@openpalm/ui 0.12.44 → 0.12.46

package/build/server/chunks/{session-cookie-DErsjR7e.js → session-cookie-Dpvcmedh.js}

@@ -1,4 +1,4 @@
-import { S as SESSION_TTL_SECONDS } from './helpers-13WhVOMk.js';
+import { S as SESSION_TTL_SECONDS } from './helpers-Du6wAFM1.js';
 
 //#region src/lib/server/session-cookie.ts
 /**
@@ -71,4 +71,4 @@ function clearSessionCookieHeader(request) {
 }
 
 export { SESSION_COOKIE_NAME as S, clearSessionCookieHeader as c, sessionCookieHeader as s };
-//# sourceMappingURL=session-cookie-DErsjR7e.js.map
+//# sourceMappingURL=session-cookie-Dpvcmedh.js.map

package/build/server/chunks/{session-cookie-DErsjR7e.js.map → session-cookie-Dpvcmedh.js.map}

@@ -1 +1 @@
-{"version":3,"file":"session-cookie-DErsjR7e.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}
+{"version":3,"file":"session-cookie-Dpvcmedh.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}

package/build/server/chunks/{setup-deploy-D9VREk8i.js → setup-deploy-CqKISPMu.js}

@@ -1,4 +1,4 @@
-import { j as backupSetupInputs, aM as runDeploy, aJ as resolveDeployJournalPath, aa as isSetupComplete, aK as resolveOpenPalmHome, at as readDeployJournal, aj as markSetupComplete } from './src-NhUHZOQF.js';
+import { j as backupSetupInputs, aM as runDeploy, aJ as resolveDeployJournalPath, aa as isSetupComplete, aK as resolveOpenPalmHome, at as readDeployJournal, aj as markSetupComplete } from './src-DfLnu33Z.js';
 
 //#region src/lib/server/setup-deploy.ts
 var _state = {
@@ -72,4 +72,4 @@ function prepareSetupRestorePoint(state) {
 }
 
 export { getDeployState as g, prepareSetupRestorePoint as p, resetDeployState as r, startDeploy as s };
-//# sourceMappingURL=setup-deploy-D9VREk8i.js.map
+//# sourceMappingURL=setup-deploy-CqKISPMu.js.map

package/build/server/chunks/{setup-deploy-D9VREk8i.js.map → setup-deploy-CqKISPMu.js.map}

