@floless/app 0.56.0 → 0.57.0

package/dist/floless-server.cjs

@@ -5489,7 +5489,7 @@ var require_thread_stream = __commonJS({
     var { version } = require_package();
     var { EventEmitter: EventEmitter2 } = require("events");
     var { Worker: Worker2 } = require("worker_threads");
-    var { join: join29 } = require("path");
+    var { join: join30 } = require("path");
     var { pathToFileURL } = require("url");
     var { wait } = require_wait();
     var {
@@ -5540,7 +5540,7 @@ var require_thread_stream = __commonJS({
     function createWorker(stream, opts) {
       const { filename, workerData } = opts;
       const bundlerOverrides = "__bundlerPathsOverrides" in globalThis ? globalThis.__bundlerPathsOverrides : {};
-      const toExecute = bundlerOverrides["thread-stream-worker"] || join29(__dirname, "lib", "worker.js");
+      const toExecute = bundlerOverrides["thread-stream-worker"] || join30(__dirname, "lib", "worker.js");
       const worker = new Worker2(toExecute, {
         ...opts.workerOpts,
         name: opts.workerOpts?.name || "thread-stream",
@@ -6006,9 +6006,9 @@ var require_transport = __commonJS({
   "node_modules/pino/lib/transport.js"(exports2, module2) {
     "use strict";
     var { createRequire: createRequire5 } = require("module");
-    var { existsSync: existsSync24 } = require("node:fs");
+    var { existsSync: existsSync25 } = require("node:fs");
     var getCallers = require_caller();
-    var { join: join29, isAbsolute: isAbsolute2, sep: sep4 } = require("node:path");
+    var { join: join30, isAbsolute: isAbsolute2, sep: sep4 } = require("node:path");
     var { fileURLToPath: fileURLToPath6 } = require("node:url");
     var sleep = require_atomic_sleep();
     var onExit = require_on_exit_leak_free();
@@ -6080,7 +6080,7 @@ var require_transport = __commonJS({
           return false;
         }
       }
-      return isAbsolute2(path) && !existsSync24(path);
+      return isAbsolute2(path) && !existsSync25(path);
     }
     function stripQuotes(value) {
       const first = value[0];
@@ -6161,7 +6161,7 @@ var require_transport = __commonJS({
         throw new Error("only one of target or targets can be specified");
       }
       if (targets) {
-        target = bundlerOverrides["pino-worker"] || join29(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join30(__dirname, "worker.js");
         options.targets = targets.filter((dest) => dest.target).map((dest) => {
           return {
             ...dest,
@@ -6179,7 +6179,7 @@ var require_transport = __commonJS({
           });
         });
       } else if (pipeline2) {
-        target = bundlerOverrides["pino-worker"] || join29(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join30(__dirname, "worker.js");
         options.pipelines = [pipeline2.map((dest) => {
           return {
             ...dest,
@@ -6202,7 +6202,7 @@ var require_transport = __commonJS({
           return origin;
         }
         if (origin === "pino/file") {
-          return join29(__dirname, "..", "file.js");
+          return join30(__dirname, "..", "file.js");
         }
         let fixTarget2;
         for (const filePath of callers) {
@@ -7182,7 +7182,7 @@ var require_safe_stable_stringify = __commonJS({
               return circularValue;
             }
             let res = "";
-            let join29 = ",";
+            let join30 = ",";
             const originalIndentation = indentation;
             if (Array.isArray(value)) {
               if (value.length === 0) {
@@ -7196,7 +7196,7 @@ var require_safe_stable_stringify = __commonJS({
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join29 = `,
+                join30 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -7204,13 +7204,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join29;
+                res += join30;
               }
               const tmp = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join29}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join30}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -7231,7 +7231,7 @@ ${originalIndentation}`;
             let separator = "";
             if (spacer !== "") {
               indentation += spacer;
-              join29 = `,
+              join30 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -7245,13 +7245,13 @@ ${indentation}`;
               const tmp = stringifyFnReplacer(key2, value, stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join29;
+                separator = join30;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...":${whitespace}"${getItemCount(removedKeys)} not stringified"`;
-              separator = join29;
+              separator = join30;
             }
             if (spacer !== "" && separator.length > 1) {
               res = `
@@ -7292,7 +7292,7 @@ ${originalIndentation}`;
             }
             const originalIndentation = indentation;
             let res = "";
-            let join29 = ",";
+            let join30 = ",";
             if (Array.isArray(value)) {
               if (value.length === 0) {
                 return "[]";
@@ -7305,7 +7305,7 @@ ${originalIndentation}`;
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join29 = `,
+                join30 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -7313,13 +7313,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join29;
+                res += join30;
               }
               const tmp = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join29}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join30}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -7332,7 +7332,7 @@ ${originalIndentation}`;
             let whitespace = "";
             if (spacer !== "") {
               indentation += spacer;
-              join29 = `,
+              join30 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -7341,7 +7341,7 @@ ${indentation}`;
               const tmp = stringifyArrayReplacer(key2, value[key2], stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join29;
+                separator = join30;
               }
             }
             if (spacer !== "" && separator.length > 1) {
@@ -7399,20 +7399,20 @@ ${originalIndentation}`;
               indentation += spacer;
               let res2 = `
 ${indentation}`;
-              const join30 = `,
+              const join31 = `,
 ${indentation}`;
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
               let i = 0;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyIndent(String(i), value[i], stack, spacer, indentation);
                 res2 += tmp2 !== void 0 ? tmp2 : "null";
-                res2 += join30;
+                res2 += join31;
               }
               const tmp = stringifyIndent(String(i), value[i], stack, spacer, indentation);
               res2 += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res2 += `${join30}"... ${getItemCount(removedKeys)} not stringified"`;
+                res2 += `${join31}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               res2 += `
 ${originalIndentation}`;
@@ -7428,16 +7428,16 @@ ${originalIndentation}`;
               return '"[Object]"';
             }
             indentation += spacer;
-            const join29 = `,
+            const join30 = `,
 ${indentation}`;
             let res = "";
             let separator = "";
             let maximumPropertiesToStringify = Math.min(keyLength, maximumBreadth);
             if (isTypedArrayWithEntries(value)) {
-              res += stringifyTypedArray(value, join29, maximumBreadth);
+              res += stringifyTypedArray(value, join30, maximumBreadth);
               keys = keys.slice(value.length);
               maximumPropertiesToStringify -= value.length;
-              separator = join29;
+              separator = join30;
             }
             if (deterministic) {
               keys = sort(keys, comparator);
@@ -7448,13 +7448,13 @@ ${indentation}`;
               const tmp = stringifyIndent(key2, value[key2], stack, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}: ${tmp}`;
-                separator = join29;
+                separator = join30;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...": "${getItemCount(removedKeys)} not stringified"`;
-              separator = join29;
+              separator = join30;
             }
             if (separator !== "") {
               res = `
@@ -25041,8 +25041,8 @@ var require_patch = __commonJS({
   "node_modules/semver/functions/patch.js"(exports2, module2) {
     "use strict";
     var SemVer = require_semver();
-    var patch = (a, loose) => new SemVer(a, loose).patch;
-    module2.exports = patch;
+    var patch2 = (a, loose) => new SemVer(a, loose).patch;
+    module2.exports = patch2;
   }
 });
 
@@ -25270,10 +25270,10 @@ var require_coerce = __commonJS({
       }
       const major = match[2];
       const minor = match[3] || "0";
-      const patch = match[4] || "0";
+      const patch2 = match[4] || "0";
       const prerelease = options.includePrerelease && match[5] ? `-${match[5]}` : "";
       const build = options.includePrerelease && match[6] ? `+${match[6]}` : "";
-      return parse(`${major}.${minor}.${patch}${prerelease}${build}`, options);
+      return parse(`${major}.${minor}.${patch2}${prerelease}${build}`, options);
     };
     module2.exports = coerce;
   }
@@ -26338,7 +26338,7 @@ var require_semver2 = __commonJS({
     var diff = require_diff();
     var major = require_major();
     var minor = require_minor();
-    var patch = require_patch();
+    var patch2 = require_patch();
     var prerelease = require_prerelease();
     var compare = require_compare();
     var rcompare = require_rcompare();
@@ -26377,7 +26377,7 @@ var require_semver2 = __commonJS({
       diff,
       major,
       minor,
-      patch,
+      patch: patch2,
       prerelease,
       compare,
       rcompare,
@@ -28698,13 +28698,13 @@ var require_accept_version = __commonJS({
       if (typeof version !== "string") {
         throw new TypeError("Version should be a string");
       }
-      let [major, minor, patch] = version.split(".", 3);
+      let [major, minor, patch2] = version.split(".", 3);
       if (isNaN(major)) {
         throw new TypeError("Major version must be a numeric value");
       }
       major = Number(major);
       minor = Number(minor) || 0;
-      patch = Number(patch) || 0;
+      patch2 = Number(patch2) || 0;
       if (major >= this.maxMajor) {
         this.maxMajor = major;
         this.store.set("x", store);
@@ -28717,11 +28717,11 @@ var require_accept_version = __commonJS({
         this.store.set(`${major}.x`, store);
         this.store.set(`${major}.x.x`, store);
       }
-      if (patch >= (this.maxPatches[`${major}.${minor}`] || 0)) {
-        this.maxPatches[`${major}.${minor}`] = patch;
+      if (patch2 >= (this.maxPatches[`${major}.${minor}`] || 0)) {
+        this.maxPatches[`${major}.${minor}`] = patch2;
         this.store.set(`${major}.${minor}.x`, store);
       }
-      this.store.set(`${major}.${minor}.${patch}`, store);
+      this.store.set(`${major}.${minor}.${patch2}`, store);
       return this;
     };
     SemVerStore.prototype.get = function(version) {
@@ -41991,7 +41991,7 @@ var require_send = __commonJS({
     var { parseTokenList } = require_parseTokenList();
     var { createHttpError } = require_createHttpError();
     var extname2 = path.extname;
-    var join29 = path.join;
+    var join30 = path.join;
     var normalize2 = path.normalize;
     var resolve6 = path.resolve;
     var sep4 = path.sep;
@@ -42078,7 +42078,7 @@ var require_send = __commonJS({
           return { statusCode: 403 };
         }
         parts = path2.split(sep4);
-        path2 = normalize2(join29(root, path2));
+        path2 = normalize2(join30(root, path2));
       } else {
         if (UP_PATH_REGEXP.test(path2)) {
           debug('malicious path "%s"', path2);
@@ -42361,7 +42361,7 @@ var require_send = __commonJS({
       let err2;
       for (let i = 0; i < options.index.length; i++) {
         const index = options.index[i];
-        const p = join29(path2, index);
+        const p = join30(path2, index);
         const { error, stat: stat4 } = await tryStat(p);
         if (error) {
           err2 = error;
@@ -43145,8 +43145,8 @@ var require_static = __commonJS({
               }
             }
           }
-          for (const [dirname12, rootPath] of indexDirs.entries()) {
-            const pathname = dirname12 + (dirname12.endsWith("/") ? "" : "/");
+          for (const [dirname13, rootPath] of indexDirs.entries()) {
+            const pathname = dirname13 + (dirname13.endsWith("/") ? "" : "/");
             const file = "/" + pathname.replace(prefix, "");
             setUpHeadAndGet(routeOpts, pathname, file, rootPath);
             if (opts.redirect === true) {
@@ -50649,7 +50649,7 @@ var require_public_api = __commonJS({
         return docs;
       return Object.assign([], { empty: true }, composer$1.streamInfo());
     }
-    function parseDocument4(source, options = {}) {
+    function parseDocument5(source, options = {}) {
       const { lineCounter: lineCounter2, prettyErrors } = parseOptions(options);
       const parser$1 = new parser.Parser(lineCounter2?.addNewLine);
       const composer$1 = new composer.Composer(options);
@@ -50675,7 +50675,7 @@ var require_public_api = __commonJS({
       } else if (options === void 0 && reviver && typeof reviver === "object") {
         options = reviver;
       }
-      const doc = parseDocument4(src, options);
+      const doc = parseDocument5(src, options);
       if (!doc)
         return null;
       doc.warnings.forEach((warning) => log2.warn(doc.options.logLevel, warning));
@@ -50711,7 +50711,7 @@ var require_public_api = __commonJS({
     }
     exports2.parse = parse;
     exports2.parseAllDocuments = parseAllDocuments;
-    exports2.parseDocument = parseDocument4;
+    exports2.parseDocument = parseDocument5;
     exports2.stringify = stringify;
   }
 });
@@ -50827,9 +50827,9 @@ var import_node_readline2 = require("node:readline");
 
 // index.ts
 var import_node_url5 = require("node:url");
-var import_node_path27 = require("node:path");
-var import_node_os19 = require("node:os");
-var import_node_fs29 = require("node:fs");
+var import_node_path28 = require("node:path");
+var import_node_os20 = require("node:os");
+var import_node_fs30 = require("node:fs");
 var import_node_child_process7 = require("node:child_process");
 
 // log.mjs
@@ -50875,19 +50875,180 @@ var import_static = __toESM(require_static(), 1);
 
 // aware-adapter.ts
 var import_node_child_process = require("node:child_process");
-var import_node_fs4 = require("node:fs");
-var import_node_path3 = require("node:path");
-var import_node_os3 = require("node:os");
-var import_node_crypto2 = require("node:crypto");
+var import_node_fs6 = require("node:fs");
+var import_node_path5 = require("node:path");
+var import_node_os5 = require("node:os");
+var import_node_crypto3 = require("node:crypto");
 var import_node_module = require("node:module");
 
