "rsshub",
+    organ: "eyes",
+    label: "RSSHub Feeds",
+    emoji: "\u{1F441}\uFE0F",
+    description: "Data perception layer. Turns any website into RSS feeds so your AI can stay informed about what matters.",
+    longDescription: `RSSHub generates RSS feeds for sources that don't expose them \u2014 Twitter accounts, GitHub issues, LinkedIn updates, news sites, anything that publishes regularly without a feed. It runs ~1,000 source adapters out of the box.
+
+For a sovereign stack this matters because it's how your AI keeps up with the world without any external service in the loop. Synap subscribes to RSSHub feeds, captures items as bookmark entities, and your agents see new content in their context the same way they see your manually-captured notes.
+
+This is the eyes organ \u2014 the part of your stack that watches things you care about so you don't have to.`,
+    homepage: "https://docs.rsshub.app",
+    category: "perception",
+    requires: ["synap"],
+    service: {
+      containerName: "eve-eyes-rsshub",
+      internalPort: 1200,
+      hostPort: 1200,
+      subdomain: "feeds",
+      healthPath: "/"
+    },
+    health: { kind: "http", path: "/" },
+    lifecycle: { restartStrategy: "restart" },
+    doctor: { critical: false }
+  },
+  {
+    id: "dokploy",
+    label: "Dokploy",
+    emoji: "\u{1F527}",
+    description: "Low-code PaaS for deploying applications. Optional \u2014 install later if you need a visual deployment dashboard.",
+    longDescription: `Dokploy is a self-hosted PaaS \u2014 think Heroku or Railway, running on your own server. It manages app deployments, databases, and SSL through a visual UI, sitting alongside Eve's Traefik (or replacing it if you prefer Dokploy's routing).
+
+Install this if you want a clicky deploy story for the apps Hermes generates \u2014 push code, click deploy, get a URL. Skip it if you're happy running compose files by hand.`,
+    homepage: "https://dokploy.com",
+    category: "add-on",
+    lifecycle: { restartStrategy: "none" },
+    doctor: { critical: false }
+  },
+  {
+    id: "opencode",
+    label: "OpenCode",
+    emoji: "\u{1F4BB}",
+    description: "AI-powered code editor. Lets your agent write and edit code directly on your server.",
+    longDescription: `OpenCode is an AI-augmented code editor exposed as a service. Your agents (and you) can open files, edit them, run commands \u2014 all from the same machine your stack lives on, with Synap's data as context.
+
+This is how a sovereign stack does development without bouncing through someone else's cloud IDE. It pairs especially well with Hermes for "describe what you want, watch the agent write it" loops.`,
+    homepage: "https://github.com/sst/opencode",
+    category: "add-on",
+    lifecycle: { restartStrategy: "none" },
+    doctor: { critical: false }
+  },
+  {
+    id: "openclaude",
+    label: "OpenClaude",
+    emoji: "\u{1F916}",
+    description: "Claude Code as a service. Exposes Claude Code to your agent for advanced coding tasks.",
+    longDescription: `OpenClaude wraps Claude Code as a long-running service so your agents can delegate hard coding tasks to it. Where OpenClaw is general-purpose action, OpenClaude is specifically the heavyweight coding sub-agent.
+
+Use this when you want the best-in-class coding model on tap from inside your stack \u2014 without exposing your codebase to a third party that doesn't run on your hardware.`,
+    category: "add-on",
+    lifecycle: { restartStrategy: "none" },
+    doctor: { critical: false }
+  },
+  {
+    id: "claude-code",
+    label: "Claude Code CLI",
+    emoji: "\u26A1",
+    description: "Anthropic's Claude Code CLI installed on your server. Run AI-powered coding sessions directly from the terminal.",
+    longDescription: `Claude Code is Anthropic's official AI coding assistant that runs in your terminal. It can read, write and edit files, run tests, execute commands, and navigate large codebases \u2014 all from a single CLI.
+
+Installing it on your server means your Eve agents (especially Hermes) can spawn a Claude Code session on the server itself to tackle complex coding tasks. It's also just useful to have available when you SSH in.
+
+Requires an Anthropic API key. After install, run \`claude\` to start a session or \`claude --help\` for all options.`,
+    homepage: "https://claude.ai/code",
+    category: "add-on",
+    lifecycle: { restartStrategy: "none" },
+    doctor: { critical: false }
+  },
+  {
+    id: "t3code",
+    label: "T3 Code",
+    emoji: "\u26A1",
+    description: "Self-hosted code execution backend (WebSocket). Connects the DevPlane pipeline to a T3 Code server for executing, verifying, and debugging phases.",
+    longDescription: `T3 Code is a self-hosted WebSocket server that wraps OpenAI Codex. The DevPlane agent pipeline delegates code execution phases (executing / verifying / debugging) to it via the Eve CodexFeaturePoller daemon.
+
+Unlike other builders, T3 Code is not installed by Eve \u2014 it runs separately on your infrastructure. This command stores the connection details (URL + API key) so Eve can wire them into the backend and CodexFeaturePoller automatically.`,
+    homepage: "https://github.com/openai/codex",
+    category: "add-on",
+    lifecycle: { restartStrategy: "none" },
+    doctor: { critical: false }
+  },
+  {
+    id: "openwebui",
+    label: "Open WebUI",
+    emoji: "\u{1F4AC}",
+    description: "Self-hosted chat UI wired to Synap IS. No external DB \u2014 SQLite by default. Eve installs inline Filter Functions for memory injection + channel sync.",
+    longDescription: `Open WebUI is the chat interface for everyone in your household or team \u2014 looks like ChatGPT, runs on your stack. Eve wires it against Synap IS as the OpenAI-compatible backend, so any provider you've configured (Anthropic, OpenAI, OpenRouter, Ollama) is available behind a normal model picker.
+
+State (conversations, users, settings) lives in a local SQLite by default \u2014 no external database.
+
+Eve also installs two inline Filter Functions directly into Open WebUI:
+  - Synap Memory Injection \u2014 pre-prompt hook that pulls relevant entities + memories from your pod and injects them as context.
+  - Synap Channel Sync \u2014 mirrors every conversation into a Synap thread so your agents can read it as context.
+
+The other Hub Protocol operations (entity create, knowledge search, calendar lookup, \u2026) are exposed as model-callable tools via the registered OpenAPI tool server, so the model decides when to invoke them.`,
+    homepage: "https://openwebui.com",
+    category: "add-on",
+    requires: ["synap"],
+    service: {
+      containerName: "hestia-openwebui",
+      internalPort: 8080,
+      hostPort: 3011,
+      subdomain: "chat",
+      healthPath: "/health"
+    },
+    materializers: ["openwebui-config", "ai-wiring"],
+    health: { kind: "http", path: "/health" },
+    lifecycle: { restartStrategy: "compose-up", envBound: true },
+    doctor: { critical: false, integrationId: "openwebui-synap" }
+  },
+  {
+    id: "eve-dashboard",
+    label: "Eve Dashboard",
+    emoji: "\u{1F33F}",
+    description: "Web dashboard for Eve \u2014 view installed components, manage AI providers, configure your stack from a browser.",
+    longDescription: `The Eve Dashboard is the meta-UI you're looking at right now: a Next.js app shipped as a Docker container that joins the same network as everything else. It reads your stack's secrets and state via mounted host paths and talks to Docker via the daemon socket.
+
+It's the front door \u2014 the place where you check that your stack is alive, jump into other components' UIs, and configure the plumbing every component needs (AI keys, domain, SSL). The actual work happens in the apps it launches you into.
+
+Always-on infrastructure, like Traefik. Removing it would leave you with no UI control plane.`,
+    category: "infrastructure",
+    requires: ["traefik"],
+    alwaysInstall: true,
+    service: {
+      containerName: "eve-dashboard",
+      // Internal port the Next standalone server listens on (PORT env, default 3000).
+      internalPort: 3e3,
+      // Host port for direct localhost access (when no domain is configured).
+      hostPort: 7979,
+      subdomain: "eve",
+      healthPath: "/api/state"
+    },
+    materializers: ["traefik-routes"],
+    health: { kind: "http", path: "/api/state" },
+    lifecycle: { restartStrategy: "recreate", envBound: true },
+    doctor: { critical: true }
+  }
+];
+var EVE_DASHBOARD_SERVICE = {
+  id: "eve-dashboard",
+  label: "Eve Dashboard",
+  emoji: "\u{1F33F}",
+  service: {
+    containerName: "eve-dashboard",
+    internalPort: 3e3,
+    hostPort: 7979,
+    subdomain: "eve",
+    healthPath: "/api/state"
+  }
+};
+function resolveComponent(id) {
+  const comp = COMPONENTS.find((c) => c.id === id);
+  if (!comp) {
+    throw new Error(`Unknown component: ${id}. Available: ${COMPONENTS.map((c) => c.id).join(", ")}`);
+  }
+  return comp;
+}
+function allComponentIds() {
+  return COMPONENTS.filter((c) => !c.category.includes("add-on")).map((c) => c.id);
+}
+function addonComponentIds() {
+  return COMPONENTS.filter((c) => c.category === "add-on").map((c) => c.id);
+}
+function selectedIds(selected) {
+  return COMPONENTS.filter((c) => selected[c.id]).map((c) => c.id);
+}
+function serviceComponents() {
+  return COMPONENTS.filter((c) => c.service !== void 0 && c.service.subdomain !== null);
+}
+function validateBaseDomain(input) {
+  const trimmed = input.trim().replace(/^https?:\/\//, "").replace(/\/.*$/, "");
+  if (!trimmed.includes(".")) return null;
+  const firstLabel = trimmed.split(".")[0];
+  const reserved = new Set(
+    COMPONENTS.map((c) => c.service?.subdomain).filter((s) => typeof s === "string" && s.length > 0)
+  );
+  if (reserved.has(firstLabel)) {
+    const root = trimmed.slice(firstLabel.length + 1);
+    return `"${trimmed}" looks like a service subdomain (first label "${firstLabel}" matches a registered component). Pass the bare root domain instead, e.g. "${root}". Eve will append component subdomains automatically (pod.${root}, pod-admin.${root}, eve.${root}, \u2026).`;
+  }
+  return null;
+}
+function publicComponentUrl(componentId, domain, ssl) {
+  const cleanDomain = domain?.trim();
+  if (!cleanDomain || cleanDomain === "localhost") return null;
+  const comp = COMPONENTS.find((c) => c.id === componentId);
+  if (!comp || !comp.service?.subdomain) return null;
+  const scheme = ssl ? "https" : "http";
+  return `${scheme}://${comp.service.subdomain}.${cleanDomain}`;
+}
+function isLoopbackUrl(url) {
+  if (!url) return false;
+  try {
+    const u = new URL(url);
+    return u.hostname === "127.0.0.1" || u.hostname === "localhost" || u.hostname === "::1" || u.hostname === "[::1]";
+  } catch {
+    return false;
+  }
+}
+var SYNAP_BACKEND_INTERNAL_URL = "http://eve-brain-synap:4000";
+var SYNAP_HOST_LOOPBACK_PORT = 14e3;
+function resolveSynapUrl(secrets) {
+  const stored = secrets?.synap?.apiUrl?.trim();
+  if (stored && !isLoopbackUrl(stored)) return stored;
+  const domain = secrets?.domain?.primary?.trim();
+  if (domain && domain !== "localhost") {
+    const ssl = secrets?.domain?.ssl ?? false;
+    return `${ssl ? "https" : "http"}://pod.${domain}`;
+  }
+  if (stored) return stored;
+  return "";
+}
+var DEFAULT_HUB_PATH = "/api/hub";
+function resolveHubBaseUrl(secrets) {
+  if (secrets?.synap?.hubBaseUrl?.trim()) {
+    return secrets.synap.hubBaseUrl.replace(/\/$/, "");
+  }
+  const base = resolveSynapUrl(secrets).replace(/\/$/, "");
+  if (!base) return void 0;
+  return `${base}${DEFAULT_HUB_PATH}`;
+}
+function defaultSkillsDir() {
+  return join(homedir(), ".eve", "skills");
+}
+async function ensureEveSkillsLayout(skillsDir = defaultSkillsDir(), hubBaseUrl, apiKey) {
+  mkdirSync(join(skillsDir, "synap"), { recursive: true });
+  if (hubBaseUrl && apiKey) {
+    try {
+      const res = await fetch(`${hubBaseUrl}/skills/system`, {
+        headers: { Authorization: `Bearer ${apiKey}` },
+        signal: AbortSignal.timeout(8e3)
+      });
+      if (res.ok) {
+        const packages = await res.json();
+        const globalClaudeSkillsDir = join(homedir(), ".claude", "skills");
+        for (const pkg of packages) {
+          const pkgDir = join(skillsDir, pkg.slug);
+          const globalPkgDir = join(globalClaudeSkillsDir, pkg.slug);
+          mkdirSync(pkgDir, { recursive: true });
+          mkdirSync(globalPkgDir, { recursive: true });
+          for (const file of pkg.files) {
+            writeFileSync(join(pkgDir, file.path), file.content, "utf-8");
+            writeFileSync(join(globalPkgDir, file.path), file.content, "utf-8");
+          }
+        }
+        return;
+      }
+    } catch {
+    }
+  }
+  const stubPath = join(skillsDir, "synap", "SKILL.md");
+  if (!existsSync(stubPath)) {
+    writeFileSync(stubPath, `---
+name: synap
+description: Use for memory, entities, channels, search, and governance via the Synap Hub Protocol.
+---
+
+# Synap Hub Protocol
+
+Base URL: $HUB_BASE_URL
+Auth: Authorization: Bearer $SYNAP_API_KEY
+
+Key endpoints:
+  GET  /memory?query=...          full-text search facts
+  POST /memory                    store a fact
+  GET  /entities/search?q=...     search entities
+  POST /entities                  create entity
+  GET  /entities/:id
+  PUT  /entities/:id              update entity (merges)
+  GET  /channels?workspaceId=...  list channels
+  POST /skills/:id/execute        run a user skill
+  GET  /skills/system             list system skill docs
+  GET  /profiles                  list entity types
+
+Run GET /users/me + GET /workspaces on startup to orient yourself.
