@openpalm/ui 0.12.0-rc.3 → 0.12.0-rc.5

package/build/server/chunks/{session-cookie-DhA3swUc.js.map → session-cookie-CkOAhUjg.js.map}

@@ -1 +1 @@
-{"version":3,"file":"session-cookie-DhA3swUc.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}
+{"version":3,"file":"session-cookie-CkOAhUjg.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}

package/build/server/chunks/{setup-deploy-C0hLjImh.js → setup-deploy-BVt3AXY8.js}

@@ -1,4 +1,4 @@
-import { j as backupSetupInputs, aR as runDeploy, aO as resolveDeployJournalPath, aj as isSetupComplete, aQ as resolveStackDir, az as readDeployJournal, ar as markSetupComplete } from './src-B7oqi9q_.js';
+import { j as backupSetupInputs, aT as runDeploy, aP as resolveDeployJournalPath, ak as isSetupComplete, aS as resolveStackDir, aA as readDeployJournal, as as markSetupComplete } from './src-hV_EYNgm.js';
 
 //#region src/lib/server/setup-deploy.ts
 var _state = {
@@ -72,4 +72,4 @@ function prepareSetupRestorePoint(state) {
 }
 
 export { getDeployState as g, prepareSetupRestorePoint as p, resetDeployState as r, startDeploy as s };
-//# sourceMappingURL=setup-deploy-C0hLjImh.js.map
+//# sourceMappingURL=setup-deploy-BVt3AXY8.js.map

package/build/server/chunks/{setup-deploy-C0hLjImh.js.map → setup-deploy-BVt3AXY8.js.map}

@@ -1 +1 @@
-{"version":3,"file":"setup-deploy-C0hLjImh.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { $t as resolveStackDir, A as readDeployJournal, M as runDeploy, O as backupSetupInputs, ft as isSetupComplete, j as resolveDeployJournalPath, k as markSetupComplete } from \"./src.js\";\n//#region src/lib/server/setup-deploy.ts\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\timageWarning: null,\n\tphase: \"writing-config\"\n};\nvar _deployPromise = null;\nfunction deployStateFromJournal(state) {\n\tconst journal = readDeployJournal(resolveDeployJournalPath(state));\n\treturn {\n\t\tdeploying: journal.deploying,\n\t\tinterrupted: journal.interrupted,\n\t\tsetupComplete: journal.setupComplete || isSetupComplete(resolveStackDir()),\n\t\tdeployStatus: journal.deployStatus,\n\t\tdeployError: journal.deployError,\n\t\timageWarning: journal.imageWarning,\n\t\tphase: journal.phase\n\t};\n}\nfunction getDeployState(state) {\n\tif (state) _state = deployStateFromJournal(state);\n\telse if (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveStackDir())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: _state.deployStatus.map((entry) => ({ ...entry }))\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\timageWarning: null,\n\t\tphase: \"writing-config\"\n\t};\n}\nfunction startDeploy(state) {\n\tif (_deployPromise) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\treturn;\n\t}\n\t_deployPromise = (async () => {\n\t\tawait runDeploy(state, {\n\t\t\tjournalPath: resolveDeployJournalPath(state),\n\t\t\tonUpdate(progress) {\n\t\t\t\t_state = {\n\t\t\t\t\tdeploying: progress.deploying,\n\t\t\t\t\tinterrupted: progress.interrupted,\n\t\t\t\t\tsetupComplete: progress.setupComplete,\n\t\t\t\t\tdeployStatus: progress.deployStatus,\n\t\t\t\t\tdeployError: progress.deployError,\n\t\t\t\t\timageWarning: progress.imageWarning,\n\t\t\t\t\tphase: progress.phase\n\t\t\t\t};\n\t\t\t},\n\t\t\tmarkSetupComplete() {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t}\n\t\t});\n\t})().finally(() => {\n\t\t_deployPromise = null;\n\t});\n}\nfunction prepareSetupRestorePoint(state) {\n\treturn backupSetupInputs(state);\n}\n//#endregion\nexport { startDeploy as i, prepareSetupRestorePoint as n, resetDeployState as r, getDeployState as t };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,YAAY,EAAE,IAAI;AACnB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,IAAI,cAAc,GAAG,IAAI;AACzB,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;AAC9B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;AAC5E,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,KAAK,EAAE,OAAO,CAAC;AACjB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,IAAI,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAClD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AACvH,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AACjE,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,YAAY,EAAE,IAAI;AACpB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,cAAc,EAAE;AACrB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE;AACF,CAAC;AACD,CAAC,cAAc,GAAG,CAAC,YAAY;AAC/B,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;AACzB,GAAG,WAAW,EAAE,wBAAwB,CAAC,KAAK,CAAC;AAC/C,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,MAAM,GAAG;AACb,KAAK,SAAS,EAAE,QAAQ,CAAC,SAAS;AAClC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,aAAa,EAAE,QAAQ,CAAC,aAAa;AAC1C,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,KAAK,EAAE,QAAQ,CAAC;AACrB,KAAK;AACL,GAAG,CAAC;AACJ,GAAG,iBAAiB,GAAG;AACvB,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;AACpB,EAAE,cAAc,GAAG,IAAI;AACvB,CAAC,CAAC,CAAC;AACH;AACA,SAAS,wBAAwB,CAAC,KAAK,EAAE;AACzC,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC;AAChC;;;;"}
+{"version":3,"file":"setup-deploy-BVt3AXY8.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { $t as resolveStackDir, A as readDeployJournal, M as runDeploy, O as backupSetupInputs, ft as isSetupComplete, j as resolveDeployJournalPath, k as markSetupComplete } from \"./src.js\";\n//#region src/lib/server/setup-deploy.ts\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\timageWarning: null,\n\tphase: \"writing-config\"\n};\nvar _deployPromise = null;\nfunction deployStateFromJournal(state) {\n\tconst journal = readDeployJournal(resolveDeployJournalPath(state));\n\treturn {\n\t\tdeploying: journal.deploying,\n\t\tinterrupted: journal.interrupted,\n\t\tsetupComplete: journal.setupComplete || isSetupComplete(resolveStackDir()),\n\t\tdeployStatus: journal.deployStatus,\n\t\tdeployError: journal.deployError,\n\t\timageWarning: journal.imageWarning,\n\t\tphase: journal.phase\n\t};\n}\nfunction getDeployState(state) {\n\tif (state) _state = deployStateFromJournal(state);\n\telse if (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveStackDir())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: _state.deployStatus.map((entry) => ({ ...entry }))\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\timageWarning: null,\n\t\tphase: \"writing-config\"\n\t};\n}\nfunction startDeploy(state) {\n\tif (_deployPromise) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\treturn;\n\t}\n\t_deployPromise = (async () => {\n\t\tawait runDeploy(state, {\n\t\t\tjournalPath: resolveDeployJournalPath(state),\n\t\t\tonUpdate(progress) {\n\t\t\t\t_state = {\n\t\t\t\t\tdeploying: progress.deploying,\n\t\t\t\t\tinterrupted: progress.interrupted,\n\t\t\t\t\tsetupComplete: progress.setupComplete,\n\t\t\t\t\tdeployStatus: progress.deployStatus,\n\t\t\t\t\tdeployError: progress.deployError,\n\t\t\t\t\timageWarning: progress.imageWarning,\n\t\t\t\t\tphase: progress.phase\n\t\t\t\t};\n\t\t\t},\n\t\t\tmarkSetupComplete() {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t}\n\t\t});\n\t})().finally(() => {\n\t\t_deployPromise = null;\n\t});\n}\nfunction prepareSetupRestorePoint(state) {\n\treturn backupSetupInputs(state);\n}\n//#endregion\nexport { startDeploy as i, prepareSetupRestorePoint as n, resetDeployState as r, getDeployState as t };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,YAAY,EAAE,IAAI;AACnB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,IAAI,cAAc,GAAG,IAAI;AACzB,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;AAC9B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;AAC5E,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,KAAK,EAAE,OAAO,CAAC;AACjB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,IAAI,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAClD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AACvH,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AACjE,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,YAAY,EAAE,IAAI;AACpB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,cAAc,EAAE;AACrB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE;AACF,CAAC;AACD,CAAC,cAAc,GAAG,CAAC,YAAY;AAC/B,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;AACzB,GAAG,WAAW,EAAE,wBAAwB,CAAC,KAAK,CAAC;AAC/C,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,MAAM,GAAG;AACb,KAAK,SAAS,EAAE,QAAQ,CAAC,SAAS;AAClC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,aAAa,EAAE,QAAQ,CAAC,aAAa;AAC1C,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,KAAK,EAAE,QAAQ,CAAC;AACrB,KAAK;AACL,GAAG,CAAC;AACJ,GAAG,iBAAiB,GAAG;AACvB,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;AACpB,EAAE,cAAc,GAAG,IAAI;AACvB,CAAC,CAAC,CAAC;AACH;AACA,SAAS,wBAAwB,CAAC,KAAK,EAAE;AACzC,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC;AAChC;;;;"}

package/build/server/chunks/{src-B7oqi9q_.js → src-hV_EYNgm.js}

@@ -737,7 +737,7 @@ var import_main = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = DotenvModule;
 })))();
 var package_default = {
-	version: "0.12.0-rc.3"};
+	version: "0.12.0-rc.5"};
 //#endregion
 //#region ../lib/src/control-plane/versioning.ts
 var SEMVER_RE = /^v?\d+\.\d+\.\d+(?:[-+].*)?$/;
@@ -946,6 +946,146 @@ function mergeEnvContent(content, updates, options = {}) {
 	return lines.join("\n");
 }
 //#endregion
+//#region ../lib/src/control-plane/addon-env-schemas.ts
+/**
+* Built-in addon env-config SCHEMAS — a LEAF module (no imports) so it can be
+* shared by both `addons.ts` (which has a heavy import graph) and the migration
+* harness without creating an import cycle (lifecycle → migrations → addons → …).
+*
+* Each schema is an env-file-shaped string: `KEY=default` lines annotated with
+* `# @required` / `# @sensitive` comment lines directly above the key.
+*/
+var BUILTIN_ADDON_ENV_SCHEMAS = {
+	api: `# API Gateway portal configuration
+# ---
+`,
+	chat: `# Web Chat portal configuration
+# ---
+`,
+	discord: `# Discord bot configuration
+# ---
+
+# Discord credentials
+# ---
+
+# Application ID from the Discord Developer Portal.
+# https://discord.com/developers/applications
+# @required
+DISCORD_APPLICATION_ID=
+
+# Bot token from the Discord Developer Portal (Bot → Token).
+# @required @sensitive
+DISCORD_BOT_TOKEN=
+
+# ---
+# Access control
+# ---
+
+# Comma-separated allowed guild (server) IDs. Empty = all joined guilds.
+DISCORD_ALLOWED_GUILDS=
+
+# Comma-separated allowed role IDs.
+DISCORD_ALLOWED_ROLES=
+
+# Comma-separated allowed user IDs.
+DISCORD_ALLOWED_USERS=
+
+# Comma-separated blocked user IDs (denied even if otherwise allowed).
+DISCORD_BLOCKED_USERS=
+
+# ---
+# Behavior
+# ---
+
+# Register slash commands on startup.
+DISCORD_REGISTER_COMMANDS=true
+
+# Hours before a conversation thread expires.
+DISCORD_THREAD_TTL_HOURS=24
+
+# Milliseconds to wait before forwarding a message (0 = immediate).
+DISCORD_FORWARD_TIMEOUT_MS=0
+`,
+	slack: `# Slack bot configuration
+# ---
+
+# Slack credentials
+# ---
+
+# Bot User OAuth Token (OAuth & Permissions → Bot User OAuth Token).
+# @required @sensitive
+SLACK_BOT_TOKEN=
+
+# App-Level Token with connections:write (Basic Information → App-Level Tokens).
+# @required @sensitive
+SLACK_APP_TOKEN=
+
+# ---
+# Access control
+# ---
+
+# Comma-separated allowed channel IDs. Empty = all channels the bot is in.
+SLACK_ALLOWED_CHANNELS=
+
+# Comma-separated allowed user IDs.
