@openpalm/ui 0.12.14-rc.9 → 0.12.16

package/build/server/chunks/{session-cookie-DBdBkZQ5.js → session-cookie-Bv0xhSHu.js}

@@ -1,4 +1,4 @@
-import { S as SESSION_TTL_SECONDS } from './helpers-DxZaxWsz.js';
+import { S as SESSION_TTL_SECONDS } from './helpers-DJjIZ4h3.js';
 
 //#region src/lib/server/session-cookie.ts
 /**
@@ -71,4 +71,4 @@ function clearSessionCookieHeader(request) {
 }
 
 export { SESSION_COOKIE_NAME as S, clearSessionCookieHeader as c, sessionCookieHeader as s };
-//# sourceMappingURL=session-cookie-DBdBkZQ5.js.map
+//# sourceMappingURL=session-cookie-Bv0xhSHu.js.map

package/build/server/chunks/{session-cookie-DBdBkZQ5.js.map → session-cookie-Bv0xhSHu.js.map}

@@ -1 +1 @@
-{"version":3,"file":"session-cookie-DBdBkZQ5.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}
+{"version":3,"file":"session-cookie-Bv0xhSHu.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}

package/build/server/chunks/{setup-deploy-DgxkIffN.js → setup-deploy-hrgPodBR.js}

@@ -1,4 +1,4 @@
-import { k as backupSetupInputs, a$ as runDeploy, aT as resolveDeployJournalPath, am as isSetupComplete, aZ as resolveStackDir, aE as readDeployJournal, aw as markSetupComplete } from './src-iloTNAHz.js';
+import { k as backupSetupInputs, a$ as runDeploy, aT as resolveDeployJournalPath, am as isSetupComplete, aZ as resolveStackDir, aE as readDeployJournal, aw as markSetupComplete } from './src-CqA6lZdE.js';
 
 //#region src/lib/server/setup-deploy.ts
 var _state = {
@@ -72,4 +72,4 @@ function prepareSetupRestorePoint(state) {
 }
 
 export { getDeployState as g, prepareSetupRestorePoint as p, resetDeployState as r, startDeploy as s };
-//# sourceMappingURL=setup-deploy-DgxkIffN.js.map
+//# sourceMappingURL=setup-deploy-hrgPodBR.js.map

package/build/server/chunks/{setup-deploy-DgxkIffN.js.map → setup-deploy-hrgPodBR.js.map}

