@openpalm/ui 0.11.5-rc.2 → 0.11.5-rc.5

package/build/server/chunks/{src-Bqr11v--.js → src-DGGmhx-_.js}

@@ -181,6 +181,8 @@ function backupOpenPalmHome(homeDir) {
 	}
 	return copiedAny ? backupDir : null;
 }
+var package_default = {
+	version: "0.11.5-rc.5"};
 //#endregion
 //#region ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/nodes/identity.js
 var require_identity = /* @__PURE__ */ __commonJSMin(((exports) => {
@@ -7378,6 +7380,79 @@ function mergeEnvContent(content, updates, options = {}) {
 	return lines.join("\n");
 }
 //#endregion
+//#region ../lib/src/control-plane/image-tags.ts
+var PLATFORM_IMAGE_TAG_KEYS = [
+	"OP_ASSISTANT_IMAGE_TAG",
+	"OP_GUARDIAN_IMAGE_TAG",
+	"OP_CHANNEL_IMAGE_TAG"
+];
+function buildPlatformImageTagEnv(tag) {
+	return {
+		OP_IMAGE_TAG: tag,
+		OP_ASSISTANT_IMAGE_TAG: tag,
+		OP_GUARDIAN_IMAGE_TAG: tag,
+		OP_CHANNEL_IMAGE_TAG: tag
+	};
+}
+//#endregion
+//#region ../lib/src/control-plane/versioning.ts
+var SEMVER_RE = /^v?\d+\.\d+\.\d+(?:[-+].*)?$/;
+function isComparableSemver(version) {
+	return !!version && SEMVER_RE.test(version.trim());
+}
+function parseComparableVersion(version) {
+	const clean = version.trim().replace(/^v/, "").split("+")[0];
+	const dashIdx = clean.indexOf("-");
+	const main = dashIdx === -1 ? clean : clean.slice(0, dashIdx);
+	const prerelease = dashIdx === -1 ? null : clean.slice(dashIdx + 1);
+	const [major = 0, minor = 0, patch = 0] = main.split(".").map(Number);
+	return {
+		major,
+		minor,
+		patch,
+		prerelease
+	};
+}
+function comparePrerelease(a, b) {
+	const aParts = a.split(".");
+	const bParts = b.split(".");
+	for (let i = 0; i < Math.max(aParts.length, bParts.length); i++) {
+		if (i >= aParts.length) return -1;
+		if (i >= bParts.length) return 1;
+		const aNum = Number(aParts[i]);
+		const bNum = Number(bParts[i]);
+		const aIsNum = !Number.isNaN(aNum);
+		const bIsNum = !Number.isNaN(bNum);
+		if (aIsNum && bIsNum) {
+			if (aNum !== bNum) return aNum > bNum ? 1 : -1;
+			continue;
+		}
+		if (aIsNum !== bIsNum) return aIsNum ? -1 : 1;
+		if (aParts[i] !== bParts[i]) return aParts[i] > bParts[i] ? 1 : -1;
+	}
+	return 0;
+}
+function compareComparableVersions(a, b) {
+	const aParsed = parseComparableVersion(a);
+	const bParsed = parseComparableVersion(b);
+	if (aParsed.major !== bParsed.major) return aParsed.major > bParsed.major ? 1 : -1;
+	if (aParsed.minor !== bParsed.minor) return aParsed.minor > bParsed.minor ? 1 : -1;
+	if (aParsed.patch !== bParsed.patch) return aParsed.patch > bParsed.patch ? 1 : -1;
+	if (aParsed.prerelease === null && bParsed.prerelease !== null) return 1;
+	if (aParsed.prerelease !== null && bParsed.prerelease === null) return -1;
+	if (aParsed.prerelease !== null && bParsed.prerelease !== null) return comparePrerelease(aParsed.prerelease, bParsed.prerelease);
+	return 0;
+}
+function majorVersionOf(version) {
+	if (!isComparableSemver(version)) return null;
+	return parseComparableVersion(version).major;
+}
+function isSameMajorVersion(a, b) {
+	const aMajor = majorVersionOf(a);
+	const bMajor = majorVersionOf(b);
+	return aMajor !== null && bMajor !== null && aMajor === bMajor;
+}
+//#endregion
 //#region ../lib/src/control-plane/migrations.ts
 /**
 * On-disk layout migration harness.
