@openpalm/ui 0.12.34 → 0.12.35

package/build/server/chunks/{session-cookie-CAsGSkTV.js → session-cookie-Cn2O_Cv6.js}

@@ -1,4 +1,4 @@
-import { S as SESSION_TTL_SECONDS } from './helpers-CbGxMTVo.js';
+import { S as SESSION_TTL_SECONDS } from './helpers-BluGgY3g.js';
 
 //#region src/lib/server/session-cookie.ts
 /**
@@ -71,4 +71,4 @@ function clearSessionCookieHeader(request) {
 }
 
 export { SESSION_COOKIE_NAME as S, clearSessionCookieHeader as c, sessionCookieHeader as s };
-//# sourceMappingURL=session-cookie-CAsGSkTV.js.map
+//# sourceMappingURL=session-cookie-Cn2O_Cv6.js.map

package/build/server/chunks/{session-cookie-CAsGSkTV.js.map → session-cookie-Cn2O_Cv6.js.map}

@@ -1 +1 @@
-{"version":3,"file":"session-cookie-CAsGSkTV.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}
+{"version":3,"file":"session-cookie-Cn2O_Cv6.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}

package/build/server/chunks/{setup-deploy-BfBaLbir.js → setup-deploy-B9QxcV6K.js}

@@ -1,4 +1,4 @@
-import { i as backupSetupInputs, aS as runDeploy, aO as resolveDeployJournalPath, ai as isSetupComplete, aQ as resolveStackDir, az as readDeployJournal, aq as markSetupComplete } from './src-BunIUeZg.js';
+import { i as backupSetupInputs, aS as runDeploy, aO as resolveDeployJournalPath, ai as isSetupComplete, aQ as resolveStackDir, az as readDeployJournal, aq as markSetupComplete } from './src-Bms-Wpj4.js';
 
 //#region src/lib/server/setup-deploy.ts
 var _state = {
@@ -72,4 +72,4 @@ function prepareSetupRestorePoint(state) {
 }
 
 export { getDeployState as g, prepareSetupRestorePoint as p, resetDeployState as r, startDeploy as s };
-//# sourceMappingURL=setup-deploy-BfBaLbir.js.map
+//# sourceMappingURL=setup-deploy-B9QxcV6K.js.map

package/build/server/chunks/{setup-deploy-BfBaLbir.js.map → setup-deploy-B9QxcV6K.js.map}

