@openpalm/ui 0.12.7 → 0.12.11

package/build/server/chunks/{session-cookie-Bc9kWbaM.js → session-cookie-BJaAqVXS.js}

@@ -1,4 +1,4 @@
-import { S as SESSION_TTL_SECONDS } from './helpers-C5ooRtVL.js';
+import { S as SESSION_TTL_SECONDS } from './helpers-TBhHA7BL.js';
 
 //#region src/lib/server/session-cookie.ts
 /**
@@ -71,4 +71,4 @@ function clearSessionCookieHeader(request) {
 }
 
 export { SESSION_COOKIE_NAME as S, clearSessionCookieHeader as c, sessionCookieHeader as s };
-//# sourceMappingURL=session-cookie-Bc9kWbaM.js.map
+//# sourceMappingURL=session-cookie-BJaAqVXS.js.map

package/build/server/chunks/{session-cookie-Bc9kWbaM.js.map → session-cookie-BJaAqVXS.js.map}

@@ -1 +1 @@
-{"version":3,"file":"session-cookie-Bc9kWbaM.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}
+{"version":3,"file":"session-cookie-BJaAqVXS.js","sources":["../../../.svelte-kit/adapter-node/chunks/session-cookie.js"],"sourcesContent":["import { m as SESSION_TTL_SECONDS } from \"./helpers.js\";\n//#region src/lib/server/session-cookie.ts\n/**\n* Single source of truth for the `op_session` cookie's Set-Cookie attributes.\n*\n* Every issuer (login, session, setup/complete) and the sliding-renewal path in\n* hooks.server.ts builds the cookie through these helpers so the attributes can\n* never drift apart. Logout uses `clearSessionCookie()` with the SAME path so\n* the browser actually drops the cookie.\n*\n* Attribute rationale:\n*  - HttpOnly       — the cookie is the only credential the browser holds; XSS\n*                     must not be able to read it.\n*  - SameSite=Lax   — the cookie must ride along on top-level GET navigations\n*                     (typing the admin URL, following a bookmark) so a valid\n*                     session loads admin with no prompt. SameSite=Strict drops\n*                     the cookie on cross-site top-level GETs (e.g. opening the\n*                     console from a link in another app on the LAN), which\n*                     would force a needless re-prompt. State-mutating requests\n*                     are independently CSRF-guarded by the Origin check\n*                     (SEC-2) in hooks.server.ts, so Lax is safe here.\n*  - Secure         — set ONLY when the request arrived over HTTPS. LAN installs\n*                     are commonly plain HTTP; hardcoding Secure would make the\n*                     browser refuse to send the cookie and break login entirely\n*                     on those deployments. We honour `x-forwarded-proto` first\n*                     (reverse-proxy TLS termination) then the request URL.\n*  - Path=/         — valid for the whole app; matched by the clear on logout.\n*  - Max-Age        — SESSION_TTL_SECONDS (14 days), in lockstep with the token expiry.\n*/\nvar SESSION_COOKIE_NAME = \"op_session\";\n/** True when the request reached us over HTTPS (direct or via TLS-terminating proxy). */\nfunction isSecureRequest(request) {\n\tconst forwarded = request.headers.get(\"x-forwarded-proto\");\n\tif (forwarded) return forwarded.split(\",\")[0].trim().toLowerCase() === \"https\";\n\ttry {\n\t\treturn new URL(request.url).protocol === \"https:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\n/**\n* Build the `Set-Cookie` value that issues/renews the session cookie.\n* `secure` is derived from the request so LAN-over-HTTP installs still work.\n*/\nfunction sessionCookieHeader(token, request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=${token}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t`Max-Age=${SESSION_TTL_SECONDS}`\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n/**\n* Build the `Set-Cookie` value that clears the session cookie (logout).\n* Must mirror name/path/attributes of the issued cookie so the browser deletes it.\n*/\nfunction clearSessionCookieHeader(request) {\n\tconst parts = [\n\t\t`${SESSION_COOKIE_NAME}=`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t\"Path=/\",\n\t\t\"Max-Age=0\"\n\t];\n\tif (isSecureRequest(request)) parts.push(\"Secure\");\n\treturn parts.join(\"; \");\n}\n//#endregion\nexport { clearSessionCookieHeader as n, sessionCookieHeader as r, SESSION_COOKIE_NAME as t };\n"],"names":[],"mappings":";;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,mBAAmB,GAAG;AAC1B;AACA,SAAS,eAAe,CAAC,OAAO,EAAE;AAClC,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3D,CAAC,IAAI,SAAS,EAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO;AAC/E,CAAC,IAAI;AACL,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC;AACjC,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,CAAC,OAAO,EAAE;AAC3C,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC3B,EAAE,UAAU;AACZ,EAAE,cAAc;AAChB,EAAE,QAAQ;AACV,EAAE;AACF,EAAE;AACF,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;AACnD,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AACxB;;;;"}

package/build/server/chunks/{setup-deploy-CghSd9qZ.js → setup-deploy-BcxKW3xV.js}