+`, "utf-8");
+  }
+}
+async function writeBuilderProjectEnv(projectDir, cwd = process.cwd()) {
+  const secrets = await readEveSecrets(cwd);
+  const hub = resolveHubBaseUrl(secrets);
+  const skillsDir = secrets?.builder?.skillsDir ?? defaultSkillsDir();
+  const synapApiKeyForSkills = await readAgentKeyOrLegacy("coder", cwd);
+  await ensureEveSkillsLayout(skillsDir, hub, synapApiKeyForSkills);
+  const synapApiKey = await readAgentKeyOrLegacy("coder", cwd);
+  const lines = [
+    "# Generated by Eve \u2014 Synap Hub + workspace wiring",
+    `SYNAP_API_URL=${resolveSynapUrl(secrets)}`,
+    `SYNAP_API_KEY=${synapApiKey}`,
+    `HUB_BASE_URL=${hub ?? ""}`,
+    `EVE_SKILLS_DIR=${skillsDir}`,
+    `DOKPLOY_WEBHOOK_URL=${secrets?.builder?.dokployWebhookUrl ?? process.env.DOKPLOY_WEBHOOK_URL ?? ""}`,
+    `DOKPLOY_API_URL=${secrets?.builder?.dokployApiUrl ?? ""}`,
+    `DOKPLOY_API_KEY=${secrets?.builder?.dokployApiKey ?? ""}`,
+    ""
+  ];
+  writeFileSync(join(projectDir, ".env"), lines.join("\n"), { mode: 384 });
+}
+async function writeSandboxEnvFile(cwd = process.cwd()) {
+  const secrets = await readEveSecrets(cwd);
+  const hub = resolveHubBaseUrl(secrets);
+  const skillsDir = secrets?.builder?.skillsDir ?? defaultSkillsDir();
+  const workspaceDir = secrets?.builder?.workspaceDir ?? join(cwd, ".eve", "workspace");
+  const synapApiKeyForSkills = await readAgentKeyOrLegacy("eve", cwd);
+  await ensureEveSkillsLayout(skillsDir, hub, synapApiKeyForSkills);
+  const synapApiKey = await readAgentKeyOrLegacy("eve", cwd);
+  const eveDir = join(cwd, ".eve");
+  mkdirSync(eveDir, { recursive: true });
+  const path = join(eveDir, "sandbox.env");
+  const lines = [
+    `SYNAP_API_URL=${resolveSynapUrl(secrets)}`,
+    `SYNAP_API_KEY=${synapApiKey}`,
+    `HUB_BASE_URL=${hub ?? ""}`,
+    `EVE_SKILLS_DIR=${skillsDir}`,
+    `EVE_WORKSPACE_DIR=${workspaceDir}`,
+    `DOKPLOY_WEBHOOK_URL=${secrets?.builder?.dokployWebhookUrl ?? process.env.DOKPLOY_WEBHOOK_URL ?? ""}`
+  ];
+  writeFileSync(path, lines.join("\n") + "\n", { mode: 384 });
+  return path;
+}
+function copySynapSkillIntoClaudeProject(projectDir, skillsDir = defaultSkillsDir()) {
+  const { readdirSync: _readdirSync } = __require("fs");
+  const skillPkgs = ["synap", "synap-schema", "synap-ui"];
+  const destRoots = [
+    join(projectDir, ".claude", "skills"),
+    join(homedir(), ".claude", "skills")
+  ];
+  for (const pkg of skillPkgs) {
+    const srcDir = join(skillsDir, pkg);
+    try {
+      const files = _readdirSync(srcDir);
+      for (const destRoot of destRoots) {
+        const destDir = join(destRoot, pkg);
+        mkdirSync(destDir, { recursive: true });
+        for (const file of files) {
+          if (file.endsWith(".md")) {
+            copyFileSync(join(srcDir, file), join(destDir, file));
+          }
+        }
+      }
+    } catch {
+    }
+  }
+}
+async function writeClaudeCodeSettings(projectDir, cwd = process.cwd()) {
+  const secrets = await readEveSecrets(cwd);
+  const hub = resolveHubBaseUrl(secrets);
+  const synapApiKey = await readAgentKeyOrLegacy("coder", cwd);
+  const skillsDir = secrets?.builder?.skillsDir ?? defaultSkillsDir();
+  await ensureEveSkillsLayout(skillsDir, hub ?? void 0, synapApiKey ?? void 0);
+  const dir = join(projectDir, ".claude");
+  mkdirSync(dir, { recursive: true });
+  const settings = {
+    env: {
+      SYNAP_API_URL: resolveSynapUrl(secrets),
+      SYNAP_API_KEY: synapApiKey,
+      HUB_BASE_URL: hub ?? "",
+      EVE_SKILLS_DIR: skillsDir
+    }
+  };
+  writeFileSync(join(dir, "settings.json"), JSON.stringify(settings, null, 2), "utf-8");
+  const hermesApiKey = secrets?.builder?.hermes?.apiServerKey;
+  if (hermesApiKey) {
+    const mcpServersDir = join(dir, "mcp-servers");
+    mkdirSync(mcpServersDir, { recursive: true });
+    const hermesMcp = {
+      type: "http",
+      url: "http://localhost:9120",
+      name: "hermes",
+      description: "Hermes agent \u2014 memory, channels, skills via Synap Hub Protocol",
+      headers: { Authorization: `Bearer ${hermesApiKey}` }
+    };
+    writeFileSync(join(mcpServersDir, "hermes.json"), JSON.stringify(hermesMcp, null, 2), "utf-8");
+  }
+  const synapUrl = resolveSynapUrl(secrets);
+  const synapMcpUrl = synapUrl ? `${synapUrl.replace(/\/$/, "")}/mcp` : "";
+  if (synapMcpUrl && synapApiKey) {
+    const mcpServersDir = join(dir, "mcp-servers");
+    mkdirSync(mcpServersDir, { recursive: true });
+    const synapMcp = {
+      type: "http",
+      url: synapMcpUrl,
+      name: "synap",
+      description: "Synap Data Pod \u2014 entities, memory, search, documents, channels, governance",
+      headers: { Authorization: `Bearer ${synapApiKey}` }
+    };
+    writeFileSync(join(mcpServersDir, "synap.json"), JSON.stringify(synapMcp, null, 2), "utf-8");
+  }
+}
+async function writeHermesEnvFile(cwd = process.cwd()) {
+  const secrets = await readEveSecrets(cwd);
+  const hub = resolveHubBaseUrl(secrets);
+  const hermesConfig = secrets?.builder?.hermes;
+  const synapApiKey = await readAgentKeyOrLegacy("hermes", cwd);
+  const skillsDir = secrets?.builder?.skillsDir ?? defaultSkillsDir();
+  await ensureEveSkillsLayout(skillsDir, hub ?? void 0, synapApiKey ?? void 0);
+  let apiServerKey = hermesConfig?.apiServerKey;
+  if (!apiServerKey) {
+    apiServerKey = randomBytes(32).toString("hex");
+    await writeEveSecrets({
+      builder: { hermes: { ...hermesConfig ?? {}, apiServerKey } }
+    });
+  }
+  const eveDir = join(homedir(), ".eve");
+  mkdirSync(eveDir, { recursive: true });
+  const path = join(eveDir, "hermes.env");
+  const lines = [
+    `SYNAP_API_URL=${resolveSynapUrl(secrets)}`,
+    `SYNAP_API_KEY=${synapApiKey}`,
+    `HUB_BASE_URL=${hub ?? ""}`,
+    `HERMES_ENABLED=${hermesConfig?.enabled ?? true}`,
+    `HERMES_POLL_INTERVAL_MS=${hermesConfig?.pollIntervalMs ?? 3e4}`,
+    `HERMES_MAX_CONCURRENT_TASKS=${hermesConfig?.maxConcurrentTasks ?? 1}`,
+    `EVE_WORKSPACE_DIR=${secrets?.builder?.workspaceDir ?? join(homedir(), ".eve", "workspace")}`,
+    // API server key — clients (OpenWebUI, LobeChat, etc.) use this to call
+    // the Hermes OpenAI-compat gateway at port 8642.
+    `API_SERVER_ENABLED=true`,
+    `API_SERVER_HOST=0.0.0.0`,
+    `API_SERVER_PORT=8642`,
+    `API_SERVER_KEY=${apiServerKey}`,
+    // Hermes gateway is already behind OpenWebUI's auth layer — OWUI enforces
+    // login before any request reaches the gateway. Allow all at the gateway
+    // level so OWUI-proxied requests aren't double-rejected.
+    `GATEWAY_ALLOW_ALL_USERS=true`
+  ];
+  const hermesProvider = secrets?.ai?.serviceProviders?.["hermes"] ?? secrets?.ai?.defaultProvider;
+  if (hermesProvider === "openai" || hermesProvider === "openrouter") {
+    lines.push(`SYNAP_EMBED_MODEL=text-embedding-3-small`);
+  }
+  const routing = secrets?.channels ? buildChannelRouting(secrets) : {};
+  const channels = secrets?.channels ?? {};
+  if (channels.telegram?.enabled && routing.telegram === "hermes") {
+    lines.push(`TELEGRAM_BOT_TOKEN=${channels.telegram.botToken ?? ""}`);
+    if (channels.telegram.webhookSecret) {
+      lines.push(`TELEGRAM_WEBHOOK_SECRET=${channels.telegram.webhookSecret}`);
+    }
+  }
+  if (channels.discord?.enabled && routing.discord === "hermes") {
+    lines.push(`DISCORD_BOT_TOKEN=${channels.discord.botToken ?? ""}`);
+    if (channels.discord.guildId) lines.push(`DISCORD_GUILD_ID=${channels.discord.guildId}`);
+    if (channels.discord.applicationId) lines.push(`DISCORD_APPLICATION_ID=${channels.discord.applicationId}`);
+  }
+  if (channels.whatsapp?.enabled && routing.whatsapp === "hermes") {
+    lines.push(`WHATSAPP_PHONE_NUMBER_ID=${channels.whatsapp.phoneNumberId ?? ""}`);
+    lines.push(`WHATSAPP_ACCESS_TOKEN=${channels.whatsapp.accessToken ?? ""}`);
+    if (channels.whatsapp.verifyToken) lines.push(`WHATSAPP_VERIFY_TOKEN=${channels.whatsapp.verifyToken}`);
+  }
+  if (channels.signal?.enabled && routing.signal === "hermes") {
+    lines.push(`SIGNAL_PHONE_NUMBER=${channels.signal.phoneNumber ?? ""}`);
+    lines.push(`SIGNAL_API_URL=${channels.signal.apiUrl ?? ""}`);
+  }
+  if (channels.matrix?.enabled && routing.matrix === "hermes") {
+    lines.push(`MATRIX_HOMESERVER_URL=${channels.matrix.homeserverUrl ?? ""}`);
+    lines.push(`MATRIX_ACCESS_TOKEN=${channels.matrix.accessToken ?? ""}`);
+    if (channels.matrix.roomId) lines.push(`MATRIX_ROOM_ID=${channels.matrix.roomId}`);
+  }
+  if (channels.slack?.enabled && routing.slack === "hermes") {
+    lines.push(`SLACK_BOT_TOKEN=${channels.slack.botToken ?? ""}`);
+    lines.push(`SLACK_SIGNING_SECRET=${channels.slack.signingSecret ?? ""}`);
+    if (channels.slack.appToken) lines.push(`SLACK_APP_TOKEN=${channels.slack.appToken}`);
+  }
+  lines.push("");
+  writeFileSync(path, lines.join("\n"), { mode: 384 });
+  return path;
+}
+function buildChannelRouting(secrets) {
+  const platforms = ["telegram", "discord", "whatsapp", "signal", "matrix", "slack"];
+  const result = {};
+  for (const p of platforms) {
+    result[p] = secrets.channelRouting?.[p] ?? "hermes";
+  }
+  return result;
+}
+var HERMES_CONFIG_YAML = (model, baseUrl, apiKey, mcpUrl) => `# Hermes config \u2014 managed by Eve (eve install / eve ai apply)
+# Editing this file directly is fine; Eve will overwrite the managed sections on the next apply.
+
+memory:
+  # Synap memory provider: 100% of memory syncs go to the Data Pod.
+  # The synap plugin lives at $HERMES_HOME/plugins/memory/synap/
+  provider: synap
+
+# Named provider entry \u2014 Hermes resolves credentials from here, not from model.base_url/api_key.
+# Both the main model and auxiliary clients (vision, web-extract) look up "custom/main".
+providers:
+  main:
+    base_url: ${baseUrl}
+    api_key: ${apiKey}
+    model: ${model}
+
+model:
+  provider: custom:main
+  default: ${model}
+
+# MCP server \u2014 exposes Hermes tools to Claude Code, Cursor, and any MCP client.
+# Connect at http://localhost:9120 (host) or http://eve-builder-hermes:9120 (docker network).
+mcp:
+  server:
+    enabled: true
+    port: 9120
+    host: 0.0.0.0
+
+# MCP clients \u2014 external MCP servers Hermes can call tools on.
+# Synap Data Pod: all Synap tools available natively (search, entities, memory, etc.)
+  clients:
+    synap:
+      url: ${mcpUrl}
+      transport: http
+      auth:
+        type: bearer
+        token: \${SYNAP_API_KEY}
+
+# Hermes dashboard \u2014 admin UI
+dashboard:
+  port: 9119
+
+# Skills \u2014 Synap Hub Protocol reference docs (mounted from ~/.eve/skills).
+# Lives at /opt/data/synap-skills/ inside the container so it doesn't
+# shadow Hermes's own /opt/data/skills/ bundled-skills directory (writable,
+# managed by Hermes; we'd block its 91-skill bootstrap copy if we mounted
+# the read-only Synap docs there).
+skills:
+  dir: /opt/data/synap-skills
+`;
+async function writeHermesConfigYaml(cwd = process.cwd()) {
+  const secrets = await readEveSecrets(cwd);
+  return writeHermesConfigYamlSync(secrets);
+}
+function writeHermesConfigYamlSync(secrets) {
+  const providers = secrets?.ai?.providers ?? [];
+  const implicitDefault = providers.find((p) => p.enabled !== false)?.id ?? "";
+  const providerId = secrets?.ai?.serviceProviders?.["hermes"] ?? secrets?.ai?.defaultProvider ?? implicitDefault;
+  const provider = providers.find((p) => p.id === providerId);
+  const BUILTIN_URLS = {
+    openrouter: "https://openrouter.ai/api/v1",
+    openai: "https://api.openai.com/v1",
+    anthropic: "https://api.anthropic.com/v1",
+    ollama: "http://eve-brain-ollama:11434/v1"
+  };
+  let baseUrl = provider?.baseUrl?.replace(/\/$/, "") ?? BUILTIN_URLS[providerId] ?? "";
+  if (providerId === "ollama" && /localhost|127\.0\.0\.1/.test(baseUrl)) {
+    baseUrl = baseUrl.replace(/localhost|127\.0\.0\.1/, "eve-brain-ollama");
+  }
+  const serviceModels = secrets?.ai?.serviceModels ?? {};
+  let model;
+  let resolvedBaseUrl;
+  let modelApiKey;
+  if (baseUrl) {
+    model = serviceModels["hermes"] ?? provider?.defaultModel ?? "hermes-3-llama-3.1-8b";
+    resolvedBaseUrl = baseUrl;
+    modelApiKey = provider?.apiKey ?? "";
+  } else {
+    const synapUrl = resolveSynapUrl(secrets);
+    resolvedBaseUrl = synapUrl ? `${synapUrl.replace(/\/$/, "")}/v1` : "http://eve-brain-synap:4000/v1";
+    model = serviceModels["hermes"] ?? "synap/balanced";
+    modelApiKey = readAgentKeyOrLegacySync("hermes", secrets);
+  }
+  const mcpUrl = "http://eve-brain-synap:4000/mcp";
+  const hermesDir = join(homedir(), ".eve", "hermes");
+  mkdirSync(hermesDir, { recursive: true });
+  const configPath = join(hermesDir, "config.yaml");
+  writeFileSync(configPath, HERMES_CONFIG_YAML(model, resolvedBaseUrl, modelApiKey, mcpUrl), { mode: 384 });
+  return configPath;
+}
+var SYNAP_PLUGIN_YAML = `name: synap
+version: 2.0.0
+description: Synap Data Pod \u2014 memory sync plugin. Syncs conversation turns to the Data Pod via Hub Protocol. Tool suite is provided via the MCP client connection.
+hooks:
+  - sync_turn
+  - on_session_end
+  - on_memory_write
+  - prefetch
+`;
+var SYNAP_PROVIDER_PY = `"""
+Synap Data Pod \u2014 Hermes MemoryProvider plugin (memory sync).
+
+Generated by Eve. Do not edit manually.
+
+Syncs all conversation turns to the Synap Data Pod via Hub Protocol.
+Tool suite (entity management, search, channels, etc.) is provided
+via the MCP client connection configured in config.yaml \u2014 not this plugin.
+
+Env vars:
+  SYNAP_API_KEY  \u2014 Hub Protocol bearer token
+  HUB_BASE_URL   \u2014 e.g. https://pod.example.com/api/hub
+  API_SERVER_KEY \u2014 Hermes gateway auth key (for embedding calls)
+  SYNAP_EMBED_MODEL \u2014 embedding model (empty = full-text only)
+"""
+import os
+import json
+import urllib.request
+import urllib.parse
+import urllib.error
+from typing import Any
+
+
+# ---------------------------------------------------------------------------
+# Module-level HTTP helpers
+# ---------------------------------------------------------------------------
+
+def _hub_url(path: str) -> str:
+    base = os.environ.get("HUB_BASE_URL", "").rstrip("/")
+    return f"{base}{path}"
+
+
+def _headers() -> dict[str, str]:
+    return {
+        "Content-Type": "application/json",
+        "Authorization": f"Bearer {os.environ.get('SYNAP_API_KEY', '')}",
+    }
+
+
+def _post(path: str, payload: dict) -> Any:
+    """POST JSON payload to Hub Protocol."""
