@openpalm/ui 0.12.0-rc.5 → 0.12.0-rc.6

package/build/server/chunks/{session-cookie-CkOAhUjg.js.map → session-cookie-Deh3JNKY.js.map}

@@ -1 +1 @@
-{"version":3,"file":"session-cookie-CkOAhUjg.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}
+{"version":3,"file":"session-cookie-Deh3JNKY.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}

package/build/server/chunks/{setup-deploy-BVt3AXY8.js → setup-deploy-C-SGDhqa.js}

@@ -1,4 +1,4 @@
-import { j as backupSetupInputs, aT as runDeploy, aP as resolveDeployJournalPath, ak as isSetupComplete, aS as resolveStackDir, aA as readDeployJournal, as as markSetupComplete } from './src-hV_EYNgm.js';
+import { j as backupSetupInputs, aT as runDeploy, aP as resolveDeployJournalPath, ak as isSetupComplete, aS as resolveStackDir, aA as readDeployJournal, as as markSetupComplete } from './src-HnR-W6qI.js';
 
 //#region src/lib/server/setup-deploy.ts
 var _state = {
@@ -72,4 +72,4 @@ function prepareSetupRestorePoint(state) {
 }
 
 export { getDeployState as g, prepareSetupRestorePoint as p, resetDeployState as r, startDeploy as s };
-//# sourceMappingURL=setup-deploy-BVt3AXY8.js.map
+//# sourceMappingURL=setup-deploy-C-SGDhqa.js.map

package/build/server/chunks/{setup-deploy-BVt3AXY8.js.map → setup-deploy-C-SGDhqa.js.map}

@@ -1 +1 @@
-{"version":3,"file":"setup-deploy-BVt3AXY8.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { $t as resolveStackDir, A as readDeployJournal, M as runDeploy, O as backupSetupInputs, ft as isSetupComplete, j as resolveDeployJournalPath, k as markSetupComplete } from \"./src.js\";\n//#region src/lib/server/setup-deploy.ts\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\timageWarning: null,\n\tphase: \"writing-config\"\n};\nvar _deployPromise = null;\nfunction deployStateFromJournal(state) {\n\tconst journal = readDeployJournal(resolveDeployJournalPath(state));\n\treturn {\n\t\tdeploying: journal.deploying,\n\t\tinterrupted: journal.interrupted,\n\t\tsetupComplete: journal.setupComplete || isSetupComplete(resolveStackDir()),\n\t\tdeployStatus: journal.deployStatus,\n\t\tdeployError: journal.deployError,\n\t\timageWarning: journal.imageWarning,\n\t\tphase: journal.phase\n\t};\n}\nfunction getDeployState(state) {\n\tif (state) _state = deployStateFromJournal(state);\n\telse if (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveStackDir())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: _state.deployStatus.map((entry) => ({ ...entry }))\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\timageWarning: null,\n\t\tphase: \"writing-config\"\n\t};\n}\nfunction startDeploy(state) {\n\tif (_deployPromise) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\treturn;\n\t}\n\t_deployPromise = (async () => {\n\t\tawait runDeploy(state, {\n\t\t\tjournalPath: resolveDeployJournalPath(state),\n\t\t\tonUpdate(progress) {\n\t\t\t\t_state = {\n\t\t\t\t\tdeploying: progress.deploying,\n\t\t\t\t\tinterrupted: progress.interrupted,\n\t\t\t\t\tsetupComplete: progress.setupComplete,\n\t\t\t\t\tdeployStatus: progress.deployStatus,\n\t\t\t\t\tdeployError: progress.deployError,\n\t\t\t\t\timageWarning: progress.imageWarning,\n\t\t\t\t\tphase: progress.phase\n\t\t\t\t};\n\t\t\t},\n\t\t\tmarkSetupComplete() {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t}\n\t\t});\n\t})().finally(() => {\n\t\t_deployPromise = null;\n\t});\n}\nfunction prepareSetupRestorePoint(state) {\n\treturn backupSetupInputs(state);\n}\n//#endregion\nexport { startDeploy as i, prepareSetupRestorePoint as n, resetDeployState as r, getDeployState as t };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,YAAY,EAAE,IAAI;AACnB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,IAAI,cAAc,GAAG,IAAI;AACzB,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;AAC9B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;AAC5E,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,KAAK,EAAE,OAAO,CAAC;AACjB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,IAAI,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAClD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AACvH,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AACjE,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,YAAY,EAAE,IAAI;AACpB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,cAAc,EAAE;AACrB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE;AACF,CAAC;AACD,CAAC,cAAc,GAAG,CAAC,YAAY;AAC/B,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;AACzB,GAAG,WAAW,EAAE,wBAAwB,CAAC,KAAK,CAAC;AAC/C,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,MAAM,GAAG;AACb,KAAK,SAAS,EAAE,QAAQ,CAAC,SAAS;AAClC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,aAAa,EAAE,QAAQ,CAAC,aAAa;AAC1C,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,KAAK,EAAE,QAAQ,CAAC;AACrB,KAAK;AACL,GAAG,CAAC;AACJ,GAAG,iBAAiB,GAAG;AACvB,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;AACpB,EAAE,cAAc,GAAG,IAAI;AACvB,CAAC,CAAC,CAAC;AACH;AACA,SAAS,wBAAwB,CAAC,KAAK,EAAE;AACzC,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC;AAChC;;;;"}
+{"version":3,"file":"setup-deploy-C-SGDhqa.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { $t as resolveStackDir, A as readDeployJournal, M as runDeploy, O as backupSetupInputs, ft as isSetupComplete, j as resolveDeployJournalPath, k as markSetupComplete } from \"./src.js\";\n//#region src/lib/server/setup-deploy.ts\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\timageWarning: null,\n\tphase: \"writing-config\"\n};\nvar _deployPromise = null;\nfunction deployStateFromJournal(state) {\n\tconst journal = readDeployJournal(resolveDeployJournalPath(state));\n\treturn {\n\t\tdeploying: journal.deploying,\n\t\tinterrupted: journal.interrupted,\n\t\tsetupComplete: journal.setupComplete || isSetupComplete(resolveStackDir()),\n\t\tdeployStatus: journal.deployStatus,\n\t\tdeployError: journal.deployError,\n\t\timageWarning: journal.imageWarning,\n\t\tphase: journal.phase\n\t};\n}\nfunction getDeployState(state) {\n\tif (state) _state = deployStateFromJournal(state);\n\telse if (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveStackDir())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: _state.deployStatus.map((entry) => ({ ...entry }))\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\timageWarning: null,\n\t\tphase: \"writing-config\"\n\t};\n}\nfunction startDeploy(state) {\n\tif (_deployPromise) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\treturn;\n\t}\n\t_deployPromise = (async () => {\n\t\tawait runDeploy(state, {\n\t\t\tjournalPath: resolveDeployJournalPath(state),\n\t\t\tonUpdate(progress) {\n\t\t\t\t_state = {\n\t\t\t\t\tdeploying: progress.deploying,\n\t\t\t\t\tinterrupted: progress.interrupted,\n\t\t\t\t\tsetupComplete: progress.setupComplete,\n\t\t\t\t\tdeployStatus: progress.deployStatus,\n\t\t\t\t\tdeployError: progress.deployError,\n\t\t\t\t\timageWarning: progress.imageWarning,\n\t\t\t\t\tphase: progress.phase\n\t\t\t\t};\n\t\t\t},\n\t\t\tmarkSetupComplete() {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t}\n\t\t});\n\t})().finally(() => {\n\t\t_deployPromise = null;\n\t});\n}\nfunction prepareSetupRestorePoint(state) {\n\treturn