@openpalm/ui 0.12.40 → 0.12.42

package/build/server/chunks/{session-cookie-CWm3gU2J.js → session-cookie-JlLVdQSQ.js}

@@ -1,4 +1,4 @@
-import { S as SESSION_TTL_SECONDS } from './helpers-BQUg4t3R.js';
+import { S as SESSION_TTL_SECONDS } from './helpers-WAbDmmLf.js';
 
 //#region src/lib/server/session-cookie.ts
 /**
@@ -71,4 +71,4 @@ function clearSessionCookieHeader(request) {
 }
 
 export { SESSION_COOKIE_NAME as S, clearSessionCookieHeader as c, sessionCookieHeader as s };
-//# sourceMappingURL=session-cookie-CWm3gU2J.js.map
+//# sourceMappingURL=session-cookie-JlLVdQSQ.js.map

package/build/server/chunks/{session-cookie-CWm3gU2J.js.map → session-cookie-JlLVdQSQ.js.map}

@@ -1 +1 @@
-{"version":3,"file":"session-cookie-CWm3gU2J.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}
+{"version":3,"file":"session-cookie-JlLVdQSQ.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}

package/build/server/chunks/{setup-deploy-BzNm_sts.js → setup-deploy-DYisu2lD.js}

@@ -1,4 +1,4 @@
-import { j as backupSetupInputs, aL as runDeploy, aI as resolveDeployJournalPath, ac as isSetupComplete, aJ as resolveStackDir, at as readDeployJournal, al as markSetupComplete } from './src-DlScVN9s.js';
+import { j as backupSetupInputs, aN as runDeploy, aK as resolveDeployJournalPath, ad as isSetupComplete, aL as resolveStackDir, av as readDeployJournal, am as markSetupComplete } from './src-Cx_5iP9B.js';
 
 //#region src/lib/server/setup-deploy.ts
 var _state = {
@@ -72,4 +72,4 @@ function prepareSetupRestorePoint(state) {
 }
 
 export { getDeployState as g, prepareSetupRestorePoint as p, resetDeployState as r, startDeploy as s };
-//# sourceMappingURL=setup-deploy-BzNm_sts.js.map
+//# sourceMappingURL=setup-deploy-DYisu2lD.js.map

package/build/server/chunks/{setup-deploy-BzNm_sts.js.map → setup-deploy-DYisu2lD.js.map}

