@openpalm/ui 0.12.0-rc.1 → 0.12.0-rc.2

package/build/server/chunks/{session-cookie-CQw8e0tc.js.map → session-cookie-C-kIy9pI.js.map}

@@ -1 +1 @@
-{"version":3,"file":"session-cookie-CQw8e0tc.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}
+{"version":3,"file":"session-cookie-C-kIy9pI.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}

package/build/server/chunks/{setup-deploy-BBl1pM-Q.js → setup-deploy-BL_wmz6j.js}

@@ -1,4 +1,4 @@
-import { j as backupSetupInputs, aE as runDeploy, aB as resolveDeployJournalPath, aa as isSetupComplete, aD as resolveStackDir, ao as readDeployJournal, ah as markSetupComplete } from './src-CHZNd5cO.js';
+import { j as backupSetupInputs, aI as runDeploy, aF as resolveDeployJournalPath, ae as isSetupComplete, aH as resolveStackDir, as as readDeployJournal, al as markSetupComplete } from './src-BEj0DuSB.js';
 
 //#region src/lib/server/setup-deploy.ts
 var _state = {
@@ -72,4 +72,4 @@ function prepareSetupRestorePoint(state) {
 }
 
 export { getDeployState as g, prepareSetupRestorePoint as p, resetDeployState as r, startDeploy as s };
-//# sourceMappingURL=setup-deploy-BBl1pM-Q.js.map
+//# sourceMappingURL=setup-deploy-BL_wmz6j.js.map

package/build/server/chunks/{setup-deploy-BBl1pM-Q.js.map → setup-deploy-BL_wmz6j.js.map}

@@ -1 +1 @@
-{"version":3,"file":"setup-deploy-BBl1pM-Q.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { A as readDeployJournal, M as runDeploy, O as backupSetupInputs, Yt as resolveStackDir, j as resolveDeployJournalPath, k as markSetupComplete, ut as isSetupComplete } from \"./src.js\";\n//#region src/lib/server/setup-deploy.ts\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\timageWarning: null,\n\tphase: \"writing-config\"\n};\nvar _deployPromise = null;\nfunction deployStateFromJournal(state) {\n\tconst journal = readDeployJournal(resolveDeployJournalPath(state));\n\treturn {\n\t\tdeploying: journal.deploying,\n\t\tinterrupted: journal.interrupted,\n\t\tsetupComplete: journal.setupComplete || isSetupComplete(resolveStackDir()),\n\t\tdeployStatus: journal.deployStatus,\n\t\tdeployError: journal.deployError,\n\t\timageWarning: journal.imageWarning,\n\t\tphase: journal.phase\n\t};\n}\nfunction getDeployState(state) {\n\tif (state) _state = deployStateFromJournal(state);\n\telse if (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveStackDir())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: _state.deployStatus.map((entry) => ({ ...entry }))\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\timageWarning: null,\n\t\tphase: \"writing-config\"\n\t};\n}\nfunction startDeploy(state) {\n\tif (_deployPromise) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\treturn;\n\t}\n\t_deployPromise = (async () => {\n\t\tawait runDeploy(state, {\n\t\t\tjournalPath: resolveDeployJournalPath(state),\n\t\t\tonUpdate(progress) {\n\t\t\t\t_state = {\n\t\t\t\t\tdeploying: progress.deploying,\n\t\t\t\t\tinterrupted: progress.interrupted,\n\t\t\t\t\tsetupComplete: progress.setupComplete,\n\t\t\t\t\tdeployStatus: progress.deployStatus,\n\t\t\t\t\tdeployError: progress.deployError,\n\t\t\t\t\timageWarning: progress.imageWarning,\n\t\t\t\t\tphase: progress.phase\n\t\t\t\t};\n\t\t\t},\n\t\t\tmarkSetupComplete() {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t}\n\t\t});\n\t})().finally(() => {\n\t\t_deployPromise = null;\n\t});\n}\nfunction prepareSetupRestorePoint(state) {\n\treturn backupSetupInputs(state);\n}\n//#endregion\nexport { startDeploy as i, prepareSetupRestorePoint as n, resetDeployState as r, getDeployState as t };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,YAAY,EAAE,IAAI;AACnB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,IAAI,cAAc,GAAG,IAAI;AACzB,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;AAC9B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;AAC5E,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,KAAK,EAAE,OAAO,CAAC;AACjB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,IAAI,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAClD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AACvH,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AACjE,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