 // app-reader.ts
+var import_node_crypto2 = require("node:crypto");
+var import_node_fs5 = require("node:fs");
+var import_node_os4 = require("node:os");
+var import_node_path4 = require("node:path");
+var import_yaml = __toESM(require_dist6(), 1);
+
+// app-origin-store.ts
+var import_node_fs4 = require("node:fs");
+var import_node_os3 = require("node:os");
+var import_node_path3 = require("node:path");
+
+// visual-input-store.ts
 var import_node_crypto = require("node:crypto");
 var import_node_fs3 = require("node:fs");
 var import_node_os2 = require("node:os");
 var import_node_path2 = require("node:path");
-var import_yaml = __toESM(require_dist6(), 1);
-var APPS_DIR = process.env.AWARE_HOME ? (0, import_node_path2.join)(process.env.AWARE_HOME, "apps") : (0, import_node_path2.join)((0, import_node_os2.homedir)(), ".aware", "apps");
+var MAX_BYTES2 = 25 * 1024 * 1024;
+var VisualInputError = class extends Error {
+};
+function inputsDir() {
+  const root = process.env.FLOLESS_HOME ?? (0, import_node_path2.join)((0, import_node_os2.homedir)(), ".floless");
+  return (0, import_node_path2.join)(root, "inputs");
+}
+function sniffExt(buf) {
+  if (buf.length >= 8 && buf[0] === 137 && buf[1] === 80 && buf[2] === 78 && buf[3] === 71) return "png";
+  if (buf.length >= 3 && buf[0] === 255 && buf[1] === 216 && buf[2] === 255) return "jpg";
+  if (buf.length >= 12 && buf.toString("ascii", 0, 4) === "RIFF" && buf.toString("ascii", 8, 12) === "WEBP") return "webp";
+  if (buf.length >= 5 && buf.toString("ascii", 0, 5) === "%PDF-") return "pdf";
+  return null;
+}
+var RESERVED = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\..*)?$/i;
+function safeSegment(s) {
+  if (!s || s === "." || s.includes("..")) return false;
+  if (s.includes("/") || s.includes("\\") || s.includes(import_node_path2.sep)) return false;
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c < 32 || c === 58) return false;
+  }
+  if (/[. ]$/.test(s)) return false;
+  return !RESERVED.test(s);
+}
+function storeVisualInput(appId, dataUrl) {
+  if (!safeSegment(appId)) throw new VisualInputError("invalid app id");
+  const m = /^data:([\w/+.-]+);base64,(.*)$/s.exec(dataUrl || "");
+  if (!m) throw new VisualInputError("visual input must be a base64 data URL");
+  const buf = Buffer.from(m[2] ?? "", "base64");
+  if (buf.length === 0) throw new VisualInputError("empty visual input");
+  if (buf.length > MAX_BYTES2) throw new VisualInputError("visual input too large (max 25 MB)");
+  const ext = sniffExt(buf);
+  if (!ext) throw new VisualInputError("visual input must be PNG, JPEG, WebP, or PDF");
+  const sha2562 = (0, import_node_crypto.createHash)("sha256").update(buf).digest("hex");
+  const dir = (0, import_node_path2.join)(inputsDir(), appId);
+  const path = (0, import_node_path2.join)(dir, `${sha2562}.${ext}`);
+  const root = (0, import_node_path2.resolve)(inputsDir());
+  const target = (0, import_node_path2.resolve)(path);
+  if (target !== root && !target.startsWith(root + import_node_path2.sep)) {
+    throw new VisualInputError("refusing to write outside the inputs root");
+  }
+  (0, import_node_fs3.mkdirSync)(dir, { recursive: true });
+  if (!(0, import_node_fs3.existsSync)(path)) {
+    const tmp = `${path}.tmp`;
+    (0, import_node_fs3.writeFileSync)(tmp, buf);
+    (0, import_node_fs3.renameSync)(tmp, path);
+  }
+  return { path, ext, bytes: (0, import_node_fs3.statSync)(path).size, sha256: sha2562 };
+}
+function renameVisualInputs(oldId, newId) {
+  if (!safeSegment(oldId) || !safeSegment(newId)) throw new VisualInputError("invalid app id");
+  const from = (0, import_node_path2.join)(inputsDir(), oldId);
+  if (!(0, import_node_fs3.existsSync)(from)) return;
+  const to = (0, import_node_path2.join)(inputsDir(), newId);
+  if ((0, import_node_fs3.existsSync)(to)) (0, import_node_fs3.rmSync)(to, { recursive: true, force: true });
+  (0, import_node_fs3.mkdirSync)(inputsDir(), { recursive: true });
+  (0, import_node_fs3.renameSync)(from, to);
+}
+function copyVisualInputs(srcId, newId) {
+  if (!safeSegment(srcId) || !safeSegment(newId)) throw new VisualInputError("invalid app id");
+  const from = (0, import_node_path2.join)(inputsDir(), srcId);
+  if (!(0, import_node_fs3.existsSync)(from)) return;
+  (0, import_node_fs3.cpSync)(from, (0, import_node_path2.join)(inputsDir(), newId), { recursive: true });
+}
+function deleteVisualInputs(id) {
+  if (!safeSegment(id)) throw new VisualInputError("invalid app id");
+  const dir = (0, import_node_path2.join)(inputsDir(), id);
+  if ((0, import_node_fs3.existsSync)(dir)) (0, import_node_fs3.rmSync)(dir, { recursive: true, force: true });
+}
+
+// app-origin-store.ts
+function storeFile() {
+  const root = process.env.FLOLESS_HOME ?? (0, import_node_path3.join)((0, import_node_os3.homedir)(), ".floless");
+  return (0, import_node_path3.join)(root, "app-origin.json");
+}
+function loadAll() {
+  try {
+    const parsed = JSON.parse((0, import_node_fs4.readFileSync)(storeFile(), "utf8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function saveAll(map) {
+  const file = storeFile();
+  const dir = (0, import_node_path3.dirname)(file);
+  if (!(0, import_node_fs4.existsSync)(dir)) (0, import_node_fs4.mkdirSync)(dir, { recursive: true });
+  const tmp = `${file}.${process.pid}.tmp`;
+  (0, import_node_fs4.writeFileSync)(tmp, JSON.stringify(map, null, 2));
+  (0, import_node_fs4.renameSync)(tmp, file);
+}
+function readOrigin(id) {
+  if (!safeSegment(id)) return null;
+  return loadAll()[id] ?? null;
+}
+function patch(id, fields) {
+  if (!safeSegment(id)) return;
+  const all = loadAll();
+  all[id] = { ...all[id] ?? {}, ...fields };
+  saveAll(all);
+}
+function setDerivedFrom(id, derivedFrom) {
+  patch(id, { derivedFrom });
+}
+function resolveTemplateId(id) {
+  return readOrigin(id)?.derivedFrom ?? id;
+}
+function markForked(id, who, ts) {
+  patch(id, { forkedAt: ts, forkedFromVersion: who.version, liabilityAcceptedAt: ts, liabilityAcceptedBy: who.acceptedBy });
+}
+function clearFork(id) {
+  if (!safeSegment(id)) return;
+  const all = loadAll();
+  const prev = all[id];
+  if (!prev) return;
+  const next = {};
+  if (prev.derivedFrom) next.derivedFrom = prev.derivedFrom;
+  all[id] = next;
+  saveAll(all);
+}
+function renameOrigin(oldId, newId) {
+  if (!safeSegment(oldId) || !safeSegment(newId)) return;
+  const all = loadAll();
+  const prev = all[oldId] ?? { derivedFrom: oldId };
+  delete all[oldId];
+  all[newId] = prev;
+  saveAll(all);
+}
+function copyOrigin(srcId, newId) {
+  setDerivedFrom(newId, resolveTemplateId(srcId));
+}
+function deleteOrigin(id) {
+  if (!safeSegment(id)) return;
+  const all = loadAll();
+  if (id in all) {
+    delete all[id];
+    saveAll(all);
+  }
+}
+function appOrigin(id) {
+  try {
+    const rec = readOrigin(id);
+    return { templateId: rec?.derivedFrom ?? id, forked: !!rec?.forkedAt, derivedFrom: rec?.derivedFrom ?? null };
+  } catch {
+    return { templateId: id, forked: false, derivedFrom: null };
+  }
+}
+
+// app-reader.ts
+var APPS_DIR = process.env.AWARE_HOME ? (0, import_node_path4.join)(process.env.AWARE_HOME, "apps") : (0, import_node_path4.join)((0, import_node_os4.homedir)(), ".aware", "apps");
 function normalizeNote(n) {
   if (n && typeof n === "object") {
     const o = n;
@@ -50916,24 +51077,24 @@ var AppNotFoundError = class extends Error {
 };
 function appDir(id) {
   if (id.includes("/") || id.includes("\\") || id.includes("..")) throw new AppNotFoundError(id);
-  const dir = (0, import_node_path2.join)(APPS_DIR, id);
-  if (!(0, import_node_fs3.existsSync)(dir)) throw new AppNotFoundError(id);
+  const dir = (0, import_node_path4.join)(APPS_DIR, id);
+  if (!(0, import_node_fs5.existsSync)(dir)) throw new AppNotFoundError(id);
   return dir;
 }
 function appPath(id) {
   if (id.includes("/") || id.includes("\\") || id.includes("..")) throw new AppNotFoundError(id);
-  return (0, import_node_path2.join)(APPS_DIR, id);
+  return (0, import_node_path4.join)(APPS_DIR, id);
 }
 function appExists(id) {
   if (id.includes("/") || id.includes("\\") || id.includes("..")) return false;
-  return (0, import_node_fs3.existsSync)((0, import_node_path2.join)(APPS_DIR, id));
+  return (0, import_node_fs5.existsSync)((0, import_node_path4.join)(APPS_DIR, id));
 }
 function firstWithExt(dir, ext) {
-  const hit = (0, import_node_fs3.readdirSync)(dir).find((f) => f.toLowerCase().endsWith(ext));
-  return hit ? (0, import_node_path2.join)(dir, hit) : null;
+  const hit = (0, import_node_fs5.readdirSync)(dir).find((f) => f.toLowerCase().endsWith(ext));
+  return hit ? (0, import_node_path4.join)(dir, hit) : null;
 }
 function sha256(text) {
-  return (0, import_node_crypto.createHash)("sha256").update(text).digest("hex");
+  return (0, import_node_crypto2.createHash)("sha256").update(text).digest("hex");
 }
 function asRecord(v) {
   return v && typeof v === "object" && !Array.isArray(v) ? v : {};
@@ -50943,7 +51104,7 @@ function appProvider(id) {
     const dir = appDir(id);
     const sourcePath = firstWithExt(dir, ".app") ?? firstWithExt(dir, ".flo");
     if (!sourcePath) return "other";
-    const src = asRecord((0, import_yaml.parse)((0, import_node_fs3.readFileSync)(sourcePath, "utf8")));
+    const src = asRecord((0, import_yaml.parse)((0, import_node_fs5.readFileSync)(sourcePath, "utf8")));
     const srcNodes = Array.isArray(src.nodes) ? src.nodes : [];
     const counts = /* @__PURE__ */ new Map();
     for (const n of srcNodes) {
@@ -50967,7 +51128,7 @@ function appBaked(id) {
     const dir = appDir(id);
     const sourcePath = firstWithExt(dir, ".app") ?? firstWithExt(dir, ".flo");
     if (!sourcePath) return false;
-    const src = asRecord((0, import_yaml.parse)((0, import_node_fs3.readFileSync)(sourcePath, "utf8")));
+    const src = asRecord((0, import_yaml.parse)((0, import_node_fs5.readFileSync)(sourcePath, "utf8")));
     return src["exposes-as-agent"] === true;
   } catch {
     return false;
@@ -50977,11 +51138,12 @@ function readApp(id) {
   const dir = appDir(id);
   const sourcePath = firstWithExt(dir, ".app") ?? firstWithExt(dir, ".flo");
   if (!sourcePath) throw new AppNotFoundError(id);
-  const sourceText = (0, import_node_fs3.readFileSync)(sourcePath, "utf8");
+  const sourceText = (0, import_node_fs5.readFileSync)(sourcePath, "utf8");
   const sourceHash = sha256(sourceText);
   const src = asRecord((0, import_yaml.parse)(sourceText));
+  const origin = appOrigin(id);
   const lockPath = firstWithExt(dir, ".lock");
-  const lockText = lockPath ? (0, import_node_fs3.readFileSync)(lockPath, "utf8") : null;
+  const lockText = lockPath ? (0, import_node_fs5.readFileSync)(lockPath, "utf8") : null;
   const lockDoc = lockText ? asRecord((0, import_yaml.parse)(lockText)) : {};
   const lockNodes = Array.isArray(lockDoc.nodes) ? lockDoc.nodes : [];
   const lockById = new Map(lockNodes.map((n) => [String(n.id), n]));
@@ -51059,6 +51221,10 @@ function readApp(id) {
     displayName: typeof src["display-name"] === "string" ? src["display-name"] : id,
     description: typeof src.description === "string" ? src.description : "",
     version: src.version != null ? String(src.version) : "0.0.0",
+    publisher: typeof src.publisher === "string" ? src.publisher : null,
+    derivedFrom: origin.derivedFrom,
+    templateId: origin.templateId,
+    forked: origin.forked,
     layout,
     requires: Array.isArray(src.requires) ? src.requires.map(String) : [],
     inputs,
@@ -51082,11 +51248,11 @@ function sourceNodeId(nodes, connections) {
 function readCommandSpec(agent, command, agentsDir = AGENTS_DIR) {
   const safe = (n) => !/[/\\\0]/.test(n) && !n.includes("..");
   if (!safe(agent) || !safe(command)) return null;
-  const manifestPath = (0, import_node_path2.join)(agentsDir, agent, "manifest.yaml");
-  if (!(0, import_node_fs3.existsSync)(manifestPath)) return null;
+  const manifestPath = (0, import_node_path4.join)(agentsDir, agent, "manifest.yaml");
+  if (!(0, import_node_fs5.existsSync)(manifestPath)) return null;
   let doc;
   try {
-    doc = asRecord((0, import_yaml.parse)((0, import_node_fs3.readFileSync)(manifestPath, "utf8")));
+    doc = asRecord((0, import_yaml.parse)((0, import_node_fs5.readFileSync)(manifestPath, "utf8")));
   } catch {
     return null;
   }
@@ -51127,11 +51293,11 @@ function parseManifestInputs(raw) {
 function readNodeSkill(agent, command, agentsDir = AGENTS_DIR) {
   const safe = (n) => !/[/\\\0]/.test(n) && !n.includes("..");
   if (!safe(agent) || !safe(command)) return null;
-  const manifestPath = (0, import_node_path2.join)(agentsDir, agent, "manifest.yaml");
-  if (!(0, import_node_fs3.existsSync)(manifestPath)) return null;
+  const manifestPath = (0, import_node_path4.join)(agentsDir, agent, "manifest.yaml");
+  if (!(0, import_node_fs5.existsSync)(manifestPath)) return null;
   let doc;
   try {
-    doc = asRecord((0, import_yaml.parse)((0, import_node_fs3.readFileSync)(manifestPath, "utf8")));
+    doc = asRecord((0, import_yaml.parse)((0, import_node_fs5.readFileSync)(manifestPath, "utf8")));
   } catch {
     return null;
   }
@@ -51165,13 +51331,13 @@ function detectTriggerSource(nodes, connections, lookup) {
   if (!spec || spec.lifecycle !== "start" || !spec.streaming) return null;
   return { nodeId: src.id, agent: src.agent, command: src.command, inputs: spec.inputs };
 }
-var AGENTS_DIR = process.env.AWARE_HOME ? (0, import_node_path2.join)(process.env.AWARE_HOME, "agents") : (0, import_node_path2.join)((0, import_node_os2.homedir)(), ".aware", "agents");
-var CREDENTIALS_DIR = process.env.AWARE_HOME ? (0, import_node_path2.join)(process.env.AWARE_HOME, "credentials") : (0, import_node_path2.join)((0, import_node_os2.homedir)(), ".aware", "credentials");
+var AGENTS_DIR = process.env.AWARE_HOME ? (0, import_node_path4.join)(process.env.AWARE_HOME, "agents") : (0, import_node_path4.join)((0, import_node_os4.homedir)(), ".aware", "agents");
+var CREDENTIALS_DIR = process.env.AWARE_HOME ? (0, import_node_path4.join)(process.env.AWARE_HOME, "credentials") : (0, import_node_path4.join)((0, import_node_os4.homedir)(), ".aware", "credentials");
 function credentialStatus(secret) {
-  const file = (0, import_node_path2.join)(CREDENTIALS_DIR, `${secret}.json`);
-  if (!(0, import_node_fs3.existsSync)(file)) return { status: "disconnected", expiresAt: null };
+  const file = (0, import_node_path4.join)(CREDENTIALS_DIR, `${secret}.json`);
+  if (!(0, import_node_fs5.existsSync)(file)) return { status: "disconnected", expiresAt: null };
   try {
-    const doc = JSON.parse((0, import_node_fs3.readFileSync)(file, "utf8"));
+    const doc = JSON.parse((0, import_node_fs5.readFileSync)(file, "utf8"));
     const raw = doc["expires_at"] ?? doc["expiresAt"] ?? doc["expiry"];
     if (raw != null) {
       const ms = typeof raw === "number" ? raw * (raw < 1e12 ? 1e3 : 1) : Date.parse(String(raw));
@@ -51184,15 +51350,15 @@ function credentialStatus(secret) {
   return { status: "connected", expiresAt: null };
 }
 function listIntegrations() {
-  if (!(0, import_node_fs3.existsSync)(AGENTS_DIR)) return [];
+  if (!(0, import_node_fs5.existsSync)(AGENTS_DIR)) return [];
   const out = [];
   const seen = /* @__PURE__ */ new Set();
   const safe = (n) => !/[/\\\0]/.test(n) && !n.includes("..");
-  for (const agentId of (0, import_node_fs3.readdirSync)(AGENTS_DIR)) {
+  for (const agentId of (0, import_node_fs5.readdirSync)(AGENTS_DIR)) {
     if (!safe(agentId)) continue;
-    const manifestPath = (0, import_node_path2.join)(AGENTS_DIR, agentId, "manifest.yaml");
-    if (!(0, import_node_fs3.existsSync)(manifestPath)) continue;
-    const manifestText = (0, import_node_fs3.readFileSync)(manifestPath, "utf8");
+    const manifestPath = (0, import_node_path4.join)(AGENTS_DIR, agentId, "manifest.yaml");
+    if (!(0, import_node_fs5.existsSync)(manifestPath)) continue;
+    const manifestText = (0, import_node_fs5.readFileSync)(manifestPath, "utf8");
     if (!manifestText.includes("secrets:")) continue;
     let doc;
     try {
@@ -51283,14 +51449,14 @@ var AwareUnsupportedError = class extends AwareError {
 };
 function resolveInvoker() {
   const envDir = process.env.AWARE_CLI_DIR;
-  if (envDir && (0, import_node_fs4.existsSync)((0, import_node_path3.join)(envDir, "scripts/bin/aware.js"))) {
-    return { head: [nodeExe(), (0, import_node_path3.join)(envDir, "scripts/bin/aware.js")], shell: false, pkgDir: envDir };
+  if (envDir && (0, import_node_fs6.existsSync)((0, import_node_path5.join)(envDir, "scripts/bin/aware.js"))) {
+    return { head: [nodeExe(), (0, import_node_path5.join)(envDir, "scripts/bin/aware.js")], shell: false, pkgDir: envDir };
   }
   try {
     const root = (0, import_node_child_process.execFileSync)("npm", ["root", "-g"], { encoding: "utf8", shell: process.platform === "win32", windowsHide: true, timeout: 1e4 }).trim();
-    const pkgDir = (0, import_node_path3.join)(root, "@aware-aeco", "cli");
-    const bin = (0, import_node_path3.join)(pkgDir, "scripts/bin/aware.js");
-    if ((0, import_node_fs4.existsSync)(bin)) return { head: [nodeExe(), bin], shell: false, pkgDir };
+    const pkgDir = (0, import_node_path5.join)(root, "@aware-aeco", "cli");
+    const bin = (0, import_node_path5.join)(pkgDir, "scripts/bin/aware.js");
+    if ((0, import_node_fs6.existsSync)(bin)) return { head: [nodeExe(), bin], shell: false, pkgDir };
   } catch {
   }
   return { head: ["aware"], shell: process.platform === "win32", pkgDir: null };
@@ -51307,7 +51473,7 @@ function awareNpmVersion() {
   const invoker = currentInvoker();
   if (!invoker.pkgDir) return null;
   try {
-    const pkg = JSON.parse((0, import_node_fs4.readFileSync)((0, import_node_path3.join)(invoker.pkgDir, "package.json"), "utf8"));
+    const pkg = JSON.parse((0, import_node_fs6.readFileSync)((0, import_node_path5.join)(invoker.pkgDir, "package.json"), "utf8"));
     return typeof pkg.version === "string" ? pkg.version : null;
   } catch {
     return null;
@@ -51396,10 +51562,10 @@ async function runJson(args) {
 function resolveTeklaBridge() {
   const invoker = currentInvoker();
   const candidates = [
-    (0, import_node_path3.join)((0, import_node_os3.homedir)(), ".aware", "bridges", "aware-tekla.exe"),
-    invoker.pkgDir ? (0, import_node_path3.join)(invoker.pkgDir, "binaries", "aware-tekla.exe") : null
+    (0, import_node_path5.join)((0, import_node_os5.homedir)(), ".aware", "bridges", "aware-tekla.exe"),
+    invoker.pkgDir ? (0, import_node_path5.join)(invoker.pkgDir, "binaries", "aware-tekla.exe") : null
   ].filter((p) => !!p);
-  return candidates.find((p) => (0, import_node_fs4.existsSync)(p)) ?? null;
+  return candidates.find((p) => (0, import_node_fs6.existsSync)(p)) ?? null;
 }
 function injectDebugger(code) {
   const lines = code.split(/\r?\n/);
@@ -51481,39 +51647,39 @@ function cancelActiveRun() {
 function isRunActive() {
   return activeRun !== null;
 }
-var LOGS_DIR = process.env.AWARE_HOME ? (0, import_node_path3.join)(process.env.AWARE_HOME, "logs") : (0, import_node_path3.join)((0, import_node_os3.homedir)(), ".aware", "logs");
+var LOGS_DIR = process.env.AWARE_HOME ? (0, import_node_path5.join)(process.env.AWARE_HOME, "logs") : (0, import_node_path5.join)((0, import_node_os5.homedir)(), ".aware", "logs");
 var TRIGGER_POLL_MS = 250;
 function parseRunHandle(stdout) {
   const m = stdout.match(/instance\s+([^,\s]+),\s*run-id\s+([0-9a-f-]{36})/i);
   return m ? { instance: m[1], runId: m[2] } : null;
 }
 function traceLogPath(id, instance, runId, logsRoot = LOGS_DIR) {
-  return (0, import_node_path3.join)(logsRoot, id, instance, `${runId}.jsonl`);
+  return (0, import_node_path5.join)(logsRoot, id, instance, `${runId}.jsonl`);
 }
 function latestTracePath(id, logsRoot = LOGS_DIR) {
-  const appDir2 = (0, import_node_path3.join)(logsRoot, id);
-  if (!(0, import_node_fs4.existsSync)(appDir2)) return null;
+  const appDir2 = (0, import_node_path5.join)(logsRoot, id);
+  if (!(0, import_node_fs6.existsSync)(appDir2)) return null;
   let best = null;
   let instances;
   try {
-    instances = (0, import_node_fs4.readdirSync)(appDir2);
+    instances = (0, import_node_fs6.readdirSync)(appDir2);
   } catch {
     return null;
   }
   for (const instance of instances) {
-    const instDir = (0, import_node_path3.join)(appDir2, instance);
+    const instDir = (0, import_node_path5.join)(appDir2, instance);
     let entries;
     try {
-      if (!(0, import_node_fs4.statSync)(instDir).isDirectory()) continue;
-      entries = (0, import_node_fs4.readdirSync)(instDir);
+      if (!(0, import_node_fs6.statSync)(instDir).isDirectory()) continue;
+      entries = (0, import_node_fs6.readdirSync)(instDir);
     } catch {
       continue;
     }
     for (const f of entries) {
       if (!f.endsWith(".jsonl")) continue;
-      const p = (0, import_node_path3.join)(instDir, f);
+      const p = (0, import_node_path5.join)(instDir, f);
       try {
-        const m = (0, import_node_fs4.statSync)(p).mtimeMs;
+        const m = (0, import_node_fs6.statSync)(p).mtimeMs;
         if (!best || m > best.mtimeMs) best = { path: p, mtimeMs: m };
       } catch {
       }
@@ -51522,17 +51688,17 @@ function latestTracePath(id, logsRoot = LOGS_DIR) {
   return best ? best.path : null;
 }
 function readTail(path, maxBytes) {
-  const size = (0, import_node_fs4.statSync)(path).size;
-  if (size <= maxBytes) return { text: (0, import_node_fs4.readFileSync)(path, "utf8"), truncated: false };
-  const fd2 = (0, import_node_fs4.openSync)(path, "r");
+  const size = (0, import_node_fs6.statSync)(path).size;
+  if (size <= maxBytes) return { text: (0, import_node_fs6.readFileSync)(path, "utf8"), truncated: false };
+  const fd2 = (0, import_node_fs6.openSync)(path, "r");
   try {
     const buf = Buffer.alloc(maxBytes);
-    const read = (0, import_node_fs4.readSync)(fd2, buf, 0, maxBytes, size - maxBytes);
+    const read = (0, import_node_fs6.readSync)(fd2, buf, 0, maxBytes, size - maxBytes);
     const nl = buf.indexOf(10, 0);
     const start = nl >= 0 && nl + 1 <= read ? nl + 1 : 0;
     return { text: buf.subarray(start, read).toString("utf8"), truncated: true };
   } finally {
-    (0, import_node_fs4.closeSync)(fd2);
+    (0, import_node_fs6.closeSync)(fd2);
   }
 }
 function readLatestTrace(id, logsRoot = LOGS_DIR, maxBytes) {
@@ -51540,7 +51706,7 @@ function readLatestTrace(id, logsRoot = LOGS_DIR, maxBytes) {
   if (!p) return null;
   let read;
   try {
-    read = maxBytes && maxBytes > 0 ? readTail(p, maxBytes) : { text: (0, import_node_fs4.readFileSync)(p, "utf8"), truncated: false };
+    read = maxBytes && maxBytes > 0 ? readTail(p, maxBytes) : { text: (0, import_node_fs6.readFileSync)(p, "utf8"), truncated: false };
   } catch {
     return null;
   }
@@ -51575,7 +51741,7 @@ function startTrigger(id, opts = {}) {
   const readAndEmit = () => {
     if (!tracePath || !traceCb) return;
     try {
-      const txt = (0, import_node_fs4.readFileSync)(tracePath, "utf8");
+      const txt = (0, import_node_fs6.readFileSync)(tracePath, "utf8");
       if (txt.length !== lastLen) {
         lastLen = txt.length;
         traceCb(parseTrace(txt));
@@ -51636,13 +51802,13 @@ function assertNodeId(id) {
 var SOURCE_EXT = /\.(flo|app|flow|aware)$/i;
 function assertSourcePath(p) {
   if (!SOURCE_EXT.test(p)) throw new AwareError(`source must be a .flo/.app file: ${JSON.stringify(p)}`);
-  if (!(0, import_node_fs4.existsSync)(p)) throw new AwareError(`source path not found: ${JSON.stringify(p)}`);
-  return (0, import_node_fs4.realpathSync)(p);
+  if (!(0, import_node_fs6.existsSync)(p)) throw new AwareError(`source path not found: ${JSON.stringify(p)}`);
+  return (0, import_node_fs6.realpathSync)(p);
 }
 function assertAppDir(p) {
-  if (!(0, import_node_fs4.existsSync)(p)) throw new AwareError(`app dir not found: ${JSON.stringify(p)}`);
-  const real = (0, import_node_fs4.realpathSync)(p);
-  if (!(0, import_node_fs4.statSync)(real).isDirectory()) throw new AwareError(`app dir is not a directory: ${JSON.stringify(p)}`);
+  if (!(0, import_node_fs6.existsSync)(p)) throw new AwareError(`app dir not found: ${JSON.stringify(p)}`);
+  const real = (0, import_node_fs6.realpathSync)(p);
+  if (!(0, import_node_fs6.statSync)(real).isDirectory()) throw new AwareError(`app dir is not a directory: ${JSON.stringify(p)}`);
   return real;
 }
 var GRAFT_PKG_AT_VER_RE = /^[A-Za-z0-9][\w.@/-]{0,127}$/;
@@ -51663,8 +51829,8 @@ function assertSourceRef(kind, ref) {
     case "openapi":
     case "yard":
       if (GRAFT_URL_RE.test(r)) return r;
-      if (!(0, import_node_fs4.existsSync)(r)) throw new AwareError(`${kind}: file/dir not found: ${r}`);
-      return (0, import_node_fs4.realpathSync)(r);
+      if (!(0, import_node_fs6.existsSync)(r)) throw new AwareError(`${kind}: file/dir not found: ${r}`);
+      return (0, import_node_fs6.realpathSync)(r);
     case "nuget":
     case "npm":
     case "ruby":
@@ -51901,8 +52067,8 @@ var aware = {
     try {
       let ref;
       if (inputs !== void 0) {
-        inputsFile = (0, import_node_path3.join)((0, import_node_os3.tmpdir)(), `floless-agent-inputs-${(0, import_node_crypto2.randomUUID)()}.json`);
-        (0, import_node_fs4.writeFileSync)(inputsFile, JSON.stringify(inputs));
+        inputsFile = (0, import_node_path5.join)((0, import_node_os5.tmpdir)(), `floless-agent-inputs-${(0, import_node_crypto3.randomUUID)()}.json`);
+        (0, import_node_fs6.writeFileSync)(inputsFile, JSON.stringify(inputs));
         ref = `@${inputsFile}`;
       }
       const { data } = await runJson(agentInvokeArgv(agent, command, ref));
@@ -51918,7 +52084,7 @@ var aware = {
     } finally {
       if (inputsFile) {
         try {
-          (0, import_node_fs4.rmSync)(inputsFile);
+          (0, import_node_fs6.rmSync)(inputsFile);
         } catch {
         }
       }
@@ -51953,7 +52119,7 @@ var aware = {
     if (code !== 0) throw new AwareError(`aware app compile failed (exit ${code})`, { stdout, stderr });
     const m = stdout.match(/→\s*(.+\.lock)\s*$/m);
     const lockPath = m?.[1]?.trim() ?? null;
-    const lockText = lockPath && (0, import_node_fs4.existsSync)(lockPath) ? (0, import_node_fs4.readFileSync)(lockPath, "utf8") : null;
+    const lockText = lockPath && (0, import_node_fs6.existsSync)(lockPath) ? (0, import_node_fs6.readFileSync)(lockPath, "utf8") : null;
     return { lockPath, lockText, output: stdout.trim() };
   },
   /**
@@ -52114,7 +52280,7 @@ var aware = {
       if (code !== 0) throw new AwareError(`aware app run failed (exit ${code})`, { stdout, stderr });
       const runId = stdout.match(/run-id\s+([0-9a-f-]{36})/i)?.[1] ?? null;
       const tracePath = stdout.match(/trace at\s+(.+\.jsonl)\s*$/m)?.[1]?.trim() ?? null;
-      const traceText = tracePath && (0, import_node_fs4.existsSync)(tracePath) ? (0, import_node_fs4.readFileSync)(tracePath, "utf8") : null;
+      const traceText = tracePath && (0, import_node_fs6.existsSync)(tracePath) ? (0, import_node_fs6.readFileSync)(tracePath, "utf8") : null;
       return { runId, tracePath, traceText, output: stdout.trim() };
     } finally {
       if (activeRun === reg2) activeRun = null;
@@ -52147,20 +52313,20 @@ var aware = {
 };
 