@@ -1 +1 @@
-{"version":3,"file":"setup-deploy-BzNm_sts.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { A as readDeployJournal, Jt as resolveStackDir, M as runDeploy, O as backupSetupInputs, ct as isSetupComplete, j as resolveDeployJournalPath, k as markSetupComplete } from \"./src.js\";\n//#region src/lib/server/setup-deploy.ts\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\timageWarning: null,\n\tphase: \"writing-config\"\n};\nvar _deployPromise = null;\nfunction deployStateFromJournal(state) {\n\tconst journal = readDeployJournal(resolveDeployJournalPath(state));\n\treturn {\n\t\tdeploying: journal.deploying,\n\t\tinterrupted: journal.interrupted,\n\t\tsetupComplete: journal.setupComplete || isSetupComplete(resolveStackDir()),\n\t\tdeployStatus: journal.deployStatus,\n\t\tdeployError: journal.deployError,\n\t\timageWarning: journal.imageWarning,\n\t\tphase: journal.phase\n\t};\n}\nfunction getDeployState(state) {\n\tif (state) _state = deployStateFromJournal(state);\n\telse if (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveStackDir())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: _state.deployStatus.map((entry) => ({ ...entry }))\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\timageWarning: null,\n\t\tphase: \"writing-config\"\n\t};\n}\nfunction startDeploy(state) {\n\tif (_deployPromise) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\treturn;\n\t}\n\t_deployPromise = (async () => {\n\t\tawait runDeploy(state, {\n\t\t\tjournalPath: resolveDeployJournalPath(state),\n\t\t\tonUpdate(progress) {\n\t\t\t\t_state = {\n\t\t\t\t\tdeploying: progress.deploying,\n\t\t\t\t\tinterrupted: progress.interrupted,\n\t\t\t\t\tsetupComplete: progress.setupComplete,\n\t\t\t\t\tdeployStatus: progress.deployStatus,\n\t\t\t\t\tdeployError: progress.deployError,\n\t\t\t\t\timageWarning: progress.imageWarning,\n\t\t\t\t\tphase: progress.phase\n\t\t\t\t};\n\t\t\t},\n\t\t\tmarkSetupComplete() {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t}\n\t\t});\n\t})().finally(() => {\n\t\t_deployPromise = null;\n\t});\n}\nfunction prepareSetupRestorePoint(state) {\n\treturn backupSetupInputs(state);\n}\n//#endregion\nexport { startDeploy as i, prepareSetupRestorePoint as n, resetDeployState as r, getDeployState as t };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,YAAY,EAAE,IAAI;AACnB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,IAAI,cAAc,GAAG,IAAI;AACzB,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;AAC9B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;AAC5E,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,KAAK,EAAE,OAAO,CAAC;AACjB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,IAAI,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAClD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AACvH,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AACjE,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,YAAY,EAAE,IAAI;AACpB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,cAAc,EAAE;AACrB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE;AACF,CAAC;AACD,CAAC,cAAc,GAAG,CAAC,YAAY;AAC/B,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;AACzB,GAAG,WAAW,EAAE,wBAAwB,CAAC,KAAK,CAAC;AAC/C,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,MAAM,GAAG;AACb,KAAK,SAAS,EAAE,QAAQ,CAAC,SAAS;AAClC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,aAAa,EAAE,QAAQ,CAAC,aAAa;AAC1C,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,KAAK,EAAE,QAAQ,CAAC;AACrB,KAAK;AACL,GAAG,CAAC;AACJ,GAAG,iBAAiB,GAAG;AACvB,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;AACpB,EAAE,cAAc,GAAG,IAAI;AACvB,CAAC,CAAC,CAAC;AACH;AACA,SAAS,wBAAwB,CAAC,KAAK,EAAE;AACzC,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC;AAChC;;;;"}