@@ -1 +1 @@
-{"version":3,"file":"setup-deploy-D9VREk8i.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { A as readDeployJournal, M as runDeploy, O as backupSetupInputs, dt as isSetupComplete, j as resolveDeployJournalPath, k as markSetupComplete, sn as resolveOpenPalmHome } from \"./src.js\";\n//#region src/lib/server/setup-deploy.ts\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\timageWarning: null,\n\tphase: \"writing-config\"\n};\nvar _deployPromise = null;\nfunction deployStateFromJournal(state) {\n\tconst journal = readDeployJournal(resolveDeployJournalPath(state));\n\treturn {\n\t\tdeploying: journal.deploying,\n\t\tinterrupted: journal.interrupted,\n\t\tsetupComplete: journal.setupComplete || isSetupComplete(resolveOpenPalmHome()),\n\t\tdeployStatus: journal.deployStatus,\n\t\tdeployError: journal.deployError,\n\t\timageWarning: journal.imageWarning,\n\t\tphase: journal.phase\n\t};\n}\nfunction getDeployState(state) {\n\tif (state) _state = deployStateFromJournal(state);\n\telse if (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveOpenPalmHome())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: _state.deployStatus.map((entry) => ({ ...entry }))\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\timageWarning: null,\n\t\tphase: \"writing-config\"\n\t};\n}\nfunction startDeploy(state) {\n\tif (_deployPromise) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\treturn;\n\t}\n\t_deployPromise = (async () => {\n\t\tawait runDeploy(state, {\n\t\t\tjournalPath: resolveDeployJournalPath(state),\n\t\t\tonUpdate(progress) {\n\t\t\t\t_state = {\n\t\t\t\t\tdeploying: progress.deploying,\n\t\t\t\t\tinterrupted: progress.interrupted,\n\t\t\t\t\tsetupComplete: progress.setupComplete,\n\t\t\t\t\tdeployStatus: progress.deployStatus,\n\t\t\t\t\tdeployError: progress.deployError,\n\t\t\t\t\timageWarning: progress.imageWarning,\n\t\t\t\t\tphase: progress.phase\n\t\t\t\t};\n\t\t\t},\n\t\t\tmarkSetupComplete() {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t}\n\t\t});\n\t})().finally(() => {\n\t\t_deployPromise = null;\n\t});\n}\nfunction prepareSetupRestorePoint(state) {\n\treturn backupSetupInputs(state);\n}\n//#endregion\nexport { startDeploy as i, prepareSetupRestorePoint as n, resetDeployState as r, getDeployState as t };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,YAAY,EAAE,IAAI;AACnB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,IAAI,cAAc,GAAG,IAAI;AACzB,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;AAC9B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAC;AAChF,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,KAAK,EAAE,OAAO,CAAC;AACjB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,IAAI,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAClD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AAC3H,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AACjE,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,YAAY,EAAE,IAAI;AACpB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,cAAc,EAAE;AACrB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE;AACF,CAAC;AACD,CAAC,cAAc,GAAG,CAAC,YAAY;AAC/B,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;AACzB,GAAG,WAAW,EAAE,wBAAwB,CAAC,KAAK,CAAC;AAC/C,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,MAAM,GAAG;AACb,KAAK,SAAS,EAAE,QAAQ,CAAC,SAAS;AAClC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,aAAa,EAAE,QAAQ,CAAC,aAAa;AAC1C,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,KAAK,EAAE,QAAQ,CAAC;AACrB,KAAK;AACL,GAAG,CAAC;AACJ,GAAG,iBAAiB,GAAG;AACvB,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;AACpB,EAAE,cAAc,GAAG,IAAI;AACvB,CAAC,CAAC,CAAC;AACH;AACA,SAAS,wBAAwB,CAAC,KAAK,EAAE;AACzC,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC;AAChC;;;;"}
+{"version":3,"file":"setup-deploy-CqKISPMu.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { A as readDeployJournal, M as runDeploy, O as backupSetupInputs, dt as isSetupComplete, j as resolveDeployJournalPath, k as markSetupComplete, sn as resolveOpenPalmHome } from \"./src.js\";\n//#region src/lib/server/setup-deploy.ts\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\timageWarning: null,\n\tphase: \"writing-config\"\n};\nvar _deployPromise = null;\nfunction deployStateFromJournal(state) {\n\tconst journal = readDeployJournal(resolveDeployJournalPath(state));\n\treturn {\n\t\tdeploying: journal.deploying,\n\t\tinterrupted: journal.interrupted,\n\t\tsetupComplete: journal.setupComplete || isSetupComplete(resolveOpenPalmHome()),\n\t\tdeployStatus: journal.deployStatus,\n\t\tdeployError: journal.deployError,\n\t\timageWarning: journal.imageWarning,\n\t\tphase: journal.phase\n\t};\n}\nfunction getDeployState(state) {\n\tif (state) _state = deployStateFromJournal(state);\n\telse if (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveOpenPalmHome())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: _state.deployStatus.map((entry) => ({ ...entry }))\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\timageWarning: null,\n\t\tphase: \"writing-config\"\n\t};\n}\nfunction startDeploy(state) {\n\tif (_deployPromise) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\treturn;\n\t}\n\t_deployPromise = (async () => {\n\t\tawait runDeploy(state, {\n\t\t\tjournalPath: resolveDeployJournalPath(state),\n\t\t\tonUpdate(progress) {\n\t\t\t\t_state = {\n\t\t\t\t\tdeploying: progress.deploying,\n\t\t\t\t\tinterrupted: progress.interrupted,\n\t\t\t\t\tsetupComplete: progress.setupComplete,\n\t\t\t\t\tdeployStatus: progress.deployStatus,\n\t\t\t\t\tdeployError: progress.deployError,\n\t\t\t\t\timageWarning: progress.imageWarning,\n\t\t\t\t\tphase: progress.phase\n\t\t\t\t};\n\t\t\t},\n\t\t\tmarkSetupComplete() {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t}\n\t\t});\n\t})().finally(() => {\n\t\t_deployPromise = null;\n\t});\n}\nfunction prepareSetupRestorePoint(state) {\n\treturn backupSetupInputs(state);\n}\n//#endregion\nexport { startDeploy as i, prepareSetupRestorePoint as n, resetDeployState as r, getDeployState as t };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,YAAY,EAAE,IAAI;AACnB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,IAAI,cAAc,GAAG,IAAI;AACzB,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;AAC9B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAC;AAChF,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,KAAK,EAAE,OAAO,CAAC;AACjB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,IAAI,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAClD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AAC3H,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AACjE,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,YAAY,EAAE,IAAI;AACpB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,cAAc,EAAE;AACrB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE;AACF,CAAC;AACD,CAAC,cAAc,GAAG,CAAC,YAAY;AAC/B,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;AACzB,GAAG,WAAW,EAAE,wBAAwB,CAAC,KAAK,CAAC;AAC/C,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,MAAM,GAAG;AACb,KAAK,SAAS,EAAE,QAAQ,CAAC,SAAS;AAClC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,aAAa,EAAE,QAAQ,CAAC,aAAa;AAC1C,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,KAAK,EAAE,QAAQ,CAAC;AACrB,KAAK;AACL,GAAG,CAAC;AACJ,GAAG,iBAAiB,GAAG;AACvB,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;AACpB,EAAE,cAAc,GAAG,IAAI;AACvB,CAAC,CAAC,CAAC;AACH;AACA,SAAS,wBAAwB,CAAC,KAAK,EAAE;AACzC,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC;AAChC;;;;"}