backupSetupInputs(state);\n}\n//#endregion\nexport { startDeploy as i, prepareSetupRestorePoint as n, resetDeployState as r, getDeployState as t };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,YAAY,EAAE,IAAI;AACnB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,IAAI,cAAc,GAAG,IAAI;AACzB,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;AAC9B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;AAC5E,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,KAAK,EAAE,OAAO,CAAC;AACjB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,IAAI,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAClD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AACvH,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AACjE,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,YAAY,EAAE,IAAI;AACpB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,cAAc,EAAE;AACrB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE;AACF,CAAC;AACD,CAAC,cAAc,GAAG,CAAC,YAAY;AAC/B,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;AACzB,GAAG,WAAW,EAAE,wBAAwB,CAAC,KAAK,CAAC;AAC/C,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,MAAM,GAAG;AACb,KAAK,SAAS,EAAE,QAAQ,CAAC,SAAS;AAClC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,aAAa,EAAE,QAAQ,CAAC,aAAa;AAC1C,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,KAAK,EAAE,QAAQ,CAAC;AACrB,KAAK;AACL,GAAG,CAAC;AACJ,GAAG,iBAAiB,GAAG;AACvB,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;AACpB,EAAE,cAAc,GAAG,IAAI;AACvB,CAAC,CAAC,CAAC;AACH;AACA,SAAS,wBAAwB,CAAC,KAAK,EAAE;AACzC,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC;AAChC;;;;"}

package/build/server/chunks/{src-hV_EYNgm.js → src-HnR-W6qI.js}

@@ -737,7 +737,7 @@ var import_main = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = DotenvModule;
 })))();
 var package_default = {
-	version: "0.12.0-rc.5"};
+	version: "0.12.0-rc.6"};
 //#endregion
 //#region ../lib/src/control-plane/versioning.ts
 var SEMVER_RE = /^v?\d+\.\d+\.\d+(?:[-+].*)?$/;
@@ -1223,6 +1223,8 @@ function readStackEnvValue(stashDir, key) {
 * Resolve the current on-disk layout version.
 *   - explicit OP_LAYOUT_VERSION in knowledge/env/stack.env wins
 *   - else a top-level `vault/` directory ⇒ 0.10.x layout (version 0)
+*   - else a `config/system.env` file ⇒ 0.9.x layout (pre-vault; also version 0 —
+*     the 0→1 migration relocates both old shapes into the knowledge/ layout)
 *   - else assume the current layout (a pre-marker 0.11 install) — caller stamps it
 */
 function readLayoutVersion(ctx) {
@@ -1232,6 +1234,7 @@ function readLayoutVersion(ctx) {
 		if (m) return Number(m[1]);
 	}
 	if (existsSync(join(ctx.homeDir, "vault"))) return 0;
+	if (existsSync(join(ctx.homeDir, "config", "system.env"))) return 0;
 	return 2;
 }
 function readStampedLayoutVersion(stashDir) {
@@ -1455,6 +1458,50 @@ function migrateCustomComposeChannelLan(ctx) {
 }
 var SECRET_KEY_RE = /(_API_KEY|_TOKEN|_SECRET|_PASSWORD)$/;
 var CONFIG_KEY_RE = /^(OP_CAP_|SYSTEM_LLM_|EMBEDDING_)/;
+/**
+* Transform a legacy flat env file (0.10.x vault/stack/stack.env OR 0.9.x
+* config/system.env — identical KEY=val shape) into the 0.11+
+* knowledge/env/stack.env:
+*   - extract OP_UI_LOGIN_PASSWORD into knowledge/secrets/op_ui_login_password
+*   - rename OP_ADMIN_PORT → OP_HOST_UI_PORT and TTS_/STT_ → OP_TTS_/OP_STT_
+*   - drop removed vars (OP_ADMIN_OPENCODE_PORT, OP_GUARDIAN_PORT)
+*   - quarantine secret/capability keys into a .removed-secrets.bak (NEVER copied
+*     back into the non-secret stack.env)
+* Skip-if-present: never overwrites an existing destStack (idempotent).