+{"version":3,"file":"setup-deploy-DYisu2lD.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { A as readDeployJournal, Jt as resolveStackDir, M as runDeploy, O as backupSetupInputs, ct as isSetupComplete, j as resolveDeployJournalPath, k as markSetupComplete } from \"./src.js\";\n//#region src/lib/server/setup-deploy.ts\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\timageWarning: null,\n\tphase: \"writing-config\"\n};\nvar _deployPromise = null;\nfunction deployStateFromJournal(state) {\n\tconst journal = readDeployJournal(resolveDeployJournalPath(state));\n\treturn {\n\t\tdeploying: journal.deploying,\n\t\tinterrupted: journal.interrupted,\n\t\tsetupComplete: journal.setupComplete || isSetupComplete(resolveStackDir()),\n\t\tdeployStatus: journal.deployStatus,\n\t\tdeployError: journal.deployError,\n\t\timageWarning: journal.imageWarning,\n\t\tphase: journal.phase\n\t};\n}\nfunction getDeployState(state) {\n\tif (state) _state = deployStateFromJournal(state);\n\telse if (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveStackDir())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: _state.deployStatus.map((entry) => ({ ...entry }))\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\timageWarning: null,\n\t\tphase: \"writing-config\"\n\t};\n}\nfunction startDeploy(state) {\n\tif (_deployPromise) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\treturn;\n\t}\n\t_deployPromise = (async () => {\n\t\tawait runDeploy(state, {\n\t\t\tjournalPath: resolveDeployJournalPath(state),\n\t\t\tonUpdate(progress) {\n\t\t\t\t_state = {\n\t\t\t\t\tdeploying: progress.deploying,\n\t\t\t\t\tinterrupted: progress.interrupted,\n\t\t\t\t\tsetupComplete: progress.setupComplete,\n\t\t\t\t\tdeployStatus: progress.deployStatus,\n\t\t\t\t\tdeployError: progress.deployError,\n\t\t\t\t\timageWarning: progress.imageWarning,\n\t\t\t\t\tphase: progress.phase\n\t\t\t\t};\n\t\t\t},\n\t\t\tmarkSetupComplete() {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t}\n\t\t});\n\t})().finally(() => {\n\t\t_deployPromise = null;\n\t});\n}\nfunction prepareSetupRestorePoint(state) {\n\treturn backupSetupInputs(state);\n}\n//#endregion\nexport { startDeploy as i, prepareSetupRestorePoint as n, resetDeployState as r, getDeployState as t };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,YAAY,EAAE,IAAI;AACnB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,IAAI,cAAc,GAAG,IAAI;AACzB,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;AAC9B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;AAC5E,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,KAAK,EAAE,OAAO,CAAC;AACjB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,IAAI,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAClD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AACvH,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AACjE,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,YAAY,EAAE,IAAI;AACpB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,cAAc,EAAE;AACrB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE;AACF,CAAC;AACD,CAAC,cAAc,GAAG,CAAC,YAAY;AAC/B,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;AACzB,GAAG,WAAW,EAAE,wBAAwB,CAAC,KAAK,CAAC;AAC/C,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,MAAM,GAAG;AACb,KAAK,SAAS,EAAE,QAAQ,CAAC,SAAS;AAClC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,aAAa,EAAE,QAAQ,CAAC,aAAa;AAC1C,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,KAAK,EAAE,QAAQ,CAAC;AACrB,KAAK;AACL,GAAG,CAAC;AACJ,GAAG,iBAAiB,GAAG;AACvB,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;AACpB,EAAE,cAAc,GAAG,IAAI;AACvB,CAAC,CAAC,CAAC;AACH;AACA,SAAS,wBAAwB,CAAC,KAAK,EAAE;AACzC,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC;AAChC;;;;"}