@@ -1 +1 @@
-{"version":3,"file":"setup-deploy-DgxkIffN.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { F as runDeploy, M as markSetupComplete, N as readDeployJournal, P as resolveDeployJournalPath, j as backupSetupInputs, on as resolveStackDir, yt as isSetupComplete } from \"./src.js\";\n//#region src/lib/server/setup-deploy.ts\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\timageWarning: null,\n\tphase: \"writing-config\"\n};\nvar _deployPromise = null;\nfunction deployStateFromJournal(state) {\n\tconst journal = readDeployJournal(resolveDeployJournalPath(state));\n\treturn {\n\t\tdeploying: journal.deploying,\n\t\tinterrupted: journal.interrupted,\n\t\tsetupComplete: journal.setupComplete || isSetupComplete(resolveStackDir()),\n\t\tdeployStatus: journal.deployStatus,\n\t\tdeployError: journal.deployError,\n\t\timageWarning: journal.imageWarning,\n\t\tphase: journal.phase\n\t};\n}\nfunction getDeployState(state) {\n\tif (state) _state = deployStateFromJournal(state);\n\telse if (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveStackDir())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: _state.deployStatus.map((entry) => ({ ...entry }))\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\timageWarning: null,\n\t\tphase: \"writing-config\"\n\t};\n}\nfunction startDeploy(state) {\n\tif (_deployPromise) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\treturn;\n\t}\n\t_deployPromise = (async () => {\n\t\tawait runDeploy(state, {\n\t\t\tjournalPath: resolveDeployJournalPath(state),\n\t\t\tonUpdate(progress) {\n\t\t\t\t_state = {\n\t\t\t\t\tdeploying: progress.deploying,\n\t\t\t\t\tinterrupted: progress.interrupted,\n\t\t\t\t\tsetupComplete: progress.setupComplete,\n\t\t\t\t\tdeployStatus: progress.deployStatus,\n\t\t\t\t\tdeployError: progress.deployError,\n\t\t\t\t\timageWarning: progress.imageWarning,\n\t\t\t\t\tphase: progress.phase\n\t\t\t\t};\n\t\t\t},\n\t\t\tmarkSetupComplete() {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t}\n\t\t});\n\t})().finally(() => {\n\t\t_deployPromise = null;\n\t});\n}\nfunction prepareSetupRestorePoint(state) {\n\treturn backupSetupInputs(state);\n}\n//#endregion\nexport { startDeploy as i, prepareSetupRestorePoint as n, resetDeployState as r, getDeployState as t };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,YAAY,EAAE,IAAI;AACnB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,IAAI,cAAc,GAAG,IAAI;AACzB,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;AAC9B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;AAC5E,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,KAAK,EAAE,OAAO,CAAC;AACjB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,IAAI,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAClD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AACvH,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AACjE,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,YAAY,EAAE,IAAI;AACpB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,cAAc,EAAE;AACrB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE;AACF,CAAC;AACD,CAAC,cAAc,GAAG,CAAC,YAAY;AAC/B,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;AACzB,GAAG,WAAW,EAAE,wBAAwB,CAAC,KAAK,CAAC;AAC/C,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,MAAM,GAAG;AACb,KAAK,SAAS,EAAE,QAAQ,CAAC,SAAS;AAClC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,aAAa,EAAE,QAAQ,CAAC,aAAa;AAC1C,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,KAAK,EAAE,QAAQ,CAAC;AACrB,KAAK;AACL,GAAG,CAAC;AACJ,GAAG,iBAAiB,GAAG;AACvB,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;AACpB,EAAE,cAAc,GAAG,IAAI;AACvB,CAAC,CAAC,CAAC;AACH;AACA,SAAS,wBAAwB,CAAC,KAAK,EAAE;AACzC,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC;AAChC;;;;"}
