@openpalm/ui 0.12.0-rc.5 → 0.12.0-rc.7

package/build/server/chunks/{session-cookie-CkOAhUjg.js.map → session-cookie-BllUKraw.js.map}

@@ -1 +1 @@
-{"version":3,"file":"session-cookie-CkOAhUjg.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}
+{"version":3,"file":"session-cookie-BllUKraw.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}

package/build/server/chunks/{setup-deploy-BVt3AXY8.js → setup-deploy-D7oh1PDA.js}

@@ -1,4 +1,4 @@
-import { j as backupSetupInputs, aT as runDeploy, aP as resolveDeployJournalPath, ak as isSetupComplete, aS as resolveStackDir, aA as readDeployJournal, as as markSetupComplete } from './src-hV_EYNgm.js';
+import { j as backupSetupInputs, aT as runDeploy, aP as resolveDeployJournalPath, ak as isSetupComplete, aS as resolveStackDir, aA as readDeployJournal, as as markSetupComplete } from './src-DnDbWIue.js';
 
 //#region src/lib/server/setup-deploy.ts
 var _state = {
@@ -72,4 +72,4 @@ function prepareSetupRestorePoint(state) {
 }
 
 export { getDeployState as g, prepareSetupRestorePoint as p, resetDeployState as r, startDeploy as s };
-//# sourceMappingURL=setup-deploy-BVt3AXY8.js.map
+//# sourceMappingURL=setup-deploy-D7oh1PDA.js.map

package/build/server/chunks/{setup-deploy-BVt3AXY8.js.map → setup-deploy-D7oh1PDA.js.map}

@@ -1 +1 @@
-{"version":3,"file":"setup-deploy-BVt3AXY8.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { $t as resolveStackDir, A as readDeployJournal, M as runDeploy, O as backupSetupInputs, ft as isSetupComplete, j as resolveDeployJournalPath, k as markSetupComplete } from \"./src.js\";\n//#region src/lib/server/setup-deploy.ts\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\timageWarning: null,\n\tphase: \"writing-config\"\n};\nvar _deployPromise = null;\nfunction deployStateFromJournal(state) {\n\tconst journal = readDeployJournal(resolveDeployJournalPath(state));\n\treturn {\n\t\tdeploying: journal.deploying,\n\t\tinterrupted: journal.interrupted,\n\t\tsetupComplete: journal.setupComplete || isSetupComplete(resolveStackDir()),\n\t\tdeployStatus: journal.deployStatus,\n\t\tdeployError: journal.deployError,\n\t\timageWarning: journal.imageWarning,\n\t\tphase: journal.phase\n\t};\n}\nfunction getDeployState(state) {\n\tif (state) _state = deployStateFromJournal(state);\n\telse if (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveStackDir())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: _state.deployStatus.map((entry) => ({ ...entry }))\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\timageWarning: null,\n\t\tphase: \"writing-config\"\n\t};\n}\nfunction startDeploy(state) {\n\tif (_deployPromise) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\treturn;\n\t}\n\t_deployPromise = (async () => {\n\t\tawait runDeploy(state, {\n\t\t\tjournalPath: resolveDeployJournalPath(state),\n\t\t\tonUpdate(progress) {\n\t\t\t\t_state = {\n\t\t\t\t\tdeploying: progress.deploying,\n\t\t\t\t\tinterrupted: progress.interrupted,\n\t\t\t\t\tsetupComplete: progress.setupComplete,\n\t\t\t\t\tdeployStatus: progress.deployStatus,\n\t\t\t\t\tdeployError: progress.deployError,\n\t\t\t\t\timageWarning: progress.imageWarning,\n\t\t\t\t\tphase: progress.phase\n\t\t\t\t};\n\t\t\t},\n\t\t\tmarkSetupComplete() {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t}\n\t\t});\n\t})().finally(() => {\n\t\t_deployPromise = null;\n\t});\n}\nfunction prepareSetupRestorePoint(state) {\n\treturn backupSetupInputs(state);\n}\n//#endregion\nexport { startDeploy as i, prepareSetupRestorePoint as n, resetDeployState as r, getDeployState as t };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,YAAY,EAAE,IAAI;AACnB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,IAAI,cAAc,GAAG,IAAI;AACzB,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;AAC9B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;AAC5E,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,KAAK,EAAE,OAAO,CAAC;AACjB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,IAAI,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAClD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AACvH,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AACjE,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,YAAY,EAAE,IAAI;AACpB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,cAAc,EAAE;AACrB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE;AACF,CAAC;AACD,CAAC,cAAc,GAAG,CAAC,YAAY;AAC/B,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;AACzB,GAAG,WAAW,EAAE,wBAAwB,CAAC,KAAK,CAAC;AAC/C,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,MAAM,GAAG;AACb,KAAK,SAAS,EAAE,QAAQ,CAAC,SAAS;AAClC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,aAAa,EAAE,QAAQ,CAAC,aAAa;AAC1C,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,KAAK,EAAE,QAAQ,CAAC;AACrB,KAAK;AACL,GAAG,CAAC;AACJ,GAAG,iBAAiB,GAAG;AACvB,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;AACpB,EAAE,cAAc,GAAG,IAAI;AACvB,CAAC,CAAC,CAAC;AACH;AACA,SAAS,wBAAwB,CAAC,KAAK,EAAE;AACzC,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC;AAChC;;;;"}
