@openpalm/ui 0.12.0-rc.2 → 0.12.0-rc.3

package/build/server/chunks/{session-cookie-C-kIy9pI.js.map → session-cookie-DhA3swUc.js.map}

@@ -1 +1 @@
-{"version":3,"file":"session-cookie-C-kIy9pI.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}
+{"version":3,"file":"session-cookie-DhA3swUc.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}

package/build/server/chunks/{setup-deploy-BL_wmz6j.js → setup-deploy-C0hLjImh.js}

@@ -1,4 +1,4 @@
-import { j as backupSetupInputs, aI as runDeploy, aF as resolveDeployJournalPath, ae as isSetupComplete, aH as resolveStackDir, as as readDeployJournal, al as markSetupComplete } from './src-BEj0DuSB.js';
+import { j as backupSetupInputs, aR as runDeploy, aO as resolveDeployJournalPath, aj as isSetupComplete, aQ as resolveStackDir, az as readDeployJournal, ar as markSetupComplete } from './src-B7oqi9q_.js';
 
 //#region src/lib/server/setup-deploy.ts
 var _state = {
@@ -72,4 +72,4 @@ function prepareSetupRestorePoint(state) {
 }
 
 export { getDeployState as g, prepareSetupRestorePoint as p, resetDeployState as r, startDeploy as s };
-//# sourceMappingURL=setup-deploy-BL_wmz6j.js.map
+//# sourceMappingURL=setup-deploy-C0hLjImh.js.map

package/build/server/chunks/{setup-deploy-BL_wmz6j.js.map → setup-deploy-C0hLjImh.js.map}

@@ -1 +1 @@
-{"version":3,"file":"setup-deploy-BL_wmz6j.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { A as readDeployJournal, M as runDeploy, O as backupSetupInputs, Yt as resolveStackDir, j as resolveDeployJournalPath, k as markSetupComplete, ut as isSetupComplete } from \"./src.js\";\n//#region src/lib/server/setup-deploy.ts\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\timageWarning: null,\n\tphase: \"writing-config\"\n};\nvar _deployPromise = null;\nfunction deployStateFromJournal(state) {\n\tconst journal = readDeployJournal(resolveDeployJournalPath(state));\n\treturn {\n\t\tdeploying: journal.deploying,\n\t\tinterrupted: journal.interrupted,\n\t\tsetupComplete: journal.setupComplete || isSetupComplete(resolveStackDir()),\n\t\tdeployStatus: journal.deployStatus,\n\t\tdeployError: journal.deployError,\n\t\timageWarning: journal.imageWarning,\n\t\tphase: journal.phase\n\t};\n}\nfunction getDeployState(state) {\n\tif (state) _state = deployStateFromJournal(state);\n\telse if (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveStackDir())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: _state.deployStatus.map((entry) => ({ ...entry }))\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\timageWarning: null,\n\t\tphase: \"writing-config\"\n\t};\n}\nfunction startDeploy(state) {\n\tif (_deployPromise) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\treturn;\n\t}\n\t_deployPromise = (async () => {\n\t\tawait runDeploy(state, {\n\t\t\tjournalPath: resolveDeployJournalPath(state),\n\t\t\tonUpdate(progress) {\n\t\t\t\t_state = {\n\t\t\t\t\tdeploying: progress.deploying,\n\t\t\t\t\tinterrupted: progress.interrupted,\n\t\t\t\t\tsetupComplete: progress.setupComplete,\n\t\t\t\t\tdeployStatus: progress.deployStatus,\n\t\t\t\t\tdeployError: progress.deployError,\n\t\t\t\t\timageWarning: progress.imageWarning,\n\t\t\t\t\tphase: progress.phase\n\t\t\t\t};\n\t\t\t},\n\t\t\tmarkSetupComplete() {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t}\n\t\t});\n\t})().finally(() => {\n\t\t_deployPromise = null;\n\t});\n}\nfunction prepareSetupRestorePoint(state) {\n\treturn backupSetupInputs(state);\n}\n//#endregion\nexport { startDeploy as i, prepareSetupRestorePoint as n, resetDeployState as r, getDeployState as t };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,YAAY,EAAE,IAAI;AACnB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,IAAI,cAAc,GAAG,IAAI;AACzB,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;AAC9B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;AAC5E,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,KAAK,EAAE,OAAO,CAAC;AACjB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,IAAI,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAClD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AACvH,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AACjE,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,YAAY,EAAE,IAAI;AACpB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,cAAc,EAAE;AACrB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE;AACF,CAAC;AACD,CAAC,cAAc,GAAG,CAAC,YAAY;AAC/B,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;AACzB,GAAG,WAAW,EAAE,wBAAwB,CAAC,KAAK,CAAC;AAC/C,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,MAAM,GAAG;AACb,KAAK,SAAS,EAAE,QAAQ,CAAC,SAAS;AAClC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,aAAa,EAAE,QAAQ,CAAC,aAAa;AAC1C,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,KAAK,EAAE,QAAQ,CAAC;AACrB,KAAK;AACL,GAAG,CAAC;AACJ,GAAG,iBAAiB,GAAG;AACvB,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;AACpB,EAAE,cAAc,GAAG,IAAI;AACvB,CAAC,CAAC,CAAC;AACH;AACA,SAAS,wBAAwB,CAAC,KAAK,EAAE;AACzC,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC;AAChC;;;;"}