+    try:
+        data = json.dumps(payload).encode()
+        req = urllib.request.Request(_hub_url(path), data=data, headers=_headers(), method="POST")
+        with urllib.request.urlopen(req, timeout=10) as resp:
+            return json.loads(resp.read())
+    except (urllib.error.URLError, Exception):
+        return None
+
+
+def _get(path: str, params: dict | None = None) -> Any:
+    """GET request with optional query params dict."""
+    try:
+        url = _hub_url(path)
+        if params:
+            url = f"{url}?{urllib.parse.urlencode(params)}"
+        req = urllib.request.Request(url, headers=_headers(), method="GET")
+        with urllib.request.urlopen(req, timeout=10) as resp:
+            return json.loads(resp.read())
+    except (urllib.error.URLError, Exception):
+        return None
+
+
+def _put(path: str, payload: dict) -> Any:
+    """PUT JSON payload to Hub Protocol."""
+    try:
+        data = json.dumps(payload).encode()
+        req = urllib.request.Request(_hub_url(path), data=data, headers=_headers(), method="PUT")
+        with urllib.request.urlopen(req, timeout=10) as resp:
+            return json.loads(resp.read())
+    except (urllib.error.URLError, Exception):
+        return None
+
+
+def _patch(path: str, payload: dict) -> Any:
+    """PATCH JSON payload to Hub Protocol."""
+    try:
+        data = json.dumps(payload).encode()
+        req = urllib.request.Request(_hub_url(path), data=data, headers=_headers(), method="PATCH")
+        with urllib.request.urlopen(req, timeout=10) as resp:
+            return json.loads(resp.read())
+    except (urllib.error.URLError, Exception):
+        return None
+
+
+def _delete(path: str) -> Any:
+    """DELETE request to Hub Protocol."""
+    try:
+        req = urllib.request.Request(_hub_url(path), headers=_headers(), method="DELETE")
+        with urllib.request.urlopen(req, timeout=10) as resp:
+            return json.loads(resp.read())
+    except (urllib.error.URLError, Exception):
+        return None
+
+
+# ---------------------------------------------------------------------------
+# Module-level response helpers
+# ---------------------------------------------------------------------------
+
+def _ok(data: Any) -> dict:
+    return {"status": "done", "data": data}
+
+
+def _err(message: str) -> dict:
+    return {"status": "error", "message": message}
+
+
+def _write_result(result: Any) -> dict:
+    """Normalize a Hub Protocol write response.
+
+    Returns _ok() on success, or pending_approval dict when the backend
+    created a proposal instead of executing (granted=False). Agents should
+    show the reviewUrl to the user and wait \u2014 never retry the same call.
+    """
+    if result is None:
+        return _err("Hub Protocol request failed \u2014 check HUB_BASE_URL and SYNAP_API_KEY")
+    if isinstance(result, dict) and result.get("granted") is False:
+        return {
+            "status": "pending_approval",
+            "proposalId": result.get("proposalId"),
+            "summary": result.get("summary", "Action requires human approval"),
+            "reasoning": result.get("reasoning", ""),
+            "reviewPath": result.get("reviewPath", ""),
+            "reviewUrl": result.get("reviewUrl", ""),
+            "message": f"This action needs approval. Review at: {result.get('reviewUrl', result.get('reviewPath', ''))}",
+        }
+    return _ok(result)
+
+
+# ---------------------------------------------------------------------------
+# SynapMemoryProvider
+# ---------------------------------------------------------------------------
+
+class SynapMemoryProvider:
+    """Synap Data Pod \u2014 Hermes MemoryProvider contract."""
+
+    def __init__(self):
+        self._session_id: str | None = None
+
+    def is_available(self) -> bool:
+        return bool(os.environ.get("SYNAP_API_KEY")) and bool(os.environ.get("HUB_BASE_URL"))
+
+    def initialize(self, session_id: str, **kwargs) -> None:
+        self._session_id = session_id
+
+    def _embed(self, text: str) -> list[float] | None:
+        """Get a 1536-d embedding via the Hermes internal gateway.
+
+        Calls http://127.0.0.1:8642/v1/embeddings (OpenAI-compat) using
+        the model set in SYNAP_EMBED_MODEL. Returns None when the model
+        is unset, unavailable, or returns a non-1536-d vector \u2014 callers
+        degrade to full-text search without interrupting the session.
+
+        The 1536-d constraint matches the knowledge_facts pgvector column.
+        Ollama embedding models (768-1024-d) are intentionally excluded.
+        """
+        model = os.environ.get("SYNAP_EMBED_MODEL", "")
+        if not model:
+            return None
+        try:
+            payload = json.dumps({"model": model, "input": text}).encode()
+            key = os.environ.get("API_SERVER_KEY", "")
+            req = urllib.request.Request(
+                "http://127.0.0.1:8642/v1/embeddings",
+                data=payload,
+                headers={"Content-Type": "application/json", "Authorization": f"Bearer {key}"},
+                method="POST",
+            )
+            with urllib.request.urlopen(req, timeout=5) as resp:
+                body = json.loads(resp.read())
+                vec = body["data"][0]["embedding"]
+                if isinstance(vec, list) and len(vec) == 1536:
+                    return vec
+        except Exception:
+            pass
+        return None
+
+    def prefetch(self, query: str) -> list[dict]:
+        """Return relevant memories for the given query.
+
+        Prefers semantic search (POST /memory/search with pgvector) when
+        SYNAP_EMBED_MODEL is set and the gateway returns a valid 1536-d
+        embedding. Falls back to full-text (GET /memory?query=) otherwise.
+        """
+        if not query:
+            return []
+        # Semantic path \u2014 try embedding via Hermes gateway
+        embedding = self._embed(query)
+        if embedding:
+            results = _post("/memory/search", {"embedding": embedding, "limit": 10})
+            if isinstance(results, list) and results:
+                return results
+        # Full-text fallback
+        results = _get("/memory", {"query": query, "limit": "10"})
+        if isinstance(results, list):
+            return results
+        return []
+
+    def sync_turn(self, user: str, assistant: str) -> None:
+        """Persist a conversation turn as two memory facts.
+
+        Includes embeddings when SYNAP_EMBED_MODEL is set so facts are
+        discoverable via semantic search in future prefetch() calls.
+        """
+        session_tag = f"[session:{self._session_id}]" if self._session_id else ""
+        if user:
+            fact = f"{session_tag}[user] {user}"
+            payload: dict = {"fact": fact}
+            emb = self._embed(fact)
+            if emb:
+                payload["embedding"] = emb
+            _post("/memory", payload)
+        if assistant:
+            fact = f"{session_tag}[assistant] {assistant}"
+            payload = {"fact": fact}
+            emb = self._embed(fact)
+            if emb:
+                payload["embedding"] = emb
+            _post("/memory", payload)
+
+    def on_session_end(self, messages: list[dict]) -> None:
+        """Summarise the session as a single memory fact with embedding."""
+        if not messages:
+            return
+        parts = []
+        for m in messages[-20:]:  # cap at last 20 to avoid huge facts
+            role = m.get("role", "?")
+            content = str(m.get("content", ""))[:300]
+            parts.append(f"{role}: {content}")
+        summary = " | ".join(parts)
+        session_tag = f"[session:{self._session_id}] " if self._session_id else ""
+        fact = f"{session_tag}[summary] {summary}"
+        payload: dict = {"fact": fact, "confidence": 0.9}
+        emb = self._embed(fact)
+        if emb:
+            payload["embedding"] = emb
+        _post("/memory", payload)
+
+    def on_memory_write(self, action: str, target: str, content: str) -> None:
+        """Intercept explicit remember/update commands \u2014 store as high-confidence facts."""
+        if action in ("remember", "add", "update", "replace"):
+            payload: dict = {"fact": content, "confidence": 1.0}
+            emb = self._embed(content)
+            if emb:
+                payload["embedding"] = emb
+            _post("/memory", payload)
+
+
+def register(ctx):
+    ctx.register_memory_provider(SynapMemoryProvider())
+`;
+function generateSynapPlugin() {
+  const pluginDir = join(homedir(), ".eve", "hermes", "plugins", "memory", "synap");
+  mkdirSync(pluginDir, { recursive: true });
+  writeFileSync(join(pluginDir, "plugin.yaml"), SYNAP_PLUGIN_YAML, "utf-8");
+  writeFileSync(join(pluginDir, "__init__.py"), SYNAP_PROVIDER_PY, "utf-8");
+  return { pluginDir };
+}
+var POD_DEPLOY_DIR_CANDIDATES = [
+  "/opt/synap-backend/deploy",
+  "/opt/synap-backend",
+  "/opt/synap/deploy",
+  "/opt/synap",
+  "/opt/synap-pod/deploy",
+  "/opt/synap-pod",
+  "/srv/synap-backend/deploy",
+  "/srv/synap/deploy"
+];
+function findPodDeployDir() {
+  if (process.env.SYNAP_DEPLOY_DIR && existsSync2(process.env.SYNAP_DEPLOY_DIR)) {
+    return process.env.SYNAP_DEPLOY_DIR;
+  }
+  for (const dir of POD_DEPLOY_DIR_CANDIDATES) {
+    if (!existsSync2(dir)) continue;
+    if (existsSync2(join2(dir, "docker-compose.yml")) || existsSync2(join2(dir, "docker-compose.standalone.yml"))) {
+      return dir;
+    }
+  }
+  return null;
+}
+var SYNAP_BACKEND_CONTAINERS = [
+  "synap-backend-backend-1",
+  "synap-backend",
+  "synap-backend-1"
+];
+function restartBackendContainer(deployDir) {
+  const mainFile = join2(deployDir, "docker-compose.yml");
+  const standaloneFile = join2(deployDir, "docker-compose.standalone.yml");
+  const overrideFile = join2(deployDir, "docker-compose.override.yml");
+  const hasOverride = existsSync2(overrideFile);
+  if (existsSync2(mainFile)) {
+    try {
+      execSync("docker compose up -d backend", {
+        cwd: deployDir,
+        stdio: ["ignore", "ignore", "ignore"],
+        timeout: 3e4
+      });
+      return true;
+    } catch {
+    }
+  }
+  if (existsSync2(standaloneFile)) {
+    try {
+      const overrideArg = hasOverride ? ` -f ${overrideFile}` : "";
+      execSync(`docker compose -f ${standaloneFile}${overrideArg} up -d backend`, {
+        cwd: deployDir,
+        stdio: ["ignore", "ignore", "ignore"],
+        timeout: 3e4
+      });
+      return true;
+    } catch {
+    }
+  }
+  for (const container of SYNAP_BACKEND_CONTAINERS) {
+    try {
+      execSync(`docker restart ${container}`, {
+        stdio: ["ignore", "ignore", "ignore"],
+        timeout: 15e3
+      });
+      return true;
+    } catch {
+    }
+  }
+  return false;
+}
+function restartHermesIfRunning() {
+  try {
+    execSync('docker inspect --format "{{.State.Running}}" eve-builder-hermes', {
+      stdio: "pipe"
+    });
+    execSync("docker restart eve-builder-hermes", { stdio: "pipe", timeout: 3e4 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+var TRAEFIK_CANDIDATES = [
+  "eve-legs-traefik",
+  // Eve-managed standard install
+  "traefik-traefik-1",
+  // /opt/traefik compose project
+  "traefik_traefik_1",
+  // older Docker Compose naming
+  "traefik"
+  // bare hand-installed container
+];
+function connectTraefikToEveNetwork() {
+  let candidates = [...TRAEFIK_CANDIDATES];
+  try {
+    const out = execSync(
+      'docker ps --filter "ancestor=traefik" --filter "status=running" --format "{{.Names}}"',
+      { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], timeout: 4e3 }
+    ).trim();
+    const imageMatch = out.split("\n")[0]?.trim();
+    if (imageMatch) candidates = [imageMatch, ...candidates];
+  } catch {
+  }
+  for (const name of candidates) {
+    try {
+      execSync(`docker inspect --format "{{.State.Running}}" ${name}`, {
+        stdio: ["ignore", "ignore", "ignore"],
+        timeout: 2e3
+      });
+    } catch {
+      continue;
+    }
+    try {
+      execSync(`docker network connect eve-network ${name}`, {
+        stdio: ["ignore", "ignore", "ignore"],
+        timeout: 5e3
+      });
+      return { connected: true, containerName: name, alreadyConnected: false };
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      const isAlready = msg.includes("already exists") || msg.toLowerCase().includes("already connected");
+      return { connected: true, containerName: name, alreadyConnected: isAlready };
+    }
+  }
+  return { connected: false, alreadyConnected: false };
+}
+var cachedReachable;
+async function isSynapLoopbackReachable(timeoutMs = 200) {
+  if (cachedReachable === true) return true;
+  const result = await probeTcpPort("127.0.0.1", SYNAP_HOST_LOOPBACK_PORT, timeoutMs);
+  if (result) cachedReachable = true;
+  return result;
+}
+function resetSynapLoopbackProbeCache() {
+  cachedReachable = void 0;
+}
+async function resolveSynapUrlOnHost(secrets) {
+  if (await isSynapLoopbackReachable()) {
+    return `http://127.0.0.1:${SYNAP_HOST_LOOPBACK_PORT}`;
+  }
+  const stored = secrets?.synap?.apiUrl?.trim();
+  if (stored && !isLoopbackUrl(stored)) return stored;
+  return resolveSynapUrl(secrets);
+}
+function probeTcpPort(host, port, timeoutMs) {
+  return new Promise((resolve2) => {
+    const socket = new Socket();
+    let settled2 = false;
+    const settle = (result) => {
+      if (settled2) return;
+      settled2 = true;
+      try {
+        socket.destroy();
+      } catch {
+      }
+      resolve2(result);
+    };
+    const timer = setTimeout(() => settle(false), timeoutMs);
+    timer.unref?.();
+    socket.once("connect", () => {
+      clearTimeout(timer);
+      settle(true);
+    });
+    socket.once("error", () => {
+      clearTimeout(timer);
+      settle(false);
+    });
+    try {
+      socket.connect(port, host);
+    } catch {
+      clearTimeout(timer);
+      settle(false);
+    }
+  });
+}
+var require2 = createRequire(import.meta.url);
+var { createHmac, randomUUID } = require2("node:crypto");
+function resolveLiveAdminPort() {
+  try {
+    const out = execSync2(
