From 737e6784f08db835de14a8148e73a308ae3f87e9 Mon Sep 17 00:00:00 2001
From: chriscrosstalk <49691103+chriscrosstalk@users.noreply.github.com>
Date: Wed, 27 May 2026 14:19:15 -0700
Subject: [PATCH 01/83] fix(logging): also write production logs to stdout for
 docker visibility (#870)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In production, the logger was configured with a single file target writing to
`/app/storage/logs/admin.log`. Because the production pino transport had no
stdout target, `docker logs nomad_admin` only saw startup banner lines from
non-pino sources — every `logger.info`/`logger.debug` call from controllers,
services, and providers was effectively invisible from outside the container.

That's been silently masking diagnostics for anyone trying to debug a running
NOMAD without exec-ing into the admin container and tailing the log file.
RAG retrieval scores, query rewrites, container preflight decisions, version
check results — all of it was there in `admin.log` but absent from any
external observation point (docker logs, container log aggregators, etc.).

This adds a second production target writing JSON to stdout (fd 1) via the
same pino/file transport. Effect: `docker logs nomad_admin` now shows the
full runtime telemetry, the persisted log file is unchanged (so Debug Info
bundle export keeps working), and external log aggregators that scrape
container stdout now have something to scrape.

Verified on NOMAD8 (v1.32.0-rc.3): post-patch `docker logs --tail 15
nomad_admin` shows the structured `{"level":30,...,"msg":"[VersionCheckProvider]
Checking for stale updateAvailable..."}` lines that previously only existed
in admin.log. File destination still receives writes (size delta confirmed
after an `/api/system/info` hit).

This is the unblock for the AI Quality eval work — without log visibility,
every diagnostic conversation about RAG retrieval and query rewriting is
guesswork.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 admin/config/logger.ts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/admin/config/logger.ts b/admin/config/logger.ts
index 981e167..3ce310e 100644
--- a/admin/config/logger.ts
+++ b/admin/config/logger.ts
@@ -18,7 +18,14 @@ const loggerConfig = defineConfig({
         targets:
           targets()
             .pushIf(!app.inProduction, targets.pretty())
+            // Production: write JSON to both the persisted log file (for Debug
+            // Info bundle export) AND stdout (so `docker logs nomad_admin` and
+            // any external log aggregator can see runtime telemetry — RAG
+            // retrieval scores, query rewrites, etc.). Writing to fd 1 via
+            // pino/file is the standard way to do this; without it, prod
+            // installs are effectively running blind from a debugger's POV.
             .pushIf(app.inProduction, targets.file({ destination: "/app/storage/logs/admin.log", mkdir: true }))
+            .pushIf(app.inProduction, targets.file({ destination: 1 }))
             .toArray(),
       },
     },

From 5bf5bc33b76ddbd21a473cf5031ebd195f1cc457 Mon Sep 17 00:00:00 2001
From: chriscrosstalk <49691103+chriscrosstalk@users.noreply.github.com>
Date: Wed, 27 May 2026 14:24:48 -0700
Subject: [PATCH 02/83] fix(KB): cursor on Always/Manual ingest policy buttons
 (#927)

Tailwind v4 dropped the default `button { cursor: pointer }` preflight
rule. The Always/Manual toggle in the KB modal uses inline <button>
elements (not the StyledButton wrapper that sets cursor-pointer
explicitly), so hovering them shows the default arrow cursor instead of
a pointer like every other clickable in the modal. Reported on NOMAD1
during v1.32.0 dogfooding.

Add cursor-pointer when not pending; keep cursor-not-allowed when the
mutation is in flight.
---
 admin/inertia/components/chat/KnowledgeBaseModal.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/admin/inertia/components/chat/KnowledgeBaseModal.tsx b/admin/inertia/components/chat/KnowledgeBaseModal.tsx
index 301bf67..4bae969 100644
--- a/admin/inertia/components/chat/KnowledgeBaseModal.tsx
+++ b/admin/inertia/components/chat/KnowledgeBaseModal.tsx
@@ -474,7 +474,7 @@ export default function KnowledgeBaseModal({ aiAssistantName = "AI Assistant", o
                         isActive
                           ? 'bg-desert-green text-white'
                           : 'bg-surface-primary text-text-secondary hover:bg-surface-tertiary'
-                      } ${updateIngestPolicyMutation.isPending ? 'opacity-50 cursor-not-allowed' : ''}`}
+                      } ${updateIngestPolicyMutation.isPending ? 'opacity-50 cursor-not-allowed' : 'cursor-pointer'}`}
                     >
                       {option}
                     </button>

From 97c65cca67b7278cf585e7418ccf0fe7111b2ef1 Mon Sep 17 00:00:00 2001
From: chriscrosstalk <49691103+chriscrosstalk@users.noreply.github.com>
Date: Wed, 27 May 2026 14:37:35 -0700
Subject: [PATCH 03/83] perf(KB): swap Qdrant full-scroll for facet on source
 enumeration (#928)

The Stored Files modal and per-file warnings panel both enumerate
distinct 'source' values in the qdrant content collection. The
existing implementation scrolls every point in the collection, 100 per
page, just to learn the unique sources. On a fully-ingested NOMAD this
is brutally slow: NOMAD3's 3.1M-point collection takes 50+ seconds to
return its ~40 distinct sources, and the same scan runs twice per modal
open (getStoredFiles + computeFileWarnings each pay it independently).

Qdrant 1.10+ supports a facet aggregation that returns the distinct
values of a payload field with their counts in a single call.
@qdrant/js-client-rest@1.16.2 (already pinned) exposes this as
`client.facet()`. Swap the three scroll loops:

- RagService.getStoredFiles
- RagService.computeFileWarnings
- RagService.\_scanAndSync (the source-set used for skip-already-embedded
  decisions)

As a bonus, computeFileWarnings's per-source chunk count comes back
inline from the facet, so the secondary scroll that was incrementing a
counter is also gone.

`exact: true` everywhere because the counts feed Warning A's
zero_chunks decision and could mis-fire near thresholds otherwise. New
RagService.FACET_SOURCE_LIMIT = 10000 caps the facet response; real
NOMADs run ~100 sources max, this is comfortable headroom.

Expected impact on NOMAD3 (3M points, 40 sources): ~50s -> ~100ms per
endpoint. On an empty/fresh KB: no measurable change either way.
---
 admin/app/services/rag_service.ts | 100 +++++++++++++-----------------
 1 file changed, 42 insertions(+), 58 deletions(-)

diff --git a/admin/app/services/rag_service.ts b/admin/app/services/rag_service.ts
index dcbbd25..2a2110b 100644
--- a/admin/app/services/rag_service.ts
+++ b/admin/app/services/rag_service.ts
@@ -46,6 +46,10 @@ export class RagService {
   public static UPLOADS_STORAGE_PATH = 'storage/kb_uploads'
   public static CONTENT_COLLECTION_NAME = 'nomad_knowledge_base'
   public static EMBEDDING_DIMENSION = 768 // Nomic Embed Text v1.5 dimension is 768
+  // Upper bound on distinct sources returned by Qdrant's facet API. Real
+  // NOMADs cap out at a few hundred ZIM files + uploaded PDFs; 10k leaves
+  // generous headroom without paying the cost of an unbounded request.
+  public static FACET_SOURCE_LIMIT = 10_000
   public static MODEL_CONTEXT_LENGTH = 2048 // nomic-embed-text has 2K token context
   public static MAX_SAFE_TOKENS = 1600 // Leave buffer for prefix and tokenization variance
   public static TARGET_TOKENS_PER_CHUNK = 1500 // Target 1500 tokens per chunk for embedding
@@ -1069,29 +1073,21 @@ export class RagService {
         RagService.EMBEDDING_DIMENSION
       )
 
+      // Use Qdrant's facet API to enumerate distinct `source` values in one
+      // call. The previous scroll-loop walked every point in the collection
+      // (3M+ on a fully-ingested NOMAD) just to learn the ~40 unique sources,
+      // which made this endpoint take 50+ seconds. Facet returns the unique
+      // values directly. `exact: true` so the count we'll reuse for warnings
+      // matches what would be reported by an exhaustive walk.
       const sources = new Set<string>()
-      let offset: string | number | null | Record<string, unknown> = null
-      const batchSize = 100
-
-      // Scroll through all points in the collection (only fetch source field)
-      do {
-        const scrollResult = await this.qdrant!.scroll(RagService.CONTENT_COLLECTION_NAME, {
-          limit: batchSize,
-          offset: offset,
-          with_payload: ['source'],
-          with_vector: false,
-        })
-
-        // Extract unique source values from payloads
-        scrollResult.points.forEach((point) => {
-          const source = point.payload?.source
-          if (source && typeof source === 'string') {
-            sources.add(source)
-          }
-        })
-
-        offset = scrollResult.next_page_offset || null
-      } while (offset !== null)
+      const facetResult = await this.qdrant!.facet(RagService.CONTENT_COLLECTION_NAME, {
+        key: 'source',
+        limit: RagService.FACET_SOURCE_LIMIT,
+        exact: true,
+      })
+      for (const hit of facetResult.hits) {
+        if (typeof hit.value === 'string') sources.add(hit.value)
+      }
 
       // Union the Qdrant-derived list with the disk-backed file paths the
       // state machine has tracked. Without this, files known to the scanner
@@ -1180,28 +1176,21 @@ export class RagService {
         RagService.EMBEDDING_DIMENSION
       )
 