 // extensions-store.ts
-var import_node_fs5 = require("node:fs");
-var import_node_os4 = require("node:os");
-var import_node_path4 = require("node:path");
-var ROOT = process.env.FLOLESS_HOME ?? (0, import_node_path4.join)((0, import_node_os4.homedir)(), ".floless");
-var uiDir = (0, import_node_path4.join)(ROOT, "ui");
-var extensionsFile = (0, import_node_path4.join)(uiDir, "extensions.json");
-var TIMELINE_FILE = (0, import_node_path4.join)(uiDir, "timeline.json");
+var import_node_fs7 = require("node:fs");
+var import_node_os6 = require("node:os");
+var import_node_path6 = require("node:path");
+var ROOT = process.env.FLOLESS_HOME ?? (0, import_node_path6.join)((0, import_node_os6.homedir)(), ".floless");
+var uiDir = (0, import_node_path6.join)(ROOT, "ui");
+var extensionsFile = (0, import_node_path6.join)(uiDir, "extensions.json");
+var TIMELINE_FILE = (0, import_node_path6.join)(uiDir, "timeline.json");
 var HISTORY_KEEP = 20;
 function ensureUiDir() {
-  if (!(0, import_node_fs5.existsSync)(uiDir)) (0, import_node_fs5.mkdirSync)(uiDir, { recursive: true });
+  if (!(0, import_node_fs7.existsSync)(uiDir)) (0, import_node_fs7.mkdirSync)(uiDir, { recursive: true });
 }
 function readExtensionsText() {
   try {
-    return (0, import_node_fs5.readFileSync)(extensionsFile, "utf8");
+    return (0, import_node_fs7.readFileSync)(extensionsFile, "utf8");
   } catch {
     return null;
   }
@@ -52191,7 +52357,7 @@ function panelsCountOf(text) {
 function loadTimeline() {
   let text;
   try {
-    text = (0, import_node_fs5.readFileSync)(TIMELINE_FILE, "utf8");
+    text = (0, import_node_fs7.readFileSync)(TIMELINE_FILE, "utf8");
   } catch {
     return { cursor: -1, entries: [] };
   }
@@ -52215,19 +52381,19 @@ function loadTimeline() {
 function saveTimeline(t) {
   ensureUiDir();
   const tmp = `${TIMELINE_FILE}.${process.pid}.tmp`;
-  (0, import_node_fs5.writeFileSync)(tmp, JSON.stringify(t, null, 2));
-  (0, import_node_fs5.renameSync)(tmp, TIMELINE_FILE);
+  (0, import_node_fs7.writeFileSync)(tmp, JSON.stringify(t, null, 2));
+  (0, import_node_fs7.renameSync)(tmp, TIMELINE_FILE);
 }
 function writeExtensionsText(text) {
   ensureUiDir();
   const tmp = `${extensionsFile}.${process.pid}.tmp`;
-  (0, import_node_fs5.writeFileSync)(tmp, text);
-  (0, import_node_fs5.renameSync)(tmp, extensionsFile);
+  (0, import_node_fs7.writeFileSync)(tmp, text);
+  (0, import_node_fs7.renameSync)(tmp, extensionsFile);
 }
 function applyState(entry2) {
   if (entry2.content === null) {
     try {
-      (0, import_node_fs5.rmSync)(extensionsFile);
+      (0, import_node_fs7.rmSync)(extensionsFile);
     } catch {
     }
   } else {
@@ -52421,13 +52587,13 @@ function runBootstrap(deps) {
 }
 
 // licensing.ts
-var import_node_fs6 = require("node:fs");
-var import_node_path5 = require("node:path");
-var import_node_os5 = require("node:os");
+var import_node_fs8 = require("node:fs");
+var import_node_path7 = require("node:path");
+var import_node_os7 = require("node:os");
 var import_node_child_process2 = require("node:child_process");
-var import_node_crypto3 = require("node:crypto");
+var import_node_crypto4 = require("node:crypto");
 var import_node_module2 = require("node:module");
-var import_node_os6 = require("node:os");
+var import_node_os8 = require("node:os");
 var ENVS = {
   production: { apiBase: "https://api.floless.io/api", webBase: "https://floless.io" },
   staging: { apiBase: "https://api.stage.floless.io/api", webBase: "https://stage.floless.io" }
@@ -52481,26 +52647,26 @@ function isSea() {
 }
 function storeDir() {
   if (process.env.FLOLESS_LICENSE_DIR) return process.env.FLOLESS_LICENSE_DIR;
-  if (isSea() && process.env.LOCALAPPDATA) return (0, import_node_path5.join)(process.env.LOCALAPPDATA, "FlolessApp-data");
-  return (0, import_node_path5.join)((0, import_node_os5.homedir)(), ".aware");
+  if (isSea() && process.env.LOCALAPPDATA) return (0, import_node_path7.join)(process.env.LOCALAPPDATA, "FlolessApp-data");
+  return (0, import_node_path7.join)((0, import_node_os7.homedir)(), ".aware");
 }
-var tokenPath = () => (0, import_node_path5.join)(storeDir(), "floless-license.json");
-var cachePath = () => (0, import_node_path5.join)(storeDir(), "floless-license-cache.json");
+var tokenPath = () => (0, import_node_path7.join)(storeDir(), "floless-license.json");
+var cachePath = () => (0, import_node_path7.join)(storeDir(), "floless-license-cache.json");
 var _migrated = false;
 function migrateLegacyStore() {
   if (_migrated) return;
   _migrated = true;
   if (process.env.FLOLESS_LICENSE_DIR || !(isSea() && process.env.LOCALAPPDATA)) return;
-  const oldDir = (0, import_node_path5.join)(process.env.LOCALAPPDATA, "FlolessApp");
+  const oldDir = (0, import_node_path7.join)(process.env.LOCALAPPDATA, "FlolessApp");
   const newDir = storeDir();
   if (oldDir === newDir) return;
   for (const f of ["floless-license.json", "floless-license-cache.json", "floless-install-id"]) {
     try {
-      const oldP = (0, import_node_path5.join)(oldDir, f);
-      const newP = (0, import_node_path5.join)(newDir, f);
-      if ((0, import_node_fs6.existsSync)(oldP) && !(0, import_node_fs6.existsSync)(newP)) {
-        (0, import_node_fs6.mkdirSync)(newDir, { recursive: true });
-        (0, import_node_fs6.copyFileSync)(oldP, newP);
+      const oldP = (0, import_node_path7.join)(oldDir, f);
+      const newP = (0, import_node_path7.join)(newDir, f);
+      if ((0, import_node_fs8.existsSync)(oldP) && !(0, import_node_fs8.existsSync)(newP)) {
+        (0, import_node_fs8.mkdirSync)(newDir, { recursive: true });
+        (0, import_node_fs8.copyFileSync)(oldP, newP);
       }
     } catch {
     }
@@ -52508,16 +52674,16 @@ function migrateLegacyStore() {
 }
 function readJson(path) {
   try {
-    return (0, import_node_fs6.existsSync)(path) ? JSON.parse((0, import_node_fs6.readFileSync)(path, "utf8")) : null;
+    return (0, import_node_fs8.existsSync)(path) ? JSON.parse((0, import_node_fs8.readFileSync)(path, "utf8")) : null;
   } catch {
     return null;
   }
 }
 function writeJson(path, value) {
-  (0, import_node_fs6.mkdirSync)(storeDir(), { recursive: true });
-  (0, import_node_fs6.writeFileSync)(path, JSON.stringify(value, null, 2), "utf8");
+  (0, import_node_fs8.mkdirSync)(storeDir(), { recursive: true });
+  (0, import_node_fs8.writeFileSync)(path, JSON.stringify(value, null, 2), "utf8");
   try {
-    (0, import_node_fs6.chmodSync)(path, 384);
+    (0, import_node_fs8.chmodSync)(path, 384);
   } catch {
   }
 }
@@ -52657,7 +52823,7 @@ async function ensureSeat(token) {
     const res = await fetch(`${env().apiBase}/seats/claim`, {
       method: "POST",
       headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
-      body: JSON.stringify({ device_fingerprint: installId(), device_name: (0, import_node_os6.hostname)(), os_version: `${process.platform} ${process.arch}` })
+      body: JSON.stringify({ device_fingerprint: installId(), device_name: (0, import_node_os8.hostname)(), os_version: `${process.platform} ${process.arch}` })
     });
     if (!res.ok) return;
     const b = await res.json();
@@ -52678,7 +52844,7 @@ async function seatHeartbeat() {
   try {
     const token = await ensureFreshToken().catch(() => null);
     if (!token) return;
-    const hmac = (0, import_node_crypto3.createHmac)("sha256", seat.hmacSecret).update(seat.nonce).digest("hex");
+    const hmac = (0, import_node_crypto4.createHmac)("sha256", seat.hmacSecret).update(seat.nonce).digest("hex");
     let res;
     try {
       res = await fetch(`${env().apiBase}/seats/heartbeat`, {
@@ -52750,7 +52916,7 @@ function logout() {
   resetSeat();
   for (const p of [tokenPath(), cachePath()]) {
     try {
-      (0, import_node_fs6.rmSync)(p, { force: true });
+      (0, import_node_fs8.rmSync)(p, { force: true });
     } catch {
     }
   }
@@ -52774,7 +52940,7 @@ function openBrowser(url) {
   (0, import_node_child_process2.spawn)(cmd, args, opts).unref();
 }
 async function startLogin() {
-  const sessionId = (0, import_node_crypto3.randomUUID)();
+  const sessionId = (0, import_node_crypto4.randomUUID)();
   const loginUrl = `${env().webBase}/login?desktop=true&session=${sessionId}&app=floless`;
   openBrowser(loginUrl);
   void pollDesktopStatus(sessionId).catch(() => {
@@ -52807,20 +52973,20 @@ async function pollDesktopStatus(sessionId, timeoutMs = 18e4) {
   return false;
 }
 function installId() {
-  const p = (0, import_node_path5.join)(storeDir(), "floless-install-id");
+  const p = (0, import_node_path7.join)(storeDir(), "floless-install-id");
   const existing = readJson(p);
   if (typeof existing === "string" && existing.length >= 80 && existing.length <= 100) {
     return existing;
   }
-  const id = (0, import_node_crypto3.createHash)("sha512").update((0, import_node_crypto3.randomUUID)()).digest("base64");
+  const id = (0, import_node_crypto4.createHash)("sha512").update((0, import_node_crypto4.randomUUID)()).digest("base64");
   writeJson(p, id);
   return id;
 }
 
 // version.ts
 var import_node_module3 = require("node:module");
-var import_node_path6 = require("node:path");
-var import_node_fs7 = require("node:fs");
+var import_node_path8 = require("node:path");
+var import_node_fs9 = require("node:fs");
 function resolveVersion(s) {
   if (s.isSea) {
     const m = s.sqVersionXml?.match(/<version>([^<]+)<\/version>/);
@@ -52839,8 +53005,8 @@ function isSea2() {
 }
 function readSqVersionXml() {
   try {
-    const sq = (0, import_node_path6.join)((0, import_node_path6.dirname)(process.execPath), "sq.version");
-    return (0, import_node_fs7.existsSync)(sq) ? (0, import_node_fs7.readFileSync)(sq, "utf8") : null;
+    const sq = (0, import_node_path8.join)((0, import_node_path8.dirname)(process.execPath), "sq.version");
+    return (0, import_node_fs9.existsSync)(sq) ? (0, import_node_fs9.readFileSync)(sq, "utf8") : null;
   } catch {
     return null;
   }
@@ -52856,7 +53022,7 @@ function appVersion() {
   return resolveVersion({
     isSea: isSea2(),
     sqVersionXml: readSqVersionXml(),
-    define: true ? "0.56.0" : void 0,
+    define: true ? "0.57.0" : void 0,
     pkgVersion: readPkgVersion()
   });
 }
@@ -52866,16 +53032,16 @@ function resolveChannel(s) {
   return "dev";
 }
 function appChannel() {
-  return resolveChannel({ isSea: isSea2(), define: true ? "0.56.0" : void 0 });
+  return resolveChannel({ isSea: isSea2(), define: true ? "0.57.0" : void 0 });
 }
 