+{"version":3,"file":"setup-deploy-hrgPodBR.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { F as runDeploy, M as markSetupComplete, N as readDeployJournal, P as resolveDeployJournalPath, j as backupSetupInputs, on as resolveStackDir, yt as isSetupComplete } from \"./src.js\";\n//#region src/lib/server/setup-deploy.ts\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\timageWarning: null,\n\tphase: \"writing-config\"\n};\nvar _deployPromise = null;\nfunction deployStateFromJournal(state) {\n\tconst journal = readDeployJournal(resolveDeployJournalPath(state));\n\treturn {\n\t\tdeploying: journal.deploying,\n\t\tinterrupted: journal.interrupted,\n\t\tsetupComplete: journal.setupComplete || isSetupComplete(resolveStackDir()),\n\t\tdeployStatus: journal.deployStatus,\n\t\tdeployError: journal.deployError,\n\t\timageWarning: journal.imageWarning,\n\t\tphase: journal.phase\n\t};\n}\nfunction getDeployState(state) {\n\tif (state) _state = deployStateFromJournal(state);\n\telse if (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveStackDir())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: _state.deployStatus.map((entry) => ({ ...entry }))\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\timageWarning: null,\n\t\tphase: \"writing-config\"\n\t};\n}\nfunction startDeploy(state) {\n\tif (_deployPromise) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\treturn;\n\t}\n\t_deployPromise = (async () => {\n\t\tawait runDeploy(state, {\n\t\t\tjournalPath: resolveDeployJournalPath(state),\n\t\t\tonUpdate(progress) {\n\t\t\t\t_state = {\n\t\t\t\t\tdeploying: progress.deploying,\n\t\t\t\t\tinterrupted: progress.interrupted,\n\t\t\t\t\tsetupComplete: progress.setupComplete,\n\t\t\t\t\tdeployStatus: progress.deployStatus,\n\t\t\t\t\tdeployError: progress.deployError,\n\t\t\t\t\timageWarning: progress.imageWarning,\n\t\t\t\t\tphase: progress.phase\n\t\t\t\t};\n\t\t\t},\n\t\t\tmarkSetupComplete() {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t}\n\t\t});\n\t})().finally(() => {\n\t\t_deployPromise = null;\n\t});\n}\nfunction prepareSetupRestorePoint(state) {\n\treturn backupSetupInputs(state);\n}\n//#endregion\nexport { startDeploy as i, prepareSetupRestorePoint as n, resetDeployState as r, getDeployState as t };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,YAAY,EAAE,IAAI;AACnB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,IAAI,cAAc,GAAG,IAAI;AACzB,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;AAC9B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;AAC5E,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,KAAK,EAAE,OAAO,CAAC;AACjB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,IAAI,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAClD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AACvH,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AACjE,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,YAAY,EAAE,IAAI;AACpB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,cAAc,EAAE;AACrB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE;AACF,CAAC;AACD,CAAC,cAAc,GAAG,CAAC,YAAY;AAC/B,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;AACzB,GAAG,WAAW,EAAE,wBAAwB,CAAC,KAAK,CAAC;AAC/C,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,MAAM,GAAG;AACb,KAAK,SAAS,EAAE,QAAQ,CAAC,SAAS;AAClC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,aAAa,EAAE,QAAQ,CAAC,aAAa;AAC1C,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,KAAK,EAAE,QAAQ,CAAC;AACrB,KAAK;AACL,GAAG,CAAC;AACJ,GAAG,iBAAiB,GAAG;AACvB,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;AACpB,EAAE,cAAc,GAAG,IAAI;AACvB,CAAC,CAAC,CAAC;AACH;AACA,SAAS,wBAAwB,CAAC,KAAK,EAAE;AACzC,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC;AAChC;;;;"}

