@openpalm/ui 0.12.12 → 0.12.13

package/build/server/chunks/{session-cookie-DTiNx7Rk.js → session-cookie-CHgIES2p.js}

@@ -1,4 +1,4 @@
-import { S as SESSION_TTL_SECONDS } from './helpers-DL0rlFJr.js';
+import { S as SESSION_TTL_SECONDS } from './helpers-kzwksNq1.js';
 
 //#region src/lib/server/session-cookie.ts
 /**
@@ -71,4 +71,4 @@ function clearSessionCookieHeader(request) {
 }
 
 export { SESSION_COOKIE_NAME as S, clearSessionCookieHeader as c, sessionCookieHeader as s };
-//# sourceMappingURL=session-cookie-DTiNx7Rk.js.map
+//# sourceMappingURL=session-cookie-CHgIES2p.js.map

package/build/server/chunks/{session-cookie-DTiNx7Rk.js.map → session-cookie-CHgIES2p.js.map}

@@ -1 +1 @@
-{"version":3,"file":"session-cookie-DTiNx7Rk.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}
+{"version":3,"file":"session-cookie-CHgIES2p.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}

package/build/server/chunks/{setup-deploy-CyDh3qyw.js → setup-deploy-B--th9ts.js}

@@ -1,4 +1,4 @@
-import { j as backupSetupInputs, aW as runDeploy, aP as resolveDeployJournalPath, ak as isSetupComplete, aU as resolveStackDir, aA as readDeployJournal, as as markSetupComplete } from './src-BGtbBgcg.js';
+import { k as backupSetupInputs, a$ as runDeploy, aT as resolveDeployJournalPath, am as isSetupComplete, aZ as resolveStackDir, aE as readDeployJournal, aw as markSetupComplete } from './src-CidJbygh.js';
 
 //#region src/lib/server/setup-deploy.ts
 var _state = {
@@ -72,4 +72,4 @@ function prepareSetupRestorePoint(state) {
 }
 
 export { getDeployState as g, prepareSetupRestorePoint as p, resetDeployState as r, startDeploy as s };
-//# sourceMappingURL=setup-deploy-CyDh3qyw.js.map
+//# sourceMappingURL=setup-deploy-B--th9ts.js.map

package/build/server/chunks/{setup-deploy-CyDh3qyw.js.map → setup-deploy-B--th9ts.js.map}