@@ -1,4 +1,4 @@
-import { j as backupSetupInputs, aW as runDeploy, aP as resolveDeployJournalPath, ak as isSetupComplete, aU as resolveStackDir, aA as readDeployJournal, as as markSetupComplete } from './src-DKq8HP_s.js';
+import { j as backupSetupInputs, aW as runDeploy, aP as resolveDeployJournalPath, ak as isSetupComplete, aU as resolveStackDir, aA as readDeployJournal, as as markSetupComplete } from './src-BrowG4c5.js';
 
 //#region src/lib/server/setup-deploy.ts
 var _state = {
@@ -72,4 +72,4 @@ function prepareSetupRestorePoint(state) {
 }
 
 export { getDeployState as g, prepareSetupRestorePoint as p, resetDeployState as r, startDeploy as s };
-//# sourceMappingURL=setup-deploy-CghSd9qZ.js.map
+//# sourceMappingURL=setup-deploy-BcxKW3xV.js.map

package/build/server/chunks/{setup-deploy-CghSd9qZ.js.map → setup-deploy-BcxKW3xV.js.map}

@@ -1 +1 @@
-{"version":3,"file":"setup-deploy-CghSd9qZ.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { A as markSetupComplete, M as resolveDeployJournalPath, N as runDeploy, ht as isSetupComplete, j as readDeployJournal, k as backupSetupInputs, nn as resolveStackDir } from \"./src.js\";\n//#region src/lib/server/setup-deploy.ts\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\timageWarning: null,\n\tphase: \"writing-config\"\n};\nvar _deployPromise = null;\nfunction deployStateFromJournal(state) {\n\tconst journal = readDeployJournal(resolveDeployJournalPath(state));\n\treturn {\n\t\tdeploying: journal.deploying,\n\t\tinterrupted: journal.interrupted,\n\t\tsetupComplete: journal.setupComplete || isSetupComplete(resolveStackDir()),\n\t\tdeployStatus: journal.deployStatus,\n\t\tdeployError: journal.deployError,\n\t\timageWarning: journal.imageWarning,\n\t\tphase: journal.phase\n\t};\n}\nfunction getDeployState(state) {\n\tif (state) _state = deployStateFromJournal(state);\n\telse if (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveStackDir())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: _state.deployStatus.map((entry) => ({ ...entry }))\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\timageWarning: null,\n\t\tphase: \"writing-config\"\n\t};\n}\nfunction startDeploy(state) {\n\tif (_deployPromise) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\treturn;\n\t}\n\t_deployPromise = (async () => {\n\t\tawait runDeploy(state, {\n\t\t\tjournalPath: resolveDeployJournalPath(state),\n\t\t\tonUpdate(progress) {\n\t\t\t\t_state = {\n\t\t\t\t\tdeploying: progress.deploying,\n\t\t\t\t\tinterrupted: progress.interrupted,\n\t\t\t\t\tsetupComplete: progress.setupComplete,\n\t\t\t\t\tdeployStatus: progress.deployStatus,\n\t\t\t\t\tdeployError: progress.deployError,\n\t\t\t\t\timageWarning: progress.imageWarning,\n\t\t\t\t\tphase: progress.phase\n\t\t\t\t};\n\t\t\t},\n\t\t\tmarkSetupComplete() {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t}\n\t\t});\n\t})().finally(() => {\n\t\t_deployPromise = null;\n\t});\n}\nfunction prepareSetupRestorePoint(state) {\n\treturn backupSetupInputs(state);\n}\n//#endregion\nexport { startDeploy as i, prepareSetupRestorePoint as n, resetDeployState as r, getDeployState as t };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,YAAY,EAAE,IAAI;AACnB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,IAAI,cAAc,GAAG,IAAI;AACzB,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;AAC9B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;AAC5E,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,KAAK,EAAE,OAAO,CAAC;AACjB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,IAAI,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAClD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AACvH,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AACjE,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,YAAY,EAAE,IAAI;AACpB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,cAAc,EAAE;AACrB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE;AACF,CAAC;AACD,CAAC,cAAc,GAAG,CAAC,YAAY;AAC/B,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;AACzB,GAAG,WAAW,EAAE,wBAAwB,CAAC,KAAK,CAAC;AAC/C,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,MAAM,GAAG;AACb,KAAK,SAAS,EAAE,QAAQ,CAAC,SAAS;AAClC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,aAAa,EAAE,QAAQ,CAAC,aAAa;AAC1C,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,KAAK,EAAE,QAAQ,CAAC;AACrB,KAAK;AACL,GAAG,CAAC;AACJ,GAAG,iBAAiB,GAAG;AACvB,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;AACpB,EAAE,cAAc,GAAG,IAAI;AACvB,CAAC,CAAC,CAAC;AACH;AACA,SAAS,wBAAwB,CAAC,KAAK,EAAE;AACzC,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC;AAChC;;;;"}