+*/
+function transformLegacyStackEnv(ctx, srcStack, destStack, newEnv, newSecrets) {
+	if (!existsSync(srcStack) || existsSync(destStack)) return;
+	const kept = [];
+	const removed = [];
+	for (const line of readFileSync(srcStack, "utf-8").split("\n")) {
+		if (line === "" || line.startsWith("#")) {
+			kept.push(line);
+			continue;
+		}
+		const eq = line.indexOf("=");
+		const key = eq >= 0 ? line.slice(0, eq) : line;
+		const val = eq >= 0 ? line.slice(eq + 1) : "";
+		if (key === "OP_UI_LOGIN_PASSWORD") {
+			writeFile600(ctx, join(newSecrets, "op_ui_login_password"), val + "\n");
+			ctx.log("extracted OP_UI_LOGIN_PASSWORD -> knowledge/secrets/op_ui_login_password");
+		} else if (key === "OP_ADMIN_PORT") {
+			kept.push(`OP_HOST_UI_PORT=${val}`);
+			ctx.log("renamed OP_ADMIN_PORT -> OP_HOST_UI_PORT");
+		} else if (key === "OP_ADMIN_OPENCODE_PORT" || key === "OP_GUARDIAN_PORT") ctx.log(`dropped removed var: ${key}`);
+		else if (key.startsWith("TTS_") || key.startsWith("STT_")) {
+			kept.push(`OP_${key}=${val}`);
+			ctx.log(`renamed ${key} -> OP_${key}`);
+		} else if (CONFIG_KEY_RE.test(key) || SECRET_KEY_RE.test(key)) {
+			removed.push(line);
+			ctx.log(`quarantined: ${key}`);
+		} else kept.push(line);
+	}
+	writeFile600(ctx, destStack, kept.join("\n") + "\n");
+	if (removed.length > 0) {
+		writeFile600(ctx, join(newEnv, "stack.env.removed-secrets.bak"), removed.join("\n") + "\n");
+		ctx.notes.push("Secret/capability keys were removed from stack.env (saved to knowledge/env/stack.env.removed-secrets.bak) — re-enter provider keys via the Connections tab and LLM config via config/akm/config.json; do not put them back in stack.env.");
+	}
+}
 function migrate010to011(ctx) {
 	const vault = join(ctx.homeDir, "vault");
 	const newEnv = join(ctx.stashDir, "env");
@@ -1462,40 +1509,7 @@ function migrate010to011(ctx) {
 	ensureDir(ctx, newEnv);
 	ensureDir(ctx, newSecrets);
 	copyIfAbsent(ctx, join(vault, "user", "user.env"), join(newEnv, "user.env"));
-	const srcStack = join(vault, "stack", "stack.env");
-	const destStack = join(newEnv, "stack.env");
-	if (existsSync(srcStack) && !existsSync(destStack)) {
-		const kept = [];
-		const removed = [];
-		for (const line of readFileSync(srcStack, "utf-8").split("\n")) {
-			if (line === "" || line.startsWith("#")) {
-				kept.push(line);
-				continue;
-			}
-			const eq = line.indexOf("=");
-			const key = eq >= 0 ? line.slice(0, eq) : line;
-			const val = eq >= 0 ? line.slice(eq + 1) : "";
-			if (key === "OP_UI_LOGIN_PASSWORD") {
-				writeFile600(ctx, join(newSecrets, "op_ui_login_password"), val + "\n");
-				ctx.log("extracted OP_UI_LOGIN_PASSWORD -> knowledge/secrets/op_ui_login_password");
-			} else if (key === "OP_ADMIN_PORT") {
-				kept.push(`OP_HOST_UI_PORT=${val}`);
-				ctx.log("renamed OP_ADMIN_PORT -> OP_HOST_UI_PORT");
-			} else if (key === "OP_ADMIN_OPENCODE_PORT" || key === "OP_GUARDIAN_PORT") ctx.log(`dropped removed var: ${key}`);
-			else if (key.startsWith("TTS_") || key.startsWith("STT_")) {
-				kept.push(`OP_${key}=${val}`);
-				ctx.log(`renamed ${key} -> OP_${key}`);
-			} else if (CONFIG_KEY_RE.test(key) || SECRET_KEY_RE.test(key)) {
-				removed.push(line);
-				ctx.log(`quarantined: ${key}`);
-			} else kept.push(line);
-		}
-		writeFile600(ctx, destStack, kept.join("\n") + "\n");
-		if (removed.length > 0) {
-			writeFile600(ctx, join(newEnv, "stack.env.removed-secrets.bak"), removed.join("\n") + "\n");
-			ctx.notes.push("Secret/capability keys were removed from stack.env (saved to knowledge/env/stack.env.removed-secrets.bak) — re-enter provider keys via the Connections tab and LLM config via config/akm/config.json; do not put them back in stack.env.");
-		}
-	}
+	transformLegacyStackEnv(ctx, join(vault, "stack", "stack.env"), join(newEnv, "stack.env"), newEnv, newSecrets);
 	if (copyIfAbsent(ctx, join(vault, "stack", "auth.json"), join(newSecrets, "auth.json"))) ctx.notes.push("Copied auth.json best-effort — verify providers in the Connections tab and re-add any that are missing (the OpenCode auth format changed).");
 	const servicesDir = join(vault, "stack", "services");
 	if (existsSync(servicesDir)) for (const name of readdirSync(servicesDir)) copyIfAbsent(ctx, join(servicesDir, name), join(newSecrets, name));
@@ -1573,8 +1587,9 @@ confirmed the new version works.