+{"version":3,"file":"setup-deploy-D7oh1PDA.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { $t as resolveStackDir, A as readDeployJournal, M as runDeploy, O as backupSetupInputs, ft as isSetupComplete, j as resolveDeployJournalPath, k as markSetupComplete } from \"./src.js\";\n//#region src/lib/server/setup-deploy.ts\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\timageWarning: null,\n\tphase: \"writing-config\"\n};\nvar _deployPromise = null;\nfunction deployStateFromJournal(state) {\n\tconst journal = readDeployJournal(resolveDeployJournalPath(state));\n\treturn {\n\t\tdeploying: journal.deploying,\n\t\tinterrupted: journal.interrupted,\n\t\tsetupComplete: journal.setupComplete || isSetupComplete(resolveStackDir()),\n\t\tdeployStatus: journal.deployStatus,\n\t\tdeployError: journal.deployError,\n\t\timageWarning: journal.imageWarning,\n\t\tphase: journal.phase\n\t};\n}\nfunction getDeployState(state) {\n\tif (state) _state = deployStateFromJournal(state);\n\telse if (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveStackDir())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: _state.deployStatus.map((entry) => ({ ...entry }))\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\timageWarning: null,\n\t\tphase: \"writing-config\"\n\t};\n}\nfunction startDeploy(state) {\n\tif (_deployPromise) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\treturn;\n\t}\n\t_deployPromise = (async () => {\n\t\tawait runDeploy(state, {\n\t\t\tjournalPath: resolveDeployJournalPath(state),\n\t\t\tonUpdate(progress) {\n\t\t\t\t_state = {\n\t\t\t\t\tdeploying: progress.deploying,\n\t\t\t\t\tinterrupted: progress.interrupted,\n\t\t\t\t\tsetupComplete: progress.setupComplete,\n\t\t\t\t\tdeployStatus: progress.deployStatus,\n\t\t\t\t\tdeployError: progress.deployError,\n\t\t\t\t\timageWarning: progress.imageWarning,\n\t\t\t\t\tphase: progress.phase\n\t\t\t\t};\n\t\t\t},\n\t\t\tmarkSetupComplete() {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t}\n\t\t});\n\t})().finally(() => {\n\t\t_deployPromise = null;\n\t});\n}\nfunction prepareSetupRestorePoint(state) {\n\treturn backupSetupInputs(state);\n}\n//#endregion\nexport { startDeploy as i, prepareSetupRestorePoint as n, resetDeployState as r, getDeployState as t };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,YAAY,EAAE,IAAI;AACnB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,IAAI,cAAc,GAAG,IAAI;AACzB,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;AAC9B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;AAC5E,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,KAAK,EAAE,OAAO,CAAC;AACjB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,IAAI,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAClD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AACvH,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AACjE,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,YAAY,EAAE,IAAI;AACpB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,cAAc,EAAE;AACrB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE;AACF,CAAC;AACD,CAAC,cAAc,GAAG,CAAC,YAAY;AAC/B,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;AACzB,GAAG,WAAW,EAAE,wBAAwB,CAAC,KAAK,CAAC;AAC/C,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,MAAM,GAAG;AACb,KAAK,SAAS,EAAE,QAAQ,CAAC,SAAS;AAClC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,aAAa,EAAE,QAAQ,CAAC,aAAa;AAC1C,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,KAAK,EAAE,QAAQ,CAAC;AACrB,KAAK;AACL,GAAG,CAAC;AACJ,GAAG,iBAAiB,GAAG;AACvB,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;AACpB,EAAE,cAAc,GAAG,IAAI;AACvB,CAAC,CAAC,CAAC;AACH;AACA,SAAS,wBAAwB,CAAC,KAAK,EAAE;AACzC,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC;AAChC;;;;"}

package/build/server/chunks/{src-hV_EYNgm.js → src-DnDbWIue.js}

@@ -737,7 +737,7 @@ var import_main = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = DotenvModule;
 })))();
 var package_default = {
-	version: "0.12.0-rc.5"};
+	version: "0.12.0-rc.7"};
 //#endregion
 //#region ../lib/src/control-plane/versioning.ts
 var SEMVER_RE = /^v?\d+\.\d+\.\d+(?:[-+].*)?$/;
@@ -1188,6 +1188,23 @@ var BackupSpaceError = class extends MigrationError {
 		this.name = "BackupSpaceError";
 	}
 };
+/**
+* Thrown when a home directory has data but matches NO known layout — no
+* OP_LAYOUT_VERSION stamp, no vault/ (0.10.x), no config/system.env (0.9.x), and
+* no knowledge/env/stack.env (0.11+). Rather than silently declaring it "already
+* current" (which skips all migrations and permanently mislabels it — the failure
+* mode that hid the 0.9.x gap for a release), detection refuses BEFORE touching
+* anything. Surfaced as a MigrationError so existing CLI/UI handlers present the
+* guidance and exit cleanly. Nothing has been modified when this throws.
