@openpalm/ui 0.12.35 → 0.12.37

package/build/server/chunks/migration-status-CdKW4TxB.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-status-CdKW4TxB.js","sources":["../../../.svelte-kit/adapter-node/chunks/migration-status.js"],"sourcesContent":["import { Gt as isSkeletonStale, Xt as MigrationError, Zt as ensureMigrated } from \"./src.js\";\n//#region src/lib/server/migration-status.ts\n/**\n* Shared on-disk migration detection for the launch flow.\n*\n* A cheap `ensureMigrated` DRY RUN (no lock, no backup, writes nothing) reports\n* whether the home needs migrating before the user can safely continue, and\n* surfaces the fail-loud UnrecognizedLayoutError/MigrationError as an attention\n* state. Used by BOTH the splash page load (to render the migration card) and the\n* launch-routing guard (to force the user onto /splash even when the stack is\n* otherwise healthy) — one source of truth, no duplicated logic.\n*/\nfunction detectMigration(homeDir) {\n\ttry {\n\t\tconst report = ensureMigrated({\n\t\t\thomeDir,\n\t\t\tdryRun: true\n\t\t});\n\t\tif (!(report.applied.length > 0 || report.releaseApplied.length > 0 || isSkeletonStale(homeDir))) return { status: \"none\" };\n\t\treturn {\n\t\t\tstatus: \"pending\",\n\t\t\tfrom: report.from,\n\t\t\tto: report.to,\n\t\t\tapplied: report.applied,\n\t\t\treleaseApplied: report.releaseApplied,\n\t\t\tnotes: report.notes\n\t\t};\n\t} catch (e) {\n\t\tif (e instanceof MigrationError) return {\n\t\t\tstatus: \"error\",\n\t\t\tmessage: e.message,\n\t\t\tguidance: e.guidance\n\t\t};\n\t\tthrow e;\n\t}\n}\n/**\n* True when a migration is pending OR the home can't be read — both are states\n* that must land the user on /splash before they can use the assistant, even if\n* the stack is running or a healthy remote is configured.\n*/\nfunction isMigrationBlocking(homeDir) {\n\tconst s = detectMigration(homeDir);\n\treturn s.status === \"pending\" || s.status === \"error\";\n}\n//#endregion\nexport { isMigrationBlocking as n, detectMigration as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,IAAI;AACL,EAAE,MAAM,MAAM,GAAG,cAAc,CAAC;AAChC,GAAG,OAAO;AACV,GAAG,MAAM,EAAE;AACX,GAAG,CAAC;AACJ,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE;AAC7H,EAAE,OAAO;AACT,GAAG,MAAM,EAAE,SAAS;AACpB,GAAG,IAAI,EAAE,MAAM,CAAC,IAAI;AACpB,GAAG,EAAE,EAAE,MAAM,CAAC,EAAE;AAChB,GAAG,OAAO,EAAE,MAAM,CAAC,OAAO;AAC1B,GAAG,cAAc,EAAE,MAAM,CAAC,cAAc;AACxC,GAAG,KAAK,EAAE,MAAM,CAAC;AACjB,GAAG;AACH,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;AACb,EAAE,IAAI,CAAC,YAAY,cAAc,EAAE,OAAO;AAC1C,GAAG,MAAM,EAAE,OAAO;AAClB,GAAG,OAAO,EAAE,CAAC,CAAC,OAAO;AACrB,GAAG,QAAQ,EAAE,CAAC,CAAC;AACf,GAAG;AACH,EAAE,MAAM,CAAC;AACT,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,OAAO,EAAE;AACtC,CAAC,MAAM,CAAC,GAAG,eAAe,CAAC,OAAO,CAAC;AACnC,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO;AACtD;;;;"}

package/build/server/chunks/{session-cookie-Cn2O_Cv6.js → session-cookie-BVOapD-n.js}

@@ -1,4 +1,4 @@
-import { S as SESSION_TTL_SECONDS } from './helpers-BluGgY3g.js';
+import { S as SESSION_TTL_SECONDS } from './helpers-Dn1KCeOM.js';
 
 //#region src/lib/server/session-cookie.ts
 /**
@@ -71,4 +71,4 @@ function clearSessionCookieHeader(request) {
 }
 
 export { SESSION_COOKIE_NAME as S, clearSessionCookieHeader as c, sessionCookieHeader as s };
-//# sourceMappingURL=session-cookie-Cn2O_Cv6.js.map
+//# sourceMappingURL=session-cookie-BVOapD-n.js.map

package/build/server/chunks/{session-cookie-Cn2O_Cv6.js.map → session-cookie-BVOapD-n.js.map}