+      "docker port hestia-openwebui 8080",
+      { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] }
+    ).trim();
+    const match = out.match(/:(\d+)\s*$/m);
+    if (match) {
+      const port = parseInt(match[1], 10);
+      if (port > 0) return port;
+    }
+  } catch {
+  }
+  return null;
+}
+function resolveOpenwebuiAdminUrl(hostPort) {
+  if (hostPort) return `http://127.0.0.1:${hostPort}`;
+  const live = resolveLiveAdminPort();
+  if (live) return `http://127.0.0.1:${live}`;
+  const comp = COMPONENTS.find((c) => c.id === "openwebui");
+  return `http://127.0.0.1:${comp?.service?.hostPort ?? 3011}`;
+}
+var resolveAdminUrl = resolveOpenwebuiAdminUrl;
+function probeHealthInternal() {
+  try {
+    const out = execSync2(
+      `docker exec hestia-openwebui python3 -c "import urllib.request,sys
+try:
+    r=urllib.request.urlopen('http://localhost:8080/api/version',timeout=5)
+    sys.stdout.write(f'{r.status}\\n')
+    sys.stdout.write(r.read(200).decode('utf-8','ignore'))
+except Exception as e:
+    sys.stderr.write(str(e))
+    sys.exit(2)"`,
+      { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
+    );
+    const text = out.toString();
+    const lines = text.split("\n");
+    const status = parseInt(lines[0] ?? "", 10);
+    const body = lines.slice(1).join("\n").trim();
+    if (status >= 200 && status < 300 && !body.startsWith("<")) {
+      return { ok: true };
+    }
+    return { ok: false, reason: `HTTP ${status || "?"}, body=${body.slice(0, 100)}` };
+  } catch (err) {
+    const stderrBuf = err?.stderr;
+    const stderrStr = stderrBuf?.toString().trim();
+    const fallback = err instanceof Error ? err.message : String(err);
+    return { ok: false, reason: stderrStr || fallback };
+  }
+}
+async function waitUntilHealthy(baseUrl, maxAttempts = 12) {
+  for (let i = 0; i < maxAttempts; i++) {
+    try {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), 5e3);
+      const res = await fetch(`${baseUrl}/api/version`, { signal: controller.signal });
+      clearTimeout(timer);
+      if (res.ok) {
+        const contentType = res.headers.get("content-type") || "";
+        if (contentType.includes("json")) {
+          return true;
+        }
+        const text = await res.text();
+        if (!text.trimStart().startsWith("<")) return true;
+      }
+    } catch {
+    }
+    await new Promise((r) => setTimeout(r, 5e3));
+  }
+  return false;
+}
+function readWebuiSecretKey() {
+  try {
+    const envPath = "/opt/openwebui/.env";
+    if (!existsSync3(envPath)) return null;
+    const content = readFileSync(envPath, "utf-8");
+    const match = content.split("\n").find((l) => l.startsWith("WEBUI_SECRET_KEY="));
+    return match?.split("=", 2)[1]?.trim() ?? null;
+  } catch {
+    return null;
+  }
+}
+function getAdminUserDetailed() {
+  try {
+    const out = execSync2(
+      `docker exec hestia-openwebui python3 -c "import sqlite3; r=sqlite3.connect('/app/backend/data/webui.db').execute(\\"SELECT id,email FROM user WHERE role='admin' LIMIT 1\\").fetchone(); print(f'{r[0]}|{r[1]}') if r else print('')"`,
+      { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
+    );
+    const row = out.toString().trim();
+    if (!row) {
+      return { user: null, error: "admin row not found (no row where role='admin' in user table)" };
+    }
+    const [id, email] = row.split("|");
+    if (!id || !email) return { user: null, error: `unexpected row shape: ${row}` };
+    return { user: { id, email } };
+  } catch (err) {
+    const stderrBuf = err?.stderr;
+    const stderrStr = stderrBuf?.toString().trim();
+    const fallback = err instanceof Error ? err.message : String(err);
+    return { user: null, error: `docker exec failed: ${(stderrStr || fallback).slice(0, 300)}` };
+  }
+}
+function forgeAdminJwt(secretKey, admin) {
+  const header = Buffer.from(JSON.stringify({ alg: "HS256", typ: "JWT" })).toString("base64url");
+  const payload = Buffer.from(JSON.stringify({
+    id: admin.id,
+    email: admin.email,
+    jti: randomUUID(),
+    iat: Math.floor(Date.now() / 1e3),
+    exp: Math.floor(Date.now() / 1e3) + 300
+  })).toString("base64url");
+  const sig = createHmac("sha256", secretKey).update(`${header}.${payload}`).digest("base64url");
+  return `${header}.${payload}.${sig}`;
+}
+async function waitForHealth(hostPort, maxAttempts = 12) {
+  const baseUrl = resolveAdminUrl(hostPort);
+  return waitUntilHealthy(baseUrl, maxAttempts);
+}
+async function waitForHealthDetailed(hostPort, maxAttempts = 12) {
+  const baseUrl = resolveAdminUrl(hostPort);
+  let lastErr = "";
+  for (let i = 0; i < maxAttempts; i++) {
+    try {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), 5e3);
+      const res = await fetch(`${baseUrl}/health`, { signal: controller.signal });
+      clearTimeout(timer);
+      if (res.ok) {
+        const ct = res.headers.get("content-type") || "";
+        if (ct.includes("json") || !ct.includes("html")) {
+          return { ok: true, baseUrl };
+        }
+        const text = await res.text();
+        if (!text.trimStart().startsWith("<")) {
+          return { ok: true, baseUrl };
+        }
+        lastErr = "OWUI returned HTML at /health (still booting)";
+      } else {
+        lastErr = `HTTP ${res.status}`;
+      }
+    } catch (err) {
+      lastErr = err instanceof Error ? err.message : String(err);
+    }
+    if (i < maxAttempts - 1) await new Promise((r) => setTimeout(r, 5e3));
+  }
+  const internal = probeHealthInternal();
+  if (internal.ok) {
+    return {
+      ok: false,
+      baseUrl,
+      reason: `Host loopback ${baseUrl}/health timed out after ${maxAttempts * 5}s (last error: ${lastErr || "unknown"}), but the container's own /health responds. Host port mapping is broken \u2014 check \`docker port hestia-openwebui 8080\` and \`OPEN_WEBUI_PORT\` in /opt/openwebui/.env.`
+    };
+  }
+  return {
+    ok: false,
+    baseUrl,
+    reason: `Host loopback ${baseUrl}/health timed out after ${maxAttempts * 5}s (last error: ${lastErr || "unknown"}); internal probe also failed: ${internal.reason ?? "unknown"}.`
+  };
+}
+async function getStatus(hostPort) {
+  const baseUrl = resolveAdminUrl(hostPort);
+  const healthy = await waitUntilHealthy(baseUrl, hostPort ? 12 : 6);
+  if (!healthy) {
+    try {
+      const res = await fetch(`${baseUrl}/health`, { signal: AbortSignal.timeout(3e3) });
+      if (res.ok) {
+        const text = await res.text();
+        if (text.trimStart().startsWith("<")) {
+          return { status: "html-response" };
+        }
+      }
+    } catch {
+    }
+    return { status: "not-reachable" };
+  }
+  const secretKey = readWebuiSecretKey();
+  if (!secretKey) {
+    return { status: "no-secret-key" };
+  }
+  const adminQ = getAdminUserDetailed();
+  if (!adminQ.user) {
+    return { status: "no-admin-user", adminUser: null, error: adminQ.error };
+  }
+  return { status: "healthy", adminUser: adminQ.user };
+}
+async function getAdminReadyStatus() {
+  const secretKey = readWebuiSecretKey();
+  if (!secretKey) {
+    return { status: "no-secret-key" };
+  }
+  const adminQ = getAdminUserDetailed();
+  if (!adminQ.user) {
+    return { status: "no-admin-user", adminUser: null, error: adminQ.error };
+  }
+  return { status: "healthy", adminUser: adminQ.user };
+}
+async function getAdminJwt(hostPort) {
+  const status = await getStatus(hostPort);
+  if (status.status !== "healthy") return null;
+  const secretKey = readWebuiSecretKey();
+  if (!secretKey) return null;
+  return forgeAdminJwt(secretKey, status.adminUser);
+}
+async function getAdminJwtPostHealth() {
+  const status = await getAdminReadyStatus();
+  if (status.status !== "healthy" || !status.adminUser) return null;
+  const secretKey = readWebuiSecretKey();
+  if (!secretKey) return null;
+  return forgeAdminJwt(secretKey, status.adminUser);
+}
+async function getAdminJwtPostHealthDetailed() {
+  const status = await getAdminReadyStatus();
+  if (status.status === "no-secret-key") {
+    return { ok: false, stage: "secret-key", reason: "WEBUI_SECRET_KEY missing in /opt/openwebui/.env" };
+  }
+  if (status.status !== "healthy" || !status.adminUser) {
+    const reason = status.status === "no-admin-user" ? status.error ?? "admin user not found in user table" : `unexpected status: ${status.status}`;
+    return { ok: false, stage: "admin-row", reason };
+  }
+  const secretKey = readWebuiSecretKey();
+  if (!secretKey) {
+    return { ok: false, stage: "secret-key", reason: "WEBUI_SECRET_KEY missing in /opt/openwebui/.env" };
+  }
+  return { ok: true, jwt: forgeAdminJwt(secretKey, status.adminUser) };
+}
+async function probeAdminAuth(jwt, hostPort) {
+  const baseUrl = resolveAdminUrl(hostPort);
+  try {
+    const res = await fetch(`${baseUrl}/api/v1/configs/export`, {
+      headers: { Authorization: `Bearer ${jwt}` },
+      signal: AbortSignal.timeout(8e3)
+    });
+    const body = await res.text();
+    return { ok: res.ok, status: res.status, body };
+  } catch (err) {
+    return { ok: false, status: 0, body: err instanceof Error ? err.message : String(err) };
+  }
+}
+async function getConfig(jwt, hostPort) {
+  const detailed = await getConfigDetailed(jwt, hostPort);
+  return detailed.ok ? detailed.config : null;
+}
+async function getConfigDetailed(jwt, hostPort) {
+  const baseUrl = resolveAdminUrl(hostPort);
+  let status = 0;
+  let body = "";
+  try {
+    const res = await fetch(`${baseUrl}/api/v1/configs/export`, {
+      headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" }
+    });
+    status = res.status;
+    body = await res.text();
+    if (!res.ok) {
+      return { ok: false, status, bodyPreview: body.slice(0, 200), reason: `HTTP ${status}` };
+    }
+    if (body.trimStart().startsWith("<")) {
+      return {
+        ok: false,
+        status,
+        bodyPreview: body.slice(0, 200),
+        reason: "OWUI returned HTML at /api/v1/configs/export (admin endpoint not registered or SPA shell intercepted the request)"
+      };
+    }
+    try {
+      const config = JSON.parse(body);
+      return { ok: true, config };
+    } catch (err) {
+      return {
+        ok: false,
+        status,
+        bodyPreview: body.slice(0, 200),
+        reason: `JSON parse failed: ${err instanceof Error ? err.message : String(err)}`
+      };
+    }
+  } catch (err) {
+    return {
+      ok: false,
+      status,
+      bodyPreview: body.slice(0, 200),
+      reason: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+async function saveConfig(jwt, config, hostPort) {
+  const detailed = await saveConfigDetailed(jwt, config, hostPort);
+  return detailed.ok;
+}
+async function saveConfigDetailed(jwt, config, hostPort) {
+  const baseUrl = resolveAdminUrl(hostPort);
+  let status = 0;
+  let body = "";
+  try {
+    const res = await fetch(`${baseUrl}/api/v1/configs/import`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
+      body: JSON.stringify({ config })
+    });
+    status = res.status;
+    if (res.ok) return { ok: true };
+    body = await res.text();
+    return { ok: false, status, bodyPreview: body.slice(0, 200), reason: `HTTP ${status}` };
+  } catch (err) {
+    return {
+      ok: false,
+      status,
+      bodyPreview: body.slice(0, 200),
+      reason: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+var MANAGED_ROOT_KEY_BY_OPTION = {
+  webuiUrl: "WEBUI_URL",
+  webuiName: "WEBUI_NAME",
+  enableSignup: "ENABLE_SIGNUP",
+  defaultUserRole: "DEFAULT_USER_ROLE"
+};
+var MANAGED_UI_KEY_BY_OPTION = {
+  enableSignup: "enable_signup",
+  defaultUserRole: "default_user_role"
+};
+var DEFAULT_MODELS_KEYS = ["DEFAULT_MODELS", "default_models"];
+function isPlainConfigObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function modelSourceMetadataFor(modelSource) {
+  return {
+    name: modelSource.displayName,
+    models: modelSource.models?.join(";")
+  };
+}
+function defaultModelsForExistingShape(desired, existing) {
+  if (Array.isArray(existing)) {
+    return Array.isArray(desired) ? [...desired] : [desired];
+  }
+  return Array.isArray(desired) ? desired.join(",") : desired;
+}
+function setIfChanged(target, key, value, changedKeys) {
+  if (JSON.stringify(target[key]) === JSON.stringify(value)) return;
+  target[key] = value;
+  changedKeys.add(key);
+}
+function reconcileOpenwebuiManagedConfig(currentConfig, desired) {
+  const config = { ...currentConfig };
+  const changedKeys = /* @__PURE__ */ new Set();
+  if (desired.modelSources?.length) {
+    const existingOpenai = isPlainConfigObject(config.openai) ? config.openai : {};
+    const openai = { ...existingOpenai };
+    const urls = Array.isArray(openai.api_base_urls) ? [...openai.api_base_urls] : [];
+    const keys = Array.isArray(openai.api_keys) ? [...openai.api_keys] : [];
+    const existingMetadata = isPlainConfigObject(openai.metadata) ? openai.metadata : {};
+    const metadata = { ...existingMetadata };
+    for (const modelSource of desired.modelSources) {
+      const idx = urls.indexOf(modelSource.url);
+      if (idx === -1) {
+        urls.push(modelSource.url);
+        keys.push(modelSource.apiKey);
+      } else {
+        keys[idx] = modelSource.apiKey;
+      }
+      metadata[modelSource.url] = modelSourceMetadataFor(modelSource);
+    }
+    while (keys.length < urls.length) keys.push("");
+    setIfChanged(openai, "api_base_urls", urls, changedKeys);
+    setIfChanged(openai, "api_keys", keys, changedKeys);
+    setIfChanged(openai, "metadata", metadata, changedKeys);
+    if (JSON.stringify(config.openai) !== JSON.stringify(openai)) {
+      config.openai = openai;
+      changedKeys.add("openai");
+    }
+  }
+  if (desired.defaultModels !== void 0) {
+    const existingKeys = DEFAULT_MODELS_KEYS.filter((key) => key in config);
+    const keysToSet = existingKeys.length ? existingKeys : ["DEFAULT_MODELS"];
+    for (const key of keysToSet) {
+      setIfChanged(
+        config,
+        key,
+        defaultModelsForExistingShape(desired.defaultModels, config[key]),
+        changedKeys
+      );
+    }
+  }
+  for (const [optionKey, configKey] of Object.entries(MANAGED_ROOT_KEY_BY_OPTION)) {