 // workflow-update.ts
-var import_node_fs8 = require("node:fs");
-var import_node_os7 = require("node:os");
-var import_node_path7 = require("node:path");
+var import_node_fs10 = require("node:fs");
+var import_node_os9 = require("node:os");
+var import_node_path9 = require("node:path");
 var import_node_url = require("node:url");
 var import_yaml2 = __toESM(require_dist6(), 1);
-var here = (0, import_node_path7.dirname)((0, import_node_url.fileURLToPath)(__import_meta_url));
+var here = (0, import_node_path9.dirname)((0, import_node_url.fileURLToPath)(__import_meta_url));
 function compareSemver(a, b) {
   const pa = String(a).split(".");
   const pb = String(b).split(".");
@@ -52890,24 +53056,35 @@ function changelogSince(changelog, installed) {
   return (changelog ?? []).filter((e) => e && compareSemver(String(e.version), installed) > 0);
 }
 function detectUpdates(installed, templates) {
+  const byId = new Map(templates.filter((t) => t.publisher === "floless").map((t) => [t.id, t]));
   const out = [];
-  for (const t of templates) {
-    if (t.publisher !== "floless") continue;
-    const iv = installed[t.id];
-    if (iv == null) continue;
-    if (compareSemver(t.version, iv) <= 0) continue;
+  for (const app of installed) {
+    if (app.forked) continue;
+    if (app.publisher != null && app.publisher !== "floless") continue;
+    const t = byId.get(app.templateId);
+    if (!t) continue;
+    if (compareSemver(t.version, app.version) <= 0) continue;
     out.push({
-      id: t.id,
-      installed: iv,
+      id: app.id,
+      templateId: t.id,
+      installed: app.version,
       available: t.version,
       module: t.module,
-      changelog: changelogSince(t.changelog, iv)
+      changelog: changelogSince(t.changelog, app.version)
     });
   }
   return out;
 }
+function stampSourceAppId(sourcePath, id) {
+  const doc = (0, import_yaml2.parseDocument)((0, import_node_fs10.readFileSync)(sourcePath, "utf8"));
+  if (doc.errors.length > 0) {
+    throw new Error(`stamp app id: source is not valid YAML: ${doc.errors[0]?.message ?? "parse error"}`);
+  }
+  doc.set("app", id);
+  (0, import_node_fs10.writeFileSync)(sourcePath, doc.toString());
+}
 function readTemplateMeta(path) {
-  const doc = (0, import_yaml2.parse)((0, import_node_fs8.readFileSync)(path, "utf8")) ?? {};
+  const doc = (0, import_yaml2.parse)((0, import_node_fs10.readFileSync)(path, "utf8")) ?? {};
   return {
     id: String(doc.app ?? ""),
     version: doc.version != null ? String(doc.version) : "0.0.0",
@@ -52921,24 +53098,24 @@ function templatePaths(roots) {
   const envDir = process.env.FLOLESS_TEMPLATES_DIR;
   const flatDirs = roots ?? [
     ...envDir ? [envDir] : [],
-    (0, import_node_path7.join)(here, "templates"),
+    (0, import_node_path9.join)(here, "templates"),
     // bundled: dist/templates beside the cjs
-    (0, import_node_path7.join)(here, "dist", "templates"),
+    (0, import_node_path9.join)(here, "dist", "templates"),
     // dev: the built bundle at server/dist
-    (0, import_node_path7.join)((0, import_node_path7.dirname)(process.execPath), "templates")
+    (0, import_node_path9.join)((0, import_node_path9.dirname)(process.execPath), "templates")
     // SEA exe
   ];
   for (const d of flatDirs) {
-    if (!(0, import_node_fs8.existsSync)(d)) continue;
-    const flos = (0, import_node_fs8.readdirSync)(d).filter((f) => f.endsWith(".flo"));
-    if (flos.length) return flos.map((f) => (0, import_node_path7.join)(d, f));
+    if (!(0, import_node_fs10.existsSync)(d)) continue;
+    const flos = (0, import_node_fs10.readdirSync)(d).filter((f) => f.endsWith(".flo"));
+    if (flos.length) return flos.map((f) => (0, import_node_path9.join)(d, f));
   }
-  for (const demos of [(0, import_node_path7.join)(here, "..", "demos"), (0, import_node_path7.join)(here, "..", "..", "demos")]) {
-    if (!(0, import_node_fs8.existsSync)(demos)) continue;
+  for (const demos of [(0, import_node_path9.join)(here, "..", "demos"), (0, import_node_path9.join)(here, "..", "..", "demos")]) {
+    if (!(0, import_node_fs10.existsSync)(demos)) continue;
     const out = [];
-    for (const dir of (0, import_node_fs8.readdirSync)(demos)) {
+    for (const dir of (0, import_node_fs10.readdirSync)(demos)) {
       try {
-        for (const f of (0, import_node_fs8.readdirSync)((0, import_node_path7.join)(demos, dir))) if (f.endsWith(".flo")) out.push((0, import_node_path7.join)(demos, dir, f));
+        for (const f of (0, import_node_fs10.readdirSync)((0, import_node_path9.join)(demos, dir))) if (f.endsWith(".flo")) out.push((0, import_node_path9.join)(demos, dir, f));
       } catch {
       }
     }
@@ -52958,19 +53135,19 @@ function loadTemplates(roots) {
   return out;
 }
 function backupDir(id, version, ts) {
-  const root = process.env.FLOLESS_HOME ?? (0, import_node_path7.join)((0, import_node_os7.homedir)(), ".floless");
+  const root = process.env.FLOLESS_HOME ?? (0, import_node_path9.join)((0, import_node_os9.homedir)(), ".floless");
   const safe = (s) => {
     const c = String(s).replace(/[^0-9A-Za-z._-]/g, "_");
     return /^\.+$/.test(c) ? "_" : c || "_";
   };
-  return (0, import_node_path7.join)(root, "app-backups", safe(id), `${safe(version)}-${ts}`);
+  return (0, import_node_path9.join)(root, "app-backups", safe(id), `${safe(version)}-${ts}`);
 }
 
 // oauth-presets.ts
-var import_node_os8 = require("node:os");
-var import_node_path8 = require("node:path");
+var import_node_os10 = require("node:os");
+var import_node_path10 = require("node:path");
 var import_node_net = __toESM(require("node:net"), 1);
-var import_node_fs9 = require("node:fs");
+var import_node_fs11 = require("node:fs");
 var MANAGED_HEADER = "# managed by floless.app - do not edit";
 var OAUTH_PRESETS = {
   "trimble-connect": {
@@ -53000,7 +53177,7 @@ function managedProfileYaml(preset) {
   ].join("\n");
 }
 function oauthDir() {
-  return process.env.AWARE_HOME ? (0, import_node_path8.join)(process.env.AWARE_HOME, "oauth") : (0, import_node_path8.join)((0, import_node_os8.homedir)(), ".aware", "oauth");
+  return process.env.AWARE_HOME ? (0, import_node_path10.join)(process.env.AWARE_HOME, "oauth") : (0, import_node_path10.join)((0, import_node_os10.homedir)(), ".aware", "oauth");
 }
 function isUpgradableLegacyProfile(existing, preset) {
   if (existing.startsWith(MANAGED_HEADER)) return false;
@@ -53014,15 +53191,15 @@ function ensureManagedProfile(id) {
   const preset = OAUTH_PRESETS[id];
   if (!preset) return "not-managed";
   const dir = oauthDir();
-  const file = (0, import_node_path8.join)(dir, `${id}.yaml`);
-  const existing = (0, import_node_fs9.existsSync)(file) ? (0, import_node_fs9.readFileSync)(file, "utf8") : null;
+  const file = (0, import_node_path10.join)(dir, `${id}.yaml`);
+  const existing = (0, import_node_fs11.existsSync)(file) ? (0, import_node_fs11.readFileSync)(file, "utf8") : null;
   if (existing !== null && !existing.startsWith(MANAGED_HEADER) && !isUpgradableLegacyProfile(existing, preset)) {
     return "skipped";
   }
   const desired = managedProfileYaml(preset);
   if (existing === desired) return "unchanged";
-  (0, import_node_fs9.mkdirSync)(dir, { recursive: true });
-  (0, import_node_fs9.writeFileSync)(file, desired, "utf8");
+  (0, import_node_fs11.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs11.writeFileSync)(file, desired, "utf8");
   return "written";
 }
 function isPortBindable(port, host = "127.0.0.1") {
@@ -53193,16 +53370,16 @@ function buildPreview(m, sourceKind, sourceRef, stagedRef) {
 }
 
 // graft-manifest-reader.ts
-var import_node_fs10 = require("node:fs");
-var import_node_path9 = require("node:path");
+var import_node_fs12 = require("node:fs");
+var import_node_path11 = require("node:path");
 var import_yaml4 = __toESM(require_dist6(), 1);
 var asRecord2 = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : {};
 function readStagedManifest(agentDir) {
-  const manifestPath = (0, import_node_path9.join)(agentDir, "manifest.yaml");
-  if (!(0, import_node_fs10.existsSync)(manifestPath)) return null;
+  const manifestPath = (0, import_node_path11.join)(agentDir, "manifest.yaml");
+  if (!(0, import_node_fs12.existsSync)(manifestPath)) return null;
   let doc;
   try {
-    doc = asRecord2((0, import_yaml4.parse)((0, import_node_fs10.readFileSync)(manifestPath, "utf8")));
+    doc = asRecord2((0, import_yaml4.parse)((0, import_node_fs12.readFileSync)(manifestPath, "utf8")));
   } catch {
     return null;
   }
@@ -53232,10 +53409,10 @@ function readStagedManifest(agentDir) {
   }
   let skillCount = Array.isArray(doc.skills) ? doc.skills.length : 0;
   if (!skillCount) {
-    const skillsDir = (0, import_node_path9.join)(agentDir, "skills");
-    if ((0, import_node_fs10.existsSync)(skillsDir)) {
+    const skillsDir = (0, import_node_path11.join)(agentDir, "skills");
+    if ((0, import_node_fs12.existsSync)(skillsDir)) {
       try {
-        skillCount = (0, import_node_fs10.readdirSync)(skillsDir).filter((f) => f.endsWith(".md")).length;
+        skillCount = (0, import_node_fs12.readdirSync)(skillsDir).filter((f) => f.endsWith(".md")).length;
       } catch {
       }
     }
@@ -53249,7 +53426,7 @@ function readStagedManifest(agentDir) {
 }
 
 // graft-stage-registry.ts
-var import_node_fs11 = require("node:fs");
+var import_node_fs13 = require("node:fs");
 var TTL_MS = 30 * 60 * 1e3;
 var registry = /* @__PURE__ */ new Map();
 function registerStage(token, tempDir, agentId) {
@@ -53271,7 +53448,7 @@ function evict(token) {
   clearTimeout(e.timer);
   registry.delete(token);
   try {
-    (0, import_node_fs11.rmSync)(e.tempDir, { recursive: true, force: true });
+    (0, import_node_fs13.rmSync)(e.tempDir, { recursive: true, force: true });
   } catch {
   }
 }
@@ -53280,8 +53457,8 @@ function clearAllStages() {
 }
 
 // graft-commit.ts
-var import_node_fs12 = require("node:fs");
-var import_node_path10 = require("node:path");
+var import_node_fs14 = require("node:fs");
+var import_node_path12 = require("node:path");
 var GraftCommitError = class extends Error {
   constructor(message, code) {
     super(message);
@@ -53291,34 +53468,34 @@ var GraftCommitError = class extends Error {
   code;
 };
 function commitStaged(tempDir, agentId, targetAgentsDir, force) {
-  const staged = (0, import_node_path10.join)(tempDir, "agents", agentId);
-  const target = (0, import_node_path10.join)(targetAgentsDir, agentId);
-  if ((0, import_node_fs12.existsSync)(target)) {
+  const staged = (0, import_node_path12.join)(tempDir, "agents", agentId);
+  const target = (0, import_node_path12.join)(targetAgentsDir, agentId);
+  if ((0, import_node_fs14.existsSync)(target)) {
     if (!force) throw new GraftCommitError(`an agent named "${agentId}" is already installed`, "collision");
-    (0, import_node_fs12.rmSync)(target, { recursive: true, force: true });
+    (0, import_node_fs14.rmSync)(target, { recursive: true, force: true });
   }
-  (0, import_node_fs12.mkdirSync)(targetAgentsDir, { recursive: true });
+  (0, import_node_fs14.mkdirSync)(targetAgentsDir, { recursive: true });
   try {
-    (0, import_node_fs12.renameSync)(staged, target);
+    (0, import_node_fs14.renameSync)(staged, target);
   } catch {
-    (0, import_node_fs12.cpSync)(staged, target, { recursive: true });
+    (0, import_node_fs14.cpSync)(staged, target, { recursive: true });
   }
-  (0, import_node_fs12.rmSync)(tempDir, { recursive: true, force: true });
+  (0, import_node_fs14.rmSync)(tempDir, { recursive: true, force: true });
   return { agentId };
 }
 function matchAssemblies(globOrDir) {
   let dir;
   let pattern;
-  if ((0, import_node_fs12.existsSync)(globOrDir) && (0, import_node_fs12.statSync)(globOrDir).isDirectory()) {
+  if ((0, import_node_fs14.existsSync)(globOrDir) && (0, import_node_fs14.statSync)(globOrDir).isDirectory()) {
     dir = globOrDir;
     pattern = "*.dll";
   } else {
-    dir = (0, import_node_path10.dirname)(globOrDir);
-    pattern = (0, import_node_path10.basename)(globOrDir);
+    dir = (0, import_node_path12.dirname)(globOrDir);
+    pattern = (0, import_node_path12.basename)(globOrDir);
   }
-  if (!dir || !(0, import_node_fs12.existsSync)(dir) || !(0, import_node_fs12.statSync)(dir).isDirectory()) return [];
+  if (!dir || !(0, import_node_fs14.existsSync)(dir) || !(0, import_node_fs14.statSync)(dir).isDirectory()) return [];
   const re = globToRegExp(pattern);
-  return (0, import_node_fs12.readdirSync)(dir).filter((f) => re.test(f)).sort();
+  return (0, import_node_fs14.readdirSync)(dir).filter((f) => re.test(f)).sort();
 }
 function globToRegExp(p) {
   const esc = p.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
@@ -53326,25 +53503,25 @@ function globToRegExp(p) {
 }
 
 // floless-store.ts
-var import_node_crypto4 = require("node:crypto");
-var import_node_fs13 = require("node:fs");
-var import_node_os9 = require("node:os");
-var import_node_path11 = require("node:path");
-var ROOT2 = process.env.FLOLESS_HOME ?? (0, import_node_path11.join)((0, import_node_os9.homedir)(), ".floless");
-var TEMPLATES_FILE = (0, import_node_path11.join)(ROOT2, "templates.json");
-var REQUESTS_DIR = (0, import_node_path11.join)(ROOT2, "requests");
+var import_node_crypto5 = require("node:crypto");
+var import_node_fs15 = require("node:fs");
+var import_node_os11 = require("node:os");
+var import_node_path13 = require("node:path");
+var ROOT2 = process.env.FLOLESS_HOME ?? (0, import_node_path13.join)((0, import_node_os11.homedir)(), ".floless");
+var TEMPLATES_FILE = (0, import_node_path13.join)(ROOT2, "templates.json");
+var REQUESTS_DIR = (0, import_node_path13.join)(ROOT2, "requests");
 function ensureRoot() {
-  if (!(0, import_node_fs13.existsSync)(ROOT2)) (0, import_node_fs13.mkdirSync)(ROOT2, { recursive: true });
+  if (!(0, import_node_fs15.existsSync)(ROOT2)) (0, import_node_fs15.mkdirSync)(ROOT2, { recursive: true });
 }
 function withinRequestsDir(p) {
-  const base = (0, import_node_path11.resolve)(REQUESTS_DIR);
-  const full = (0, import_node_path11.resolve)(p);
-  return full === base || full.startsWith(base + import_node_path11.sep);
+  const base = (0, import_node_path13.resolve)(REQUESTS_DIR);
+  const full = (0, import_node_path13.resolve)(p);
+  return full === base || full.startsWith(base + import_node_path13.sep);
 }
 function listTemplates() {
-  if (!(0, import_node_fs13.existsSync)(TEMPLATES_FILE)) return [];
+  if (!(0, import_node_fs15.existsSync)(TEMPLATES_FILE)) return [];
   try {
-    const parsed = JSON.parse((0, import_node_fs13.readFileSync)(TEMPLATES_FILE, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs15.readFileSync)(TEMPLATES_FILE, "utf8"));
     return Array.isArray(parsed) ? parsed : [];
   } catch {
     return [];
@@ -53353,8 +53530,8 @@ function listTemplates() {
 function writeTemplates(list) {
   ensureRoot();
   const tmp = `${TEMPLATES_FILE}.${process.pid}.tmp`;
-  (0, import_node_fs13.writeFileSync)(tmp, JSON.stringify(list, null, 2));
-  (0, import_node_fs13.renameSync)(tmp, TEMPLATES_FILE);
+  (0, import_node_fs15.writeFileSync)(tmp, JSON.stringify(list, null, 2));
+  (0, import_node_fs15.renameSync)(tmp, TEMPLATES_FILE);
 }
 function addTemplate(input) {
   const list = listTemplates();
@@ -53365,7 +53542,7 @@ function addTemplate(input) {
     if (dup) return dup;
   }
   const tpl = {
-    id: (0, import_node_crypto4.randomUUID)(),
+    id: (0, import_node_crypto5.randomUUID)(),
     name: input.name.trim(),
     category: (input.category || "Uncategorized").trim(),
     node: input.node,
@@ -53386,12 +53563,12 @@ function deleteTemplate(id) {
 function getTemplate(id) {
   return listTemplates().find((t) => t.id === id) ?? null;
 }
-function updateTemplate(id, patch) {
+function updateTemplate(id, patch2) {
   const list = listTemplates();
   const cur = list.find((t) => t.id === id);
   if (!cur) return null;
-  const name = patch.name?.trim();
-  const category = patch.category?.trim();
+  const name = patch2.name?.trim();
+  const category = patch2.category?.trim();
   cur.name = name || cur.name;
   cur.category = category || cur.category;
   writeTemplates(list);
@@ -53399,13 +53576,13 @@ function updateTemplate(id, patch) {
 }
 function addRequest(req, decoded = []) {
   ensureRoot();
-  if (!(0, import_node_fs13.existsSync)(REQUESTS_DIR)) (0, import_node_fs13.mkdirSync)(REQUESTS_DIR, { recursive: true });
-  const id = (0, import_node_crypto4.randomUUID)();
+  if (!(0, import_node_fs15.existsSync)(REQUESTS_DIR)) (0, import_node_fs15.mkdirSync)(REQUESTS_DIR, { recursive: true });
+  const id = (0, import_node_crypto5.randomUUID)();
   const createdAt = (/* @__PURE__ */ new Date()).toISOString();
   const base = `${createdAt.replace(/[:.]/g, "-")}__${id}`;
   const snapshots = decoded.map((d, i) => {
-    const p = (0, import_node_path11.join)(REQUESTS_DIR, `${base}__snap${i + 1}.${d.ext}`);
-    (0, import_node_fs13.writeFileSync)(p, d.buf);
+    const p = (0, import_node_path13.join)(REQUESTS_DIR, `${base}__snap${i + 1}.${d.ext}`);
+    (0, import_node_fs15.writeFileSync)(p, d.buf);
     return p;
   });
   const full = {
@@ -53415,55 +53592,55 @@ function addRequest(req, decoded = []) {
     ...req,
     ...snapshots.length ? { snapshots } : {}
   };
-  (0, import_node_fs13.writeFileSync)((0, import_node_path11.join)(REQUESTS_DIR, `${base}.json`), JSON.stringify(full, null, 2));
+  (0, import_node_fs15.writeFileSync)((0, import_node_path13.join)(REQUESTS_DIR, `${base}.json`), JSON.stringify(full, null, 2));
   return full;
 }
 function listRequests() {
-  if (!(0, import_node_fs13.existsSync)(REQUESTS_DIR)) return [];
-  return (0, import_node_fs13.readdirSync)(REQUESTS_DIR).filter((f) => f.endsWith(".json")).sort().map((f) => {
+  if (!(0, import_node_fs15.existsSync)(REQUESTS_DIR)) return [];
+  return (0, import_node_fs15.readdirSync)(REQUESTS_DIR).filter((f) => f.endsWith(".json")).sort().map((f) => {
     try {
-      return JSON.parse((0, import_node_fs13.readFileSync)((0, import_node_path11.join)(REQUESTS_DIR, f), "utf8"));
+      return JSON.parse((0, import_node_fs15.readFileSync)((0, import_node_path13.join)(REQUESTS_DIR, f), "utf8"));
     } catch {
       return null;
     }
   }).filter((r) => r !== null);
 }
 function deleteRequest(id) {
-  if (!(0, import_node_fs13.existsSync)(REQUESTS_DIR)) return false;
-  const file = (0, import_node_fs13.readdirSync)(REQUESTS_DIR).find((f) => f.endsWith(`__${id}.json`));
+  if (!(0, import_node_fs15.existsSync)(REQUESTS_DIR)) return false;
+  const file = (0, import_node_fs15.readdirSync)(REQUESTS_DIR).find((f) => f.endsWith(`__${id}.json`));
   if (!file) return false;
   try {
-    const parsed = JSON.parse((0, import_node_fs13.readFileSync)((0, import_node_path11.join)(REQUESTS_DIR, file), "utf8"));
+    const parsed = JSON.parse((0, import_node_fs15.readFileSync)((0, import_node_path13.join)(REQUESTS_DIR, file), "utf8"));
     for (const p of parsed.snapshots ?? []) {
       if (!withinRequestsDir(p)) continue;
       try {
-        (0, import_node_fs13.rmSync)(p);
+        (0, import_node_fs15.rmSync)(p);
       } catch {
       }
     }
   } catch {
   }
-  (0, import_node_fs13.rmSync)((0, import_node_path11.join)(REQUESTS_DIR, file));
+  (0, import_node_fs15.rmSync)((0, import_node_path13.join)(REQUESTS_DIR, file));
   return true;
 }
 function clearRequests() {
-  if (!(0, import_node_fs13.existsSync)(REQUESTS_DIR)) return 0;
-  const allFiles = (0, import_node_fs13.readdirSync)(REQUESTS_DIR);
+  if (!(0, import_node_fs15.existsSync)(REQUESTS_DIR)) return 0;
+  const allFiles = (0, import_node_fs15.readdirSync)(REQUESTS_DIR);
   const jsonFiles = allFiles.filter((f) => f.endsWith(".json"));
   for (const f of allFiles) {
     try {
-      (0, import_node_fs13.rmSync)((0, import_node_path11.join)(REQUESTS_DIR, f));
+      (0, import_node_fs15.rmSync)((0, import_node_path13.join)(REQUESTS_DIR, f));
     } catch {
     }
   }
   return jsonFiles.length;
 }
 function snapshotPathFor(id, n) {
-  if (!(0, import_node_fs13.existsSync)(REQUESTS_DIR)) return null;
-  const file = (0, import_node_fs13.readdirSync)(REQUESTS_DIR).find((f) => f.endsWith(`__${id}.json`));
+  if (!(0, import_node_fs15.existsSync)(REQUESTS_DIR)) return null;
+  const file = (0, import_node_fs15.readdirSync)(REQUESTS_DIR).find((f) => f.endsWith(`__${id}.json`));
   if (!file) return null;
   try {
-    const parsed = JSON.parse((0, import_node_fs13.readFileSync)((0, import_node_path11.join)(REQUESTS_DIR, file), "utf8"));
+    const parsed = JSON.parse((0, import_node_fs15.readFileSync)((0, import_node_path13.join)(REQUESTS_DIR, file), "utf8"));
     const cand = parsed.snapshots?.[n] ?? null;
     return cand && withinRequestsDir(cand) ? cand : null;
   } catch {
@@ -53474,8 +53651,8 @@ var flolessRoot = ROOT2;
 var SnapshotError = class extends Error {
 };
 var MAX_SNAPSHOTS = 8;
-var MAX_BYTES2 = 25 * 1024 * 1024;
-function sniffExt(buf) {
+var MAX_BYTES3 = 25 * 1024 * 1024;
+function sniffExt2(buf) {
   if (buf.length >= 8 && buf[0] === 137 && buf[1] === 80 && buf[2] === 78 && buf[3] === 71) return "png";
   if (buf.length >= 3 && buf[0] === 255 && buf[1] === 216 && buf[2] === 255) return "jpg";
   if (buf.length >= 12 && buf.toString("ascii", 0, 4) === "RIFF" && buf.toString("ascii", 8, 12) === "WEBP") return "webp";
@@ -53488,100 +53665,24 @@ function decodeSnapshots(inputs) {
   return inputs.map((s) => {
     const m = /^data:([\w/+.-]+);base64,(.*)$/s.exec(s.dataUrl || "");
     if (!m) throw new SnapshotError("snapshot must be a base64 data URL");
-    if ((m[2]?.length ?? 0) * 0.75 > MAX_BYTES2) throw new SnapshotError("snapshot too large (max 25 MB)");
+    if ((m[2]?.length ?? 0) * 0.75 > MAX_BYTES3) throw new SnapshotError("snapshot too large (max 25 MB)");
     const buf = Buffer.from(m[2] ?? "", "base64");
     if (buf.length === 0) throw new SnapshotError("empty snapshot");
-    if (buf.length > MAX_BYTES2) throw new SnapshotError("snapshot too large (max 25 MB)");
-    const ext = sniffExt(buf);
+    if (buf.length > MAX_BYTES3) throw new SnapshotError("snapshot too large (max 25 MB)");
+    const ext = sniffExt2(buf);
     if (!ext) throw new SnapshotError("snapshot must be PNG, JPEG, WebP, or PDF");
     return { buf, ext };
   });
 }
 