@@ -1 +1 @@
-{"version":3,"file":"setup-deploy-BfBaLbir.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { A as readDeployJournal, M as runDeploy, O as backupSetupInputs, en as resolveStackDir, j as resolveDeployJournalPath, k as markSetupComplete, lt as isSetupComplete } from \"./src.js\";\n//#region src/lib/server/setup-deploy.ts\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\timageWarning: null,\n\tphase: \"writing-config\"\n};\nvar _deployPromise = null;\nfunction deployStateFromJournal(state) {\n\tconst journal = readDeployJournal(resolveDeployJournalPath(state));\n\treturn {\n\t\tdeploying: journal.deploying,\n\t\tinterrupted: journal.interrupted,\n\t\tsetupComplete: journal.setupComplete || isSetupComplete(resolveStackDir()),\n\t\tdeployStatus: journal.deployStatus,\n\t\tdeployError: journal.deployError,\n\t\timageWarning: journal.imageWarning,\n\t\tphase: journal.phase\n\t};\n}\nfunction getDeployState(state) {\n\tif (state) _state = deployStateFromJournal(state);\n\telse if (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveStackDir())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: _state.deployStatus.map((entry) => ({ ...entry }))\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\timageWarning: null,\n\t\tphase: \"writing-config\"\n\t};\n}\nfunction startDeploy(state) {\n\tif (_deployPromise) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\treturn;\n\t}\n\t_deployPromise = (async () => {\n\t\tawait runDeploy(state, {\n\t\t\tjournalPath: resolveDeployJournalPath(state),\n\t\t\tonUpdate(progress) {\n\t\t\t\t_state = {\n\t\t\t\t\tdeploying: progress.deploying,\n\t\t\t\t\tinterrupted: progress.interrupted,\n\t\t\t\t\tsetupComplete: progress.setupComplete,\n\t\t\t\t\tdeployStatus: progress.deployStatus,\n\t\t\t\t\tdeployError: progress.deployError,\n\t\t\t\t\timageWarning: progress.imageWarning,\n\t\t\t\t\tphase: progress.phase\n\t\t\t\t};\n\t\t\t},\n\t\t\tmarkSetupComplete() {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t}\n\t\t});\n\t})().finally(() => {\n\t\t_deployPromise = null;\n\t});\n}\nfunction prepareSetupRestorePoint(state) {\n\treturn backupSetupInputs(state);\n}\n//#endregion\nexport { startDeploy as i, prepareSetupRestorePoint as n, resetDeployState as r, getDeployState as t };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,YAAY,EAAE,IAAI;AACnB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,IAAI,cAAc,GAAG,IAAI;AACzB,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;AAC9B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;AAC5E,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,KAAK,EAAE,OAAO,CAAC;AACjB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,IAAI,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAClD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AACvH,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AACjE,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,YAAY,EAAE,IAAI;AACpB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,cAAc,EAAE;AACrB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE;AACF,CAAC;AACD,CAAC,cAAc,GAAG,CAAC,YAAY;AAC/B,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;AACzB,GAAG,WAAW,EAAE,wBAAwB,CAAC,KAAK,CAAC;AAC/C,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,MAAM,GAAG;AACb,KAAK,SAAS,EAAE,QAAQ,CAAC,SAAS;AAClC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,aAAa,EAAE,QAAQ,CAAC,aAAa;AAC1C,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,KAAK,EAAE,QAAQ,CAAC;AACrB,KAAK;AACL,GAAG,CAAC;AACJ,GAAG,iBAAiB,GAAG;AACvB,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;AACpB,EAAE,cAAc,GAAG,IAAI;AACvB,CAAC,CAAC,CAAC;AACH;AACA,SAAS,wBAAwB,CAAC,KAAK,EAAE;AACzC,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC;AAChC;;;;"}
+{"version":3,"file":"setup-deploy-B9QxcV6K.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { A as readDeployJournal, M as runDeploy, O as backupSetupInputs, en as resolveStackDir, j as resolveDeployJournalPath, k as markSetupComplete, lt as isSetupComplete } from \"./src.js\";\n//#region src/lib/server/setup-deploy.ts\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\timageWarning: null,\n\tphase: \"writing-config\"\n};\nvar _deployPromise = null;\nfunction deployStateFromJournal(state) {\n\tconst journal = readDeployJournal(resolveDeployJournalPath(state));\n\treturn {\n\t\tdeploying: journal.deploying,\n\t\tinterrupted: journal.interrupted,\n\t\tsetupComplete: journal.setupComplete || isSetupComplete(resolveStackDir()),\n\t\tdeployStatus: journal.deployStatus,\n\t\tdeployError: journal.deployError,\n\t\timageWarning: journal.imageWarning,\n\t\tphase: journal.phase\n\t};\n}\nfunction getDeployState(state) {\n\tif (state) _state = deployStateFromJournal(state);\n\telse if (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveStackDir())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: _state.deployStatus.map((entry) => ({ ...entry }))\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\timageWarning: null,\n\t\tphase: \"writing-config\"\n\t};\n}\nfunction startDeploy(state) {\n\tif (_deployPromise) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\treturn;\n\t}\n\t_deployPromise = (async () => {\n\t\tawait runDeploy(state, {\n\t\t\tjournalPath: resolveDeployJournalPath(state),\n\t\t\tonUpdate(progress) {\n\t\t\t\t_state = {\n\t\t\t\t\tdeploying: progress.deploying,\n\t\t\t\t\tinterrupted: progress.interrupted,\n\t\t\t\t\tsetupComplete: progress.setupComplete,\n\t\t\t\t\tdeployStatus: progress.deployStatus,\n\t\t\t\t\tdeployError: progress.deployError,\n\t\t\t\t\timageWarning: progress.imageWarning,\n\t\t\t\t\tphase: progress.phase\n\t\t\t\t};\n\t\t\t},\n\t\t\tmarkSetupComplete() {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t}\n\t\t});\n\t})().finally(() => {\n\t\t_deployPromise = null;\n\t});\n}\nfunction prepareSetupRestorePoint(state) {\n\treturn backupSetupInputs(state);\n}\n//#endregion\nexport { startDeploy as i, prepareSetupRestorePoint as n, resetDeployState as r, getDeployState as t };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,YAAY,EAAE,IAAI;AACnB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,IAAI,cAAc,GAAG,IAAI;AACzB,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;AAC9B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;AAC5E,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,KAAK,EAAE,OAAO,CAAC;AACjB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,IAAI,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAClD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AACvH,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AACjE,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,YAAY,EAAE,IAAI;AACpB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,cAAc,EAAE;AACrB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE;AACF,CAAC;AACD,CAAC,cAAc,GAAG,CAAC,YAAY;AAC/B,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;AACzB,GAAG,WAAW,EAAE,wBAAwB,CAAC,KAAK,CAAC;AAC/C,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,MAAM,GAAG;AACb,KAAK,SAAS,EAAE,QAAQ,CAAC,SAAS;AAClC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,aAAa,EAAE,QAAQ,CAAC,aAAa;AAC1C,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,KAAK,EAAE,QAAQ,CAAC;AACrB,KAAK;AACL,GAAG,CAAC;AACJ,GAAG,iBAAiB,GAAG;AACvB,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;AACpB,EAAE,cAAc,GAAG,IAAI;AACvB,CAAC,CAAC,CAAC;AACH;AACA,SAAS,wBAAwB,CAAC,KAAK,EAAE;AACzC,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC;AAChC;;;;"}