+    const value = desired[optionKey];
+    if (value !== void 0) {
+      setIfChanged(config, configKey, value, changedKeys);
+    }
+  }
+  if (Object.keys(MANAGED_UI_KEY_BY_OPTION).some(
+    (k) => desired[k] !== void 0
+  )) {
+    const existingUi = isPlainConfigObject(config.ui) ? config.ui : {};
+    const ui = { ...existingUi };
+    for (const [optionKey, uiKey] of Object.entries(MANAGED_UI_KEY_BY_OPTION)) {
+      const value = desired[optionKey];
+      if (value !== void 0) {
+        setIfChanged(ui, uiKey, value, changedKeys);
+      }
+    }
+    if (JSON.stringify(config.ui) !== JSON.stringify(ui)) {
+      config.ui = ui;
+      changedKeys.add("ui");
+    }
+  }
+  if ("tool_server" in config) {
+    delete config.tool_server;
+    changedKeys.add("tool_server");
+  }
+  return {
+    config,
+    changed: changedKeys.size > 0,
+    changedKeys: [...changedKeys]
+  };
+}
+async function reconcileOpenwebuiManagedConfigViaAdmin(jwt, desired, hostPort) {
+  const detailed = await reconcileOpenwebuiManagedConfigViaAdminDetailed(jwt, desired, hostPort);
+  return detailed.ok ? detailed.result : null;
+}
+async function reconcileOpenwebuiManagedConfigViaAdminDetailed(jwt, desired, hostPort) {
+  const read = await getConfigDetailed(jwt, hostPort);
+  if (!read.ok) {
+    return { ok: false, step: "getConfig", status: read.status, bodyPreview: read.bodyPreview, reason: read.reason };
+  }
+  const result = reconcileOpenwebuiManagedConfig(read.config, desired);
+  if (!result.changed) return { ok: true, result };
+  const save = await saveConfigDetailed(jwt, result.config, hostPort);
+  if (!save.ok) {
+    return { ok: false, step: "saveConfig", status: save.status, bodyPreview: save.bodyPreview, reason: save.reason };
+  }
+  return { ok: true, result };
+}
+async function listModelSources(jwt, hostPort) {
+  const config = await getConfig(jwt, hostPort);
+  if (!config) return [];
+  const openai = config.openai ?? {};
+  const urls = Array.isArray(openai.api_base_urls) ? openai.api_base_urls : [];
+  const keys = Array.isArray(openai.api_keys) ? openai.api_keys : [];
+  const metadata = openai.metadata ?? {};
+  return urls.map((url, i) => ({
+    url,
+    apiKey: keys[i] ?? "",
+    displayName: metadata[url]?.name ?? url
+  }));
+}
+async function registerModelSource(jwt, modelSource, hostPort) {
+  const result = await reconcileOpenwebuiManagedConfigViaAdmin(
+    jwt,
+    { modelSources: [modelSource] },
+    hostPort
+  );
+  return result !== null;
+}
+async function upsertAllModelSources(jwt, modelSources, hostPort) {
+  if (modelSources.length === 0) return 0;
+  const result = await reconcileOpenwebuiManagedConfigViaAdmin(
+    jwt,
+    { modelSources },
+    hostPort
+  );
+  return result !== null ? modelSources.length : 0;
+}
+var SYNAP_SKILL_SLUGS = ["synap", "synap-schema", "synap-ui"];
+var EVE_MANAGED_TAG = "synap:system";
+var HTTP_TIMEOUT_MS = 3e4;
+function nameFor(slug) {
+  switch (slug) {
+    case "synap":
+      return `Synap \u2014 Capture, Memory, Channels [${EVE_MANAGED_TAG}]`;
+    case "synap-schema":
+      return `Synap Schema \u2014 Profiles & Property Defs [${EVE_MANAGED_TAG}]`;
+    case "synap-ui":
+      return `Synap UI \u2014 Views & Dashboards [${EVE_MANAGED_TAG}]`;
+  }
+}
+async function fetchSynapSkills(hubBaseUrl, apiKey) {
+  const url = `${hubBaseUrl}/skills/system`;
+  const res = await fetch(url, {
+    headers: { Authorization: `Bearer ${apiKey}` },
+    signal: AbortSignal.timeout(HTTP_TIMEOUT_MS)
+  });
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    const keyPrefix = apiKey.slice(0, 12);
+    throw new Error(
+      `Hub /skills/system failed with HTTP ${res.status} (url=${url}, key=${keyPrefix}\u2026, body=${body.slice(0, 200)})`
+    );
+  }
+  const packages = await res.json();
+  if (!Array.isArray(packages)) {
+    throw new Error("Hub /skills/system returned a non-array body");
+  }
+  return packages;
+}
+function extractSkillMarkdown(pkg) {
+  const file = pkg.files.find((f) => f.path === "SKILL.md");
+  return file?.content ?? null;
+}
+async function listPrompts(jwt, hostPort) {
+  const baseUrl = resolveOpenwebuiAdminUrl(hostPort);
+  const res = await fetch(`${baseUrl}/api/v1/prompts/`, {
+    headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
+    signal: AbortSignal.timeout(HTTP_TIMEOUT_MS)
+  });
+  if (!res.ok) {
+    throw new Error(`OpenWebUI GET /api/v1/prompts/ failed with HTTP ${res.status}`);
+  }
+  const data = await res.json();
+  return Array.isArray(data) ? data : [];
+}
+async function createPrompt(jwt, prompt, hostPort) {
+  const baseUrl = resolveOpenwebuiAdminUrl(hostPort);
+  const res = await fetch(`${baseUrl}/api/v1/prompts/create`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
+    body: JSON.stringify(prompt),
+    signal: AbortSignal.timeout(HTTP_TIMEOUT_MS)
+  });
+  if (!res.ok) {
+    throw new Error(`POST /api/v1/prompts/create failed with HTTP ${res.status}`);
+  }
+}
+async function updatePrompt(jwt, promptId, prompt, hostPort) {
+  const baseUrl = resolveOpenwebuiAdminUrl(hostPort);
+  const path = `/api/v1/prompts/id/${encodeURIComponent(promptId)}/update`;
+  const res = await fetch(`${baseUrl}${path}`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
+    body: JSON.stringify(prompt),
+    signal: AbortSignal.timeout(HTTP_TIMEOUT_MS)
+  });
+  if (!res.ok) {
+    throw new Error(`POST ${path} failed with HTTP ${res.status}`);
+  }
+}
+async function pushSynapSkillsToOpenwebuiPrompts(cwd, hubBaseUrl, secrets) {
+  let apiKey = readAgentKeyOrLegacySync("openwebui", secrets);
+  if (!apiKey) apiKey = readAgentKeyOrLegacySync("eve", secrets);
+  if (!apiKey) {
+    throw new Error("No Hub API key available \u2014 run: eve auth provision --agent openwebui (or eve auth provision --agent eve)");
+  }
+  const packages = await fetchSynapSkills(hubBaseUrl.replace(/\/$/, ""), apiKey);
+  const jwt = await getAdminJwt();
+  if (!jwt) {
+    throw new Error("OpenWebUI admin JWT unavailable \u2014 container down or no admin user");
+  }
+  const existing = await listPrompts(jwt);
+  const existingByCommand = /* @__PURE__ */ new Map();
+  for (const p of existing) {
+    if (typeof p.command === "string") existingByCommand.set(p.command, p);
+  }
+  const synced = [];
+  const skipped = [];
+  let created = 0;
+  let updated = 0;
+  void secrets;
+  for (const slug of SYNAP_SKILL_SLUGS) {
+    const pkg = packages.find((p) => p.slug === slug);
+    if (!pkg) {
+      skipped.push({ command: slug, reason: "Hub did not return this skill package" });
+      continue;
+    }
+    const content = extractSkillMarkdown(pkg);
+    if (!content) {
+      skipped.push({ command: slug, reason: "Skill package has no SKILL.md file" });
+      continue;
+    }
+    const desired = {
+      command: slug,
+      name: nameFor(slug),
+      content
+    };
+    try {
+      const prior = existingByCommand.get(slug);
+      if (!prior) {
+        await createPrompt(jwt, desired);
+        created++;
+      } else if (prior.content !== content || prior.name !== desired.name) {
+        if (!prior.id) {
+          skipped.push({
+            command: slug,
+            reason: "existing prompt missing `id` field \u2014 cannot target id-keyed update endpoint"
+          });
+          continue;
+        }
+        await updatePrompt(jwt, prior.id, desired);
+        updated++;
+      }
+      synced.push({
+        command: slug,
+        name: desired.name,
+        content,
+        source: slug
+      });
+    } catch (err) {
+      skipped.push({
+        command: slug,
+        reason: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  return { synced, created, updated, skipped };
+}
+var DEFAULT_NAMESPACE = "openwebui";
+var DEFAULT_MAX_ENTRIES = 500;
+var SYNAP_PAGE_SIZE = 100;
+var FILE_EXTENSION = ".md";
+function filenameFor(entry) {
+  const raw = entry.slug && entry.slug.trim() || entry.key;
+  const safe = raw.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 120);
+  return `${safe || "entry"}${FILE_EXTENSION}`;
+}
+function sha256Hex(input) {
+  return createHash("sha256").update(input).digest("hex");
+}
+function renderFileBody(entry, namespace) {
+  const lines = [
+    `# ${entry.key}`,
+    "",
+    entry.value ?? "",
+    "",
+    "---",
+    "source: synap",
+    `namespace: ${namespace}`
+  ];
+  if (entry.status) lines.push(`status: ${entry.status}`);
+  if (entry.author) lines.push(`author: ${entry.author}`);
+  return lines.join("\n");
+}
+function indexEntries(entries, maxEntries) {
+  const byFilename = /* @__PURE__ */ new Map();
+  const skipped = [];
+  for (const entry of entries) {
+    if (byFilename.size >= maxEntries) {
+      skipped.push({ key: entry.key, reason: "maxEntries reached" });
+      continue;
+    }
+    const filename = filenameFor(entry);
+    if (byFilename.has(filename)) {
+      skipped.push({ key: entry.key, reason: `filename collision with another entry: ${filename}` });
+      continue;
+    }
+    byFilename.set(filename, entry);
+  }
+  return { byFilename, skipped };
+}
+async function fetchSynapKnowledge(hubBaseUrl, hubApiKey, namespace, maxEntries) {
+  const out = [];
+  let offset = 0;
+  while (out.length < maxEntries) {
+    const limit = Math.min(SYNAP_PAGE_SIZE, maxEntries - out.length);
+    const url = new URL(`${hubBaseUrl.replace(/\/$/, "")}/knowledge`);
+    url.searchParams.set("namespace", namespace);
+    url.searchParams.set("limit", String(limit));
+    url.searchParams.set("offset", String(offset));
+    const res = await fetch(url, {
+      headers: {
+        Authorization: `Bearer ${hubApiKey}`,
+        "Content-Type": "application/json"
+      }
+    });
+    if (!res.ok) {
+      const body = await res.text().catch(() => "");
+      const keyPrefix = hubApiKey.slice(0, 12);
+      throw new Error(
+        `Synap knowledge fetch failed: HTTP ${res.status} ${res.statusText} (url=${url}, key=${keyPrefix}\u2026, body=${body.slice(0, 200)})`
+      );
+    }
+    const data = await res.json();
+    if (!Array.isArray(data)) {
+      throw new Error("Synap knowledge fetch returned non-array payload");
+    }
+    const page = data;
+    out.push(...page);
+    if (page.length < limit) break;
+    offset += page.length;
+  }
+  return out.slice(0, maxEntries);
+}
+function assertJsonText(path, text) {
+  if (text.trimStart().startsWith("<")) {
+    throw new Error(
+      `OpenWebUI ${path} returned HTML \u2014 admin route not registered on this OWUI build (SPA shell shadowing the API)`
+    );
+  }
+}
+async function owuiGetJson(ctx, path) {
+  const res = await fetch(`${ctx.baseUrl}${path}`, {
+    headers: { Authorization: `Bearer ${ctx.jwt}`, "Content-Type": "application/json" }
+  });
+  if (!res.ok) {
+    throw new Error(`OpenWebUI GET ${path} failed: HTTP ${res.status}`);
+  }
+  const text = await res.text();
+  assertJsonText(`GET ${path}`, text);
+  return JSON.parse(text);
+}
+async function owuiPostJson(ctx, path, body) {
+  const res = await fetch(`${ctx.baseUrl}${path}`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${ctx.jwt}`, "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) {
+    throw new Error(`OpenWebUI POST ${path} failed: HTTP ${res.status}`);
+  }
+  const text = await res.text();
+  assertJsonText(`POST ${path}`, text);
+  return JSON.parse(text);
+}
+async function ensureCollection(ctx, name, description) {
+  const list = await owuiGetJson(ctx, "/api/v1/knowledge/");
+  const existing = Array.isArray(list) ? list.find((c) => c.name === name) : void 0;
+  if (existing) {
+    return owuiGetJson(
+      ctx,
+      `/api/v1/knowledge/${existing.id}`
+    );
+  }
+  return owuiPostJson(ctx, "/api/v1/knowledge/create", {
+    name,
+    description
+  });
+}
+function fileNameOf(file) {
+  return file.filename ?? file.meta?.name ?? "";
+}
+async function fetchFileContent(ctx, fileId) {
+  const res = await fetch(`${ctx.baseUrl}/api/v1/files/${fileId}/data/content`, {
+    headers: { Authorization: `Bearer ${ctx.jwt}` }
+  });
+  if (!res.ok) {
+    throw new Error(`OpenWebUI fetch file content failed: HTTP ${res.status}`);
+  }
+  return res.text();
+}
+async function getRemoteContentHash(ctx, fileId) {
+  try {
+    const body = await fetchFileContent(ctx, fileId);
+    return sha256Hex(body);
+  } catch {
+    return null;
+  }
+}
+async function uploadFile(ctx, filename, body) {
+  const form = new FormData();
+  form.append(
+    "file",
+    new Blob([body], { type: "text/markdown" }),
+    filename
+  );
+  const res = await fetch(`${ctx.baseUrl}/api/v1/files/`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${ctx.jwt}` },
+    body: form
+  });
+  if (!res.ok) {
+    throw new Error(`OpenWebUI file upload failed: HTTP ${res.status}`);
+  }
+  const text = await res.text();
+  assertJsonText("POST /api/v1/files/", text);
+  const data = JSON.parse(text);
+  if (!data.id) {
+    throw new Error("OpenWebUI file upload returned no id");
+  }
+  return data.id;
+}
+async function attachFile(ctx, collectionId, fileId) {
+  await owuiPostJson(ctx, `/api/v1/knowledge/${collectionId}/file/add`, {
+    file_id: fileId
+  });
+}
+async function removeFile(ctx, collectionId, fileId) {
+  await owuiPostJson(ctx, `/api/v1/knowledge/${collectionId}/file/remove`, {
+    file_id: fileId
+  });
+}
+async function deleteFile(ctx, fileId) {
+  const res = await fetch(`${ctx.baseUrl}/api/v1/files/${fileId}`, {
+    method: "DELETE",
+    headers: { Authorization: `Bearer ${ctx.jwt}` }
+  });
+  if (!res.ok && res.status !== 404) {
+    throw new Error(`OpenWebUI file delete failed: HTTP ${res.status}`);
+  }
+}
+async function syncSynapKnowledgeToOpenwebui(cwd, hubBaseUrl, secrets, opts = {}) {
+  void cwd;
+  const namespace = opts.namespace?.trim() || DEFAULT_NAMESPACE;
+  const collectionName = opts.collectionName?.trim() || `Synap Knowledge (${namespace})`;
+  const collectionDescription = opts.collectionDescription?.trim() || `Mirrored from Synap pod (namespace: ${namespace}). Managed by Eve.`;
+  const maxEntries = opts.maxEntries ?? DEFAULT_MAX_ENTRIES;
+  let hubApiKey = readAgentKeyOrLegacySync("openwebui", secrets);