+*/
+var UnrecognizedLayoutError = class extends MigrationError {
+	homeDir;
+	constructor(homeDir) {
+		super(`Unrecognized OpenPalm home layout at ${homeDir}: it contains data but matches no known version (no OP_LAYOUT_VERSION stamp, no vault/, no config/system.env, no knowledge/env/stack.env).`, "No changes were made to your home. This directory may be from an unsupported or newer version of OpenPalm. Make a manual backup, then either upgrade through the version that created it, or — if you know the layout — set OP_LAYOUT_VERSION in knowledge/env/stack.env to force detection. If this is unexpected, open an issue with a listing of the directory.", null);
+		this.homeDir = homeDir;
+		this.name = "UnrecognizedLayoutError";
+	}
+};
 var RELEASE_VERSION_KEY = "OP_RELEASE_VERSION";
 function resolveMigrationPaths(homeDir) {
 	return {
@@ -1198,9 +1215,21 @@ function resolveMigrationPaths(homeDir) {
 		configDir: join(homeDir, "config")
 	};
 }
-function selectPendingReleaseMigrations(releaseFrom, targetVersion) {
+/**
+* Pick the release migrations to run for an upgrade to `targetVersion`: every
+* migration pinned to a version in the half-open range (releaseFrom, targetVersion]
+* — i.e. NEWER than the home's recorded version, up to and INCLUDING the target.
+* `releaseFrom === null` (no recorded version) runs them all (they are idempotent).
+*
+* This is what makes adding a release migration a one-line, version-local change:
+* a developer pins their migration to the release that introduced it and the range
+* selector includes it for every older home automatically — they never touch, or
+* even read, the migrations for prior releases. `migrations` is injectable so the
+* forward-compat property can be proven against a hypothetical future set.
+*/
+function selectPendingReleaseMigrations(releaseFrom, targetVersion, migrations = RELEASE_MIGRATIONS) {
 	if (!isComparableSemver(targetVersion)) return [];
-	return RELEASE_MIGRATIONS.filter((migration) => {
+	return migrations.filter((migration) => {
 		if (!isComparableSemver(migration.version)) return false;
 		if (compareComparableVersions(migration.version, targetVersion) > 0) return false;
 		if (releaseFrom === null || !isComparableSemver(releaseFrom)) return true;
@@ -1219,20 +1248,56 @@ function readStackEnvValue(stashDir, key) {
 	}
 	return null;
 }
-/**
-* Resolve the current on-disk layout version.