package/build/server/chunks/{src-BunIUeZg.js → src-Bms-Wpj4.js}

@@ -3,7 +3,7 @@ import { P as PROVIDER_DEFAULT_URLS, a as PROVIDER_KEY_MAP } from './provider-co
 import { r as require_dist } from './dist-DOFcG0Zp.js';
 import { createRequire } from 'node:module';
 import Vt, { existsSync, readFileSync, copyFileSync, chmodSync, mkdirSync, lstatSync, rmSync, readdirSync, renameSync, writeFileSync, statfsSync, cpSync, openSync, constants, writeSync, closeSync, statSync, chownSync } from 'node:fs';
-import or, { join, basename, dirname, resolve, win32, posix } from 'node:path';
+import or, { join, basename, dirname, resolve, win32, posix, relative } from 'node:path';
 import { Buffer as Buffer$1 } from 'buffer';
 import I from 'fs';
 import Xs, { parse, dirname as dirname$1 } from 'path';
@@ -362,6 +362,13 @@ function acquireInstallLock(dataDir) {
 		});
 		return null;
 	}
+	try {
+		const { pid } = parseLockContent(readFileSync(path, "utf-8"));
+		if (pid === process.pid) return {
+			path,
+			reentrant: true
+		};
+	} catch {}
 	if (!isStale(path)) return null;
 	logger$13.info("removing stale install lock and retrying acquire", { path });
 	try {
@@ -459,6 +466,7 @@ function unlockInstallLock(dataDir) {
 }
 function releaseInstallLock(handle) {
 	if (!handle) return;
+	if (handle.reentrant) return;
 	try {
 		rmSync(handle.path, { force: true });
 	} catch (err) {
@@ -738,7 +746,7 @@ var import_main = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = DotenvModule;
 })))();
 var package_default = {
-	version: "0.12.34"};
+	version: "0.12.35"};
 //#endregion
 //#region ../lib/src/control-plane/versioning.ts
 var SEMVER_RE = /^v?\d+\.\d+\.\d+(?:[-+].*)?$/;
@@ -5260,7 +5268,6 @@ function randomHex(bytes) {
 * historical `.env.schema` files (varlock format) were retired in #391.
 */
 var logger$12 = createLogger("core-assets");
-var GITHUB_ASSET_TIMEOUT_MS = 1e4;
 var _require$1 = createRequire(import.meta.url);
 function bundledAssetPath(relPath) {
 	try {
@@ -5296,10 +5303,7 @@ function ensureOpenCodeSystemConfig() {
 }
 var SHIPPED_DEFAULT_HASHES = { "config/guardian/instructions/moderation.md": ["dfa770d433bef9954e58e29cfb337679eb27ed3c9de61ddd2c4106d3add9a628"] };
 /** Assets under config/guardian/ that are managed (refreshable) but respect user edits. */
-var GUARDIAN_MANAGED_ASSETS = [{
-	relPath: "config/guardian/instructions/moderation.md",
-	githubFilename: ".openpalm/config/guardian/instructions/moderation.md"
-}];
+var GUARDIAN_MANAGED_ASSETS = [{ relPath: "config/guardian/instructions/moderation.md" }];
 /**
 * Returns true when the on-disk content is still byte-identical to one of the
 * previously shipped defaults for the given relPath (i.e. the user has not
@@ -5311,41 +5315,12 @@ function isUnmodifiedDefault(relPath, currentContent) {
 	const h = sha256(currentContent);
 	return known.includes(h);
 }
-var REPO = "itlackey/openpalm";
-function normalizeAssetRef(version) {
-	const v = version.trim();
-	if (!v) throw new Error("Cannot download OpenPalm stack assets: no version provided. The caller must pass the target release tag (e.g. \"v0.11.0-rc.6\").");
-	return /^\d/.test(v) ? `v${v}` : v;
-}
 var MANAGED_ASSETS = [
-	{
-		relPath: "config/stack/core.compose.yml",
-		githubFilename: ".openpalm/config/stack/core.compose.yml"
-	},
-	{
-		relPath: "config/stack/services.compose.yml",
-		githubFilename: ".openpalm/config/stack/services.compose.yml"
-	},
-	{
-		relPath: "config/stack/portals.compose.yml",
-		githubFilename: ".openpalm/config/stack/portals.compose.yml"
-	}
+	{ relPath: "config/stack/core.compose.yml" },
+	{ relPath: "config/stack/services.compose.yml" },
+	{ relPath: "config/stack/portals.compose.yml" }
 ];
-var SEEDED_ASSETS = [{
-	relPath: "config/assistant/opencode.jsonc",
-	githubFilename: ".openpalm/config/assistant/opencode.jsonc"
-}, {
-	relPath: "config/stack/custom.compose.yml",
-	githubFilename: ".openpalm/config/stack/custom.compose.yml"
-}];
-async function downloadAsset(filename, version) {