@@ -7412,6 +7487,17 @@ var MigrationError = class extends Error {
 		this.name = "MigrationError";
 	}
 };
+var RELEASE_VERSION_KEY = "OP_RELEASE_VERSION";
+var CURRENT_RELEASE_VERSION = `v${package_default.version}`;
+function selectPendingReleaseMigrations(releaseFrom, targetVersion) {
+	if (!isComparableSemver(targetVersion)) return [];
+	return RELEASE_MIGRATIONS.filter((migration) => {
+		if (!isComparableSemver(migration.version)) return false;
+		if (compareComparableVersions(migration.version, targetVersion) > 0) return false;
+		if (releaseFrom === null || !isComparableSemver(releaseFrom)) return true;
+		return compareComparableVersions(migration.version, releaseFrom) > 0;
+	}).sort((a, b) => compareComparableVersions(a.version, b.version));
+}
 function stackEnvFile(stashDir) {
 	return join(stashDir, "env", "stack.env");
 }
@@ -7435,6 +7521,26 @@ function stampLayoutVersion(stashDir, version) {
 	if (!existsSync(envPath)) return;
 	writeFileSync(envPath, upsertEnvValue(readFileSync(envPath, "utf-8"), LAYOUT_VERSION_KEY, String(version)));
 }
+function readReleaseVersion(stashDir) {
+	const envPath = stackEnvFile(stashDir);
+	if (!existsSync(envPath)) return null;
+	let imageTagFallback = null;
+	for (const line of readFileSync(envPath, "utf-8").split("\n")) {
+		const releaseMatch = line.match(/^OP_RELEASE_VERSION=(.+)\s*$/);
+		if (releaseMatch) return releaseMatch[1].trim();
+		const imageTagMatch = line.match(/^OP_IMAGE_TAG=(.+)\s*$/);
+		if (imageTagMatch && !imageTagFallback) imageTagFallback = imageTagMatch[1].trim();
+	}
+	return imageTagFallback;
+}
+function stampReleaseVersion(stashDir, version) {
+	const envPath = stackEnvFile(stashDir);
+	if (!existsSync(envPath)) return;
+	writeFileSync(envPath, upsertEnvValue(readFileSync(envPath, "utf-8"), RELEASE_VERSION_KEY, version));
+}
+function upsertMany(content, values) {
+	return Object.entries(values).reduce((next, [key, value]) => upsertEnvValue(next, key, value), content);
+}
 function ensureDir(ctx, dir) {
 	if (ctx.dryRun) {
 		ctx.log(`[dry-run] mkdir ${rel(ctx, dir)}`);
@@ -7476,6 +7582,20 @@ function writeFile600(ctx, path, content) {
 		chmodSync(path, 384);
 	} catch {}
 }
+function seedPerImageTagVars(ctx) {
+	const envPath = stackEnvFile(ctx.stashDir);
+	if (!existsSync(envPath)) return;
+	const current = readFileSync(envPath, "utf-8");
+	const imageTag = current.match(/^OP_IMAGE_TAG=(.+)$/m)?.[1]?.trim();
+	if (!imageTag) return;
+	if (PLATFORM_IMAGE_TAG_KEYS.filter((key) => !new RegExp(`^${key}=`, "m").test(current)).length === 0) return;
+	if (ctx.dryRun) {
+		ctx.log(`[dry-run] seed per-image tag vars from OP_IMAGE_TAG=${imageTag}`);
+		return;
+	}
+	writeFile600(ctx, envPath, upsertMany(current, buildPlatformImageTagEnv(imageTag)));
+	ctx.log(`seeded per-image tag vars from OP_IMAGE_TAG=${imageTag}`);
+}
 var SECRET_KEY_RE = /(_API_KEY|_TOKEN|_SECRET|_PASSWORD)$/;
 var CONFIG_KEY_RE = /^(OP_CAP_|SYSTEM_LLM_|EMBEDDING_)/;
 function migrate010to011(ctx) {
@@ -7631,6 +7751,19 @@ var MIGRATIONS = [{
 		if (!existsSync(stackEnvFile(ctx.stashDir))) throw new Error("post-migration check failed: knowledge/env/stack.env is missing");
 	}
 }];
+var RELEASE_MIGRATIONS = [{
+	version: CURRENT_RELEASE_VERSION,
+	describe: "seed per-image platform tags from OP_IMAGE_TAG",
+	apply: seedPerImageTagVars,
+	verify(ctx) {
+		if (ctx.dryRun) return;
+		const envPath = stackEnvFile(ctx.stashDir);
+		if (!existsSync(envPath)) return;
+		const content = readFileSync(envPath, "utf-8");
+		if (!/^OP_IMAGE_TAG=/m.test(content)) return;
+		for (const key of PLATFORM_IMAGE_TAG_KEYS) if (!new RegExp(`^${key}=`, "m").test(content)) throw new Error(`post-migration check failed: ${key} is missing`);
+	}
+}];
 var RECOVERY_GUIDANCE = "Your original files were left untouched and a full backup was taken first. To recover, restore the backup (see docs/operations/backup-restore.md) or run the standalone migrator with --dry-run (scripts/migrate-0.10-to-0.11.sh / .ps1). Full guide: docs/operations/upgrade-0.10-to-0.11.md";
 /**
 * Ensure the home directory is migrated to the current layout. Safe to call at
@@ -7653,24 +7786,25 @@ function ensureMigrated(opts = {}) {
 		notes: []
 	};
 	const from = readLayoutVersion(ctxBase);
+	const releaseFrom = readReleaseVersion(stashDir);
 	const empty = {
 		migrated: false,
 		from,
 		to: from,
 		applied: [],
 		backupDir: null,
-		notes: []
+		notes: [],
+		releaseFrom,
+		releaseTo: CURRENT_RELEASE_VERSION,
+		releaseApplied: []
 	};
-	if (from >= 1) {
-		if (!dryRun) stampLayoutVersion(stashDir, 1);
-		return {
-			...empty,
-			to: 1
-		};
-	}
 	const pending = MIGRATIONS.filter((m) => m.from >= from && m.to <= 1).sort((a, b) => a.from - b.from);
-	if (pending.length === 0) {
-		if (!dryRun) stampLayoutVersion(stashDir, 1);