+SLACK_ALLOWED_USERS=
+
+# Comma-separated blocked user IDs.
+SLACK_BLOCKED_USERS=
+
+`,
+	gateway: "",
+	ollama: "",
+	voice: `# OpenPalm Voice (Kokoro TTS + Whisper STT) configuration
+# ---
+# Local inference server — no upstream API or key. Values are optional; the
+# compose overlay supplies safe defaults.
+
+# faster-whisper model id. Default base.en is baked into the image.
+# @required
+OP_VOICE_WHISPER_MODEL=base.en
+
+# Default Kokoro voice id (54 bundled voices, e.g. af_heart, am_michael).
+OP_VOICE_KOKORO_VOICE=bf_isabella
+
+# Python logging level: debug, info, warning, error.
+OP_VOICE_LOG_LEVEL=info
+`
+};
+/**
+* The set of NON-sensitive addon env keys declared in BUILTIN_ADDON_ENV_SCHEMAS
+* — a `KEY=` line whose annotation comment block does NOT carry `@sensitive`.
+*
+* This is the ALLOWLIST for the C4 `knowledge/secrets/` → `stack.env` migration:
+* it must only ever promote real, declared, non-sensitive addon config. The
+* secrets dir is a GENERAL secret store (ssh keys, github/OAuth creds, akm
+* secrets, per-portal verification secrets) — a file must never be copied into
+* the non-secret stack.env just because its name lacks a `_TOKEN/_SECRET/...`
+* suffix.
+*/
+function nonSensitiveAddonEnvKeys() {
+	const keys = /* @__PURE__ */ new Set();
+	const KEY_RE = /^([A-Z][A-Z0-9_]*)=/;
+	for (const schema of Object.values(BUILTIN_ADDON_ENV_SCHEMAS)) {
+		let sensitive = false;
+		for (const raw of schema.split("\n")) {
+			const trimmed = raw.trim();
+			if (trimmed.startsWith("#")) {
+				if (/@sensitive\b/.test(trimmed)) sensitive = true;
+				continue;
+			}
+			const m = raw.match(KEY_RE);
+			if (m) {
+				if (!sensitive) keys.add(m[1]);
+				sensitive = false;
+				continue;
+			}
+			if (trimmed === "") sensitive = false;
+		}
+	}
+	return keys;
+}
+//#endregion
 //#region ../lib/src/control-plane/image-tags.ts
 var PLATFORM_IMAGE_TAG_KEYS = [
 	"OP_ASSISTANT_IMAGE_TAG",
@@ -1010,8 +1150,11 @@ function buildPlatformImageTagEnv(tag, perImage, pinnedImages = []) {
 *   - Otherwise: acquire the install lock, take a FULL-HOME backup first, and
 *     abort the whole upgrade if the backup fails (never migrate without a
 *     verified safety copy).
-*   - Migrations are COPY-ONLY / additive (never delete the old layout), so a
-*     mid-run failure leaves the home fully recoverable.
+*   - Migrations are additive for USER data (never delete/overwrite user files;
+*     relocate, don't drop). They MAY remove SYSTEM-managed inert files (e.g. a
+*     compose overlay the control plane no longer loads) via an explicit
+*     allowlist — but only because the FULL-HOME backup above runs first, so the
+*     home stays fully recoverable. Never a heuristic sweep, never user data.
 *   - The OP_LAYOUT_VERSION bump is the LAST step (the commit point); a crash
 *     before it just re-runs next time (idempotent).