@@ -1 +1 @@
-{"version":3,"file":"setup-deploy-CyDh3qyw.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { A as markSetupComplete, M as resolveDeployJournalPath, N as runDeploy, ht as isSetupComplete, j as readDeployJournal, k as backupSetupInputs, nn as resolveStackDir } from \"./src.js\";\n//#region src/lib/server/setup-deploy.ts\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\timageWarning: null,\n\tphase: \"writing-config\"\n};\nvar _deployPromise = null;\nfunction deployStateFromJournal(state) {\n\tconst journal = readDeployJournal(resolveDeployJournalPath(state));\n\treturn {\n\t\tdeploying: journal.deploying,\n\t\tinterrupted: journal.interrupted,\n\t\tsetupComplete: journal.setupComplete || isSetupComplete(resolveStackDir()),\n\t\tdeployStatus: journal.deployStatus,\n\t\tdeployError: journal.deployError,\n\t\timageWarning: journal.imageWarning,\n\t\tphase: journal.phase\n\t};\n}\nfunction getDeployState(state) {\n\tif (state) _state = deployStateFromJournal(state);\n\telse if (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveStackDir())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: _state.deployStatus.map((entry) => ({ ...entry }))\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\timageWarning: null,\n\t\tphase: \"writing-config\"\n\t};\n}\nfunction startDeploy(state) {\n\tif (_deployPromise) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\treturn;\n\t}\n\t_deployPromise = (async () => {\n\t\tawait runDeploy(state, {\n\t\t\tjournalPath: resolveDeployJournalPath(state),\n\t\t\tonUpdate(progress) {\n\t\t\t\t_state = {\n\t\t\t\t\tdeploying: progress.deploying,\n\t\t\t\t\tinterrupted: progress.interrupted,\n\t\t\t\t\tsetupComplete: progress.setupComplete,\n\t\t\t\t\tdeployStatus: progress.deployStatus,\n\t\t\t\t\tdeployError: progress.deployError,\n\t\t\t\t\timageWarning: progress.imageWarning,\n\t\t\t\t\tphase: progress.phase\n\t\t\t\t};\n\t\t\t},\n\t\t\tmarkSetupComplete() {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t}\n\t\t});\n\t})().finally(() => {\n\t\t_deployPromise = null;\n\t});\n}\nfunction prepareSetupRestorePoint(state) {\n\treturn backupSetupInputs(state);\n}\n//#endregion\nexport { startDeploy as i, prepareSetupRestorePoint as n, resetDeployState as r, getDeployState as t };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,YAAY,EAAE,IAAI;AACnB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,IAAI,cAAc,GAAG,IAAI;AACzB,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;AAC9B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;AAC5E,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,KAAK,EAAE,OAAO,CAAC;AACjB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,IAAI,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAClD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AACvH,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AACjE,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,YAAY,EAAE,IAAI;AACpB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,cAAc,EAAE;AACrB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE;AACF,CAAC;AACD,CAAC,cAAc,GAAG,CAAC,YAAY;AAC/B,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;AACzB,GAAG,WAAW,EAAE,wBAAwB,CAAC,KAAK,CAAC;AAC/C,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,MAAM,GAAG;AACb,KAAK,SAAS,EAAE,QAAQ,CAAC,SAAS;AAClC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,aAAa,EAAE,QAAQ,CAAC,aAAa;AAC1C,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,KAAK,EAAE,QAAQ,CAAC;AACrB,KAAK;AACL,GAAG,CAAC;AACJ,GAAG,iBAAiB,GAAG;AACvB,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;AACpB,EAAE,cAAc,GAAG,IAAI;AACvB,CAAC,CAAC,CAAC;AACH;AACA,SAAS,wBAAwB,CAAC,KAAK,EAAE;AACzC,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC;AAChC;;;;"}
+{"version":3,"file":"setup-deploy-B--th9ts.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { F as runDeploy, M as markSetupComplete, N as readDeployJournal, P as resolveDeployJournalPath, j as backupSetupInputs, on as resolveStackDir, yt as isSetupComplete } from \"./src.js\";\n//#region src/lib/server/setup-deploy.ts\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\timageWarning: null,\n\tphase: \"writing-config\"\n};\nvar _deployPromise = null;\nfunction deployStateFromJournal(state) {\n\tconst journal = readDeployJournal(resolveDeployJournalPath(state));\n\treturn {\n\t\tdeploying: journal.deploying,\n\t\tinterrupted: journal.interrupted,\n\t\tsetupComplete: journal.setupComplete || isSetupComplete(resolveStackDir()),\n\t\tdeployStatus: journal.deployStatus,\n\t\tdeployError: journal.deployError,\n\t\timageWarning: journal.imageWarning,\n\t\tphase: journal.phase\n\t};\n}\nfunction getDeployState(state) {\n\tif (state) _state = deployStateFromJournal(state);\n\telse if (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveStackDir())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: _state.deployStatus.map((entry) => ({ ...entry }))\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\timageWarning: null,\n\t\tphase: \"writing-config\"\n\t};\n}\nfunction startDeploy(state) {\n\tif (_deployPromise) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\treturn;\n\t}\n\t_deployPromise = (async () => {\n\t\tawait runDeploy(state, {\n\t\t\tjournalPath: resolveDeployJournalPath(state),\n\t\t\tonUpdate(progress) {\n\t\t\t\t_state = {\n\t\t\t\t\tdeploying: progress.deploying,\n\t\t\t\t\tinterrupted: progress.interrupted,\n\t\t\t\t\tsetupComplete: progress.setupComplete,\n\t\t\t\t\tdeployStatus: progress.deployStatus,\n\t\t\t\t\tdeployError: progress.deployError,\n\t\t\t\t\timageWarning: progress.imageWarning,\n\t\t\t\t\tphase: progress.phase\n\t\t\t\t};\n\t\t\t},\n\t\t\tmarkSetupComplete() {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t}\n\t\t});\n\t})().finally(() => {\n\t\t_deployPromise = null;\n\t});\n}\nfunction prepareSetupRestorePoint(state) {\n\treturn backupSetupInputs(state);\n}\n//#endregion\nexport { startDeploy as i, prepareSetupRestorePoint as n, resetDeployState as r, getDeployState as t };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,YAAY,EAAE,IAAI;AACnB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,IAAI,cAAc,GAAG,IAAI;AACzB,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;AAC9B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;AAC5E,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,KAAK,EAAE,OAAO,CAAC;AACjB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,IAAI,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAClD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AACvH,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AACjE,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,YAAY,EAAE,IAAI;AACpB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,cAAc,EAAE;AACrB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE;AACF,CAAC;AACD,CAAC,cAAc,GAAG,CAAC,YAAY;AAC/B,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;AACzB,GAAG,WAAW,EAAE,wBAAwB,CAAC,KAAK,CAAC;AAC/C,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,MAAM,GAAG;AACb,KAAK,SAAS,EAAE,QAAQ,CAAC,SAAS;AAClC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,aAAa,EAAE,QAAQ,CAAC,aAAa;AAC1C,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,KAAK,EAAE,QAAQ,CAAC;AACrB,KAAK;AACL,GAAG,CAAC;AACJ,GAAG,iBAAiB,GAAG;AACvB,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;AACpB,EAAE,cAAc,GAAG,IAAI;AACvB,CAAC,CAAC,CAAC;AACH;AACA,SAAS,wBAAwB,CAAC,KAAK,EAAE;AACzC,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC;AAChC;;;;"}