,YAAY,EAAE,IAAI;AACpB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,cAAc,EAAE;AACrB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE;AACF,CAAC;AACD,CAAC,cAAc,GAAG,CAAC,YAAY;AAC/B,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;AACzB,GAAG,WAAW,EAAE,wBAAwB,CAAC,KAAK,CAAC;AAC/C,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,MAAM,GAAG;AACb,KAAK,SAAS,EAAE,QAAQ,CAAC,SAAS;AAClC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,aAAa,EAAE,QAAQ,CAAC,aAAa;AAC1C,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,KAAK,EAAE,QAAQ,CAAC;AACrB,KAAK;AACL,GAAG,CAAC;AACJ,GAAG,iBAAiB,GAAG;AACvB,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;AACpB,EAAE,cAAc,GAAG,IAAI;AACvB,CAAC,CAAC,CAAC;AACH;AACA,SAAS,wBAAwB,CAAC,KAAK,EAAE;AACzC,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC;AAChC;;;;"}
+{"version":3,"file":"setup-deploy-BL_wmz6j.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { A as readDeployJournal, M as runDeploy, O as backupSetupInputs, Yt as resolveStackDir, j as resolveDeployJournalPath, k as markSetupComplete, ut as isSetupComplete } from \"./src.js\";\n//#region src/lib/server/setup-deploy.ts\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\timageWarning: null,\n\tphase: \"writing-config\"\n};\nvar _deployPromise = null;\nfunction deployStateFromJournal(state) {\n\tconst journal = readDeployJournal(resolveDeployJournalPath(state));\n\treturn {\n\t\tdeploying: journal.deploying,\n\t\tinterrupted: journal.interrupted,\n\t\tsetupComplete: journal.setupComplete || isSetupComplete(resolveStackDir()),\n\t\tdeployStatus: journal.deployStatus,\n\t\tdeployError: journal.deployError,\n\t\timageWarning: journal.imageWarning,\n\t\tphase: journal.phase\n\t};\n}\nfunction getDeployState(state) {\n\tif (state) _state = deployStateFromJournal(state);\n\telse if (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveStackDir())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: _state.deployStatus.map((entry) => ({ ...entry }))\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\timageWarning: null,\n\t\tphase: \"writing-config\"\n\t};\n}\nfunction startDeploy(state) {\n\tif (_deployPromise) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\treturn;\n\t}\n\t_deployPromise = (async () => {\n\t\tawait runDeploy(state, {\n\t\t\tjournalPath: resolveDeployJournalPath(state),\n\t\t\tonUpdate(progress) {\n\t\t\t\t_state = {\n\t\t\t\t\tdeploying: progress.deploying,\n\t\t\t\t\tinterrupted: progress.interrupted,\n\t\t\t\t\tsetupComplete: progress.setupComplete,\n\t\t\t\t\tdeployStatus: progress.deployStatus,\n\t\t\t\t\tdeployError: progress.deployError,\n\t\t\t\t\timageWarning: progress.imageWarning,\n\t\t\t\t\tphase: progress.phase\n\t\t\t\t};\n\t\t\t},\n\t\t\tmarkSetupComplete() {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t}\n\t\t});\n\t})().finally(() => {\n\t\t_deployPromise = null;\n\t});\n}\nfunction prepareSetupRestorePoint(state) {\n\treturn backupSetupInputs(state);\n}\n//#endregion\nexport { startDeploy as i, prepareSetupRestorePoint as n, resetDeployState as r, getDeployState as t };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,YAAY,EAAE,IAAI;AACnB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,IAAI,cAAc,GAAG,IAAI;AACzB,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;AAC9B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;AAC5E,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,KAAK,EAAE,OAAO,CAAC;AACjB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,IAAI,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAClD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AACvH,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AACjE,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,YAAY,EAAE,IAAI;AACpB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,cAAc,EAAE;AACrB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE;AACF,CAAC;AACD,CAAC,cAAc,GAAG,CAAC,YAAY;AAC/B,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;AACzB,GAAG,WAAW,EAAE,wBAAwB,CAAC,KAAK,CAAC;AAC/C,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,MAAM,GAAG;AACb,KAAK,SAAS,EAAE,QAAQ,CAAC,SAAS;AAClC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,aAAa,EAAE,QAAQ,CAAC,aAAa;AAC1C,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,KAAK,EAAE,QAAQ,CAAC;AACrB,KAAK;AACL,GAAG,CAAC;AACJ,GAAG,iBAAiB,GAAG;AACvB,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;AACpB,EAAE,cAAc,GAAG,IAAI;AACvB,CAAC,CAAC,CAAC;AACH;AACA,SAAS,wBAAwB,CAAC,KAAK,EAAE;AACzC,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC;AAChC;;;;"}