+	const pendingRelease = selectPendingReleaseMigrations(releaseFrom, CURRENT_RELEASE_VERSION);
+	if (pending.length === 0 && pendingRelease.length === 0) {
+		if (!dryRun) {
+			stampLayoutVersion(stashDir, 1);
+			stampReleaseVersion(stashDir, CURRENT_RELEASE_VERSION);
+		}
 		return {
 			...empty,
 			to: 1
@@ -7697,6 +7831,7 @@ function ensureMigrated(opts = {}) {
 			log(`Backup: ${backupDir}`);
 		}
 		const applied = [];
+		const releaseApplied = [];
 		const notes = [];
 		for (const m of pending) {
 			const ctx = {
@@ -7708,13 +7843,107 @@ function ensureMigrated(opts = {}) {
 			m.verify(ctx);
 			applied.push(`${m.from}->${m.to}`);
 		}
-		if (!dryRun) stampLayoutVersion(stashDir, 1);
+		for (const migration of pendingRelease) {
+			const ctx = {
+				...ctxBase,
+				notes
+			};
+			log(`Migrating release ${releaseFrom ?? "unknown"} → ${migration.version}: ${migration.describe}`);
+			migration.apply(ctx);
+			migration.verify(ctx);
+			releaseApplied.push(migration.version);
+		}
+		if (!dryRun) {
+			stampLayoutVersion(stashDir, 1);
+			stampReleaseVersion(stashDir, CURRENT_RELEASE_VERSION);
+		}
 		return {
 			migrated: true,
 			from,
 			to: 1,
 			applied,
 			backupDir,
+			notes,
+			releaseFrom,
+			releaseTo: CURRENT_RELEASE_VERSION,
+			releaseApplied
+		};
+	} catch (e) {
+		if (e instanceof MigrationError) throw e;
+		throw new MigrationError(`Migration failed: ${e instanceof Error ? e.message : String(e)}`, RECOVERY_GUIDANCE, backupDir);
+	} finally {
+		releaseInstallLock(lock);
+	}
+}
+function ensureReleaseMigrated(opts) {
+	const homeDir = opts.homeDir ?? resolveOpenPalmHome();
+	const dryRun = opts.dryRun ?? false;
+	const log = opts.log ?? (() => {});
+	const stashDir = resolveStashDir();
+	const targetVersion = opts.targetVersion.trim();
+	const releaseFrom = readReleaseVersion(stashDir);
+	const pendingRelease = selectPendingReleaseMigrations(releaseFrom, targetVersion);
+	const empty = {
+		migrated: false,
+		from: releaseFrom,
+		to: targetVersion,
+		applied: [],
+		backupDir: null,
+		notes: []
+	};
+	if (pendingRelease.length === 0) {
+		if (!dryRun && releaseFrom !== targetVersion) stampReleaseVersion(stashDir, targetVersion);
+		return empty;
+	}
+	const ctxBase = {
+		homeDir,
+		dataDir: resolveDataDir(),
+		stackDir: resolveStackDir(),
+		stashDir,
+		configDir: resolveConfigDir(),
+		dryRun,
+		log,
+		notes: []
+	};
+	let lock = null;
+	let backupDir = null;
+	try {
+		if (!dryRun) {
+			try {
+				mkdirSync(ctxBase.dataDir, { recursive: true });
+			} catch (e) {
+				throw new MigrationError(`Could not prepare the data directory: ${e instanceof Error ? e.message : String(e)}`, RECOVERY_GUIDANCE, null);
+			}
+			lock = acquireInstallLock(ctxBase.dataDir);
+			if (!lock) throw new MigrationError("Another install/upgrade is in progress.", RECOVERY_GUIDANCE, null);
+			log("Taking a full backup before migrating…");
+			try {
+				backupDir = backupOpenPalmHome(homeDir);
+			} catch (e) {
+				throw new MigrationError(`Could not create a safety backup; upgrade aborted (no changes made): ${e instanceof Error ? e.message : String(e)}`, RECOVERY_GUIDANCE, null);
+			}
+			if (!backupDir) throw new MigrationError("Could not create a safety backup; upgrade aborted (no changes made).", RECOVERY_GUIDANCE, null);
+			log(`Backup: ${backupDir}`);
+		}
+		const applied = [];
+		const notes = [];
+		for (const migration of pendingRelease) {
+			const ctx = {
+				...ctxBase,
+				notes
+			};
+			log(`Migrating release ${releaseFrom ?? "unknown"} → ${migration.version}: ${migration.describe}`);
+			migration.apply(ctx);
+			migration.verify(ctx);
+			applied.push(migration.version);
+		}
+		if (!dryRun) stampReleaseVersion(stashDir, targetVersion);
+		return {
+			migrated: true,
+			from: releaseFrom,
+			to: targetVersion,
+			applied,
+			backupDir,
 			notes
 		};
 	} catch (e) {
@@ -10683,64 +10912,6 @@ var yo = (s) => {
 	s.mtimeCache || (s.mtimeCache = /* @__PURE__ */ new Map()), s.filter = t ? (e, i) => t(e, i) && !((s.mtimeCache?.get(e) ?? i.mtime ?? 0) > (i.mtime ?? 0)) : (e, i) => !((s.mtimeCache?.get(e) ?? i.mtime ?? 0) > (i.mtime ?? 0));
 };
 //#endregion
-//#region ../lib/src/control-plane/versioning.ts
-var SEMVER_RE = /^v?\d+\.\d+\.\d+(?:[-+].*)?$/;
-function isComparableSemver(version) {
-	return !!version && SEMVER_RE.test(version.trim());
-}
-function parseComparableVersion(version) {
-	const clean = version.trim().replace(/^v/, "").split("+")[0];
-	const dashIdx = clean.indexOf("-");
-	const main = dashIdx === -1 ? clean : clean.slice(0, dashIdx);
-	const prerelease = dashIdx === -1 ? null : clean.slice(dashIdx + 1);
-	const [major = 0, minor = 0, patch = 0] = main.split(".").map(Number);
-	return {
-		major,
-		minor,
-		patch,
-		prerelease