+{"version":3,"file":"setup-deploy-C0hLjImh.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { $t as resolveStackDir, A as readDeployJournal, M as runDeploy, O as backupSetupInputs, ft as isSetupComplete, j as resolveDeployJournalPath, k as markSetupComplete } from \"./src.js\";\n//#region src/lib/server/setup-deploy.ts\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\timageWarning: null,\n\tphase: \"writing-config\"\n};\nvar _deployPromise = null;\nfunction deployStateFromJournal(state) {\n\tconst journal = readDeployJournal(resolveDeployJournalPath(state));\n\treturn {\n\t\tdeploying: journal.deploying,\n\t\tinterrupted: journal.interrupted,\n\t\tsetupComplete: journal.setupComplete || isSetupComplete(resolveStackDir()),\n\t\tdeployStatus: journal.deployStatus,\n\t\tdeployError: journal.deployError,\n\t\timageWarning: journal.imageWarning,\n\t\tphase: journal.phase\n\t};\n}\nfunction getDeployState(state) {\n\tif (state) _state = deployStateFromJournal(state);\n\telse if (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveStackDir())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: _state.deployStatus.map((entry) => ({ ...entry }))\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\timageWarning: null,\n\t\tphase: \"writing-config\"\n\t};\n}\nfunction startDeploy(state) {\n\tif (_deployPromise) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\treturn;\n\t}\n\t_deployPromise = (async () => {\n\t\tawait runDeploy(state, {\n\t\t\tjournalPath: resolveDeployJournalPath(state),\n\t\t\tonUpdate(progress) {\n\t\t\t\t_state = {\n\t\t\t\t\tdeploying: progress.deploying,\n\t\t\t\t\tinterrupted: progress.interrupted,\n\t\t\t\t\tsetupComplete: progress.setupComplete,\n\t\t\t\t\tdeployStatus: progress.deployStatus,\n\t\t\t\t\tdeployError: progress.deployError,\n\t\t\t\t\timageWarning: progress.imageWarning,\n\t\t\t\t\tphase: progress.phase\n\t\t\t\t};\n\t\t\t},\n\t\t\tmarkSetupComplete() {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t}\n\t\t});\n\t})().finally(() => {\n\t\t_deployPromise = null;\n\t});\n}\nfunction prepareSetupRestorePoint(state) {\n\treturn backupSetupInputs(state);\n}\n//#endregion\nexport { startDeploy as i, prepareSetupRestorePoint as n, resetDeployState as r, getDeployState as t };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,YAAY,EAAE,IAAI;AACnB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,IAAI,cAAc,GAAG,IAAI;AACzB,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;AAC9B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;AAC5E,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,KAAK,EAAE,OAAO,CAAC;AACjB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,IAAI,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAClD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AACvH,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AACjE,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,YAAY,EAAE,IAAI;AACpB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,cAAc,EAAE;AACrB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE;AACF,CAAC;AACD,CAAC,cAAc,GAAG,CAAC,YAAY;AAC/B,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;AACzB,GAAG,WAAW,EAAE,wBAAwB,CAAC,KAAK,CAAC;AAC/C,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,MAAM,GAAG;AACb,KAAK,SAAS,EAAE,QAAQ,CAAC,SAAS;AAClC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,aAAa,EAAE,QAAQ,CAAC,aAAa;AAC1C,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,KAAK,EAAE,QAAQ,CAAC;AACrB,KAAK;AACL,GAAG,CAAC;AACJ,GAAG,iBAAiB,GAAG;AACvB,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;AACpB,EAAE,cAAc,GAAG,IAAI;AACvB,CAAC,CAAC,CAAC;AACH;AACA,SAAS,wBAAwB,CAAC,KAAK,EAAE;AACzC,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC;AAChC;;;;"}

package/build/server/chunks/{src-BEj0DuSB.js → src-B7oqi9q_.js}

@@ -1,7 +1,7 @@
 import { _ as __commonJSMin, b as __require } from './chunk-CLZ62Ad-.js';
 import { P as PROVIDER_DEFAULT_URLS, a as PROVIDER_KEY_MAP } from './provider-constants-DPrj3yBX.js';
 import { r as require_dist } from './dist-DOFcG0Zp.js';
-import Vt, { existsSync, readFileSync, copyFileSync, chmodSync, mkdirSync, lstatSync, rmSync, readdirSync, writeFileSync, renameSync, statSync, cpSync, openSync, constants, writeSync, closeSync, chownSync, realpathSync } from 'node:fs';
+import Vt, { existsSync, readFileSync, copyFileSync, chmodSync, mkdirSync, lstatSync, rmSync, readdirSync, writeFileSync, renameSync, statSync, statfsSync, cpSync, openSync, constants, writeSync, closeSync, chownSync, realpathSync } from 'node:fs';
 import or, { join, basename, dirname, resolve, win32, posix } from 'node:path';
 import { Buffer as Buffer$1 } from 'buffer';
 import I from 'fs';
@@ -96,6 +96,84 @@ function timestampDirName(now = /* @__PURE__ */ new Date()) {
 	return now.toISOString().replace(/[:.]/g, "-");
 }
 /**
+* Recursively sum the apparent size (in bytes) of every file under `path`,
+* excluding the existing backups directory (we never back up backups).