package/build/server/chunks/{src-CHZNd5cO.js → src-BEj0DuSB.js}

@@ -261,7 +261,7 @@ function releaseInstallLock(handle) {
 	}
 }
 //#endregion
-//#region ../lib/src/control-plane/env.ts
+//#region ../lib/package.json
 var import_main = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var fs$1 = __require("fs");
 	var path = __require("path");
@@ -529,6 +529,119 @@ var import_main = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports.populate = DotenvModule.populate;
 	module.exports = DotenvModule;
 })))();
+var package_default = {
+	version: "0.12.0-rc.2"};
+//#endregion
+//#region ../lib/src/control-plane/versioning.ts
+var SEMVER_RE = /^v?\d+\.\d+\.\d+(?:[-+].*)?$/;
+/**
+* The canonical control-plane / platform version.
+*
+* This is the ONE source of truth for "which @openpalm/lib (and therefore which
+* RELEASE_MIGRATIONS + lifecycle) is running." It travels with the data/ui
+* build (the published @openpalm/ui inlines this lib), so it self-updates in
+* place — it is NOT the Electron harness version (see
+* packages/electron/src/harness-contract.ts: HARNESS_CONTRACT_VERSION).
+*
+* Stored Docker-canonical (`v`-prefixed) because every consumer that stamps a
+* version into stack.env / a skeleton / a migration target wants the Docker tag
+* form. Use `formatForDisplay` for user-facing strings and `normalizeVersion`
+* for npm-style (no-`v`) comparisons.
+*
+* Replaces the former implicit `v${libPkg.version}` scattered through lifecycle
+* / migrations so the platform version has a single, named home.
+*/
+var PLATFORM_VERSION = formatForDocker(package_default.version);
+function isComparableSemver(version) {
+	return !!version && SEMVER_RE.test(version.trim());
+}
+function parseComparableVersion(version) {
+	const clean = normalizeVersion(version).split("+")[0];
+	const dashIdx = clean.indexOf("-");
+	const main = dashIdx === -1 ? clean : clean.slice(0, dashIdx);
+	const prerelease = dashIdx === -1 ? null : clean.slice(dashIdx + 1);
+	const [major = 0, minor = 0, patch = 0] = main.split(".").map(Number);
+	return {
+		major,
+		minor,
+		patch,
+		prerelease
+	};
+}
+function comparePrerelease(a, b) {
+	const aParts = a.split(".");
+	const bParts = b.split(".");
+	for (let i = 0; i < Math.max(aParts.length, bParts.length); i++) {
+		if (i >= aParts.length) return -1;
+		if (i >= bParts.length) return 1;
+		const aNum = Number(aParts[i]);
+		const bNum = Number(bParts[i]);
+		const aIsNum = !Number.isNaN(aNum);
+		const bIsNum = !Number.isNaN(bNum);
+		if (aIsNum && bIsNum) {
+			if (aNum !== bNum) return aNum > bNum ? 1 : -1;
+			continue;
+		}
+		if (aIsNum !== bIsNum) return aIsNum ? -1 : 1;
+		if (aParts[i] !== bParts[i]) return aParts[i] > bParts[i] ? 1 : -1;
+	}
+	return 0;
+}
+function compareComparableVersions(a, b) {
+	const aParsed = parseComparableVersion(a);
+	const bParsed = parseComparableVersion(b);
+	if (aParsed.major !== bParsed.major) return aParsed.major > bParsed.major ? 1 : -1;
+	if (aParsed.minor !== bParsed.minor) return aParsed.minor > bParsed.minor ? 1 : -1;
+	if (aParsed.patch !== bParsed.patch) return aParsed.patch > bParsed.patch ? 1 : -1;
+	if (aParsed.prerelease === null && bParsed.prerelease !== null) return 1;
+	if (aParsed.prerelease !== null && bParsed.prerelease === null) return -1;
+	if (aParsed.prerelease !== null && bParsed.prerelease !== null) return comparePrerelease(aParsed.prerelease, bParsed.prerelease);
+	return 0;
+}
+function majorVersionOf(version) {
+	if (!isComparableSemver(version)) return null;
+	return parseComparableVersion(version).major;
+}
+function isSameMajorVersion(a, b) {
+	const aMajor = majorVersionOf(a);
+	const bMajor = majorVersionOf(b);
+	return aMajor !== null && bMajor !== null && aMajor === bMajor;
+}
+/**
+* npm/display form: strip a single leading `v` and trim. `v0.12.0` → `0.12.0`.