-	const rawUrl = `https://raw.githubusercontent.com/${REPO}/${version}/${filename}`;
-	try {
-		const res = await fetch(rawUrl, { signal: AbortSignal.timeout(GITHUB_ASSET_TIMEOUT_MS) });
-		if (res.ok) return await res.text();
-	} catch {}
-	throw new Error(`Failed to download ${filename} from GitHub (ref "${version}" not found or network error)`);
-}
+var SEEDED_ASSETS = [{ relPath: "config/assistant/opencode.jsonc" }, { relPath: "config/stack/custom.compose.yml" }];
 function ensureBackupDir(backupDir, suffix = "") {
 	if (backupDir) return backupDir;
 	return join(resolveBackupsDir(), `${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}${suffix}`);
@@ -5408,56 +5383,6 @@ function refreshCoreAssetsFromSource(sourceRoot, homeDir = resolveOpenPalmHome()
 		kept
 	};
 }
-async function refreshCoreAssets(version) {
-	const ref = normalizeAssetRef(version);
-	const homeDir = resolveOpenPalmHome();
-	const updated = [];
-	const kept = [];
-	let backupDir = null;
-	for (const asset of MANAGED_ASSETS) {
-		const freshContent = await downloadAsset(asset.githubFilename, ref);
-		const targetPath = join(homeDir, asset.relPath);
-		if (existsSync(targetPath)) {
-			if (sha256(readFileSync(targetPath, "utf-8")) === sha256(freshContent)) continue;
-			backupDir = backupExistingFile(targetPath, asset.relPath, backupDir);
-		}
-		mkdirSync(dirname(targetPath), { recursive: true });
-		writeFileSync(targetPath, freshContent);
-		updated.push(asset.relPath);
-	}
-	for (const asset of GUARDIAN_MANAGED_ASSETS) {
-		const freshContent = await downloadAsset(asset.githubFilename, ref);
-		const targetPath = join(homeDir, asset.relPath);
-		if (existsSync(targetPath)) {
-			const currentContent = readFileSync(targetPath, "utf-8");
-			if (sha256(currentContent) === sha256(freshContent)) continue;
-			if (!isUnmodifiedDefault(asset.relPath, currentContent)) {
-				logger$12.info("guardian managed asset kept (user-modified); new default available", {
-					path: asset.relPath,
-					hint: "Remove the file or restore the shipped default to pick up the new version on the next refresh."
-				});
-				kept.push(asset.relPath);
-				continue;
-			}
-		}
-		mkdirSync(dirname(targetPath), { recursive: true });
-		writeFileSync(targetPath, freshContent);
-		updated.push(asset.relPath);
-	}
-	for (const asset of SEEDED_ASSETS) {
-		const targetPath = join(homeDir, asset.relPath);
-		if (existsSync(targetPath)) continue;
-		const freshContent = await downloadAsset(asset.githubFilename, ref);
-		mkdirSync(dirname(targetPath), { recursive: true });
-		writeFileSync(targetPath, freshContent);
-		updated.push(asset.relPath);
-	}
-	return {
-		backupDir,
-		updated,
-		kept
-	};
-}
 //#endregion
 //#region ../lib/src/control-plane/ui-assets.ts
 /**
@@ -5492,6 +5417,21 @@ async function fetchWithRetry(url, retries = 3) {
 	}
 	throw new Error(`Failed to fetch ${url} after ${retries} attempts`);
 }
+function copyTree(src, dest, opts) {
+	if (!existsSync(src)) return;
+	const entries = readdirSync(src, {
+		recursive: true,
+		withFileTypes: true
+	});
+	for (const entry of entries) {
+		if (!entry.isFile()) continue;
+		const srcFile = join(entry.parentPath ?? entry.path, entry.name);
+		const destFile = join(dest, relative(src, srcFile));
+		if (existsSync(destFile)) continue;
+		mkdirSync(dirname(destFile), { recursive: true });
+		copyFileSync(srcFile, destFile);
+	}
+}
 /** Resolve a candidate path using three strategies, returning the first that exists. */
 function resolveLocalCandidate(...strategies) {
 	for (const strategy of strategies) try {
@@ -5520,6 +5460,60 @@ function resolveLocalOpenpalmDir() {
 	}, () => null);
 }
 /**
+* Seed OP_HOME from the .openpalm/ skeleton.
+*
+* Existing files are never overwritten (user edits win).
+* Falls back to downloading the repo tarball from GitHub when no local
+* skeleton is found (production binary, packaged Electron app).
+*/
+/** Version stamp recording which skeleton version OP_HOME was last seeded from. */