-// visual-input-store.ts
-var import_node_crypto5 = require("node:crypto");
-var import_node_fs14 = require("node:fs");
-var import_node_os10 = require("node:os");
-var import_node_path12 = require("node:path");
-var MAX_BYTES3 = 25 * 1024 * 1024;
-var VisualInputError = class extends Error {
-};
-function inputsDir() {
-  const root = process.env.FLOLESS_HOME ?? (0, import_node_path12.join)((0, import_node_os10.homedir)(), ".floless");
-  return (0, import_node_path12.join)(root, "inputs");
-}
-function sniffExt2(buf) {
-  if (buf.length >= 8 && buf[0] === 137 && buf[1] === 80 && buf[2] === 78 && buf[3] === 71) return "png";
-  if (buf.length >= 3 && buf[0] === 255 && buf[1] === 216 && buf[2] === 255) return "jpg";
-  if (buf.length >= 12 && buf.toString("ascii", 0, 4) === "RIFF" && buf.toString("ascii", 8, 12) === "WEBP") return "webp";
-  if (buf.length >= 5 && buf.toString("ascii", 0, 5) === "%PDF-") return "pdf";
-  return null;
-}
-var RESERVED = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\..*)?$/i;
-function safeSegment(s) {
-  if (!s || s === "." || s.includes("..")) return false;
-  if (s.includes("/") || s.includes("\\") || s.includes(import_node_path12.sep)) return false;
-  for (let i = 0; i < s.length; i++) {
-    const c = s.charCodeAt(i);
-    if (c < 32 || c === 58) return false;
-  }
-  if (/[. ]$/.test(s)) return false;
-  return !RESERVED.test(s);
-}
-function storeVisualInput(appId, dataUrl) {
-  if (!safeSegment(appId)) throw new VisualInputError("invalid app id");
-  const m = /^data:([\w/+.-]+);base64,(.*)$/s.exec(dataUrl || "");
-  if (!m) throw new VisualInputError("visual input must be a base64 data URL");
-  const buf = Buffer.from(m[2] ?? "", "base64");
-  if (buf.length === 0) throw new VisualInputError("empty visual input");
-  if (buf.length > MAX_BYTES3) throw new VisualInputError("visual input too large (max 25 MB)");
-  const ext = sniffExt2(buf);
-  if (!ext) throw new VisualInputError("visual input must be PNG, JPEG, WebP, or PDF");
-  const sha2562 = (0, import_node_crypto5.createHash)("sha256").update(buf).digest("hex");
-  const dir = (0, import_node_path12.join)(inputsDir(), appId);
-  const path = (0, import_node_path12.join)(dir, `${sha2562}.${ext}`);
-  const root = (0, import_node_path12.resolve)(inputsDir());
-  const target = (0, import_node_path12.resolve)(path);
-  if (target !== root && !target.startsWith(root + import_node_path12.sep)) {
-    throw new VisualInputError("refusing to write outside the inputs root");
-  }
-  (0, import_node_fs14.mkdirSync)(dir, { recursive: true });
-  if (!(0, import_node_fs14.existsSync)(path)) {
-    const tmp = `${path}.tmp`;
-    (0, import_node_fs14.writeFileSync)(tmp, buf);
-    (0, import_node_fs14.renameSync)(tmp, path);
-  }
-  return { path, ext, bytes: (0, import_node_fs14.statSync)(path).size, sha256: sha2562 };
-}
-function renameVisualInputs(oldId, newId) {
-  if (!safeSegment(oldId) || !safeSegment(newId)) throw new VisualInputError("invalid app id");
-  const from = (0, import_node_path12.join)(inputsDir(), oldId);
-  if (!(0, import_node_fs14.existsSync)(from)) return;
-  const to = (0, import_node_path12.join)(inputsDir(), newId);
-  if ((0, import_node_fs14.existsSync)(to)) (0, import_node_fs14.rmSync)(to, { recursive: true, force: true });
-  (0, import_node_fs14.mkdirSync)(inputsDir(), { recursive: true });
-  (0, import_node_fs14.renameSync)(from, to);
-}
-function copyVisualInputs(srcId, newId) {
-  if (!safeSegment(srcId) || !safeSegment(newId)) throw new VisualInputError("invalid app id");
-  const from = (0, import_node_path12.join)(inputsDir(), srcId);
-  if (!(0, import_node_fs14.existsSync)(from)) return;
-  (0, import_node_fs14.cpSync)(from, (0, import_node_path12.join)(inputsDir(), newId), { recursive: true });
-}
-function deleteVisualInputs(id) {
-  if (!safeSegment(id)) throw new VisualInputError("invalid app id");
-  const dir = (0, import_node_path12.join)(inputsDir(), id);
-  if ((0, import_node_fs14.existsSync)(dir)) (0, import_node_fs14.rmSync)(dir, { recursive: true, force: true });
-}
-
 // contract-store.ts
-var import_node_fs16 = require("node:fs");
-var import_node_path14 = require("node:path");
-var import_node_os11 = require("node:os");
+var import_node_fs17 = require("node:fs");
+var import_node_path15 = require("node:path");
+var import_node_os12 = require("node:os");
 
 // contract-schema.ts
-var import_node_fs15 = require("node:fs");
-var import_node_path13 = require("node:path");
+var import_node_fs16 = require("node:fs");
+var import_node_path14 = require("node:path");
 var import_node_url2 = require("node:url");
 function validate(doc, schema) {
   const errors = [];
@@ -53682,16 +53783,16 @@ function walk(value, node, root, path, errors) {
 var _cached = null;
 function loadSteelTakeoffSchema() {
   if (_cached) return _cached;
-  const here2 = (0, import_node_path13.dirname)((0, import_node_url2.fileURLToPath)(__import_meta_url));
+  const here2 = (0, import_node_path14.dirname)((0, import_node_url2.fileURLToPath)(__import_meta_url));
   const candidates = [
-    (0, import_node_path13.join)(here2, "..", "schemas", "steel.takeoff.v1.schema.json"),
+    (0, import_node_path14.join)(here2, "..", "schemas", "steel.takeoff.v1.schema.json"),
     // dev: server/ next to schemas/
-    (0, import_node_path13.join)(here2, "schemas", "steel.takeoff.v1.schema.json")
+    (0, import_node_path14.join)(here2, "schemas", "steel.takeoff.v1.schema.json")
     // bundled: dist/ holds ./schemas
   ];
   for (const p of candidates) {
     try {
-      const text = (0, import_node_fs15.readFileSync)(p, "utf8");
+      const text = (0, import_node_fs16.readFileSync)(p, "utf8");
       _cached = JSON.parse(text);
       return _cached;
     } catch (err2) {
@@ -53707,20 +53808,20 @@ function validateSteelTakeoff(doc) {
 // contract-store.ts
 var ContractError = class extends Error {
 };
-var ROOT3 = process.env.FLOLESS_HOME ?? (0, import_node_path14.join)((0, import_node_os11.homedir)(), ".floless");
-var DIR = (0, import_node_path14.join)(ROOT3, "contracts");
+var ROOT3 = process.env.FLOLESS_HOME ?? (0, import_node_path15.join)((0, import_node_os12.homedir)(), ".floless");
+var DIR = (0, import_node_path15.join)(ROOT3, "contracts");
 function safeId(appId) {
   if (!/^[a-z0-9][a-z0-9._-]*$/i.test(appId)) throw new ContractError(`invalid appId: ${appId}`);
   return appId;
 }
 function contractPath(appId) {
-  return (0, import_node_path14.join)(DIR, `${safeId(appId)}.json`);
+  return (0, import_node_path15.join)(DIR, `${safeId(appId)}.json`);
 }
 function readContract(appId) {
   const p = contractPath(appId);
-  if (!(0, import_node_fs16.existsSync)(p)) return null;
+  if (!(0, import_node_fs17.existsSync)(p)) return null;
   try {
-    return JSON.parse((0, import_node_fs16.readFileSync)(p, "utf8"));
+    return JSON.parse((0, import_node_fs17.readFileSync)(p, "utf8"));
   } catch (e) {
     console.warn(`readContract: ignoring unreadable contract at ${p}: ${e instanceof Error ? e.message : e}`);
     return null;
@@ -53733,8 +53834,8 @@ function writeContract(appId, doc) {
     const first = res.errors.slice(0, 5).map((e) => `${e.path}: ${e.message}`).join("; ");
     throw new ContractError(`contract failed schema validation \u2014 ${first}`);
   }
-  if (!(0, import_node_fs16.existsSync)(DIR)) (0, import_node_fs16.mkdirSync)(DIR, { recursive: true });
-  (0, import_node_fs16.writeFileSync)(p, JSON.stringify(doc));
+  if (!(0, import_node_fs17.existsSync)(DIR)) (0, import_node_fs17.mkdirSync)(DIR, { recursive: true });
+  (0, import_node_fs17.writeFileSync)(p, JSON.stringify(doc));
 }
 
 // contract-resolve.ts
@@ -53756,10 +53857,10 @@ function readContractForApp(appId, readAppFn = readApp) {
 }
 
 // contract-bake.ts
-var import_node_fs17 = require("node:fs");
+var import_node_fs18 = require("node:fs");
 var import_yaml5 = __toESM(require_dist6(), 1);
 function bakeContractIntoApp(sourcePath, contract) {
-  const doc = (0, import_yaml5.parseDocument)((0, import_node_fs17.readFileSync)(sourcePath, "utf8"));
+  const doc = (0, import_yaml5.parseDocument)((0, import_node_fs18.readFileSync)(sourcePath, "utf8"));
   if (doc.errors.length > 0) {
     throw new Error(`contract bake: source is not valid YAML: ${doc.errors[0]?.message ?? "parse error"}`);
   }
@@ -53802,7 +53903,7 @@ function bakeContractIntoApp(sourcePath, contract) {
     baked.filter = next;
   }
   doc.setIn(["nodes", idx, "config", "takeoff"], baked);
-  (0, import_node_fs17.writeFileSync)(sourcePath, doc.toString());
+  (0, import_node_fs18.writeFileSync)(sourcePath, doc.toString());
 }
 
 // steel-joints.ts
@@ -54374,11 +54475,11 @@ function contractToBom(contractInput) {
 }
 
 // bom-export.ts
-var import_node_os12 = require("node:os");
-var import_node_path15 = require("node:path");
+var import_node_os13 = require("node:os");
+var import_node_path16 = require("node:path");
 
 // node_modules/write-excel-file/modules/export/writeXlsxFileNode.js
-var import_node_fs18 = __toESM(require("node:fs"), 1);
+var import_node_fs19 = __toESM(require("node:fs"), 1);
 
 // node_modules/write-excel-file/modules/xlsx/helpers/features/getAdditionalContent.js
 function _createForOfIteratorHelperLoose(r, e) {
@@ -58550,7 +58651,7 @@ function writeXlsxFile(arg1, arg2, arg3) {
     },
     toFile: function toFile(filePath) {
       return createReadableStream().then(function(readableStream) {
-        return pipe(readableStream, import_node_fs18.default.createWriteStream(filePath));
+        return pipe(readableStream, import_node_fs19.default.createWriteStream(filePath));
       });
     }
   };
@@ -58575,8 +58676,8 @@ function pipe(readableStream, writableStream) {
 
 // bom-export.ts
 function bomExportPath(appId, format) {
-  const root = process.env.FLOLESS_HOME ?? (0, import_node_path15.join)((0, import_node_os12.homedir)(), ".floless");
-  return (0, import_node_path15.join)(root, "exports", appId, `${appId}-bom.${format}`);
+  const root = process.env.FLOLESS_HOME ?? (0, import_node_path16.join)((0, import_node_os13.homedir)(), ".floless");
+  return (0, import_node_path16.join)(root, "exports", appId, `${appId}-bom.${format}`);
 }
 function csvField(v) {
   let s = String(v);
@@ -58604,11 +58705,11 @@ async function bomToXlsx(bom) {
 }
 
 // scene-bake.ts
-var import_node_fs19 = require("node:fs");
-var import_node_path16 = require("node:path");
+var import_node_fs20 = require("node:fs");
+var import_node_path17 = require("node:path");
 var import_yaml6 = __toESM(require_dist6(), 1);
 function bakeSceneIntoApp(sourcePath, scene, agent = "viewer-3d") {
-  const doc = (0, import_yaml6.parseDocument)((0, import_node_fs19.readFileSync)(sourcePath, "utf8"));
+  const doc = (0, import_yaml6.parseDocument)((0, import_node_fs20.readFileSync)(sourcePath, "utf8"));
   if (doc.errors.length > 0) {
     throw new Error(`scene bake: source is not valid YAML: ${doc.errors[0]?.message ?? "parse error"}`);
   }
@@ -58617,10 +58718,10 @@ function bakeSceneIntoApp(sourcePath, scene, agent = "viewer-3d") {
   const idx = items.findIndex((it) => ((0, import_yaml6.isMap)(it) ? it.toJSON() : null)?.agent === agent);
   if (idx < 0) throw new Error(`no ${agent} render node to bake the scene into`);
   doc.setIn(["nodes", idx, "config", "scene"], scene);
-  (0, import_node_fs19.writeFileSync)(sourcePath, doc.toString());
+  (0, import_node_fs20.writeFileSync)(sourcePath, doc.toString());
 }
-function bakeNodeConfigById(sourcePath, nodeId, patch) {
-  const doc = (0, import_yaml6.parseDocument)((0, import_node_fs19.readFileSync)(sourcePath, "utf8"));
+function bakeNodeConfigById(sourcePath, nodeId, patch2) {
+  const doc = (0, import_yaml6.parseDocument)((0, import_node_fs20.readFileSync)(sourcePath, "utf8"));
   if (doc.errors.length > 0) {
     throw new Error(`node bake: source is not valid YAML: ${doc.errors[0]?.message ?? "parse error"}`);
   }
@@ -58628,13 +58729,13 @@ function bakeNodeConfigById(sourcePath, nodeId, patch) {
   const items = (0, import_yaml6.isSeq)(seq) ? seq.items : [];
   const idx = items.findIndex((it) => ((0, import_yaml6.isMap)(it) ? it.toJSON() : null)?.id === nodeId);
   if (idx < 0) throw new Error(`no node with id "${nodeId}"`);
-  for (const [key, value] of Object.entries(patch)) doc.setIn(["nodes", idx, "config", key], value);
-  (0, import_node_fs19.writeFileSync)(sourcePath, doc.toString());
+  for (const [key, value] of Object.entries(patch2)) doc.setIn(["nodes", idx, "config", key], value);
+  (0, import_node_fs20.writeFileSync)(sourcePath, doc.toString());
 }
 function writeViewer3dApp(dir, appId, scene) {
-  (0, import_node_fs19.mkdirSync)(dir, { recursive: true });
-  const flo = (0, import_node_path16.join)(dir, `${appId}.flo`);
-  (0, import_node_fs19.writeFileSync)(flo, [
+  (0, import_node_fs20.mkdirSync)(dir, { recursive: true });
+  const flo = (0, import_node_path17.join)(dir, `${appId}.flo`);
+  (0, import_node_fs20.writeFileSync)(flo, [
     `app: ${appId}`,
     "version: 0.1.0",
     "display-name: Steel 3D",
@@ -58655,9 +58756,9 @@ function writeViewer3dApp(dir, appId, scene) {
   return flo;
 }
 function writeIfcApp(dir, appId, scene, outputPath) {
-  (0, import_node_fs19.mkdirSync)(dir, { recursive: true });
-  const flo = (0, import_node_path16.join)(dir, `${appId}.flo`);
-  (0, import_node_fs19.writeFileSync)(flo, [
+  (0, import_node_fs20.mkdirSync)(dir, { recursive: true });
+  const flo = (0, import_node_path17.join)(dir, `${appId}.flo`);
+  (0, import_node_fs20.writeFileSync)(flo, [
     `app: ${appId}`,
     "version: 0.1.0",
     "display-name: Steel IFC",
@@ -58680,9 +58781,9 @@ function writeIfcApp(dir, appId, scene, outputPath) {
   return flo;
 }
 function writeTeklaApp(dir, appId, scene, teklaVersion = "2026.0") {
-  (0, import_node_fs19.mkdirSync)(dir, { recursive: true });
-  const flo = (0, import_node_path16.join)(dir, `${appId}.flo`);
-  (0, import_node_fs19.writeFileSync)(flo, [
+  (0, import_node_fs20.mkdirSync)(dir, { recursive: true });
+  const flo = (0, import_node_path17.join)(dir, `${appId}.flo`);
+  (0, import_node_fs20.writeFileSync)(flo, [
     `app: ${appId}`,
     "version: 0.1.0",
     "display-name: Steel to Tekla",
@@ -58721,11 +58822,11 @@ async function bakeBomExportNodes(sourcePath, appId, contract) {
     xlsx: bom ? (await bomToXlsx(bom)).toString("base64") : null
   };
   for (const { id, format } of EXPORT_NODES) {
-    const patch = { path: bomExportPath(appId, format) };
+    const patch2 = { path: bomExportPath(appId, format) };
     const bytes = bytesFor[format];
-    if (bytes != null) patch.bytes = bytes;
+    if (bytes != null) patch2.bytes = bytes;
     try {
-      bakeNodeConfigById(sourcePath, id, patch);
+      bakeNodeConfigById(sourcePath, id, patch2);
       baked.push(id);
     } catch (e) {
       if (!(e instanceof Error && /no node with id/.test(e.message))) throw e;
@@ -59081,13 +59182,13 @@ function scoreContract2(contractInput) {
 }
 