+{"version":3,"file":"setup-deploy-BcxKW3xV.js","sources":["../../../.svelte-kit/adapter-node/chunks/setup-deploy.js"],"sourcesContent":["import { A as markSetupComplete, M as resolveDeployJournalPath, N as runDeploy, ht as isSetupComplete, j as readDeployJournal, k as backupSetupInputs, nn as resolveStackDir } from \"./src.js\";\n//#region src/lib/server/setup-deploy.ts\nvar _state = {\n\tdeploying: false,\n\tsetupComplete: false,\n\tdeployStatus: [],\n\tdeployError: null,\n\timageWarning: null,\n\tphase: \"writing-config\"\n};\nvar _deployPromise = null;\nfunction deployStateFromJournal(state) {\n\tconst journal = readDeployJournal(resolveDeployJournalPath(state));\n\treturn {\n\t\tdeploying: journal.deploying,\n\t\tinterrupted: journal.interrupted,\n\t\tsetupComplete: journal.setupComplete || isSetupComplete(resolveStackDir()),\n\t\tdeployStatus: journal.deployStatus,\n\t\tdeployError: journal.deployError,\n\t\timageWarning: journal.imageWarning,\n\t\tphase: journal.phase\n\t};\n}\nfunction getDeployState(state) {\n\tif (state) _state = deployStateFromJournal(state);\n\telse if (!_state.setupComplete && !_state.deploying && isSetupComplete(resolveStackDir())) _state.setupComplete = true;\n\treturn {\n\t\t..._state,\n\t\tdeployStatus: _state.deployStatus.map((entry) => ({ ...entry }))\n\t};\n}\nfunction resetDeployState() {\n\t_state = {\n\t\tdeploying: false,\n\t\tsetupComplete: false,\n\t\tdeployStatus: [],\n\t\tdeployError: null,\n\t\timageWarning: null,\n\t\tphase: \"writing-config\"\n\t};\n}\nfunction startDeploy(state) {\n\tif (_deployPromise) {\n\t\t_state.deployError = \"install_in_progress: A deploy is already running. Wait for it to finish.\";\n\t\treturn;\n\t}\n\t_deployPromise = (async () => {\n\t\tawait runDeploy(state, {\n\t\t\tjournalPath: resolveDeployJournalPath(state),\n\t\t\tonUpdate(progress) {\n\t\t\t\t_state = {\n\t\t\t\t\tdeploying: progress.deploying,\n\t\t\t\t\tinterrupted: progress.interrupted,\n\t\t\t\t\tsetupComplete: progress.setupComplete,\n\t\t\t\t\tdeployStatus: progress.deployStatus,\n\t\t\t\t\tdeployError: progress.deployError,\n\t\t\t\t\timageWarning: progress.imageWarning,\n\t\t\t\t\tphase: progress.phase\n\t\t\t\t};\n\t\t\t},\n\t\t\tmarkSetupComplete() {\n\t\t\t\tmarkSetupComplete(state);\n\t\t\t}\n\t\t});\n\t})().finally(() => {\n\t\t_deployPromise = null;\n\t});\n}\nfunction prepareSetupRestorePoint(state) {\n\treturn backupSetupInputs(state);\n}\n//#endregion\nexport { startDeploy as i, prepareSetupRestorePoint as n, resetDeployState as r, getDeployState as t };\n"],"names":[],"mappings":";;AACA;AACA,IAAI,MAAM,GAAG;AACb,CAAC,SAAS,EAAE,KAAK;AACjB,CAAC,aAAa,EAAE,KAAK;AACrB,CAAC,YAAY,EAAE,EAAE;AACjB,CAAC,WAAW,EAAE,IAAI;AAClB,CAAC,YAAY,EAAE,IAAI;AACnB,CAAC,KAAK,EAAE;AACR,CAAC;AACD,IAAI,cAAc,GAAG,IAAI;AACzB,SAAS,sBAAsB,CAAC,KAAK,EAAE;AACvC,CAAC,MAAM,OAAO,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC,OAAO;AACR,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;AAC9B,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;AAC5E,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AAClC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;AACpC,EAAE,KAAK,EAAE,OAAO,CAAC;AACjB,EAAE;AACF;AACA,SAAS,cAAc,CAAC,KAAK,EAAE;AAC/B,CAAC,IAAI,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAClD,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,IAAI;AACvH,CAAC,OAAO;AACR,EAAE,GAAG,MAAM;AACX,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AACjE,EAAE;AACF;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,MAAM,GAAG;AACV,EAAE,SAAS,EAAE,KAAK;AAClB,EAAE,aAAa,EAAE,KAAK;AACtB,EAAE,YAAY,EAAE,EAAE;AAClB,EAAE,WAAW,EAAE,IAAI;AACnB,EAAE,YAAY,EAAE,IAAI;AACpB,EAAE,KAAK,EAAE;AACT,EAAE;AACF;AACA,SAAS,WAAW,CAAC,KAAK,EAAE;AAC5B,CAAC,IAAI,cAAc,EAAE;AACrB,EAAE,MAAM,CAAC,WAAW,GAAG,0EAA0E;AACjG,EAAE;AACF,CAAC;AACD,CAAC,cAAc,GAAG,CAAC,YAAY;AAC/B,EAAE,MAAM,SAAS,CAAC,KAAK,EAAE;AACzB,GAAG,WAAW,EAAE,wBAAwB,CAAC,KAAK,CAAC;AAC/C,GAAG,QAAQ,CAAC,QAAQ,EAAE;AACtB,IAAI,MAAM,GAAG;AACb,KAAK,SAAS,EAAE,QAAQ,CAAC,SAAS;AAClC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,aAAa,EAAE,QAAQ,CAAC,aAAa;AAC1C,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,WAAW,EAAE,QAAQ,CAAC,WAAW;AACtC,KAAK,YAAY,EAAE,QAAQ,CAAC,YAAY;AACxC,KAAK,KAAK,EAAE,QAAQ,CAAC;AACrB,KAAK;AACL,GAAG,CAAC;AACJ,GAAG,iBAAiB,GAAG;AACvB,IAAI,iBAAiB,CAAC,KAAK,CAAC;AAC5B,GAAG;AACH,GAAG,CAAC;AACJ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;AACpB,EAAE,cAAc,GAAG,IAAI;AACvB,CAAC,CAAC,CAAC;AACH;AACA,SAAS,wBAAwB,CAAC,KAAK,EAAE;AACzC,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC;AAChC;;;;"}