package/build/server/chunks/{src-iloTNAHz.js → src-CqA6lZdE.js}

@@ -1,7 +1,8 @@
 import { _ as __commonJSMin, b as __require } from './chunk-CLZ62Ad-.js';
 import { P as PROVIDER_DEFAULT_URLS, a as PROVIDER_KEY_MAP } from './provider-constants-DPrj3yBX.js';
 import { r as require_dist } from './dist-DOFcG0Zp.js';
-import Vt, { existsSync, readFileSync, copyFileSync, chmodSync, mkdirSync, lstatSync, rmSync, readdirSync, renameSync, writeFileSync, statfsSync, cpSync, openSync, constants, writeSync, closeSync, statSync, chownSync, realpathSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import Vt, { existsSync, readFileSync, copyFileSync, chmodSync, mkdirSync, lstatSync, rmSync, readdirSync, renameSync, writeFileSync, statfsSync, cpSync, openSync, constants, writeSync, closeSync, statSync, chownSync } from 'node:fs';
 import or, { join, basename, dirname, resolve, win32, posix } from 'node:path';
 import { Buffer as Buffer$1 } from 'buffer';
 import I from 'fs';
@@ -737,7 +738,7 @@ var import_main = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = DotenvModule;
 })))();
 var package_default = {
-	version: "0.12.14-rc.9"};
+	version: "0.12.16"};
 //#endregion
 //#region ../lib/src/control-plane/versioning.ts
 var SEMVER_RE = /^v?\d+\.\d+\.\d+(?:[-+].*)?$/;
@@ -1915,6 +1916,40 @@ function purgeStaleEnabledAddons(ctx) {
 	writeFile600(ctx, envPath, upsertEnvValue(content, "OP_ENABLED_ADDONS", cleaned.join(",")));
 	ctx.log(`set OP_ENABLED_ADDONS=${cleaned.join(",")}`);
 }
+/**
+* Patch portals.compose.yml in-place to add the OP_GUARDIAN_VERSION and
+* PLATFORM_VERSION env vars to the guardian service. The thin-host entrypoint
+* (v0.12.14+) needs these to resolve the correct npm package versions on boot.
+* Both values are derived from OP_GUARDIAN_IMAGE_TAG / OP_IMAGE_TAG — vars
+* already written to stack.env by the lifecycle. No-op when already present.
+*/
+function patchPortalsComposeForThinHost(ctx) {
+	const path = join(ctx.stackDir, "portals.compose.yml");
+	if (!existsSync(path)) return;
+	const content = readFileSync(path, "utf-8");
+	if (content.includes("OP_GUARDIAN_VERSION:")) return;
+	const ANCHOR = "      OP_ASSISTANT_URL: http://assistant:4096";
+	if (!content.includes(ANCHOR)) {
+		ctx.log("WARN: portals.compose.yml does not contain expected anchor line; skipping thin-host env patch — apply manually");
+		ctx.notes.push("portals.compose.yml could not be auto-patched for the guardian thin-host. Add OP_GUARDIAN_VERSION and PLATFORM_VERSION to the guardian service environment manually (see packages/skeleton/config/stack/portals.compose.yml for the reference values).");
+		return;
+	}
+	const INSERTION = [
+		"      # Thin-host entrypoint uses these to install @openpalm/guardian and",
+		"      # @openpalm/skeleton at the correct versions on first boot.",
+		"      # OP_GUARDIAN_IMAGE_TAG (e.g. v0.12.9) may differ from OP_IMAGE_TAG when",
+		"      # guardian is released independently of the platform.",
+		"      OP_GUARDIAN_VERSION: ${OP_GUARDIAN_IMAGE_TAG:-${OP_IMAGE_TAG:-}}",
+		"      PLATFORM_VERSION: ${OP_IMAGE_TAG:-}"
+	].join("\n");
+	const patched = content.replace(ANCHOR, `${ANCHOR}\n${INSERTION}`);
+	if (ctx.dryRun) {
+		ctx.log("[dry-run] would patch portals.compose.yml with OP_GUARDIAN_VERSION + PLATFORM_VERSION");
+		return;
+	}
+	writeFileSync(path, patched);
+	ctx.log("patched portals.compose.yml: added OP_GUARDIAN_VERSION and PLATFORM_VERSION to guardian service env");
+}
 var RELEASE_MIGRATIONS = [
 	{
 		version: "v0.11.5-rc.1",
@@ -1960,6 +1995,17 @@ var RELEASE_MIGRATIONS = [
 			const remaining = parseEnabledAddons(match[1]);
 			for (const id of remaining) if (!KNOWN_ADDON_IDS.has(id)) throw new Error(`post-migration check failed: stale addon ID '${id}' still in OP_ENABLED_ADDONS`);
 		}
+	},
+	{
+		version: "v0.12.14-rc.1",
+		describe: "patch portals.compose.yml — add OP_GUARDIAN_VERSION + PLATFORM_VERSION to guardian service env",
+		apply: patchPortalsComposeForThinHost,
+		verify(ctx) {
+			if (ctx.dryRun) return;
+			const path = join(ctx.stackDir, "portals.compose.yml");
+			if (!existsSync(path)) return;
+			if (!readFileSync(path, "utf-8").includes("OP_GUARDIAN_VERSION:")) throw new Error("post-migration check failed: OP_GUARDIAN_VERSION still missing from portals.compose.yml");
+		}
 	}
 ];