-*   - explicit OP_LAYOUT_VERSION in knowledge/env/stack.env wins
-*   - else a top-level `vault/` directory ⇒ 0.10.x layout (version 0)
-*   - else assume the current layout (a pre-marker 0.11 install) — caller stamps it
+/** OpenPalm-shaped directories whose content marks a home as "an install of SOME
+*  version" (vs. an empty/fresh home or a directory full of unrelated junk). */
+var OPENPALM_CONTENT_DIRS = [
+	"config",
+	"data",
+	"knowledge",
+	"logs",
+	"backups"
+];
+/** True if `dir` exists and contains at least one regular file (recursively). */
+function dirHasAnyFile(dir) {
+	if (!existsSync(dir)) return false;
+	for (const entry of readdirSync(dir, { withFileTypes: true })) {
+		if (entry.isFile()) return true;
+		if (entry.isDirectory() && dirHasAnyFile(join(dir, entry.name))) return true;
+	}
+	return false;
+}
+/** True if the home holds any OpenPalm-shaped content (i.e. is not fresh/empty). */
+function hasOpenPalmContent(homeDir) {
+	return OPENPALM_CONTENT_DIRS.some((d) => dirHasAnyFile(join(homeDir, d)));
+}
+/**
+* Resolve the current on-disk layout version. Ordered so that an AUTHORITATIVE
+* stamp wins, legacy markers handle both old installs and crash-recovery, and an
+* unrecognized home fails LOUD instead of being silently declared current:
+*   1. explicit OP_LAYOUT_VERSION in knowledge/env/stack.env ⇒ that version
+*      (a completed migration is stamped, so this short-circuits everything below)
+*   2. a top-level `vault/` directory ⇒ 0.10.x layout (version 0). Checked before
+*      the pre-stamp shortcut so a crash mid-migration (knowledge/ written, not yet
+*      stamped, vault/ still present) re-runs the idempotent 0→1 migration.
+*   3. a `config/system.env` file ⇒ 0.9.x layout (pre-vault; also version 0)
+*   4. a `knowledge/env/stack.env` with no stamp ⇒ current layout (a 0.11.0 install
+*      made before OP_LAYOUT_VERSION existed) — caller stamps it
+*   5. no OpenPalm-shaped content ⇒ a fresh install ⇒ current
+*   6. otherwise: data present but no known layout ⇒ throw UnrecognizedLayoutError
+*      (refuse rather than silently skip migrations and mislabel the home)
 */
 function readLayoutVersion(ctx) {
 	const envPath = stackEnvFile(ctx.stashDir);
-	if (existsSync(envPath)) for (const line of readFileSync(envPath, "utf-8").split("\n")) {
+	const envExists = existsSync(envPath);
+	if (envExists) for (const line of readFileSync(envPath, "utf-8").split("\n")) {
 		const m = line.match(/^OP_LAYOUT_VERSION=(\d+)\s*$/);
 		if (m) return Number(m[1]);
 	}
 	if (existsSync(join(ctx.homeDir, "vault"))) return 0;
-	return 2;
+	if (existsSync(join(ctx.homeDir, "config", "system.env"))) return 0;
+	if (envExists) return 2;
+	if (!hasOpenPalmContent(ctx.homeDir)) return 2;
+	throw new UnrecognizedLayoutError(ctx.homeDir);
 }
 function readStampedLayoutVersion(stashDir) {
 	const raw = readStackEnvValue(stashDir, LAYOUT_VERSION_KEY);
@@ -1455,6 +1520,50 @@ function migrateCustomComposeChannelLan(ctx) {
 }
 var SECRET_KEY_RE = /(_API_KEY|_TOKEN|_SECRET|_PASSWORD)$/;
 var CONFIG_KEY_RE = /^(OP_CAP_|SYSTEM_LLM_|EMBEDDING_)/;
+/**
+* Transform a legacy flat env file (0.10.x vault/stack/stack.env OR 0.9.x
+* config/system.env — identical KEY=val shape) into the 0.11+
+* knowledge/env/stack.env:
+*   - extract OP_UI_LOGIN_PASSWORD into knowledge/secrets/op_ui_login_password
+*   - rename OP_ADMIN_PORT → OP_HOST_UI_PORT and TTS_/STT_ → OP_TTS_/OP_STT_
+*   - drop removed vars (OP_ADMIN_OPENCODE_PORT, OP_GUARDIAN_PORT)
+*   - quarantine secret/capability keys into a .removed-secrets.bak (NEVER copied
+*     back into the non-secret stack.env)
+* Skip-if-present: never overwrites an existing destStack (idempotent).
