bazilion 0.12.2 → 0.13.0

package/dist/web/server/assets/public-origin-xV0lm0Ty.js

@@ -0,0 +1,25 @@
+//#region src/lib/public-origin.ts
+function webOriginConfig(env = process.env) {
+	const raw = env.BAZILION_PUBLIC_ORIGIN?.trim();
+	if (!raw) return {
+		origin: null,
+		production: false,
+		sessionCookie: "bz_session_dev",
+		csrfCookie: "bz_csrf_dev"
+	};
+	let url;
+	try {
+		url = new URL(raw);
+	} catch {
+		throw new Error("BAZILION_PUBLIC_ORIGIN must be an exact HTTPS origin");
+	}
+	if (url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash || url.origin !== raw.replace(/\/$/, "")) throw new Error("BAZILION_PUBLIC_ORIGIN must be an exact HTTPS origin");
+	return {
+		origin: url.origin,
+		production: true,
+		sessionCookie: "__Host-bz_session",
+		csrfCookie: "__Host-bz_csrf"
+	};
+}
+//#endregion
+export { webOriginConfig as t };

package/dist/web/server/assets/{router-CIVjTgNp.js → router-D-6TzLRZ.js}

@@ -1,36 +1,37 @@
-import { i as getCookie, t as createServerFn } from "../server.js";
-import { t as DAEMON_BASE_URL } from "./daemon-client-2NRMzlTr.js";
-import { i as BaziuLogo, n as ThemeToggle, r as PawIcon, t as Route$4 } from "./login-Bx5LEyGP.js";
-import { t as createSsrRpc } from "./createSsrRpc-DFsIAfFd.js";
-import { t as Route$5 } from "./routes-C19CMLZt.js";
-import { t as Route$6 } from "./teams-DEpQR2QA.js";
-import { t as Route$7 } from "./skills-C-UgkuCW.js";
-import { t as Route$8 } from "./config-1w2GiJUn.js";
-import { t as Route$9 } from "./attention-BxkTf337.js";
-import { t as Route$10 } from "./approvals-CWcFHlor.js";
-import { t as Route$11 } from "./agents-C9xlWK0Z.js";
-import { t as Route$12 } from "./tokens-BnwFbV7T.js";
-import { t as Route$13 } from "./services-C4szdhPx.js";
-import { t as Route$14 } from "./mcp-DIWTogHM.js";
-import { t as Route$15 } from "./teams-OIkHuxy1.js";
-import { t as Route$16 } from "./agents-BvttypqB.js";
-import { t as Route$17 } from "./_id-Dj1yZ3zJ.js";
-import { t as Route$18 } from "./_id-FcHdSocl.js";
-import { t as Route$19 } from "./policy-C30AeFIb.js";
-import { t as Route$20 } from "./memory-pZ4pZT7p.js";
-import { t as Route$21 } from "./members-VdPwD6CE.js";
-import { t as Route$22 } from "./context-BXGo5Vfi.js";
-import { t as Route$23 } from "./activity-D9SMqBhy.js";
-import { t as Route$24 } from "./telegram-XwyKSEtj.js";
-import { t as Route$25 } from "./triggers-BZPl5CHs.js";
-import { t as Route$26 } from "./learning-B7PBkvER.js";
-import { t as Route$27 } from "./inbox-ZvDNAjaM.js";
-import { t as Route$28 } from "./_id-DinTp_7X.js";
-import { t as Route$29 } from "./_id-CwyGjJeP.js";
+import { a as getCookie, n as createServerFn } from "../server.js";
+import { t as DAEMON_BASE_URL } from "./daemon-client-CI5NHwNC.js";
+import { t as webOriginConfig } from "./public-origin-xV0lm0Ty.js";
+import { i as BaziuLogo, n as ThemeToggle, r as PawIcon, t as Route$4 } from "./login-CrFVVUaE.js";
+import { t as createSsrRpc } from "./createSsrRpc-6LHNEsSK.js";
+import { t as Route$5 } from "./routes-D933ngZS.js";
+import { t as Route$6 } from "./teams-DqC4wZxu.js";
+import { t as Route$7 } from "./skills-D5DQL8bM.js";
+import { t as Route$8 } from "./config-wYtIhkRm.js";
+import { t as Route$9 } from "./attention-Bw_wiiqI.js";
+import { t as Route$10 } from "./approvals-BkUGmYU9.js";
+import { t as Route$11 } from "./agents-BpSeOA30.js";
+import { t as Route$12 } from "./tokens-DO5BzNOn.js";
+import { t as Route$13 } from "./services-OB4LAr2A.js";
+import { t as Route$14 } from "./mcp-BQtp2T87.js";
+import { t as Route$15 } from "./teams-Dz6ZEMRo.js";
+import { t as Route$16 } from "./agents-DY630p6x.js";