+*
+* Cheap enough for a pre-backup estimate; errors on individual entries are
+* skipped (a transient unreadable file should not block the safety copy).
+*/
+function estimateHomeBackupBytes(homeDir) {
+	if (!existsSync(homeDir)) return 0;
+	const backupsDir = join(homeDir, "data", "backups");
+	let total = 0;
+	const walk = (dir) => {
+		let entries;
+		try {
+			entries = readdirSync(dir, { withFileTypes: true });
+		} catch {
+			return;
+		}
+		for (const entry of entries) {
+			const full = join(dir, entry.name);
+			if (full === backupsDir) continue;
+			if (entry.isDirectory()) walk(full);
+			else if (entry.isFile()) try {
+				total += statSync(full).size;
+			} catch {}
+		}
+	};
+	walk(homeDir);
+	return total;
+}
+/**
+* Estimate whether a full-home backup would fit safely on disk.
+*
+* Returns a structured result; the caller decides whether to warn, block, or
+* (with explicit confirmation) proceed. This NEVER deletes anything — it only
+* measures. `threshold` is the fraction of currently-free space the backup may
+* consume before it is flagged `insufficient` (default 80%).
+*/
+function checkBackupFreeSpace(homeDir, threshold = .8) {
+	const estimatedBytes = estimateHomeBackupBytes(homeDir);
+	let freeBytes = Number.POSITIVE_INFINITY;
+	try {
+		const stat = statfsSync(homeDir);
+		freeBytes = stat.bavail * stat.bsize;
+	} catch {}
+	const ratio = freeBytes > 0 ? estimatedBytes / freeBytes : Number.POSITIVE_INFINITY;
+	return {
+		estimatedBytes,
+		freeBytes,
+		ratio,
+		insufficient: estimatedBytes > freeBytes * threshold,
+		threshold
+	};
+}
+function formatBytes(bytes) {
+	if (!Number.isFinite(bytes)) return "unknown";
+	const units = [
+		"B",
+		"KB",
+		"MB",
+		"GB",
+		"TB"
+	];
+	let value = bytes;
+	let i = 0;
+	while (value >= 1024 && i < units.length - 1) {
+		value /= 1024;
+		i += 1;
+	}
+	return `${value.toFixed(value >= 10 || i === 0 ? 0 : 1)} ${units[i]}`;
+}
+/**
+* Human-readable, plain-language explanation of a low-free-space situation,
+* suitable for a CLI warning or a UI notice.
+*/
+function describeBackupSpaceShortfall(check) {
+	return `The safety backup is estimated at ${formatBytes(check.estimatedBytes)}, but only ${formatBytes(check.freeBytes)} is free on this disk. Backing up could fill the disk. Free up space (your old backups are under data/backups/ — review them with \`openpalm backups list\`), or re-run with confirmation to proceed anyway. Nothing was changed or deleted.`;
+}
+/**
 * Create a durable backup snapshot of the current OP_HOME contents.
 *
 * The backup is written under OP_HOME/data/backups/<timestamp>/ and excludes
@@ -123,6 +201,62 @@ function backupOpenPalmHome(homeDir) {
 	}
 	return copiedAny ? backupDir : null;
 }
+function listBackupDirs(homeDir) {
+	const backupsDir = join(homeDir, "data", "backups");
+	if (!existsSync(backupsDir)) return [];
+	return readdirSync(backupsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join(backupsDir, entry.name)).sort((a, b) => b.localeCompare(a));
+}
+function dirSizeBytes(dir) {
+	let total = 0;
+	let entries;
+	try {
+		entries = readdirSync(dir, { withFileTypes: true });
+	} catch {
+		return 0;
+	}
+	for (const entry of entries) {
+		const full = join(dir, entry.name);
+		if (entry.isDirectory()) total += dirSizeBytes(full);
+		else if (entry.isFile()) try {
+			total += statSync(full).size;
+		} catch {}
+	}
+	return total;
+}
+/**
+* Summarize the upgrade backup snapshots for UI visibility (count, total size,
+* last-backup time, per-backup sizes). Read-only — never deletes anything.