+var SKELETON_VERSION_STAMP = ".skeleton-version";
+/**
+* Seed the bundled `.openpalm/` skeleton into OP_HOME — ONCE PER VERSION.
+*
+* Electron calls this on every launch; without a guard it re-copied the entire
+* skeleton tree each time (wasteful, and it re-materialized files a user/process
+* had deliberately removed). We stamp OP_HOME/.skeleton-version with `repoRef`
+* after a successful seed and skip the copy when it already matches — so a given
+* version seeds once and an upgrade re-seeds (skipExisting still preserves any
+* user edits). To force a re-seed, delete the stamp.
+*/
+async function seedOpenPalmDir(repoRef, homeDir, _configDir, _dataDir) {
+	const stampPath = join(homeDir, SKELETON_VERSION_STAMP);
+	let alreadySeeded = false;
+	if (existsSync(stampPath)) try {
+		alreadySeeded = readFileSync(stampPath, "utf-8").trim() === repoRef.trim();
+	} catch {}
+	const stamp = () => {
+		try {
+			writeFileSync(stampPath, `${repoRef}\n`);
+		} catch {}
+	};
+	const local = resolveLocalOpenpalmDir();
+	if (local) {
+		const { updated, backupDir } = refreshCoreAssetsFromSource(local, homeDir);
+		if (updated.length) logger$11.debug("refreshed managed stack assets", { refreshed: updated });
+		if (alreadySeeded) {
+			logger$11.debug("skeleton already seeded for this version — managed assets refreshed, skipping full seed", { repoRef });
+			return {
+				updated,
+				backupDir
+			};
+		}
+		logger$11.debug("seeding .openpalm from local source", {
+			src: local,
+			repoRef
+		});
+		copyTree(local, homeDir);
+		stamp();
+		return {
+			updated,
+			backupDir
+		};
+	}
+	throw new Error("Cannot locate @openpalm/skeleton. Set OPENPALM_REPO_ROOT (dev) or install @openpalm/skeleton: npm install @openpalm/skeleton@" + (process.env.OP_SKELETON_VERSION ?? process.env.PLATFORM_VERSION ?? "<version>"));
+}
+/**
 * The UI ships as `@openpalm/ui` on npm — a self-contained `adapter-node`
 * bundle (only `build/` is published; no `node_modules` is needed at runtime,
 * because the build bundles every dependency). The desktop and host updaters
@@ -7717,11 +7711,42 @@ async function reconcileCore(state, opts) {
 			throw new Error(`Compose preflight failed: ${preflight.stderr}\nFiles: ${files.join(", ")}\nEnv files: ${envFiles.filter(existsSync).join(", ")}\nProfiles: ${profiles.join(", ") || "(none)"}\nProject: ${projectName}`);
 		}
 	}
-	if (!opts.skipSnapshot && !hasArmedSnapshot()) snapshotCurrentState(state);
 	state.artifacts = resolveRuntimeFiles();
 	writeRuntimeFiles(state);
 	return active;
 }
+/**
+* Idempotent OP_HOME asset reconciliation to the running platform version.
+*
+* This is the single place that brings an OP_HOME's *assets* (layout, skeleton
+* data/, managed compose, release transforms) up to PLATFORM_VERSION. It is
+* keyed entirely on PLATFORM_VERSION (the running control plane), NOT on the
+* per-image OP_*_VERSION pins in stack.env — those stay independent and drive
+* compose image resolution only.
+*
+* Every step is a cheap no-op when already current:
+*   • ensureMigrated        — forward-only layout migrations (skip-if-done)
+*   • seedOpenPalmDir       — skeleton data/ seed (stamp-gated, skip-existing) +
+*                             managed compose refresh from BUNDLED local source
+*   • ensureReleaseMigrated — forward-only release transforms (copy-only, idempotent)
+*
+* Returns the assets it actually changed (the refreshed managed compose/config
+* files) and the backup directory a release migration created (if any), so
+* performUpgrade can surface them in UpgradeResult — the upgrade route logs the
+* asset list and shows the backup dir to the operator.
+*/
+async function reconcileHome(state) {
+	ensureMigrated({ homeDir: state.homeDir });
+	const seed = await seedOpenPalmDir(PLATFORM_VERSION, state.homeDir, state.configDir, state.dataDir);
+	const release = ensureReleaseMigrated({
+		homeDir: state.homeDir,
+		targetVersion: PLATFORM_VERSION
+	});
+	return {
+		assetsUpdated: seed.updated,