 If anything looks wrong, do NOT delete this directory — restore from it or from
 \`data/backups/\`. Full guide: docs/operations/upgrade-0.10-to-0.11.md
 `;
-/** Drop a safe-removal README into the retained legacy vault/ (skip if present). */
+/** Drop a safe-removal README into the retained legacy vault/ (skip if absent/present). */
 function writeVaultReadme(ctx, vault) {
+	if (!existsSync(vault)) return;
 	const dest = join(vault, "README.md");
 	if (existsSync(dest)) {
 		ctx.log("skip (exists): vault/README.md");
@@ -1599,6 +1614,105 @@ function readLegacyStackYmlAddons(ctx) {
 	return [];
 }
 /**
+* The recognized 0.9.x entries under config/. Their DATA is relocated to its 0.11+
+* home (env/secrets/tasks); the originals — plus the no-longer-read system files
+* (schemas, components, openpalm.yml, ov.conf) — are then moved wholesale into
+* config/legacy-0.9/ so config/ holds only the current layout. Moving is
+* relocation, never deletion; the full-home backup already ran.
+*/
+var LEGACY_09_CONFIG_ENTRIES = [
+	"automations",
+	"components",
+	"user.env",
+	"user.env.schema",
+	"system.env",
+	"system.env.schema",
+	"openpalm.yml",
+	"ov.conf"
+];
+var LEGACY_09_README = `# This \`config/legacy-0.9/\` directory is from OpenPalm 0.9.x — a RECOVERY COPY
+
+OpenPalm 0.11+ uses a different on-disk layout. The upgrade **extracted** your
+data out of the old 0.9.x \`config/\` files into the new locations and moved the
+originals here, untouched, as a safety net:
+
+- \`config/user.env\`        → \`knowledge/env/user.env\`
+- \`config/system.env\`      → \`knowledge/env/stack.env\` (transformed; secrets
+                              extracted to \`knowledge/secrets/\`)
+- \`config/automations/*\`   → \`knowledge/tasks/\`
+- old \`components/*\`       → inert (compose components were replaced by the fixed
+                              overlay set + OP_ENABLED_ADDONS); kept for reference
+- \`config/openpalm.yml\`, \`ov.conf\`, \`*.schema\` → no longer read; kept for reference
+
+A full backup of your home was also taken under \`data/backups/\` before migrating.
+
+Nothing in 0.11+ reads this directory anymore. You can delete it once you have
+confirmed the new version works (UI signs in, stack starts, channels work). If
+\`knowledge/env/stack.env.removed-secrets.bak\` exists, re-enter those provider keys
+via the Connections tab and LLM config via \`config/akm/config.json\` first — do not
+put secrets back into stack.env. Prefer your OS trash (reversible) when removing.