package/build/server/chunks/{src-NhUHZOQF.js → src-DfLnu33Z.js}

@@ -3242,8 +3242,11 @@ function ensureHomeDirs() {
 		`${home}/state`
 	]) mkdirSync(dir, { recursive: true });
 }
+var package_default = {
+	version: "0.12.46"};
 //#endregion
 //#region ../lib/src/control-plane/versioning.ts
+var SEMVER_RE = /^v?\d+\.\d+\.\d+(?:[-+].*)?$/;
 /**
 * The canonical control-plane / platform version.
 *
@@ -3260,8 +3263,10 @@ function ensureHomeDirs() {
 * PLATFORM_VERSION was the source of a false-mismatch bug class ("v0.12.37"
 * stamp vs "0.12.37" tag).
 */
-var PLATFORM_VERSION = normalizeVersion({
-	version: "0.12.44"}.version);
+var PLATFORM_VERSION = normalizeVersion(package_default.version);
+function isComparableSemver(version) {
+	return !!version && SEMVER_RE.test(version.trim());
+}
 function parseComparableVersion(version) {
 	const clean = normalizeVersion(version).split("+")[0];
 	const dashIdx = clean.indexOf("-");
@@ -3315,6 +3320,21 @@ function normalizeVersion(version) {
 	return (version ?? "").trim().replace(/^v/, "");
 }
 /**
+* True when `version` carries a semver pre-release segment (`0.12.0-rc.1`).
+* Build metadata (`+build.5`) is NOT a pre-release. Non-semver → false.
+*/
+function isPrerelease(version) {
+	if (!isComparableSemver(version)) return false;
+	return parseComparableVersion(version).prerelease !== null;
+}
+/**
+* The npm dist-tag channel a release stream tracks: prereleases ride `next`,
+* stable rides `latest`. Canonical home for the prerelease→channel mapping.
+*/
+function distTagForVersion(version) {
+	return isPrerelease(version) ? "next" : "latest";
+}
+/**
 * User-facing presentation form: drop the leading `v` so the UI shows one
 * canonical spelling regardless of whether the value arrived as a Docker tag or
 * an npm version. Non-semver values are returned trimmed but otherwise untouched
@@ -3536,22 +3556,36 @@ function resolveLocalOpenpalmDir() {
 * unconditionally is both correct and simpler. Changed managed files are backed
 * up first by overwriteSystemTree.
 */
-async function applyHomeSeed(repoRef, homeDir, _configDir, _dataDir) {
-	const local = resolveLocalOpenpalmDir();
-	if (local) {
+async function applyHomeSeed(repoRef, homeDir, _configDir, dataDir) {
+	let local = resolveLocalOpenpalmDir();
+	let staged = null;
+	if (!local) {
+		logger$12.debug("no local skeleton found — downloading @openpalm/skeleton from npm", { repoRef });
+		try {
+			staged = await fetchRemoteSkeleton(repoRef, dataDir);
+		} catch (err) {
+			throw new Error(`Could not obtain @openpalm/skeleton: ${err instanceof Error ? err.message : String(err)}. Check network access, or set OPENPALM_REPO_ROOT to a source checkout for development.`);
+		}
+		local = staged;
+	}
+	try {
 		const { updated, backupDir } = overwriteSystemTree(local, homeDir);
 		if (updated.length) logger$12.debug("overwrote managed system/ tree", { refreshed: updated });
-		logger$12.debug("seeding .openpalm from local source", {
+		logger$12.debug("seeding .openpalm from skeleton source", {
 			src: local,
 			repoRef
 		});
-		copyTree(local, homeDir);
+		copyTree(local, homeDir, { skipExisting: true });
 		return {
 			updated,
 			backupDir
 		};
+	} finally {
+		if (staged) rmSync(staged, {
+			recursive: true,
+			force: true
+		});
 	}
-	throw new Error("Cannot locate @openpalm/skeleton. Set OPENPALM_REPO_ROOT (dev) or install @openpalm/skeleton: npm install @openpalm/skeleton@" + (process.env.OP_SKELETON_VERSION ?? process.env.PLATFORM_VERSION ?? "<version>"));
 }
 /**