+* Pass-through for an already-bare version. Empty/whitespace → ''.
+*/
+function normalizeVersion(version) {
+	return (version ?? "").trim().replace(/^v/, "");
+}
+/**
+* Docker-tag form: ensure exactly one leading `v`. `0.12.0` → `v0.12.0`,
+* `v0.12.0` → `v0.12.0`. Empty/whitespace → '' (callers gate on RELEASE_TAG_REGEX
+* before treating a value as a real tag).
+*/
+function formatForDocker(version) {
+	const bare = normalizeVersion(version);
+	return bare ? `v${bare}` : "";
+}
+/**
+* True when `version` carries a semver pre-release segment (`0.12.0-rc.1`).
+* Build metadata (`+build.5`) is NOT a pre-release. Non-semver → false.
+*/
+function isPrerelease(version) {
+	if (!isComparableSemver(version)) return false;
+	return parseComparableVersion(version).prerelease !== null;
+}
+/**
+* User-facing presentation form: drop the leading `v` so the UI shows one
+* canonical spelling regardless of whether the value arrived as a Docker tag or
+* an npm version. Non-semver values are returned trimmed but otherwise untouched
+* (e.g. a moving `latest`/`dev` tag).
+*/
+function formatForDisplay(version) {
+	return normalizeVersion(version);
+}
+//#endregion
+//#region ../lib/src/control-plane/env.ts
 function parseEnvContent(content) {
 	return (0, import_main.parse)(content);
 }
@@ -675,64 +788,6 @@ function buildPlatformImageTagEnv(tag, perImage, pinnedImages = []) {
 	};
 }
 //#endregion
-//#region ../lib/src/control-plane/versioning.ts
-var SEMVER_RE = /^v?\d+\.\d+\.\d+(?:[-+].*)?$/;
-function isComparableSemver(version) {
-	return !!version && SEMVER_RE.test(version.trim());
-}
-function parseComparableVersion(version) {
-	const clean = version.trim().replace(/^v/, "").split("+")[0];
-	const dashIdx = clean.indexOf("-");
-	const main = dashIdx === -1 ? clean : clean.slice(0, dashIdx);
-	const prerelease = dashIdx === -1 ? null : clean.slice(dashIdx + 1);
-	const [major = 0, minor = 0, patch = 0] = main.split(".").map(Number);
-	return {
-		major,
-		minor,
-		patch,
-		prerelease
-	};
-}
-function comparePrerelease(a, b) {
-	const aParts = a.split(".");
-	const bParts = b.split(".");
-	for (let i = 0; i < Math.max(aParts.length, bParts.length); i++) {
-		if (i >= aParts.length) return -1;
-		if (i >= bParts.length) return 1;
-		const aNum = Number(aParts[i]);
-		const bNum = Number(bParts[i]);
-		const aIsNum = !Number.isNaN(aNum);
-		const bIsNum = !Number.isNaN(bNum);
-		if (aIsNum && bIsNum) {
-			if (aNum !== bNum) return aNum > bNum ? 1 : -1;
-			continue;
-		}
-		if (aIsNum !== bIsNum) return aIsNum ? -1 : 1;
-		if (aParts[i] !== bParts[i]) return aParts[i] > bParts[i] ? 1 : -1;
-	}
-	return 0;
-}
-function compareComparableVersions(a, b) {
-	const aParsed = parseComparableVersion(a);
-	const bParsed = parseComparableVersion(b);
-	if (aParsed.major !== bParsed.major) return aParsed.major > bParsed.major ? 1 : -1;
-	if (aParsed.minor !== bParsed.minor) return aParsed.minor > bParsed.minor ? 1 : -1;
-	if (aParsed.patch !== bParsed.patch) return aParsed.patch > bParsed.patch ? 1 : -1;
-	if (aParsed.prerelease === null && bParsed.prerelease !== null) return 1;
-	if (aParsed.prerelease !== null && bParsed.prerelease === null) return -1;
-	if (aParsed.prerelease !== null && bParsed.prerelease !== null) return comparePrerelease(aParsed.prerelease, bParsed.prerelease);
-	return 0;
-}
-function majorVersionOf(version) {
-	if (!isComparableSemver(version)) return null;
-	return parseComparableVersion(version).major;
-}
-function isSameMajorVersion(a, b) {
-	const aMajor = majorVersionOf(a);
-	const bMajor = majorVersionOf(b);
-	return aMajor !== null && bMajor !== null && aMajor === bMajor;
-}
-//#endregion
 //#region ../lib/src/control-plane/migrations.ts
 /**
 * On-disk layout migration harness.