+`;
+/** Enabled 0.9.x channels were compose "components": config/components/channel-<name>.yml. */
+function readLegacy09ChannelAddons(ctx) {
+	const comps = join(ctx.configDir, "components");
+	if (!existsSync(comps)) return [];
+	const addons = /* @__PURE__ */ new Set();
+	for (const name of readdirSync(comps)) {
+		const m = name.match(/^channel-([a-z0-9-]+)\.ya?ml$/);
+		if (m && ADDON_NAME_RE.test(m[1])) addons.add(m[1]);
+	}
+	return [...addons].sort();
+}
+function migrate09xToKnowledge(ctx) {
+	const sysEnv = join(ctx.configDir, "system.env");
+	if (!existsSync(sysEnv)) return;
+	const newEnv = join(ctx.stashDir, "env");
+	const newSecrets = join(ctx.stashDir, "secrets");
+	const newTasks = join(ctx.stashDir, "tasks");
+	ensureDir(ctx, newEnv);
+	ensureDir(ctx, newSecrets);
+	copyIfAbsent(ctx, join(ctx.configDir, "user.env"), join(newEnv, "user.env"));
+	transformLegacyStackEnv(ctx, sysEnv, join(newEnv, "stack.env"), newEnv, newSecrets);
+	const autos = join(ctx.configDir, "automations");
+	if (existsSync(autos)) {
+		ensureDir(ctx, newTasks);
+		for (const name of readdirSync(autos)) copyIfAbsent(ctx, join(autos, name), join(newTasks, name));
+	}
+	const addons = readLegacy09ChannelAddons(ctx);
+	if (addons.length > 0) {
+		const envPath = stackEnvFile(ctx.stashDir);
+		if (ctx.dryRun) ctx.log(`[dry-run] set OP_ENABLED_ADDONS=${addons.join(",")}`);
+		else if (existsSync(envPath)) {
+			writeFile600(ctx, envPath, upsertEnvValue(readFileSync(envPath, "utf-8"), "OP_ENABLED_ADDONS", addons.join(",")));
+			ctx.log(`set OP_ENABLED_ADDONS=${addons.join(",")}`);
+		}
+	}
+	const legacyDir = join(ctx.configDir, "legacy-0.9");
+	for (const name of LEGACY_09_CONFIG_ENTRIES) {
+		const src = join(ctx.configDir, name);
+		if (!existsSync(src)) continue;
+		ensureDir(ctx, legacyDir);
+		const dest = join(legacyDir, name);
+		if (existsSync(dest)) {
+			ctx.log(`skip (exists): config/legacy-0.9/${name}`);
+			continue;
+		}
+		if (ctx.dryRun) {
+			ctx.log(`[dry-run] relocate config/${name} -> config/legacy-0.9/${name}`);
+			continue;
+		}
+		renameSync(src, dest);
+		ctx.log(`relocated config/${name} -> config/legacy-0.9/${name}`);
+	}
+	const readmePath = join(legacyDir, "README.md");
+	if (existsSync(legacyDir) && !existsSync(readmePath)) if (ctx.dryRun) ctx.log("[dry-run] write config/legacy-0.9/README.md (safe-removal guide)");
+	else {
+		writeFileSync(readmePath, LEGACY_09_README);
+		ctx.log("wrote config/legacy-0.9/README.md (safe-removal guide)");
+	}
+	ctx.notes.push("Upgraded a 0.9.x install: your config/ data moved to knowledge/ and the old 0.9.x files were retained under config/legacy-0.9/ (see its README). Verify the stack, then remove that directory via your OS trash.");
+}
+/**
 * SYSTEM-managed files the 0.12.0 control plane no longer materializes or reads.