-      // Per-source chunk count from a single scroll. We deliberately don't
-      // assume `kb_ingest_state.chunks_embedded` here so this PR stays
-      // independent of the state-machine PR (#888) — but a future cleanup can
-      // read from there for efficiency once both have landed.
+      // Per-source chunk count via Qdrant's facet API. Was a full scroll of
+      // every point in the collection, which on a fully-ingested NOMAD takes
+      // ~50s for a 3M-point KB just to count ~40 sources. Facet returns the
+      // distinct values + counts in a single call. `exact: true` because the
+      // counts feed Warning A's zero_chunks decision — approximate counts
+      // could mis-fire warnings near thresholds.
       const chunksBySource = new Map<string, number>()
-      let offset: string | number | null | Record<string, unknown> = null
-      const batchSize = 100
-      do {
-        const scrollResult = await this.qdrant!.scroll(RagService.CONTENT_COLLECTION_NAME, {
-          limit: batchSize,
-          offset,
-          with_payload: ['source'],
-          with_vector: false,
-        })
-        for (const point of scrollResult.points) {
-          const source = point.payload?.source
-          if (source && typeof source === 'string') {
-            chunksBySource.set(source, (chunksBySource.get(source) ?? 0) + 1)
-          }
-        }
-        offset = scrollResult.next_page_offset || null
-      } while (offset !== null)
+      const facetResult = await this.qdrant!.facet(RagService.CONTENT_COLLECTION_NAME, {
+        key: 'source',
+        limit: RagService.FACET_SOURCE_LIMIT,
+        exact: true,
+      })
+      for (const hit of facetResult.hits) {
+        if (typeof hit.value === 'string') chunksBySource.set(hit.value, hit.count)
+      }
 
       // Scan the filesystem the same way scanAndSyncStorage does so Warning A
       // can fire on files with zero qdrant points (the headline "video-only
@@ -1548,22 +1537,17 @@ export class RagService {
       )
 
       // Collect every unique `source` already in Qdrant so we can skip files
-      // that have already been embedded.
+      // that have already been embedded. Facet returns the distinct values in
+      // a single call rather than scrolling the whole collection.
       const sourcesInQdrant = new Set<string>()
-      let offset: string | number | null | Record<string, unknown> = null
-      do {
-        const scrollResult = await this.qdrant!.scroll(RagService.CONTENT_COLLECTION_NAME, {
-          limit: 100,
-          offset,
-          with_payload: ['source'],
-          with_vector: false,
-        })
-        scrollResult.points.forEach((point) => {
-          const source = point.payload?.source
-          if (source && typeof source === 'string') sourcesInQdrant.add(source)
-        })
-        offset = scrollResult.next_page_offset || null
-      } while (offset !== null)
+      const facetResult = await this.qdrant!.facet(RagService.CONTENT_COLLECTION_NAME, {
+        key: 'source',
+        limit: RagService.FACET_SOURCE_LIMIT,
+        exact: true,
+      })
+      for (const hit of facetResult.hits) {
+        if (typeof hit.value === 'string') sourcesInQdrant.add(hit.value)
+      }
 
       logger.info(`[RAG] Found ${sourcesInQdrant.size} unique sources in Qdrant`)
 

From 8d2bf785e1b21e1202aed7c8fd4da3ed12135f49 Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Wed, 27 May 2026 22:12:27 +0000
Subject: [PATCH 04/83] chore(deps): bump various deps

---
 admin/package-lock.json | 462 ++++++++++++++++++++--------------------
 admin/package.json      |  10 +-
 2 files changed, 236 insertions(+), 236 deletions(-)