+import { t as Route$17 } from "./_id-xTD_6ApX.js";
+import { t as Route$18 } from "./_id-CvYqVJPU.js";
+import { t as Route$19 } from "./policy-D7kj3Cy7.js";
+import { t as Route$20 } from "./memory-Iq2M0-Yc.js";
+import { t as Route$21 } from "./members-DXu2oAS_.js";
+import { t as Route$22 } from "./context-BkDDwbby.js";
+import { t as Route$23 } from "./activity-BazZNfvf.js";
+import { t as Route$24 } from "./telegram-J4T0XhwQ.js";
+import { t as Route$25 } from "./triggers-BdBx-HwR.js";
+import { t as Route$26 } from "./learning-DpyLNVe8.js";
+import { t as Route$27 } from "./inbox-0iiSg-Y1.js";
+import { t as Route$28 } from "./_id-DkrNqqTw.js";
+import { t as Route$29 } from "./_id-BENqNBfK.js";
 import { useEffect, useState } from "react";
 import { HeadContent, Link, Outlet, Scripts, createFileRoute, createRootRoute, createRouter, lazyRouteComponent, redirect, useRouterState } from "@tanstack/react-router";
 import { jsx, jsxs } from "react/jsx-runtime";
-import { BellRing, Bot, LayoutTemplate, Settings2, ShieldCheck, Sparkles, UsersRound } from "lucide-react";
+import { BellRing, Bot, LayoutTemplate, LogOut, Settings2, ShieldCheck, Sparkles, UsersRound } from "lucide-react";
 //#region src/components/Footer.tsx
 function Footer() {
 	return /* @__PURE__ */ jsxs("footer", {
@@ -97,6 +98,9 @@ function TopNav() {
 		if (pathname === "/login" || pathname === "/welcome") return;
 		fetch("/api/attention/summary").then((response) => response.ok ? response.json() : null).then((body) => setAttentionCount(body?.openTotal ?? 0)).catch(() => {});
 	}, [pathname]);
+	async function logout() {
+		if ((await fetch("/api/logout", { method: "POST" })).ok) window.location.assign("/login");
+	}
 	return /* @__PURE__ */ jsxs("nav", {
 		"aria-label": "Primary navigation",
 		className: "mx-auto grid w-full max-w-[1500px] shrink-0 grid-cols-[minmax(0,1fr)_auto] items-center gap-x-3 gap-y-2 border-b border-frost py-3 md:flex md:gap-2 md:py-4",
@@ -139,9 +143,19 @@ function TopNav() {
 					}, link.to);
 				})
 			}),
-			/* @__PURE__ */ jsx("div", {
-				className: "col-start-2 row-start-1 md:col-auto md:row-auto md:ml-auto",
-				children: /* @__PURE__ */ jsx(ThemeToggle, {})
+			/* @__PURE__ */ jsxs("div", {
+				className: "col-start-2 row-start-1 flex items-center gap-1 md:col-auto md:row-auto md:ml-auto",
+				children: [/* @__PURE__ */ jsx(ThemeToggle, {}), /* @__PURE__ */ jsx("button", {
+					type: "button",
+					onClick: logout,
+					"aria-label": "Log out",
+					title: "Log out",
+					className: "inline-flex h-9 w-9 items-center justify-center rounded-lg text-mocha hover:bg-ivory hover:text-sapphire",
+					children: /* @__PURE__ */ jsx(LogOut, {
+						className: "h-4 w-4",
+						"aria-hidden": "true"
+					})
+				})]
 			})
 		]
 	});
@@ -156,11 +170,48 @@ function isSetupOpen(path) {
 	return false;
 }
 //#endregion
+//#region src/lib/csrf-fetch.ts
+function cookie(name) {
+	const prefix = `${encodeURIComponent(name)}=`;
+	for (const part of document.cookie.split(";")) {
+		const value = part.trim();
+		if (value.startsWith(prefix)) return decodeURIComponent(value.slice(prefix.length));
+	}
+	return null;
+}
+function installCsrfFetch() {
+	if (typeof window === "undefined") return;
+	const marker = "__bazilionCsrfFetchInstalled";
+	const state = window;
+	if (state[marker]) return;
+	state[marker] = true;
+	const original = window.fetch.bind(window);
+	window.fetch = (input, init) => {
+		const request = input instanceof Request ? input : null;
+		const method = (init?.method ?? request?.method ?? "GET").toUpperCase();