+*/
+function transformLegacyStackEnv(ctx, srcStack, destStack, newEnv, newSecrets) {
+	if (!existsSync(srcStack) || existsSync(destStack)) return;
+	const kept = [];
+	const removed = [];
+	for (const line of readFileSync(srcStack, "utf-8").split("\n")) {
+		if (line === "" || line.startsWith("#")) {
+			kept.push(line);
+			continue;
+		}
+		const eq = line.indexOf("=");
+		const key = eq >= 0 ? line.slice(0, eq) : line;
+		const val = eq >= 0 ? line.slice(eq + 1) : "";
+		if (key === "OP_UI_LOGIN_PASSWORD") {
+			writeFile600(ctx, join(newSecrets, "op_ui_login_password"), val + "\n");
+			ctx.log("extracted OP_UI_LOGIN_PASSWORD -> knowledge/secrets/op_ui_login_password");
+		} else if (key === "OP_ADMIN_PORT") {
+			kept.push(`OP_HOST_UI_PORT=${val}`);
+			ctx.log("renamed OP_ADMIN_PORT -> OP_HOST_UI_PORT");
+		} else if (key === "OP_ADMIN_OPENCODE_PORT" || key === "OP_GUARDIAN_PORT") ctx.log(`dropped removed var: ${key}`);
+		else if (key.startsWith("TTS_") || key.startsWith("STT_")) {
+			kept.push(`OP_${key}=${val}`);
+			ctx.log(`renamed ${key} -> OP_${key}`);
+		} else if (CONFIG_KEY_RE.test(key) || SECRET_KEY_RE.test(key)) {
+			removed.push(line);
+			ctx.log(`quarantined: ${key}`);
+		} else kept.push(line);
+	}
+	writeFile600(ctx, destStack, kept.join("\n") + "\n");
+	if (removed.length > 0) {
+		writeFile600(ctx, join(newEnv, "stack.env.removed-secrets.bak"), removed.join("\n") + "\n");
+		ctx.notes.push("Secret/capability keys were removed from stack.env (saved to knowledge/env/stack.env.removed-secrets.bak) — re-enter provider keys via the Connections tab and LLM config via config/akm/config.json; do not put them back in stack.env.");
+	}
+}
 function migrate010to011(ctx) {
 	const vault = join(ctx.homeDir, "vault");
 	const newEnv = join(ctx.stashDir, "env");
@@ -1462,40 +1571,7 @@ function migrate010to011(ctx) {
 	ensureDir(ctx, newEnv);
 	ensureDir(ctx, newSecrets);
 	copyIfAbsent(ctx, join(vault, "user", "user.env"), join(newEnv, "user.env"));
-	const srcStack = join(vault, "stack", "stack.env");
-	const destStack = join(newEnv, "stack.env");
-	if (existsSync(srcStack) && !existsSync(destStack)) {
-		const kept = [];
-		const removed = [];
-		for (const line of readFileSync(srcStack, "utf-8").split("\n")) {
-			if (line === "" || line.startsWith("#")) {
-				kept.push(line);
-				continue;
-			}
-			const eq = line.indexOf("=");
-			const key = eq >= 0 ? line.slice(0, eq) : line;
-			const val = eq >= 0 ? line.slice(eq + 1) : "";
-			if (key === "OP_UI_LOGIN_PASSWORD") {
-				writeFile600(ctx, join(newSecrets, "op_ui_login_password"), val + "\n");
-				ctx.log("extracted OP_UI_LOGIN_PASSWORD -> knowledge/secrets/op_ui_login_password");
-			} else if (key === "OP_ADMIN_PORT") {
-				kept.push(`OP_HOST_UI_PORT=${val}`);
-				ctx.log("renamed OP_ADMIN_PORT -> OP_HOST_UI_PORT");
-			} else if (key === "OP_ADMIN_OPENCODE_PORT" || key === "OP_GUARDIAN_PORT") ctx.log(`dropped removed var: ${key}`);
-			else if (key.startsWith("TTS_") || key.startsWith("STT_")) {
-				kept.push(`OP_${key}=${val}`);
-				ctx.log(`renamed ${key} -> OP_${key}`);
-			} else if (CONFIG_KEY_RE.test(key) || SECRET_KEY_RE.test(key)) {
-				removed.push(line);
-				ctx.log(`quarantined: ${key}`);
-			} else kept.push(line);
-		}
-		writeFile600(ctx, destStack, kept.join("\n") + "\n");
-		if (removed.length > 0) {
-			writeFile600(ctx, join(newEnv, "stack.env.removed-secrets.bak"), removed.join("\n") + "\n");
-			ctx.notes.push("Secret/capability keys were removed from stack.env (saved to knowledge/env/stack.env.removed-secrets.bak) — re-enter provider keys via the Connections tab and LLM config via config/akm/config.json; do not put them back in stack.env.");
-		}
-	}
+	transformLegacyStackEnv(ctx, join(vault, "stack", "stack.env"), join(newEnv, "stack.env"), newEnv, newSecrets);
 	if (copyIfAbsent(ctx, join(vault, "stack", "auth.json"), join(newSecrets, "auth.json"))) ctx.notes.push("Copied auth.json best-effort — verify providers in the Connections tab and re-add any that are missing (the OpenCode auth format changed).");
 	const servicesDir = join(vault, "stack", "services");
 	if (existsSync(servicesDir)) for (const name of readdirSync(servicesDir)) copyIfAbsent(ctx, join(servicesDir, name), join(newSecrets, name));
@@ -1573,8 +1649,9 @@ confirmed the new version works.