package/build/server/chunks/{src-BGtbBgcg.js → src-CidJbygh.js}

@@ -737,7 +737,7 @@ var import_main = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = DotenvModule;
 })))();
 var package_default = {
-	version: "0.12.12"};
+	version: "0.12.13"};
 //#endregion
 //#region ../lib/src/control-plane/versioning.ts
 var SEMVER_RE = /^v?\d+\.\d+\.\d+(?:[-+].*)?$/;
@@ -1117,6 +1117,33 @@ function buildPinnedImageTagEnv(env, pinnedImages) {
 	for (const image of pinnedImages) updates[platformImageTagKeyFor(image)] = resolveEffectivePlatformImageTag(env, image);
 	return updates;
 }
+var DEPLOYABLE_UNITS = [
+	"assistant",
+	"guardian",
+	"portals",
+	"voice"
+];
+var DEPLOYABLE_UNIT_IMAGE_NAMES = {
+	assistant: "assistant",
+	guardian: "guardian",
+	portals: "portal",
+	voice: "voice"
+};
+var DEPLOYABLE_UNIT_IMAGE_TAG_KEYS = {
+	assistant: "OP_ASSISTANT_IMAGE_TAG",
+	guardian: "OP_GUARDIAN_IMAGE_TAG",
+	portals: "OP_PORTAL_IMAGE_TAG",
+	voice: "OP_VOICE_IMAGE_TAG"
+};
+function isDeployableUnit(value) {
+	return DEPLOYABLE_UNITS.includes(value);
+}
+function deployableUnitImageName(unit) {
+	return DEPLOYABLE_UNIT_IMAGE_NAMES[unit];
+}
+function deployableUnitImageTagKey(unit) {
+	return DEPLOYABLE_UNIT_IMAGE_TAG_KEYS[unit];
+}
 /**
 * Build the stack.env image-tag entries for a platform release.
 *
@@ -5451,7 +5478,7 @@ function resolveLocalOpenpalmDir() {
 * aware — unlike `releases/latest`, which silently excludes prereleases),
 * immutable versions, and a sha512 integrity we verify fail-closed.
 */
-var NPM_REGISTRY = "https://registry.npmjs.org";
+var NPM_REGISTRY$1 = "https://registry.npmjs.org";
 var UI_PACKAGE = "@openpalm/ui";
 /**
 * Resolve the npm manifest for `@openpalm/ui` by exact version OR dist-tag.
@@ -5459,7 +5486,7 @@ var UI_PACKAGE = "@openpalm/ui";
 * manifest (version + dist.tarball + dist.integrity). Throws on non-OK.
 */
 async function fetchNpmUiManifest(versionOrTag) {
-	const res = await fetchWithRetry(`${NPM_REGISTRY}/${UI_PACKAGE}/${versionOrTag}`);
+	const res = await fetchWithRetry(`${NPM_REGISTRY$1}/${UI_PACKAGE}/${versionOrTag}`);
 	if (!res.ok) throw new Error(`npm registry returned HTTP ${res.status} for ${UI_PACKAGE}@${versionOrTag}`);
 	const m = await res.json();
 	if (!m.version || !m.dist?.tarball) throw new Error(`npm manifest for ${UI_PACKAGE}@${versionOrTag} is missing version/dist.tarball`);
@@ -7812,6 +7839,71 @@ function collectPinnedImageWarnings(currentEnv, pinnedImages, platformTag) {
 	return warnings;
 }
 /**
+* Resolve the newest published tag for a SPECIFIC image on Docker Hub.
+*
+* `assistant` is the version-of-record image, but with independently versioned
+* units each image (guardian, portal, voice) has its own release line. This
+* resolves the newest semver tag for the given image name so a per-unit update
+* check compares against the unit's own latest, not the assistant's.
+*
+* Used both to auto-detect during "Update now" and to resolve a requested
+* `latest` selection into a concrete release tag before fetching stack assets
+* (GitHub has no asset tree at a `latest` ref).
+*/
+async function resolveLatestImageTag(namespace, imageName) {
+	const latestTag = resolveNewestDockerTag(await fetchDockerTagsPayload(namespace, imageName), {});
+	if (!latestTag) throw new Error(`No usable Docker image tag found for ${namespace}/${imageName}`);
+	return latestTag;
+}
+/**
+* Resolve the newest published tag for a SPECIFIC image, scoped to the current
+* major version of `currentTag`. Mirrors {@link resolveLatestImageTag} with the
+* same major-scoping + prerelease policy as the platform resolver.
+*/