+		if (new URL(request?.url ?? String(input), window.location.href).origin !== window.location.origin || [
+			"GET",
+			"HEAD",
+			"OPTIONS"
+		].includes(method)) return original(input, init);
+		const csrf = cookie("__Host-bz_csrf") ?? cookie("bz_csrf_dev");
+		if (!csrf) return original(input, init);
+		const headers = new Headers(request?.headers ?? void 0);
+		for (const [key, value] of new Headers(init?.headers)) headers.set(key, value);
+		headers.set("x-bazilion-csrf", csrf);
+		return original(input, {
+			...init,
+			headers
+		});
+	};
+}
+//#endregion
 //#region src/styles.css?url
-var styles_default = "/assets/styles-DMltY3su.css";
+var styles_default = "/assets/styles-D6RPN7RK.css";
 //#endregion
 //#region src/routes/__root.tsx
 var THEME_INIT_SCRIPT = `(function(){try{var t=localStorage.getItem('baziu-theme');var sd=window.matchMedia&&window.matchMedia('(prefers-color-scheme: dark)').matches;var d=t==='dark'||((t===null||t==='system')&&sd);document.documentElement.classList.toggle('dark',d);}catch(e){}})();`;
+installCsrfFetch();
 var Route$3 = createRootRoute({
 	beforeLoad: async ({ location }) => {
 		const path = location.pathname;
@@ -182,30 +233,14 @@ var Route$3 = createRootRoute({
 			},
 			{ title: "bazilion" }
 		],
-		links: [
-			{
-				rel: "icon",
-				type: "image/svg+xml",
-				href: "/baziu.svg"
-			},
-			{
-				rel: "preconnect",
-				href: "https://fonts.googleapis.com"
-			},
-			{
-				rel: "preconnect",
-				href: "https://fonts.gstatic.com",
-				crossOrigin: ""
-			},
-			{
-				rel: "stylesheet",
-				href: "https://fonts.googleapis.com/css2?family=DM+Serif+Display&family=DM+Sans:ital,opsz,wght@0,9..40,300..700;1,9..40,300..700&family=JetBrains+Mono:wght@400;500&display=swap"
-			},
-			{
-				rel: "stylesheet",
-				href: styles_default
-			}
-		]
+		links: [{
+			rel: "icon",
+			type: "image/svg+xml",
+			href: "/baziu.svg"
+		}, {
+			rel: "stylesheet",
+			href: styles_default
+		}]
 	}),
 	component: RootComponent,
 	notFoundComponent: NotFound
@@ -299,8 +334,43 @@ var STRIP_REQUEST_HEADERS = new Set([
 	"trailer",
 	"transfer-encoding",
 	"upgrade",
-	"cookie"
+	"cookie",
+	"forwarded",
+	"x-forwarded-for",
+	"x-forwarded-host",
+	"x-forwarded-proto",
+	"x-real-ip"
 ]);
+var MAX_JSON_BODY = 2 * 1024 * 1024;
+var MAX_UPLOAD_BODY = 25 * 1024 * 1024;
+function isLoopback(hostname) {
+	return [
+		"127.0.0.1",
+		"localhost",
+		"[::1]",
+		"::1"
+	].includes(hostname);
+}
+function hasDuplicateCookie(header, name) {
+	if (!header) return false;
+	return header.split(";").map((part) => part.trim()).map((part) => part.slice(0, part.indexOf("="))).filter((cookieName) => cookieName === name).length > 1;
+}
+function boundedBody(body, limit) {
+	let seen = 0;
+	return body.pipeThrough(new TransformStream({ transform(chunk, controller) {
+		seen += chunk.byteLength;
+		if (seen > limit) throw new Error("request body exceeds gateway limit");
+		controller.enqueue(chunk);
+	} }));
+}
+function addSecurityHeaders(headers, production) {
+	headers.set("x-content-type-options", "nosniff");
+	headers.set("referrer-policy", "no-referrer");
+	headers.set("permissions-policy", "camera=(), microphone=(), geolocation=()");
+	headers.set("x-frame-options", "DENY");
+	headers.set("content-security-policy", "default-src 'self'; base-uri 'self'; connect-src 'self'; font-src 'self'; frame-ancestors 'none'; img-src 'self' data:; object-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'");
+	if (production) headers.set("strict-transport-security", "max-age=31536000; includeSubDomains");
+}
 var STRIP_RESPONSE_HEADERS = new Set([
 	"connection",
 	"keep-alive",