 *   - On failure, throw MigrationError carrying the backup path + recovery
@@ -1089,7 +1232,7 @@ function readLayoutVersion(ctx) {
 		if (m) return Number(m[1]);
 	}
 	if (existsSync(join(ctx.homeDir, "vault"))) return 0;
-	return 1;
+	return 2;
 }
 function readStampedLayoutVersion(stashDir) {
 	const raw = readStackEnvValue(stashDir, LAYOUT_VERSION_KEY);
@@ -1203,9 +1346,11 @@ function migrateAddonConfigToStackEnv(ctx) {
 	if (!existsSync(secretsDir)) return;
 	const stackContent = readFileSync(envPath, "utf-8");
 	const additions = {};
+	const allowedKeys = nonSensitiveAddonEnvKeys();
 	for (const filename of readdirSync(secretsDir)) {
 		if (filename.includes(".") || filename.includes("/")) continue;
 		const envKey = filename.toUpperCase();
+		if (!allowedKeys.has(envKey)) continue;
 		if (ADDON_SENSITIVE_KEY_RE.test(envKey)) continue;
 		if (new RegExp(`^${envKey}=`, "m").test(stackContent)) {
 			ctx.log(`skip (exists in stack.env): ${envKey}`);
@@ -1453,6 +1598,32 @@ function readLegacyStackYmlAddons(ctx) {
 	}
 	return [];
 }
+/**
+* SYSTEM-managed files the 0.12.0 control plane no longer materializes or reads.
+* Removed so OP_HOME holds only the current managed asset set. This is an explicit
+* ALLOWLIST of system files — NEVER user data, NEVER a heuristic sweep:
+*   - config/stack/channels.compose.yml — renamed to portals.compose.yml in 0.12.0;
+*     the control plane loads an explicit overlay list (not a glob), so it is inert.
+*   - config/stack/stack.yml — the StackSpec was removed in 0.11.0 (addons live in
+*     OP_ENABLED_ADDONS; the 0→1 migration already extracts any legacy addons[]).
+* Removal is safe because the layout-migration path takes a FULL OP_HOME backup
+* first and aborts if it fails (see ensureMigrated), so a stamped layout bump is
+* always recoverable. User data is never removed; if a future inert path actually
+* holds user data it must be MOVED to its proper location here, not deleted.
+*/
+var INERT_LAYOUT_V2_FILES = [join("config", "stack", "channels.compose.yml"), join("config", "stack", "stack.yml")];
+function migrate1to2(ctx) {
+	for (const rel of INERT_LAYOUT_V2_FILES) {
+		const full = join(ctx.homeDir, rel);
+		if (!existsSync(full)) continue;
+		if (ctx.dryRun) {
+			ctx.log(`[dry-run] remove inert system file: ${rel}`);
+			continue;
+		}
+		rmSync(full, { force: true });
+		ctx.log(`removed inert pre-0.12.0 system file: ${rel}`);
+	}
+}
 var MIGRATIONS = [{
 	from: 0,
 	to: 1,
@@ -1462,6 +1633,15 @@ var MIGRATIONS = [{
 		if (ctx.dryRun) return;
 		if (!existsSync(stackEnvFile(ctx.stashDir))) throw new Error("post-migration check failed: knowledge/env/stack.env is missing");
 	}
+}, {
+	from: 1,
+	to: 2,
+	describe: "drop inert pre-0.12.0 system files (channels.compose.yml, stack.yml)",
+	apply: migrate1to2,
+	verify(ctx) {
+		if (ctx.dryRun) return;
+		for (const rel of INERT_LAYOUT_V2_FILES) if (existsSync(join(ctx.homeDir, rel))) throw new Error(`post-migration check failed: inert ${rel} still present`);
+	}
 }];
 var RELEASE_MIGRATIONS = [
 	{
@@ -1548,7 +1728,7 @@ function ensureMigrated(opts = {}) {
 	const layoutStamp = readStampedLayoutVersion(ctxBase.stashDir);
 	const releaseTargetRaw = releaseStamp ?? readImageTag(ctxBase.stashDir);
 	const comparableReleaseTarget = resolveComparableReleaseTarget(releaseTargetRaw);
-	const needsLayoutStamp = layoutStamp !== 1;
+	const needsLayoutStamp = layoutStamp !== 2;