@@ -4734,10 +4789,6 @@ function resolveLocalOpenpalmDir() {
 */
 var NPM_REGISTRY = "https://registry.npmjs.org";
 var UI_PACKAGE = "@openpalm/ui";
-/** Strip a single leading 'v' so a release ref (v1.2.3) becomes an npm version (1.2.3). */
-function toNpmVersion(repoRef) {
-	return repoRef.replace(/^v/, "");
-}
 /**
 * Resolve the npm manifest for `@openpalm/ui` by exact version OR dist-tag.
 * `GET <registry>/@openpalm/ui/<version-or-tag>` returns the abbreviated
@@ -4748,10 +4799,13 @@ async function fetchNpmUiManifest(versionOrTag) {
 	if (!res.ok) throw new Error(`npm registry returned HTTP ${res.status} for ${UI_PACKAGE}@${versionOrTag}`);
 	const m = await res.json();
 	if (!m.version || !m.dist?.tarball) throw new Error(`npm manifest for ${UI_PACKAGE}@${versionOrTag} is missing version/dist.tarball`);
+	const rawMin = typeof m.minHarnessContract === "number" ? m.minHarnessContract : Number(m.minHarnessContract);
+	const minHarnessContract = Number.isFinite(rawMin) && rawMin > 0 ? rawMin : 0;
 	return {
 		version: m.version,
 		tarball: m.dist.tarball,
-		integrity: m.dist.integrity ?? null
+		integrity: m.dist.integrity ?? null,
+		minHarnessContract
 	};
 }
 /**
@@ -4828,7 +4882,7 @@ async function downloadNpmUiBundle(manifest, uiDir, dataDir) {
 async function seedUiBuild(repoRef, dataDir, options) {
 	const uiDir = join(dataDir, "ui");
 	mkdirSync(uiDir, { recursive: true });
-	const manifest = await fetchNpmUiManifest(toNpmVersion(repoRef));
+	const manifest = await fetchNpmUiManifest(normalizeVersion(repoRef));
 	logger$9.debug("downloading UI build from npm", { version: manifest.version });
 	await downloadNpmUiBundle(manifest, uiDir, dataDir);
 }
@@ -6723,8 +6777,6 @@ function writeFileAtomic(path, content, mode) {
 	writeFileSync(tmp, content, mode !== void 0 ? { mode } : {});
 	renameSync(tmp, path);
 }
-var package_default = {
-	version: "0.12.0-rc.1"};
 //#endregion
 //#region ../lib/src/control-plane/rollback.ts
 /**
@@ -6878,9 +6930,12 @@ var DOCKER_REGISTRY_TIMEOUT_MS = 1e4;
 /**
 * Resolve the best Docker image tag from a registry tags payload.
 *
-* Constraints (both optional):
-* - `sameMajorAs`  — only consider tags whose major component matches this tag.
-* - `atOrBelow`    — only consider tags whose version is <= this tag.
+* Constraints (all optional):
+* - `sameMajorAs`    — only consider tags whose major component matches this tag.
+* - `atOrBelow`      — only consider tags whose version is <= this tag.
+* - `skipPrerelease` — ignore prerelease tags (`-rc`, `-beta`, …). Used so a
+*                      STABLE base never auto-jumps onto a prerelease (#494),
+*                      mirroring the UI card's channel gate.