+*/
+function summarizeBackups(homeDir) {
+	const backups = listBackupDirs(homeDir).map((path) => {
+		let createdAt = "";
+		try {
+			createdAt = statSync(path).mtime.toISOString();
+		} catch {}
+		return {
+			path,
+			name: path.slice(path.lastIndexOf("/") + 1),
+			sizeBytes: dirSizeBytes(path),
+			createdAt
+		};
+	});
+	const totalBytes = backups.reduce((sum, b) => sum + b.sizeBytes, 0);
+	return {
+		count: backups.length,
+		totalBytes,
+		lastBackupAt: backups[0]?.createdAt || null,
+		backups
+	};
+}
+function pruneBackupDirs(homeDir, keep) {
+	if (!Number.isInteger(keep) || keep < 0) throw new Error("keep must be a non-negative integer");
+	const toDelete = listBackupDirs(homeDir).slice(keep);
+	for (const backupDir of toDelete) rmSync(backupDir, {
+		recursive: true,
+		force: true
+	});
+	return toDelete;
+}
 //#endregion
 //#region ../lib/src/control-plane/install-lock.ts
 var import_dist = require_dist();
@@ -249,6 +383,79 @@ function acquireInstallLock(dataDir) {
 	}
 	return null;
 }
+var INSTALL_LOCK_STALE_AFTER_MS = STALE_AFTER_MS;
+/**
+* Inspect the install lock under `dataDir` without modifying it. Used by the
+* `openpalm unlock` command and the UI "operation stuck?" affordance to decide
+* whether a removal is safe.
+*/
+function inspectInstallLock(dataDir) {
+	const path = join(dataDir, ".install.lock");
+	let content;
+	try {
+		content = readFileSync(path, "utf-8");
+	} catch (err) {
+		if (err.code === "ENOENT") return {
+			present: false,
+			path
+		};
+		let ageMs = null;
+		try {
+			ageMs = Date.now() - statSync(path).mtimeMs;
+		} catch {}
+		return {
+			present: true,
+			path,
+			pid: null,
+			timestamp: null,
+			ageMs,
+			stale: isStale(path)
+		};
+	}
+	const { pid, timestamp } = parseLockContent(content);
+	return {
+		present: true,
+		path,
+		pid,
+		timestamp,
+		ageMs: timestamp !== null ? Date.now() - timestamp : null,
+		stale: isStale(path)
+	};
+}
+/**
+* Remove the install lock ONLY if it is stale (dead holder PID or older than
+* the 30-minute staleness window). Never blind-removes a lock held by a live,
+* recent install. Returns `{ ok: false, reason: "live" }` when the lock is
+* still active so the caller can surface a clear message instead of forcing.
+*/
+function unlockInstallLock(dataDir) {
+	const status = inspectInstallLock(dataDir);
+	if (!status.present) return {
+		ok: true,
+		removed: false,
+		status
+	};
+	if (!status.stale) return {
+		ok: false,
+		reason: "live",
+		status
+	};
+	try {
+		rmSync(status.path, { force: true });
+		logger$11.info("removed stale install lock via unlock", { path: status.path });
+	} catch (err) {
+		logger$11.warn("failed to remove stale install lock during unlock", {
+			path: status.path,
+			error: err instanceof Error ? err.message : String(err)
+		});
+		throw err;
+	}
+	return {
+		ok: true,
+		removed: true,
+		status
+	};
+}
 function releaseInstallLock(handle) {
 	if (!handle) return;
 	try {
@@ -530,7 +737,7 @@ var import_main = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = DotenvModule;
 })))();
 var package_default = {
-	version: "0.12.0-rc.2"};
+	version: "0.12.0-rc.3"};
 //#endregion
 //#region ../lib/src/control-plane/versioning.ts
 var SEMVER_RE = /^v?\d+\.\d+\.\d+(?:[-+].*)?$/;
@@ -822,6 +1029,22 @@ var MigrationError = class extends Error {
 		this.name = "MigrationError";
 	}
 };
+/**
+* Thrown when the pre-backup free-space check estimates the safety backup would
+* exceed a safe fraction of free disk. Surfaced so callers (CLI/UI) can present
+* a plain-language warning and re-run with explicit confirmation. NOTHING is
+* deleted — the migration aborts cleanly with no changes made.