+async function resolveLatestImageTagForCurrentMajor(namespace, imageName, currentTag, opts = {}) {
+	const skipPrerelease = !opts.allowPrerelease && !isPrerelease(currentTag);
+	const latestTag = resolveNewestDockerTag(await fetchDockerTagsPayload(namespace, imageName), {
+		sameMajorAs: currentTag,
+		skipPrerelease
+	});
+	if (!latestTag) throw new Error(`No usable Docker image tag found for ${namespace}/${imageName} in major ${majorVersionOf(currentTag) ?? currentTag}`);
+	return latestTag;
+}
+/**
+* List published Docker image tags for a SPECIFIC image, filtered + sorted.
+*
+* Mirrors {@link resolveLatestImageTag} / {@link resolveLatestImageTagForCurrentMajor}
+* but returns ALL matching tags (not just the newest), sorted newest (highest
+* semver) first. Used by the admin UI's per-unit version picker dropdowns so the
+* user can pin/rollback to any published tag — Docker Hub is the authoritative
+* source for what's available to deploy, per unit.
+*
+* Constraints (all optional):
+* - `sameMajorAs`    — only tags whose major component matches this tag.
+* - `skipPrerelease` — ignore prerelease tags (`-rc`, `-beta`, …). Default false
+*                      so the picker shows every tag on the line, including rcs.
+* - `max`            — cap the returned list (default 20).
+*
+* Tags are returned in Docker-canonical form (`v`-prefixed, as Docker Hub returns
+* them). The UI strips the `v` for display via `formatForDisplay`.
+*/
+async function listDockerImageTags(namespace, imageName, opts = {}) {
+	const { sameMajorAs, skipPrerelease = false, max = 20 } = opts;
+	const results = (await fetchDockerTagsPayload(namespace, imageName))?.results;
+	if (!Array.isArray(results)) return [];
+	const tags = [];
+	for (const entry of results) {
+		const name = typeof entry?.name === "string" ? entry.name.trim() : "";
+		if (!name || name === "latest") continue;
+		if (!isComparableSemver(name)) continue;
+		if (skipPrerelease && isPrerelease(name)) continue;
+		if (sameMajorAs !== void 0 && !isSameMajorVersion(name, sameMajorAs)) continue;
+		tags.push(name);
+	}
+	tags.sort((a, b) => compareComparableVersions(b, a));
+	return tags.slice(0, max);
+}
+/**
 * Resolve the newest published platform tag from the Docker registry.
 *
 * `assistant` is the version-of-record image: its newest tag is the canonical
@@ -7823,9 +7915,7 @@ function collectPinnedImageWarnings(currentEnv, pinnedImages, platformTag) {
 * (GitHub has no asset tree at a `latest` ref).
 */
 async function resolveLatestPlatformTag(namespace) {
-	const latestTag = resolveNewestDockerTag(await fetchDockerTagsPayload(namespace, "assistant"), {});
-	if (!latestTag) throw new Error("No usable Docker image tag found");
-	return latestTag;
+	return resolveLatestImageTag(namespace, "assistant");
 }
 /**
 * Resolve the default target version for `openpalm migrate --dry-run`: the
@@ -7837,13 +7927,7 @@ async function resolveDefaultMigrateTarget(state, opts = {}) {
 	return resolveLatestPlatformTagForCurrentMajor(resolveImageNamespace(state), resolvePlatformVersionPolicyBaseTag(state), { allowPrerelease: opts.allowPrerelease });
 }
 async function resolveLatestPlatformTagForCurrentMajor(namespace, currentTag, opts = {}) {
-	const skipPrerelease = !opts.allowPrerelease && !isPrerelease(currentTag);
-	const latestTag = resolveNewestDockerTag(await fetchDockerTagsPayload(namespace, "assistant"), {
-		sameMajorAs: currentTag,
-		skipPrerelease
-	});
-	if (!latestTag) throw new Error(`No usable Docker image tag found in major ${majorVersionOf(currentTag) ?? currentTag}`);
-	return latestTag;
+	return resolveLatestImageTagForCurrentMajor(namespace, "assistant", currentTag, opts);