 *
 * With no constraints: returns the first semver tag found, or the first
 * non-"latest" tag as a fallback (mirrors the original resolveNewestDockerTag).
@@ -6889,8 +6944,8 @@ var DOCKER_REGISTRY_TIMEOUT_MS = 1e4;
 function resolveNewestDockerTag(payload, constraints = {}) {
 	const results = payload?.results;
 	if (!Array.isArray(results)) return null;
-	const { sameMajorAs, atOrBelow } = constraints;
-	if (!(sameMajorAs !== void 0 || atOrBelow !== void 0)) {
+	const { sameMajorAs, atOrBelow, skipPrerelease } = constraints;
+	if (!(sameMajorAs !== void 0 || atOrBelow !== void 0 || skipPrerelease === true)) {
 		let fallback = null;
 		for (const entry of results) {
 			const name = typeof entry?.name === "string" ? entry.name.trim() : "";
@@ -6904,6 +6959,7 @@ function resolveNewestDockerTag(payload, constraints = {}) {
 	for (const entry of results) {
 		const name = typeof entry?.name === "string" ? entry.name.trim() : "";
 		if (!isComparableSemver(name)) continue;
+		if (skipPrerelease && isPrerelease(name)) continue;
 		if (sameMajorAs !== void 0 && !isSameMajorVersion(name, sameMajorAs)) continue;
 		if (atOrBelow !== void 0 && compareComparableVersions(name, atOrBelow) > 0) continue;
 		if (!best || compareComparableVersions(name, best) > 0) best = name;
@@ -6913,7 +6969,32 @@ function resolveNewestDockerTag(payload, constraints = {}) {
 function resolvePlatformVersionPolicyBaseTag(state) {
 	const configured = parseEnvFile(`${state.stashDir}/env/stack.env`).OP_IMAGE_TAG?.trim();
 	if (isComparableSemver(configured)) return configured;
-	return `v${package_default.version}`;
+	return PLATFORM_VERSION;
+}
+/**
+* Host-vs-target guard (#492), keyed on the RUNNING control-plane version.
+*
+* The migrations a release needs live inside the @openpalm/lib that is actually
+* executing — i.e. PLATFORM_VERSION (the version of the running data/ui build, or
+* the compiled-in CLI lib). If a user points the stack at a tag NEWER than the
+* control plane they're running, `ensureReleaseMigrated` runs an OLD migration
+* array that doesn't contain that release's migrations → the new images come up
+* against half-migrated files. There is no safe recovery, so this is a HARD block
+* (not a warning): nothing is written before it throws.
+*
+* The thin-harness design (§6.5) makes this satisfiable: the supervisor self-
+* updates data/ui to the current platform BEFORE the UI serves the upgrade
+* request, so "target ≤ running platform" only fails when the user genuinely
+* picks a tag the running control plane cannot migrate to — at which point the
+* fix is to update the app / control plane first, not to proceed.
+*
+* Non-semver targets (a moving `latest`/`dev` tag) are not comparable and are
+* left to the resolver paths that turn them into a concrete release first.
+*/
+function assertTargetNotNewerThanPlatform(targetTag) {
+	if (!isComparableSemver(targetTag) || !isComparableSemver(PLATFORM_VERSION)) return;
+	if (compareComparableVersions(targetTag, PLATFORM_VERSION) <= 0) return;
+	throw new Error(`Version ${formatForDisplay(targetTag)} is newer than the OpenPalm control plane you're running (${formatForDisplay(PLATFORM_VERSION)}). Update the OpenPalm app / control plane first, then update the stack. Nothing was changed.`);
 }
 function resolveImageNamespace(state) {
 	const namespace = (parseEnvFile(`${state.stashDir}/env/stack.env`).OP_IMAGE_NAMESPACE ?? process.env.OP_IMAGE_NAMESPACE ?? "openpalm").trim().toLowerCase();
@@ -7017,9 +7098,13 @@ async function resolveLatestPlatformTag(namespace) {
 	if (!latestTag) throw new Error("No usable Docker image tag found");
 	return latestTag;
 }
-async function resolveLatestPlatformTagForCurrentMajor(namespace, currentTag) {
-	const latestTag = resolveNewestDockerTag(await fetchDockerTagsPayload(namespace, "assistant"), { sameMajorAs: currentTag });
-	if (!latestTag) throw new Error(`No usable Docker image tag found in major ${currentTag.replace(/^v/, "").split(".")[0]}`);
+async function resolveLatestPlatformTagForCurrentMajor(namespace, currentTag, opts = {}) {
+	const skipPrerelease = !opts.allowPrerelease && !isPrerelease(currentTag);
+	const latestTag = resolveNewestDockerTag(await fetchDockerTagsPayload(namespace, "assistant"), {
+		sameMajorAs: currentTag,
+		skipPrerelease
+	});
+	if (!latestTag) throw new Error(`No usable Docker image tag found in major ${majorVersionOf(currentTag) ?? currentTag}`);
 	return latestTag;
 }
 async function updateStackEnvToLatestImageTag(state, resolvedTag) {
@@ -7077,11 +7162,12 @@ async function withStackEnvRollback(state, run) {
 *
 * Callers handle their own audit logging and admin self-recreation.