+  if (!hubApiKey) hubApiKey = readAgentKeyOrLegacySync("eve", secrets);
+  if (!hubApiKey) {
+    throw new Error("No Synap Hub API key available \u2014 run: eve auth provision --agent openwebui (or eve auth provision --agent eve)");
+  }
+  const jwt = await getAdminJwt();
+  if (!jwt) {
+    throw new Error("Could not forge OpenWebUI admin JWT (is the container up and an admin signed up?)");
+  }
+  const ctx = { baseUrl: resolveOpenwebuiAdminUrl(), jwt };
+  const synapEntries = await fetchSynapKnowledge(
+    hubBaseUrl,
+    hubApiKey,
+    namespace,
+    maxEntries
+  );
+  if (synapEntries.length === 0) {
+    return { collectionId: "", added: 0, updated: 0, removed: 0, skipped: [] };
+  }
+  const { byFilename: desired, skipped } = indexEntries(synapEntries, maxEntries);
+  const collection = await ensureCollection(ctx, collectionName, collectionDescription);
+  const remoteByFilename = /* @__PURE__ */ new Map();
+  for (const file of collection.files ?? []) {
+    const name = fileNameOf(file);
+    if (name) remoteByFilename.set(name, file);
+  }
+  let added = 0;
+  let updated = 0;
+  let removed = 0;
+  for (const [filename, entry] of desired.entries()) {
+    const body = renderFileBody(entry, namespace);
+    const desiredHash = sha256Hex(body);
+    const remote = remoteByFilename.get(filename);
+    try {
+      if (!remote) {
+        const fileId2 = await uploadFile(ctx, filename, body);
+        await attachFile(ctx, collection.id, fileId2);
+        added++;
+        continue;
+      }
+      const remoteHash = await getRemoteContentHash(ctx, remote.id);
+      if (remoteHash === desiredHash) {
+        continue;
+      }
+      await removeFile(ctx, collection.id, remote.id);
+      await deleteFile(ctx, remote.id);
+      const fileId = await uploadFile(ctx, filename, body);
+      await attachFile(ctx, collection.id, fileId);
+      updated++;
+    } catch (err) {
+      skipped.push({
+        key: entry.key,
+        reason: err instanceof Error ? err.message : "unknown error"
+      });
+    }
+  }
+  for (const [filename, remote] of remoteByFilename.entries()) {
+    if (desired.has(filename)) continue;
+    try {
+      await removeFile(ctx, collection.id, remote.id);
+      await deleteFile(ctx, remote.id);
+      removed++;
+    } catch (err) {
+      skipped.push({
+        key: filename,
+        reason: err instanceof Error ? err.message : "unknown error"
+      });
+    }
+  }
+  return {
+    collectionId: collection.id,
+    added,
+    updated,
+    removed,
+    skipped
+  };
+}
+var SYNAP_TOOL_SERVER_NAME = "Synap Hub Protocol";
+var SYNAP_MCP_SERVER_NAME = "Synap MCP";
+var HUB_OPENAPI_PATH = "/api/hub/openapi.json";
+var MCP_PATH = "/mcp";
+function synapOpenapiContainerUrl() {
+  return `${SYNAP_BACKEND_INTERNAL_URL.replace(/\/+$/, "")}${HUB_OPENAPI_PATH}`;
+}
+function synapMcpContainerUrl() {
+  return `${SYNAP_BACKEND_INTERNAL_URL.replace(/\/+$/, "")}${MCP_PATH}`;
+}
+async function fetchSynapOpenapi(hubBaseUrl) {
+  const probeUrl = (() => {
+    const trimmed = (hubBaseUrl || "").replace(/\/+$/, "");
+    if (!trimmed) return null;
+    if (trimmed.endsWith("/api/hub")) return `${trimmed}/openapi.json`;
+    if (trimmed.includes("/api/hub/")) return `${trimmed}/openapi.json`;
+    return `${trimmed}${HUB_OPENAPI_PATH}`;
+  })();
+  if (!probeUrl) return { ok: false };
+  try {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 5e3);
+    const res = await fetch(probeUrl, { signal: controller.signal });
+    clearTimeout(timer);
+    if (!res.ok) return { ok: false };
+    const text = await res.text();
+    if (!text || text.trimStart().startsWith("<")) return { ok: false };
+    const parsed = JSON.parse(text);
+    if (typeof parsed.openapi !== "string") return { ok: false };
+    const paths = parsed.paths && typeof parsed.paths === "object" ? Object.keys(parsed.paths).length : 0;
+    return { ok: true, paths };
+  } catch {
+    return { ok: false };
+  }
+}
+async function getToolServerConnections(jwt, baseUrl) {
+  const url = `${baseUrl}/api/v1/configs/tool_servers`;
+  const res = await fetch(url, {
+    headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
+    signal: AbortSignal.timeout(8e3)
+  });
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw new Error(`GET /api/v1/configs/tool_servers HTTP ${res.status}: ${body.slice(0, 200)}`);
+  }
+  const text = await res.text();
+  if (text.trimStart().startsWith("<")) {
+    throw new Error("GET /api/v1/configs/tool_servers returned HTML \u2014 admin route not registered on this OWUI build");
+  }
+  const parsed = JSON.parse(text);
+  if (Array.isArray(parsed)) return parsed;
+  return parsed.TOOL_SERVER_CONNECTIONS ?? [];
+}
+async function saveToolServerConnections(jwt, baseUrl, connections) {
+  const url = `${baseUrl}/api/v1/configs/tool_servers`;
+  const body = { TOOL_SERVER_CONNECTIONS: connections };
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(8e3)
+  });
+  if (!res.ok) {
+    const respBody = await res.text().catch(() => "");
+    throw new Error(`POST /api/v1/configs/tool_servers HTTP ${res.status}: ${respBody.slice(0, 200)}`);
+  }
+}
+async function registerSynapAsOpenwebuiToolServer(_cwd, hubBaseUrl, secrets) {
+  const endpointUrl = synapOpenapiContainerUrl();
+  const probe = await fetchSynapOpenapi(hubBaseUrl);
+  if (!probe.ok) {
+    console.log("Synap OpenAPI endpoint not found \u2014 skipping");
+    return {
+      registered: false,
+      toolCount: 0,
+      serverName: SYNAP_TOOL_SERVER_NAME,
+      endpointUrl
+    };
+  }
+  const baseUrl = resolveOpenwebuiAdminUrl();
+  const jwt = await getAdminJwt();
+  if (!jwt) {
+    throw new Error(
+      "OpenWebUI admin login failed \u2014 cannot register Synap tool server"
+    );
+  }
+  const apiKey = readAgentKeyOrLegacySync("eve", secrets);
+  if (!apiKey) {
+    throw new Error(
+      "No eve agent hubApiKey in secrets \u2014 cannot register Synap tool server"
+    );
+  }
+  const connections = await getToolServerConnections(jwt, baseUrl);
+  const existingIdx = connections.findIndex((c) => c.name === SYNAP_TOOL_SERVER_NAME);
+  const existing = existingIdx >= 0 ? connections[existingIdx] : void 0;
+  if (existing && existing.url === endpointUrl && existing.key === apiKey && (existing.path ?? "") === "") {
+    return {
+      registered: true,
+      toolCount: probe.paths,
+      serverName: SYNAP_TOOL_SERVER_NAME,
+      endpointUrl
+    };
+  }
+  const updatedEntry = {
+    url: endpointUrl,
+    path: "",
+    type: "openapi",
+    auth_type: "bearer",
+    key: apiKey,
+    name: SYNAP_TOOL_SERVER_NAME,
+    config: {},
+    info: {}
+  };
+  const next = [...connections];
+  if (existingIdx >= 0) {
+    next[existingIdx] = { ...existing, ...updatedEntry };
+  } else {
+    next.push(updatedEntry);
+  }
+  const mcpUrl = synapMcpContainerUrl();
+  const mcpEntry = {
+    url: mcpUrl,
+    path: "",
+    type: "mcp",
+    auth_type: "bearer",
+    key: apiKey,
+    name: SYNAP_MCP_SERVER_NAME,
+    config: {},
+    info: {}
+  };
+  const mcpIdx = next.findIndex((c) => c.name === SYNAP_MCP_SERVER_NAME);
+  if (mcpIdx >= 0) {
+    const existingMcp = next[mcpIdx];
+    if (existingMcp.url !== mcpUrl || existingMcp.key !== apiKey) {
+      next[mcpIdx] = { ...existingMcp, ...mcpEntry };
+    }
+  } else {
+    next.push(mcpEntry);
+  }
+  await saveToolServerConnections(jwt, baseUrl, next);
+  return {
+    registered: true,
+    toolCount: probe.paths,
+    serverName: SYNAP_TOOL_SERVER_NAME,
+    endpointUrl
+  };
+}
+var FUNCTION_DEFINITIONS = [
+  {
+    id: "synap_memory_filter",
+    name: "Synap Memory Injection",
+    file: "synap_memory_filter.py",
+    description: "Pre-prompt RAG: pulls top memories + entities from Synap on every turn."
+  },
+  {
+    id: "synap_channel_sync",
+    name: "Synap Channel Sync",
+    file: "synap_channel_sync.py",
+    description: "One-way mirror: every Open WebUI chat is posted to a Synap thread."
+  }
+];
+var HTTP_TIMEOUT_MS2 = 8e3;
+function resolveAssetsDir() {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const candidates = [
+    join3(here, "..", "assets", "functions"),
+    join3(here, "assets", "functions"),
+    "/app/packages/@eve/dna/assets/functions"
+  ];
+  for (const c of candidates) {
+    if (existsSync4(c)) return c;
+  }
+  return null;
+}
+function readFunctionSource(filename) {
+  const dir = resolveAssetsDir();
+  if (!dir) return null;
+  const p = join3(dir, filename);
+  if (!existsSync4(p)) return null;
+  return readFileSync2(p, "utf-8");
+}
+function assertJsonText2(label, text) {
+  if (text.trimStart().startsWith("<")) {
+    throw new Error(
+      `OpenWebUI ${label} returned HTML \u2014 admin route not registered on this OWUI build`
+    );
+  }
+}
+async function adminGet(ctx, path) {
+  const res = await fetch(`${ctx.baseUrl}${path}`, {
+    headers: { Authorization: `Bearer ${ctx.jwt}`, "Content-Type": "application/json" },
+    signal: AbortSignal.timeout(HTTP_TIMEOUT_MS2)
+  });
+  if (!res.ok) throw new Error(`OpenWebUI GET ${path} failed: HTTP ${res.status}`);
+  const text = await res.text();
+  assertJsonText2(`GET ${path}`, text);
+  return JSON.parse(text);
+}
+async function adminPost(ctx, path, body) {
+  const res = await fetch(`${ctx.baseUrl}${path}`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${ctx.jwt}`, "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(HTTP_TIMEOUT_MS2)
+  });
+  if (!res.ok) {
+    const respText = await res.text().catch(() => "");
+    throw new Error(`OpenWebUI POST ${path} failed: HTTP ${res.status} ${respText.slice(0, 200)}`);
+  }
+  const text = await res.text();
+  assertJsonText2(`POST ${path}`, text);
+  return JSON.parse(text);
+}
+async function listFunctions(ctx) {
+  const data = await adminGet(ctx, "/api/v1/functions/");
+  return Array.isArray(data) ? data : [];
+}
+async function createFunction(ctx, form) {
+  await adminPost(ctx, "/api/v1/functions/create", form);
+}
+async function updateFunction(ctx, id, form) {
+  await adminPost(
+    ctx,
+    `/api/v1/functions/id/${encodeURIComponent(id)}/update`,
+    form
+  );
+}
+async function setValves(ctx, id, valves) {
+  await adminPost(ctx, `/api/v1/functions/id/${encodeURIComponent(id)}/valves/update`, valves);
+}
+async function toggleActive(ctx, id) {
+  await adminPost(ctx, `/api/v1/functions/id/${encodeURIComponent(id)}/toggle`, {});
+}
+async function toggleGlobal(ctx, id) {
+  await adminPost(ctx, `/api/v1/functions/id/${encodeURIComponent(id)}/toggle/global`, {});
+}
+async function pushSynapFunctionsToOpenwebui(cwd, _hubBaseUrl, _secrets) {
+  let apiKey = readAgentKeyOrLegacySync("openwebui", _secrets);
+  if (!apiKey) apiKey = readAgentKeyOrLegacySync("eve", _secrets);
+  if (!apiKey) {
+    throw new Error("No Hub API key \u2014 run: eve auth provision --agent openwebui (or eve auth provision --agent eve)");
+  }
+  const jwt = await getAdminJwt();
+  if (!jwt) {
+    throw new Error("OpenWebUI admin JWT unavailable \u2014 container down or no admin user");
+  }
+  const ctx = { baseUrl: resolveOpenwebuiAdminUrl(), jwt };
+  const existing = await listFunctions(ctx);
+  const existingById = /* @__PURE__ */ new Map();
+  for (const fn of existing) existingById.set(fn.id, fn);
+  const valves = {
+    SYNAP_API_URL: SYNAP_BACKEND_INTERNAL_URL,
+    SYNAP_API_KEY: apiKey
+  };
+  const synced = [];
+  const skipped = [];
+  for (const def of FUNCTION_DEFINITIONS) {
+    const content = readFunctionSource(def.file);
+    if (!content) {
+      skipped.push({ id: def.id, reason: `source file not found: assets/functions/${def.file}` });
+      continue;
+    }
+    const desired = {
+      id: def.id,
+      name: def.name,
+      content,
+      meta: { description: def.description }
+    };
+    try {
+      const prior = existingById.get(def.id);
+      let action;
+      if (!prior) {
+        await createFunction(ctx, desired);
+        action = "created";
+      } else if (prior.content !== content || prior.name !== def.name) {
+        await updateFunction(ctx, def.id, desired);
+        action = "updated";
+      } else {
+        action = "unchanged";
+      }
+      await setValves(ctx, def.id, valves);
+      if (!prior || prior.is_active !== true) await toggleActive(ctx, def.id);
+      if (!prior || prior.is_global !== true) await toggleGlobal(ctx, def.id);
+      synced.push({
+        id: def.id,
+        name: def.name,
+        action,
+        enabled: true,
+        global: true
+      });
+    } catch (err) {
+      skipped.push({
+        id: def.id,
+        reason: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  return { synced, skipped };
+}
+async function provisionOwuiUserInSynap(opts) {
+  const podUrl = (opts.podUrl ?? process.env.SYNAP_POD_URL ?? "").replace(/\/+$/, "");
+  const agentKey = opts.agentApiKey ?? process.env.SYNAP_AGENT_API_KEY ?? "";
+  if (!podUrl) throw new Error("podUrl / SYNAP_POD_URL must be set");
+  if (!agentKey) throw new Error("agentApiKey / SYNAP_AGENT_API_KEY must be set");
+  const resp = await fetch(`${podUrl}/api/hub/setup/external-user`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${agentKey}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({
+      externalUserId: opts.owuiUserId,
+      name: opts.owuiUserName,
+      mintSubToken: true
+    })
+  });
+  if (!resp.ok) {
+    throw new Error(`Synap provisioning failed: ${resp.status} ${resp.statusText}`);
+  }
+  const data = await resp.json();
+  return {
+    token: data.token ?? null,
+    synapUserId: data.synapUserId,
+    reused: data.reused ?? false
+  };
+}
+async function listOwuiUsers(jwt) {
+  const baseUrl = resolveOpenwebuiAdminUrl();
+  try {
+    const res = await fetch(`${baseUrl}/api/v1/users/`, {
+      headers: { Authorization: `Bearer ${jwt}` },
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!res.ok) return [];
+    const data = await res.json();
+    if (!Array.isArray(data)) return [];
+    return data;
+  } catch {
+    return [];
+  }
+}
+async function syncOwuiUsersToSynap(cwd = process.cwd(), secrets) {
+  const result = {
+    total: 0,