-	};
-}
-function comparePrerelease(a, b) {
-	const aParts = a.split(".");
-	const bParts = b.split(".");
-	for (let i = 0; i < Math.max(aParts.length, bParts.length); i++) {
-		if (i >= aParts.length) return -1;
-		if (i >= bParts.length) return 1;
-		const aNum = Number(aParts[i]);
-		const bNum = Number(bParts[i]);
-		const aIsNum = !Number.isNaN(aNum);
-		const bIsNum = !Number.isNaN(bNum);
-		if (aIsNum && bIsNum) {
-			if (aNum !== bNum) return aNum > bNum ? 1 : -1;
-			continue;
-		}
-		if (aIsNum !== bIsNum) return aIsNum ? -1 : 1;
-		if (aParts[i] !== bParts[i]) return aParts[i] > bParts[i] ? 1 : -1;
-	}
-	return 0;
-}
-function compareComparableVersions(a, b) {
-	const aParsed = parseComparableVersion(a);
-	const bParsed = parseComparableVersion(b);
-	if (aParsed.major !== bParsed.major) return aParsed.major > bParsed.major ? 1 : -1;
-	if (aParsed.minor !== bParsed.minor) return aParsed.minor > bParsed.minor ? 1 : -1;
-	if (aParsed.patch !== bParsed.patch) return aParsed.patch > bParsed.patch ? 1 : -1;
-	if (aParsed.prerelease === null && bParsed.prerelease !== null) return 1;
-	if (aParsed.prerelease !== null && bParsed.prerelease === null) return -1;
-	if (aParsed.prerelease !== null && bParsed.prerelease !== null) return comparePrerelease(aParsed.prerelease, bParsed.prerelease);
-	return 0;
-}
-function majorVersionOf(version) {
-	if (!isComparableSemver(version)) return null;
-	return parseComparableVersion(version).major;
-}
-function isSameMajorVersion(a, b) {
-	const aMajor = majorVersionOf(a);
-	const bMajor = majorVersionOf(b);
-	return aMajor !== null && bMajor !== null && aMajor === bMajor;
-}
-//#endregion
 //#region ../lib/src/control-plane/ui-assets.ts
 /**
 * Runtime asset seeding and resolution for the UI build and OP_HOME skeleton.
@@ -11477,7 +11648,7 @@ function generateFallbackSystemEnv(state) {
 		"",
 		"# ── Images ──────────────────────────────────────────────────────────",
 		`OP_IMAGE_NAMESPACE=${process.env.OP_IMAGE_NAMESPACE ?? "openpalm"}`,
-		`OP_IMAGE_TAG=${DEFAULT_IMAGE_TAG}`,
+		...Object.entries(buildPlatformImageTagEnv(DEFAULT_IMAGE_TAG)).map(([key, value]) => `${key}=${value}`),
 		"",
 		"# ── Layout (on-disk schema version; managed by the migration harness) ──",
 		`OP_LAYOUT_VERSION=1`,
@@ -13351,8 +13522,6 @@ async function validateProposedState(state) {
 		warnings
 	};
 }
-var package_default = {
-	version: "0.11.5-rc.2"};
 //#endregion
 //#region ../lib/src/control-plane/compose-args.ts
 /**
@@ -13403,6 +13572,11 @@ function buildComposeOptions(state) {
 /** Lifecycle helpers — state factory, apply transitions, compose file list. */
 var IMAGE_NAMESPACE_RE = /^[a-z0-9]+(?:[._-][a-z0-9]+)*$/;
 var SEMVER_TAG_RE = /^v\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;
+var PLATFORM_IMAGE_NAMES = [
+	"assistant",
+	"guardian",
+	"channel"
+];
 function createState() {
 	const homeDir = resolveOpenPalmHome();
 	const configDir = resolveConfigDir();
@@ -13523,6 +13697,35 @@ function resolveImageNamespace(state) {
 	if (!IMAGE_NAMESPACE_RE.test(namespace)) throw new Error(`Invalid image namespace in system.env: ${namespace}`);
 	return namespace;
 }
+function resolveRequiredPlatformImages(state) {
+	const required = new Set(["assistant"]);
+	if (hasEnabledChannel(listEnabledAddonIds(state.homeDir))) {
+		required.add("guardian");
+		required.add("channel");
+	}
+	return PLATFORM_IMAGE_NAMES.filter((name) => required.has(name));
+}
+async function isDockerImageTagPublished(namespace, imageName, tag) {
+	let response;
+	try {
+		response = await fetch(`https://registry.hub.docker.com/v2/repositories/${namespace}/${imageName}/tags/${tag}`, { headers: { Accept: "application/json" } });
+	} catch (e) {
+		throw new Error(`Failed to verify Docker image tag ${namespace}/${imageName}:${tag}: ${e instanceof Error ? e.message : String(e)}`);
+	}
+	if (response.status === 404) return false;
+	if (!response.ok) throw new Error(`Docker tag verification failed for ${namespace}/${imageName}:${tag} (${response.status})`);
+	return true;
+}
+async function ensurePlatformImagesPublished(state, namespace, tag) {
+	if (namespace !== "openpalm") return;
+	const requiredImages = resolveRequiredPlatformImages(state);
+	const missing = (await Promise.all(requiredImages.map(async (imageName) => ({
+		imageName,
+		published: await isDockerImageTagPublished(namespace, imageName, tag)
+	})))).filter((entry) => !entry.published).map((entry) => entry.imageName);
+	if (missing.length === 0) return;
+	throw new Error(`Refusing to update to ${namespace}/*:${tag}: missing published image tag(s) for ${missing.join(", ")}. This release is incomplete for the enabled services; stack.env was left unchanged.`);
+}
 /**
 * Resolve the newest published platform tag from the Docker registry.