 	const needsReleaseStamp = comparableReleaseTarget !== null && releaseStamp !== comparableReleaseTarget;
 	const empty = {
 		migrated: false,
@@ -1561,11 +1741,11 @@ function ensureMigrated(opts = {}) {
 		releaseTo: comparableReleaseTarget ?? releaseFrom ?? "",
 		releaseApplied: []
 	};
-	const pending = MIGRATIONS.filter((m) => m.from >= from && m.from < 1).sort((a, b) => a.from - b.from);
+	const pending = MIGRATIONS.filter((m) => m.from >= from && m.from < 2).sort((a, b) => a.from - b.from);
 	const pendingRelease = comparableReleaseTarget ? selectPendingReleaseMigrations(releaseFrom, comparableReleaseTarget) : [];
 	if (pending.length === 0 && pendingRelease.length === 0 && !needsLayoutStamp && !needsReleaseStamp) return {
 		...empty,
-		to: 1
+		to: 2
 	};
 	let lock = null;
 	let backupDir = null;
@@ -1607,13 +1787,13 @@ function ensureMigrated(opts = {}) {
 		}, releaseFrom, releaseTargetRaw);
 		if (!dryRun && releaseTargetRaw && comparableReleaseTarget === null) logSkippedNonComparableReleaseStamp(log, notes, releaseTargetRaw);
 		if (!dryRun) {
-			stampLayoutVersion(ctxBase.stashDir, 1);
+			stampLayoutVersion(ctxBase.stashDir, 2);
 			if (comparableReleaseTarget) stampReleaseVersion(ctxBase.stashDir, comparableReleaseTarget);
 		}
 		return {
 			migrated: true,
 			from,
-			to: 1,
+			to: 2,
 			applied,
 			backupDir,
 			notes,
@@ -5657,7 +5837,7 @@ function generateFallbackSystemEnv(state) {
 		...Object.entries(buildPlatformImageTagEnv(DEFAULT_IMAGE_TAG)).map(([key, value]) => `${key}=${value}`),
 		"",
 		"# ── Layout (on-disk schema version; managed by the migration harness) ──",
-		`OP_LAYOUT_VERSION=1`,
+		`OP_LAYOUT_VERSION=2`,
 		"",
 		"# ── Enabled addons (comma-separated; managed via the Add-ons UI / CLI) ──",
 		"OP_ENABLED_ADDONS=",
@@ -5853,103 +6033,6 @@ var BUILTIN_ADDONS = [
 	"ssh",
 	"voice"
 ];
-var BUILTIN_ADDON_ENV_SCHEMAS = {
-	api: `# API Gateway portal configuration
-# ---
-`,
-	chat: `# Web Chat portal configuration
-# ---
-`,
-	discord: `# Discord bot configuration
-# ---
-
-# Discord credentials
-# ---
-
-# Application ID from the Discord Developer Portal.
-# https://discord.com/developers/applications
-# @required
-DISCORD_APPLICATION_ID=
-
-# Bot token from the Discord Developer Portal (Bot → Token).
-# @required @sensitive
-DISCORD_BOT_TOKEN=
-
-# ---
-# Access control
-# ---
-
-# Comma-separated allowed guild (server) IDs. Empty = all joined guilds.
-DISCORD_ALLOWED_GUILDS=
-
-# Comma-separated allowed role IDs.
-DISCORD_ALLOWED_ROLES=
-
-# Comma-separated allowed user IDs.
-DISCORD_ALLOWED_USERS=
-
-# Comma-separated blocked user IDs (denied even if otherwise allowed).
-DISCORD_BLOCKED_USERS=
-
-# ---
-# Behavior
-# ---
-
-# Register slash commands on startup.
-DISCORD_REGISTER_COMMANDS=true
-
-# Hours before a conversation thread expires.
-DISCORD_THREAD_TTL_HOURS=24
-
-# Milliseconds to wait before forwarding a message (0 = immediate).
-DISCORD_FORWARD_TIMEOUT_MS=0
-`,
-	slack: `# Slack bot configuration
-# ---
-
-# Slack credentials
-# ---
-
-# Bot User OAuth Token (OAuth & Permissions → Bot User OAuth Token).
-# @required @sensitive
-SLACK_BOT_TOKEN=
-
-# App-Level Token with connections:write (Basic Information → App-Level Tokens).
-# @required @sensitive
-SLACK_APP_TOKEN=
-
-# ---
-# Access control
-# ---
-
-# Comma-separated allowed channel IDs. Empty = all channels the bot is in.
-SLACK_ALLOWED_CHANNELS=
-
-# Comma-separated allowed user IDs.
-SLACK_ALLOWED_USERS=
-
-# Comma-separated blocked user IDs.