+    provisioned: 0,
+    skipped: 0,
+    errors: 0,
+    errorMessages: []
+  };
+  const resolvedSecrets = secrets ?? await readEveSecrets(cwd);
+  const podUrl = (resolvedSecrets?.synap?.apiUrl ?? process.env.SYNAP_POD_URL ?? "").replace(/\/+$/, "");
+  const agentApiKey = resolvedSecrets?.agents?.["openwebui"]?.hubApiKey?.trim() || resolvedSecrets?.agents?.["eve"]?.hubApiKey?.trim() || process.env.SYNAP_AGENT_API_KEY || "";
+  if (!podUrl || !agentApiKey) {
+    result.errorMessages.push("syncOwuiUsersToSynap: podUrl or agentApiKey not available \u2014 skipping");
+    result.errors = 1;
+    return result;
+  }
+  const jwt = await getAdminJwtPostHealth();
+  if (!jwt) {
+    result.errorMessages.push("syncOwuiUsersToSynap: could not forge admin JWT \u2014 is OpenWebUI healthy?");
+    result.errors = 1;
+    return result;
+  }
+  const users = await listOwuiUsers(jwt);
+  result.total = users.length;
+  if (users.length === 0) return result;
+  const existingTokens = resolvedSecrets?.builder?.openwebui?.userTokens ?? {};
+  const newTokens = {};
+  for (const user of users) {
+    if (existingTokens[user.id]) {
+      result.skipped++;
+      continue;
+    }
+    try {
+      const provision = await provisionOwuiUserInSynap({
+        owuiUserId: user.id,
+        owuiUserName: user.name,
+        podUrl,
+        agentApiKey
+      });
+      if (provision.token) {
+        newTokens[user.id] = provision.token;
+        result.provisioned++;
+      } else {
+        result.skipped++;
+      }
+    } catch (err) {
+      result.errors++;
+      result.errorMessages.push(
+        `user ${user.id} (${user.email}): ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  if (Object.keys(newTokens).length > 0) {
+    const merged = { ...existingTokens, ...newTokens };
+    await writeEveSecrets(
+      {
+        builder: {
+          ...resolvedSecrets?.builder ?? {},
+          openwebui: {
+            ...resolvedSecrets?.builder?.openwebui ?? {},
+            userTokens: merged
+          }
+        }
+      },
+      cwd
+    );
+  }
+  return result;
+}
+async function resolveHubBaseUrlOnHost(secrets) {
+  const synapBase = await resolveSynapUrlOnHost(secrets);
+  if (!synapBase) return resolveHubBaseUrl(secrets);
+  const isLoopback = synapBase.startsWith("http://127.") || synapBase.startsWith("http://localhost");
+  const base = isLoopback ? synapBase : synapBase.replace(/^http:\/\//, "https://");
+  return `${base.replace(/\/$/, "")}${DEFAULT_HUB_PATH}`;
+}
+async function syncOpenwebuiExtras(cwd, secrets, opts) {
+  if (!secrets) return { skipped: true };
+  const hubBaseUrl = await resolveHubBaseUrlOnHost(secrets);
+  if (!hubBaseUrl) return { skipped: true };
+  const [skills, knowledge, tools, functions, users] = await Promise.allSettled([
+    pushSynapSkillsToOpenwebuiPrompts(cwd, hubBaseUrl, secrets),
+    syncSynapKnowledgeToOpenwebui(cwd, hubBaseUrl, secrets, opts?.knowledge),
+    registerSynapAsOpenwebuiToolServer(cwd, hubBaseUrl, secrets),
+    pushSynapFunctionsToOpenwebui(cwd, hubBaseUrl, secrets),
+    syncOwuiUsersToSynap(cwd, secrets)
+  ]);
+  return {
+    skipped: false,
+    skills: settled(skills),
+    knowledge: settled(knowledge),
+    tools: settled(tools),
+    functions: settled(functions),
+    users: settled(users)
+  };
+}
+function formatExtrasSummary(r) {
+  if (r.skipped) return "OpenWebUI extras: skipped (no Hub URL)";
+  const parts = [];
+  parts.push(formatPart("skills", r.skills, (v) => `created=${v.created} updated=${v.updated} skipped=${v.skipped.length}`));
+  parts.push(formatPart("knowledge", r.knowledge, (v) => `+${v.added}/~${v.updated}/-${v.removed} skipped=${v.skipped.length}`));
+  parts.push(formatPart("tools", r.tools, (v) => v.registered ? `registered ${v.toolCount} ops` : "not registered"));
+  parts.push(formatPart("functions", r.functions, (v) => `synced=${v.synced.length} skipped=${v.skipped.length}`));
+  parts.push(formatPart("users", r.users, (v) => `total=${v.total} provisioned=${v.provisioned} skipped=${v.skipped} errors=${v.errors}`));
+  return `OpenWebUI extras: ${parts.join(" | ")}`;
+}
+function settled(p) {
+  return p.status === "fulfilled" ? { ok: true, result: p.value } : { ok: false, error: errorMessage(p.reason) };
+}
+function formatPart(label, outcome, ok) {
+  if (!outcome) return `${label}=\u2013`;
+  return outcome.ok ? `${label}: ${ok(outcome.result)}` : `${label}: error (${outcome.error})`;
+}
+function errorMessage(err) {
+  if (err instanceof Error) return err.message;
+  return String(err);
+}
+function isContainerRunning(name) {
+  try {
+    const out = execSync3(`docker ps --filter "name=^${name}$" --format "{{.Names}}"`, {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "ignore"]
+    }).trim();
+    return out === name;
+  } catch {
+    return false;
+  }
+}
+function dockerRestart(name) {
+  try {
+    execSync3(`docker restart ${name}`, { stdio: "ignore" });
+  } catch {
+  }
+}
+function pickPrimaryProvider(secrets, componentId) {
+  const all = (secrets?.ai?.providers ?? []).filter((p) => p.enabled !== false);
+  const usable = all.filter(
+    (p) => p.id === "ollama" || p.apiKey && p.apiKey.trim().length > 0 || p.baseUrl && p.baseUrl.trim().length > 0
+    // custom providers may not have API keys
+  );
+  if (usable.length === 0) return null;
+  let base = null;
+  if (componentId) {
+    const override = secrets?.ai?.serviceProviders?.[componentId];
+    if (override) {
+      const hit = usable.find((p) => p.id === override);
+      if (hit) base = hit;
+    }
+  }
+  if (!base) {
+    const def = secrets?.ai?.defaultProvider;
+    const fallback = secrets?.ai?.fallbackProvider;
+    base = usable.find((p) => p.id === def) ?? usable.find((p) => p.id === fallback) ?? usable.find((p) => p.enabled !== false) ?? usable[0];
+  }
+  if (!base) return null;
+  if (componentId) {
+    const modelOverride = secrets?.ai?.serviceModels?.[componentId];
+    if (modelOverride) {
+      return { ...base, defaultModel: modelOverride };
+    }
+  }
+  return base;
+}
+function wireSynapIs(secrets) {
+  const providers = secrets?.ai?.providers ?? [];
+  if (providers.length === 0) {
+    return { id: "synap", outcome: "skipped", summary: "no AI providers configured" };
+  }
+  const deployDir = process.env.SYNAP_DEPLOY_DIR ?? "/opt/synap-backend/deploy";
+  if (!existsSync5(deployDir)) {
+    return { id: "synap", outcome: "skipped", summary: `deploy dir not found: ${deployDir}` };
+  }
+  const envLines = ["# AI provider keys \u2014 managed by eve ai apply"];
+  const skippedCustom = [];
+  for (const p of providers) {
+    if (!p.apiKey) continue;
+    if (p.id === "openai") envLines.push(`OPENAI_API_KEY=${p.apiKey}`);
+    if (p.id === "anthropic") envLines.push(`ANTHROPIC_API_KEY=${p.apiKey}`);
+    if (p.id === "openrouter") envLines.push(`OPENROUTER_API_KEY=${p.apiKey}`);
+    if (p.id.startsWith("custom-") || !["ollama", "openai", "anthropic", "openrouter"].includes(p.id)) {
+      const idx = providers.filter((x) => x.id.startsWith("custom-")).indexOf(p) + 1;
+      if (idx > 0) {
+        envLines.push(`CUSTOM_PROVIDER_${idx}_BASE_URL=${p.baseUrl ?? ""}`);
+        envLines.push(`CUSTOM_PROVIDER_${idx}_API_KEY=${p.apiKey}`);
+        envLines.push(`CUSTOM_PROVIDER_${idx}_NAME=${p.name ?? p.id}`);
+        if (p.defaultModel) envLines.push(`CUSTOM_PROVIDER_${idx}_DEFAULT_MODEL=${p.defaultModel}`);
+      } else {
+        skippedCustom.push(p.id);
+      }
+    }
+  }
+  const synapProvider = pickPrimaryProvider(secrets, "synap");
+  if (synapProvider) {
+    envLines.push(`DEFAULT_AI_PROVIDER=${synapProvider.id}`);
+    if (synapProvider.defaultModel) {
+      envLines.push(`DEFAULT_AI_MODEL=${synapProvider.defaultModel}`);
+    }
+  }
+  const ollamaProvider = providers.find((p) => p.id === "ollama");
+  if (ollamaProvider) {
+    const ollamaUrl = secrets?.inference?.ollamaUrl ?? "http://eve-brain-ollama:11434";
+    envLines.push(`OLLAMA_BASE_URL=${ollamaUrl}`);
+  }
+  const envPath = join4(deployDir, ".env");
+  let existing = "";
+  try {
+    existing = readFileSync3(envPath, "utf-8");
+  } catch {
+  }
+  const marker = "# AI provider keys \u2014 managed by eve ai apply";
+  const before = existing.includes(marker) ? existing.split(marker)[0].trimEnd() : existing.trimEnd();
+  const merged = (before ? before + "\n\n" : "") + envLines.join("\n") + "\n";
+  try {
+    writeFileSync2(envPath, merged, { mode: 384 });
+  } catch (err) {
+    return {
+      id: "synap",
+      outcome: "failed",
+      summary: "could not write Synap IS env",
+      detail: err instanceof Error ? err.message : String(err)
+    };
+  }
+  try {
+    const out = execSync3(
+      `docker ps --filter "label=com.docker.compose.project=synap-backend" --filter "label=com.docker.compose.service=intelligence-hub" --format "{{.Names}}"`,
+      { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] }
+    ).trim();
+    const isContainer = out.split("\n")[0]?.trim();
+    if (isContainer) dockerRestart(isContainer);
+  } catch {
+  }
+  const wiredCount = providers.length - skippedCustom.length;
+  return {
+    id: "synap",
+    outcome: "ok",
+    summary: `Synap IS env updated (${wiredCount} provider(s))` + (skippedCustom.length ? ` \u2014 ${skippedCustom.length} custom provider(s) not wired here (${skippedCustom.join(", ")}); they live in the pod's ai_providers table` : ""),
+    detail: envPath,
+    wiredModel: synapProvider?.defaultModel,
+    wiredProvider: synapProvider?.id
+  };
+}
+function wireOpenclaw(secrets) {
+  const synapApiKey = readAgentKeyOrLegacySync("openclaw", secrets);
+  if (!synapApiKey) {
+    return { id: "openclaw", outcome: "skipped", summary: "no Synap pod API key \u2014 install Synap first" };
+  }
+  if (!isContainerRunning("eve-arms-openclaw")) {
+    return { id: "openclaw", outcome: "skipped", summary: "eve-arms-openclaw container not running" };
+  }
+  const provider = pickPrimaryProvider(secrets, "openclaw");
+  const preferredModel = provider?.defaultModel;
+  const authProfile = {
+    providers: {
+      openai: {
+        apiKey: synapApiKey,
+        // Synap backend (eve-brain-synap:4000) is the AI hub for self-hosted Eve.
+        // intelligence-hub:3001 is the proprietary IS — not available without managed pod.
+        baseUrl: "http://eve-brain-synap:4000/v1",
+        ...preferredModel ? { defaultModel: preferredModel } : {}
+      }
+    },
+    ...preferredModel ? { defaultModel: preferredModel } : {}
+  };
+  const authJson = JSON.stringify(authProfile, null, 2);
+  const containerPath = "/home/node/.openclaw/agents/main/agent/auth-profiles.json";
+  try {
+    execSync3(`docker exec eve-arms-openclaw sh -c 'mkdir -p ${dirname2(containerPath)}'`, {
+      stdio: "ignore"
+    });
+    execSync3(
+      `docker exec -i eve-arms-openclaw sh -c 'cat > ${containerPath}'`,
+      { input: authJson, stdio: ["pipe", "pipe", "ignore"] }
+    );
+    execSync3(`docker exec eve-arms-openclaw sh -c 'chmod 600 ${containerPath}'`, {
+      stdio: "ignore"
+    });
+  } catch (err) {
+    return {
+      id: "openclaw",
+      outcome: "failed",
+      summary: "could not write OpenClaw auth-profiles.json",
+      detail: err instanceof Error ? err.message : String(err)
+    };
+  }
+  dockerRestart("eve-arms-openclaw");
+  return {
+    id: "openclaw",
+    outcome: "ok",
+    summary: "OpenClaw wired to Synap IS as OpenAI provider",
+    detail: containerPath,
+    wiredModel: preferredModel,
+    wiredProvider: "synap"
+  };
+}
+async function wireOpenwebui(secrets) {
+  let synapApiKey = readAgentKeyOrLegacySync("openwebui", secrets);
+  if (!synapApiKey) {
+    synapApiKey = readAgentKeyOrLegacySync("eve", secrets);
+  }
+  if (!synapApiKey) {
+    return { id: "openwebui", outcome: "skipped", summary: "no Synap API key \u2014 run: eve auth provision --agent openwebui (or eve auth provision --agent eve)" };
+  }
+  const providers = secrets?.ai?.providers ?? [];
+  const deployDir = "/opt/openwebui";
+  const envPath = join4(deployDir, ".env");
+  if (!existsSync5(deployDir)) {
+    return { id: "openwebui", outcome: "skipped", summary: "Open WebUI deploy dir not found \u2014 install it first" };
+  }
+  let existing = "";
+  try {
+    existing = readFileSync3(envPath, "utf-8");
+  } catch {
+  }
+  const marker = "# AI wiring \u2014 managed by eve ai apply";
+  const aiManagedEnvKeys = /* @__PURE__ */ new Set([
+    "SYNAP_API_KEY",
+    "SYNAP_IS_URL",
+    "OPENAI_API_BASE_URLS",
+    "OPENAI_API_KEYS",
+    "DEFAULT_MODELS"
+  ]);
+  const rawBefore = existing.includes(marker) ? existing.split(marker)[0] : existing;
+  const before = rawBefore.split("\n").filter((line) => {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#") || !trimmed.includes("=")) return true;
+    const key = trimmed.slice(0, trimmed.indexOf("="));
+    return !aiManagedEnvKeys.has(key);
+  }).join("\n").trimEnd();
+  const provider = pickPrimaryProvider(secrets, "openwebui");
+  const preferredModel = provider?.defaultModel;
+  const apiBaseUrls = ["http://eve-brain-synap:4000/v1"];
+  const apiKeys = [synapApiKey];
+  const hermesApiServerKey = secrets?.builder?.hermes?.apiServerKey;
+  if (hermesApiServerKey && isContainerRunning("eve-builder-hermes")) {
+    apiBaseUrls.push("http://eve-builder-hermes:8642/v1");
+    apiKeys.push(hermesApiServerKey);
+  }
+  for (const p of providers) {
+    if (p.enabled === false || !p.id.startsWith("custom-")) continue;
+    if (!p.baseUrl) continue;
+    const url = p.baseUrl.replace(/\/v1$/, "");
+    apiBaseUrls.push(`${url}/v1`);
+    if (p.apiKey && p.apiKey.trim()) {
+      apiKeys.push(p.apiKey);
+    } else {
+      apiKeys.push("");
+    }
+  }
+  const block = [
+    marker,
+    `SYNAP_API_KEY=${synapApiKey}`,
+    // synap-backend (eve-brain-synap:4000) hosts /v1/chat/completions + /v1/models.
+    // intelligence-hub (port 3001) is internal IS — it has no /v1 endpoints.
+    `SYNAP_IS_URL=http://eve-brain-synap:4000`,
+    // Plural form takes precedence when pipelines is also installed.
+    // Hermes appears as a separate model source in the OpenWebUI model picker.