 *
@@ -13558,11 +13761,12 @@ async function resolveLatestPlatformTagForCurrentMajor(namespace, currentTag) {
 	if (!latestTag) throw new Error(`No usable Docker image tag found in major ${currentTag.replace(/^v/, "").split(".")[0]}`);
 	return latestTag;
 }
-async function updateStackEnvToLatestImageTag(state) {
+async function updateStackEnvToLatestImageTag(state, resolvedTag) {
 	const systemEnvPath = `${state.stashDir}/env/stack.env`;
 	const namespace = resolveImageNamespace(state);
-	const latestTag = await resolveLatestPlatformTagForCurrentMajor(namespace, resolvePlatformVersionPolicyBaseTag(state));
-	writeFileSync(systemEnvPath, mergeEnvContent(existsSync(systemEnvPath) ? readFileSync(systemEnvPath, "utf-8") : "", { OP_IMAGE_TAG: latestTag }, { uncomment: true }));
+	const latestTag = resolvedTag ?? await resolveLatestPlatformTagForCurrentMajor(namespace, resolvePlatformVersionPolicyBaseTag(state));
+	await ensurePlatformImagesPublished(state, namespace, latestTag);
+	writeFileSync(systemEnvPath, mergeEnvContent(existsSync(systemEnvPath) ? readFileSync(systemEnvPath, "utf-8") : "", buildPlatformImageTagEnv(latestTag), { uncomment: true }));
 	return {
 		namespace,
 		tag: latestTag
@@ -13582,75 +13786,89 @@ async function applyUpgrade(state, version) {
 		releaseInstallLock(lock);
 	}
 }
-/**
-* Full upgrade: resolve latest image tag, refresh assets, pull images,
-* and recreate containers. Used by both the admin endpoint and CLI.
-*
-* Callers handle their own audit logging and admin self-recreation.
-*/
-async function performUpgrade(state) {
-	const composeOpts = buildComposeOptions(state);
+async function withStackEnvRollback(state, run) {
 	const stackEnvPath = `${state.stashDir}/env/stack.env`;
 	let originalStackEnv = null;
 	try {
 		originalStackEnv = readFileSync(stackEnvPath, "utf-8");
 	} catch {}
-	let imageTag;
-	let namespace;
-	let upgradeResult;
 	try {
-		const tagResult = await updateStackEnvToLatestImageTag(state);
-		imageTag = tagResult.tag;
-		namespace = tagResult.namespace;
-		upgradeResult = await applyUpgrade(state, imageTag);
+		return await run();
 	} catch (e) {
 		if (originalStackEnv !== null) try {
 			writeFileSync(stackEnvPath, originalStackEnv);
 		} catch {}
 		throw e;
 	}
-	const pullResult = await composePull(composeOpts);
-	if (!pullResult.ok) throw new Error(`Failed to pull images: ${pullResult.stderr}`);
-	const services = await buildManagedServices(state);
-	const upResult = await composeUp({
-		...composeOpts,
-		services,
-		forceRecreate: true,
-		removeOrphans: true
+}
+/**
+* Full upgrade: resolve latest image tag, refresh assets, pull images,
+* and recreate containers. Used by both the admin endpoint and CLI.
+*
+* Callers handle their own audit logging and admin self-recreation.