+*/
+var BackupSpaceError = class extends MigrationError {
+	estimatedBytes;
+	freeBytes;
+	constructor(message, guidance, estimatedBytes, freeBytes) {
+		super(message, guidance, null);
+		this.estimatedBytes = estimatedBytes;
+		this.freeBytes = freeBytes;
+		this.name = "BackupSpaceError";
+	}
+};
 var RELEASE_VERSION_KEY = "OP_RELEASE_VERSION";
 function resolveMigrationPaths(homeDir) {
 	return {
@@ -1273,7 +1496,7 @@ var RELEASE_MIGRATIONS = [
 		verify(ctx) {}
 	}
 ];
-var RECOVERY_GUIDANCE = "Your original files were left untouched and a full backup was taken first. To recover, restore the backup (see docs/operations/backup-restore.md) or run `openpalm migrate --dry-run` to preview the current copy-only migration. Full guide: docs/operations/upgrade-0.10-to-0.11.md";
+var RECOVERY_GUIDANCE = "Your original files were left untouched and a full backup was taken first. If something went wrong, run `openpalm rollback` to restore your previous state, or restore the backup manually (see docs/operations/backup-restore.md). You can also run `openpalm migrate --dry-run` to preview the current copy-only migration. Full guide: docs/operations/upgrade-0.10-to-0.11.md";
 function resolveComparableReleaseTarget(rawVersion) {
 	if (!rawVersion) return null;
 	return isComparableSemver(rawVersion) ? rawVersion : null;
@@ -1311,6 +1534,7 @@ function runReleaseMigrations(ctxBase, releaseFrom, targetVersion) {
 function ensureMigrated(opts = {}) {
 	const homeDir = opts.homeDir ? resolve(opts.homeDir) : process.env.OP_HOME ? resolve(process.env.OP_HOME) : resolve(process.env.HOME ?? "", ".openpalm");
 	const dryRun = opts.dryRun ?? false;
+	const confirmLowSpace = opts.confirmLowSpace ?? false;
 	const log = opts.log ?? (() => {});
 	const ctxBase = {
 		...resolveMigrationPaths(homeDir),
@@ -1354,6 +1578,8 @@ function ensureMigrated(opts = {}) {
 			}
 			lock = acquireInstallLock(ctxBase.dataDir);
 			if (!lock) throw new MigrationError("Another install/upgrade is in progress.", RECOVERY_GUIDANCE, null);
+			const spaceCheck = checkBackupFreeSpace(homeDir);
+			if (spaceCheck.insufficient && !confirmLowSpace) throw new BackupSpaceError(describeBackupSpaceShortfall(spaceCheck), RECOVERY_GUIDANCE, spaceCheck.estimatedBytes, spaceCheck.freeBytes);
 			log("Taking a full backup before migrating…");
 			try {
 				backupDir = backupOpenPalmHome(homeDir);
@@ -5336,20 +5562,84 @@ function writeSystemEnv(state) {
 		if (!hasUsableOperatorId(parsed, "OP_GID")) adminManaged.OP_GID = String(ids.gid);
 	}
 	if (!parsed.OP_HOME) adminManaged.OP_HOME = state.homeDir;
-	base = stripSecretLikeEnvKeys(base);
+	const { content: strippedBase, removed } = stripSecretLikeEnvKeys(base);
+	base = strippedBase;
+	if (removed.length > 0) {
+		logger$7.warn("Removed secret-looking keys from stack.env (they belong in Connections/secrets)", {
+			removedKeys: removed,
+			stackEnvPath: systemEnvPath
+		});
+		recordSecretStripNotice(state, removed);
+	}
 	assertNoSecretLikeStackEnvKeys(parseEnvContent(base));
 	assertNoSecretLikeStackEnvKeys(adminManaged);
 	writeFileSync(systemEnvPath, mergeEnvContent(base, adminManaged, { sectionHeader: "# ── Admin-managed ──────────────────────────────────────────────────" }), { mode: 384 });
 	chmodSync(systemEnvPath, 384);
 }
 function stripSecretLikeEnvKeys(content) {
-	return content.split("\n").filter((line) => {
-		let trimmed = line.trim();
-		if (trimmed.startsWith("export ")) trimmed = trimmed.slice(7).trimStart();
-		const eq = trimmed.indexOf("=");
-		if (eq <= 0) return true;
-		return !isSecretLikeStackEnvKey(trimmed.slice(0, eq).trim());
-	}).join("\n");
+	const removed = [];
+	return {
+		content: content.split("\n").filter((line) => {
+			let trimmed = line.trim();
+			if (trimmed.startsWith("export ")) trimmed = trimmed.slice(7).trimStart();
+			const eq = trimmed.indexOf("=");
+			if (eq <= 0) return true;
+			const key = trimmed.slice(0, eq).trim();
+			if (isSecretLikeStackEnvKey(key)) {
+				removed.push(key);
+				return false;
+			}
+			return true;
+		}).join("\n"),
+		removed
+	};
+}
+/**
+* Path of the one-time "secret-looking values were removed from stack.env"
+* notice the UI reads and dismisses.