package/build/server/chunks/{src-DlScVN9s.js → src-Cx_5iP9B.js}

@@ -477,7 +477,7 @@ function releaseInstallLock(handle) {
 	}
 }
 //#endregion
-//#region ../lib/package.json
+//#region ../lib/src/control-plane/env.ts
 var import_main = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var fs$1 = __require("fs");
 	var path = __require("path");
@@ -745,92 +745,6 @@ var import_main = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports.populate = DotenvModule.populate;
 	module.exports = DotenvModule;
 })))();
-var package_default = {
-	version: "0.12.40"};
-//#endregion
-//#region ../lib/src/control-plane/versioning.ts
-var SEMVER_RE = /^v?\d+\.\d+\.\d+(?:[-+].*)?$/;
-/**
-* The canonical control-plane / platform version.
-*
-* This is the ONE source of truth for "which @openpalm/lib (and therefore which
-* RELEASE_MIGRATIONS + lifecycle) is running." It travels with the data/ui
-* build (the published @openpalm/ui inlines this lib), so it self-updates in
-* place — it is NOT the Electron harness version (see
-* packages/electron/src/harness-contract.ts: HARNESS_CONTRACT_VERSION).
-*
-* Stored BARE (npm form, no `v`) because every internal consumer that stamps or
-* compares it — `.skeleton-version`, `OP_RELEASE_VERSION`, the skeleton-mismatch
-* check — wants a value that matches the bare Docker tags in `OP_*_VERSION`. The
-* `v` is re-added only at the Docker/git-tag boundary via `formatForDocker`. A
-* `v`-prefixed PLATFORM_VERSION was the source of a false-mismatch bug class
-* ("v0.12.37" stamp vs "0.12.37" tag).
-*/
-var PLATFORM_VERSION = normalizeVersion(package_default.version);
-function isComparableSemver(version) {
-	return !!version && SEMVER_RE.test(version.trim());
-}
-function parseComparableVersion(version) {
-	const clean = normalizeVersion(version).split("+")[0];
-	const dashIdx = clean.indexOf("-");
-	const main = dashIdx === -1 ? clean : clean.slice(0, dashIdx);
-	const prerelease = dashIdx === -1 ? null : clean.slice(dashIdx + 1);
-	const [major = 0, minor = 0, patch = 0] = main.split(".").map(Number);
-	return {
-		major,
-		minor,
-		patch,
-		prerelease
-	};
-}
-function comparePrerelease(a, b) {
-	const aParts = a.split(".");
-	const bParts = b.split(".");
-	for (let i = 0; i < Math.max(aParts.length, bParts.length); i++) {
-		if (i >= aParts.length) return -1;
-		if (i >= bParts.length) return 1;
-		const aNum = Number(aParts[i]);
-		const bNum = Number(bParts[i]);
-		const aIsNum = !Number.isNaN(aNum);
-		const bIsNum = !Number.isNaN(bNum);
-		if (aIsNum && bIsNum) {
-			if (aNum !== bNum) return aNum > bNum ? 1 : -1;
-			continue;
-		}
-		if (aIsNum !== bIsNum) return aIsNum ? -1 : 1;
-		if (aParts[i] !== bParts[i]) return aParts[i] > bParts[i] ? 1 : -1;
-	}
-	return 0;
-}
-function compareComparableVersions(a, b) {
-	const aParsed = parseComparableVersion(a);
-	const bParsed = parseComparableVersion(b);
-	if (aParsed.major !== bParsed.major) return aParsed.major > bParsed.major ? 1 : -1;
-	if (aParsed.minor !== bParsed.minor) return aParsed.minor > bParsed.minor ? 1 : -1;
-	if (aParsed.patch !== bParsed.patch) return aParsed.patch > bParsed.patch ? 1 : -1;
-	if (aParsed.prerelease === null && bParsed.prerelease !== null) return 1;
-	if (aParsed.prerelease !== null && bParsed.prerelease === null) return -1;
-	if (aParsed.prerelease !== null && bParsed.prerelease !== null) return comparePrerelease(aParsed.prerelease, bParsed.prerelease);
-	return 0;
-}
-/**
-* npm/display form: strip a single leading `v` and trim. `v0.12.0` → `0.12.0`.
-* Pass-through for an already-bare version. Empty/whitespace → ''.
-*/
-function normalizeVersion(version) {
-	return (version ?? "").trim().replace(/^v/, "");
-}
-/**
-* User-facing presentation form: drop the leading `v` so the UI shows one
-* canonical spelling regardless of whether the value arrived as a Docker tag or
-* an npm version. Non-semver values are returned trimmed but otherwise untouched
-* (e.g. a moving `latest`/`dev` tag).
-*/
-function formatForDisplay(version) {
-	return normalizeVersion(version);