 // app-lifecycle.ts
-var import_node_fs22 = require("node:fs");
-var import_node_os14 = require("node:os");
-var import_node_path19 = require("node:path");
+var import_node_fs23 = require("node:fs");
+var import_node_os15 = require("node:os");
+var import_node_path20 = require("node:path");
 
 // routines.ts
-var import_node_fs21 = require("node:fs");
-var import_node_path18 = require("node:path");
+var import_node_fs22 = require("node:fs");
+var import_node_path19 = require("node:path");
 
 // sse.ts
 var clients = /* @__PURE__ */ new Set();
@@ -59124,11 +59225,11 @@ function clientCount() {
 }
 
 // trigger-sessions.ts
-var import_node_fs20 = require("node:fs");
-var import_node_os13 = require("node:os");
-var import_node_path17 = require("node:path");
+var import_node_fs21 = require("node:fs");
+var import_node_os14 = require("node:os");
+var import_node_path18 = require("node:path");
 var import_yaml7 = __toESM(require_dist6(), 1);
-var AGENTS_DIR2 = process.env.AWARE_HOME ? (0, import_node_path17.join)(process.env.AWARE_HOME, "agents") : (0, import_node_path17.join)((0, import_node_os13.homedir)(), ".aware", "agents");
+var AGENTS_DIR2 = process.env.AWARE_HOME ? (0, import_node_path18.join)(process.env.AWARE_HOME, "agents") : (0, import_node_path18.join)((0, import_node_os14.homedir)(), ".aware", "agents");
 function summarizeFire(data) {
   if (!data) return "event";
   const type = typeof data.type === "string" ? data.type : "";
@@ -59145,10 +59246,10 @@ function mapTriggerState(phase) {
 function isHostBacked(agent, agentsDir = AGENTS_DIR2) {
   const safe = (n) => !n.includes("/") && !n.includes("\\") && !n.includes("..");
   if (!safe(agent)) return false;
-  const manifestPath = (0, import_node_path17.join)(agentsDir, agent, "manifest.yaml");
-  if (!(0, import_node_fs20.existsSync)(manifestPath)) return false;
+  const manifestPath = (0, import_node_path18.join)(agentsDir, agent, "manifest.yaml");
+  if (!(0, import_node_fs21.existsSync)(manifestPath)) return false;
   try {
-    const doc = (0, import_yaml7.parse)((0, import_node_fs20.readFileSync)(manifestPath, "utf8"));
+    const doc = (0, import_yaml7.parse)((0, import_node_fs21.readFileSync)(manifestPath, "utf8"));
     const transport = doc?.transport;
     return !!(transport && typeof transport === "object" && "cli" in transport);
   } catch {
@@ -59433,7 +59534,7 @@ var RoutineError = class extends Error {
   }
   status;
 };
-var ROUTINES_FILE = (0, import_node_path18.join)(flolessRoot, "routines.json");
+var ROUTINES_FILE = (0, import_node_path19.join)(flolessRoot, "routines.json");
 var routines = [];
 var loaded = false;
 function ensureLoaded() {
@@ -59469,10 +59570,10 @@ function sanitizeRoutine(raw) {
   };
 }
 function loadFromDisk() {
-  if (!(0, import_node_fs21.existsSync)(ROUTINES_FILE)) return [];
+  if (!(0, import_node_fs22.existsSync)(ROUTINES_FILE)) return [];
   let text;
   try {
-    text = (0, import_node_fs21.readFileSync)(ROUTINES_FILE, "utf8");
+    text = (0, import_node_fs22.readFileSync)(ROUTINES_FILE, "utf8");
   } catch {
     return [];
   }
@@ -59481,17 +59582,17 @@ function loadFromDisk() {
     return Array.isArray(parsed) ? parsed.map(sanitizeRoutine).filter((r) => r !== null) : [];
   } catch {
     try {
-      (0, import_node_fs21.renameSync)(ROUTINES_FILE, `${ROUTINES_FILE}.corrupt-${Date.now()}`);
+      (0, import_node_fs22.renameSync)(ROUTINES_FILE, `${ROUTINES_FILE}.corrupt-${Date.now()}`);
     } catch {
     }
     return [];
   }
 }
 function saveRoutines() {
-  if (!(0, import_node_fs21.existsSync)(flolessRoot)) (0, import_node_fs21.mkdirSync)(flolessRoot, { recursive: true });
+  if (!(0, import_node_fs22.existsSync)(flolessRoot)) (0, import_node_fs22.mkdirSync)(flolessRoot, { recursive: true });
   const tmp = `${ROUTINES_FILE}.${process.pid}.tmp`;
-  (0, import_node_fs21.writeFileSync)(tmp, JSON.stringify(routines, null, 2));
-  (0, import_node_fs21.renameSync)(tmp, ROUTINES_FILE);
+  (0, import_node_fs22.writeFileSync)(tmp, JSON.stringify(routines, null, 2));
+  (0, import_node_fs22.renameSync)(tmp, ROUTINES_FILE);
 }
 function listRoutines() {
   ensureLoaded();
@@ -59648,30 +59749,30 @@ function createRoutine(input) {
   broadcast({ type: "routine-changed", id: r.id });
   return r;
 }
-function updateRoutine(id, patch) {
+function updateRoutine(id, patch2) {
   ensureLoaded();
   const r = getRoutine(id);
   if (!r) return null;
-  if (patch.name !== void 0) {
-    const name = String(patch.name).trim();
+  if (patch2.name !== void 0) {
+    const name = String(patch2.name).trim();
     if (!name) throw new RoutineError("name cannot be empty");
     r.name = name;
   }
-  if (patch.schedule !== void 0) {
+  if (patch2.schedule !== void 0) {
     if (r.kind !== "schedule") throw new RoutineError("cannot set a schedule on a trigger routine");
-    const err2 = validateSchedule(patch.schedule);
+    const err2 = validateSchedule(patch2.schedule);
     if (err2) throw new RoutineError(err2);
-    r.schedule = patch.schedule;
+    r.schedule = patch2.schedule;
   }
-  if (patch.inputs !== void 0) {
+  if (patch2.inputs !== void 0) {
     const app = requireApp(r.workflow);
-    r.inputs = coerceInputs(app, patch.inputs);
+    r.inputs = coerceInputs(app, patch2.inputs);
   }
-  if (patch.enabled !== void 0) r.enabled = !!patch.enabled;
+  if (patch2.enabled !== void 0) r.enabled = !!patch2.enabled;
   r.updated = (/* @__PURE__ */ new Date()).toISOString();
   r.nextFireAt = computeNextFire(r);
   saveRoutines();
-  if (r.kind === "trigger" && (patch.enabled !== void 0 || patch.inputs !== void 0)) {
+  if (r.kind === "trigger" && (patch2.enabled !== void 0 || patch2.inputs !== void 0)) {
     syncTriggerSession(r);
   }
   broadcast({ type: "routine-changed", id: r.id });
@@ -59899,13 +60000,13 @@ var AppLifecycleError = class extends Error {
   }
 };
 function appsDir() {
-  return process.env.AWARE_HOME ? (0, import_node_path19.join)(process.env.AWARE_HOME, "apps") : (0, import_node_path19.join)((0, import_node_os14.homedir)(), ".aware", "apps");
+  return process.env.AWARE_HOME ? (0, import_node_path20.join)(process.env.AWARE_HOME, "apps") : (0, import_node_path20.join)((0, import_node_os15.homedir)(), ".aware", "apps");
 }
 function appDirPath(id) {
-  return (0, import_node_path19.join)(appsDir(), id);
+  return (0, import_node_path20.join)(appsDir(), id);
 }
 function appInstalled(id) {
-  return APP_ID3.test(id) && (0, import_node_fs22.existsSync)(appDirPath(id));
+  return APP_ID3.test(id) && (0, import_node_fs23.existsSync)(appDirPath(id));
 }
 function logCascade(what, e) {
   console.error(`[app-lifecycle] cascade step failed (${what}):`, e instanceof Error ? e.message : e);
@@ -59943,6 +60044,11 @@ async function renameApp(oldId, newId, deps = defaultDeps2) {
   } catch (e) {
     logCascade("re-point routines", e);
   }
+  try {
+    renameOrigin(oldId, newId);
+  } catch (e) {
+    logCascade("carry lineage", e);
+  }
   return { id: newId, compiled };
 }
 async function duplicateApp(srcId, newId, deps = defaultDeps2) {
@@ -59955,6 +60061,11 @@ async function duplicateApp(srcId, newId, deps = defaultDeps2) {
   } catch (e) {
     logCascade("copy visual inputs", e);
   }
+  try {
+    copyOrigin(srcId, newId);
+  } catch (e) {
+    logCascade("copy lineage", e);
+  }
   return { id: newId, compiled };
 }
 async function deleteApp(id, deps = defaultDeps2) {
@@ -59970,6 +60081,11 @@ async function deleteApp(id, deps = defaultDeps2) {
   } catch (e) {
     logCascade("remove routines", e);
   }
+  try {
+    deleteOrigin(id);
+  } catch (e) {
+    logCascade("drop lineage", e);
+  }
 }
 
 // route-gate.ts
@@ -60006,9 +60122,9 @@ function isGatedAwareRoute(url, method) {
 
 // autostart.mjs
 var import_node_child_process4 = require("node:child_process");
-var import_node_fs23 = require("node:fs");
-var import_node_os15 = require("node:os");
-var import_node_path20 = require("node:path");
+var import_node_fs24 = require("node:fs");
+var import_node_os16 = require("node:os");
+var import_node_path21 = require("node:path");
 
 // teardown.mjs
 var RUN_KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run";
@@ -60120,8 +60236,8 @@ function removeLegacyRunKey() {
 }
 function logLine(msg) {
   try {
-    (0, import_node_fs23.mkdirSync)(logDir(), { recursive: true });
-    (0, import_node_fs23.appendFileSync)(logFilePath(), `${(/* @__PURE__ */ new Date()).toISOString()} ${msg}
+    (0, import_node_fs24.mkdirSync)(logDir(), { recursive: true });
+    (0, import_node_fs24.appendFileSync)(logFilePath(), `${(/* @__PURE__ */ new Date()).toISOString()} ${msg}
 `);
   } catch {
   }
@@ -60129,8 +60245,8 @@ function logLine(msg) {
 function registerAutostart(exePath) {
   if (!isWin) return;
   const xml = buildAutostartTaskXml(exePath, currentUserId());
-  const tmp = (0, import_node_path20.join)((0, import_node_os15.tmpdir)(), `floless-autostart-${process.pid}-${Date.now()}.xml`);
-  (0, import_node_fs23.writeFileSync)(tmp, "\uFEFF" + xml, { encoding: "utf16le" });
+  const tmp = (0, import_node_path21.join)((0, import_node_os16.tmpdir)(), `floless-autostart-${process.pid}-${Date.now()}.xml`);
+  (0, import_node_fs24.writeFileSync)(tmp, "\uFEFF" + xml, { encoding: "utf16le" });
   try {
     (0, import_node_child_process4.execFileSync)("schtasks", ["/Create", "/TN", TASK_NAME, "/XML", tmp, "/F"], {
       stdio: ["ignore", "ignore", "ignore"],
@@ -60141,7 +60257,7 @@ function registerAutostart(exePath) {
     throw err2;
   } finally {
     try {
-      (0, import_node_fs23.rmSync)(tmp, { force: true });
+      (0, import_node_fs24.rmSync)(tmp, { force: true });
     } catch {
     }
   }
@@ -60176,26 +60292,26 @@ function unregisterAutostart() {
 // updater.ts
 var import_node_child_process5 = require("node:child_process");
 var import_node_crypto6 = require("node:crypto");
-var import_node_fs25 = require("node:fs");
+var import_node_fs26 = require("node:fs");
 var import_node_stream3 = require("node:stream");
 var import_promises = require("node:stream/promises");
-var import_node_path22 = require("node:path");
+var import_node_path23 = require("node:path");
 
 // post-update-marker.mjs
-var import_node_fs24 = require("node:fs");
-var import_node_os16 = require("node:os");
-var import_node_path21 = require("node:path");
+var import_node_fs25 = require("node:fs");
+var import_node_os17 = require("node:os");
+var import_node_path22 = require("node:path");
 var FRESH_MS = 12e4;
 function markerPath() {
   const override = (process.env.FLOLESS_POST_UPDATE_MARKER ?? "").trim();
   if (override) return override;
-  const root = process.env.FLOLESS_HOME ?? (0, import_node_path21.join)((0, import_node_os16.homedir)(), ".floless");
-  return (0, import_node_path21.join)(root, ".post-update");
+  const root = process.env.FLOLESS_HOME ?? (0, import_node_path22.join)((0, import_node_os17.homedir)(), ".floless");
+  return (0, import_node_path22.join)(root, ".post-update");
 }
 function legacyMarkerPath() {
   if ((process.env.FLOLESS_POST_UPDATE_MARKER ?? "").trim()) return null;
   try {
-    return (0, import_node_path21.join)((0, import_node_path21.dirname)((0, import_node_path21.dirname)(process.execPath)), ".floless-post-update");
+    return (0, import_node_path22.join)((0, import_node_path22.dirname)((0, import_node_path22.dirname)(process.execPath)), ".floless-post-update");
   } catch {
     return null;
   }
@@ -60205,7 +60321,7 @@ function writePostUpdateMarker() {
   for (const p of [markerPath(), legacyMarkerPath()]) {
     if (!p) continue;
     try {
-      (0, import_node_fs24.writeFileSync)(p, (/* @__PURE__ */ new Date()).toISOString());
+      (0, import_node_fs25.writeFileSync)(p, (/* @__PURE__ */ new Date()).toISOString());
       wrote = true;
     } catch {
     }
@@ -60217,9 +60333,9 @@ function consumePostUpdateMarker() {
   for (const p of [markerPath(), legacyMarkerPath()]) {
     if (!p) continue;
     try {
-      if (!(0, import_node_fs24.existsSync)(p)) continue;
-      const ageMs = Date.now() - (0, import_node_fs24.statSync)(p).mtimeMs;
-      (0, import_node_fs24.rmSync)(p, { force: true });
+      if (!(0, import_node_fs25.existsSync)(p)) continue;
+      const ageMs = Date.now() - (0, import_node_fs25.statSync)(p).mtimeMs;
+      (0, import_node_fs25.rmSync)(p, { force: true });
       if (ageMs < FRESH_MS) fresh = true;
     } catch {
     }
@@ -60236,13 +60352,13 @@ function currentVersion() {
   return appVersion();
 }
 function installRoot() {
-  return (0, import_node_path22.dirname)((0, import_node_path22.dirname)(process.execPath));
+  return (0, import_node_path23.dirname)((0, import_node_path23.dirname)(process.execPath));
 }
 function updateExePath() {
-  return (0, import_node_path22.join)(installRoot(), "Update.exe");
+  return (0, import_node_path23.join)(installRoot(), "Update.exe");
 }
 function packagesDir() {
-  return (0, import_node_path22.join)(installRoot(), "packages");
+  return (0, import_node_path23.join)(installRoot(), "packages");
 }
 function feedUrl() {
   const env2 = (process.env.FLOLESS_UPDATE_URL ?? "").trim().replace(/\/+$/, "");
@@ -60335,22 +60451,22 @@ async function checkForUpdate() {
 }
 async function sha1OfFile(path) {
   const hash = (0, import_node_crypto6.createHash)("sha1");
-  await (0, import_promises.pipeline)((0, import_node_fs25.createReadStream)(path), hash);
+  await (0, import_promises.pipeline)((0, import_node_fs26.createReadStream)(path), hash);
   return hash.digest("hex").toUpperCase();
 }
 async function downloadPackage(asset) {
   if (!NUPKG_NAME.test(asset.FileName)) throw new Error(`refusing suspicious package name: ${asset.FileName}`);
   const want = asset.SHA1.toUpperCase();
   const dir = packagesDir();
-  (0, import_node_fs25.mkdirSync)(dir, { recursive: true });
-  const dest = (0, import_node_path22.join)(dir, asset.FileName);
-  if ((0, import_node_fs25.existsSync)(dest) && await sha1OfFile(dest) === want) return dest;
+  (0, import_node_fs26.mkdirSync)(dir, { recursive: true });
+  const dest = (0, import_node_path23.join)(dir, asset.FileName);
+  if ((0, import_node_fs26.existsSync)(dest) && await sha1OfFile(dest) === want) return dest;
   const res = await authedFetch(`${feedUrl()}/${encodeURIComponent(asset.FileName)}`, {
     redirect: "follow",
     signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS)
   });
   if (!res.ok || !res.body) throw new Error(`download failed: HTTP ${res.status} for ${asset.FileName}`);
-  await (0, import_promises.pipeline)(import_node_stream3.Readable.fromWeb(res.body), (0, import_node_fs25.createWriteStream)(dest));
+  await (0, import_promises.pipeline)(import_node_stream3.Readable.fromWeb(res.body), (0, import_node_fs26.createWriteStream)(dest));
   const got = await sha1OfFile(dest);
   if (got !== want) throw new Error(`SHA1 mismatch for ${asset.FileName}: feed=${want} got=${got}`);
   return dest;
@@ -60359,7 +60475,7 @@ async function applyUpdate(check, opts) {
   if (!check.supported) return { applied: false, message: check.reason ?? "auto-update not supported in this runtime" };
   if (!check.updateAvailable || !check.asset) return { applied: false, message: check.reason ?? "no update available" };
   const exe = updateExePath();
-  if (!(0, import_node_fs25.existsSync)(exe)) {
+  if (!(0, import_node_fs26.existsSync)(exe)) {
     return { applied: false, message: `Update.exe not found at ${exe} \u2014 is this a Velopack install?` };
   }
   const pkg = await downloadPackage(check.asset);
@@ -60599,12 +60715,12 @@ function isTraceCorrupt(events) {
 