+*/
+function secretStripNoticePath(state) {
+	return `${state.dataDir}/secret-strip-notice.json`;
+}
+function recordSecretStripNotice(state, newlyRemoved) {
+	const path = secretStripNoticePath(state);
+	let keys = new Set(newlyRemoved);
+	if (existsSync(path)) try {
+		const prior = JSON.parse(readFileSync(path, "utf-8"));
+		if (Array.isArray(prior.keys)) keys = new Set([...prior.keys, ...newlyRemoved]);
+	} catch {}
+	const notice = {
+		keys: [...keys].sort(),
+		at: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	try {
+		mkdirSync(state.dataDir, { recursive: true });
+		writeFileSync(path, JSON.stringify(notice, null, 2));
+	} catch (e) {
+		logger$7.warn("Could not persist secret-strip notice", { error: e instanceof Error ? e.message : String(e) });
+	}
+}
+/** Read the pending secret-strip notice, or null when there is none. */
+function readSecretStripNotice(state) {
+	const path = secretStripNoticePath(state);
+	if (!existsSync(path)) return null;
+	try {
+		const parsed = JSON.parse(readFileSync(path, "utf-8"));
+		if (Array.isArray(parsed.keys) && parsed.keys.length > 0 && typeof parsed.at === "string") return {
+			keys: parsed.keys,
+			at: parsed.at
+		};
+	} catch {}
+	return null;
+}
+/** Dismiss (delete) the pending secret-strip notice. */
+function dismissSecretStripNotice(state) {
+	const path = secretStripNoticePath(state);
+	if (existsSync(path)) try {
+		rmSync(path);
+	} catch (e) {
+		logger$7.warn("Could not dismiss secret-strip notice", { error: e instanceof Error ? e.message : String(e) });
+	}
 }
 function generateFallbackSystemEnv(state) {
 	const ids = resolveOperatorIds(state.homeDir);
@@ -6991,6 +7281,43 @@ function resolvePlatformVersionPolicyBaseTag(state) {
 * Non-semver targets (a moving `latest`/`dev` tag) are not comparable and are
 * left to the resolver paths that turn them into a concrete release first.
 */
+/**
+* Downgrade-needs-confirmation signal (#501).
+*
+* Release migrations are forward-only (copy-only, additive); they do NOT run
+* backward. Pointing the stack at an OLDER tag than the one currently running is
+* therefore a data-safety event, not a routine version change: the older images
+* may not understand files the newer release already migrated. We don't block it
+* (a user may legitimately need to roll back), but we require an explicit
+* confirmation so it can't happen by a stray dropdown selection. The UI catches
+* this by `code` and shows a plain warning + confirm; the CLI surfaces the
+* message and a `--confirm`/`--yes` path.
+*/
+var DowngradeConfirmationRequired = class extends Error {
+	code = "downgrade_confirmation_required";
+	currentVersion;
+	targetVersion;
+	constructor(currentVersion, targetVersion) {
+		super(`Version ${formatForDisplay(targetVersion)} is older than the version you're running (${formatForDisplay(currentVersion)}). This is a downgrade. Release migrations don't run backward; your data may not be compatible — restore from backup if needed. Re-run with confirmation to proceed. Nothing was changed.`);
+		this.name = "DowngradeConfirmationRequired";
+		this.currentVersion = currentVersion;
+		this.targetVersion = targetVersion;
+	}
+};
+/**
+* Throw {@link DowngradeConfirmationRequired} when `targetTag` is strictly older
+* than the version currently configured in stack.env, unless the caller passed
+* an explicit confirmation. Non-semver tags (a moving `latest`/`dev` ref, or a
+* first install with no current tag) are not comparable and pass through — the
+* resolver paths turn `latest` into a concrete release before this runs.
+*/
+function assertNotUnconfirmedDowngrade(state, targetTag, confirmDowngrade) {
+	if (confirmDowngrade) return;
+	const currentTag = resolvePlatformVersionPolicyBaseTag(state);
+	if (!isComparableSemver(targetTag) || !isComparableSemver(currentTag)) return;
+	if (compareComparableVersions(targetTag, currentTag) >= 0) return;
+	throw new DowngradeConfirmationRequired(currentTag, targetTag);
+}
 function assertTargetNotNewerThanPlatform(targetTag) {
 	if (!isComparableSemver(targetTag) || !isComparableSemver(PLATFORM_VERSION)) return;
 	if (compareComparableVersions(targetTag, PLATFORM_VERSION) <= 0) return;
@@ -7098,6 +7425,15 @@ async function resolveLatestPlatformTag(namespace) {
 	if (!latestTag) throw new Error("No usable Docker image tag found");
 	return latestTag;
 }
+/**
+* Resolve the default target version for `openpalm migrate --dry-run`: the
+* newest published platform tag in the current major. Mirrors the resolver the
+* upgrade path uses (same namespace, same base tag, same prerelease policy) so a
+* dry-run preview reflects the exact version `openpalm update` would move to.