-SLACK_BLOCKED_USERS=
-
-`,
-	gateway: "",
-	ollama: "",
-	voice: `# OpenPalm Voice (Kokoro TTS + Whisper STT) configuration
-# ---
-# Local inference server — no upstream API or key. Values are optional; the
-# compose overlay supplies safe defaults.
-
-# faster-whisper model id. Default base.en is baked into the image.
-# @required
-OP_VOICE_WHISPER_MODEL=base.en
-
-# Default Kokoro voice id (54 bundled voices, e.g. af_heart, am_michael).
-OP_VOICE_KOKORO_VOICE=bf_isabella
-
-# Python logging level: debug, info, warning, error.
-OP_VOICE_LOG_LEVEL=info
-`
-};
 function getRegistryAutomation(name) {
 	if (!VALID_NAME_RE.test(name)) return null;
 	const localOpenpalmDir = resolveLocalOpenpalmDir();
@@ -10192,5 +10275,5 @@ function collectBindAddressWarnings(env) {
 	return warnings;
 }
 
-export { ensureReleaseMigrated as $, AKM_USER_ENV_REF as A, composeStats as B, CORE_SERVICES as C, DowngradeConfirmationRequired as D, composeStop as E, composeUp as F, createLogger as G, createOpenCodeClient as H, INSTALL_LOCK_STALE_AFTER_MS as I, createState as J, deleteUserEnvKey as K, deriveLaunchStatus as L, MigrationError as M, deriveLocalStackState as N, detectGpu as O, PLATFORM_VERSION as P, detectHostOpenCode as Q, detectLocalProviders as R, detectRuntime as S, disableHostAkmSharing as T, dismissSecretStripNotice as U, enableHostAkmSharing as V, ensureAkmUserEnv as W, ensureHomeDirs as X, ensureMigrated as Y, ensureOpenCodeConfig as Z, ensureOpenCodeSystemConfig as _, addonProfileId as a, writeRuntimeFiles as a$, ensureSecrets as a0, executeAutomation as a1, fetchProviderModels as a2, formatForDisplay as a3, getAddonProfileAvailability as a4, getAddonProfileSelection as a5, getAddonProfiles as a6, getAddonServiceNames as a7, getAkmStats as a8, getDockerEvents as a9, readSecret as aA, readSecretFile as aB, readSecretStripNotice as aC, readStackEnv as aD, readStackRuntimeEnv as aE, readStackSecretEnv as aF, readTaskFile as aG, readUserEnvFile as aH, recommendSetup as aI, removeSecretFile as aJ, removeTaskFile as aK, resolveComposeProjectName as aL, resolveDataDir as aM, resolveDefaultMigrateTarget as aN, resolveDeployJournalPath as aO, resolveRuntimeFiles as aP, resolveStackDir as aQ, runDeploy as aR, seedUiBuild as aS, setAddonEnabled as aT, setAddonProfileSelection as aU, summarizeBackups as aV, summarizeComposeStderr as aW, unlockInstallLock as aX, useExistingProviderForAssistantCli as aY, validateProposedState as aZ, writeFileAtomic as a_, getHostAkmSharingStatus as aa, getRegistryAddonConfig as ab, hostAkmStashPath as ac, importHostOpenCode as ad, initializeStateSecrets as ae, inspectInstallLock as af, isAllowedService as ag, isComparableSemver as ah, isHostAkmAvailable as ai, isSetupComplete as aj, listAssistantCliTools as ak, listAvailableAddonIds as al, listBackupDirs as am, listEnabledAddonIds as an, listSecretFiles as ao, loadAutomations as ap, mapDockerError as aq, markSetupComplete as ar, parseComposeStderr as as, parseEnvFile as at, patchSecretsEnvFile as au, performSetup as av, performUpgrade as aw, pruneBackupDirs as ax, readAutomationLogs as ay, readDeployJournal as az, annotateAddonProfileAvailability as b, writeSecretFile as b0, writeStackSecretEnv as b1, writeTaskFile as b2, writeUserEnvKey as b3, writeVoiceVars as b4, applyInstall as c, applyTagChange as d, applyUninstall as e, applyUpdate as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, backupSetupInputs as j, buildAkmEndpoint as k, buildAkmEnv as l, buildComposeOptions as m, buildManagedServices as n, checkDocker as o, checkDockerCompose as p, classifyLocalInstall as q, collectBindAddressWarnings as r, compareComparableVersions as s, composeDown as t, composeLogs as u, composePreflight as v, composePs as w, composePull as x, composeRestart as y, composeStart as z };