 var RECOVERY_GUIDANCE = "Your original files were left untouched and a full backup was taken first. If something went wrong, run `openpalm rollback` to restore your previous state, or restore the backup manually (see docs/operations/backup-restore.md). You can also run `openpalm migrate --dry-run` to preview the current copy-only migration. Full guide: docs/operations/upgrade-0.10-to-0.11.md";
@@ -5235,8 +5281,19 @@ function randomHex(bytes) {
 */
 var logger$11 = createLogger("core-assets");
 var GITHUB_ASSET_TIMEOUT_MS = 1e4;
+var _require$1 = createRequire(import.meta.url);
 function bundledAssetPath(relPath) {
-	return join(dirname(fileURLToPath(import.meta.url)), "../../../../.openpalm", relPath);
+	try {
+		return join(dirname(_require$1.resolve("@openpalm/skeleton/package.json")), relPath);
+	} catch {}
+	const repoRoot = process.env.OPENPALM_REPO_ROOT;
+	if (repoRoot) return join(repoRoot, "packages", "skeleton", relPath);
+	try {
+		const meta = fileURLToPath(import.meta.url);
+		const candidate = join(dirname(meta), "..", "..", "..", "..", "packages", "skeleton", relPath);
+		if (existsSync(join(dirname(meta), "..", "..", "..", "..", "packages", "skeleton", "package.json"))) return candidate;
+	} catch {}
+	throw new Error("@openpalm/skeleton not found. Set OPENPALM_REPO_ROOT or install @openpalm/skeleton.");
 }
 function readCoreCompose() {
 	const livePath = `${resolveOpenPalmHome()}/config/stack/core.compose.yml`;
@@ -5429,13 +5486,20 @@ async function refreshCoreAssets(version) {
 * These functions are consumed by both the CLI and the Electron shell — they
 * must use only Node.js-compatible APIs (no Bun.spawn, Bun.write, etc.).
 *
-* Source resolution order (UI build and .openpalm/ skeleton):
-*   1. OPENPALM_REPO_ROOT env var — explicit dev override
-*   2. Relative to import.meta.url — works for `bun run` / source installs
-*   3. Relative to process.execPath — works for compiled Bun binary in repo
-*   4. null → remote download (the UI build from the @openpalm/ui npm registry
-*      tarball; the .openpalm skeleton from the GitHub repo tarball)
-*/
+* Skeleton (packages/skeleton/) resolution order:
+*   1. OPENPALM_REPO_ROOT env var → packages/skeleton/ (dev override)
+*   2. OPENPALM_SKELETON_DIR env var → set by Electron from extraResources
+*   3. require.resolve('@openpalm/skeleton/package.json') → npm/CLI dep
+*   4. null → seedOpenPalmDir throws with an actionable error message
+*
+* UI build resolution order:
+*   1. OPENPALM_REPO_ROOT env var → packages/ui/build/ (dev override)
+*   2. Electron extraResources → ui-build/ alongside the asar
+*   3. Relative to import.meta.url — works for `bun run` / source installs
+*   4. Relative to process.execPath — works for compiled Bun binary in repo
+*   5. null → remote download (from the @openpalm/ui npm registry tarball)
+*/
+var _require = createRequire(import.meta.url);
 var logger$10 = createLogger("lib:ui-assets");
 async function fetchWithRetry(url, retries = 3) {
 	for (let i = 0; i < retries; i++) try {
@@ -5457,15 +5521,23 @@ function resolveLocalCandidate(...strategies) {
 	return null;
 }
 /**
-* Locate the repo's .openpalm/ skeleton directory.
+* Locate the skeleton directory (packages/skeleton/ or equivalent).
 * Used by seedOpenPalmDir to avoid a network download when running from source.
 */
 function resolveLocalOpenpalmDir() {
-	return resolveLocalCandidate(() => process.env.OPENPALM_REPO_ROOT ? join(process.env.OPENPALM_REPO_ROOT, ".openpalm") : null, () => process.env.OPENPALM_SKELETON_DIR ?? null, () => {
-		const meta = fileURLToPath(import.meta.url);
-		if (meta.startsWith("/$bunfs/")) return null;
-		return join(dirname(meta), "..", "..", "..", "..", ".openpalm");
-	}, () => join(dirname(realpathSync(process.execPath)), "..", "..", "..", ".openpalm"));
+	return resolveLocalCandidate(() => process.env.OPENPALM_REPO_ROOT ? join(process.env.OPENPALM_REPO_ROOT, "packages", "skeleton") : null, () => process.env.OPENPALM_SKELETON_DIR ?? null, () => {
+		try {
+			return dirname(_require.resolve("@openpalm/skeleton/package.json"));
+		} catch {
+			return null;
+		}
+	}, () => {
+		try {
+			return join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "..", "packages", "skeleton");
+		} catch {
+			return null;
+		}
+	}, () => null);
 }
 /**
 * The UI ships as `@openpalm/ui` on npm — a self-contained `adapter-node`
@@ -10821,4 +10893,4 @@ function collectBindAddressWarnings(env) {
 }
 