+    `OPENAI_API_BASE_URLS=${apiBaseUrls.join(";")}`,
+    `OPENAI_API_KEYS=${apiKeys.join(";")}`,
+    ...preferredModel ? [`DEFAULT_MODELS=${preferredModel}`] : []
+  ].join("\n");
+  try {
+    writeFileSync2(envPath, (before ? before + "\n\n" : "") + block + "\n", { mode: 384 });
+  } catch (err) {
+    return {
+      id: "openwebui",
+      outcome: "failed",
+      summary: "could not write Open WebUI env",
+      detail: err instanceof Error ? err.message : String(err)
+    };
+  }
+  try {
+    execSync3("docker compose up -d", {
+      cwd: "/opt/openwebui",
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+  } catch (err) {
+    const errMsg = err instanceof Error ? err.message.split("\n").pop()?.trim() ?? String(err) : String(err);
+    if (isContainerRunning("hestia-openwebui")) {
+      try {
+        dockerRestart("hestia-openwebui");
+      } catch {
+      }
+    }
+    return {
+      id: "openwebui",
+      outcome: "failed",
+      summary: `docker compose failed (${errMsg})`,
+      detail: errMsg
+    };
+  }
+  const hermesNote = hermesApiServerKey ? " + Hermes gateway" : "";
+  try {
+    const { modelSources } = buildOpenwebuiModelSources(secrets, deployDir);
+    if (modelSources.length > 0) {
+      modelSources[0].apiKey = synapApiKey;
+    }
+    const hermesIdx = modelSources.findIndex((m) => m.displayName === "Hermes Gateway");
+    if (hermesIdx >= 0) {
+      modelSources[hermesIdx].apiKey = hermesApiServerKey ?? "";
+    }
+    const outcome = await registerOpenwebuiAdminApi(modelSources, {
+      managedConfig: buildOpenwebuiManagedConfig(secrets)
+    });
+    if (!outcome.ok) {
+      return {
+        id: "openwebui",
+        outcome: "ok",
+        summary: `Open WebUI wired to Synap IS${hermesNote} (registration warning: ${outcome.stage} \u2014 ${outcome.reason} \u2014 run \`eve openwebui sync\` to retry)`,
+        detail: envPath,
+        wiredModel: preferredModel,
+        wiredProvider: "synap"
+      };
+    }
+    const extras = await syncOpenwebuiExtras(process.cwd(), secrets);
+    const extrasSummary = formatExtrasSummary(extras);
+    const extrasHas401 = /\b401\b|Unauthorized/i.test(extrasSummary);
+    return {
+      id: "openwebui",
+      outcome: "ok",
+      summary: extrasHas401 ? `Open WebUI wired to Synap IS${hermesNote} (extras 401 \u2014 eve key likely stale: ${extrasSummary})` : `Open WebUI wired to Synap IS${hermesNote} (${extrasSummary})`,
+      detail: envPath,
+      wiredModel: preferredModel,
+      wiredProvider: "synap"
+    };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return {
+      id: "openwebui",
+      outcome: "ok",
+      summary: `Open WebUI wired to Synap IS${hermesNote} (registration warning: ${msg} \u2014 run \`eve openwebui sync\` to retry)`,
+      detail: envPath,
+      wiredModel: preferredModel,
+      wiredProvider: "synap"
+    };
+  }
+}
+function wireHermes(secrets) {
+  const home = homedir2();
+  const eveDir = join4(home, ".eve");
+  const hermesEnvPath = join4(home, ".eve", "hermes.env");
+  if (!existsSync5(eveDir)) {
+    return { id: "hermes", outcome: "skipped", summary: ".eve dir not found \u2014 install Hermes first" };
+  }
+  const synapApiKey = readAgentKeyOrLegacySync("hermes", secrets);
+  if (!synapApiKey) {
+    return { id: "hermes", outcome: "skipped", summary: "no Hermes Hub API key \u2014 run provisioning first" };
+  }
+  const provider = pickPrimaryProvider(secrets, "hermes");
+  const preferredModel = provider?.defaultModel ?? "synap/balanced";
+  const BUILTIN_URLS = {
+    openrouter: "https://openrouter.ai/api/v1",
+    openai: "https://api.openai.com/v1",
+    anthropic: "https://api.anthropic.com/v1",
+    ollama: "http://eve-brain-ollama:11434/v1"
+  };
+  let aiBaseUrl = provider?.baseUrl?.replace(/\/$/, "") ?? BUILTIN_URLS[provider?.id ?? ""] ?? "";
+  if (provider?.id === "ollama" && /localhost|127\.0\.0\.1/.test(aiBaseUrl)) {
+    aiBaseUrl = aiBaseUrl.replace(/localhost|127\.0\.0\.1/, "eve-brain-ollama");
+  }
+  if (!aiBaseUrl) {
+    aiBaseUrl = "http://eve-brain-synap:4000/v1";
+  }
+  const aiApiKey = provider && provider.id !== "ollama" && provider.apiKey ? provider.apiKey : synapApiKey;
+  const aiBlock = [
+    "# AI wiring \u2014 managed by eve ai apply",
+    `AI_BASE_URL=${aiBaseUrl}`,
+    `AI_API_KEY=${aiApiKey}`,
+    `AI_DEFAULT_MODEL=${preferredModel}`
+  ].join("\n");
+  let existing = "";
+  try {
+    existing = readFileSync3(hermesEnvPath, "utf-8");
+  } catch {
+  }
+  const marker = "# AI wiring \u2014 managed by eve ai apply";
+  const before = existing.includes(marker) ? existing.split(marker)[0].trimEnd() : existing.trimEnd();
+  const merged = (before ? before + "\n\n" : "") + aiBlock + "\n";
+  try {
+    writeFileSync2(hermesEnvPath, merged, { mode: 384 });
+  } catch (err) {
+    return {
+      id: "hermes",
+      outcome: "failed",
+      summary: "could not write hermes.env AI block",
+      detail: err instanceof Error ? err.message : String(err)
+    };
+  }
+  try {
+    writeHermesConfigYamlSync(secrets);
+    generateSynapPlugin();
+  } catch {
+  }
+  const hermesWasRunning = isContainerRunning("eve-builder-hermes");
+  if (hermesWasRunning) {
+    void appendOperationalEvent({
+      type: "repair.started",
+      target: "eve-builder-hermes",
+      componentId: "hermes",
+      summary: "Recreating Hermes container to pick up env/config changes",
+      details: { trigger: "wireHermes", op: "docker rm -f + docker run" }
+    }).catch(() => {
+    });
+    try {
+      execSync3("docker rm -f eve-builder-hermes", { stdio: "ignore" });
+    } catch {
+    }
+  }
+  try {
+    const home2 = homedir2();
+    const hermesHome = join4(home2, ".eve", "hermes");
+    const hermesEnv = join4(home2, ".eve", "hermes.env");
+    const skillsDir = join4(home2, ".eve", "skills");
+    mkdirSync2(hermesHome, { recursive: true });
+    mkdirSync2(skillsDir, { recursive: true });
+    try {
+      execSync3(`chown -R 10000:10000 ${JSON.stringify(hermesHome)}`, { stdio: "ignore" });
+    } catch {
+    }
+    const args = [
+      "run",
+      "-d",
+      "--name",
+      "eve-builder-hermes",
+      "--network",
+      "eve-network",
+      "--restart",
+      "unless-stopped",
+      "-p",
+      "8642:8642",
+      "-p",
+      "9119:9119",
+      "-p",
+      "9120:9120",
+      "-v",
+      `${hermesHome}:/opt/data`,
+      "-v",
+      `${skillsDir}:/opt/data/synap-skills:ro`,
+      "--env-file",
+      hermesEnv,
+      "-e",
+      "HERMES_HOME=/opt/data",
+      "nousresearch/hermes-agent:latest",
+      "gateway",
+      "run"
+    ];
+    execSync3(`docker ${args.join(" ")}`, { stdio: "pipe", timeout: 3e4 });
+    if (hermesWasRunning) {
+      void appendOperationalEvent({
+        type: "repair.succeeded",
+        target: "eve-builder-hermes",
+        componentId: "hermes",
+        ok: true,
+        summary: "Hermes container recreated with fresh env/config"
+      }).catch(() => {
+      });
+    }
+  } catch (err) {
+    if (hermesWasRunning) {
+      void appendOperationalEvent({
+        type: "repair.failed",
+        target: "eve-builder-hermes",
+        componentId: "hermes",
+        ok: false,
+        summary: "Hermes container recreate failed",
+        error: err instanceof Error ? err.message : String(err)
+      }).catch(() => {
+      });
+    }
+  }
+  return {
+    id: "hermes",
+    outcome: "ok",
+    summary: `Hermes wired \u2192 ${preferredModel} (config + plugin regenerated)`,
+    detail: hermesEnvPath,
+    wiredModel: preferredModel,
+    wiredProvider: "synap"
+  };
+}
+function wireBuilder(_secrets, componentId) {
+  return {
+    id: componentId,
+    outcome: "skipped",
+    summary: "builder organ uses Synap IS via Hub Protocol \u2014 wired during install"
+  };
+}
+var AI_CONSUMERS = /* @__PURE__ */ new Set([
+  "synap",
+  "openclaw",
+  "openwebui",
+  "hermes"
+]);
+var AI_CONSUMERS_NEEDING_RECREATE = /* @__PURE__ */ new Set([
+  "openclaw",
+  // Hermes is started via `docker run --env-file ~/.eve/hermes.env`. Docker
+  // bakes env vars into the container spec at creation time — `docker restart`
+  // reuses those stale values. Any channel credential or AI config change
+  // requires a full recreate so the updated hermes.env is re-read.
+  "hermes",
+  // OpenWebUI reads OPENAI_API_BASE_URLS from .env on first boot. `docker
+  // restart` won't re-read the file — compose up -d is required. The admin
+  // API can update config without restart, but the primary path uses recreate.
+  "openwebui"
+]);
+async function wireComponentAi(componentId, secrets) {
+  const comp = COMPONENTS.find((c) => c.id === componentId);
+  if (!comp) {
+    return { id: componentId, outcome: "failed", summary: `unknown component: ${componentId}` };
+  }
+  switch (componentId) {
+    case "synap":
+      return wireSynapIs(secrets);
+    case "openclaw":
+      return wireOpenclaw(secrets);
+    case "openwebui":
+      return wireOpenwebui(secrets);
+    case "hermes":
+      return wireHermes(secrets);
+    case "opencode":
+    case "openclaude":
+      return wireBuilder(secrets, componentId);
+    default:
+      return {
+        id: componentId,
+        outcome: "skipped",
+        summary: "no AI wiring needed"
+      };
+  }
+}
+async function wireAllInstalledComponents(secrets, installedComponents) {
+  return Promise.all(installedComponents.map((id) => wireComponentAi(id, secrets)));
+}
+function buildOpenwebuiModelSources(secrets, _deployDir) {
+  const providers = secrets?.ai?.providers ?? [];
+  const modelSources = [];
+  modelSources.push({
+    url: "http://eve-brain-synap:4000/v1",
+    apiKey: "",
+    displayName: "Synap IS"
+  });
+  const hermesApiKey = secrets?.builder?.hermes?.apiServerKey ?? "";
+  if (hermesApiKey && isContainerRunning("eve-builder-hermes")) {
+    modelSources.push({
+      url: "http://eve-builder-hermes:8642/v1",
+      apiKey: hermesApiKey,
+      displayName: "Hermes Gateway"
+    });
+  }
+  for (const p of providers) {
+    if (p.enabled === false || !p.id.startsWith("custom-")) continue;
+    const hasLiveUrl = !!(p.baseUrl && p.apiKey);
+    if (!hasLiveUrl) continue;
+    modelSources.push({
+      url: p.baseUrl.replace(/\/v1$/, "") + "/v1",
+      apiKey: p.apiKey ?? "",
+      displayName: p.name ?? p.id,
+      models: p.models
+    });
+  }
+  return { modelSources };
+}
+function buildOpenwebuiManagedConfig(secrets) {
+  const provider = pickPrimaryProvider(secrets, "openwebui");
+  const defaultModels = secrets?.ai?.serviceModels?.openwebui ?? provider?.defaultModel ?? "synap/auto";
+  const domain = secrets?.domain?.primary?.trim();
+  const webuiUrl = domain && domain !== "localhost" ? `${secrets?.domain?.ssl ? "https" : "http"}://chat.${domain}` : "";
+  return {
+    defaultModels,
+    webuiUrl,
+    webuiName: "Eve",
+    enableSignup: true,
+    defaultUserRole: "pending"
+  };
+}
+async function registerOpenwebuiAdminApi(modelSources, options) {
+  const healthAttempts = options.maxRetries ?? 12;
+  const health = await waitForHealthDetailed(void 0, healthAttempts);
+  if (!health.ok) {
+    return { ok: false, stage: "health", reason: health.reason ?? `health timed out at ${health.baseUrl}` };
+  }
+  const jwtResult = await getAdminJwtPostHealthDetailed();
+  if (!jwtResult.ok) {
+    return { ok: false, stage: jwtResult.stage, reason: jwtResult.reason };
+  }
+  const jwt = jwtResult.jwt;
+  const auth = await probeAdminAuth(jwt);
+  if (!auth.ok) {
+    if (auth.status === 401 || auth.status === 403) {
+      return {
+        ok: false,
+        stage: "jwt-rejected",
+        reason: `admin /api/v1/configs/ rejected forged JWT with HTTP ${auth.status}: ${auth.body.slice(0, 200)}`
+      };
+    }
+    return {
+      ok: false,
+      stage: "reconcile",
+      reason: `admin /api/v1/configs/ probe returned HTTP ${auth.status || "?"}: ${auth.body.slice(0, 200)}`
+    };
+  }
+  try {
+    const detailed = await reconcileOpenwebuiManagedConfigViaAdminDetailed(jwt, {
+      ...options.managedConfig ?? {},
+      modelSources
+    });
+    if (!detailed.ok) {
+      return {
+        ok: false,
+        stage: "reconcile",
+        reason: `${detailed.step} failed (HTTP ${detailed.status || "?"}): ${detailed.reason}` + (detailed.bodyPreview ? ` | body: ${detailed.bodyPreview}` : "")
+      };
+    }
+  } catch (err) {
+    return {
+      ok: false,
+      stage: "reconcile",
+      reason: err instanceof Error ? err.message : String(err)
+    };
+  }
+  return { ok: true };
+}
+function hasAnyProvider(secrets) {
+  const providers = secrets?.ai?.providers ?? [];
+  return providers.some((p) => p.apiKey && p.apiKey.trim().length > 0);
+}
+function changed(changedSections, section) {
+  return changedSections.some((s) => s === section || s.startsWith(`${section}.`));
+}
+function installedAiConsumers(secrets) {
+  const status = secrets.ai?.wiringStatus ?? {};
+  const wired = Object.keys(status).filter((id) => status[id]?.lastApplied);
+  if (wired.length > 0) return wired;
+  const ids = new Set(COMPONENTS.map((component) => component.id));
+  return Array.from(AI_CONSUMERS_NEEDING_RECREATE).filter((id) => ids.has(id));
+}
+async function tryWriteHermesEnv() {
+  try {
+    await writeHermesEnvFile();
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function reconcile(secrets, changedSections, options = {}) {
+  const result = {
+    envSync: false,
+    aiWiring: [],
+    containerRecreates: [],
+    traefikUpdate: false
+  };
+  if (changed(changedSections, "ai")) {
+    const consumers = installedAiConsumers(secrets);
+    const wiring = await wireAllInstalledComponents(secrets, consumers);
+    result.aiWiring = wiring.map(({ id, outcome, summary }) => ({ id, outcome, summary }));
+    result.containerRecreates.push(
+      ...wiring.filter((item) => item.outcome === "ok" && AI_CONSUMERS_NEEDING_RECREATE.has(item.id)).map((item) => item.id)
+    );
+  }
+  if (!options.skipEnvSync && (changed(changedSections, "channels") || changed(changedSections, "channelRouting") || changed(changedSections, "builder") || changed(changedSections, "inference"))) {
+    result.envSync = await tryWriteHermesEnv();
+    if (changed(changedSections, "builder")) {
+      result.containerRecreates.push("hermes");
+    }
+  }
+  if (changed(changedSections, "domain") || changed(changedSections, "synap") || changed(changedSections, "pod")) {
+    const deployDir = findPodDeployDir();
+    if (deployDir) {
+      result.envSync = true;
+      if (restartBackendContainer(deployDir)) {
+        result.containerRecreates.push("synap");
+      }
+    }
+  }
+  if (options.recreateComponents) {
+    result.containerRecreates.push(...options.recreateComponents);
+  }
+  result.containerRecreates = Array.from(new Set(result.containerRecreates));
+  return result;
+}
+
+export {
+  COMPONENTS,
+  EVE_DASHBOARD_SERVICE,
+  resolveComponent,
+  allComponentIds,
+  addonComponentIds,
+  selectedIds,
+  serviceComponents,
+  validateBaseDomain,
+  publicComponentUrl,
+  isLoopbackUrl,
+  SYNAP_BACKEND_INTERNAL_URL,
+  SYNAP_HOST_LOOPBACK_PORT,
+  resolveSynapUrl,
+  DEFAULT_HUB_PATH,
+  resolveHubBaseUrl,
+  defaultSkillsDir,
+  ensureEveSkillsLayout,
+  writeBuilderProjectEnv,
+  writeSandboxEnvFile,
+  copySynapSkillIntoClaudeProject,
+  writeClaudeCodeSettings,
+  writeHermesEnvFile,
+  writeHermesConfigYaml,
+  generateSynapPlugin,
+  POD_DEPLOY_DIR_CANDIDATES,
+  findPodDeployDir,
+  SYNAP_BACKEND_CONTAINERS,
+  restartBackendContainer,
+  restartHermesIfRunning,
+  connectTraefikToEveNetwork,
+  isSynapLoopbackReachable,
+  resetSynapLoopbackProbeCache,
+  resolveSynapUrlOnHost,
+  resolveOpenwebuiAdminUrl,
+  waitForHealth,
+  waitForHealthDetailed,
+  getStatus,
+  getAdminReadyStatus,
+  getAdminJwt,
+  getAdminJwtPostHealth,
+  getAdminJwtPostHealthDetailed,
+  probeAdminAuth,
+  getConfig,
+  getConfigDetailed,
+  saveConfig,
+  saveConfigDetailed,
+  reconcileOpenwebuiManagedConfig,
+  reconcileOpenwebuiManagedConfigViaAdmin,
+  reconcileOpenwebuiManagedConfigViaAdminDetailed,
+  listModelSources,
+  registerModelSource,
+  upsertAllModelSources,
+  pushSynapSkillsToOpenwebuiPrompts,
+  syncSynapKnowledgeToOpenwebui,
+  registerSynapAsOpenwebuiToolServer,
+  pushSynapFunctionsToOpenwebui,
+  provisionOwuiUserInSynap,
+  syncOwuiUsersToSynap,
+  syncOpenwebuiExtras,
+  formatExtrasSummary,
+  pickPrimaryProvider,
+  AI_CONSUMERS,
+  AI_CONSUMERS_NEEDING_RECREATE,
+  wireComponentAi,
+  wireAllInstalledComponents,
+  buildOpenwebuiModelSources,
+  buildOpenwebuiManagedConfig,
+  registerOpenwebuiAdminApi,
+  hasAnyProvider,
+  reconcile
+};
+//# sourceMappingURL=chunk-O5WTCVMZ.js.map