+*/
+async function resolveDefaultMigrateTarget(state, opts = {}) {
+	return resolveLatestPlatformTagForCurrentMajor(resolveImageNamespace(state), resolvePlatformVersionPolicyBaseTag(state), { allowPrerelease: opts.allowPrerelease });
+}
 async function resolveLatestPlatformTagForCurrentMajor(namespace, currentTag, opts = {}) {
 	const skipPrerelease = !opts.allowPrerelease && !isPrerelease(currentTag);
 	const latestTag = resolveNewestDockerTag(await fetchDockerTagsPayload(namespace, "assistant"), {
@@ -7198,7 +7534,7 @@ async function performUpgrade(state, opts = {}) {
 * Set a specific image tag in stack.env then pull images and restart containers.
 * Used by the admin "set version" action — skips the auto-detect step in performUpgrade.
 */
-async function applyTagChange(state, tag) {
+async function applyTagChange(state, tag, opts = {}) {
 	return withStackEnvRollback(state, async () => {
 		const namespace = resolveImageNamespace(state);
 		const requested = tag.trim();
@@ -7210,6 +7546,7 @@ async function applyTagChange(state, tag) {
 			throw new Error(`Cannot resolve "latest" to a concrete release: ${msg}. Check your network connection or select a specific version.`);
 		}
 		assertTargetNotNewerThanPlatform(resolvedTag);
+		assertNotUnconfirmedDowngrade(state, resolvedTag, opts.confirmDowngrade ?? false);
 		const stackEnvPath = `${state.stashDir}/env/stack.env`;
 		const currentEnv = parseEnvFile(stackEnvPath);
 		const pinnedImages = parsePinnedImages(currentEnv.OP_PINNED_IMAGES);
@@ -7695,7 +8032,7 @@ async function runDeploy(state, options = {}) {
 	const lock = acquireInstallLock(state.dataDir);
 	if (!lock) {
 		progress.deploying = false;
-		progress.deployError = "install_in_progress: A deploy is already running. Wait for it to finish.";
+		progress.deployError = "install_in_progress: A deploy is already running. Wait for it to finish (the lock clears itself automatically after 30 minutes). If you're sure nothing is running, run 'openpalm unlock' to clear a stale lock.";
 		emitProgress(options, progress);
 		return progress;
 	}
@@ -9369,7 +9706,7 @@ async function performSetup(input, opts) {
 	const lockHandle = acquireInstallLock(state.dataDir);
 	if (lockHandle === null) return {
 		ok: false,
-		error: "install_in_progress: Another install is in progress. Wait for it to finish, or remove state/.install.lock if you're sure no install is running."
+		error: "install_in_progress: Another install is in progress. Wait for it to finish (the lock clears itself automatically after 30 minutes). If you're sure nothing is running, run 'openpalm unlock' to clear a stale lock."
 	};
 	logger.info("performing setup", { connectionCount: connections.length });
 	const updates = buildOwnerEnvFromSetup(owner);
@@ -9855,5 +10192,5 @@ function collectBindAddressWarnings(env) {
 	return warnings;
 }
 
-export { formatForDisplay as $, AKM_USER_ENV_REF as A, composeStats as B, CORE_SERVICES as C, composeStop as D, composeUp as E, createLogger as F, createOpenCodeClient as G, createState as H, deleteUserEnvKey as I, deriveLaunchStatus as J, deriveLocalStackState as K, detectGpu as L, MigrationError as M, detectHostOpenCode as N, detectLocalProviders as O, PLATFORM_VERSION as P, detectRuntime as Q, disableHostAkmSharing as R, enableHostAkmSharing as S, ensureAkmUserEnv as T, ensureHomeDirs as U, ensureMigrated as V, ensureOpenCodeConfig as W, ensureOpenCodeSystemConfig as X, ensureSecrets as Y, executeAutomation as Z, fetchProviderModels as _, addonProfileId as a, getAddonProfileAvailability as a0, getAddonProfileSelection as a1, getAddonProfiles as a2, getAddonServiceNames as a3, getAkmStats as a4, getDockerEvents as a5, getHostAkmSharingStatus as a6, getRegistryAddonConfig as a7, hostAkmStashPath as a8, importHostOpenCode as a9, recommendSetup as aA, removeSecretFile as aB, removeTaskFile as aC, resolveComposeProjectName as aD, resolveDataDir as aE, resolveDeployJournalPath as aF, resolveRuntimeFiles as aG, resolveStackDir as aH, runDeploy as aI, seedUiBuild as aJ, setAddonEnabled as aK, setAddonProfileSelection as aL, summarizeComposeStderr as aM, useExistingProviderForAssistantCli as aN, validateProposedState as aO, writeFileAtomic as aP, writeRuntimeFiles as aQ, writeSecretFile as aR, writeStackSecretEnv as aS, writeTaskFile as