diff --git a/admin/package-lock.json b/admin/package-lock.json
index a896708..9821ab4 100644
--- a/admin/package-lock.json
+++ b/admin/package-lock.json
@@ -28,7 +28,7 @@
         "@protomaps/basemaps": "5.7.0",
         "@qdrant/js-client-rest": "1.16.2",
         "@tabler/icons-react": "3.36.1",
-        "@tailwindcss/vite": "4.1.18",
+        "@tailwindcss/vite": "4.3.0",
         "@tanstack/react-query": "5.90.20",
         "@tanstack/react-query-devtools": "5.91.3",
         "@tanstack/react-virtual": "3.13.18",
@@ -45,20 +45,20 @@
         "compression": "1.8.1",
         "dockerode": "4.0.9",
         "edge.js": "6.4.0",
-        "fast-xml-parser": "5.5.9",
+        "fast-xml-parser": "5.7.0",
         "fuse.js": "7.1.0",
-        "ipaddr.js": "^2.4.0",
+        "ipaddr.js": "2.4.0",
         "jszip": "3.10.1",
         "luxon": "3.7.2",
         "maplibre-gl": "4.7.1",
         "mysql2": "3.16.2",
         "ollama": "0.6.3",
-        "openai": "6.27.0",
+        "openai": "6.38.0",
         "pdf-parse": "2.4.5",
         "pdf2pic": "3.2.0",
         "pino-pretty": "13.1.3",
         "pmtiles": "4.4.0",
-        "postcss": "8.5.6",
+        "postcss": "8.5.15",
         "react": "19.2.4",
         "react-adonis-transmit": "1.0.1",
         "react-dom": "19.2.4",
@@ -68,7 +68,7 @@
         "remark-gfm": "4.0.1",
         "sharp": "0.34.5",
         "stopword": "3.1.5",
-        "systeminformation": "5.31.0",
+        "systeminformation": "5.31.6",
         "tailwindcss": "4.2.2",
         "tar": "7.5.11",
         "tesseract.js": "7.0.0",
@@ -3360,6 +3360,18 @@
         "url": "https://paulmillr.com/funding/"
       }
     },
+    "node_modules/@nodable/entities": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@nodable/entities/-/entities-2.1.0.tgz",
+      "integrity": "sha512-nyT7T3nbMyBI/lvr6L5TyWbFJAI9FTgVRakNoBqCD+PmID8DzFrrNdLLtHMwMszOtqZa8PAOV24ZqDnQrhQINA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodable"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/@nodelib/fs.scandir": {
       "version": "2.1.5",
       "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
@@ -4590,53 +4602,53 @@
       }
     },
     "node_modules/@tailwindcss/node": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.1.18.tgz",
-      "integrity": "sha512-DoR7U1P7iYhw16qJ49fgXUlry1t4CpXeErJHnQ44JgTSKMaZUdf17cfn5mHchfJ4KRBZRFA/Coo+MUF5+gOaCQ==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.3.0.tgz",
+      "integrity": "sha512-aFb4gUhFOgdh9AXo4IzBEOzBkkAxm9VigwDJnMIYv3lcfXCJVesNfbEaBl4BNgVRyid92AmdviqwBUBRKSeY3g==",
       "license": "MIT",
       "dependencies": {
-        "@jridgewell/remapping": "^2.3.4",
-        "enhanced-resolve": "^5.18.3",
+        "@jridgewell/remapping": "^2.3.5",
+        "enhanced-resolve": "^5.21.0",
         "jiti": "^2.6.1",
-        "lightningcss": "1.30.2",
+        "lightningcss": "1.32.0",
         "magic-string": "^0.30.21",
         "source-map-js": "^1.2.1",
-        "tailwindcss": "4.1.18"
+        "tailwindcss": "4.3.0"
       }
     },
     "node_modules/@tailwindcss/node/node_modules/tailwindcss": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.1.18.tgz",
-      "integrity": "sha512-4+Z+0yiYyEtUVCScyfHCxOYP06L5Ne+JiHhY2IjR2KWMIWhJOYZKLSGZaP5HkZ8+bY0cxfzwDE5uOmzFXyIwxw==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.3.0.tgz",
+      "integrity": "sha512-y6nxMGB1nMW9R6k96e5gdIFzcfL/gTJRNaqGes1YvkLnPVXzWgbqFF2yLC0T8G774n24cx3Pe8XrKoniCOAH+Q==",
       "license": "MIT"
     },
     "node_modules/@tailwindcss/oxide": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.1.18.tgz",
-      "integrity": "sha512-EgCR5tTS5bUSKQgzeMClT6iCY3ToqE1y+ZB0AKldj809QXk1Y+3jB0upOYZrn9aGIzPtUsP7sX4QQ4XtjBB95A==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.3.0.tgz",
+      "integrity": "sha512-F7HZGBeN9I0/AuuJS5PwcD8xayx5ri5GhjYUDBEVYUkexyA/giwbDNjRVrxSezE3T250OU2K/wp/ltWx3UOefg==",
       "license": "MIT",
       "engines": {
-        "node": ">= 10"
+        "node": ">= 20"
       },
       "optionalDependencies": {
-        "@tailwindcss/oxide-android-arm64": "4.1.18",
-        "@tailwindcss/oxide-darwin-arm64": "4.1.18",
-        "@tailwindcss/oxide-darwin-x64": "4.1.18",
-        "@tailwindcss/oxide-freebsd-x64": "4.1.18",
-        "@tailwindcss/oxide-linux-arm-gnueabihf": "4.1.18",
-        "@tailwindcss/oxide-linux-arm64-gnu": "4.1.18",
-        "@tailwindcss/oxide-linux-arm64-musl": "4.1.18",
-        "@tailwindcss/oxide-linux-x64-gnu": "4.1.18",
-        "@tailwindcss/oxide-linux-x64-musl": "4.1.18",
-        "@tailwindcss/oxide-wasm32-wasi": "4.1.18",
-        "@tailwindcss/oxide-win32-arm64-msvc": "4.1.18",
-        "@tailwindcss/oxide-win32-x64-msvc": "4.1.18"
+        "@tailwindcss/oxide-android-arm64": "4.3.0",
+        "@tailwindcss/oxide-darwin-arm64": "4.3.0",
+        "@tailwindcss/oxide-darwin-x64": "4.3.0",
+        "@tailwindcss/oxide-freebsd-x64": "4.3.0",
+        "@tailwindcss/oxide-linux-arm-gnueabihf": "4.3.0",
+        "@tailwindcss/oxide-linux-arm64-gnu": "4.3.0",
+        "@tailwindcss/oxide-linux-arm64-musl": "4.3.0",
+        "@tailwindcss/oxide-linux-x64-gnu": "4.3.0",
+        "@tailwindcss/oxide-linux-x64-musl": "4.3.0",
+        "@tailwindcss/oxide-wasm32-wasi": "4.3.0",
+        "@tailwindcss/oxide-win32-arm64-msvc": "4.3.0",
+        "@tailwindcss/oxide-win32-x64-msvc": "4.3.0"
       }
     },
     "node_modules/@tailwindcss/oxide-android-arm64": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.1.18.tgz",
-      "integrity": "sha512-dJHz7+Ugr9U/diKJA0W6N/6/cjI+ZTAoxPf9Iz9BFRF2GzEX8IvXxFIi/dZBloVJX/MZGvRuFA9rqwdiIEZQ0Q==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.3.0.tgz",
+      "integrity": "sha512-TJPiq67tKlLuObP6RkwvVGDoxCMBVtDgKkLfa/uyj7/FyxvQwHS+UOnVrXXgbEsfUaMgiVvC4KbJnRr26ho4Ng==",
       "cpu": [
         "arm64"
       ],
@@ -4646,13 +4658,13 @@
         "android"
       ],
       "engines": {
-        "node": ">= 10"
+        "node": ">= 20"
       }
     },
     "node_modules/@tailwindcss/oxide-darwin-arm64": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.1.18.tgz",
-      "integrity": "sha512-Gc2q4Qhs660bhjyBSKgq6BYvwDz4G+BuyJ5H1xfhmDR3D8HnHCmT/BSkvSL0vQLy/nkMLY20PQ2OoYMO15Jd0A==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.3.0.tgz",
+      "integrity": "sha512-oMN/WZRb+SO37BmUElEgeEWuU8E/HXRkiODxJxLe1UTHVXLrdVSgfaJV7pSlhRGMSOiXLuxTIjfsF3wYvz8cgQ==",
       "cpu": [
         "arm64"
       ],
@@ -4662,13 +4674,13 @@
         "darwin"
       ],
       "engines": {
-        "node": ">= 10"
+        "node": ">= 20"
       }
     },
     "node_modules/@tailwindcss/oxide-darwin-x64": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.1.18.tgz",
-      "integrity": "sha512-FL5oxr2xQsFrc3X9o1fjHKBYBMD1QZNyc1Xzw/h5Qu4XnEBi3dZn96HcHm41c/euGV+GRiXFfh2hUCyKi/e+yw==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.3.0.tgz",
+      "integrity": "sha512-N6CUmu4a6bKVADfw77p+iw6Yd9Q3OBhe0veaDX+QazfuVYlQsHfDgxBrsjQ/IW+zywL8mTrNd0SdJT/zgtvMdA==",
       "cpu": [
         "x64"
       ],
@@ -4678,13 +4690,13 @@
         "darwin"
       ],
       "engines": {
-        "node": ">= 10"
+        "node": ">= 20"
       }
     },
     "node_modules/@tailwindcss/oxide-freebsd-x64": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.1.18.tgz",
-      "integrity": "sha512-Fj+RHgu5bDodmV1dM9yAxlfJwkkWvLiRjbhuO2LEtwtlYlBgiAT4x/j5wQr1tC3SANAgD+0YcmWVrj8R9trVMA==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.3.0.tgz",
+      "integrity": "sha512-zDL5hBkQdH5C6MpqbK3gQAgP80tsMwSI26vjOzjJtNCMUo0lFgOItzHKBIupOZNQxt3ouPH7RPhvNhiTfCe5CQ==",
       "cpu": [
         "x64"
       ],
@@ -4694,13 +4706,13 @@
         "freebsd"
       ],
       "engines": {
-        "node": ">= 10"
+        "node": ">= 20"
       }
     },
     "node_modules/@tailwindcss/oxide-linux-arm-gnueabihf": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.1.18.tgz",
-      "integrity": "sha512-Fp+Wzk/Ws4dZn+LV2Nqx3IilnhH51YZoRaYHQsVq3RQvEl+71VGKFpkfHrLM/Li+kt5c0DJe/bHXK1eHgDmdiA==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.3.0.tgz",
+      "integrity": "sha512-R06HdNi7A7OEoMsf6d4tjZ71RCWnZQPHj2mnotSFURjNLdBC+cIgXQ7l81CqeoiQftjf6OOblxXMInMgN2VzMA==",
       "cpu": [
         "arm"
       ],
@@ -4710,77 +4722,89 @@
         "linux"
       ],
       "engines": {
-        "node": ">= 10"
+        "node": ">= 20"
       }
     },
     "node_modules/@tailwindcss/oxide-linux-arm64-gnu": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.1.18.tgz",
-      "integrity": "sha512-S0n3jboLysNbh55Vrt7pk9wgpyTTPD0fdQeh7wQfMqLPM/Hrxi+dVsLsPrycQjGKEQk85Kgbx+6+QnYNiHalnw==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.3.0.tgz",
+      "integrity": "sha512-qTJHELX8jetjhRQHCLilkVLmybpzNQAtaI/gaoVoidn/ufbNDbAo8KlK2J+yPoc8wQxvDxCmh/5lr8nC1+lTbg==",
       "cpu": [
         "arm64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
       ],
       "engines": {
-        "node": ">= 10"
+        "node": ">= 20"
       }
     },
     "node_modules/@tailwindcss/oxide-linux-arm64-musl": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.1.18.tgz",
-      "integrity": "sha512-1px92582HkPQlaaCkdRcio71p8bc8i/ap5807tPRDK/uw953cauQBT8c5tVGkOwrHMfc2Yh6UuxaH4vtTjGvHg==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.3.0.tgz",
+      "integrity": "sha512-Z6sukiQsngnWO+l39X4pPbiWT81IC+PLKF+PHxIlyZbGNb9MODfYlXEVlFvej5BOZInWX01kVyzeLvHsXhfczQ==",
       "cpu": [
         "arm64"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
       ],
       "engines": {
-        "node": ">= 10"
+        "node": ">= 20"
       }
     },
     "node_modules/@tailwindcss/oxide-linux-x64-gnu": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.1.18.tgz",
-      "integrity": "sha512-v3gyT0ivkfBLoZGF9LyHmts0Isc8jHZyVcbzio6Wpzifg/+5ZJpDiRiUhDLkcr7f/r38SWNe7ucxmGW3j3Kb/g==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.3.0.tgz",
+      "integrity": "sha512-DRNdQRpSGzRGfARVuVkxvM8Q12nh19l4BF/G7zGA1oe+9wcC6saFBHTISrpIcKzhiXtSrlSrluCfvMuledoCTQ==",
       "cpu": [
         "x64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
       ],
       "engines": {
-        "node": ">= 10"
+        "node": ">= 20"
       }
     },
     "node_modules/@tailwindcss/oxide-linux-x64-musl": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.1.18.tgz",