package/build/server/chunks/{src-DKq8HP_s.js → src-BrowG4c5.js}

@@ -278,7 +278,7 @@ var import_dist = require_dist();
 * On any unexpected error (permissions, ENOSPC, etc.) we return null so the
 * caller surfaces "install_in_progress" rather than silently fake-acquiring.
 */
-var logger$11 = createLogger("install-lock");
+var logger$12 = createLogger("install-lock");
 var STALE_AFTER_MS = 1800 * 1e3;
 function isProcessAlive(pid) {
 	try {
@@ -345,7 +345,7 @@ function acquireInstallLock(dataDir) {
 	try {
 		mkdirSync(dataDir, { recursive: true });
 	} catch (err) {
-		logger$11.warn("failed to ensure data dir for install lock", {
+		logger$12.warn("failed to ensure data dir for install lock", {
 			dataDir,
 			error: err instanceof Error ? err.message : String(err)
 		});
@@ -355,18 +355,18 @@ function acquireInstallLock(dataDir) {
 	try {
 		if (tryCreate(path)) return { path };
 	} catch (err) {
-		logger$11.warn("unexpected error acquiring install lock", {
+		logger$12.warn("unexpected error acquiring install lock", {
 			path,
 			error: err instanceof Error ? err.message : String(err)
 		});
 		return null;
 	}
 	if (!isStale(path)) return null;
-	logger$11.info("removing stale install lock and retrying acquire", { path });
+	logger$12.info("removing stale install lock and retrying acquire", { path });
 	try {
 		rmSync(path, { force: true });
 	} catch (err) {
-		logger$11.warn("failed to remove stale install lock", {
+		logger$12.warn("failed to remove stale install lock", {
 			path,
 			error: err instanceof Error ? err.message : String(err)
 		});
@@ -375,7 +375,7 @@ function acquireInstallLock(dataDir) {
 	try {
 		if (tryCreate(path)) return { path };
 	} catch (err) {
-		logger$11.warn("unexpected error re-acquiring install lock", {
+		logger$12.warn("unexpected error re-acquiring install lock", {
 			path,
 			error: err instanceof Error ? err.message : String(err)
 		});
@@ -442,9 +442,9 @@ function unlockInstallLock(dataDir) {
 	};
 	try {
 		rmSync(status.path, { force: true });
-		logger$11.info("removed stale install lock via unlock", { path: status.path });
+		logger$12.info("removed stale install lock via unlock", { path: status.path });
 	} catch (err) {
-		logger$11.warn("failed to remove stale install lock during unlock", {
+		logger$12.warn("failed to remove stale install lock during unlock", {
 			path: status.path,
 			error: err instanceof Error ? err.message : String(err)
 		});
@@ -461,7 +461,7 @@ function releaseInstallLock(handle) {
 	try {
 		rmSync(handle.path, { force: true });
 	} catch (err) {
-		logger$11.warn("failed to release install lock", {
+		logger$12.warn("failed to release install lock", {
 			path: handle.path,
 			error: err instanceof Error ? err.message : String(err)
 		});
@@ -737,7 +737,7 @@ var import_main = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = DotenvModule;
 })))();
 var package_default = {
-	version: "0.12.7"};
+	version: "0.12.11"};
 //#endregion
 //#region ../lib/src/control-plane/versioning.ts
 var SEMVER_RE = /^v?\d+\.\d+\.\d+(?:[-+].*)?$/;
@@ -1846,6 +1846,48 @@ function selectPendingLayoutMigrations(from, migrations = MIGRATIONS, ceiling =
 	if (cursor !== ceiling) throw new Error(`Layout migration chain overshoots the target: reached ${cursor}, expected ${ceiling}. Migrations must advance one layout step at a time.`);
 	return chain;
 }
+/**
+* The hardcoded builtin addon IDs from addons.ts. Inlined here to avoid an
+* import cycle (addons.ts → config-persistence.ts → … which itself may call
+* migrations). These must stay in sync with BUILTIN_ADDONS in addons.ts.
+*/
+var KNOWN_ADDON_IDS = new Set([
+	"api",
+	"chat",
+	"discord",
+	"gateway",
+	"ollama",
+	"slack",
+	"ssh",
+	"voice"
+]);
+/**
+* Strip any addon IDs from OP_ENABLED_ADDONS that are not in the current
+* builtin addon set. Stale IDs accumulate when an addon is removed from the
+* codebase or renamed — they cause the Capabilities/Add-ons tab to show
+* phantom "enabled" entries that can never be managed.
+*
+* Idempotent: no-op when every recorded ID is still valid.
+* Non-destructive: only writes when there are stale IDs to remove.
+*/
+function purgeStaleEnabledAddons(ctx) {
+	const envPath = stackEnvFile(ctx.stashDir);
+	if (!existsSync(envPath)) return;
+	const content = readFileSync(envPath, "utf-8");
+	const match = content.match(/^OP_ENABLED_ADDONS=(.*)$/m);
+	if (!match) return;
+	const current = parseEnabledAddons(match[1]);
+	const cleaned = current.filter((id) => KNOWN_ADDON_IDS.has(id));
+	const stale = current.filter((id) => !KNOWN_ADDON_IDS.has(id));
+	if (stale.length === 0) return;