 * The UI ships as `@openpalm/ui` on npm — a self-contained `adapter-node`
@@ -3567,6 +3601,36 @@ async function applyHomeSeed(repoRef, homeDir, _configDir, _dataDir) {
 var NPM_REGISTRY = "https://registry.npmjs.org";
 var UI_PACKAGE = "@openpalm/ui";
 /**
+* Read an explicitly DECLARED platform channel from the environment, if any.
+*
+* This decouples the channel from the harness/app version (§6.4 of the
+* thin-harness design): a *stable* host can opt into a `next` control plane for
+* testing by setting `OP_UI_CHANNEL=next` WITHOUT faking its app version, and
+* the choice survives the harness↔platform version split. Returns null when
+* unset/blank or not one of the two valid dist-tags (caller falls back to
+* deriving the channel from the version).
+*/
+function declaredUiChannel() {
+	const raw = (process.env.OP_UI_CHANNEL ?? "").trim().toLowerCase();
+	return raw === "latest" || raw === "next" ? raw : null;
+}
+/**
+* The npm dist-tag channel a release stream tracks: prereleases ride `next`,
+* stable rides `latest`. `@openpalm/ui` is independently versioned (it publishes
+* on its own `publish-ui.yml` workflow, like the channel adapters), so the
+* desktop/host updaters can't compare a UI version against the app version —
+* they pick the CHANNEL from the app's release stream and then resolve the
+* newest UI on that channel.
+*
+* An EXPLICITLY declared channel (`OP_UI_CHANNEL` or the `channel` argument)
+* always wins over the version-derived default, so a stable host can opt into a
+* `next` control plane without faking its version. Falls back to
+* `distTagForVersion` (the canonical prerelease→channel mapping from Stage 1).
+*/
+function uiUpdateChannel(appVersion, channel) {
+	return declaredUiChannel() ?? distTagForVersion(appVersion);
+}
+/**
 * Resolve the npm manifest for `@openpalm/ui` by exact version OR dist-tag.
 * `GET <registry>/@openpalm/ui/<version-or-tag>` returns the abbreviated
 * manifest (version + dist.tarball + dist.integrity). Throws on non-OK.
@@ -3586,6 +3650,28 @@ async function fetchNpmUiManifest(versionOrTag) {
 	};
 }
 /**
+* Resolve a channel to the npm version ref to install.
+*
+*   `latest` → the @latest dist-tag (newest STABLE) — unchanged.
+*   `next`   → the NEWEST published version across ALL dist-tags.
+*
+* Why not just `@next`: prereleases publish to a SUFFIX dist-tag (X.Y.Z-beta.N →
+* `beta`, -rc.N → `rc`), NOT a single moving `next` tag — so the `next` tag goes
+* stale (it sat at 0.12.0-rc.8 while betas shipped to `beta`). Resolving `@next`
+* therefore froze (or downgraded) the prerelease channel. Mirroring the Docker
+* resolver (which lists tags and picks the newest on-channel), take max(dist-tags)
+* = the true bleeding edge (latest beta/rc/stable, whichever is newest).
+*/
+async function resolveChannelRef(pkg, channel) {
+	if (channel === "latest") return "latest";
+	const res = await fetchWithRetry(`${NPM_REGISTRY}/-/package/${encodeURIComponent(pkg)}/dist-tags`);
+	if (!res.ok) throw new Error(`npm registry returned HTTP ${res.status} for ${pkg} dist-tags`);
+	const tags = await res.json();
+	const versions = Object.values(tags).filter((v) => typeof v === "string" && v.length > 0);
+	if (versions.length === 0) return "next";
+	return versions.reduce((newest, v) => compareComparableVersions(v, newest) > 0 ? v : newest);
+}
+/**
 * Verify a Subresource-Integrity string against the bytes. FAIL-CLOSED: a
 * present-but-wrong hash throws (the corruption / tamper case). A registry that