-//# sourceMappingURL=src-B7oqi9q_.js.map
+export { ensureReleaseMigrated as $, AKM_USER_ENV_REF as A, composeStats as B, CORE_SERVICES as C, DowngradeConfirmationRequired as D, composeStop as E, composeUp as F, createLogger as G, createOpenCodeClient as H, INSTALL_LOCK_STALE_AFTER_MS as I, createState as J, deleteUserEnvKey as K, deriveLaunchStatus as L, MigrationError as M, deriveLocalStackState as N, detectGpu as O, PLATFORM_VERSION as P, detectHostOpenCode as Q, detectLocalProviders as R, detectRuntime as S, disableHostAkmSharing as T, dismissSecretStripNotice as U, enableHostAkmSharing as V, ensureAkmUserEnv as W, ensureHomeDirs as X, ensureMigrated as Y, ensureOpenCodeConfig as Z, ensureOpenCodeSystemConfig as _, addonProfileId as a, validateProposedState as a$, ensureSecrets as a0, executeAutomation as a1, fetchProviderModels as a2, formatForDisplay as a3, getAddonProfileAvailability as a4, getAddonProfileSelection as a5, getAddonProfiles as a6, getAddonServiceNames as a7, getAkmStats as a8, getDockerEvents as a9, readDeployJournal as aA, readSecret as aB, readSecretFile as aC, readSecretStripNotice as aD, readStackEnv as aE, readStackRuntimeEnv as aF, readStackSecretEnv as aG, readTaskFile as aH, readUserEnvFile as aI, recommendSetup as aJ, removeSecretFile as aK, removeTaskFile as aL, resolveComposeProjectName as aM, resolveDataDir as aN, resolveDefaultMigrateTarget as aO, resolveDeployJournalPath as aP, resolveEffectivePlatformImageTag as aQ, resolveRuntimeFiles as aR, resolveStackDir as aS, runDeploy as aT, seedUiBuild as aU, setAddonEnabled as aV, setAddonProfileSelection as aW, summarizeBackups as aX, summarizeComposeStderr as aY, unlockInstallLock as aZ, useExistingProviderForAssistantCli as a_, getHostAkmSharingStatus as aa, getRegistryAddonConfig as ab, hostAkmStashPath as ac, importHostOpenCode as ad, initializeStateSecrets as ae, inspectInstallLock as af, isAllowedService as ag, isComparableSemver as ah, isHostAkmAvailable as ai, isPrerelease as aj, isSetupComplete as ak, listAssistantCliTools as al, listAvailableAddonIds as am, listBackupDirs as an, listEnabledAddonIds as ao, listSecretFiles as ap, loadAutomations as aq, mapDockerError as ar, markSetupComplete as as, parseComposeStderr as at, parseEnvFile as au, patchSecretsEnvFile as av, performSetup as aw, performUpgrade as ax, pruneBackupDirs as ay, readAutomationLogs as az, annotateAddonProfileAvailability as b, writeFileAtomic as b0, writeRuntimeFiles as b1, writeSecretFile as b2, writeStackSecretEnv as b3, writeTaskFile as b4, writeUserEnvKey as b5, writeVoiceVars as b6, applyInstall as c, applyTagChange as d, applyUninstall as e, applyUpdate as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, backupSetupInputs as j, buildAkmEndpoint as k, buildAkmEnv as l, buildComposeOptions as m, buildManagedServices as n, checkDocker as o, checkDockerCompose as p, classifyLocalInstall as q, collectBindAddressWarnings as r, compareComparableVersions as s, composeDown as t, composeLogs as u, composePreflight as v, composePs as w, composePull as x, composeRestart as y, composeStart as z };
+//# sourceMappingURL=src-hV_EYNgm.js.map