 */
-async function performUpgrade(state) {
+async function performUpgrade(state, opts = {}) {
 	return withStackEnvRollback(state, async () => {
 		const composeOpts = buildComposeOptions(state);
 		const namespace = resolveImageNamespace(state);
-		const imageTag = await resolveLatestPlatformTagForCurrentMajor(namespace, resolvePlatformVersionPolicyBaseTag(state));
+		const imageTag = await resolveLatestPlatformTagForCurrentMajor(namespace, resolvePlatformVersionPolicyBaseTag(state), { allowPrerelease: opts.allowPrerelease });
+		assertTargetNotNewerThanPlatform(imageTag);
 		ensureReleaseMigrated({
 			homeDir: state.homeDir,
 			targetVersion: imageTag
@@ -7123,6 +7209,7 @@ async function applyTagChange(state, tag) {
 			const msg = e instanceof Error ? e.message : String(e);
 			throw new Error(`Cannot resolve "latest" to a concrete release: ${msg}. Check your network connection or select a specific version.`);
 		}
+		assertTargetNotNewerThanPlatform(resolvedTag);
 		const stackEnvPath = `${state.stashDir}/env/stack.env`;
 		const currentEnv = parseEnvFile(stackEnvPath);
 		const pinnedImages = parsePinnedImages(currentEnv.OP_PINNED_IMAGES);
@@ -9768,5 +9855,5 @@ function collectBindAddressWarnings(env) {
 	return warnings;
 }
 
-export { getAddonProfiles as $, AKM_USER_ENV_REF as A, composeStop as B, CORE_SERVICES as C, composeUp as D, createLogger as E, createOpenCodeClient as F, createState as G, deleteUserEnvKey as H, deriveLaunchStatus as I, deriveLocalStackState as J, detectGpu as K, detectHostOpenCode as L, MigrationError as M, detectLocalProviders as N, detectRuntime as O, disableHostAkmSharing as P, enableHostAkmSharing as Q, ensureAkmUserEnv as R, ensureHomeDirs as S, ensureMigrated as T, ensureOpenCodeConfig as U, ensureOpenCodeSystemConfig as V, ensureSecrets as W, executeAutomation as X, fetchProviderModels as Y, getAddonProfileAvailability as Z, getAddonProfileSelection as _, addonProfileId as a, getAddonServiceNames as a0, getAkmStats as a1, getDockerEvents as a2, getHostAkmSharingStatus as a3, getRegistryAddonConfig as a4, hostAkmStashPath as a5, importHostOpenCode as a6, initializeStateSecrets as a7, isAllowedService as a8, isHostAkmAvailable as a9, resolveDataDir as aA, resolveDeployJournalPath as aB, resolveRuntimeFiles as aC, resolveStackDir as aD, runDeploy as aE, seedUiBuild as aF, setAddonEnabled as aG, setAddonProfileSelection as aH, summarizeComposeStderr as aI, useExistingProviderForAssistantCli as aJ, validateProposedState as aK, writeFileAtomic as aL, writeRuntimeFiles as aM, writeSecretFile as aN, writeStackSecretEnv as aO, writeTaskFile as aP, writeUserEnvKey as aQ, writeVoiceVars as aR, isSetupComplete as aa, listAssistantCliTools as ab, listAvailableAddonIds as ac, listEnabledAddonIds as ad, listSecretFiles as ae, loadAutomations as af, mapDockerError as ag, markSetupComplete as ah, parseComposeStderr as ai, parseEnvFile as aj, patchSecretsEnvFile as ak, performSetup as al, performUpgrade as am, readAutomationLogs as an, readDeployJournal as ao, readSecret as ap, readSecretFile as aq, readStackEnv as ar, readStackRuntimeEnv as as, readStackSecretEnv as at, readTaskFile as au, readUserEnvFile as av, recommendSetup as aw, removeSecretFile as ax, removeTaskFile as ay, resolveComposeProjectName as