-}
-//#endregion
-//#region ../lib/src/control-plane/env.ts
 function parseEnvContent(content) {
 	return (0, import_main.parse)(content);
 }
@@ -1067,6 +981,92 @@ function nonSensitiveAddonEnvKeys() {
 	}
 	return keys;
 }
+var package_default = {
+	version: "0.12.42"};
+//#endregion
+//#region ../lib/src/control-plane/versioning.ts
+var SEMVER_RE = /^v?\d+\.\d+\.\d+(?:[-+].*)?$/;
+/**
+* The canonical control-plane / platform version.
+*
+* This is the ONE source of truth for "which @openpalm/lib (and therefore which
+* RELEASE_MIGRATIONS + lifecycle) is running." It travels with the data/ui
+* build (the published @openpalm/ui inlines this lib), so it self-updates in
+* place — it is NOT the Electron harness version (see
+* packages/electron/src/harness-contract.ts: HARNESS_CONTRACT_VERSION).
+*
+* Stored BARE (npm form, no `v`) — the canonical spelling everywhere. Docker
+* image tags, git tags, `.skeleton-version`, `OP_RELEASE_VERSION`, and
+* `OP_*_VERSION` are all bare as of 0.12.41 (the `v` prefix was retired); reads
+* still tolerate a legacy leading `v` via `normalizeVersion`. A `v`-prefixed
+* PLATFORM_VERSION was the source of a false-mismatch bug class ("v0.12.37"
+* stamp vs "0.12.37" tag).
+*/
+var PLATFORM_VERSION = normalizeVersion(package_default.version);
+function isComparableSemver(version) {
+	return !!version && SEMVER_RE.test(version.trim());
+}
+function parseComparableVersion(version) {
+	const clean = normalizeVersion(version).split("+")[0];
+	const dashIdx = clean.indexOf("-");
+	const main = dashIdx === -1 ? clean : clean.slice(0, dashIdx);
+	const prerelease = dashIdx === -1 ? null : clean.slice(dashIdx + 1);
+	const [major = 0, minor = 0, patch = 0] = main.split(".").map(Number);
+	return {
+		major,
+		minor,
+		patch,
+		prerelease
+	};
+}
+function comparePrerelease(a, b) {
+	const aParts = a.split(".");
+	const bParts = b.split(".");
+	for (let i = 0; i < Math.max(aParts.length, bParts.length); i++) {
+		if (i >= aParts.length) return -1;
+		if (i >= bParts.length) return 1;
+		const aNum = Number(aParts[i]);
+		const bNum = Number(bParts[i]);
+		const aIsNum = !Number.isNaN(aNum);
+		const bIsNum = !Number.isNaN(bNum);
+		if (aIsNum && bIsNum) {
+			if (aNum !== bNum) return aNum > bNum ? 1 : -1;
+			continue;
+		}
+		if (aIsNum !== bIsNum) return aIsNum ? -1 : 1;
+		if (aParts[i] !== bParts[i]) return aParts[i] > bParts[i] ? 1 : -1;
+	}
+	return 0;
+}
+function compareComparableVersions(a, b) {
+	const aParsed = parseComparableVersion(a);
+	const bParsed = parseComparableVersion(b);
+	if (aParsed.major !== bParsed.major) return aParsed.major > bParsed.major ? 1 : -1;
+	if (aParsed.minor !== bParsed.minor) return aParsed.minor > bParsed.minor ? 1 : -1;
+	if (aParsed.patch !== bParsed.patch) return aParsed.patch > bParsed.patch ? 1 : -1;
+	if (aParsed.prerelease === null && bParsed.prerelease !== null) return 1;
+	if (aParsed.prerelease !== null && bParsed.prerelease === null) return -1;
+	if (aParsed.prerelease !== null && bParsed.prerelease !== null) return comparePrerelease(aParsed.prerelease, bParsed.prerelease);
+	return 0;
+}
+/**
+* Canonical bare form: strip a single legacy leading `v` and trim. `v0.12.0` →
+* `0.12.0`. Pass-through for an already-bare version. Empty/whitespace → ''.
+* This is the form written to stack.env (`OP_*_VERSION`), used as the Docker
+* image tag, and stamped into `.skeleton-version`.
+*/
+function normalizeVersion(version) {
+	return (version ?? "").trim().replace(/^v/, "");
+}
+/**
+* User-facing presentation form: drop the leading `v` so the UI shows one
+* canonical spelling regardless of whether the value arrived as a Docker tag or
+* an npm version. Non-semver values are returned trimmed but otherwise untouched
+* (e.g. a moving `latest`/`dev` tag).
+*/
+function formatForDisplay(version) {
+	return normalizeVersion(version);
+}
 //#endregion
 //#region ../lib/src/control-plane/addon-ids.ts
 /**
@@ -10399,5 +10399,5 @@ function collectBindAddressWarnings(env) {
 	return warnings;
 }
 