@@ -1 +1 @@
-{"version":3,"file":"session-cookie-Cn2O_Cv6.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}
+{"version":3,"file":"session-cookie-BVOapD-n.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}

package/build/server/chunks/{setup-deploy-B9QxcV6K.js → setup-deploy-xKJ3K_r-.js}

@@ -1,4 +1,4 @@
-import { i as backupSetupInputs, aS as runDeploy, aO as resolveDeployJournalPath, ai as isSetupComplete, aQ as resolveStackDir, az as readDeployJournal, aq as markSetupComplete } from './src-Bms-Wpj4.js';
+import { j as backupSetupInputs, aL as runDeploy, aI as resolveDeployJournalPath, ac as isSetupComplete, aJ as resolveStackDir, at as readDeployJournal, al as markSetupComplete } from './src-tc6vkfjq.js';
 
 //#region src/lib/server/setup-deploy.ts
 var _state = {
@@ -72,4 +72,4 @@ function prepareSetupRestorePoint(state) {
 }
 
 export { getDeployState as g, prepareSetupRestorePoint as p, resetDeployState as r, startDeploy as s };
-//# sourceMappingURL=setup-deploy-B9QxcV6K.js.map
+//# sourceMappingURL=setup-deploy-xKJ3K_r-.js.map

package/build/server/chunks/{setup-deploy-B9QxcV6K.js.map → setup-deploy-xKJ3K_r-.js.map}