 * omits the hash entirely (legacy metadata) is logged and allowed — modern npm
@@ -3663,6 +3749,78 @@ async function seedUiBuild(repoRef, dataDir, options) {
 	logger$12.debug("downloading UI build from npm", { version: manifest.version });
 	await downloadNpmUiBundle(manifest, uiDir, dataDir);
 }
+var SKELETON_PACKAGE = "@openpalm/skeleton";
+async function fetchNpmSkeletonManifest(versionOrTag) {
+	const res = await fetchWithRetry(`${NPM_REGISTRY}/${SKELETON_PACKAGE}/${versionOrTag}`);
+	if (!res.ok) throw new Error(`npm registry returned HTTP ${res.status} for ${SKELETON_PACKAGE}@${versionOrTag}`);
+	const m = await res.json();
+	if (!m.version || !m.dist?.tarball) throw new Error(`npm manifest for ${SKELETON_PACKAGE}@${versionOrTag} is missing version/dist.tarball`);
+	return {
+		version: m.version,
+		tarball: m.dist.tarball,
+		integrity: m.dist.integrity ?? null
+	};
+}
+/**
+* Download `@openpalm/skeleton` from npm, verify integrity, and extract the FULL
+* skeleton tree into a fresh staging dir under `dataDir`, returning that path.
+* The tarball wraps the tree under `package/` (npm standard), so we strip 1 path
+* component to land config/, data/, knowledge/, system/, workspace/ directly in
+* staging.
+*
+* FAIL-CLOSED: throws if integrity is missing or wrong, or if the bundle is
+* missing system/stack/. On any failure the staging dir is removed; on success
+* the CALLER owns cleanup of the returned path.
+*/
+async function stageSkeletonDownload(manifest, dataDir) {
+	const res = await fetchWithRetry(manifest.tarball);
+	if (!res.ok) throw new Error(`Failed to download skeleton bundle (HTTP ${res.status})`);
+	const data = new Uint8Array(await res.arrayBuffer());
+	if (!manifest.integrity) throw new Error(`npm manifest for ${SKELETON_PACKAGE}@${manifest.version} has no integrity hash — refusing to install unverified`);
+	verifyNpmIntegrity(data, manifest.integrity);
+	logger$12.debug("skeleton bundle integrity verified", { version: manifest.version });
+	const tmpTar = join(dataDir, ".skeleton.tgz.tmp");
+	const staging = join(dataDir, ".skeleton.staging");
+	rmSync(staging, {
+		recursive: true,
+		force: true
+	});
+	mkdirSync(staging, { recursive: true });
+	try {
+		writeFileSync(tmpTar, data);
+		await fo({
+			file: tmpTar,
+			cwd: staging,
+			strip: 1
+		});
+		if (!existsSync(join(staging, "system", "stack"))) throw new Error("downloaded skeleton bundle is missing system/stack/");
+		return staging;
+	} catch (err) {
+		rmSync(staging, {
+			recursive: true,
+			force: true
+		});
+		throw err;
+	} finally {
+		rmSync(tmpTar, { force: true });
+	}
+}
+/**
+* Seed-path remote fallback for applyHomeSeed: resolve the skeleton on the
+* platform's release channel, download it, and stage the FULL tree, returning
+* that path. Mirrors seedUiBuild's local-or-download model so a packaged binary
+* never asks the user to `npm install @openpalm/skeleton` by hand. The caller
+* owns cleanup of the returned staging dir.
+*/
+async function fetchRemoteSkeleton(repoRef, dataDir) {
+	const channel = uiUpdateChannel(repoRef);
+	const manifest = await fetchNpmSkeletonManifest(await resolveChannelRef(SKELETON_PACKAGE, channel));
+	logger$12.debug("fetching @openpalm/skeleton from npm for cold-start seed", {
+		version: manifest.version,
+		channel
+	});
+	return stageSkeletonDownload(manifest, dataDir);
+}
 //#endregion
 //#region ../lib/src/control-plane/env.ts
 var import_main = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
@@ -9518,4 +9676,4 @@ function collectBindAddressWarnings(env) {
 }
 