 If anything looks wrong, do NOT delete this directory — restore from it or from
 \`data/backups/\`. Full guide: docs/operations/upgrade-0.10-to-0.11.md
 `;
-/** Drop a safe-removal README into the retained legacy vault/ (skip if present). */
+/** Drop a safe-removal README into the retained legacy vault/ (skip if absent/present). */
 function writeVaultReadme(ctx, vault) {
+	if (!existsSync(vault)) return;
 	const dest = join(vault, "README.md");
 	if (existsSync(dest)) {
 		ctx.log("skip (exists): vault/README.md");
@@ -1599,6 +1676,105 @@ function readLegacyStackYmlAddons(ctx) {
 	return [];
 }
 /**
+* The recognized 0.9.x entries under config/. Their DATA is relocated to its 0.11+
+* home (env/secrets/tasks); the originals — plus the no-longer-read system files
+* (schemas, components, openpalm.yml, ov.conf) — are then moved wholesale into
+* config/legacy-0.9/ so config/ holds only the current layout. Moving is
+* relocation, never deletion; the full-home backup already ran.
+*/
+var LEGACY_09_CONFIG_ENTRIES = [
+	"automations",
+	"components",
+	"user.env",
+	"user.env.schema",
+	"system.env",
+	"system.env.schema",
+	"openpalm.yml",
+	"ov.conf"
+];
+var LEGACY_09_README = `# This \`config/legacy-0.9/\` directory is from OpenPalm 0.9.x — a RECOVERY COPY
+
+OpenPalm 0.11+ uses a different on-disk layout. The upgrade **extracted** your
+data out of the old 0.9.x \`config/\` files into the new locations and moved the
+originals here, untouched, as a safety net:
+
+- \`config/user.env\`        → \`knowledge/env/user.env\`
+- \`config/system.env\`      → \`knowledge/env/stack.env\` (transformed; secrets
+                              extracted to \`knowledge/secrets/\`)
+- \`config/automations/*\`   → \`knowledge/tasks/\`
+- old \`components/*\`       → inert (compose components were replaced by the fixed
+                              overlay set + OP_ENABLED_ADDONS); kept for reference
+- \`config/openpalm.yml\`, \`ov.conf\`, \`*.schema\` → no longer read; kept for reference
+
+A full backup of your home was also taken under \`data/backups/\` before migrating.
+
+Nothing in 0.11+ reads this directory anymore. You can delete it once you have
+confirmed the new version works (UI signs in, stack starts, channels work). If
+\`knowledge/env/stack.env.removed-secrets.bak\` exists, re-enter those provider keys
+via the Connections tab and LLM config via \`config/akm/config.json\` first — do not
+put secrets back into stack.env. Prefer your OS trash (reversible) when removing.
+`;
+/** Enabled 0.9.x channels were compose "components": config/components/channel-<name>.yml. */
+function readLegacy09ChannelAddons(ctx) {
+	const comps = join(ctx.configDir, "components");
+	if (!existsSync(comps)) return [];
+	const addons = /* @__PURE__ */ new Set();
+	for (const name of readdirSync(comps)) {
+		const m = name.match(/^channel-([a-z0-9-]+)\.ya?ml$/);
+		if (m && ADDON_NAME_RE.test(m[1])) addons.add(m[1]);
+	}
+	return [...addons].sort();
+}
+function migrate09xToKnowledge(ctx) {
+	const sysEnv = join(ctx.configDir, "system.env");
+	if (!existsSync(sysEnv)) return;
+	const newEnv = join(ctx.stashDir, "env");
+	const newSecrets = join(ctx.stashDir, "secrets");
+	const newTasks = join(ctx.stashDir, "tasks");
+	ensureDir(ctx, newEnv);
+	ensureDir(ctx, newSecrets);
+	copyIfAbsent(ctx, join(ctx.configDir, "user.env"), join(newEnv, "user.env"));