@@ -1 +1 @@
-{"version":3,"file":"setup-deploy-B9QxcV6K.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { A as readDeployJournal, M as runDeploy, O as backupSetupInputs, en as resolveStackDir, j as resolveDeployJournalPath, k as markSetupComplete, lt as isSetupComplete } from \"./src.js\";\n//#region src/lib/server/setup-deploy.ts\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\timageWarning: null,\n\tphase: \"writing-config\"\n};\nvar _deployPromise = null;\nfunction deployStateFromJournal(state) {\n\tconst journal = readDeployJournal(resolveDeployJournalPath(state));\n\treturn {\n\t\tdeploying: journal.deploying,\n\t\tinterrupted: journal.interrupted,\n\t\tsetupComplete: journal.setupComplete || isSetupComplete(resolveStackDir()),\n\t\tdeployStatus: journal.deployStatus,\n\t\tdeployError: journal.deployError,\n\t\timageWarning: journal.imageWarning,\n\t\tphase: journal.phase\n\t};\n}\nfunction getDeployState(state) {\n\tif (state) _state = deployStateFromJournal(state);\n\telse if (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveStackDir())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: _state.deployStatus.map((entry) => ({ ...entry }))\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\timageWarning: null,\n\t\tphase: \"writing-config\"\n\t};\n}\nfunction startDeploy(state) {\n\tif (_deployPromise) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\treturn;\n\t}\n\t_deployPromise = (async () => {\n\t\tawait runDeploy(state, {\n\t\t\tjournalPath: resolveDeployJournalPath(state),\n\t\t\tonUpdate(progress) {\n\t\t\t\t_state = {\n\t\t\t\t\tdeploying: progress.deploying,\n\t\t\t\t\tinterrupted: progress.interrupted,\n\t\t\t\t\tsetupComplete: progress.setupComplete,\n\t\t\t\t\tdeployStatus: progress.deployStatus,\n\t\t\t\t\tdeployError: progress.deployError,\n\t\t\t\t\timageWarning: progress.imageWarning,\n\t\t\t\t\tphase: progress.phase\n\t\t\t\t};\n\t\t\t},\n\t\t\tmarkSetupComplete() {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t}\n\t\t});\n\t})().finally(() => {\n\t\t_deployPromise = null;\n\t});\n}\nfunction prepareSetupRestorePoint(state) {\n\treturn backupSetupInputs(state);\n}\n//#endregion\nexport { startDeploy as i, prepareSetupRestorePoint as n, resetDeployState as r, getDeployState as t };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,YAAY,EAAE,IAAI;AACnB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,IAAI,cAAc,GAAG,IAAI;AACzB,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;AAC9B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;AAC5E,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,KAAK,EAAE,OAAO,CAAC;AACjB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,IAAI,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAClD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AACvH,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AACjE,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,YAAY,EAAE,IAAI;AACpB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,cAAc,EAAE;AACrB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE;AACF,CAAC;AACD,CAAC,cAAc,GAAG,CAAC,YAAY;AAC/B,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;AACzB,GAAG,WAAW,EAAE,wBAAwB,CAAC,KAAK,CAAC;AAC/C,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,MAAM,GAAG;AACb,KAAK,SAAS,EAAE,QAAQ,CAAC,SAAS;AAClC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,aAAa,EAAE,QAAQ,CAAC,aAAa;AAC1C,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,KAAK,EAAE,QAAQ,CAAC;AACrB,KAAK;AACL,GAAG,CAAC;AACJ,GAAG,iBAAiB,GAAG;AACvB,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;AACpB,EAAE,cAAc,GAAG,IAAI;AACvB,CAAC,CAAC,CAAC;AACH;AACA,SAAS,wBAAwB,CAAC,KAAK,EAAE;AACzC,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC;AAChC;;;;"}