@@ -313,12 +383,36 @@ var STRIP_RESPONSE_HEADERS = new Set([
 ]);
 async function proxy(request) {
 	const incoming = new URL(request.url);
+	const originConfig = webOriginConfig();
+	const expectedOrigin = originConfig.origin ?? incoming.origin;
+	const expected = new URL(expectedOrigin);
+	if (originConfig.production) {
+		if (request.headers.get("host") !== expected.host) return new Response("not found", { status: 404 });
+		const forwardedHost = request.headers.get("x-forwarded-host");
+		const forwardedProto = request.headers.get("x-forwarded-proto");
+		if (forwardedHost && forwardedHost !== expected.host || forwardedProto && forwardedProto !== "https") return new Response("invalid forwarding headers", { status: 400 });
+	} else if (!isLoopback(incoming.hostname)) return new Response("loopback development only", { status: 403 });
+	if (request.headers.has("forwarded")) return new Response("invalid forwarding headers", { status: 400 });
+	const unsafe = ![
+		"GET",
+		"HEAD",
+		"OPTIONS"
+	].includes(request.method);
+	const incomingCookies = request.headers.get("cookie");
+	if (hasDuplicateCookie(incomingCookies, originConfig.sessionCookie) || hasDuplicateCookie(incomingCookies, originConfig.csrfCookie)) return new Response("ambiguous cookies", { status: 400 });
+	const session = getCookie(originConfig.sessionCookie);
+	const csrf = getCookie(originConfig.csrfCookie);
+	if (unsafe && (session || incoming.pathname === "/api/login")) {
+		if (request.headers.get("origin") !== expectedOrigin) return new Response("origin validation failed", { status: 403 });
+		if (session && (!csrf || request.headers.get("x-bazilion-csrf") !== csrf)) return new Response("csrf validation failed", { status: 403 });
+	}
 	const target = `${DAEMON_BASE_URL}${incoming.pathname}${incoming.search}`;
 	const headers = new Headers();
 	for (const [k, v] of request.headers) if (!STRIP_REQUEST_HEADERS.has(k.toLowerCase())) headers.set(k, v);
-	if (!headers.has("authorization")) {
-		const token = getCookie("bz_token");
-		if (token) headers.set("authorization", `Bearer ${token}`);
+	if (session) {
+		const cookieParts = [`${originConfig.sessionCookie}=${session}`];
+		if (csrf) cookieParts.push(`${originConfig.csrfCookie}=${csrf}`);
+		headers.set("cookie", cookieParts.join("; "));
 	}
 	headers.set("origin", DAEMON_BASE_URL);
 	const init = {
@@ -327,12 +421,21 @@ async function proxy(request) {
 		redirect: "manual"
 	};
 	if (request.method !== "GET" && request.method !== "HEAD") {
-		init.body = request.body;
+		const limit = (request.headers.get("content-type") ?? "").startsWith("multipart/form-data") ? MAX_UPLOAD_BODY : MAX_JSON_BODY;
+		const contentLength = Number(request.headers.get("content-length") ?? 0);
+		if (Number.isFinite(contentLength) && contentLength > limit) return new Response("request body too large", { status: 413 });
+		if (request.body) init.body = boundedBody(request.body, limit);
 		init.duplex = "half";
 	}
 	const upstream = await fetch(target, init);
 	const respHeaders = new Headers();
-	for (const [k, v] of upstream.headers) if (!STRIP_RESPONSE_HEADERS.has(k.toLowerCase())) respHeaders.set(k, v);
+	for (const [k, v] of upstream.headers) {
+		const lower = k.toLowerCase();
+		if (lower !== "set-cookie" && !STRIP_RESPONSE_HEADERS.has(lower)) respHeaders.set(k, v);
+	}
+	const getSetCookie = upstream.headers.getSetCookie;
+	for (const value of getSetCookie?.call(upstream.headers) ?? []) respHeaders.append("set-cookie", value);
+	addSecurityHeaders(respHeaders, originConfig.production);
 	return new Response(upstream.body, {
 		status: upstream.status,
 		statusText: upstream.statusText,