 // launch.mjs
 var import_node_child_process6 = require("node:child_process");
-var import_node_path23 = require("node:path");
+var import_node_path24 = require("node:path");
 var import_node_url3 = require("node:url");
-var import_node_fs26 = require("node:fs");
+var import_node_fs27 = require("node:fs");
 var import_node_http = __toESM(require("node:http"), 1);
 var import_node_readline = require("node:readline");
-var __dirname2 = (0, import_node_path23.dirname)((0, import_node_url3.fileURLToPath)(__import_meta_url));
+var __dirname2 = (0, import_node_path24.dirname)((0, import_node_url3.fileURLToPath)(__import_meta_url));
 var PORT = Number(process.env.PORT ?? 4317);
 var HEALTH_URL = `http://127.0.0.1:${PORT}/api/health`;
 var BROWSER_URL = `http://floless.localhost:${PORT}`;
@@ -60676,8 +60792,8 @@ async function waitHealthy(timeoutMs = 3e4) {
 function resolveServerStart() {
   const packaged = /flolessapp\.exe$/i.test(process.execPath);
   if (packaged) return { cmd: process.execPath, args: ["--serve"], shell: false };
-  const bundle = (0, import_node_path23.join)(__dirname2, "dist", "floless-server.cjs");
-  if ((0, import_node_fs26.existsSync)(bundle)) return { cmd: process.execPath, args: [bundle, "--serve"], shell: false };
+  const bundle = (0, import_node_path24.join)(__dirname2, "dist", "floless-server.cjs");
+  if ((0, import_node_fs27.existsSync)(bundle)) return { cmd: process.execPath, args: [bundle, "--serve"], shell: false };
   return { cmd: "npm", args: ["run", "start"], shell: isWin2 };
 }
 function startServerDetached() {
@@ -60830,8 +60946,8 @@ function taskkillArgs(pid, { tree = true } = {}) {
 }
 function killSupervisor({ tree = true } = {}) {
   if (!isWin2) return;
-  const isNpmChannel = /^node(\.exe)?$/i.test((0, import_node_path23.basename)(process.execPath));
-  const scriptMatch = isNpmChannel ? (0, import_node_path23.basename)((0, import_node_url3.fileURLToPath)(__import_meta_url)) : void 0;
+  const isNpmChannel = /^node(\.exe)?$/i.test((0, import_node_path24.basename)(process.execPath));
+  const scriptMatch = isNpmChannel ? (0, import_node_path24.basename)((0, import_node_url3.fileURLToPath)(__import_meta_url)) : void 0;
   const realExe = resolveRealInstallExe(process.execPath);
   const exeMatch = realExe === process.execPath ? process.execPath : [process.execPath, realExe];
   const pids = supervisorPidsToKill(enumerateProcesses(), process.pid, exeMatch, scriptMatch);
@@ -60996,7 +61112,7 @@ async function runAction(arg, flagArgv = [], selfVersion = null) {
   }
   await action(parseTeardownFlags(flagArgv));
 }
-var entry = (0, import_node_path23.basename)(process.argv[1] ?? "").toLowerCase();
+var entry = (0, import_node_path24.basename)(process.argv[1] ?? "").toLowerCase();
 if (entry === "launch.mjs") {
   runAction(process.argv[2], process.argv.slice(3)).catch((e) => {
     log(`error: ${e?.message ?? e}`);
@@ -61070,9 +61186,9 @@ function awareUpgradeBlockReason(s) {
 }
 
 // skill-sync.ts
-var import_node_fs27 = require("node:fs");
-var import_node_os17 = require("node:os");
-var import_node_path24 = require("node:path");
+var import_node_fs28 = require("node:fs");
+var import_node_os18 = require("node:os");
+var import_node_path25 = require("node:path");
 var import_node_url4 = require("node:url");
 var import_yaml8 = __toESM(require_dist6(), 1);
 
@@ -61113,30 +61229,30 @@ function selectShippedSkillNames(names) {
 }
 
 // skill-sync.ts
-var __dirname3 = (0, import_node_path24.dirname)((0, import_node_url4.fileURLToPath)(__import_meta_url));
+var __dirname3 = (0, import_node_path25.dirname)((0, import_node_url4.fileURLToPath)(__import_meta_url));
 function bundledSkillsRoot() {
   const candidates = [
-    (0, import_node_path24.join)(__dirname3, "skills"),
-    (0, import_node_path24.join)((0, import_node_path24.dirname)(process.execPath), "skills"),
-    (0, import_node_path24.join)(__dirname3, "..", ".claude", "skills")
+    (0, import_node_path25.join)(__dirname3, "skills"),
+    (0, import_node_path25.join)((0, import_node_path25.dirname)(process.execPath), "skills"),
+    (0, import_node_path25.join)(__dirname3, "..", ".claude", "skills")
   ];
-  return candidates.find((p) => (0, import_node_fs27.existsSync)(p)) ?? null;
+  return candidates.find((p) => (0, import_node_fs28.existsSync)(p)) ?? null;
 }
 function targetConfigDirs() {
   const override = process.env.FLOLESS_SKILL_TARGETS;
   if (override) {
     return override.split(";").map((d) => d.trim()).filter(Boolean).map((dir) => ({ runtime: "custom", dir }));
   }
-  const home = (0, import_node_os17.homedir)();
+  const home = (0, import_node_os18.homedir)();
   return [
-    { runtime: "claude", dir: (0, import_node_path24.join)(home, ".claude") },
-    { runtime: "codex", dir: (0, import_node_path24.join)(home, ".codex") },
-    { runtime: "opencode", dir: (0, import_node_path24.join)(home, ".opencode") }
+    { runtime: "claude", dir: (0, import_node_path25.join)(home, ".claude") },
+    { runtime: "codex", dir: (0, import_node_path25.join)(home, ".codex") },
+    { runtime: "opencode", dir: (0, import_node_path25.join)(home, ".opencode") }
   ];
 }
 function skillVersion(skillMdPath) {
   try {
-    const text = (0, import_node_fs27.readFileSync)(skillMdPath, "utf8");
+    const text = (0, import_node_fs28.readFileSync)(skillMdPath, "utf8");
     const m = /^---\r?\n([\s\S]*?)\r?\n---/.exec(text);
     if (!m || m[1] === void 0) return null;
     const fm = (0, import_yaml8.parse)(m[1]);
@@ -61176,21 +61292,21 @@ function decideAction(installed, bundled) {
 function bundledSkills(root) {
   let entries = [];
   try {
-    entries = selectShippedSkillNames((0, import_node_fs27.readdirSync)(root));
+    entries = selectShippedSkillNames((0, import_node_fs28.readdirSync)(root));
   } catch {
     return [];
   }
   const out = [];
   for (const name of entries) {
-    const dir = (0, import_node_path24.join)(root, name);
+    const dir = (0, import_node_path25.join)(root, name);
     let isDir = false;
     try {
-      isDir = (0, import_node_fs27.statSync)(dir).isDirectory();
+      isDir = (0, import_node_fs28.statSync)(dir).isDirectory();
     } catch {
       isDir = false;
     }
     if (!isDir) continue;
-    const v = skillVersion((0, import_node_path24.join)(dir, "SKILL.md"));
+    const v = skillVersion((0, import_node_path25.join)(dir, "SKILL.md"));
     if (!v) continue;
     out.push({ name, dir, version: v });
   }
@@ -61203,17 +61319,17 @@ function syncSkills() {
   const skills = bundledSkills(root);
   if (!skills.length) return results;
   for (const { runtime, dir: cfg } of targetConfigDirs()) {
-    if (!(0, import_node_fs27.existsSync)(cfg)) continue;
-    const skillsDir = (0, import_node_path24.join)(cfg, "skills");
+    if (!(0, import_node_fs28.existsSync)(cfg)) continue;
+    const skillsDir = (0, import_node_path25.join)(cfg, "skills");
     for (const s of skills) {
-      const dest = (0, import_node_path24.join)(skillsDir, s.name);
-      const installedMd = (0, import_node_path24.join)(dest, "SKILL.md");
-      const installed = (0, import_node_fs27.existsSync)(installedMd) ? skillVersion(installedMd) : null;
+      const dest = (0, import_node_path25.join)(skillsDir, s.name);
+      const installedMd = (0, import_node_path25.join)(dest, "SKILL.md");
+      const installed = (0, import_node_fs28.existsSync)(installedMd) ? skillVersion(installedMd) : null;
       const action = decideAction(installed, s.version);
       if (action === "installed" || action === "updated") {
         try {
-          if (action === "updated") (0, import_node_fs27.rmSync)(dest, { recursive: true, force: true });
-          (0, import_node_fs27.cpSync)(s.dir, dest, { recursive: true });
+          if (action === "updated") (0, import_node_fs28.rmSync)(dest, { recursive: true, force: true });
+          (0, import_node_fs28.cpSync)(s.dir, dest, { recursive: true });
           results.push({ runtime, skill: s.name, action, from: installed, to: s.version });
         } catch {
         }
@@ -61226,9 +61342,9 @@ function syncSkills() {
 }
 
 // watch.ts
-var import_node_os18 = require("node:os");
-var import_node_path26 = require("node:path");
-var import_node_fs28 = require("node:fs");
+var import_node_os19 = require("node:os");
+var import_node_path27 = require("node:path");
+var import_node_fs29 = require("node:fs");
 
 // node_modules/chokidar/esm/index.js
 var import_fs2 = require("fs");
@@ -61239,7 +61355,7 @@ var sysPath2 = __toESM(require("path"), 1);
 // node_modules/readdirp/esm/index.js
 var import_promises2 = require("node:fs/promises");
 var import_node_stream4 = require("node:stream");
-var import_node_path25 = require("node:path");
+var import_node_path26 = require("node:path");
 var EntryTypes = {
   FILE_TYPE: "files",
   DIR_TYPE: "directories",
@@ -61314,7 +61430,7 @@ var ReaddirpStream = class extends import_node_stream4.Readable {
     this._wantsDir = type ? DIR_TYPES.has(type) : false;
     this._wantsFile = type ? FILE_TYPES.has(type) : false;
     this._wantsEverything = type === EntryTypes.EVERYTHING_TYPE;
-    this._root = (0, import_node_path25.resolve)(root);
+    this._root = (0, import_node_path26.resolve)(root);
     this._isDirent = !opts.alwaysStat;
     this._statsProp = this._isDirent ? "dirent" : "stats";
     this._rdOptions = { encoding: "utf8", withFileTypes: this._isDirent };
@@ -61385,8 +61501,8 @@ var ReaddirpStream = class extends import_node_stream4.Readable {
     let entry2;
     const basename5 = this._isDirent ? dirent.name : dirent;
     try {
-      const fullPath = (0, import_node_path25.resolve)((0, import_node_path25.join)(path, basename5));
-      entry2 = { path: (0, import_node_path25.relative)(this._root, fullPath), fullPath, basename: basename5 };
+      const fullPath = (0, import_node_path26.resolve)((0, import_node_path26.join)(path, basename5));
+      entry2 = { path: (0, import_node_path26.relative)(this._root, fullPath), fullPath, basename: basename5 };
       entry2[this._statsProp] = this._isDirent ? dirent : await this._stat(fullPath);
     } catch (err2) {
       this._onError(err2);
@@ -61420,7 +61536,7 @@ var ReaddirpStream = class extends import_node_stream4.Readable {
         }
         if (entryRealPathStats.isDirectory()) {
           const len2 = entryRealPath.length;
-          if (full.startsWith(entryRealPath) && full.substr(len2, 1) === import_node_path25.sep) {
+          if (full.startsWith(entryRealPath) && full.substr(len2, 1) === import_node_path26.sep) {
             const recursiveError = new Error(`Circular symlink detected: "${full}" points to "${entryRealPath}"`);
             recursiveError.code = RECURSIVE_ERROR_CODE;
             return this._onError(recursiveError);
@@ -61959,9 +62075,9 @@ var NodeFsHandler = class {
     if (this.fsw.closed) {
       return;
     }
-    const dirname12 = sysPath.dirname(file);
+    const dirname13 = sysPath.dirname(file);
     const basename5 = sysPath.basename(file);
-    const parent = this.fsw._getWatchedDir(dirname12);
+    const parent = this.fsw._getWatchedDir(dirname13);
     let prevStats = stats;
     if (parent.has(basename5))
       return;
@@ -61988,7 +62104,7 @@ var NodeFsHandler = class {
             prevStats = newStats2;
           }
         } catch (error) {
-          this.fsw._remove(dirname12, basename5);
+          this.fsw._remove(dirname13, basename5);
         }
       } else if (parent.has(basename5)) {
         const at = newStats.atimeMs;
@@ -62928,33 +63044,33 @@ function appIdFromLogPath(path) {
   return i >= 0 && parts[i + 1] ? parts[i + 1] : null;
 }
 function samePath(a, b) {
-  const ra = (0, import_node_path26.resolve)(a);
-  const rb = (0, import_node_path26.resolve)(b);
+  const ra = (0, import_node_path27.resolve)(a);
+  const rb = (0, import_node_path27.resolve)(b);
   return process.platform === "win32" ? ra.toLowerCase() === rb.toLowerCase() : ra === rb;
 }
 function underDir(path, dir) {
-  const rp = (0, import_node_path26.resolve)(path);
-  const rd = (0, import_node_path26.resolve)(dir);
+  const rp = (0, import_node_path27.resolve)(path);
+  const rd = (0, import_node_path27.resolve)(dir);
   const [p, d] = process.platform === "win32" ? [rp.toLowerCase(), rd.toLowerCase()] : [rp, rd];
-  return p === d || p.startsWith(d + import_node_path26.sep);
+  return p === d || p.startsWith(d + import_node_path27.sep);
 }
 function startWatcher() {
-  const awareDir = process.env.AWARE_HOME ?? (0, import_node_path26.join)((0, import_node_os18.homedir)(), ".aware");
-  const credentialsDir = (0, import_node_path26.join)(awareDir, "credentials");
-  if (!(0, import_node_fs28.existsSync)(credentialsDir)) {
+  const awareDir = process.env.AWARE_HOME ?? (0, import_node_path27.join)((0, import_node_os19.homedir)(), ".aware");
+  const credentialsDir = (0, import_node_path27.join)(awareDir, "credentials");
+  if (!(0, import_node_fs29.existsSync)(credentialsDir)) {
     try {
-      (0, import_node_fs28.mkdirSync)(credentialsDir, { recursive: true });
+      (0, import_node_fs29.mkdirSync)(credentialsDir, { recursive: true });
     } catch {
     }
   }
-  if (!(0, import_node_fs28.existsSync)(uiDir)) {
+  if (!(0, import_node_fs29.existsSync)(uiDir)) {
     try {
-      (0, import_node_fs28.mkdirSync)(uiDir, { recursive: true });
+      (0, import_node_fs29.mkdirSync)(uiDir, { recursive: true });
     } catch {
     }
   }
-  const targets = ["apps", "logs", "credentials"].map((d) => (0, import_node_path26.join)(awareDir, d)).filter((p) => (0, import_node_fs28.existsSync)(p));
-  if ((0, import_node_fs28.existsSync)(uiDir)) targets.push(uiDir);
+  const targets = ["apps", "logs", "credentials"].map((d) => (0, import_node_path27.join)(awareDir, d)).filter((p) => (0, import_node_fs29.existsSync)(p));
+  if ((0, import_node_fs29.existsSync)(uiDir)) targets.push(uiDir);
   if (targets.length === 0) {
     return null;
   }
@@ -62983,11 +63099,11 @@ function startWatcher() {
     const isCredential = path.split(/[\\/]/).includes("credentials");
     const kind = isCredential ? "credential" : path.endsWith(".jsonl") ? "trace" : path.endsWith(".lock") ? "lock" : path.endsWith(".flo") || path.endsWith(".app") ? "source" : "file";
     broadcast({ type: "fs-change", kind, event, path });
-    if (kind === "trace" && event !== "unlink" && (0, import_node_fs28.existsSync)(path)) {
+    if (kind === "trace" && event !== "unlink" && (0, import_node_fs29.existsSync)(path)) {
       const id = appIdFromLogPath(path);
       if (!id) return;
       try {
-        broadcast({ type: "trace-file", id, runId: path.split(import_node_path26.sep).pop()?.replace(/\.jsonl$/, "") ?? null, events: parseTrace((0, import_node_fs28.readFileSync)(path, "utf8")) });
+        broadcast({ type: "trace-file", id, runId: path.split(import_node_path27.sep).pop()?.replace(/\.jsonl$/, "") ?? null, events: parseTrace((0, import_node_fs29.readFileSync)(path, "utf8")) });
       } catch {
       }
     }
@@ -62996,10 +63112,10 @@ function startWatcher() {
 }
 