+{"version":3,"file":"setup-deploy-xKJ3K_r-.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { A as readDeployJournal, Jt as resolveStackDir, M as runDeploy, O as backupSetupInputs, ct as isSetupComplete, j as resolveDeployJournalPath, k as markSetupComplete } from \"./src.js\";\n//#region src/lib/server/setup-deploy.ts\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\timageWarning: null,\n\tphase: \"writing-config\"\n};\nvar _deployPromise = null;\nfunction deployStateFromJournal(state) {\n\tconst journal = readDeployJournal(resolveDeployJournalPath(state));\n\treturn {\n\t\tdeploying: journal.deploying,\n\t\tinterrupted: journal.interrupted,\n\t\tsetupComplete: journal.setupComplete || isSetupComplete(resolveStackDir()),\n\t\tdeployStatus: journal.deployStatus,\n\t\tdeployError: journal.deployError,\n\t\timageWarning: journal.imageWarning,\n\t\tphase: journal.phase\n\t};\n}\nfunction getDeployState(state) {\n\tif (state) _state = deployStateFromJournal(state);\n\telse if (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveStackDir())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: _state.deployStatus.map((entry) => ({ ...entry }))\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\timageWarning: null,\n\t\tphase: \"writing-config\"\n\t};\n}\nfunction startDeploy(state) {\n\tif (_deployPromise) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\treturn;\n\t}\n\t_deployPromise = (async () => {\n\t\tawait runDeploy(state, {\n\t\t\tjournalPath: resolveDeployJournalPath(state),\n\t\t\tonUpdate(progress) {\n\t\t\t\t_state = {\n\t\t\t\t\tdeploying: progress.deploying,\n\t\t\t\t\tinterrupted: progress.interrupted,\n\t\t\t\t\tsetupComplete: progress.setupComplete,\n\t\t\t\t\tdeployStatus: progress.deployStatus,\n\t\t\t\t\tdeployError: progress.deployError,\n\t\t\t\t\timageWarning: progress.imageWarning,\n\t\t\t\t\tphase: progress.phase\n\t\t\t\t};\n\t\t\t},\n\t\t\tmarkSetupComplete() {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t}\n\t\t});\n\t})().finally(() => {\n\t\t_deployPromise = null;\n\t});\n}\nfunction prepareSetupRestorePoint(state) {\n\treturn backupSetupInputs(state);\n}\n//#endregion\nexport { startDeploy as i, prepareSetupRestorePoint as n, resetDeployState as r, getDeployState as t };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,YAAY,EAAE,IAAI;AACnB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,IAAI,cAAc,GAAG,IAAI;AACzB,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;AAC9B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;AAC5E,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,KAAK,EAAE,OAAO,CAAC;AACjB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,IAAI,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAClD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AACvH,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AACjE,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,YAAY,EAAE,IAAI;AACpB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,cAAc,EAAE;AACrB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE;AACF,CAAC;AACD,CAAC,cAAc,GAAG,CAAC,YAAY;AAC/B,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;AACzB,GAAG,WAAW,EAAE,wBAAwB,CAAC,KAAK,CAAC;AAC/C,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,MAAM,GAAG;AACb,KAAK,SAAS,EAAE,QAAQ,CAAC,SAAS;AAClC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,aAAa,EAAE,QAAQ,CAAC,aAAa;AAC1C,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,KAAK,EAAE,QAAQ,CAAC;AACrB,KAAK;AACL,GAAG,CAAC;AACJ,GAAG,iBAAiB,GAAG;AACvB,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;AACpB,EAAE,cAAc,GAAG,IAAI;AACvB,CAAC,CAAC,CAAC;AACH;AACA,SAAS,wBAAwB,CAAC,KAAK,EAAE;AACzC,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC;AAChC;;;;"}