 export { getAddonProfiles as $, AKM_USER_ENV_REF as A, composeStats as B, composeStop as C, DOCKER_IMAGE_NAMES as D, composeUp as E, createLogger as F, createOpenCodeClient as G, createState as H, INSTALL_LOCK_STALE_AFTER_MS as I, deleteUserEnvKey as J, deriveLaunchStatus as K, deriveLocalStackState as L, detectGpu as M, detectHostOpenCode as N, detectLocalProviders as O, PLATFORM_VERSION as P, detectRuntime as Q, disableHostAkmSharing as R, SERVICE_VERSION_KEYS as S, dismissSecretStripNotice as T, enableHostAkmSharing as U, ensureAkmUserEnv as V, executeAutomation as W, fetchProviderModels as X, formatForDisplay as Y, getAddonProfileAvailability as Z, getAddonProfileSelection as _, addonProfileId as a, writeUserEnvKey as a$, getAddonServiceNames as a0, getAkmStats as a1, getDockerEvents as a2, getHostAkmSharingStatus as a3, getRegistryAddonConfig as a4, getRunningImages as a5, hostAkmStashPath as a6, importHostOpenCode as a7, inspectInstallLock as a8, isAllowedService as a9, readStackSecretEnv as aA, readTaskFile as aB, readUserEnvFile as aC, readVersions as aD, recommendSetup as aE, removeSecretFile as aF, removeTaskFile as aG, resolveComposeProjectName as aH, resolveDataDir as aI, resolveDeployJournalPath as aJ, resolveOpenPalmHome as aK, runAssistantAkmCommand as aL, runDeploy as aM, seedUiBuild as aN, setAddonEnabled as aO, setAddonProfileSelection as aP, stackDirFor as aQ, stripVoiceVariantSuffix as aR, summarizeBackups as aS, unlockInstallLock as aT, useExistingProviderForAssistantCli as aU, validateProposedState as aV, writeChannelPreference as aW, writeFileAtomic as aX, writeSecretFile as aY, writeStackSecretEnv as aZ, writeTaskFile as a_, isSetupComplete as aa, isVersionKey as ab, listAssistantCliTools as ac, listAvailableAddonIds as ad, listBackupDirs as ae, listEnabledAddonIds as af, listSecretFiles as ag, loadAutomations as ah, mapDockerError as ai, markSetupComplete as aj, mergeEnvContent as ak, normalizeVersion as al, parseComposeStderr as am, parseEnvFile as an, patchSecretsEnvFile as ao, performSetup as ap, pruneBackupDirs as aq, readAutomationLogs as ar, readChannelPreference as as, readDeployJournal as at, readPinnedVersions as au, readSecret as av, readSecretFile as aw, readSecretStripNotice as ax, readStackEnv as ay, readStackRuntimeEnv as az, annotateAddonProfileAvailability as b, writeVersions as b0, writeVoiceVars as b1, applyInstall as c, applyStack as d, applyUninstall as e, applyUpdate as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, backupSetupInputs as j, buildAkmEndpoint as k, buildAkmEnv as l, buildComposeOptions as m, buildManagedServices as n, checkDocker as o, checkDockerCompose as p, classifyLocalInstall as q, collectBindAddressWarnings as r, compareComparableVersions as s, composeDown as t, composeLogs as u, composePreflight as v, composePs as w, composePull as x, composeRestart as y, composeStart as z };
-//# sourceMappingURL=src-NhUHZOQF.js.map
+//# sourceMappingURL=src-DfLnu33Z.js.map