package/dist/web/server/assets/{routes-BrA-U_Hm.js → routes-CNRzy79H.js}

@@ -1,6 +1,6 @@
-import { i as getCookie, t as createServerFn } from "../server.js";
-import { t as createServerRpc } from "./createServerRpc-pU-IQV2Y.js";
-import { n as daemonClient, r as ApiClientError } from "./daemon-client-2NRMzlTr.js";
+import { a as getCookie, n as createServerFn } from "../server.js";
+import { t as createServerRpc } from "./createServerRpc-B7Yr1K8i.js";
+import { n as daemonClient, r as ApiClientError } from "./daemon-client-CI5NHwNC.js";
 import { t as SIDEBAR_OPEN_GROUPS_COOKIE } from "./Sidebar-DsRVCszF.js";
 //#region src/routes/index.tsx?tss-serverfn-split
 function parseOpenGroupsCookie(raw) {
@@ -21,7 +21,7 @@ var fetchHomeData_createServerFn_handler = createServerRpc({
 	name: "fetchHomeData",
 	filename: "src/routes/index.tsx"
 }, (opts) => fetchHomeData.__executeServer(opts));
-var fetchHomeData = createServerFn({ method: "POST" }).inputValidator((d) => d).handler(fetchHomeData_createServerFn_handler, async ({ data }) => {
+var fetchHomeData = createServerFn({ method: "POST" }).validator((d) => d).handler(fetchHomeData_createServerFn_handler, async ({ data }) => {
 	const client = daemonClient();
 	const [agents, profiles, profileGroups, teams] = await Promise.all([
 		client.get("/api/agents?includeArchived=false"),

package/dist/web/server/assets/{routes-B6cMLIPk.js → routes-CiPfEldd.js}

@@ -1,4 +1,4 @@
-import { t as Route } from "./routes-C19CMLZt.js";
+import { t as Route } from "./routes-D933ngZS.js";
 import { t as ChatPane } from "./ChatPane-Ba5wTsVk.js";
 import { n as Sidebar } from "./Sidebar-DsRVCszF.js";
 import { jsx, jsxs } from "react/jsx-runtime";

package/dist/web/server/assets/{routes-C19CMLZt.js → routes-D933ngZS.js}

@@ -1,9 +1,9 @@
-import { t as createServerFn } from "../server.js";
-import { t as createSsrRpc } from "./createSsrRpc-DFsIAfFd.js";
+import { n as createServerFn } from "../server.js";
+import { t as createSsrRpc } from "./createSsrRpc-6LHNEsSK.js";
 import { createFileRoute, lazyRouteComponent } from "@tanstack/react-router";
 //#region src/routes/index.tsx
-var $$splitComponentImporter = () => import("./routes-B6cMLIPk.js");
-var fetchHomeData = createServerFn({ method: "POST" }).inputValidator((d) => d).handler(createSsrRpc("26dbbcbe40063e8aedfd343cf1dfd4dfe5589f24591c0ba35e80c611d7c57c7c"));
+var $$splitComponentImporter = () => import("./routes-CiPfEldd.js");
+var fetchHomeData = createServerFn({ method: "POST" }).validator((d) => d).handler(createSsrRpc("26dbbcbe40063e8aedfd343cf1dfd4dfe5589f24591c0ba35e80c611d7c57c7c"));
 var Route = createFileRoute("/")({
 	validateSearch: (s) => ({ agent: typeof s.agent === "string" ? s.agent : void 0 }),
 	loaderDeps: ({ search }) => ({ agentId: search.agent }),

package/dist/web/server/assets/{services-B9yBWDX0.js → services-DJRA1A0-.js}

@@ -1,4 +1,4 @@
-import { t as Route } from "./services-C4szdhPx.js";
+import { t as Route } from "./services-OB4LAr2A.js";
 import { t as ConfigPage } from "./ConfigPage-BKlh5vOU.js";
 import { t as FieldRow } from "./FieldRow-B4eTegH9.js";
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";