package/build/server/chunks/{src-Bms-Wpj4.js → src-tc6vkfjq.js}

@@ -2,7 +2,7 @@ import { _ as __commonJSMin, b as __require } from './chunk-CLZ62Ad-.js';
 import { P as PROVIDER_DEFAULT_URLS, a as PROVIDER_KEY_MAP } from './provider-constants-DPrj3yBX.js';
 import { r as require_dist } from './dist-DOFcG0Zp.js';
 import { createRequire } from 'node:module';
-import Vt, { existsSync, readFileSync, copyFileSync, chmodSync, mkdirSync, lstatSync, rmSync, readdirSync, renameSync, writeFileSync, statfsSync, cpSync, openSync, constants, writeSync, closeSync, statSync, chownSync } from 'node:fs';
+import Vt, { existsSync, readFileSync, copyFileSync, chmodSync, mkdirSync, rmSync, readdirSync, renameSync, writeFileSync, statfsSync, cpSync, openSync, constants, writeSync, closeSync, statSync, lstatSync, chownSync } from 'node:fs';
 import or, { join, basename, dirname, resolve, win32, posix, relative } from 'node:path';
 import { Buffer as Buffer$1 } from 'buffer';
 import I from 'fs';
@@ -746,7 +746,7 @@ var import_main = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = DotenvModule;
 })))();
 var package_default = {
-	version: "0.12.35"};
+	version: "0.12.37"};
 //#endregion
 //#region ../lib/src/control-plane/versioning.ts
 var SEMVER_RE = /^v?\d+\.\d+\.\d+(?:[-+].*)?$/;
@@ -831,14 +831,6 @@ function formatForDocker(version) {
 	return bare ? `v${bare}` : "";
 }
 /**
-* True when `version` carries a semver pre-release segment (`0.12.0-rc.1`).
-* Build metadata (`+build.5`) is NOT a pre-release. Non-semver → false.
-*/
-function isPrerelease(version) {
-	if (!isComparableSemver(version)) return false;
-	return parseComparableVersion(version).prerelease !== null;
-}
-/**
 * User-facing presentation form: drop the leading `v` so the UI shows one
 * canonical spelling regardless of whether the value arrived as a Docker tag or
 * an npm version. Non-semver values are returned trimmed but otherwise untouched
@@ -5258,8 +5250,7 @@ function randomHex(bytes) {
 * Core runtime asset management for the OpenPalm control plane.
 *
 * Manages source-of-truth files for the ~/.openpalm/ layout:
-*   stack/              — compose runtime assets (core.compose.yml)
-*   config/guardian/    — guardian OpenCode config (skip-if-user-modified)
+*   config/stack/       — system-owned compose files, refreshed every reconcile
 *
 * This module manages runtime-owned core files only.
 * Addon compose bundle generation and registry catalog refresh are handled
@@ -5301,26 +5292,11 @@ function readBundledStackAsset(name) {
 function ensureOpenCodeSystemConfig() {
 	mkdirSync(`${resolveDataDir()}/assistant`, { recursive: true });
 }
-var SHIPPED_DEFAULT_HASHES = { "config/guardian/instructions/moderation.md": ["dfa770d433bef9954e58e29cfb337679eb27ed3c9de61ddd2c4106d3add9a628"] };
-/** Assets under config/guardian/ that are managed (refreshable) but respect user edits. */
-var GUARDIAN_MANAGED_ASSETS = [{ relPath: "config/guardian/instructions/moderation.md" }];
-/**
-* Returns true when the on-disk content is still byte-identical to one of the
-* previously shipped defaults for the given relPath (i.e. the user has not
-* edited it and it is safe to overwrite on refresh).
-*/
-function isUnmodifiedDefault(relPath, currentContent) {
-	const known = SHIPPED_DEFAULT_HASHES[relPath];
-	if (!known || known.length === 0) return false;
-	const h = sha256(currentContent);
-	return known.includes(h);
-}
 var MANAGED_ASSETS = [
 	{ relPath: "config/stack/core.compose.yml" },
 	{ relPath: "config/stack/services.compose.yml" },
 	{ relPath: "config/stack/portals.compose.yml" }
 ];
-var SEEDED_ASSETS = [{ relPath: "config/assistant/opencode.jsonc" }, { relPath: "config/stack/custom.compose.yml" }];
 function ensureBackupDir(backupDir, suffix = "") {
 	if (backupDir) return backupDir;
 	return join(resolveBackupsDir(), `${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}${suffix}`);
@@ -5334,7 +5310,6 @@ function backupExistingFile(targetPath, assetRelPath, backupDir, suffix = "") {
 }
 function refreshCoreAssetsFromSource(sourceRoot, homeDir = resolveOpenPalmHome()) {
 	const updated = [];
-	const kept = [];
 	let backupDir = null;
 	for (const asset of MANAGED_ASSETS) {
 		const sourcePath = join(sourceRoot, asset.relPath);
@@ -5348,39 +5323,9 @@ function refreshCoreAssetsFromSource(sourceRoot, homeDir = resolveOpenPalmHome()
 		writeFileSync(targetPath, freshContent);
 		updated.push(asset.relPath);
 	}
-	for (const asset of GUARDIAN_MANAGED_ASSETS) {