-      "integrity": "sha512-bhJ2y2OQNlcRwwgOAGMY0xTFStt4/wyU6pvI6LSuZpRgKQwxTec0/3Scu91O8ir7qCR3AuepQKLU/kX99FouqQ==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.3.0.tgz",
+      "integrity": "sha512-Z0IADbDo8bh6I7h2IQMx601AdXBLfFpEdUotft86evd/8ZPflZe9COPO8Q1vw+pfLWIUo9zN/JGZvwuAJqduqg==",
       "cpu": [
         "x64"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
       ],
       "engines": {
-        "node": ">= 10"
+        "node": ">= 20"
       }
     },
     "node_modules/@tailwindcss/oxide-wasm32-wasi": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.1.18.tgz",
-      "integrity": "sha512-LffYTvPjODiP6PT16oNeUQJzNVyJl1cjIebq/rWWBF+3eDst5JGEFSc5cWxyRCJ0Mxl+KyIkqRxk1XPEs9x8TA==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.0.tgz",
+      "integrity": "sha512-HNZGOUxEmElksYR7S6sC5jTeNGpobAsy9u7Gu0AskJ8/20FR9GqebUyB+HBcU/ax6BHuiuJi+Oda4B+YX6H1yA==",
       "bundleDependencies": [
         "@napi-rs/wasm-runtime",
         "@emnapi/core",
@@ -4795,75 +4819,21 @@
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/core": "^1.7.1",
-        "@emnapi/runtime": "^1.7.1",
-        "@emnapi/wasi-threads": "^1.1.0",
-        "@napi-rs/wasm-runtime": "^1.1.0",
+        "@emnapi/core": "^1.10.0",
+        "@emnapi/runtime": "^1.10.0",
+        "@emnapi/wasi-threads": "^1.2.1",
+        "@napi-rs/wasm-runtime": "^1.1.4",
         "@tybys/wasm-util": "^0.10.1",
-        "tslib": "^2.4.0"
+        "tslib": "^2.8.1"
       },
       "engines": {
         "node": ">=14.0.0"
       }
     },
-    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/core": {
-      "version": "1.7.1",
-      "inBundle": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "@emnapi/wasi-threads": "1.1.0",
-        "tslib": "^2.4.0"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/runtime": {
-      "version": "1.7.1",
-      "inBundle": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "tslib": "^2.4.0"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/wasi-threads": {
-      "version": "1.1.0",
-      "inBundle": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "tslib": "^2.4.0"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@napi-rs/wasm-runtime": {
-      "version": "1.1.0",
-      "inBundle": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "@emnapi/core": "^1.7.1",
-        "@emnapi/runtime": "^1.7.1",
-        "@tybys/wasm-util": "^0.10.1"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@tybys/wasm-util": {
-      "version": "0.10.1",
-      "inBundle": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "tslib": "^2.4.0"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/tslib": {
-      "version": "2.8.1",
-      "inBundle": true,
-      "license": "0BSD",
-      "optional": true
-    },
     "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.1.18.tgz",
-      "integrity": "sha512-HjSA7mr9HmC8fu6bdsZvZ+dhjyGCLdotjVOgLA2vEqxEBZaQo9YTX4kwgEvPCpRh8o4uWc4J/wEoFzhEmjvPbA==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.0.tgz",
+      "integrity": "sha512-Pe+RPVTi1T+qymuuRpcdvwSVZjnll/f7n8gBxMMh3xLTctMDKqpdfGimbMyioqtLhUYZxdJ9wGNhV7MKHvgZsQ==",
       "cpu": [
         "arm64"
       ],
@@ -4873,13 +4843,13 @@
         "win32"
       ],
       "engines": {
-        "node": ">= 10"
+        "node": ">= 20"
       }
     },
     "node_modules/@tailwindcss/oxide-win32-x64-msvc": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.1.18.tgz",
-      "integrity": "sha512-bJWbyYpUlqamC8dpR7pfjA0I7vdF6t5VpUGMWRkXVE3AXgIZjYUYAK7II1GNaxR8J1SSrSrppRar8G++JekE3Q==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.3.0.tgz",
+      "integrity": "sha512-Mvrf2kXW/yeW/OTezZlCGOirXRcUuLIBx/5Y12BaPM7wJoryG6dfS/NJL8aBPqtTEx/Vm4T4vKzFUcKDT+TKUA==",
       "cpu": [
         "x64"
       ],
@@ -4889,27 +4859,27 @@
         "win32"
       ],
       "engines": {
-        "node": ">= 10"
+        "node": ">= 20"
       }
     },
     "node_modules/@tailwindcss/vite": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/vite/-/vite-4.1.18.tgz",
-      "integrity": "sha512-jVA+/UpKL1vRLg6Hkao5jldawNmRo7mQYrZtNHMIVpLfLhDml5nMRUo/8MwoX2vNXvnaXNNMedrMfMugAVX1nA==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/vite/-/vite-4.3.0.tgz",
+      "integrity": "sha512-t6J3OrB5Fc0ExuhohouH0fWUGMYL6PTLhW+E7zIk/pdbnJARZDCwjBznFnkh5ynRnIRSI4YjtTH0t6USjJISrw==",
       "license": "MIT",
       "dependencies": {
-        "@tailwindcss/node": "4.1.18",
-        "@tailwindcss/oxide": "4.1.18",
-        "tailwindcss": "4.1.18"
+        "@tailwindcss/node": "4.3.0",
+        "@tailwindcss/oxide": "4.3.0",
+        "tailwindcss": "4.3.0"
       },
       "peerDependencies": {
-        "vite": "^5.2.0 || ^6 || ^7"
+        "vite": "^5.2.0 || ^6 || ^7 || ^8"
       }
     },
     "node_modules/@tailwindcss/vite/node_modules/tailwindcss": {
-      "version": "4.1.18",
-      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.1.18.tgz",
-      "integrity": "sha512-4+Z+0yiYyEtUVCScyfHCxOYP06L5Ne+JiHhY2IjR2KWMIWhJOYZKLSGZaP5HkZ8+bY0cxfzwDE5uOmzFXyIwxw==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.3.0.tgz",
+      "integrity": "sha512-y6nxMGB1nMW9R6k96e5gdIFzcfL/gTJRNaqGes1YvkLnPVXzWgbqFF2yLC0T8G774n24cx3Pe8XrKoniCOAH+Q==",
       "license": "MIT"
     },
     "node_modules/@tanstack/eslint-plugin-query": {
@@ -8077,13 +8047,13 @@
       }
     },
     "node_modules/enhanced-resolve": {
-      "version": "5.18.4",
-      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.18.4.tgz",
-      "integrity": "sha512-LgQMM4WXU3QI+SYgEc2liRgznaD5ojbmY3sb8LxyguVkIg5FxdpTkvk72te2R38/TGKxH634oLxXRGY6d7AP+Q==",
+      "version": "5.22.0",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.22.0.tgz",
+      "integrity": "sha512-xYcDWrpELkFzz9SpZ3PlI6Eu6eD93Yf0WLDRxikGhWJ3MAir2SNZTIVCVZqZ/NUyx8AdMc2gT9C0gPiw18kG+A==",
       "license": "MIT",
       "dependencies": {
         "graceful-fs": "^4.2.4",
-        "tapable": "^2.2.0"
+        "tapable": "^2.3.3"
       },
       "engines": {
         "node": ">=10.13.0"
@@ -8779,9 +8749,9 @@
       "license": "MIT"
     },
     "node_modules/fast-xml-builder": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.1.4.tgz",
-      "integrity": "sha512-f2jhpN4Eccy0/Uz9csxh3Nu6q4ErKxf0XIsasomfOihuSUa3/xw6w8dnOtCDgEItQFJG8KyXPzQXzcODDrrbOg==",
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.2.0.tgz",
+      "integrity": "sha512-00aAWieqff+ZJhsXA4g1g7M8k+7AYoMUUHF+/zFb5U6Uv/P0Vl4QZo84/IcufzYalLuEj9928bXN9PbbFzMF0Q==",
       "funding": [
         {
           "type": "github",
@@ -8790,13 +8760,14 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "path-expression-matcher": "^1.1.3"
+        "path-expression-matcher": "^1.5.0",
+        "xml-naming": "^0.1.0"
       }
     },
     "node_modules/fast-xml-parser": {
-      "version": "5.5.9",
-      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.5.9.tgz",
-      "integrity": "sha512-jldvxr1MC6rtiZKgrFnDSvT8xuH+eJqxqOBThUVjYrxssYTo1avZLGql5l0a0BAERR01CadYzZ83kVEkbyDg+g==",
+      "version": "5.7.0",
+      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.7.0.tgz",
+      "integrity": "sha512-MTcrUoRQ1GSQ9iG3QJzBGquYYYeA7piZaJoIWbPFGbRn6Jj6z7xgoAyi4DrZX4y2ZIQQBF59gc/zmvvejjgoFQ==",
       "funding": [
         {
           "type": "github",
@@ -8805,9 +8776,10 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "fast-xml-builder": "^1.1.4",
-        "path-expression-matcher": "^1.2.0",
-        "strnum": "^2.2.2"
+        "@nodable/entities": "^2.1.0",
+        "fast-xml-builder": "^1.1.5",
+        "path-expression-matcher": "^1.5.0",
+        "strnum": "^2.2.3"
       },
       "bin": {
         "fxparser": "src/cli/cli.js"
@@ -10756,9 +10728,9 @@
       }
     },
     "node_modules/lightningcss": {
-      "version": "1.30.2",
-      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.30.2.tgz",
-      "integrity": "sha512-utfs7Pr5uJyyvDETitgsaqSyjCb2qNRAtuqUeWIAKztsOYdcACf2KtARYXg2pSvhkt+9NfoaNY7fxjl6nuMjIQ==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.32.0.tgz",
+      "integrity": "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==",
       "license": "MPL-2.0",
       "dependencies": {
         "detect-libc": "^2.0.3"
@@ -10771,23 +10743,23 @@
         "url": "https://opencollective.com/parcel"
       },
       "optionalDependencies": {
-        "lightningcss-android-arm64": "1.30.2",
-        "lightningcss-darwin-arm64": "1.30.2",
-        "lightningcss-darwin-x64": "1.30.2",
-        "lightningcss-freebsd-x64": "1.30.2",
-        "lightningcss-linux-arm-gnueabihf": "1.30.2",
-        "lightningcss-linux-arm64-gnu": "1.30.2",
-        "lightningcss-linux-arm64-musl": "1.30.2",
-        "lightningcss-linux-x64-gnu": "1.30.2",
-        "lightningcss-linux-x64-musl": "1.30.2",
-        "lightningcss-win32-arm64-msvc": "1.30.2",
-        "lightningcss-win32-x64-msvc": "1.30.2"
+        "lightningcss-android-arm64": "1.32.0",
+        "lightningcss-darwin-arm64": "1.32.0",
+        "lightningcss-darwin-x64": "1.32.0",
+        "lightningcss-freebsd-x64": "1.32.0",
+        "lightningcss-linux-arm-gnueabihf": "1.32.0",
+        "lightningcss-linux-arm64-gnu": "1.32.0",
+        "lightningcss-linux-arm64-musl": "1.32.0",
+        "lightningcss-linux-x64-gnu": "1.32.0",
+        "lightningcss-linux-x64-musl": "1.32.0",
+        "lightningcss-win32-arm64-msvc": "1.32.0",
+        "lightningcss-win32-x64-msvc": "1.32.0"
       }
     },
     "node_modules/lightningcss-android-arm64": {
-      "version": "1.30.2",
-      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.30.2.tgz",
-      "integrity": "sha512-BH9sEdOCahSgmkVhBLeU7Hc9DWeZ1Eb6wNS6Da8igvUwAe0sqROHddIlvU06q3WyXVEOYDZ6ykBZQnjTbmo4+A==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.32.0.tgz",
+      "integrity": "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==",
       "cpu": [
         "arm64"
       ],
@@ -10805,9 +10777,9 @@
       }
     },
     "node_modules/lightningcss-darwin-arm64": {
-      "version": "1.30.2",
-      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.30.2.tgz",
-      "integrity": "sha512-ylTcDJBN3Hp21TdhRT5zBOIi73P6/W0qwvlFEk22fkdXchtNTOU4Qc37SkzV+EKYxLouZ6M4LG9NfZ1qkhhBWA==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.32.0.tgz",
+      "integrity": "sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ==",