+*/
+async function performUpgrade(state) {
+	return withStackEnvRollback(state, async () => {
+		const composeOpts = buildComposeOptions(state);
+		const namespace = resolveImageNamespace(state);
+		const imageTag = await resolveLatestPlatformTagForCurrentMajor(namespace, resolvePlatformVersionPolicyBaseTag(state));
+		await ensurePlatformImagesPublished(state, namespace, imageTag);
+		ensureReleaseMigrated({
+			homeDir: state.homeDir,
+			targetVersion: imageTag
+		});
+		const { tag: confirmedImageTag } = await updateStackEnvToLatestImageTag(state, imageTag);
+		const upgradeResult = await applyUpgrade(state, confirmedImageTag);
+		const pullResult = await composePull(composeOpts);
+		if (!pullResult.ok) throw new Error(`Failed to pull images: ${pullResult.stderr}`);
+		const services = await buildManagedServices(state);
+		const upResult = await composeUp({
+			...composeOpts,
+			services,
+			forceRecreate: true,
+			removeOrphans: true
+		});
+		if (!upResult.ok) throw new Error(`Images pulled but failed to recreate containers: ${upResult.stderr}`);
+		return {
+			imageTag: confirmedImageTag,
+			namespace,
+			backupDir: upgradeResult.backupDir,
+			assetsUpdated: upgradeResult.updated,
+			restarted: upgradeResult.restarted
+		};
 	});
-	if (!upResult.ok) throw new Error(`Images pulled but failed to recreate containers: ${upResult.stderr}`);
-	return {
-		imageTag,
-		namespace,
-		backupDir: upgradeResult.backupDir,
-		assetsUpdated: upgradeResult.updated,
-		restarted: upgradeResult.restarted
-	};
 }
 /**
 * Set a specific image tag in stack.env then pull images and restart containers.
 * Used by the admin "set version" action — skips the auto-detect step in performUpgrade.
 */
 async function applyTagChange(state, tag) {
-	const namespace = resolveImageNamespace(state);
-	const requested = tag.trim();
-	let resolvedTag = requested;
-	if (requested === "" || requested.toLowerCase() === "latest") try {
-		resolvedTag = await resolveLatestPlatformTag(namespace);
-	} catch (e) {
-		const msg = e instanceof Error ? e.message : String(e);
-		throw new Error(`Cannot resolve "latest" to a concrete release: ${msg}. Check your network connection or select a specific version.`);
-	}
-	const stackEnvPath = `${state.stashDir}/env/stack.env`;
-	writeFileSync(stackEnvPath, mergeEnvContent(existsSync(stackEnvPath) ? readFileSync(stackEnvPath, "utf-8") : "", { OP_IMAGE_TAG: resolvedTag }, { uncomment: true }));
-	const upgradeResult = await applyUpgrade(state, resolvedTag);
-	return {
-		imageTag: resolvedTag,
-		namespace,
-		backupDir: upgradeResult.backupDir,
-		assetsUpdated: upgradeResult.updated,
-		restarted: upgradeResult.restarted
-	};
+	return withStackEnvRollback(state, async () => {
+		const namespace = resolveImageNamespace(state);
+		const requested = tag.trim();
+		let resolvedTag = requested;
+		if (requested === "" || requested.toLowerCase() === "latest") try {
+			resolvedTag = await resolveLatestPlatformTag(namespace);
+		} catch (e) {
+			const msg = e instanceof Error ? e.message : String(e);
+			throw new Error(`Cannot resolve "latest" to a concrete release: ${msg}. Check your network connection or select a specific version.`);
+		}
+		await ensurePlatformImagesPublished(state, namespace, resolvedTag);
+		ensureReleaseMigrated({
+			homeDir: state.homeDir,
+			targetVersion: resolvedTag
+		});
+		const stackEnvPath = `${state.stashDir}/env/stack.env`;
+		writeFileSync(stackEnvPath, mergeEnvContent(existsSync(stackEnvPath) ? readFileSync(stackEnvPath, "utf-8") : "", buildPlatformImageTagEnv(resolvedTag), { uncomment: true }));
+		const upgradeResult = await applyUpgrade(state, resolvedTag);
+		return {
+			imageTag: resolvedTag,
+			namespace,
+			backupDir: upgradeResult.backupDir,
+			assetsUpdated: upgradeResult.updated,
+			restarted: upgradeResult.restarted
+		};
+	});
 }
 function buildComposeFileList(state) {
 	return discoverStackOverlays(state.stackDir, state.homeDir);
@@ -14780,7 +14998,7 @@ async function performSetup(input, opts) {
 		try {
 			const systemEnvForAkm = existsSync(`${state.stashDir}/env/stack.env`) ? readFileSync(`${state.stashDir}/env/stack.env`, "utf-8") : "";
 			const akmUpdates = {};
-			akmUpdates.OP_IMAGE_TAG = imageTag && imageTag.trim() ? imageTag.trim() : DEFAULT_IMAGE_TAG;
+			Object.assign(akmUpdates, buildPlatformImageTagEnv(imageTag && imageTag.trim() ? imageTag.trim() : DEFAULT_IMAGE_TAG));
 			if (Object.keys(akmUpdates).length > 0) writeFileAtomic(`${state.stashDir}/env/stack.env`, mergeEnvContent(systemEnvForAkm, akmUpdates), 384);
 			if (llm || embedding) {
 				const akmConfigDir = join(state.configDir, "akm");
@@ -15041,6 +15259,154 @@ function importHostOpenCode(state, options = {}) {