package/dist/web/server/assets/{services-wG8I06oS.js → services-DozuJtzX.js}

@@ -1,6 +1,6 @@
-import { t as createServerFn } from "../server.js";
-import { t as createServerRpc } from "./createServerRpc-pU-IQV2Y.js";
-import { n as daemonClient } from "./daemon-client-2NRMzlTr.js";
+import { n as createServerFn } from "../server.js";
+import { t as createServerRpc } from "./createServerRpc-B7Yr1K8i.js";
+import { n as daemonClient } from "./daemon-client-CI5NHwNC.js";
 //#region src/routes/config/services.tsx?tss-serverfn-split
 var fetchServices_createServerFn_handler = createServerRpc({
 	id: "6afd81bef0ee381d6e3641cd8e269968429c874e2f9d56c8f818cc9d180ee477",

package/dist/web/server/assets/{services-C4szdhPx.js → services-OB4LAr2A.js}

@@ -1,8 +1,8 @@
-import { t as createServerFn } from "../server.js";
-import { t as createSsrRpc } from "./createSsrRpc-DFsIAfFd.js";
+import { n as createServerFn } from "../server.js";
+import { t as createSsrRpc } from "./createSsrRpc-6LHNEsSK.js";
 import { createFileRoute, lazyRouteComponent } from "@tanstack/react-router";
 //#region src/routes/config/services.tsx
-var $$splitComponentImporter = () => import("./services-B9yBWDX0.js");
+var $$splitComponentImporter = () => import("./services-DJRA1A0-.js");
 var fetchServices = createServerFn({ method: "GET" }).handler(createSsrRpc("6afd81bef0ee381d6e3641cd8e269968429c874e2f9d56c8f818cc9d180ee477"));
 var Route = createFileRoute("/config/services")({
 	loader: () => fetchServices(),

package/dist/web/server/assets/{skills-BZdqiDig.js → skills-Babb9jsQ.js}

@@ -1,4 +1,4 @@
-import { t as Route } from "./skills-C-UgkuCW.js";
+import { t as Route } from "./skills-D5DQL8bM.js";
 import { a as StatusBadge, i as SectionCard, n as PageHeader, r as PageShell, t as EmptyState } from "./Page-LENulSXY.js";
 import { t as Button } from "./Button-Dsnw22OF.js";
 import { useRef, useState } from "react";

package/dist/web/server/assets/{skills-C-UgkuCW.js → skills-D5DQL8bM.js}

@@ -1,8 +1,8 @@
-import { t as createServerFn } from "../server.js";
-import { t as createSsrRpc } from "./createSsrRpc-DFsIAfFd.js";
+import { n as createServerFn } from "../server.js";
+import { t as createSsrRpc } from "./createSsrRpc-6LHNEsSK.js";
 import { createFileRoute, lazyRouteComponent } from "@tanstack/react-router";
 //#region src/routes/skills/index.tsx
-var $$splitComponentImporter = () => import("./skills-BZdqiDig.js");
+var $$splitComponentImporter = () => import("./skills-Babb9jsQ.js");
 var fetchSkills = createServerFn({ method: "GET" }).handler(createSsrRpc("ae1d30575b229c1e2622fbaf2252800a9a7acc84afdd68cba025ca890b8d52c5"));
 var Route = createFileRoute("/skills/")({
 	loader: () => fetchSkills(),

package/dist/web/server/assets/{skills-a9VSWHWq.js → skills-DfGSJTCB.js}

@@ -1,6 +1,6 @@
-import { t as createServerFn } from "../server.js";
-import { t as createServerRpc } from "./createServerRpc-pU-IQV2Y.js";
-import { n as daemonClient } from "./daemon-client-2NRMzlTr.js";
+import { n as createServerFn } from "../server.js";
+import { t as createServerRpc } from "./createServerRpc-B7Yr1K8i.js";
+import { n as daemonClient } from "./daemon-client-CI5NHwNC.js";
 //#region src/routes/skills/index.tsx?tss-serverfn-split
 var fetchSkills_createServerFn_handler = createServerRpc({
 	id: "ae1d30575b229c1e2622fbaf2252800a9a7acc84afdd68cba025ca890b8d52c5",