       "cpu": [
         "arm64"
       ],
@@ -10825,9 +10797,9 @@
       }
     },
     "node_modules/lightningcss-darwin-x64": {
-      "version": "1.30.2",
-      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.30.2.tgz",
-      "integrity": "sha512-oBZgKchomuDYxr7ilwLcyms6BCyLn0z8J0+ZZmfpjwg9fRVZIR5/GMXd7r9RH94iDhld3UmSjBM6nXWM2TfZTQ==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.32.0.tgz",
+      "integrity": "sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w==",
       "cpu": [
         "x64"
       ],
@@ -10845,9 +10817,9 @@
       }
     },
     "node_modules/lightningcss-freebsd-x64": {
-      "version": "1.30.2",
-      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.30.2.tgz",
-      "integrity": "sha512-c2bH6xTrf4BDpK8MoGG4Bd6zAMZDAXS569UxCAGcA7IKbHNMlhGQ89eRmvpIUGfKWNVdbhSbkQaWhEoMGmGslA==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.32.0.tgz",
+      "integrity": "sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig==",
       "cpu": [
         "x64"
       ],
@@ -10865,9 +10837,9 @@
       }
     },
     "node_modules/lightningcss-linux-arm-gnueabihf": {
-      "version": "1.30.2",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.30.2.tgz",
-      "integrity": "sha512-eVdpxh4wYcm0PofJIZVuYuLiqBIakQ9uFZmipf6LF/HRj5Bgm0eb3qL/mr1smyXIS1twwOxNWndd8z0E374hiA==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.32.0.tgz",
+      "integrity": "sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw==",
       "cpu": [
         "arm"
       ],
@@ -10885,12 +10857,15 @@
       }
     },
     "node_modules/lightningcss-linux-arm64-gnu": {
-      "version": "1.30.2",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.30.2.tgz",
-      "integrity": "sha512-UK65WJAbwIJbiBFXpxrbTNArtfuznvxAJw4Q2ZGlU8kPeDIWEX1dg3rn2veBVUylA2Ezg89ktszWbaQnxD/e3A==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.32.0.tgz",
+      "integrity": "sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ==",
       "cpu": [
         "arm64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -10905,12 +10880,15 @@
       }
     },
     "node_modules/lightningcss-linux-arm64-musl": {
-      "version": "1.30.2",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.30.2.tgz",
-      "integrity": "sha512-5Vh9dGeblpTxWHpOx8iauV02popZDsCYMPIgiuw97OJ5uaDsL86cnqSFs5LZkG3ghHoX5isLgWzMs+eD1YzrnA==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.32.0.tgz",
+      "integrity": "sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==",
       "cpu": [
         "arm64"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -10925,12 +10903,15 @@
       }
     },
     "node_modules/lightningcss-linux-x64-gnu": {
-      "version": "1.30.2",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.30.2.tgz",
-      "integrity": "sha512-Cfd46gdmj1vQ+lR6VRTTadNHu6ALuw2pKR9lYq4FnhvgBc4zWY1EtZcAc6EffShbb1MFrIPfLDXD6Xprbnni4w==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.32.0.tgz",
+      "integrity": "sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==",
       "cpu": [
         "x64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -10945,12 +10926,15 @@
       }
     },
     "node_modules/lightningcss-linux-x64-musl": {
-      "version": "1.30.2",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.30.2.tgz",
-      "integrity": "sha512-XJaLUUFXb6/QG2lGIW6aIk6jKdtjtcffUT0NKvIqhSBY3hh9Ch+1LCeH80dR9q9LBjG3ewbDjnumefsLsP6aiA==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.32.0.tgz",
+      "integrity": "sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==",
       "cpu": [
         "x64"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -10965,9 +10949,9 @@
       }
     },
     "node_modules/lightningcss-win32-arm64-msvc": {
-      "version": "1.30.2",
-      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.30.2.tgz",
-      "integrity": "sha512-FZn+vaj7zLv//D/192WFFVA0RgHawIcHqLX9xuWiQt7P0PtdFEVaxgF9rjM/IRYHQXNnk61/H/gb2Ei+kUQ4xQ==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.32.0.tgz",
+      "integrity": "sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==",
       "cpu": [
         "arm64"
       ],
@@ -10985,9 +10969,9 @@
       }
     },
     "node_modules/lightningcss-win32-x64-msvc": {
-      "version": "1.30.2",
-      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.30.2.tgz",
-      "integrity": "sha512-5g1yc73p+iAkid5phb4oVFMB45417DkRevRbt/El/gKXJk4jid+vPFF/AXbxn05Aky8PapwzZrdJShv5C0avjw==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.32.0.tgz",
+      "integrity": "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==",
       "cpu": [
         "x64"
       ],
@@ -12872,9 +12856,9 @@
       }
     },
     "node_modules/openai": {
-      "version": "6.27.0",
-      "resolved": "https://registry.npmjs.org/openai/-/openai-6.27.0.tgz",
-      "integrity": "sha512-osTKySlrdYrLYTt0zjhY8yp0JUBmWDCN+Q+QxsV4xMQnnoVFpylgKGgxwN8sSdTNw0G4y+WUXs4eCMWpyDNWZQ==",
+      "version": "6.38.0",
+      "resolved": "https://registry.npmjs.org/openai/-/openai-6.38.0.tgz",
+      "integrity": "sha512-AoMplt2UalrpgUDMh3L09QWjNRlgJPipclQvA6sYAaeF6nHNBMgmikAZGmcYLn8on4d9sQY9Q8bOLfrBS7Lc8g==",
       "license": "Apache-2.0",
       "bin": {
         "openai": "bin/cli"
@@ -13214,9 +13198,9 @@
       }
     },
     "node_modules/path-expression-matcher": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.2.0.tgz",
-      "integrity": "sha512-DwmPWeFn+tq7TiyJ2CxezCAirXjFxvaiD03npak3cRjlP9+OjTmSy1EpIrEbh+l6JgUundniloMLDQ/6VTdhLQ==",
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.5.0.tgz",
+      "integrity": "sha512-cbrerZV+6rvdQrrD+iGMcZFEiiSrbv9Tfdkvnusy6y0x0GKBXREFg/Y65GhIfm0tnLntThhzCnfKwp1WRjeCyQ==",
       "funding": [
         {
           "type": "github",
@@ -13471,9 +13455,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.6",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz",
-      "integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==",
+      "version": "8.5.15",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
+      "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==",
       "funding": [
         {
           "type": "opencollective",
@@ -13490,7 +13474,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.11",
+        "nanoid": "^3.3.12",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
@@ -13505,9 +13489,9 @@
       "license": "MIT"
     },
     "node_modules/postcss/node_modules/nanoid": {
-      "version": "3.3.11",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
-      "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
+      "version": "3.3.12",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
+      "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
       "funding": [
         {
           "type": "github",
@@ -15430,9 +15414,9 @@
       }
     },
     "node_modules/strnum": {
-      "version": "2.2.2",
-      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.2.2.tgz",
-      "integrity": "sha512-DnR90I+jtXNSTXWdwrEy9FakW7UX+qUZg28gj5fk2vxxl7uS/3bpI4fjFYVmdK9etptYBPNkpahuQnEwhwECqA==",
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.3.0.tgz",
+      "integrity": "sha512-ums3KNd42PGyx5xaoVTO1mjU1bH3NpY4vsrVlnv9PNGqQj8wd7rJ6nEypLrJ7z5vxK5RP0yMLo6J/Gsm62DI5Q==",
       "funding": [
         {
           "type": "github",
@@ -15525,9 +15509,10 @@
       }
     },
     "node_modules/systeminformation": {
-      "version": "5.31.0",
-      "resolved": "https://registry.npmjs.org/systeminformation/-/systeminformation-5.31.0.tgz",
-      "integrity": "sha512-z5pjzvC8UnQJ/iu34z+mo3lAeMzTGdArjPQoG5uPyV5XY4BY+M6ZcRTl4XnZqudz6sP713LhWMKv6e0kGFGCgQ==",
+      "version": "5.31.6",
+      "resolved": "https://registry.npmjs.org/systeminformation/-/systeminformation-5.31.6.tgz",
+      "integrity": "sha512-Uv2b2uGGM6ns+26czgW2cYRabYdnswM0ddSOOlryHOaelzsmDSet1iM/NT7VOYxW8x/BW+HkY+b1Ve2pLTSGSA==",
+      "license": "MIT",
       "os": [
         "darwin",
         "linux",
@@ -15575,9 +15560,9 @@
       "license": "MIT"
     },
     "node_modules/tapable": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.0.tgz",
-      "integrity": "sha512-g9ljZiwki/LfxmQADO3dEY1CbpmXT5Hm2fJ+QaGKwSXUylMybePR7/67YW7jOrrvjEgL1Fmz5kzyAjWVWLlucg==",
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.3.tgz",
+      "integrity": "sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==",
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -16735,6 +16720,21 @@
       "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
       "license": "ISC"
     },
+    "node_modules/xml-naming": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/xml-naming/-/xml-naming-0.1.0.tgz",
+      "integrity": "sha512-k8KO9hrMyNk6tUWqUfkTEZbezRRpONVOzUTnc97VnCvyj6Tf9lyUR9EDAIeiVLv56jsMcoXEwjW8Kv5yPY52lw==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=16.0.0"
+      }
+    },
     "node_modules/y18n": {
       "version": "5.0.8",
       "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
diff --git a/admin/package.json b/admin/package.json
index 6798656..8923031 100644
--- a/admin/package.json
+++ b/admin/package.json
@@ -81,7 +81,7 @@
     "@protomaps/basemaps": "5.7.0",
     "@qdrant/js-client-rest": "1.16.2",
     "@tabler/icons-react": "3.36.1",
-    "@tailwindcss/vite": "4.1.18",
+    "@tailwindcss/vite": "4.3.0",
     "@tanstack/react-query": "5.90.20",
     "@tanstack/react-query-devtools": "5.91.3",
     "@tanstack/react-virtual": "3.13.18",
@@ -98,7 +98,7 @@
     "compression": "1.8.1",
     "dockerode": "4.0.9",
     "edge.js": "6.4.0",
-    "fast-xml-parser": "5.5.9",
+    "fast-xml-parser": "5.7.0",
     "fuse.js": "7.1.0",
     "ipaddr.js": "2.4.0",
     "jszip": "3.10.1",
@@ -106,12 +106,12 @@
     "maplibre-gl": "4.7.1",
     "mysql2": "3.16.2",
     "ollama": "0.6.3",
-    "openai": "6.27.0",
+    "openai": "6.38.0",
     "pdf-parse": "2.4.5",
     "pdf2pic": "3.2.0",
     "pino-pretty": "13.1.3",
     "pmtiles": "4.4.0",
-    "postcss": "8.5.6",
+    "postcss": "8.5.15",
     "react": "19.2.4",
     "react-adonis-transmit": "1.0.1",
     "react-dom": "19.2.4",
@@ -121,7 +121,7 @@
     "remark-gfm": "4.0.1",
     "sharp": "0.34.5",
     "stopword": "3.1.5",
-    "systeminformation": "5.31.0",
+    "systeminformation": "5.31.6",
     "tailwindcss": "4.2.2",
     "tar": "7.5.11",
     "tesseract.js": "7.0.0",