 * Removed so OP_HOME holds only the current managed asset set. This is an explicit
 * ALLOWLIST of system files — NEVER user data, NEVER a heuristic sweep:
@@ -1627,8 +1741,11 @@ function migrate1to2(ctx) {
 var MIGRATIONS = [{
 	from: 0,
 	to: 1,
-	describe: "0.10.x vault/ layout → 0.11.0 knowledge/ layout",
-	apply: migrate010to011,
+	describe: "pre-knowledge (0.9.x config/ or 0.10.x vault/) → 0.11.0 knowledge/ layout",
+	apply(ctx) {
+		migrate010to011(ctx);
+		migrate09xToKnowledge(ctx);
+	},
 	verify(ctx) {
 		if (ctx.dryRun) return;
 		if (!existsSync(stackEnvFile(ctx.stashDir))) throw new Error("post-migration check failed: knowledge/env/stack.env is missing");
@@ -10276,4 +10393,4 @@ function collectBindAddressWarnings(env) {
 }
 
 export { ensureReleaseMigrated as $, AKM_USER_ENV_REF as A, composeStats as B, CORE_SERVICES as C, DowngradeConfirmationRequired as D, composeStop as E, composeUp as F, createLogger as G, createOpenCodeClient as H, INSTALL_LOCK_STALE_AFTER_MS as I, createState as J, deleteUserEnvKey as K, deriveLaunchStatus as L, MigrationError as M, deriveLocalStackState as N, detectGpu as O, PLATFORM_VERSION as P, detectHostOpenCode as Q, detectLocalProviders as R, detectRuntime as S, disableHostAkmSharing as T, dismissSecretStripNotice as U, enableHostAkmSharing as V, ensureAkmUserEnv as W, ensureHomeDirs as X, ensureMigrated as Y, ensureOpenCodeConfig as Z, ensureOpenCodeSystemConfig as _, addonProfileId as a, validateProposedState as a$, ensureSecrets as a0, executeAutomation as a1, fetchProviderModels as a2, formatForDisplay as a3, getAddonProfileAvailability as a4, getAddonProfileSelection as a5, getAddonProfiles as a6, getAddonServiceNames as a7, getAkmStats as a8, getDockerEvents as a9, readDeployJournal as aA, readSecret as aB, readSecretFile as aC, readSecretStripNotice as aD, readStackEnv as aE, readStackRuntimeEnv as aF, readStackSecretEnv as aG, readTaskFile as aH, readUserEnvFile as aI, recommendSetup as aJ, removeSecretFile as aK, removeTaskFile as aL, resolveComposeProjectName as aM, resolveDataDir as aN, resolveDefaultMigrateTarget as aO, resolveDeployJournalPath as aP, resolveEffectivePlatformImageTag as aQ, resolveRuntimeFiles as aR, resolveStackDir as aS, runDeploy as aT, seedUiBuild as aU, setAddonEnabled as aV, setAddonProfileSelection as aW, summarizeBackups as aX, summarizeComposeStderr as aY, unlockInstallLock as aZ, useExistingProviderForAssistantCli as a_, getHostAkmSharingStatus as aa, getRegistryAddonConfig as ab, hostAkmStashPath as ac, importHostOpenCode as ad, initializeStateSecrets as ae, inspectInstallLock as af, isAllowedService as ag, isComparableSemver as ah, isHostAkmAvailable as ai, isPrerelease as aj, isSetupComplete as ak, listAssistantCliTools as al, listAvailableAddonIds as am, listBackupDirs as an, listEnabledAddonIds as ao, listSecretFiles as ap, loadAutomations as aq, mapDockerError as ar, markSetupComplete as as, parseComposeStderr as at, parseEnvFile as au, patchSecretsEnvFile as av, performSetup as aw, performUpgrade as ax, pruneBackupDirs as ay, readAutomationLogs as az, annotateAddonProfileAvailability as b, writeFileAtomic as b0, writeRuntimeFiles as b1, writeSecretFile as b2, writeStackSecretEnv as b3, writeTaskFile as b4, writeUserEnvKey as b5, writeVoiceVars as b6, applyInstall as c, applyTagChange as d, applyUninstall as e, applyUpdate as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, backupSetupInputs as j, buildAkmEndpoint as k, buildAkmEnv as l, buildComposeOptions as m, buildManagedServices as n, checkDocker as o, checkDockerCompose as p, classifyLocalInstall as q, collectBindAddressWarnings as r, compareComparableVersions as s, composeDown as t, composeLogs as u, composePreflight as v, composePs as w, composePull as x, composeRestart as y, composeStart as z };
-//# sourceMappingURL=src-hV_EYNgm.js.map
+//# sourceMappingURL=src-HnR-W6qI.js.map