package/dist/web/server/assets/start-uKQNK6if.js

@@ -0,0 +1,70 @@
+import { t as createMiddleware } from "../server.js";
+import { t as webOriginConfig } from "./public-origin-xV0lm0Ty.js";
+//#region ../../node_modules/.pnpm/@tanstack+start-client-core@1.170.14/node_modules/@tanstack/start-client-core/dist/esm/createStart.js
+function dedupeSerializationAdapters(deduped, serializationAdapters) {
+	for (let i = 0, len = serializationAdapters.length; i < len; i++) {
+		const current = serializationAdapters[i];
+		if (!deduped.has(current)) {
+			deduped.add(current);
+			if (current.extends) dedupeSerializationAdapters(deduped, current.extends);
+		}
+	}
+}
+var createStart = (getOptions) => {
+	return {
+		getOptions: async () => {
+			const options = await getOptions();
+			if (options.serializationAdapters) {
+				const deduped = /* @__PURE__ */ new Set();
+				dedupeSerializationAdapters(deduped, options.serializationAdapters);
+				options.serializationAdapters = Array.from(deduped);
+			}
+			return options;
+		},
+		createMiddleware
+	};
+};
+//#endregion
+//#region src/start.ts
+function isLoopback(hostname) {
+	return [
+		"127.0.0.1",
+		"localhost",
+		"[::1]",
+		"::1"
+	].includes(hostname);
+}
+function secureHeaders(headers, production) {
+	headers.set("x-content-type-options", "nosniff");
+	headers.set("referrer-policy", "no-referrer");
+	headers.set("permissions-policy", "camera=(), microphone=(), geolocation=()");
+	headers.set("x-frame-options", "DENY");
+	headers.set("content-security-policy", "default-src 'self'; base-uri 'self'; connect-src 'self'; font-src 'self'; frame-ancestors 'none'; img-src 'self' data:; object-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'");
+	if (production) headers.set("strict-transport-security", "max-age=31536000; includeSubDomains");
+}
+var securityBoundary = createMiddleware().server(async ({ request, next }) => {
+	const config = webOriginConfig();
+	const incoming = new URL(request.url);
+	if (config.production) {
+		const expected = new URL(config.origin);
+		if (request.headers.get("host") !== expected.host) return new Response("not found", { status: 404 });
+		const forwardedHost = request.headers.get("x-forwarded-host");
+		const forwardedProto = request.headers.get("x-forwarded-proto");
+		if (forwardedHost && forwardedHost !== expected.host || forwardedProto && forwardedProto !== "https") return new Response("invalid forwarding headers", { status: 400 });
+	} else if (!isLoopback(incoming.hostname)) return new Response("loopback development only", { status: 403 });
+	if (request.headers.has("forwarded")) return new Response("invalid forwarding headers", { status: 400 });
+	const result = await next();
+	const headers = new Headers(result.response.headers);
+	secureHeaders(headers, config.production);
+	return {
+		...result,
+		response: new Response(result.response.body, {
+			status: result.response.status,
+			statusText: result.response.statusText,
+			headers
+		})
+	};
+});
+var startInstance = createStart(() => ({ requestMiddleware: [securityBoundary] }));
+//#endregion
+export { startInstance };

package/dist/web/server/assets/{teams-CpQ0YgWf.js → teams-Bk6ZT0MD.js}

@@ -1,4 +1,4 @@
-import { t as Route } from "./teams-OIkHuxy1.js";
+import { t as Route } from "./teams-Dz6ZEMRo.js";
 import { n as PageHeader, r as PageShell } from "./Page-LENulSXY.js";
 import { t as Button } from "./Button-Dsnw22OF.js";
 import { t as TemplatesTabs } from "./TemplatesTabs-CcRxZhJe.js";

package/dist/web/server/assets/{teams-jBtvnk59.js → teams-Cc2Czynq.js}

@@ -1,4 +1,4 @@
-import { t as Route } from "./teams-DEpQR2QA.js";
+import { t as Route } from "./teams-DqC4wZxu.js";
 import { a as StatusBadge, i as SectionCard, n as PageHeader, r as PageShell, t as EmptyState } from "./Page-LENulSXY.js";
 import { t as Button } from "./Button-Dsnw22OF.js";
 import { useState } from "react";

package/dist/web/server/assets/{teams-DqfrEoH6.js → teams-DPnAX4wD.js}

@@ -1,6 +1,6 @@
-import { t as createServerFn } from "../server.js";
-import { t as createServerRpc } from "./createServerRpc-pU-IQV2Y.js";
-import { n as daemonClient } from "./daemon-client-2NRMzlTr.js";
+import { n as createServerFn } from "../server.js";
+import { t as createServerRpc } from "./createServerRpc-B7Yr1K8i.js";
+import { n as daemonClient } from "./daemon-client-CI5NHwNC.js";
 //#region src/routes/teams/index.tsx?tss-serverfn-split
 var fetchTeamsData_createServerFn_handler = createServerRpc({
 	id: "1ab05a58944792f34ad279deeaa56f70e9360687856b18327f335b022e8d21a5",
@@ -12,7 +12,7 @@ var fetchTeamsData = createServerFn({ method: "GET" }).handler(fetchTeamsData_cr
 	const [teams, agents, health] = await Promise.all([
 		c.get("/api/teams"),
 		c.get("/api/agents?includeArchived=true"),
-		c.get("/api/health")
+		c.get("/api/health/details")
 	]);
 	const memberCounts = {};
 	for (const a of agents) memberCounts[a.teamId] = (memberCounts[a.teamId] ?? 0) + 1;