From e26ce4f1f657369a71e07d223c5e1c3cae285a95 Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Wed, 27 May 2026 22:30:03 +0000
Subject: [PATCH 05/83] docs: update release notes

---
 admin/docs/release-notes.md | 83 +++++++++++++++++++++++++++++++++++++
 1 file changed, 83 insertions(+)

diff --git a/admin/docs/release-notes.md b/admin/docs/release-notes.md
index 2e0bd34..a537c9f 100644
--- a/admin/docs/release-notes.md
+++ b/admin/docs/release-notes.md
@@ -1,5 +1,88 @@
 # Release Notes
 
+## Unreleased
+
+### Features
+
+### Bug Fixes
+- fix(logging): also write production logs to stdout for docker visibility (#870). Thanks @chriscrosstalk for the contribution!
+- fix(KB): cursor on Always/Manual ingest policy buttons (#927). Thanks @chriscrosstalk for the contribution!
+
+### Improvements
+- perf(KB): swap Qdrant full-scroll for facet on source enumeration (#928). Thanks @chriscrosstalk for the contribution!
+- chore(deps): bump various dependencies. Thanks @jakeaturner for the contribution!
+
+## Version 1.32.0 - May 20, 2026
+
+### Features
+- **AI:** improved AMD GPU acceleration for Ollama via ROCm + HSA override (#804)
+- **chat:** confirm-on-switch + one-chat-model-at-a-time enforcement (#ffa70a5)
+- **content-manager:** add sortable file size column (#698), closes #685
+- **content-updates:** show size, surface downloads in Active Downloads (#299b767)
+- **Content:** custom ZIM library sources with pre-seeded mirrors (#593) (#62e75fd), closes #576
+- **easy-setup:** split AI into its own conditional step (issue #905) (#0617d54), closes #907
+- **GPU:** auto-remediate nomad_ollama passthrough loss on admin boot (#755) (#2997637), closes #208 #804
+- **KB:** Always/Manual ingest policy toggle (RFC #883 §1/§4) (#894) (#8eb8809), closes #880 #886 #886 #886 #888 #888 #888 #888 #888
+- **KB:** conditional warnings A + B on Stored Files (RFC #883 §6) (#563f86a), closes #891 #891 #890 #881
+- **KB:** first-chat JIT prompt for ingest policy (RFC #883 Phase 3 task 12) (#fd153b4), closes #894 #894 #894
+- **KB:** group admin docs into single row in Stored Files (RFC #883 §9) (#c64ec97)
+- **KB:** guardrail modal at 50GB / 10%-free thresholds (RFC #883 §7) (#cf3a924), closes #897 #897 #894 #899
+- **KB:** per-file ingest action + state indicator on Stored Files (RFC #883 §5) (#d850cb9), closes #907 #907 #907 #908
+- **KB:** per-file ingest state machine (Phase 1 of RFC #883) (#888) (#743549c), closes #880 #886 #886 #886
+- **KB:** ratio registry for disk + time estimates (Phase 1B of RFC #883) (#159d57b)
+- **KB:** status pill + last-activity timestamp on Processing Queue (RFC #883 §5/§10) (#43ca584)
+- **KB:** surface embedding-disk estimate in curated tier-change modal (RFC #883 §1) (#e68c753), closes #891 #891
+- **KB:** wizard AI policy step (RFC #883 Phase 3 task 13) (#7a681d0), closes #899 #894 #894 #899
+- **Maps:** regional map downloads via go-pmtiles extract (#780) (#94059b0)
+- **maps:** show map coordinates on mouse move (#786) (#08838b1)
+
+### Bug Fixes
+- **AI:** add truncation DEBUG log (#e3b758f)
+- **AI:** improve remote Ollama url validation to prevent SSRF vulnerability (#989a401)
+- **AI:** pre-cap embed input + log fallback reason (#881) (#2dec5bf), closes #369 #670
+- **AI:** preserve semver tag in DB on AMD Ollama updates (#019a5a4)
+- **AI:** rewrite RAG query on first follow-up (off-by-one in skip-rewrite threshold) (#43645e4)
+- **AI:** vendor-aware AMD HSA override + benchmark discrete-GPU detection (#a2e2f7f), closes #804 #804 #810
+- **API:** accept notes, marker_type, and position on markers endpoints (#770) (#132ec9c), closes #768
+- **API:** skip compression for Server-Sent Events (#798) (#4b21ea6)
+- **content:** show selected tier on cards while downloads are in flight (#059cf2a), closes #36b6d8e
+- **DockerService:** improve volume logic and documentation in forceReinstall (#501860a)
+- **Downloads:** treat missing Content-Type as octet-stream (#848) (#3abf338)
+- **install:** warn loudly on non-x86_64 architectures before pulling images (#797) (#cb129d2), closes #419
+- **KB:** add re-embed and reset & rebuild opts to fix broken embeddings (#886) (#4c21196)
+- **KB:** align chunks_per_mb column type with TS contract (#4d6b140)
+- **KB:** blank-screen on panel open + tooltips on bulk-action buttons (#633a3c3), closes #892 #895 #post-#892
+- **KB:** guardrail bypass during estimate load + Transition sibling (PR #901 review) (#7e768f3)
+- **KB:** remove redundant Refresh button from Processing Queue (#4e8cadd), closes #893
+- **KB:** respect Manual ingest policy on post-download dispatch (#a5fe52f), closes #909
+- **KB:** silent maybe-later error + redundant prompt-state refetches (PR #899 review) (#9a684a5)
+- **KB:** surface file-warning compute failures instead of masking as healthy (PR #895 review) (#a0047c1)
+- **KB:** TierSelectionModal hook order + register IconLibrary (#6e5284e), closes #915
+- **KB:** union Stored Files list with state-machine file paths (#898) (#8ed0bdf), closes #886 #888 #888
+- **Maps:** render notes in marker popup when populated (#f41027c), closes #770
+- **Maps:** send filename instead of full path to delete endpoint (#6a68bac)
+- **models:** correct inverted belongsTo keys on ChatMessage.session (#921) (#82f67de)
+- **queue:** singleton QueueService to stop ioredis connection leak (#ba53702), closes #872
+- **RAG:** add start button in kb modal and ensure restart policy exists (#700) (#2d8a02f)
+- **RAG:** anchor continuation-batch initial progress to overall-file frame (#889) (#f304d80)
+- **RAG:** pace continuation batches when embedding is CPU-only (#a22c640)
+- **RAG:** pass num_ctx and truncate to Ollama embed call (#763) (#7bebedc), closes #756 #369 #670
+- **RAG:** report ZIM ingestion progress in overall-file frame (#d28eb9b)
+- **RAG:** unbreak multi-batch ZIM ingestion (jobId dedupe) (#74cef75)
+- **security:** canonicalize hostnames to block IPv4-mapped IPv6 IMDS bypass (#736c9bd)
+- **security:** match IPv6 SSRF patterns against unbracketed hostnames (#b3dac9b)
+- **System:** correct AMD VRAM in Graphics card + harden log probe (#d2f2172), closes #835 #850 #208
+- **System:** correct NVIDIA VRAM in Graphics card (#835) (#6c799dd), closes #804
+- **System:** self-heal stale updateAvailable flag after sidecar-driven update (#825) (#318276c)
+- **System:** validate StartedAt with fallback to tail:500 (PR review) (#662a6c4)
+- **UI:** Country Picker UX polish + auto-refresh stored files (#817) (#8c06b5b), closes #780
+- **UI:** four fixes for the System Update page (#827) (#3a2e92a)
+- **UI:** improve global map banner display logic (#702) (#5517e82)
+- **UI:** wire map file delete confirmation to API (#732) (#e561ce8)
+- **ZIM:** preserve co-existing Wikipedia corpora on cleanup (#884) (#5e2c599)
+
+### Improvements
+
 ## Version 1.31.1 - April 21, 2026
 