+		backupDir: release.backupDir ?? seed.backupDir
+	};
+}
 function resolveLifecycleLock(state, opts) {
 	if (opts && "lock" in opts) return opts.lock ?? null;
 	return acquireInstallLock(state.dataDir);
@@ -7730,11 +7755,71 @@ function releaseLifecycleLock(lock, opts) {
 	if (opts && "lock" in opts) return;
 	releaseInstallLock(lock);
 }
+/**
+* The single idempotent stack reconcile. Every lifecycle entry point is a thin
+* flag variant of this:
+*   1. reconcileHome   — bring OP_HOME assets up to PLATFORM_VERSION (migrations,
+*                        bundled skeleton seed, release transforms). No GitHub.
+*   2. reconcileCore   — preflight, snapshot (rollback), write runtime files,
+*                        flip service state per activate/deactivate.
+*   3. composePull     — (compose+pull only) fetch images per OP_*_VERSION pins.
+*   4. composeUp       — (compose only) recreate the managed service set.
+*
+* The whole thing runs under withStackEnvRollback: stack.env + the portals/custom
+* compose files are snapshotted and restored if any step throws, and the
+* pre-reconcile state is armed for `openpalm rollback`. reconcileCore runs with
+* skipSnapshot:true so it never takes a second snapshot over that armed one.
+*
+* The `compose` flag is deliberately OFF for install/update/uninstall: those
+* consumers (runDeploy, the admin install/update/uninstall routes) already own a
+* bespoke compose phase — pulling images first, parsing per-service failures,
+* polling health, and emitting progress. Letting the wrapper composeUp too would
+* (a) double-recreate and (b) on a fresh install fatally `up` BEFORE images are
+* pulled. Only performUpgrade sets compose:true — its consumers (CLI update, the
+* admin upgrade route) have no separate compose phase and want the full
+* pull+recreate to happen inside the wrapper, with rollback on failure.
+*
+* Returns the services that were active (running) after the reconcile — the
+* "restarted" set for update/upgrade reporting — plus the OP_HOME assets it
+* changed and any backup dir a release migration created, for UpgradeResult.
+*/
+function reconcileStack(state, opts) {
+	return withStackEnvRollback(state, async () => {
+		const activating = !opts.deactivate;
+		if (activating && opts.compose) await repairRootOwnedBindMounts(state.homeDir);
+		const home = await reconcileHome(state);
+		const active = await reconcileCore(state, {
+			activateServices: opts.activate,
+			deactivateServices: opts.deactivate,
+			skipSnapshot: true
+		});
+		if (activating && opts.compose) {
+			const composeOpts = buildComposeOptions(state);
+			if (opts.pull) {
+				const pullResult = await composePull(composeOpts);
+				if (!pullResult.ok) throw new Error(`Failed to pull images: ${pullResult.stderr}`);
+			}
+			const services = await buildManagedServices(state);
+			const upResult = await composeUp({
+				...composeOpts,
+				services,
+				forceRecreate: true,
+				removeOrphans: true
+			});
+			if (!upResult.ok) throw new Error(`Failed to recreate containers: ${upResult.stderr}`);
+		}
+		return {
+			active,
+			assetsUpdated: home.assetsUpdated,
+			backupDir: home.backupDir
+		};
+	});
+}
 async function applyInstall(state, opts) {
 	const lock = resolveLifecycleLock(state, opts);
 	if (!lock) throw new Error("Another install is already in progress");
 	try {
-		await reconcileCore(state, { activateServices: true });
+		await reconcileStack(state, { activate: true });
 		ensureComposeVolumeTargets(state);
 	} finally {
 		releaseLifecycleLock(lock, opts);
@@ -7744,7 +7829,8 @@ async function applyUpdate(state, opts) {
 	const lock = resolveLifecycleLock(state, opts);
 	if (!lock) throw new Error("Another install is already in progress");
 	try {
-		return { restarted: await reconcileCore(state, {}) };
+		const { active } = await reconcileStack(state, {});
+		return { restarted: active };
 	} finally {
 		releaseLifecycleLock(lock, opts);
 	}
@@ -7753,7 +7839,8 @@ async function applyUninstall(state, opts) {