 		conflicts
 	};
 }
+//#endregion
+//#region ../lib/src/control-plane/akm-stats.ts
+function asRecord(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function asArray(value) {
+	return Array.isArray(value) ? value : [];
+}
+function asString(value) {
+	return typeof value === "string" && value.trim() ? value : null;
+}
+function asNumber(value) {
+	return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function asBoolean(value) {
+	return typeof value === "boolean" ? value : null;
+}
+function parseJsonObject(stdout) {
+	try {
+		return asRecord(JSON.parse(stdout));
+	} catch {
+		return null;
+	}
+}
+function runAkmJsonCommand(state, args, timeoutMs, options = {}) {
+	const akmEnv = buildAkmEnv(state);
+	assertAkmEnvComplete(akmEnv);
+	return new Promise((resolve) => {
+		execFile("akm", [
+			...args,
+			"--format",
+			"json",
+			"--quiet"
+		], {
+			env: {
+				...process.env,
+				...akmEnv
+			},
+			timeout: timeoutMs,
+			maxBuffer: 4 * 1024 * 1024
+		}, (error, stdout, stderr) => {
+			const execError = error;
+			const exitCode = typeof execError?.code === "number" ? execError.code : null;
+			const errorCode = typeof execError?.code === "string" ? execError.code : null;
+			const allowed = exitCode !== null && (options.allowExitCodes ?? []).includes(exitCode);
+			resolve({
+				ok: !error || allowed,
+				stdout: stdout?.toString() ?? "",
+				stderr: stderr?.toString() ?? "",
+				exitCode,
+				errorCode
+			});
+		});
+	});
+}
+function readAssetCount(info, type) {
+	if (!info) return null;
+	const candidates = [
+		asRecord(info.assetCounts),
+		asRecord(info.assetTypeCounts),
+		asRecord(info.assetsByType),
+		asRecord(info.counts)
+	];
+	for (const candidate of candidates) {
+		const value = asNumber(candidate?.[type]);
+		if (value !== null) return value;
+	}
+	return null;
+}
+function advisoryMessage(value) {
+	if (typeof value === "string" && value.trim()) return value.trim();
+	const record = asRecord(value);
+	if (!record) return null;
+	return asString(record.message) ?? asString(record.name);
+}
+function parseAkmStats(healthStdout, infoStdout, proposalsStdout) {
+	const health = parseJsonObject(healthStdout);
+	const info = parseJsonObject(infoStdout);
+	const proposalsPayload = parseJsonObject(proposalsStdout);
+	if (!health && !info) return {
+		available: false,
+		reason: "AKM stats unavailable on this host."
+	};
+	const indexStats = asRecord(info?.indexStats);
+	const improve = asRecord(health?.improve);
+	const reflect = asRecord(improve?.reflect);
+	const consolidation = asRecord(improve?.consolidation);
+	const proposals = asArray(proposalsPayload?.proposals).map((entry) => asRecord(entry)).filter((entry) => entry !== null).map((entry) => ({
+		ref: asString(entry.ref),
+		generator: asString(entry.generator) ?? asString(entry.source),
+		createdAt: asString(entry.createdAt),
+		status: asString(entry.status)
+	}));
+	const rawStatus = asString(health?.status)?.toLowerCase();
+	const status = rawStatus === "pass" || rawStatus === "ok" ? "pass" : rawStatus === "warn" ? "warn" : "unknown";
+	return {
+		available: true,
+		version: asString(info?.version),
+		health: {
+			status,
+			advisories: asArray(health?.advisories).map((entry) => advisoryMessage(entry)).filter((entry) => entry !== null)
+		},
+		index: {
+			entryCount: asNumber(indexStats?.entryCount),
+			lastBuiltAt: asString(indexStats?.lastBuiltAt),
+			hasEmbeddings: asBoolean(indexStats?.hasEmbeddings),
+			vecAvailable: asBoolean(indexStats?.vecAvailable)
+		},
+		assetCounts: {
+			memory: readAssetCount(info, "memory"),
+			skill: readAssetCount(info, "skill"),
+			lesson: readAssetCount(info, "lesson")
+		},
+		improve: {
+			invoked: asNumber(improve?.invoked),
+			completed: asNumber(improve?.completed),
+			skipped: asNumber(improve?.skipped),
+			reflectOk: asNumber(reflect?.ok),
+			reflectCooldown: asNumber(reflect?.cooldown),
+			consolidation: {
+				promoted: asNumber(consolidation?.promoted),
+				merged: asNumber(consolidation?.merged),
+				deleted: asNumber(consolidation?.deleted)
+			}
+		},
+		proposals: {
+			pending: proposals.length,
+			items: proposals
+		}
+	};
+}
+async function getAkmStats(state) {
+	const [healthResult, infoResult, proposalsResult] = await Promise.all([
+		runAkmJsonCommand(state, ["health"], 8e3, { allowExitCodes: [4] }),
+		runAkmJsonCommand(state, ["info"], 8e3),
+		runAkmJsonCommand(state, [
+			"proposal",
+			"list",
+			"--status",
+			"pending"
+		], 12e3)
+	]);
+	if (healthResult.errorCode === "ENOENT" || infoResult.errorCode === "ENOENT") return {
+		available: false,
+		reason: "The akm CLI is not installed on this host."