-		const sourcePath = join(sourceRoot, asset.relPath);
-		const targetPath = join(homeDir, asset.relPath);
-		if (!existsSync(sourcePath)) continue;
-		const freshContent = readFileSync(sourcePath, "utf-8");
-		if (existsSync(targetPath)) {
-			const currentContent = readFileSync(targetPath, "utf-8");
-			if (sha256(currentContent) === sha256(freshContent)) continue;
-			if (!isUnmodifiedDefault(asset.relPath, currentContent)) {
-				logger$12.info("guardian managed asset kept (user-modified); new default available", {
-					path: asset.relPath,
-					hint: "Remove the file or restore the shipped default to pick up the new version on the next refresh."
-				});
-				kept.push(asset.relPath);
-				continue;
-			}
-		}
-		mkdirSync(dirname(targetPath), { recursive: true });
-		writeFileSync(targetPath, freshContent);
-		updated.push(asset.relPath);
-	}
-	for (const asset of SEEDED_ASSETS) {
-		const sourcePath = join(sourceRoot, asset.relPath);
-		const targetPath = join(homeDir, asset.relPath);
-		if (existsSync(targetPath)) continue;
-		mkdirSync(dirname(targetPath), { recursive: true });
-		writeFileSync(targetPath, readFileSync(sourcePath, "utf-8"));
-		updated.push(asset.relPath);
-	}
 	return {
 		backupDir,
-		updated,
-		kept
+		updated
 	};
 }
 //#endregion
@@ -5468,6 +5413,27 @@ function resolveLocalOpenpalmDir() {
 */
 /** Version stamp recording which skeleton version OP_HOME was last seeded from. */
 var SKELETON_VERSION_STAMP = ".skeleton-version";
+/** The skeleton version OP_HOME was last seeded from, or null when unstamped. */
+function readSkeletonVersion(homeDir) {
+	try {
+		const p = join(homeDir, SKELETON_VERSION_STAMP);
+		return existsSync(p) ? readFileSync(p, "utf-8").trim() : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* True when this home was seeded by a DIFFERENT platform version than the one
+* now running — i.e. the binary was updated but its assets/secrets/migrations
+* have not been applied to OP_HOME yet. The launch flow uses this to land the
+* user on /splash with an "apply updates" button instead of silently
+* self-healing on every request. An unstamped home (null) is NOT stale — that's
+* a fresh/not-installed home handled by the setup flow.
+*/
+function isSkeletonStale(homeDir) {
+	const stamped = readSkeletonVersion(homeDir);
+	return stamped !== null && stamped !== PLATFORM_VERSION.trim();
+}
 /**
 * Seed the bundled `.openpalm/` skeleton into OP_HOME — ONCE PER VERSION.
 *
@@ -6056,7 +6022,7 @@ var SERVICE_VERSION_KEYS = [
 /**
 * Maps each service version key to its Docker Hub image name (without namespace).
 * Namespace defaults to "openpalm" (OP_IMAGE_NAMESPACE env var in compose).
-* Source: .openpalm/config/stack/core.compose.yml + services.compose.yml + portals.compose.yml.
+* Source: packages/skeleton/config/stack/core.compose.yml + services.compose.yml + portals.compose.yml.
 *
 * NOTE: voice tags carry a variant suffix in compose (e.g. "-cpu", "-cu121") that is
 * appended by the compose file itself. OP_VOICE_VERSION holds only the base semver part.
@@ -7657,7 +7623,6 @@ function hasArmedSnapshot() {
 //#endregion
 //#region ../lib/src/control-plane/lifecycle.ts
 /** Lifecycle helpers — state factory, apply transitions, compose file list. */
-var IMAGE_NAMESPACE_RE = /^[a-z0-9]+(?:[._-][a-z0-9]+)*$/;
 function createState() {
 	const homeDir = resolveOpenPalmHome();
 	const configDir = resolveConfigDir();
@@ -7726,27 +7691,58 @@ async function reconcileCore(state, opts) {
 *
 * Every step is a cheap no-op when already current:
 *   • ensureMigrated        — forward-only layout migrations (skip-if-done)
+*   • ensureHomeDirs        — create the OP_HOME directory layout
 *   • seedOpenPalmDir       — skeleton data/ seed (stamp-gated, skip-existing) +
 *                             managed compose refresh from BUNDLED local source
+*   • ensureOpenCode*       — starter OpenCode config + data dir (seed-if-missing)
 *   • ensureReleaseMigrated — forward-only release transforms (copy-only, idempotent)
 *
+* This is the ONLY function that writes OP_HOME's layout/assets, so callers never
+* need to defensively re-ensure dirs or config themselves.
+*
 * Returns the assets it actually changed (the refreshed managed compose/config
 * files) and the backup directory a release migration created (if any), so
 * performUpgrade can surface them in UpgradeResult — the upgrade route logs the
 * asset list and shows the backup dir to the operator.
 */
-async function reconcileHome(state) {