 export { ensureOpenCodeSystemConfig as $, AKM_USER_ENV_REF as A, BackupSpaceError as B, CORE_SERVICES as C, DowngradeConfirmationRequired as D, composeStats as E, composeStop as F, composeUp as G, createLogger as H, INSTALL_LOCK_STALE_AFTER_MS as I, createOpenCodeClient as J, createState as K, deleteUserEnvKey as L, MigrationError as M, deriveLaunchStatus as N, deriveLocalStackState as O, PLATFORM_VERSION as P, detectGpu as Q, detectHostOpenCode as R, detectLocalProviders as S, detectRuntime as T, disableHostAkmSharing as U, dismissSecretStripNotice as V, enableHostAkmSharing as W, ensureAkmUserEnv as X, ensureHomeDirs as Y, ensureMigrated as Z, ensureOpenCodeConfig as _, addonProfileId as a, runDeploy as a$, ensureReleaseMigrated as a0, ensureSecrets as a1, executeAutomation as a2, fetchProviderModels as a3, formatForDisplay as a4, getAddonProfileAvailability as a5, getAddonProfileSelection as a6, getAddonProfiles as a7, getAddonServiceNames as a8, getAkmStats as a9, performSetup as aA, performUpgrade as aB, pruneBackupDirs as aC, readAutomationLogs as aD, readDeployJournal as aE, readSecret as aF, readSecretFile as aG, readSecretStripNotice as aH, readStackEnv as aI, readStackRuntimeEnv as aJ, readStackSecretEnv as aK, readTaskFile as aL, readUserEnvFile as aM, recommendSetup as aN, removeSecretFile as aO, removeTaskFile as aP, resolveComposeProjectName as aQ, resolveDataDir as aR, resolveDefaultMigrateTarget as aS, resolveDeployJournalPath as aT, resolveEffectivePlatformImageTag as aU, resolveLatestImageTag as aV, resolveLatestImageTagForCurrentMajor as aW, resolveLatestNpmVersion as aX, resolveRuntimeFiles as aY, resolveStackDir as aZ, runAssistantAkmCommand as a_, getDockerEvents as aa, getHostAkmSharingStatus as ab, getRegistryAddonConfig as ac, hostAkmStashPath as ad, importHostOpenCode as ae, initializeStateSecrets as af, inspectInstallLock as ag, isAllowedService as ah, isComparableSemver as ai, isDeployableUnit as aj, isHostAkmAvailable as ak, isPrerelease as al, isSetupComplete as am, listAssistantCliTools as an, listAvailableAddonIds as ao, listBackupDirs as ap, listDockerImageTags as aq, listEnabledAddonIds as ar, listNpmVersions as as, listSecretFiles as at, loadAutomations as au, mapDockerError as av, markSetupComplete as aw, parseComposeStderr as ax, parseEnvFile as ay, patchSecretsEnvFile as az, annotateAddonProfileAvailability as b, seedUiBuild as b0, setAddonEnabled as b1, setAddonProfileSelection as b2, summarizeBackups as b3, summarizeComposeStderr as b4, unlockInstallLock as b5, useExistingProviderForAssistantCli as b6, validateProposedState as b7, writeFileAtomic as b8, writeRuntimeFiles as b9, writeSecretFile as ba, writeStackSecretEnv as bb, writeTaskFile as bc, writeUserEnvKey as bd, writeVoiceVars as be, applyInstall as c, applyTagChange as d, applyUninstall as e, applyUnitImageTagChange as f, applyUpdate as g, assertSafeSecretFilename as h, assertSafeTaskFilename as i, authJsonPath as j, backupSetupInputs as k, buildAkmEndpoint as l, buildAkmEnv as m, buildComposeOptions as n, buildManagedServices as o, checkDocker as p, checkDockerCompose as q, classifyLocalInstall as r, collectBindAddressWarnings as s, composeDown as t, composeLogs as u, composePreflight as v, composePs as w, composePull as x, composeRestart as y, composeStart as z };
-//# sourceMappingURL=src-iloTNAHz.js.map
+//# sourceMappingURL=src-CqA6lZdE.js.map