+	ctx.log(`purging stale addon IDs from OP_ENABLED_ADDONS: ${stale.join(", ")}`);
+	if (ctx.dryRun) {
+		ctx.log(`[dry-run] would set OP_ENABLED_ADDONS=${cleaned.join(",")}`);
+		return;
+	}
+	writeFile600(ctx, envPath, upsertEnvValue(content, "OP_ENABLED_ADDONS", cleaned.join(",")));
+	ctx.log(`set OP_ENABLED_ADDONS=${cleaned.join(",")}`);
+}
 var RELEASE_MIGRATIONS = [
 	{
 		version: "v0.11.5-rc.1",
@@ -1877,6 +1919,20 @@ var RELEASE_MIGRATIONS = [
 		describe: "rewrite channel_lan -> portal_net in user custom.compose.yml overlay",
 		apply: migrateCustomComposeChannelLan,
 		verify(ctx) {}
+	},
+	{
+		version: "v0.12.3-rc.1",
+		describe: "purge stale addon IDs from OP_ENABLED_ADDONS",
+		apply: purgeStaleEnabledAddons,
+		verify(ctx) {
+			if (ctx.dryRun) return;
+			const envPath = stackEnvFile(ctx.stashDir);
+			if (!existsSync(envPath)) return;
+			const match = readFileSync(envPath, "utf-8").match(/^OP_ENABLED_ADDONS=(.*)$/m);
+			if (!match) return;
+			const remaining = parseEnabledAddons(match[1]);
+			for (const id of remaining) if (!KNOWN_ADDON_IDS.has(id)) throw new Error(`post-migration check failed: stale addon ID '${id}' still in OP_ENABLED_ADDONS`);
+		}
 	}
 ];
 var RECOVERY_GUIDANCE = "Your original files were left untouched and a full backup was taken first. If something went wrong, run `openpalm rollback` to restore your previous state, or restore the backup manually (see docs/operations/backup-restore.md). You can also run `openpalm migrate --dry-run` to preview the current copy-only migration. Full guide: docs/operations/upgrade-0.10-to-0.11.md";
@@ -5150,7 +5206,7 @@ function randomHex(bytes) {
 * Env validation has moved to `akm vault` + the in-house redactor — the
 * historical `.env.schema` files (varlock format) were retired in #391.
 */
-var logger$10 = createLogger("core-assets");
+var logger$11 = createLogger("core-assets");
 var GITHUB_ASSET_TIMEOUT_MS = 1e4;
 function bundledAssetPath(relPath) {
 	return join(dirname(fileURLToPath(import.meta.url)), "../../../../.openpalm", relPath);
@@ -5164,7 +5220,7 @@ function readBundledStackAsset(name) {
 	try {
 		return readFileSync(bundledAssetPath(`config/stack/${name}`), "utf-8");
 	} catch (err) {
-		logger$10.warn("bundled stack asset unavailable (returning empty)", {
+		logger$11.warn("bundled stack asset unavailable (returning empty)", {
 			name,
 			error: err instanceof Error ? err.message : String(err)
 		});
@@ -5262,7 +5318,7 @@ function refreshCoreAssetsFromSource(sourceRoot, homeDir = resolveOpenPalmHome()
 			const currentContent = readFileSync(targetPath, "utf-8");
 			if (sha256(currentContent) === sha256(freshContent)) continue;
 			if (!isUnmodifiedDefault(asset.relPath, currentContent)) {
-				logger$10.info("guardian managed asset kept (user-modified); new default available", {
+				logger$11.info("guardian managed asset kept (user-modified); new default available", {
 					path: asset.relPath,
 					hint: "Remove the file or restore the shipped default to pick up the new version on the next refresh."
 				});
@@ -5312,7 +5368,7 @@ async function refreshCoreAssets(version) {
 			const currentContent = readFileSync(targetPath, "utf-8");
 			if (sha256(currentContent) === sha256(freshContent)) continue;
 			if (!isUnmodifiedDefault(asset.relPath, currentContent)) {
-				logger$10.info("guardian managed asset kept (user-modified); new default available", {
+				logger$11.info("guardian managed asset kept (user-modified); new default available", {
 					path: asset.relPath,
 					hint: "Remove the file or restore the shipped default to pick up the new version on the next refresh."
 				});
@@ -5353,7 +5409,7 @@ async function refreshCoreAssets(version) {
 *   4. null → remote download (the UI build from the @openpalm/ui npm registry
 *      tarball; the .openpalm skeleton from the GitHub repo tarball)
 */
-var logger$9 = createLogger("lib:ui-assets");
+var logger$10 = createLogger("lib:ui-assets");
 async function fetchWithRetry(url, retries = 3) {
 	for (let i = 0; i < retries; i++) try {
 		const res = await fetch(url, { signal: AbortSignal.timeout(6e4) });
@@ -5448,7 +5504,7 @@ async function downloadNpmUiBundle(manifest, uiDir, dataDir) {
 	const data = new Uint8Array(await res.arrayBuffer());
 	if (!manifest.integrity) throw new Error(`npm manifest for ${UI_PACKAGE}@${manifest.version} has no integrity hash — refusing to install unverified`);
 	verifyNpmIntegrity(data, manifest.integrity);
-	logger$9.debug("UI bundle integrity verified", { version: manifest.version });
+	logger$10.debug("UI bundle integrity verified", { version: manifest.version });