 	const lock = resolveLifecycleLock(state, opts);
 	if (!lock) throw new Error("Another install is already in progress");
 	try {
-		return { stopped: await reconcileCore(state, { deactivateServices: true }) };
+		const { active } = await reconcileStack(state, { deactivate: true });
+		return { stopped: active };
 	} finally {
 		releaseLifecycleLock(lock, opts);
 	}
@@ -7763,21 +7850,6 @@ function resolveImageNamespace(state) {
 	if (!IMAGE_NAMESPACE_RE.test(namespace)) throw new Error(`Invalid image namespace in system.env: ${namespace}`);
 	return namespace;
 }
-async function applyUpgrade(state, version, opts) {
-	const lock = resolveLifecycleLock(state, opts);
-	if (!lock) throw new Error("Another install is already in progress");
-	try {
-		await repairRootOwnedBindMounts(state.homeDir);
-		const { backupDir, updated } = await refreshCoreAssets(version);
-		return {
-			backupDir,
-			updated,
-			restarted: await reconcileCore(state, { skipSnapshot: true })
-		};
-	} finally {
-		releaseLifecycleLock(lock, opts);
-	}
-}
 async function withStackEnvRollback(state, run) {
 	const stackEnvPath = `${state.stashDir}/env/stack.env`;
 	const portalsComposePath = `${state.stackDir}/portals.compose.yml`;
@@ -7794,7 +7866,7 @@ async function withStackEnvRollback(state, run) {
 	try {
 		originalCustomCompose = readFileSync(customComposePath, "utf-8");
 	} catch {}
-	snapshotCurrentState(state, { arm: true });
+	if (!hasArmedSnapshot()) snapshotCurrentState(state, { arm: true });
 	try {
 		return await run();
 	} catch (e) {
@@ -7819,36 +7891,35 @@ async function withStackEnvRollback(state, run) {
 * There are NO Docker Hub calls: image versions are user-managed in stack.env
 * (PATCH /admin/versions), and the platform asset version is the running lib's
 * PLATFORM_VERSION — never resolved from a remote registry.
-*/
-async function performUpgrade(state, _opts = {}) {
-	return withStackEnvRollback(state, async () => {
-		const composeOpts = buildComposeOptions(state);
+*
+* `allowPrerelease` is accepted for caller intent/forward-compatibility but is
+* currently a NO-OP: there is no remote-tag resolution to gate, since the target
+* is always the running PLATFORM_VERSION and image tags are user-pinned in
+* stack.env. Forward-only release migrations decide compatibility (a downgrade
+* target yields no pending migrations rather than throwing). Callers pass it so
+* the gate can be wired here later without an API change.
+*/
+async function performUpgrade(state, opts) {
+	const lock = resolveLifecycleLock(state, opts);
+	if (!lock) throw new Error("Another install is already in progress");
+	try {
 		const namespace = resolveImageNamespace(state);
-		const releaseTag = "platform-" + normalizeVersion(PLATFORM_VERSION);
-		ensureReleaseMigrated({
-			homeDir: state.homeDir,
-			targetVersion: PLATFORM_VERSION
+		const { active, assetsUpdated, backupDir } = await reconcileStack(state, {
+			activate: true,
+			pull: true,
+			compose: true
 		});
-		const upgradeResult = await applyUpgrade(state, releaseTag);
-		const pullResult = await composePull(composeOpts);
-		if (!pullResult.ok) throw new Error(`Failed to pull images: ${pullResult.stderr}`);
-		const services = await buildManagedServices(state);
-		const upResult = await composeUp({
-			...composeOpts,
-			services,
-			forceRecreate: true,
-			removeOrphans: true
-		});
-		if (!upResult.ok) throw new Error(`Images pulled but failed to recreate containers: ${upResult.stderr}`);
 		return {
 			imageTag: PLATFORM_VERSION,
 			namespace,
-			backupDir: upgradeResult.backupDir,
-			assetsUpdated: upgradeResult.updated,
-			restarted: upgradeResult.restarted,
+			backupDir,
+			assetsUpdated,
+			restarted: active,
 			warnings: []
 		};
-	});
+	} finally {
+		releaseLifecycleLock(lock, opts);
+	}
 }
 function buildComposeFileList(state) {
 	return discoverStackOverlays(state.stackDir);
@@ -10385,4 +10456,4 @@ function collectBindAddressWarnings(env) {
 }
 