+	transformLegacyStackEnv(ctx, sysEnv, join(newEnv, "stack.env"), newEnv, newSecrets);
+	const autos = join(ctx.configDir, "automations");
+	if (existsSync(autos)) {
+		ensureDir(ctx, newTasks);
+		for (const name of readdirSync(autos)) copyIfAbsent(ctx, join(autos, name), join(newTasks, name));
+	}
+	const addons = readLegacy09ChannelAddons(ctx);
+	if (addons.length > 0) {
+		const envPath = stackEnvFile(ctx.stashDir);
+		if (ctx.dryRun) ctx.log(`[dry-run] set OP_ENABLED_ADDONS=${addons.join(",")}`);
+		else if (existsSync(envPath)) {
+			writeFile600(ctx, envPath, upsertEnvValue(readFileSync(envPath, "utf-8"), "OP_ENABLED_ADDONS", addons.join(",")));
+			ctx.log(`set OP_ENABLED_ADDONS=${addons.join(",")}`);
+		}
+	}
+	const legacyDir = join(ctx.configDir, "legacy-0.9");
+	for (const name of LEGACY_09_CONFIG_ENTRIES) {
+		const src = join(ctx.configDir, name);
+		if (!existsSync(src)) continue;
+		ensureDir(ctx, legacyDir);
+		const dest = join(legacyDir, name);
+		if (existsSync(dest)) {
+			ctx.log(`skip (exists): config/legacy-0.9/${name}`);
+			continue;
+		}
+		if (ctx.dryRun) {
+			ctx.log(`[dry-run] relocate config/${name} -> config/legacy-0.9/${name}`);
+			continue;
+		}
+		renameSync(src, dest);
+		ctx.log(`relocated config/${name} -> config/legacy-0.9/${name}`);
+	}
+	const readmePath = join(legacyDir, "README.md");
+	if (existsSync(legacyDir) && !existsSync(readmePath)) if (ctx.dryRun) ctx.log("[dry-run] write config/legacy-0.9/README.md (safe-removal guide)");
+	else {
+		writeFileSync(readmePath, LEGACY_09_README);
+		ctx.log("wrote config/legacy-0.9/README.md (safe-removal guide)");
+	}
+	ctx.notes.push("Upgraded a 0.9.x install: your config/ data moved to knowledge/ and the old 0.9.x files were retained under config/legacy-0.9/ (see its README). Verify the stack, then remove that directory via your OS trash.");
+}
+/**
 * SYSTEM-managed files the 0.12.0 control plane no longer materializes or reads.
 * Removed so OP_HOME holds only the current managed asset set. This is an explicit
 * ALLOWLIST of system files — NEVER user data, NEVER a heuristic sweep:
@@ -1627,8 +1803,11 @@ function migrate1to2(ctx) {
 var MIGRATIONS = [{
 	from: 0,
 	to: 1,
-	describe: "0.10.x vault/ layout → 0.11.0 knowledge/ layout",
-	apply: migrate010to011,
+	describe: "pre-knowledge (0.9.x config/ or 0.10.x vault/) → 0.11.0 knowledge/ layout",
+	apply(ctx) {
+		migrate010to011(ctx);
+		migrate09xToKnowledge(ctx);
+	},
 	verify(ctx) {
 		if (ctx.dryRun) return;
 		if (!existsSync(stackEnvFile(ctx.stashDir))) throw new Error("post-migration check failed: knowledge/env/stack.env is missing");
@@ -1643,6 +1822,30 @@ var MIGRATIONS = [{
 		for (const rel of INERT_LAYOUT_V2_FILES) if (existsSync(join(ctx.homeDir, rel))) throw new Error(`post-migration check failed: inert ${rel} still present`);
 	}
 }];
+/**
+* Select the layout migrations to run, by WALKING the chain from `from` up to
+* CURRENT_LAYOUT_VERSION — correct-by-construction for multi-version jumps and a
+* loud guard against a broken chain (the forward-compat footgun). A plain
+* `filter(m.from in [from, ceiling))` would silently skip a missing step or run a
+* migration whose precondition isn't met; here a gap throws immediately so the
+* mistake surfaces at the structural test, never on a user's disk.
+*
+* Forward-only: a home at or beyond the current layout (e.g. ran on a newer app,
+* then downgraded) returns [] — there are no backward migrations.