az, annotateAddonProfileAvailability as b, applyInstall as c, applyTagChange as d, applyUninstall as e, applyUpdate as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, backupSetupInputs as j, buildAkmEndpoint as k, buildAkmEnv as l, buildComposeOptions as m, buildManagedServices as n, checkDocker as o, checkDockerCompose as p, classifyLocalInstall as q, collectBindAddressWarnings as r, composeDown as s, composeLogs as t, composePreflight as u, composePs as v, composePull as w, composeRestart as x, composeStart as y, composeStats as z };
-//# sourceMappingURL=src-CHZNd5cO.js.map
+export { formatForDisplay as $, AKM_USER_ENV_REF as A, composeStats as B, CORE_SERVICES as C, composeStop as D, composeUp as E, createLogger as F, createOpenCodeClient as G, createState as H, deleteUserEnvKey as I, deriveLaunchStatus as J, deriveLocalStackState as K, detectGpu as L, MigrationError as M, detectHostOpenCode as N, detectLocalProviders as O, PLATFORM_VERSION as P, detectRuntime as Q, disableHostAkmSharing as R, enableHostAkmSharing as S, ensureAkmUserEnv as T, ensureHomeDirs as U, ensureMigrated as V, ensureOpenCodeConfig as W, ensureOpenCodeSystemConfig as X, ensureSecrets as Y, executeAutomation as Z, fetchProviderModels as _, addonProfileId as a, getAddonProfileAvailability as a0, getAddonProfileSelection as a1, getAddonProfiles as a2, getAddonServiceNames as a3, getAkmStats as a4, getDockerEvents as a5, getHostAkmSharingStatus as a6, getRegistryAddonConfig as a7, hostAkmStashPath as a8, importHostOpenCode as a9, recommendSetup as aA, removeSecretFile as aB, removeTaskFile as aC, resolveComposeProjectName as aD, resolveDataDir as aE, resolveDeployJournalPath as aF, resolveRuntimeFiles as aG, resolveStackDir as aH, runDeploy as aI, seedUiBuild as aJ, setAddonEnabled as aK, setAddonProfileSelection as aL, summarizeComposeStderr as aM, useExistingProviderForAssistantCli as aN, validateProposedState as aO, writeFileAtomic as aP, writeRuntimeFiles as aQ, writeSecretFile as aR, writeStackSecretEnv as aS, writeTaskFile as aT, writeUserEnvKey as aU, writeVoiceVars as aV, initializeStateSecrets as aa, isAllowedService as ab, isComparableSemver as ac, isHostAkmAvailable as ad, isSetupComplete as ae, listAssistantCliTools as af, listAvailableAddonIds as ag, listEnabledAddonIds as ah, listSecretFiles as ai, loadAutomations as aj, mapDockerError as ak, markSetupComplete as al, parseComposeStderr as am, parseEnvFile as an, patchSecretsEnvFile as ao, performSetup as ap, performUpgrade as aq, readAutomationLogs as ar, readDeployJournal as as, readSecret as at, readSecretFile as au, readStackEnv as av, readStackRuntimeEnv as aw, readStackSecretEnv as ax, readTaskFile as ay, readUserEnvFile as az, annotateAddonProfileAvailability as b, applyInstall as c, applyTagChange as d, applyUninstall as e, applyUpdate as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, backupSetupInputs as j, buildAkmEndpoint as k, buildAkmEnv as l, buildComposeOptions as m, buildManagedServices as n, checkDocker as o, checkDockerCompose as p, classifyLocalInstall as q, collectBindAddressWarnings as r, compareComparableVersions as s, composeDown as t, composeLogs as u, composePreflight as v, composePs as w, composePull as x, composeRestart as y, composeStart as z };
+//# sourceMappingURL=src-BEj0DuSB.js.map