 	const tmpTar = join(dataDir, ".ui-build.tgz.tmp");
 	const staging = join(dataDir, ".ui-build.staging");
 	try {
@@ -5491,7 +5547,7 @@ async function seedUiBuild(repoRef, dataDir, options) {
 	const uiDir = join(dataDir, "ui");
 	mkdirSync(uiDir, { recursive: true });
 	const manifest = await fetchNpmUiManifest(normalizeVersion(repoRef));
-	logger$9.debug("downloading UI build from npm", { version: manifest.version });
+	logger$10.debug("downloading UI build from npm", { version: manifest.version });
 	await downloadNpmUiBundle(manifest, uiDir, dataDir);
 }
 //#endregion
@@ -5613,7 +5669,7 @@ function removeSecretFile(stackDir, name) {
 //#region ../lib/src/control-plane/secrets.ts
 /** Secrets and capability key management. */
 var OPENCODE_STARTER_CONFIG = JSON.stringify({ $schema: "https://opencode.ai/config.json" }, null, 2) + "\n";
-var logger$8 = createLogger("secrets");
+var logger$9 = createLogger("secrets");
 var VAULT_DIR_MODE = 448;
 var VAULT_FILE_MODE = 384;
 var SECRET_ENV_KEY_RE = /(?:^OP_UI_LOGIN_PASSWORD$|^OP_OPENCODE_PASSWORD$|_API_KEY$|_TOKEN$|_SECRET$|_PASSWORD$)/;
@@ -5646,7 +5702,7 @@ function enforceVaultDirMode(vaultDir) {
 	try {
 		chmodSync(vaultDir, VAULT_DIR_MODE);
 	} catch (error) {
-		logger$8.warn("failed to enforce vault directory permissions", {
+		logger$9.warn("failed to enforce vault directory permissions", {
 			vaultDir,
 			error: error instanceof Error ? error.message : String(error)
 		});
@@ -5657,7 +5713,7 @@ function writeVaultFile(path, content) {
 	try {
 		chmodSync(path, VAULT_FILE_MODE);
 	} catch (error) {
-		logger$8.warn("failed to enforce vault file permissions", {
+		logger$9.warn("failed to enforce vault file permissions", {
 			path,
 			error: error instanceof Error ? error.message : String(error)
 		});
@@ -5724,7 +5780,7 @@ function ensureAuthJson(state) {
 			return;
 		}
 	} catch (error) {
-		logger$8.warn("failed to repair auth.json path", {
+		logger$9.warn("failed to repair auth.json path", {
 			path: authJsonPath$1,
 			error: error instanceof Error ? error.message : String(error)
 		});
@@ -5767,12 +5823,12 @@ function writeAuthJsonProviderKeys(state, providerKeys) {
 		const corruptPath = `${authJsonPath$2}.corrupt-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
 		try {
 			renameSync(authJsonPath$2, corruptPath);
-			logger$8.warn("corrupt auth.json renamed for recovery", {
+			logger$9.warn("corrupt auth.json renamed for recovery", {
 				original: authJsonPath$2,
 				renamed: corruptPath
 			});
 		} catch (renameErr) {
-			logger$8.warn("could not rename corrupt auth.json; starting fresh", {
+			logger$9.warn("could not rename corrupt auth.json; starting fresh", {
 				path: authJsonPath$2,
 				error: renameErr instanceof Error ? renameErr.message : String(renameErr)
 			});
@@ -5909,7 +5965,7 @@ var STACK_DEFAULTS = {
 * the rollback module (snapshot to OP_HOME/data/rollback/).
 */
 var DEFAULT_IMAGE_TAG = "latest";
-var logger$7 = createLogger("config-persistence");
+var logger$8 = createLogger("config-persistence");
 /**
 * Return the env files used for docker compose --env-file args.
 *
@@ -5947,7 +6003,7 @@ function writeSystemEnv(state) {
 	const { content: strippedBase, removed } = stripSecretLikeEnvKeys(base);
 	base = strippedBase;
 	if (removed.length > 0) {
-		logger$7.warn("Removed secret-looking keys from stack.env (they belong in Connections/secrets)", {
+		logger$8.warn("Removed secret-looking keys from stack.env (they belong in Connections/secrets)", {
 			removedKeys: removed,
 			stackEnvPath: systemEnvPath
 		});
@@ -5998,7 +6054,7 @@ function recordSecretStripNotice(state, newlyRemoved) {
 		mkdirSync(state.dataDir, { recursive: true });
 		writeFileSync(path, JSON.stringify(notice, null, 2));
 	} catch (e) {
-		logger$7.warn("Could not persist secret-strip notice", { error: e instanceof Error ? e.message : String(e) });
+		logger$8.warn("Could not persist secret-strip notice", { error: e instanceof Error ? e.message : String(e) });
 	}
 }
 /** Read the pending secret-strip notice, or null when there is none. */
@@ -6020,7 +6076,7 @@ function dismissSecretStripNotice(state) {
 	if (existsSync(path)) try {
 		rmSync(path);
 	} catch (e) {
-		logger$7.warn("Could not dismiss secret-strip notice", { error: e instanceof Error ? e.message : String(e) });
+		logger$8.warn("Could not dismiss secret-strip notice", { error: e instanceof Error ? e.message : String(e) });
 	}
 }
 function generateFallbackSystemEnv(state) {
@@ -6165,7 +6221,7 @@ function chownVolumeTarget(path, operatorIds) {
 	try {