+*/
+function selectPendingLayoutMigrations(from, migrations = MIGRATIONS, ceiling = 2) {
+	if (from >= ceiling) return [];
+	const chain = [];
+	let cursor = from;
+	while (cursor < ceiling) {
+		const next = migrations.find((m) => m.from === cursor);
+		if (!next) throw new Error(`Layout migration chain is broken: no migration with from:${cursor} (home is at layout ${from}, target is ${ceiling}). Add a Migration { from:${cursor}, to:${cursor + 1}, … } to MIGRATIONS.`);
+		chain.push(next);
+		cursor = next.to;
+	}
+	if (cursor !== ceiling) throw new Error(`Layout migration chain overshoots the target: reached ${cursor}, expected ${ceiling}. Migrations must advance one layout step at a time.`);
+	return chain;
+}
 var RELEASE_MIGRATIONS = [
 	{
 		version: "v0.11.5-rc.1",
@@ -1741,7 +1944,7 @@ function ensureMigrated(opts = {}) {
 		releaseTo: comparableReleaseTarget ?? releaseFrom ?? "",
 		releaseApplied: []
 	};
-	const pending = MIGRATIONS.filter((m) => m.from >= from && m.from < 2).sort((a, b) => a.from - b.from);
+	const pending = selectPendingLayoutMigrations(from);
 	const pendingRelease = comparableReleaseTarget ? selectPendingReleaseMigrations(releaseFrom, comparableReleaseTarget) : [];
 	if (pending.length === 0 && pendingRelease.length === 0 && !needsLayoutStamp && !needsReleaseStamp) return {
 		...empty,
@@ -10276,4 +10479,4 @@ function collectBindAddressWarnings(env) {
 }
 
 export { ensureReleaseMigrated as $, AKM_USER_ENV_REF as A, composeStats as B, CORE_SERVICES as C, DowngradeConfirmationRequired as D, composeStop as E, composeUp as F, createLogger as G, createOpenCodeClient as H, INSTALL_LOCK_STALE_AFTER_MS as I, createState as J, deleteUserEnvKey as K, deriveLaunchStatus as L, MigrationError as M, deriveLocalStackState as N, detectGpu as O, PLATFORM_VERSION as P, detectHostOpenCode as Q, detectLocalProviders as R, detectRuntime as S, disableHostAkmSharing as T, dismissSecretStripNotice as U, enableHostAkmSharing as V, ensureAkmUserEnv as W, ensureHomeDirs as X, ensureMigrated as Y, ensureOpenCodeConfig as Z, ensureOpenCodeSystemConfig as _, addonProfileId as a, validateProposedState as a$, ensureSecrets as a0, executeAutomation as a1, fetchProviderModels as a2, formatForDisplay as a3, getAddonProfileAvailability as a4, getAddonProfileSelection as a5, getAddonProfiles as a6, getAddonServiceNames as a7, getAkmStats as a8, getDockerEvents as a9, readDeployJournal as aA, readSecret as aB, readSecretFile as aC, readSecretStripNotice as aD, readStackEnv as aE, readStackRuntimeEnv as aF, readStackSecretEnv as aG, readTaskFile as aH, readUserEnvFile as aI, recommendSetup as aJ, removeSecretFile as aK, removeTaskFile as aL, resolveComposeProjectName as aM, resolveDataDir as aN, resolveDefaultMigrateTarget as aO, resolveDeployJournalPath as aP, resolveEffectivePlatformImageTag as aQ, resolveRuntimeFiles as aR, resolveStackDir as aS, runDeploy as aT, seedUiBuild as aU, setAddonEnabled as aV, setAddonProfileSelection as aW, summarizeBackups as aX, summarizeComposeStderr as aY, unlockInstallLock as aZ, useExistingProviderForAssistantCli as a_, getHostAkmSharingStatus as aa, getRegistryAddonConfig as ab, hostAkmStashPath as ac, importHostOpenCode as ad, initializeStateSecrets as ae, inspectInstallLock as af, isAllowedService as ag, isComparableSemver as ah, isHostAkmAvailable as ai, isPrerelease as aj, isSetupComplete as ak, listAssistantCliTools as al, listAvailableAddonIds as am, listBackupDirs as an, listEnabledAddonIds as ao, listSecretFiles as ap, loadAutomations as aq, mapDockerError as ar, markSetupComplete as as, parseComposeStderr as at, parseEnvFile as au, patchSecretsEnvFile as av, performSetup as aw, performUpgrade as ax, pruneBackupDirs as ay, readAutomationLogs as az, annotateAddonProfileAvailability as b, writeFileAtomic as b0, writeRuntimeFiles as b1, writeSecretFile as b2, writeStackSecretEnv as b3, writeTaskFile as b4, writeUserEnvKey as b5, writeVoiceVars as b6, applyInstall as c, applyTagChange as d, applyUninstall as e, applyUpdate as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, backupSetupInputs as j, buildAkmEndpoint as k, buildAkmEnv as l, buildComposeOptions as m, buildManagedServices as n, checkDocker as o, checkDockerCompose as p, classifyLocalInstall as q, collectBindAddressWarnings as r, compareComparableVersions as s, composeDown as t, composeLogs as u, composePreflight as v, composePs as w, composePull as x, composeRestart as y, composeStart as z };
-//# sourceMappingURL=src-hV_EYNgm.js.map
+//# sourceMappingURL=src-DnDbWIue.js.map