 // index.ts
-var __dirname4 = (0, import_node_path27.dirname)((0, import_node_url5.fileURLToPath)(__import_meta_url));
-var WEB_ROOT = [(0, import_node_path27.join)(__dirname4, "web"), (0, import_node_path27.join)((0, import_node_path27.dirname)(process.execPath), "web"), (0, import_node_path27.join)(__dirname4, "..", "web")].find(
-  (p) => (0, import_node_fs29.existsSync)(p)
-) ?? (0, import_node_path27.join)(__dirname4, "..", "web");
+var __dirname4 = (0, import_node_path28.dirname)((0, import_node_url5.fileURLToPath)(__import_meta_url));
+var WEB_ROOT = [(0, import_node_path28.join)(__dirname4, "web"), (0, import_node_path28.join)((0, import_node_path28.dirname)(process.execPath), "web"), (0, import_node_path28.join)(__dirname4, "..", "web")].find(
+  (p) => (0, import_node_fs30.existsSync)(p)
+) ?? (0, import_node_path28.join)(__dirname4, "..", "web");
 var PORT2 = Number(process.env.PORT ?? 4317);
 var HOST = "127.0.0.1";
 var crashHandlersInstalled = false;
@@ -63015,7 +63131,7 @@ function installCrashHandlers() {
 ${stack}
 `;
     try {
-      (0, import_node_fs29.appendFileSync)(logFilePath(), line);
+      (0, import_node_fs30.appendFileSync)(logFilePath(), line);
     } catch {
     }
     if (process.stderr.isTTY) process.stderr.write(line);
@@ -63278,24 +63394,64 @@ async function startServer() {
   });
   app.get("/api/apps", async () => {
     const apps = await aware.list();
-    return { ok: true, apps: apps.map((a) => ({ ...a, provider: appProvider(a.id), baked: appBaked(a.id) })) };
+    return { ok: true, apps: apps.map((a) => ({ ...a, provider: appProvider(a.id), baked: appBaked(a.id), ...appOrigin(a.id) })) };
   });
   app.get("/api/workflows/updates", async () => {
     const apps = await aware.list();
-    const installed = {};
+    const installed = [];
     for (const a of apps) {
       try {
-        installed[a.id] = readApp(a.id).version;
+        const { templateId, forked } = appOrigin(a.id);
+        const app2 = readApp(a.id);
+        installed.push({ id: a.id, version: app2.version, templateId, forked, publisher: app2.publisher });
       } catch {
       }
     }
     return { ok: true, updates: detectUpdates(installed, loadTemplates()) };
   });
   const _wfUpdating = /* @__PURE__ */ new Set();
+  class TemplateSwapError extends Error {
+    code;
+    backupPath;
+    constructor(message, code, backupPath) {
+      super(message);
+      this.name = "TemplateSwapError";
+      this.code = code;
+      this.backupPath = backupPath;
+    }
+  }
+  async function swapTemplateIntoApp(opts) {
+    const { id, templateId, templatePath, srcPath, appDirPath: appDirPath2, fromVersion, contract, verb } = opts;
+    const bdir = backupDir(id, fromVersion, Date.now());
+    try {
+      (0, import_node_fs30.mkdirSync)((0, import_node_path28.dirname)(bdir), { recursive: true });
+      (0, import_node_fs30.cpSync)(appDirPath2, bdir, { recursive: true });
+      (0, import_node_fs30.cpSync)(templatePath, srcPath);
+      if (id !== templateId) stampSourceAppId(srcPath, id);
+      if (contract != null) {
+        bakeContractIntoApp(srcPath, contract);
+        await bakeDownstream(srcPath, id, contract);
+      }
+      await aware.compile(srcPath);
+      return { backupPath: bdir };
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      try {
+        (0, import_node_fs30.rmSync)(appDirPath2, { recursive: true, force: true });
+        (0, import_node_fs30.cpSync)(bdir, appDirPath2, { recursive: true });
+      } catch (re) {
+        const rmsg = re instanceof Error ? re.message : String(re);
+        throw new TemplateSwapError(`${verb} failed (${msg}) AND rollback failed (${rmsg}) \u2014 restore manually from ${bdir}`, "rollback-failed", bdir);
+      }
+      throw new TemplateSwapError(`${verb} failed (rolled back to ${fromVersion}): ${msg}`, `${verb}-failed`);
+    }
+  }
   app.post("/api/workflows/:id/update", async (req, reply) => {
     const id = req.params.id;
-    const t = loadTemplates().find((x) => x.id === id);
-    if (!t) return reply.status(404).send({ ok: false, error: `no bundled template for "${id}"`, code: "no-template" });
+    const { templateId, forked } = appOrigin(id);
+    if (forked) return reply.status(409).send({ ok: false, error: `"${id}" is a fork (off the update channel) \u2014 restore it to the official version first to rejoin`, code: "forked" });
+    const t = loadTemplates().find((x) => x.id === templateId);
+    if (!t) return reply.status(404).send({ ok: false, error: `no bundled template in the lineage of "${id}"`, code: "no-template" });
     if (t.publisher !== "floless") return reply.status(400).send({ ok: false, error: `"${id}" is not a FloLess-published workflow`, code: "not-published" });
     if (_wfUpdating.has(id)) return reply.status(409).send({ ok: false, error: `an update for "${id}" is already in progress`, code: "in-progress" });
     let fromVersion;
@@ -63313,7 +63469,7 @@ async function startServer() {
       return reply.status(409).send({ ok: false, error: `"${id}" is already at ${fromVersion}`, code: "up-to-date" });
     }
     const contract = readContract(id);
-    if (contract == null && (0, import_node_fs29.existsSync)(contractPath(id))) {
+    if (contract == null && (0, import_node_fs30.existsSync)(contractPath(id))) {
       return reply.status(409).send({ ok: false, error: `"${id}"'s saved data is unreadable \u2014 open it in the editor and re-save before updating`, code: "contract-corrupt" });
     }
     if (contract != null) {
@@ -63321,28 +63477,13 @@ async function startServer() {
       if (!v.valid) return reply.status(409).send({ ok: false, error: `"${id}"'s saved data is invalid \u2014 re-save it in the editor before updating`, code: "contract-invalid" });
     }
     _wfUpdating.add(id);
-    const bdir = backupDir(id, fromVersion, Date.now());
     try {
-      (0, import_node_fs29.mkdirSync)((0, import_node_path27.dirname)(bdir), { recursive: true });
-      (0, import_node_fs29.cpSync)(appDirPath2, bdir, { recursive: true });
-      (0, import_node_fs29.cpSync)(t.path, srcPath);
-      if (contract != null) {
-        bakeContractIntoApp(srcPath, contract);
-        await bakeDownstream(srcPath, id, contract);
-      }
-      await aware.compile(srcPath);
+      const { backupPath } = await swapTemplateIntoApp({ id, templateId, templatePath: t.path, srcPath, appDirPath: appDirPath2, fromVersion, contract, verb: "update" });
       broadcast({ type: "apps-changed", id });
-      return { ok: true, id, fromVersion, toVersion: t.version, backupPath: bdir };
+      return { ok: true, id, fromVersion, toVersion: t.version, backupPath };
     } catch (e) {
-      const msg = e instanceof Error ? e.message : String(e);
-      try {
-        (0, import_node_fs29.rmSync)(appDirPath2, { recursive: true, force: true });
-        (0, import_node_fs29.cpSync)(bdir, appDirPath2, { recursive: true });
-      } catch (re) {
-        const rmsg = re instanceof Error ? re.message : String(re);
-        return reply.status(500).send({ ok: false, error: `update failed (${msg}) AND rollback failed (${rmsg}) \u2014 restore manually from ${bdir}`, code: "rollback-failed", backupPath: bdir });
-      }
-      return reply.status(500).send({ ok: false, error: `update failed (rolled back to ${fromVersion}): ${msg}`, code: "update-failed" });
+      if (e instanceof TemplateSwapError) return reply.status(500).send({ ok: false, error: e.message, code: e.code, ...e.backupPath ? { backupPath: e.backupPath } : {} });
+      throw e;
     } finally {
       _wfUpdating.delete(id);
     }
@@ -63609,7 +63750,7 @@ async function startServer() {
     }
     const companionId = `${req.params.appId}-ifc`;
     const filename = `${req.params.appId}.ifc`;
-    const outPath = (0, import_node_path27.join)(appPath(companionId), filename);
+    const outPath = (0, import_node_path28.join)(appPath(companionId), filename);
     let flo;
     try {
       flo = writeIfcApp(appPath(companionId), companionId, scene, outPath);
@@ -63632,8 +63773,8 @@ async function startServer() {
       }
       throw e;
     }
-    if (!(0, import_node_fs29.existsSync)(outPath)) return reply.send({ ok: false, error: "the IFC export produced no file" });
-    const content = (0, import_node_fs29.readFileSync)(outPath, "utf8");
+    if (!(0, import_node_fs30.existsSync)(outPath)) return reply.send({ ok: false, error: "the IFC export produced no file" });
+    const content = (0, import_node_fs30.readFileSync)(outPath, "utf8");
     broadcast({ type: "apps-changed" });
     return { ok: true, filename, content, bytes: Buffer.byteLength(content), skipped };
   });
@@ -63712,17 +63853,17 @@ async function startServer() {
       return reply.status(422).send({ ok: false, error: "no priced members to export \u2014 every member is an RFI (no AISC size / weight yet)" });
     }
     const outPath = bomExportPath(appId, format);
-    const dir = (0, import_node_path27.dirname)(outPath);
+    const dir = (0, import_node_path28.dirname)(outPath);
     const filename = `${appId}-bom.${format}`;
     try {
-      (0, import_node_fs29.mkdirSync)(dir, { recursive: true });
+      (0, import_node_fs30.mkdirSync)(dir, { recursive: true });
       if (format === "csv") {
         const text = bomToCsv(bom);
-        (0, import_node_fs29.writeFileSync)(outPath, text, "utf8");
+        (0, import_node_fs30.writeFileSync)(outPath, text, "utf8");
         return { ok: true, filename, encoding: "utf8", content: text, bytes: Buffer.byteLength(text), savedTo: outPath };
       }
       const buf = await bomToXlsx(bom);
-      (0, import_node_fs29.writeFileSync)(outPath, buf);
+      (0, import_node_fs30.writeFileSync)(outPath, buf);
       return { ok: true, filename, encoding: "base64", content: buf.toString("base64"), bytes: buf.length, savedTo: outPath };
     } catch (e) {
       app.log.error({ appId, format, err: e instanceof Error ? e.message : e }, "export-bom: generation failed");
@@ -63758,6 +63899,60 @@ async function startServer() {
     broadcast({ type: "apps-changed", id: req.params.id });
     return { ok: true };
   });
+  app.post("/api/app/:id/fork", async (req, reply) => {
+    const id = req.params.id;
+    if (!appExists(id)) return reply.status(404).send({ ok: false, error: `"${id}" is not installed`, code: "not-installed" });
+    if (req.body?.accept !== true) return reply.status(400).send({ ok: false, error: "liability terms not accepted", code: "terms-required" });
+    let version;
+    try {
+      version = readApp(id).version;
+    } catch {
+      return reply.status(404).send({ ok: false, error: `"${id}" is not installed`, code: "not-installed" });
+    }
+    const acceptedBy = typeof req.body?.acceptedBy === "string" ? req.body.acceptedBy : void 0;
+    markForked(id, { version, acceptedBy }, (/* @__PURE__ */ new Date()).toISOString());
+    broadcast({ type: "apps-changed", id });
+    return { ok: true, id, forked: true };
+  });
+  app.post("/api/app/:id/restore", async (req, reply) => {
+    const id = req.params.id;
+    const { templateId } = appOrigin(id);
+    const t = loadTemplates().find((x) => x.id === templateId);
+    if (!t) return reply.status(404).send({ ok: false, error: `no bundled template to restore "${id}" from`, code: "no-template" });
+    if (t.publisher !== "floless") return reply.status(400).send({ ok: false, error: `"${id}" has no FloLess-published template to restore from`, code: "not-published" });
+    if (_wfUpdating.has(id)) return reply.status(409).send({ ok: false, error: `an operation for "${id}" is already in progress`, code: "in-progress" });
+    let fromVersion;
+    let srcPath;
+    let appDirPath2;
+    try {
+      const a = readApp(id);
+      fromVersion = a.version;
+      srcPath = a.source.path;
+      appDirPath2 = appDir(id);
+    } catch {
+      return reply.status(404).send({ ok: false, error: `"${id}" is not installed`, code: "not-installed" });
+    }
+    const contract = readContract(id);
+    if (contract == null && (0, import_node_fs30.existsSync)(contractPath(id))) {
+      return reply.status(409).send({ ok: false, error: `"${id}"'s saved data is unreadable \u2014 open it in the editor and re-save before restoring`, code: "contract-corrupt" });
+    }
+    if (contract != null) {
+      const v = validateSteelTakeoff(contract);
+      if (!v.valid) return reply.status(409).send({ ok: false, error: `"${id}"'s saved data is invalid \u2014 re-save it in the editor before restoring`, code: "contract-invalid" });
+    }
+    _wfUpdating.add(id);
+    try {
+      const { backupPath } = await swapTemplateIntoApp({ id, templateId, templatePath: t.path, srcPath, appDirPath: appDirPath2, fromVersion, contract, verb: "restore" });
+      clearFork(id);
+      broadcast({ type: "apps-changed", id });
+      return { ok: true, id, restored: true, version: t.version, backupPath };
+    } catch (e) {
+      if (e instanceof TemplateSwapError) return reply.status(500).send({ ok: false, error: e.message, code: e.code, ...e.backupPath ? { backupPath: e.backupPath } : {} });
+      throw e;
+    } finally {
+      _wfUpdating.delete(id);
+    }
+  });
   app.post("/api/app/:id/freeze", async (req, reply) => {
     const nodeId = typeof req.body?.nodeId === "string" ? req.body.nodeId.trim() : "";
     if (!nodeId) return reply.status(400).send({ ok: false, error: "nodeId required" });
@@ -63816,11 +64011,11 @@ async function startServer() {
     if (appExists(id)) {
       return reply.status(409).send({ ok: false, error: `a workflow named "${id}" is already installed \u2014 remove it first, or rename the file's app: id`, code: "exists", id });
     }
-    const stageRoot = (0, import_node_fs29.mkdtempSync)((0, import_node_path27.join)((0, import_node_os19.tmpdir)(), "floless-import-"));
+    const stageRoot = (0, import_node_fs30.mkdtempSync)((0, import_node_path28.join)((0, import_node_os20.tmpdir)(), "floless-import-"));
     try {
-      const stageDir = (0, import_node_path27.join)(stageRoot, id);
-      (0, import_node_fs29.mkdirSync)(stageDir);
-      (0, import_node_fs29.writeFileSync)((0, import_node_path27.join)(stageDir, `${id}.flo`), content);
+      const stageDir = (0, import_node_path28.join)(stageRoot, id);
+      (0, import_node_fs30.mkdirSync)(stageDir);
+      (0, import_node_fs30.writeFileSync)((0, import_node_path28.join)(stageDir, `${id}.flo`), content);
       await aware.install(stageDir);
     } catch (err2) {
       try {
@@ -63830,7 +64025,7 @@ async function startServer() {
       const msg = err2 instanceof AwareError ? err2.message : String(err2?.message ?? err2);
       return reply.status(502).send({ ok: false, error: `import failed: ${msg}` });
     } finally {
-      (0, import_node_fs29.rmSync)(stageRoot, { recursive: true, force: true });
+      (0, import_node_fs30.rmSync)(stageRoot, { recursive: true, force: true });
     }
     broadcast({ type: "apps-changed", id });
     return { ok: true, id };
@@ -63844,13 +64039,13 @@ async function startServer() {
     }
     const inputs = appData.inputs.map((i) => ({ name: i.name, type: i.type }));
     const baked = bakeFloSource(appData.source.text, inputs);
-    const tmpRoot = (0, import_node_fs29.mkdtempSync)((0, import_node_path27.join)((0, import_node_os19.tmpdir)(), "floless-bake-"));
-    const backupDir2 = (0, import_node_path27.join)(tmpRoot, `${id}-backup`);
-    const bakeDir = (0, import_node_path27.join)(tmpRoot, id);
-    (0, import_node_fs29.cpSync)(appDir(id), backupDir2, { recursive: true });
-    (0, import_node_fs29.cpSync)(appDir(id), bakeDir, { recursive: true });
+    const tmpRoot = (0, import_node_fs30.mkdtempSync)((0, import_node_path28.join)((0, import_node_os20.tmpdir)(), "floless-bake-"));
+    const backupDir2 = (0, import_node_path28.join)(tmpRoot, `${id}-backup`);
+    const bakeDir = (0, import_node_path28.join)(tmpRoot, id);
+    (0, import_node_fs30.cpSync)(appDir(id), backupDir2, { recursive: true });
+    (0, import_node_fs30.cpSync)(appDir(id), bakeDir, { recursive: true });
     const floName = appData.source.path.split(/[\\/]/).pop();
-    (0, import_node_fs29.writeFileSync)((0, import_node_path27.join)(bakeDir, floName), baked);
+    (0, import_node_fs30.writeFileSync)((0, import_node_path28.join)(bakeDir, floName), baked);
     let appInstalled2 = true;
     try {
       await aware.uninstall(id);
@@ -63872,17 +64067,17 @@ async function startServer() {
         throw installErr;
       }
       try {
-        await aware.compile((0, import_node_path27.join)(appDir(id), floName));
+        await aware.compile((0, import_node_path28.join)(appDir(id), floName));
       } catch (compileErr) {
         app.log.warn({ id, compileErr: String(compileErr) }, "bake: post-install recompile failed (app baked but may need a manual Compile)");
       }
       broadcast({ type: "baked", id });
       return { ok: true, id, agent: id, inputs };
     } finally {
-      if (appInstalled2) (0, import_node_fs29.rmSync)(tmpRoot, { recursive: true, force: true });
+      if (appInstalled2) (0, import_node_fs30.rmSync)(tmpRoot, { recursive: true, force: true });
     }
   });
-  const graftAgentsDir = () => (0, import_node_path27.join)((0, import_node_os19.homedir)(), ".aware", "agents");
+  const graftAgentsDir = () => (0, import_node_path28.join)((0, import_node_os20.homedir)(), ".aware", "agents");
   app.post("/api/graft/match", async (req, reply) => {
     const { glob } = req.body ?? {};
     if (!glob) return reply.status(400).send({ ok: false, error: "glob required" });
@@ -63899,7 +64094,7 @@ async function startServer() {
     if (!sourceKind || !sourceRef) {
       return reply.status(400).send({ ok: false, error: "sourceKind and sourceRef required" });
     }
-    const tempHome = (0, import_node_fs29.mkdtempSync)((0, import_node_path27.join)((0, import_node_os19.tmpdir)(), "floless-graft-"));
+    const tempHome = (0, import_node_fs30.mkdtempSync)((0, import_node_path28.join)((0, import_node_os20.tmpdir)(), "floless-graft-"));
     let result;
     try {
       result = await aware.build({
@@ -63912,19 +64107,19 @@ async function startServer() {
         awareHome: tempHome
       });
     } catch (err2) {
-      (0, import_node_fs29.rmSync)(tempHome, { recursive: true, force: true });
+      (0, import_node_fs30.rmSync)(tempHome, { recursive: true, force: true });
       const msg = err2 instanceof AwareError ? err2.message : String(err2?.message ?? err2);
       return reply.status(422).send({ ok: false, error: msg });
     }
     const manifest = readStagedManifest(result.agentDir);
     if (!manifest) {
-      (0, import_node_fs29.rmSync)(tempHome, { recursive: true, force: true });
+      (0, import_node_fs30.rmSync)(tempHome, { recursive: true, force: true });
       return reply.status(502).send({ ok: false, error: `build produced output at ${result.agentDir} but no manifest.yaml` });
     }
     const token = (0, import_node_crypto7.randomUUID)();
     registerStage(token, tempHome, result.agentId);
     const preview = buildPreview(manifest, sourceKind, sourceRef, token);
-    if ((0, import_node_fs29.existsSync)((0, import_node_path27.join)(graftAgentsDir(), result.agentId))) {
+    if ((0, import_node_fs30.existsSync)((0, import_node_path28.join)(graftAgentsDir(), result.agentId))) {
       preview.warnings.unshift(`An agent named "${result.agentId}" is already installed \u2014 creating it will overwrite it.`);
     }
     return { ok: true, preview };
@@ -63943,7 +64138,7 @@ async function startServer() {
         registerStage(stagedRef, stage.tempDir, stage.agentId);
         return reply.status(409).send({ ok: false, error: err2.message, agentId: stage.agentId, collision: true });
       }
-      (0, import_node_fs29.rmSync)(stage.tempDir, { recursive: true, force: true });
+      (0, import_node_fs30.rmSync)(stage.tempDir, { recursive: true, force: true });
       throw err2;
     }
     broadcast({ type: "grafted", id: stage.agentId });
@@ -64203,11 +64398,11 @@ async function startServer() {
   app.get("/api/requests/:id/snapshot/:n", async (req, reply) => {
     const n = Number.parseInt(req.params.n, 10);
     const p = Number.isInteger(n) ? snapshotPathFor(req.params.id, n) : null;
-    if (!p || !(0, import_node_fs29.existsSync)(p)) return reply.status(404).send({ ok: false, error: "snapshot not found" });
+    if (!p || !(0, import_node_fs30.existsSync)(p)) return reply.status(404).send({ ok: false, error: "snapshot not found" });
     const ext = p.split(".").pop().toLowerCase();
     reply.header("Content-Type", ext === "png" ? "image/png" : ext === "webp" ? "image/webp" : ext === "pdf" ? "application/pdf" : "image/jpeg");
     reply.header("Cache-Control", "no-store");
-    return (0, import_node_fs29.readFileSync)(p);
+    return (0, import_node_fs30.readFileSync)(p);
   });
   app.post(
     "/api/tweak",
@@ -64369,7 +64564,7 @@ async function startServer() {
         warn(`last-run-status:${ref} \u2014 trace exists but couldn't be parsed (corrupt/truncated)`);
         let finishedAt2 = null;
         try {
-          finishedAt2 = (0, import_node_fs29.statSync)(latest.path).mtime.toISOString();
+          finishedAt2 = (0, import_node_fs30.statSync)(latest.path).mtime.toISOString();
         } catch {
           finishedAt2 = null;
         }
@@ -64379,7 +64574,7 @@ async function startServer() {
       let finishedAt = typeof runEnd?.ts === "string" ? runEnd.ts : null;
       if (!finishedAt) {
         try {
-          finishedAt = (0, import_node_fs29.statSync)(latest.path).mtime.toISOString();
+          finishedAt = (0, import_node_fs30.statSync)(latest.path).mtime.toISOString();
         } catch {
           finishedAt = null;
         }