 ### Features

From fa144c4777c2b58574af8263d81a8822e0c603e2 Mon Sep 17 00:00:00 2001
From: cosmistack-bot <dev@cosmistack.com>
Date: Wed, 27 May 2026 22:36:12 +0000
Subject: [PATCH 06/83] chore(release): 1.32.1 [skip ci]

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 2e5698f..22d213e 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "project-nomad",
-  "version": "1.32.0",
+  "version": "1.32.1",
   "description": "\"",
   "main": "index.js",
   "scripts": {

From d5f7c3f615c92c07b798b6512b2483fd9d64a89d Mon Sep 17 00:00:00 2001
From: cosmistack-bot <dev@cosmistack.com>
Date: Wed, 27 May 2026 22:36:20 +0000
Subject: [PATCH 07/83] docs(release): finalize v1.32.1 release notes [skip ci]

---
 admin/docs/release-notes.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/admin/docs/release-notes.md b/admin/docs/release-notes.md
index a537c9f..d2bd242 100644
--- a/admin/docs/release-notes.md
+++ b/admin/docs/release-notes.md
@@ -1,6 +1,6 @@
 # Release Notes
 
-## Unreleased
+## Version 1.32.1 - May 27, 2026
 
 ### Features
 

From 17630c048fe141c5504b1505a08d8be3da3e0f8a Mon Sep 17 00:00:00 2001
From: Jake Turner <jturner@cosmistack.com>
Date: Mon, 4 May 2026 19:21:51 +0000
Subject: [PATCH 08/83] docs: update release notes

---
 admin/docs/release-notes.md | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/admin/docs/release-notes.md b/admin/docs/release-notes.md
index d2bd242..758cdbe 100644
--- a/admin/docs/release-notes.md
+++ b/admin/docs/release-notes.md
@@ -173,6 +173,34 @@
 
 ## Version 1.31.1 - April 21, 2026
 
+### Features
+- **AI Assistant**: Added improved support for AMD GPU acceleration for Ollama via ROCm + HSA override. Thanks @chriscrosstalk for the contribution!
+- **Content Explorer**: Added support for custom ZIM library sources and pre-seeded ZIM library mirrors in addition to the default Kiwix library. Thanks @chriscrosstalk for the contribution!
+- **Content Manager**: Content update sizes and downloads are now properly displayed in Active Downloads with progress bars and friendly names. Thanks @chriscrosstalk for the contribution!
+- **Maps**: Map regions can now be extracted and downloaded locally from PMTiles to avoid the need for a full global map download for users who only want specific regions. Thanks @bgauger for the contribution!
+
+### Bug Fixes
+- **API**: Compression is now skipped for Server-Sent Events (SSE) responses to prevent issues with streaming endpoints. Thanks @chriscrosstalk for the fix!
+- **Maps**: Fixed logic issues with the global map banner display. Thanks @Gujiassh for the fix!
+- **Maps**: The selected map file is now properly deleted after confirming the action in the UI. Thanks @cuyua9 for the fix!
+- **System**: Fixed an issue where the a pending update could still be indicated in the UI even after the system was updated successfully. Thanks @jakeaturner for the fix!
+
+### Improvements
+- **Build**: The Command Center image now uses the VERSION build arg to write `app/version.json` with the current version for improved version tracking and debugging, even in RC environments. Thanks @chriscrosstalk for the contribution!
+- **Content Manager**: Added a sortable file size column to the ZIM files table in the Content Manager for easier management of storage space. Thanks @chriscrosstalk for the contribution!
+- **Dependencies**: All package.json dependencies have been pinned to specific versions to ensure stability and reduce the risk of unexpected breaking changes/supply-chain compromises from upstream packages. Thanks @jakeaturner for the contribution!
+- **Dependencies**: Updated various dependencies to close security vulnerabilities and improve stability
+- **Docs**: Update CONTIRBUTING.md to require an issue to be opened before submitting a PR for non-trivial changes to ensure proper discussion and review of proposed changes. Thanks @chriscrosstalk for the contribution!
+- **Docs**: Added the map markers endpoints to the API reference documentation. Thanks @kennethbrewer3 for the contribution!
+- **Docs**: Added a link to the new WSL2 install guide in the README and FAQ. Thanks @chriscrosstalk for the contribution!
+- **Install**: The install script now warns loudly if the user is attempting to install on a non-x86_64/amd64 platform to prevent unsupported installations and potential issues. Thanks @chriscrosstalk for the contribution!
+- **Maps**: The maps API endpoints now properly accept and validate notes, marker_type, and position data for map markers and persist them in the database for retrieval in the UI. Thanks @jrsphoto for the contribution!
+- **Maps**: The current coordinates of the mouse pointer can now be displayed in the map viewer for easier navigation and exploration. Thanks @kennethbrewer3 for the contribution!
+- **RAG**: NOMAD now properly passed `num_ctx` and truncation to the Ollama embedding endpoint to ensure that the context window of the model is best utilized for embeddings. Thanks @chriscrosstalk for the contribution!
+- **RAG**: Added a manual start button for Qdrant and a self-healing mechanism for Qdrant's restart-policy to ensure that the vector database is running properly for embedding and retrieval tasks. Thanks @hestela for the contribution!
+
+## Version 1.31.1 - April 21, 2026
+
 ### Features
 
 ### Bug Fixes

From b8961d27dd56cd7e10464699c0ab8067107e95fc Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Mon, 1 Jun 2026 17:34:32 +0000
Subject: [PATCH 09/83] fix(rag): improve context-reliance hedging and use
 heading metadata at query time
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Users often saw the assistant disclaim ("Sorry, I couldn't find specific
context regarding X, but here's a general answer...") even when material
that directly answered the query was embedded. Two compounding causes,
both on the read/generation side:

1. The rag_context system prompt explicitly authorized the hedge: it told
   the model to fall back to general knowledge and "acknowledge the
   limitations," and mandated "According to the information available..."
   citations that pushed small models into meta-commentary preambles.
   Rewrote it to treat the retrieved context as the primary, authoritative
   source, lead with the answer, fall back to general knowledge *silently*,
   and never emit "couldn't find specific context" phrasing, while still allowing
   the model itself to make some "sanity-check" decisions if the retrieved context
   seems wildly incorrect or unrelated to the user's query.

2. The injected context labeled each block with a raw relevance score
   (e.g. "Relevance: 42.3%"). nomic-embed cosine scores for genuinely
   relevant passages sit ~0.4-0.6, so the number primed the model to
   distrust correct context. Dropped the model-visible score (it stays in
   the logs) and replaced it with a neutral source-title label.

Also added a conservative, score-scaled heading boost in rerankResults:
when query keywords match a chunk's section/article title (ZIM metadata we
already fetch), nudge its rank. Same diminishing-returns shape as the
existing boosts and gated behind the existing semantic-quality threshold,
so it can't promote a weak match.

Scope note: this removes the visible hedge and improves ranking of
already-retrieved chunks. It does NOT fix retrieval recall — diluted
1500-token chunks that never reach dense search's top-k are unaffected.
That's a follow-up (smaller chunks + BM25/RRF hybrid).
---
 admin/app/controllers/ollama_controller.ts | 11 +++++++++-
 admin/app/services/rag_service.ts          | 23 ++++++++++++++++++++
 admin/constants/ollama.ts                  | 25 +++++++++++++++-------
 3 files changed, 50 insertions(+), 9 deletions(-)

diff --git a/admin/app/controllers/ollama_controller.ts b/admin/app/controllers/ollama_controller.ts
index 3bf9e73..9174616 100644
--- a/admin/app/controllers/ollama_controller.ts
+++ b/admin/app/controllers/ollama_controller.ts
@@ -106,8 +106,17 @@ export default class OllamaController {
             `[RAG] Injecting ${trimmedDocs.length}/${relevantDocs.length} results (model: ${reqData.model}, maxResults: ${maxResults}, maxTokens: ${maxTokens || 'unlimited'})`
           )
 
+          // Label each context block with its source title when available (a neutral,
+          // honest provenance signal) but never the raw relevance score — nomic cosine
+          // scores for genuinely relevant passages sit ~0.4-0.6, and surfacing e.g.
+          // "42%" primes the model to distrust correct context. Scores stay in the logs
+          // above for debugging.
           const contextText = trimmedDocs
-            .map((doc, idx) => `[Context ${idx + 1}] (Relevance: ${(doc.score * 100).toFixed(1)}%)\n${doc.text}`)
+            .map((doc, idx) => {
+              const title = doc.metadata?.full_title || doc.metadata?.article_title
+              const label = title ? `[Context ${idx + 1} — ${title}]` : `[Context ${idx + 1}]`
+              return `${label}\n${doc.text}`
+            })
             .join('\n\n')
 
           const systemMessage = {
diff --git a/admin/app/services/rag_service.ts b/admin/app/services/rag_service.ts
index 2a2110b..203913a 100644
--- a/admin/app/services/rag_service.ts
+++ b/admin/app/services/rag_service.ts
@@ -1011,6 +1011,29 @@ export class RagService {
           }
         }
 
+        // Boost when query keywords match the chunk's section/article heading. ZIM
+        // content carries this structural metadata (already fetched, no extra cost),
+        // and a query term appearing in a heading is a strong relevance signal that
+        // body-text matching alone misses. Same conservative, score-scaled, diminishing
+        // -returns shape as the boosts above, so it can't promote a weak match.
+        const headingText = [result.full_title, result.section_title, result.article_title]
+          .filter(Boolean)
+          .join(' ')
+          .toLowerCase()
+        if (headingText) {
+          const headingHits = queryKeywords.filter((kw) =>
+            headingText.includes(kw.toLowerCase())
+          ).length
+          if (headingHits > 0) {
+            const headingRatio = headingHits / Math.max(queryKeywords.length, 1)
+            const headingBoost = Math.sqrt(headingRatio) * 0.1 * result.score
+            logger.debug(
+              `[RAG] Heading match: ${headingHits}/${queryKeywords.length} - Boost: ${headingBoost.toFixed(3)}`
+            )
+            finalScore += headingBoost
+          }
+        }
+
         finalScore = Math.min(1.0, finalScore + keywordBoost)
 
         return {
diff --git a/admin/constants/ollama.ts b/admin/constants/ollama.ts
index 23df8f0..17268d8 100644
--- a/admin/constants/ollama.ts
+++ b/admin/constants/ollama.ts
@@ -86,18 +86,27 @@ export const SYSTEM_PROMPTS = {
  - Use tables when presenting structured data.
 `,
   rag_context: (context: string) => `
-You have access to relevant information from the knowledge base. This context has been retrieved based on semantic similarity to the user's question.
+Information has been retrieved from the NOMAD knowledge base that MAY be relevant to the
+user's question. It was selected by automated similarity search, which is imperfect — some
+or all of it may be unrelated to what the user actually asked.
 