 		chownSync(path, operatorIds.uid, operatorIds.gid);
 	} catch (error) {
-		logger$7.warn(`Could not chown volume target ${path} to ${operatorIds.uid}:${operatorIds.gid}: ${error instanceof Error ? error.message : String(error)}`);
+		logger$8.warn(`Could not chown volume target ${path} to ${operatorIds.uid}:${operatorIds.gid}: ${error instanceof Error ? error.message : String(error)}`);
 	}
 }
 function writeRuntimeFiles(state) {
@@ -6224,7 +6280,7 @@ function canonicalAddonProfileSelection(addon, profile) {
 * the runtime source of truth.
 */
 var VALID_NAME_RE = /^[a-z0-9][a-z0-9-]{0,62}$/;
-var logger$6 = createLogger("registry");
+var logger$7 = createLogger("registry");
 var BUILTIN_ADDONS = [
 	"api",
 	"chat",
@@ -6275,14 +6331,13 @@ function readAddonServiceNamesFromContent(composeContent, composePath, addonName
 		const entries = Object.entries(services);
 		if (!addonName) return entries.map(([name]) => name);
 		return entries.filter(([serviceName, raw]) => {
-			if (serviceName === "guardian") return false;
 			if (serviceName === addonName || serviceName.startsWith(`${addonName}-`)) return true;
 			if (!raw || typeof raw !== "object") return false;
 			const profiles = raw.profiles;
 			return Array.isArray(profiles) && profiles.some((p) => typeof p === "string" && p.startsWith(`addon.${addonName}`));
 		}).map(([serviceName]) => serviceName);
 	} catch (error) {
-		logger$6.warn("failed to parse addon compose services", {
+		logger$7.warn("failed to parse addon compose services", {
 			composePath,
 			error: error instanceof Error ? error.message : String(error)
 		});
@@ -6449,7 +6504,7 @@ function readAddonProfilesFromContent(composeContent, composePath) {
 	try {
 		parsed = (0, import_dist.parse)(composeContent);
 	} catch (error) {
-		logger$6.warn("failed to parse addon compose profiles", {
+		logger$7.warn("failed to parse addon compose profiles", {
 			composePath,
 			error: error instanceof Error ? error.message : String(error)
 		});
@@ -6905,6 +6960,10 @@ function removeTaskFile(stashDir, name) {
 function isSetupComplete(stackDir) {
 	return parseEnvFile(stackEnvPathFromStackDir(stackDir)).OP_SETUP_COMPLETE === "true";
 }
+//#endregion
+//#region ../lib/src/control-plane/docker.ts
+/** Docker integration — executes docker compose commands via execFile (no shell). */
+var logger$6 = createLogger("lib:docker");
 /** Execute docker with an argument array — no shell interpolation. */
 function run$1(args, cwd, timeoutMs = 12e4, envOverrides) {
 	return new Promise((resolve) => {
@@ -7238,6 +7297,43 @@ async function getDockerEvents(projectName, since = "1h") {
 		"json"
 	], void 0, 15e3);
 }
+/**
+* Fix root-owned bind-mount directories under OP_HOME by running a temporary
+* Docker container as root to chown them back to the operator UID:GID.
+*
+* Needed because the guardian container historically ran as root (no `user:`
+* directive), leaving data/guardian and data/logs owned by root on the host.
+* The host process cannot chown root-owned files without being root itself,
+* so we delegate to Docker — which has root access via the daemon.
+*
+* No-op on Windows or when no directories need fixing.
+*/
+async function repairRootOwnedBindMounts(homeDir) {
+	if (process.platform === "win32") return;
+	const rootOwned = [join(homeDir, "data", "guardian"), join(homeDir, "data", "logs")].filter((dir) => {
+		try {
+			return existsSync(dir) && statSync(dir).uid === 0;
+		} catch {
+			return false;
+		}
+	});
+	if (rootOwned.length === 0) return;
+	const ids = resolveOperatorIds(homeDir);
+	if (!ids) return;
+	const volumeArgs = rootOwned.flatMap((dir, i) => ["-v", `${dir}:/chown_target_${i}`]);
+	const targets = rootOwned.map((_, i) => `/chown_target_${i}`).join(" ");
+	logger$6.info(`Repairing root-owned bind mounts: ${rootOwned.map((d) => d.split("/").slice(-2).join("/")).join(", ")}`);
+	const result = await run$1([
+		"run",
+		"--rm",
+		...volumeArgs,
+		"alpine",
+		"sh",
+		"-c",
+		`chown -R ${ids.uid}:${ids.gid} ${targets}`
+	], void 0, 3e4);
+	if (!result.ok) logger$6.warn(`Could not repair root-owned bind mounts: ${result.stderr.trim()}`);
+}
 //#endregion
 //#region ../lib/src/control-plane/launch-status.ts
 /**
@@ -7775,6 +7871,7 @@ async function applyUpgrade(state, version, opts) {
 	const lock = resolveLifecycleLock(state, opts);
 	if (!lock) throw new Error("Another install is already in progress");
 	try {
+		await repairRootOwnedBindMounts(state.homeDir);
 		const { backupDir, updated } = await refreshCoreAssets(version);
 		return {
 			backupDir,
@@ -10497,4 +10594,4 @@ function collectBindAddressWarnings(env) {
 }
 