 export { ensureReleaseMigrated as $, AKM_USER_ENV_REF as A, BackupSpaceError as B, CORE_SERVICES as C, DOCKER_IMAGE_NAMES as D, composeUp as E, createLogger as F, createOpenCodeClient as G, createState as H, INSTALL_LOCK_STALE_AFTER_MS as I, deleteUserEnvKey as J, deriveLaunchStatus as K, deriveLocalStackState as L, MigrationError as M, detectGpu as N, detectHostOpenCode as O, PLATFORM_VERSION as P, detectLocalProviders as Q, detectRuntime as R, SERVICE_VERSION_KEYS as S, disableHostAkmSharing as T, dismissSecretStripNotice as U, enableHostAkmSharing as V, ensureAkmUserEnv as W, ensureHomeDirs as X, ensureMigrated as Y, ensureOpenCodeConfig as Z, ensureOpenCodeSystemConfig as _, addonProfileId as a, writeFileAtomic as a$, ensureSecrets as a0, executeAutomation as a1, fetchProviderModels as a2, formatForDisplay as a3, getAddonProfileAvailability as a4, getAddonProfileSelection as a5, getAddonProfiles as a6, getAddonServiceNames as a7, getAkmStats as a8, getDockerEvents as a9, readSecret as aA, readSecretFile as aB, readSecretStripNotice as aC, readStackEnv as aD, readStackRuntimeEnv as aE, readStackSecretEnv as aF, readTaskFile as aG, readUserEnvFile as aH, readVersions as aI, recommendSetup as aJ, removeSecretFile as aK, removeTaskFile as aL, resolveComposeProjectName as aM, resolveDataDir as aN, resolveDeployJournalPath as aO, resolveRuntimeFiles as aP, resolveStackDir as aQ, runAssistantAkmCommand as aR, runDeploy as aS, seedUiBuild as aT, setAddonEnabled as aU, setAddonProfileSelection as aV, summarizeBackups as aW, summarizeComposeStderr as aX, unlockInstallLock as aY, useExistingProviderForAssistantCli as aZ, validateProposedState as a_, getHostAkmSharingStatus as aa, getRegistryAddonConfig as ab, hostAkmStashPath as ac, importHostOpenCode as ad, initializeStateSecrets as ae, inspectInstallLock as af, isAllowedService as ag, isPrerelease as ah, isSetupComplete as ai, listAssistantCliTools as aj, listAvailableAddonIds as ak, listBackupDirs as al, listEnabledAddonIds as am, listSecretFiles as an, loadAutomations as ao, mapDockerError as ap, markSetupComplete as aq, mergeEnvContent as ar, parseComposeStderr as as, parseEnvFile as at, patchSecretsEnvFile as au, performSetup as av, performUpgrade as aw, pruneBackupDirs as ax, readAutomationLogs as ay, readDeployJournal as az, annotateAddonProfileAvailability as b, writeRuntimeFiles as b0, writeSecretFile as b1, writeStackSecretEnv as b2, writeTaskFile as b3, writeUserEnvKey as b4, writeVersions as b5, writeVoiceVars as b6, applyInstall as c, applyUninstall as d, applyUpdate as e, assertSafeSecretFilename as f, assertSafeTaskFilename as g, authJsonPath as h, backupSetupInputs as i, buildAkmEndpoint as j, buildAkmEnv as k, buildComposeOptions as l, buildManagedServices as m, checkDocker as n, checkDockerCompose as o, classifyLocalInstall as p, collectBindAddressWarnings as q, composeDown as r, composeLogs as s, composePreflight as t, composePs as u, composePull as v, composeRestart as w, composeStart as x, composeStats as y, composeStop as z };
-//# sourceMappingURL=src-BunIUeZg.js.map
+//# sourceMappingURL=src-Bms-Wpj4.js.map