-	ensureMigrated({ homeDir: state.homeDir });
+async function reconcileHome(state, opts = {}) {
+	const migration = ensureMigrated({
+		homeDir: state.homeDir,
+		confirmLowSpace: opts.confirmLowSpace
+	});
+	ensureHomeDirs();
+	ensureSecrets(state);
 	const seed = await seedOpenPalmDir(PLATFORM_VERSION, state.homeDir, state.configDir, state.dataDir);
+	ensureOpenCodeConfig();
+	ensureOpenCodeSystemConfig();
 	const release = ensureReleaseMigrated({
 		homeDir: state.homeDir,
 		targetVersion: PLATFORM_VERSION
 	});
 	return {
+		migration,
 		assetsUpdated: seed.updated,
 		backupDir: release.backupDir ?? seed.backupDir
 	};
 }
+/**
+* Bring OP_HOME up to date WITHOUT touching containers — the single primitive
+* behind the splash "apply updates" button. Runs the full home reconcile
+* (migrations + dirs + secrets + skeleton seed + OpenCode config) under the
+* install lock so it can't race a concurrent install/update, then returns the
+* migration report for the UI to display. This is the deliberate, user-clicked
+* replacement for the per-request self-healing we removed: serving the UI is a
+* pure read; THIS is where the home is mutated.
+*/
+async function applyHomeReconcile(state, opts = {}) {
+	const lock = resolveLifecycleLock(state);
+	if (!lock) throw new Error("Another install is already in progress");
+	try {
+		return await reconcileHome(state, opts);
+	} finally {
+		releaseLifecycleLock(lock);
+	}
+}
 function resolveLifecycleLock(state, opts) {
 	if (opts && "lock" in opts) return opts.lock ?? null;
 	return acquireInstallLock(state.dataDir);
@@ -7845,11 +7841,6 @@ async function applyUninstall(state, opts) {
 		releaseLifecycleLock(lock, opts);
 	}
 }
-function resolveImageNamespace(state) {
-	const namespace = (parseEnvFile(`${state.stashDir}/env/stack.env`).OP_IMAGE_NAMESPACE ?? process.env.OP_IMAGE_NAMESPACE ?? "openpalm").trim().toLowerCase();
-	if (!IMAGE_NAMESPACE_RE.test(namespace)) throw new Error(`Invalid image namespace in system.env: ${namespace}`);
-	return namespace;
-}
 async function withStackEnvRollback(state, run) {
 	const stackEnvPath = `${state.stashDir}/env/stack.env`;
 	const portalsComposePath = `${state.stackDir}/portals.compose.yml`;
@@ -7882,45 +7873,6 @@ async function withStackEnvRollback(state, run) {
 		throw e;
 	}
 }
-/**
-* Update the stack to the running control-plane version: run forward release
-* migrations, refresh core stack assets (compose/config) for PLATFORM_VERSION,
-* then pull images and recreate containers honoring the per-image OP_*_VERSION
-* pins already written in stack.env.
-*
-* There are NO Docker Hub calls: image versions are user-managed in stack.env
-* (PATCH /admin/versions), and the platform asset version is the running lib's
-* PLATFORM_VERSION — never resolved from a remote registry.
-*
-* `allowPrerelease` is accepted for caller intent/forward-compatibility but is
-* currently a NO-OP: there is no remote-tag resolution to gate, since the target
-* is always the running PLATFORM_VERSION and image tags are user-pinned in
-* stack.env. Forward-only release migrations decide compatibility (a downgrade
-* target yields no pending migrations rather than throwing). Callers pass it so
-* the gate can be wired here later without an API change.
-*/
-async function performUpgrade(state, opts) {
-	const lock = resolveLifecycleLock(state, opts);
-	if (!lock) throw new Error("Another install is already in progress");
-	try {
-		const namespace = resolveImageNamespace(state);
-		const { active, assetsUpdated, backupDir } = await reconcileStack(state, {
-			activate: true,
-			pull: true,
-			compose: true
-		});
-		return {
-			imageTag: PLATFORM_VERSION,
-			namespace,
-			backupDir,
-			assetsUpdated,
-			restarted: active,
-			warnings: []
-		};
-	} finally {
-		releaseLifecycleLock(lock, opts);
-	}
-}
 function buildComposeFileList(state) {
 	return discoverStackOverlays(state.stackDir);
 }
@@ -9218,7 +9170,7 @@ var ENV_FILE_MODE = 384;
 /**
 * Build the env that points akm at the shared OpenPalm stash. We mirror the
 * layout that the assistant container uses (see
-* `.openpalm/config/stack/core.compose.yml`) so host-side and container-side
+* `packages/skeleton/config/stack/core.compose.yml`) so host-side and container-side
 * runs resolve to the same files.
 *
 * Host-side runs use the same explicit directories as the assistant container:
@@ -10455,5 +10407,5 @@ function collectBindAddressWarnings(env) {
 	return warnings;
 }
 