 }
 async function updateStackEnvToLatestImageTag(state, resolvedTag) {
 	const systemEnvPath = `${state.stashDir}/env/stack.env`;
@@ -7974,6 +8058,87 @@ async function applyTagChange(state, tag, opts = {}) {
 		};
 	});
 }
+/**
+* Read the currently-configured image tag for a single deployable unit from
+* stack.env. Falls back to OP_IMAGE_TAG (the compose substitution fallback) and
+* finally PLATFORM_VERSION, mirroring the compose `${OP_*_IMAGE_TAG:-…}` chain.
+*/
+function resolveUnitCurrentTag(state, unit) {
+	const envVars = parseEnvFile(`${state.stashDir}/env/stack.env`);
+	const tag = envVars[deployableUnitImageTagKey(unit)]?.trim() || envVars.OP_IMAGE_TAG?.trim();
+	if (isComparableSemver(tag)) return tag;
+	return PLATFORM_VERSION;
+}
+/**
+* Per-unit downgrade gate (#501). A target OLDER than the unit's CURRENT tag is
+* a downgrade — forward-only release migrations don't run backward, so require
+* explicit confirmation. Compared against the unit's own tag (not the platform
+* OP_IMAGE_TAG) so pinning guardian back a patch doesn't trip on the assistant
+* version.
+*/
+function assertNotUnconfirmedUnitDowngrade(state, unit, targetTag, confirmDowngrade) {
+	if (confirmDowngrade) return;
+	const currentTag = resolveUnitCurrentTag(state, unit);
+	if (!isComparableSemver(targetTag) || !isComparableSemver(currentTag)) return;
+	if (compareComparableVersions(targetTag, currentTag) >= 0) return;
+	throw new DowngradeConfirmationRequired(currentTag, targetTag);
+}
+/**
+* Pin a SINGLE deployable unit's image tag in stack.env, then pull + recreate.
+*
+* Unlike {@link applyTagChange} (a full platform upgrade), this writes only the
+* one `OP_*_IMAGE_TAG` env var for the named unit and does NOT run release
+* migrations or refresh stack compose assets — those are platform-level and run
+* on `performUpgrade` / `applyTagChange`. Per-unit pinning is for rolling one
+* image back to a known-good release or pinning it to a tested build without
+* moving the rest of the stack.
+*
+* Non-destructive: the write uses `mergeEnvContent` so existing user keys
+* (including commented-out ones) are preserved.
+*/
+async function applyUnitImageTagChange(state, unit, tag, opts = {}) {
+	if (!isDeployableUnit(unit)) throw new Error(`Unknown deployable unit: ${unit}`);
+	const typedUnit = unit;
+	return withStackEnvRollback(state, async () => {
+		const namespace = resolveImageNamespace(state);
+		const imageName = deployableUnitImageName(typedUnit);
+		const envKey = deployableUnitImageTagKey(typedUnit);
+		const requested = tag.trim();
+		let resolvedTag = requested;
+		if (requested === "" || requested.toLowerCase() === "latest") try {
+			resolvedTag = await resolveLatestImageTag(namespace, imageName);
+		} catch (e) {
+			const msg = e instanceof Error ? e.message : String(e);
+			throw new Error(`Cannot resolve "latest" to a concrete release for ${typedUnit}: ${msg}. Check your network connection or select a specific version.`);
+		}
+		assertNotUnconfirmedUnitDowngrade(state, typedUnit, resolvedTag, opts.confirmDowngrade ?? false);
+		const dockerTag = extractDockerTagFromReleaseTag(resolvedTag);
+		if (namespace === "openpalm") {
+			if (!await isDockerImageTagPublished(namespace, imageName, dockerTag)) throw new Error(`Refusing to pin ${namespace}/${imageName}:${dockerTag}: tag is not published. stack.env was left unchanged.`);
+		}
+		const stackEnvPath = `${state.stashDir}/env/stack.env`;
+		writeFileSync(stackEnvPath, mergeEnvContent(existsSync(stackEnvPath) ? readFileSync(stackEnvPath, "utf-8") : "", { [envKey]: dockerTag }));
+		const composeOpts = buildComposeOptions(state);