package/dist/web/server/assets/{teams-DEpQR2QA.js → teams-DqC4wZxu.js}

@@ -1,9 +1,9 @@
-import { t as createServerFn } from "../server.js";
-import { t as createSsrRpc } from "./createSsrRpc-DFsIAfFd.js";
+import { n as createServerFn } from "../server.js";
+import { t as createSsrRpc } from "./createSsrRpc-6LHNEsSK.js";
 import { createFileRoute, lazyRouteComponent } from "@tanstack/react-router";
 //#region src/routes/teams/index.tsx
 var $$splitErrorComponentImporter = () => import("./teams-3im0oQnS.js");
-var $$splitComponentImporter = () => import("./teams-jBtvnk59.js");
+var $$splitComponentImporter = () => import("./teams-Cc2Czynq.js");
 var fetchTeamsData = createServerFn({ method: "GET" }).handler(createSsrRpc("1ab05a58944792f34ad279deeaa56f70e9360687856b18327f335b022e8d21a5"));
 var Route = createFileRoute("/teams/")({
 	loader: () => fetchTeamsData(),

package/dist/web/server/assets/{teams-OIkHuxy1.js → teams-Dz6ZEMRo.js}

@@ -1,8 +1,8 @@
-import { t as createServerFn } from "../server.js";
-import { t as createSsrRpc } from "./createSsrRpc-DFsIAfFd.js";
+import { n as createServerFn } from "../server.js";
+import { t as createSsrRpc } from "./createSsrRpc-6LHNEsSK.js";
 import { createFileRoute, lazyRouteComponent } from "@tanstack/react-router";
 //#region src/routes/templates/teams/index.tsx
-var $$splitComponentImporter = () => import("./teams-CpQ0YgWf.js");
+var $$splitComponentImporter = () => import("./teams-Bk6ZT0MD.js");
 var fetchTeams = createServerFn({ method: "GET" }).handler(createSsrRpc("1bb12262aaa902fa208aafaa70b69c63da34c1fe523ab0322fe766903fc6b4c1"));
 var Route = createFileRoute("/templates/teams/")({
 	loader: () => fetchTeams(),

package/dist/web/server/assets/{teams-MjqgsmC3.js → teams-be05ci17.js}

@@ -1,6 +1,6 @@
-import { t as createServerFn } from "../server.js";
-import { t as createServerRpc } from "./createServerRpc-pU-IQV2Y.js";
-import { n as daemonClient } from "./daemon-client-2NRMzlTr.js";
+import { n as createServerFn } from "../server.js";
+import { t as createServerRpc } from "./createServerRpc-B7Yr1K8i.js";
+import { n as daemonClient } from "./daemon-client-CI5NHwNC.js";
 //#region src/routes/templates/teams/index.tsx?tss-serverfn-split
 var fetchTeams_createServerFn_handler = createServerRpc({
 	id: "1bb12262aaa902fa208aafaa70b69c63da34c1fe523ab0322fe766903fc6b4c1",

package/dist/web/server/assets/{telegram-DNgCWebD.js → telegram-1AWL6lFw.js}

@@ -1,6 +1,6 @@
-import { t as createServerFn } from "../server.js";
-import { t as createServerRpc } from "./createServerRpc-pU-IQV2Y.js";
-import { n as daemonClient } from "./daemon-client-2NRMzlTr.js";
+import { n as createServerFn } from "../server.js";
+import { t as createServerRpc } from "./createServerRpc-B7Yr1K8i.js";
+import { n as daemonClient } from "./daemon-client-CI5NHwNC.js";
 //#region src/routes/config/integrations/telegram.tsx?tss-serverfn-split
 var fetchTelegramConfig_createServerFn_handler = createServerRpc({
 	id: "00a157dd07824e1f126f06646effd1d876f280f6fc64c144d2f6429414a4e58a",