-export { ensureReleaseMigrated as $, AKM_USER_ENV_REF as A, BackupSpaceError as B, CORE_SERVICES as C, DOCKER_IMAGE_NAMES as D, composeUp as E, createLogger as F, createOpenCodeClient as G, createState as H, INSTALL_LOCK_STALE_AFTER_MS as I, deleteUserEnvKey as J, deriveLaunchStatus as K, deriveLocalStackState as L, MigrationError as M, detectGpu as N, detectHostOpenCode as O, PLATFORM_VERSION as P, detectLocalProviders as Q, detectRuntime as R, SERVICE_VERSION_KEYS as S, disableHostAkmSharing as T, dismissSecretStripNotice as U, enableHostAkmSharing as V, ensureAkmUserEnv as W, ensureHomeDirs as X, ensureMigrated as Y, ensureOpenCodeConfig as Z, ensureOpenCodeSystemConfig as _, addonProfileId as a, writeFileAtomic as a$, ensureSecrets as a0, executeAutomation as a1, fetchProviderModels as a2, formatForDisplay as a3, getAddonProfileAvailability as a4, getAddonProfileSelection as a5, getAddonProfiles as a6, getAddonServiceNames as a7, getAkmStats as a8, getDockerEvents as a9, readSecret as aA, readSecretFile as aB, readSecretStripNotice as aC, readStackEnv as aD, readStackRuntimeEnv as aE, readStackSecretEnv as aF, readTaskFile as aG, readUserEnvFile as aH, readVersions as aI, recommendSetup as aJ, removeSecretFile as aK, removeTaskFile as aL, resolveComposeProjectName as aM, resolveDataDir as aN, resolveDeployJournalPath as aO, resolveRuntimeFiles as aP, resolveStackDir as aQ, runAssistantAkmCommand as aR, runDeploy as aS, seedUiBuild as aT, setAddonEnabled as aU, setAddonProfileSelection as aV, summarizeBackups as aW, summarizeComposeStderr as aX, unlockInstallLock as aY, useExistingProviderForAssistantCli as aZ, validateProposedState as a_, getHostAkmSharingStatus as aa, getRegistryAddonConfig as ab, hostAkmStashPath as ac, importHostOpenCode as ad, initializeStateSecrets as ae, inspectInstallLock as af, isAllowedService as ag, isPrerelease as ah, isSetupComplete as ai, listAssistantCliTools as aj, listAvailableAddonIds as ak, listBackupDirs as al, listEnabledAddonIds as am, listSecretFiles as an, loadAutomations as ao, mapDockerError as ap, markSetupComplete as aq, mergeEnvContent as ar, parseComposeStderr as as, parseEnvFile as at, patchSecretsEnvFile as au, performSetup as av, performUpgrade as aw, pruneBackupDirs as ax, readAutomationLogs as ay, readDeployJournal as az, annotateAddonProfileAvailability as b, writeRuntimeFiles as b0, writeSecretFile as b1, writeStackSecretEnv as b2, writeTaskFile as b3, writeUserEnvKey as b4, writeVersions as b5, writeVoiceVars as b6, applyInstall as c, applyUninstall as d, applyUpdate as e, assertSafeSecretFilename as f, assertSafeTaskFilename as g, authJsonPath as h, backupSetupInputs as i, buildAkmEndpoint as j, buildAkmEnv as k, buildComposeOptions as l, buildManagedServices as m, checkDocker as n, checkDockerCompose as o, classifyLocalInstall as p, collectBindAddressWarnings as q, composeDown as r, composeLogs as s, composePreflight as t, composePs as u, composePull as v, composeRestart as w, composeStart as x, composeStats as y, composeStop as z };
-//# sourceMappingURL=src-Bms-Wpj4.js.map
+export { formatForDisplay as $, AKM_USER_ENV_REF as A, BackupSpaceError as B, CORE_SERVICES as C, DOCKER_IMAGE_NAMES as D, composeStop as E, composeUp as F, createLogger as G, createOpenCodeClient as H, INSTALL_LOCK_STALE_AFTER_MS as I, createState as J, deleteUserEnvKey as K, deriveLaunchStatus as L, MigrationError as M, deriveLocalStackState as N, detectGpu as O, PLATFORM_VERSION as P, detectHostOpenCode as Q, detectLocalProviders as R, SERVICE_VERSION_KEYS as S, detectRuntime as T, disableHostAkmSharing as U, dismissSecretStripNotice as V, enableHostAkmSharing as W, ensureAkmUserEnv as X, ensureMigrated as Y, executeAutomation as Z, fetchProviderModels as _, addonProfileId as a, getAddonProfileAvailability as a0, getAddonProfileSelection as a1, getAddonProfiles as a2, getAddonServiceNames as a3, getAkmStats as a4, getDockerEvents as a5, getHostAkmSharingStatus as a6, getRegistryAddonConfig as a7, hostAkmStashPath as a8, importHostOpenCode as a9, readTaskFile as aA, readUserEnvFile as aB, readVersions as aC, recommendSetup as aD, removeSecretFile as aE, removeTaskFile as aF, resolveComposeProjectName as aG, resolveDataDir as aH, resolveDeployJournalPath as aI, resolveStackDir as aJ, runAssistantAkmCommand as aK, runDeploy as aL, seedUiBuild as aM, setAddonEnabled as aN, setAddonProfileSelection as aO, summarizeBackups as aP, summarizeComposeStderr as aQ, unlockInstallLock as aR, useExistingProviderForAssistantCli as aS, validateProposedState as aT, writeFileAtomic as aU, writeSecretFile as aV, writeStackSecretEnv as aW, writeTaskFile as aX, writeUserEnvKey as aY, writeVersions as aZ, writeVoiceVars as a_, inspectInstallLock as aa, isAllowedService as ab, isSetupComplete as ac, isSkeletonStale as ad, listAssistantCliTools as ae, listAvailableAddonIds as af, listBackupDirs as ag, listEnabledAddonIds as ah, listSecretFiles as ai, loadAutomations as aj, mapDockerError as ak, markSetupComplete as al, mergeEnvContent as am, parseComposeStderr as an, parseEnvFile as ao, patchSecretsEnvFile as ap, performSetup as aq, pruneBackupDirs as ar, readAutomationLogs as as, readDeployJournal as at, readSecret as au, readSecretFile as av, readSecretStripNotice as aw, readStackEnv as ax, readStackRuntimeEnv as ay, readStackSecretEnv as az, annotateAddonProfileAvailability as b, applyHomeReconcile as c, applyInstall as d, applyUninstall as e, applyUpdate as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, backupSetupInputs as j, buildAkmEndpoint as k, buildAkmEnv as l, buildComposeOptions as m, buildManagedServices as n, checkDocker as o, checkDockerCompose as p, classifyLocalInstall as q, collectBindAddressWarnings as r, composeDown as s, composeLogs as t, composePreflight as u, composePs as v, composePull as w, composeRestart as x, composeStart as y, composeStats as z };
+//# sourceMappingURL=src-tc6vkfjq.js.map