+		const pullResult = await composePull(composeOpts);
+		if (!pullResult.ok) throw new Error(`Failed to pull images: ${pullResult.stderr}`);
+		const services = await buildManagedServices(state);
+		const upResult = await composeUp({
+			...composeOpts,
+			services,
+			forceRecreate: true,
+			removeOrphans: true
+		});
+		if (!upResult.ok) throw new Error(`Images pulled but failed to recreate containers: ${upResult.stderr}`);
+		return {
+			imageTag: dockerTag,
+			namespace,
+			backupDir: null,
+			assetsUpdated: [],
+			restarted: services,
+			warnings: []
+		};
+	});
+}
 function buildComposeFileList(state) {
 	return discoverStackOverlays(state.stackDir);
 }
@@ -9156,6 +9321,71 @@ async function validateProposedState(state) {
 	};
 }
 //#endregion
+//#region ../lib/src/control-plane/npm-registry.ts
+/**
+* npm registry lookups — latest version + version list for any npm package.
+*
+* The admin UI's "Admin interface" picker (@openpalm/ui) and the platform
+* latest-version check (@openpalm/lib) both read from the npm registry. Keeping
+* these helpers in lib (not duplicated in the UI) follows the shared control-
+* plane library rule: both CLI and admin import portable lookups from
+* `@openpalm/lib`.
+*
+* Uses the Web Platform `fetch` built-in — no third-party deps.
+*/
+var NPM_REGISTRY = "https://registry.npmjs.org";
+var NPM_TIMEOUT_MS = 8e3;
+async function fetchNpmPackument(packageName) {
+	let response;
+	try {
+		response = await fetch(`${NPM_REGISTRY}/${packageName}`, {
+			headers: {
+				"User-Agent": "openpalm-admin/1.0",
+				Accept: "application/json"
+			},
+			signal: AbortSignal.timeout(NPM_TIMEOUT_MS)
+		});
+	} catch (e) {
+		throw new Error(`Failed to query npm registry: ${e instanceof Error ? e.message : String(e)}`);
+	}
+	if (response.status === 404) return {};
+	if (!response.ok) throw new Error(`npm registry lookup failed (${response.status})`);
+	return await response.json();
+}
+/**
+* Resolve the latest published version of an npm package from its dist-tags.
+*
+* `distTag` defaults to `'latest'`; pass `{ allowPrerelease: true }` (or
+* `{ distTag: 'next' }`) to read the prerelease channel. Returns `null` when the
+* package exists but the requested dist-tag is absent.
+*/
+async function resolveLatestNpmVersion(packageName, opts = {}) {
+	const distTag = opts.distTag ?? (opts.allowPrerelease ? "next" : "latest");
+	const version = ((await fetchNpmPackument(packageName))["dist-tags"] ?? {})[distTag];
+	return typeof version === "string" ? version : null;
+}
+/**
+* List published npm versions for a package, newest-first by publish time.
+*
+* Mirrors the shape the admin UI's `@openpalm/ui` picker expects. Returns at
+* most `max` entries (default 20). A 404 (package not yet published) yields an
+* empty list.
+*/
+async function listNpmVersions(packageName, opts = {}) {
+	const { max = 20 } = opts;
+	const packument = await fetchNpmPackument(packageName);
+	const distTags = packument["dist-tags"] ?? {};
+	const versionToTag = /* @__PURE__ */ new Map();
+	for (const [tag, version] of Object.entries(distTags)) versionToTag.set(version, tag);
+	const time = packument.time ?? {};
+	return Object.keys(packument.versions ?? {}).map((version) => ({
+		version,
+		prerelease: version.includes("-"),
+		publishedAt: time[version] ?? null,
+		distTag: versionToTag.get(version) ?? null
+	})).sort((a, b) => (b.publishedAt ?? "").localeCompare(a.publishedAt ?? "")).slice(0, max);
+}
+//#endregion
 //#region ../lib/src/control-plane/markdown-task.ts
 /**
 * AKM task parser.
@@ -10590,5 +10820,5 @@ function collectBindAddressWarnings(env) {
 	return warnings;
 }
 