+	};
+	return parseAkmStats(healthResult.stdout, infoResult.stdout, proposalsResult.stdout);
+}
 
-export { getRegistryAddonConfig as $, AKM_USER_ENV_REF as A, createOpenCodeClient as B, CORE_SERVICES as C, createState as D, deleteUserEnvKey as E, detectExistingProject as F, detectGpu as G, detectHostOpenCode as H, detectLocalProviders as I, disableHostAkmSharing as J, enableHostAkmSharing as K, ensureAkmUserEnv as L, MigrationError as M, ensureHomeDirs as N, ensureMigrated as O, PROVIDER_KEY_MAP as P, ensureOpenCodeConfig as Q, ensureOpenCodeSystemConfig as R, ensureSecrets as S, executeAutomation as T, fetchProviderModels as U, getAddonProfileAvailability as V, getAddonProfileSelection as W, getAddonProfiles as X, getAddonServiceNames as Y, getDockerEvents as Z, getHostAkmSharingStatus as _, addonProfileId as a, hostAkmStashPath as a0, importHostOpenCode as a1, isAllowedService as a2, isHostAkmAvailable as a3, isSetupComplete as a4, listAvailableAddonIds as a5, listEnabledAddonIds as a6, listSecretFiles as a7, loadAutomations as a8, lookupEmbeddingDims as a9, writeRuntimeFiles as aA, writeSecretFile as aB, writeStackSecretEnv as aC, writeTaskFile as aD, writeUserEnvKey as aE, writeVoiceVars as aF, parseComposeStderr as aa, parseEnvFile as ab, patchSecretsEnvFile as ac, performSetup as ad, performUpgrade as ae, readAutomationLogs as af, readSecret as ag, readSecretFile as ah, readStackEnv as ai, readStackRuntimeEnv as aj, readStackSecretEnv as ak, readTaskFile as al, readUserEnvFile as am, recommendSetup as an, removeSecretFile as ao, removeTaskFile as ap, resolveComposeProjectName as aq, resolveDataDir as ar, resolveRuntimeFiles as as, resolveStackDir as at, seedUiBuild as au, setAddonEnabled as av, setAddonProfileSelection as aw, summarizeComposeStderr as ax, validateProposedState as ay, writeFileAtomic as az, annotateAddonProfileAvailability as b, applyInstall as c, applyTagChange as d, applyUninstall as e, applyUpdate as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, buildAkmEndpoint as j, buildAkmEnv as k, buildComposeOptions as l, buildManagedServices as m, checkDocker as n, checkDockerCompose as o, composeDown as p, composeLogs as q, composePreflight as r, composePs as s, composePull as t, composeRestart as u, composeStart as v, composeStats as w, composeStop as x, composeUp as y, createLogger as z };
-//# sourceMappingURL=src-Bqr11v--.js.map
+export { getHostAkmSharingStatus as $, AKM_USER_ENV_REF as A, createOpenCodeClient as B, CORE_SERVICES as C, createState as D, deleteUserEnvKey as E, detectExistingProject as F, detectGpu as G, detectHostOpenCode as H, detectLocalProviders as I, disableHostAkmSharing as J, enableHostAkmSharing as K, ensureAkmUserEnv as L, MigrationError as M, ensureHomeDirs as N, ensureMigrated as O, PROVIDER_KEY_MAP as P, ensureOpenCodeConfig as Q, ensureOpenCodeSystemConfig as R, ensureSecrets as S, executeAutomation as T, fetchProviderModels as U, getAddonProfileAvailability as V, getAddonProfileSelection as W, getAddonProfiles as X, getAddonServiceNames as Y, getAkmStats as Z, getDockerEvents as _, addonProfileId as a, getRegistryAddonConfig as a0, hostAkmStashPath as a1, importHostOpenCode as a2, isAllowedService as a3, isHostAkmAvailable as a4, isSetupComplete as a5, listAvailableAddonIds as a6, listEnabledAddonIds as a7, listSecretFiles as a8, loadAutomations as a9, writeFileAtomic as aA, writeRuntimeFiles as aB, writeSecretFile as aC, writeStackSecretEnv as aD, writeTaskFile as aE, writeUserEnvKey as aF, writeVoiceVars as aG, lookupEmbeddingDims as aa, parseComposeStderr as ab, parseEnvFile as ac, patchSecretsEnvFile as ad, performSetup as ae, performUpgrade as af, readAutomationLogs as ag, readSecret as ah, readSecretFile as ai, readStackEnv as aj, readStackRuntimeEnv as ak, readStackSecretEnv as al, readTaskFile as am, readUserEnvFile as an, recommendSetup as ao, removeSecretFile as ap, removeTaskFile as aq, resolveComposeProjectName as ar, resolveDataDir as as, resolveRuntimeFiles as at, resolveStackDir as au, seedUiBuild as av, setAddonEnabled as aw, setAddonProfileSelection as ax, summarizeComposeStderr as ay, validateProposedState as az, annotateAddonProfileAvailability as b, applyInstall as c, applyTagChange as d, applyUninstall as e, applyUpdate as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, buildAkmEndpoint as j, buildAkmEnv as k, buildComposeOptions as l, buildManagedServices as m, checkDocker as n, checkDockerCompose as o, composeDown as p, composeLogs as q, composePreflight as r, composePs as s, composePull as t, composeRestart as u, composeStart as v, composeStats as w, composeStop as x, composeUp as y, createLogger as z };
+//# sourceMappingURL=src-DGGmhx-_.js.map