-export { formatForDisplay as $, AKM_USER_ENV_REF as A, BackupSpaceError as B, CORE_SERVICES as C, DOCKER_IMAGE_NAMES as D, composeStop as E, composeUp as F, createLogger as G, createOpenCodeClient as H, INSTALL_LOCK_STALE_AFTER_MS as I, createState as J, deleteUserEnvKey as K, deriveLaunchStatus as L, MigrationError as M, deriveLocalStackState as N, detectGpu as O, PLATFORM_VERSION as P, detectHostOpenCode as Q, detectLocalProviders as R, SERVICE_VERSION_KEYS as S, detectRuntime as T, disableHostAkmSharing as U, dismissSecretStripNotice as V, enableHostAkmSharing as W, ensureAkmUserEnv as X, ensureMigrated as Y, executeAutomation as Z, fetchProviderModels as _, addonProfileId as a, getAddonProfileAvailability as a0, getAddonProfileSelection as a1, getAddonProfiles as a2, getAddonServiceNames as a3, getAkmStats as a4, getDockerEvents as a5, getHostAkmSharingStatus as a6, getRegistryAddonConfig as a7, hostAkmStashPath as a8, importHostOpenCode as a9, readTaskFile as aA, readUserEnvFile as aB, readVersions as aC, recommendSetup as aD, removeSecretFile as aE, removeTaskFile as aF, resolveComposeProjectName as aG, resolveDataDir as aH, resolveDeployJournalPath as aI, resolveStackDir as aJ, runAssistantAkmCommand as aK, runDeploy as aL, seedUiBuild as aM, setAddonEnabled as aN, setAddonProfileSelection as aO, summarizeBackups as aP, summarizeComposeStderr as aQ, unlockInstallLock as aR, useExistingProviderForAssistantCli as aS, validateProposedState as aT, writeFileAtomic as aU, writeSecretFile as aV, writeStackSecretEnv as aW, writeTaskFile as aX, writeUserEnvKey as aY, writeVersions as aZ, writeVoiceVars as a_, inspectInstallLock as aa, isAllowedService as ab, isSetupComplete as ac, isSkeletonStale as ad, listAssistantCliTools as ae, listAvailableAddonIds as af, listBackupDirs as ag, listEnabledAddonIds as ah, listSecretFiles as ai, loadAutomations as aj, mapDockerError as ak, markSetupComplete as al, mergeEnvContent as am, parseComposeStderr as an, parseEnvFile as ao, patchSecretsEnvFile as ap, performSetup as aq, pruneBackupDirs as ar, readAutomationLogs as as, readDeployJournal as at, readSecret as au, readSecretFile as av, readSecretStripNotice as aw, readStackEnv as ax, readStackRuntimeEnv as ay, readStackSecretEnv as az, annotateAddonProfileAvailability as b, applyHomeReconcile as c, applyInstall as d, applyUninstall as e, applyUpdate as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, backupSetupInputs as j, buildAkmEndpoint as k, buildAkmEnv as l, buildComposeOptions as m, buildManagedServices as n, checkDocker as o, checkDockerCompose as p, classifyLocalInstall as q, collectBindAddressWarnings as r, composeDown as s, composeLogs as t, composePreflight as u, composePs as v, composePull as w, composeRestart as x, composeStart as y, composeStats as z };
-//# sourceMappingURL=src-DlScVN9s.js.map
+export { fetchProviderModels as $, AKM_USER_ENV_REF as A, BackupSpaceError as B, CORE_SERVICES as C, DOCKER_IMAGE_NAMES as D, composeStats as E, composeStop as F, composeUp as G, createLogger as H, INSTALL_LOCK_STALE_AFTER_MS as I, createOpenCodeClient as J, createState as K, deleteUserEnvKey as L, MigrationError as M, deriveLaunchStatus as N, deriveLocalStackState as O, PLATFORM_VERSION as P, detectGpu as Q, detectHostOpenCode as R, SERVICE_VERSION_KEYS as S, detectLocalProviders as T, detectRuntime as U, disableHostAkmSharing as V, dismissSecretStripNotice as W, enableHostAkmSharing as X, ensureAkmUserEnv as Y, ensureMigrated as Z, executeAutomation as _, addonProfileId as a, writeVersions as a$, formatForDisplay as a0, getAddonProfileAvailability as a1, getAddonProfileSelection as a2, getAddonProfiles as a3, getAddonServiceNames as a4, getAkmStats as a5, getDockerEvents as a6, getHostAkmSharingStatus as a7, getRegistryAddonConfig as a8, hostAkmStashPath as a9, readStackRuntimeEnv as aA, readStackSecretEnv as aB, readTaskFile as aC, readUserEnvFile as aD, readVersions as aE, recommendSetup as aF, removeSecretFile as aG, removeTaskFile as aH, resolveComposeProjectName as aI, resolveDataDir as aJ, resolveDeployJournalPath as aK, resolveStackDir as aL, runAssistantAkmCommand as aM, runDeploy as aN, seedUiBuild as aO, setAddonEnabled as aP, setAddonProfileSelection as aQ, summarizeBackups as aR, summarizeComposeStderr as aS, unlockInstallLock as aT, useExistingProviderForAssistantCli as aU, validateProposedState as aV, writeFileAtomic as aW, writeSecretFile as aX, writeStackSecretEnv as aY, writeTaskFile as aZ, writeUserEnvKey as a_, importHostOpenCode as aa, inspectInstallLock as ab, isAllowedService as ac, isSetupComplete as ad, isSkeletonStale as ae, listAssistantCliTools as af, listAvailableAddonIds as ag, listBackupDirs as ah, listEnabledAddonIds as ai, listSecretFiles as aj, loadAutomations as ak, mapDockerError as al, markSetupComplete as am, mergeEnvContent as an, normalizeVersion as ao, parseComposeStderr as ap, parseEnvFile as aq, patchSecretsEnvFile as ar, performSetup as as, pruneBackupDirs as at, readAutomationLogs as au, readDeployJournal as av, readSecret as aw, readSecretFile as ax, readSecretStripNotice as ay, readStackEnv as az, annotateAddonProfileAvailability as b, writeVoiceVars as b0, applyHomeReconcile as c, applyInstall as d, applyUninstall as e, applyUpdate as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, backupSetupInputs as j, buildAkmEndpoint as k, buildAkmEnv as l, buildComposeOptions as m, buildManagedServices as n, checkDocker as o, checkDockerCompose as p, classifyLocalInstall as q, collectBindAddressWarnings as r, compareComparableVersions as s, composeDown as t, composeLogs as u, composePreflight as v, composePs as w, composePull as x, composeRestart as y, composeStart as z };
+//# sourceMappingURL=src-Cx_5iP9B.js.map