 export { ensureReleaseMigrated as $, AKM_USER_ENV_REF as A, BackupSpaceError as B, CORE_SERVICES as C, DowngradeConfirmationRequired as D, composeStop as E, composeUp as F, createLogger as G, createOpenCodeClient as H, INSTALL_LOCK_STALE_AFTER_MS as I, createState as J, deleteUserEnvKey as K, deriveLaunchStatus as L, MigrationError as M, deriveLocalStackState as N, detectGpu as O, PLATFORM_VERSION as P, detectHostOpenCode as Q, detectLocalProviders as R, detectRuntime as S, disableHostAkmSharing as T, dismissSecretStripNotice as U, enableHostAkmSharing as V, ensureAkmUserEnv as W, ensureHomeDirs as X, ensureMigrated as Y, ensureOpenCodeConfig as Z, ensureOpenCodeSystemConfig as _, addonProfileId as a, summarizeComposeStderr as a$, ensureSecrets as a0, executeAutomation as a1, fetchProviderModels as a2, formatForDisplay as a3, getAddonProfileAvailability as a4, getAddonProfileSelection as a5, getAddonProfiles as a6, getAddonServiceNames as a7, getAkmStats as a8, getDockerEvents as a9, readDeployJournal as aA, readSecret as aB, readSecretFile as aC, readSecretStripNotice as aD, readStackEnv as aE, readStackRuntimeEnv as aF, readStackSecretEnv as aG, readTaskFile as aH, readUserEnvFile as aI, recommendSetup as aJ, removeSecretFile as aK, removeTaskFile as aL, resolveComposeProjectName as aM, resolveDataDir as aN, resolveDefaultMigrateTarget as aO, resolveDeployJournalPath as aP, resolveEffectivePlatformImageTag as aQ, resolveLatestPlatformTag as aR, resolveLatestPlatformTagForCurrentMajor as aS, resolveRuntimeFiles as aT, resolveStackDir as aU, runAssistantAkmCommand as aV, runDeploy as aW, seedUiBuild as aX, setAddonEnabled as aY, setAddonProfileSelection as aZ, summarizeBackups as a_, getHostAkmSharingStatus as aa, getRegistryAddonConfig as ab, hostAkmStashPath as ac, importHostOpenCode as ad, initializeStateSecrets as ae, inspectInstallLock as af, isAllowedService as ag, isComparableSemver as ah, isHostAkmAvailable as ai, isPrerelease as aj, isSetupComplete as ak, listAssistantCliTools as al, listAvailableAddonIds as am, listBackupDirs as an, listEnabledAddonIds as ao, listSecretFiles as ap, loadAutomations as aq, mapDockerError as ar, markSetupComplete as as, parseComposeStderr as at, parseEnvFile as au, patchSecretsEnvFile as av, performSetup as aw, performUpgrade as ax, pruneBackupDirs as ay, readAutomationLogs as az, annotateAddonProfileAvailability as b, unlockInstallLock as b0, useExistingProviderForAssistantCli as b1, validateProposedState as b2, writeFileAtomic as b3, writeRuntimeFiles as b4, writeSecretFile as b5, writeStackSecretEnv as b6, writeTaskFile as b7, writeUserEnvKey as b8, writeVoiceVars as b9, applyInstall as c, applyTagChange as d, applyUninstall as e, applyUpdate as f, assertSafeSecretFilename as g, assertSafeTaskFilename as h, authJsonPath as i, backupSetupInputs as j, buildAkmEndpoint as k, buildAkmEnv as l, buildComposeOptions as m, buildManagedServices as n, checkDocker as o, checkDockerCompose as p, classifyLocalInstall as q, collectBindAddressWarnings as r, composeDown as s, composeLogs as t, composePreflight as u, composePs as v, composePull as w, composeRestart as x, composeStart as y, composeStats as z };
-//# sourceMappingURL=src-DKq8HP_s.js.map
+//# sourceMappingURL=src-BrowG4c5.js.map