aT, writeUserEnvKey as aU, writeVoiceVars as aV, initializeStateSecrets as aa, isAllowedService as ab, isComparableSemver as ac, isHostAkmAvailable as ad, isSetupComplete as ae, listAssistantCliTools as af, listAvailableAddonIds as ag, listEnabledAddonIds as ah, listSecretFiles as ai, loadAutomations as aj, mapDockerError as ak, markSetupComplete as al, parseComposeStderr as am, parseEnvFile as an, patchSecretsEnvFile as ao, performSetup as ap, performUpgrade as aq, readAutomationLogs as ar, readDeployJournal as as, readSecret as at, readSecretFile as au, readStackEnv as av, readStackRuntimeEnv as aw, readStackSecretEnv as ax, readTaskFile as ay, readUserEnvFile as az, annotateAddonProfileAvailability as b, applyInstall as c, applyTagChange as d, applyUninstall as e, applyUpdate as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, backupSetupInputs as j, buildAkmEndpoint as k, buildAkmEnv as l, buildComposeOptions as m, buildManagedServices as n, checkDocker as o, checkDockerCompose as p, classifyLocalInstall as q, collectBindAddressWarnings as r, compareComparableVersions as s, composeDown as t, composeLogs as u, composePreflight as v, composePs as w, composePull as x, composeRestart as y, composeStart as z };
-//# sourceMappingURL=src-BEj0DuSB.js.map
+export { ensureReleaseMigrated as $, AKM_USER_ENV_REF as A, composeStats as B, CORE_SERVICES as C, DowngradeConfirmationRequired as D, composeStop as E, composeUp as F, createLogger as G, createOpenCodeClient as H, INSTALL_LOCK_STALE_AFTER_MS as I, createState as J, deleteUserEnvKey as K, deriveLaunchStatus as L, MigrationError as M, deriveLocalStackState as N, detectGpu as O, PLATFORM_VERSION as P, detectHostOpenCode as Q, detectLocalProviders as R, detectRuntime as S, disableHostAkmSharing as T, dismissSecretStripNotice as U, enableHostAkmSharing as V, ensureAkmUserEnv as W, ensureHomeDirs as X, ensureMigrated as Y, ensureOpenCodeConfig as Z, ensureOpenCodeSystemConfig as _, addonProfileId as a, writeRuntimeFiles as a$, ensureSecrets as a0, executeAutomation as a1, fetchProviderModels as a2, formatForDisplay as a3, getAddonProfileAvailability as a4, getAddonProfileSelection as a5, getAddonProfiles as a6, getAddonServiceNames as a7, getAkmStats as a8, getDockerEvents as a9, readSecret as aA, readSecretFile as aB, readSecretStripNotice as aC, readStackEnv as aD, readStackRuntimeEnv as aE, readStackSecretEnv as aF, readTaskFile as aG, readUserEnvFile as aH, recommendSetup as aI, removeSecretFile as aJ, removeTaskFile as aK, resolveComposeProjectName as aL, resolveDataDir as aM, resolveDefaultMigrateTarget as aN, resolveDeployJournalPath as aO, resolveRuntimeFiles as aP, resolveStackDir as aQ, runDeploy as aR, seedUiBuild as aS, setAddonEnabled as aT, setAddonProfileSelection as aU, summarizeBackups as aV, summarizeComposeStderr as aW, unlockInstallLock as aX, useExistingProviderForAssistantCli as aY, validateProposedState as aZ, writeFileAtomic as a_, getHostAkmSharingStatus as aa, getRegistryAddonConfig as ab, hostAkmStashPath as ac, importHostOpenCode as ad, initializeStateSecrets as ae, inspectInstallLock as af, isAllowedService as ag, isComparableSemver as ah, isHostAkmAvailable as ai, isSetupComplete as aj, listAssistantCliTools as ak, listAvailableAddonIds as al, listBackupDirs as am, listEnabledAddonIds as an, listSecretFiles as ao, loadAutomations as ap, mapDockerError as aq, markSetupComplete as ar, parseComposeStderr as as, parseEnvFile as at, patchSecretsEnvFile as au, performSetup as av, performUpgrade as aw, pruneBackupDirs as ax, readAutomationLogs as ay, readDeployJournal as az, annotateAddonProfileAvailability as b, writeSecretFile as b0, writeStackSecretEnv as b1, writeTaskFile as b2, writeUserEnvKey as b3, writeVoiceVars as b4, applyInstall as c, applyTagChange as d, applyUninstall as e, applyUpdate as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, backupSetupInputs as j, buildAkmEndpoint as k, buildAkmEnv as l, buildComposeOptions as m, buildManagedServices as n, checkDocker as o, checkDockerCompose as p, classifyLocalInstall as q, collectBindAddressWarnings as r, compareComparableVersions as s, composeDown as t, composeLogs as u, composePreflight as v, composePs as w, composePull as x, composeRestart as y, composeStart as z };
+//# sourceMappingURL=src-B7oqi9q_.js.map