-export { ensureReleaseMigrated as $, AKM_USER_ENV_REF as A, BackupSpaceError as B, CORE_SERVICES as C, DowngradeConfirmationRequired as D, composeStop as E, composeUp as F, createLogger as G, createOpenCodeClient as H, INSTALL_LOCK_STALE_AFTER_MS as I, createState as J, deleteUserEnvKey as K, deriveLaunchStatus as L, MigrationError as M, deriveLocalStackState as N, detectGpu as O, PLATFORM_VERSION as P, detectHostOpenCode as Q, detectLocalProviders as R, detectRuntime as S, disableHostAkmSharing as T, dismissSecretStripNotice as U, enableHostAkmSharing as V, ensureAkmUserEnv as W, ensureHomeDirs as X, ensureMigrated as Y, ensureOpenCodeConfig as Z, ensureOpenCodeSystemConfig as _, addonProfileId as a, summarizeComposeStderr as a$, ensureSecrets as a0, executeAutomation as a1, fetchProviderModels as a2, formatForDisplay as a3, getAddonProfileAvailability as a4, getAddonProfileSelection as a5, getAddonProfiles as a6, getAddonServiceNames as a7, getAkmStats as a8, getDockerEvents as a9, readDeployJournal as aA, readSecret as aB, readSecretFile as aC, readSecretStripNotice as aD, readStackEnv as aE, readStackRuntimeEnv as aF, readStackSecretEnv as aG, readTaskFile as aH, readUserEnvFile as aI, recommendSetup as aJ, removeSecretFile as aK, removeTaskFile as aL, resolveComposeProjectName as aM, resolveDataDir as aN, resolveDefaultMigrateTarget as aO, resolveDeployJournalPath as aP, resolveEffectivePlatformImageTag as aQ, resolveLatestPlatformTag as aR, resolveLatestPlatformTagForCurrentMajor as aS, resolveRuntimeFiles as aT, resolveStackDir as aU, runAssistantAkmCommand as aV, runDeploy as aW, seedUiBuild as aX, setAddonEnabled as aY, setAddonProfileSelection as aZ, summarizeBackups as a_, getHostAkmSharingStatus as aa, getRegistryAddonConfig as ab, hostAkmStashPath as ac, importHostOpenCode as ad, initializeStateSecrets as ae, inspectInstallLock as af, isAllowedService as ag, isComparableSemver as ah, isHostAkmAvailable as ai, isPrerelease as aj, isSetupComplete as ak, listAssistantCliTools as al, listAvailableAddonIds as am, listBackupDirs as an, listEnabledAddonIds as ao, listSecretFiles as ap, loadAutomations as aq, mapDockerError as ar, markSetupComplete as as, parseComposeStderr as at, parseEnvFile as au, patchSecretsEnvFile as av, performSetup as aw, performUpgrade as ax, pruneBackupDirs as ay, readAutomationLogs as az, annotateAddonProfileAvailability as b, unlockInstallLock as b0, useExistingProviderForAssistantCli as b1, validateProposedState as b2, writeFileAtomic as b3, writeRuntimeFiles as b4, writeSecretFile as b5, writeStackSecretEnv as b6, writeTaskFile as b7, writeUserEnvKey as b8, writeVoiceVars as b9, applyInstall as c, applyTagChange as d, applyUninstall as e, applyUpdate as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, backupSetupInputs as j, buildAkmEndpoint as k, buildAkmEnv as l, buildComposeOptions as m, buildManagedServices as n, checkDocker as o, checkDockerCompose as p, classifyLocalInstall as q, collectBindAddressWarnings as r, composeDown as s, composeLogs as t, composePreflight as u, composePs as v, composePull as w, composeRestart as x, composeStart as y, composeStats as z };
-//# sourceMappingURL=src-BGtbBgcg.js.map
+export { ensureOpenCodeSystemConfig as $, AKM_USER_ENV_REF as A, BackupSpaceError as B, CORE_SERVICES as C, DowngradeConfirmationRequired as D, composeStats as E, composeStop as F, composeUp as G, createLogger as H, INSTALL_LOCK_STALE_AFTER_MS as I, createOpenCodeClient as J, createState as K, deleteUserEnvKey as L, MigrationError as M, deriveLaunchStatus as N, deriveLocalStackState as O, PLATFORM_VERSION as P, detectGpu as Q, detectHostOpenCode as R, detectLocalProviders as S, detectRuntime as T, disableHostAkmSharing as U, dismissSecretStripNotice as V, enableHostAkmSharing as W, ensureAkmUserEnv as X, ensureHomeDirs as Y, ensureMigrated as Z, ensureOpenCodeConfig as _, addonProfileId as a, runDeploy as a$, ensureReleaseMigrated as a0, ensureSecrets as a1, executeAutomation as a2, fetchProviderModels as a3, formatForDisplay as a4, getAddonProfileAvailability as a5, getAddonProfileSelection as a6, getAddonProfiles as a7, getAddonServiceNames as a8, getAkmStats as a9, performSetup as aA, performUpgrade as aB, pruneBackupDirs as aC, readAutomationLogs as aD, readDeployJournal as aE, readSecret as aF, readSecretFile as aG, readSecretStripNotice as aH, readStackEnv as aI, readStackRuntimeEnv as aJ, readStackSecretEnv as aK, readTaskFile as aL, readUserEnvFile as aM, recommendSetup as aN, removeSecretFile as aO, removeTaskFile as aP, resolveComposeProjectName as aQ, resolveDataDir as aR, resolveDefaultMigrateTarget as aS, resolveDeployJournalPath as aT, resolveEffectivePlatformImageTag as aU, resolveLatestImageTag as aV, resolveLatestImageTagForCurrentMajor as aW, resolveLatestNpmVersion as aX, resolveRuntimeFiles as aY, resolveStackDir as aZ, runAssistantAkmCommand as a_, getDockerEvents as aa, getHostAkmSharingStatus as ab, getRegistryAddonConfig as ac, hostAkmStashPath as ad, importHostOpenCode as ae, initializeStateSecrets as af, inspectInstallLock as ag, isAllowedService as ah, isComparableSemver as ai, isDeployableUnit as aj, isHostAkmAvailable as ak, isPrerelease as al, isSetupComplete as am, listAssistantCliTools as an, listAvailableAddonIds as ao, listBackupDirs as ap, listDockerImageTags as aq, listEnabledAddonIds as ar, listNpmVersions as as, listSecretFiles as at, loadAutomations as au, mapDockerError as av, markSetupComplete as aw, parseComposeStderr as ax, parseEnvFile as ay, patchSecretsEnvFile as az, annotateAddonProfileAvailability as b, seedUiBuild as b0, setAddonEnabled as b1, setAddonProfileSelection as b2, summarizeBackups as b3, summarizeComposeStderr as b4, unlockInstallLock as b5, useExistingProviderForAssistantCli as b6, validateProposedState as b7, writeFileAtomic as b8, writeRuntimeFiles as b9, writeSecretFile as ba, writeStackSecretEnv as bb, writeTaskFile as bc, writeUserEnvKey as bd, writeVoiceVars as be, applyInstall as c, applyTagChange as d, applyUninstall as e, applyUnitImageTagChange as f, applyUpdate as g, assertSafeSecretFilename as h, assertSafeTaskFilename as i, authJsonPath as j, backupSetupInputs as k, buildAkmEndpoint as l, buildAkmEnv as m, buildComposeOptions as n, buildManagedServices as o, checkDocker as p, checkDockerCompose as q, classifyLocalInstall as r, collectBindAddressWarnings as s, composeDown as t, composeLogs as u, composePreflight as v, composePs as w, composePull as x, composeRestart as y, composeStart as z };
+//# sourceMappingURL=src-CidJbygh.js.map