 [Knowledge Base Context]
 ${context}
 
-IMPORTANT INSTRUCTIONS:
-1. If the user's question is directly related to the context above, use this information to provide accurate, detailed answers.
-2. Always cite or reference the context when using it (e.g., "According to the information available..." or "Based on the knowledge base...").
-3. If the context is only partially relevant, combine it with your general knowledge but be clear about what comes from the knowledge base.
-4. If the context is not relevant to the user's question, you can respond using your general knowledge without forcing the context into your answer. Do not mention the context if it's not relevant.
-5. Never fabricate information that isn't in the context or your training data.
-6. If you're unsure or you don't have enough information to answer the user's question, acknowledge the limitations.
+HOW TO ANSWER:
+1. First, silently judge whether the context genuinely addresses the user's question. Use
+   it ONLY when it really contains relevant information. Do not force a connection that
+   isn't there: poetic, narrative, tangential, or topically-unrelated passages are NOT
+   relevant just because they share a word with the question — ignore them.
+2. When the context is relevant, base your answer on it and answer directly and specifically.
+3. When the context does not actually address the question, ignore it completely and answer
+   from your own general knowledge. Do this silently — do not mention the knowledge base,
+   the context, or the fact that it lacked an answer, and do not apologize.
+4. Never narrate your retrieval or reasoning process. Do not write "according to Context 1",
+   "the context is unrelated, but", "I couldn't find specific context", or similar. Just
+   give the answer as if you simply knew it.
+5. Do not fabricate specifics (numbers, names, procedures) that are neither supported by
+   genuinely relevant context nor part of your reliable knowledge.
 
 Format your response using markdown for readability.
 `,

From 820c5c415ee3a418a40967707aa8bbbbf5c93f3a Mon Sep 17 00:00:00 2001
From: teccin <teccin@proton.me>
Date: Sat, 30 May 2026 18:12:04 -0400
Subject: [PATCH 10/83] Fix a few typos and punctuation in README.md

---
 README.md | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index a7e1100..381cb86 100644
--- a/README.md
+++ b/README.md
@@ -14,7 +14,7 @@
 
 ---
 
-Project N.O.M.A.D. is a self-contained, offline-first knowledge and education server packed with critical tools, knowledge, and AI to keep you informed and empowered—anytime, anywhere.
+Project N.O.M.A.D. is a self-contained, offline-first knowledge and education server packed with critical tools, knowledge, and AI to keep you informed and empowered — anytime, anywhere.
 
 ## Installation & Quickstart
 Project N.O.M.A.D. can be installed on any Debian-based operating system (we recommend Ubuntu). Installation is completely terminal-based, and all tools and resources are designed to be accessed through the browser, so there's no need for a desktop environment if you'd rather setup N.O.M.A.D. as a "server" and access it through other clients.
@@ -68,7 +68,7 @@ N.O.M.A.D. also includes built-in tools like a Wikipedia content selector, ZIM l
 While many similar offline survival computers are designed to be run on bare-minimum, lightweight hardware, Project N.O.M.A.D. is quite the opposite. To install and run the
 available AI tools, we highly encourage the use of a beefy, GPU-backed device to make the most of your install.
 
-At it's core, however, N.O.M.A.D. is still very lightweight. For a barebones installation of the management application itself, the following minimal specs are required:
+At its core, however, N.O.M.A.D. is still very lightweight. For a barebones installation of the management application itself, the following minimal specs are required:
 
 *Note: Project N.O.M.A.D. is not sponsored by any hardware manufacturer and is designed to be as hardware-agnostic as possible. The harware listed below is for example/comparison use only*
 
@@ -91,12 +91,12 @@ To run LLM's and other included AI tools:
 
 **For detailed build recommendations at three price points ($150–$1,000+), see the [Hardware Guide](https://www.projectnomad.us/hardware).**
 
-Again, Project N.O.M.A.D. itself is quite lightweight - it's the tools and resources you choose to install with N.O.M.A.D. that will determine the specs required for your unique deployment
+Again, Project N.O.M.A.D. itself is quite lightweight — it's the tools and resources you choose to install with N.O.M.A.D. that will determine the specs required for your unique deployment
 
 #### Running AI models on a different host
 By default, N.O.M.A.D.'s installer will attempt to setup Ollama on the host when the AI Assistant is installed. However, if you would like to run the AI model on a different host, you can go to the settings of of the AI assistant and input a URL for either an ollama or OpenAI-compatible API server (such as LM Studio).  
-Note that if you use Ollama on a different host, you must start the server with this option `OLLAMA_HOST=0.0.0.0`.  
-Ollama is the preferred way to use the AI assistant as it has features such as model download that OpenAI API does not support. So when using LM Studio for example, you will have to use LM Studio to download models.
+Note that if you use Ollama on a different host, you must start the server with this option: `OLLAMA_HOST=0.0.0.0`.  
+Ollama is the preferred way to use the AI assistant, as it has features such as model download that OpenAI API does not support. So when using LM Studio, for example, you will have to use LM Studio to download models.
 You are responsible for the setup of Ollama/OpenAI server on the other host.
 
 ## Frequently Asked Questions (FAQ)
@@ -108,7 +108,7 @@ Project N.O.M.A.D. is designed for offline usage. An internet connection is only
 To test internet connectivity, N.O.M.A.D. attempts to make a request to Cloudflare's utility endpoint, `https://1.1.1.1/cdn-cgi/trace` and checks for a successful response.
 
 ## About Security
-By design, Project N.O.M.A.D. is intended to be open and available without hurdles - it includes no authentication. If you decide to connect your device to a local network after install (e.g. for allowing other devices to access it's resources), you can block/open ports to control which services are exposed.
+By design, Project N.O.M.A.D. is intended to be open and available without hurdles — it includes no authentication. If you decide to connect your device to a local network after install (e.g. for allowing other devices to access its resources), you can block/open ports to control which services are exposed.
 
 **Will authentication be added in the future?** Maybe. It's not currently a priority, but if there's enough demand for it, we may consider building in an optional authentication layer in a future release to support uses cases where multiple users need access to the same instance but with different permission levels (e.g. family use with parental controls, classroom use with teacher/admin accounts, etc.). We have a suggestion for this on our public roadmap, so if this is something you'd like to see, please upvote it here: https://roadmap.projectnomad.us/posts/1/user-authentication-please-build-in-user-auth-with-admin-user-roles
 

From 7943ae5d1f871877c55099f343698dbd32cde0fc Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Sat, 6 Jun 2026 17:59:35 +0000
Subject: [PATCH 11/83] chore(deps): bump axios to 1.17.0 in admin

---
 admin/package-lock.json | 36 +++++++++++++++++++++++++++++++-----
 admin/package.json      |  2 +-
 2 files changed, 32 insertions(+), 6 deletions(-)

diff --git a/admin/package-lock.json b/admin/package-lock.json
index 9821ab4..bf53709 100644
--- a/admin/package-lock.json
+++ b/admin/package-lock.json
@@ -38,7 +38,7 @@
         "@vinejs/vine": "3.0.1",
         "@vitejs/plugin-react": "4.7.0",
         "autoprefixer": "10.4.24",
-        "axios": "1.15.0",
+        "axios": "1.17.0",
         "better-sqlite3": "12.6.2",
         "bullmq": "5.67.2",
         "cheerio": "1.2.0",
@@ -6369,16 +6369,42 @@
       }
     },
     "node_modules/axios": {
-      "version": "1.15.0",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.15.0.tgz",
-      "integrity": "sha512-wWyJDlAatxk30ZJer+GeCWS209sA42X+N5jU2jy6oHTp7ufw8uzUTVFBX9+wTfAlhiJXGS0Bq7X6efruWjuK9Q==",
+      "version": "1.17.0",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.17.0.tgz",
+      "integrity": "sha512-J8SwNxprqqpbfenehxWYXE7CW+wM1BB4w3+N+g+/Wx40xM4rsLrfPmHHxSWIxJLYDgSY/HqlFPIYb2/S3rxafw==",
       "license": "MIT",
       "dependencies": {
-        "follow-redirects": "^1.15.11",
+        "follow-redirects": "^1.16.0",
         "form-data": "^4.0.5",
+        "https-proxy-agent": "^5.0.1",
         "proxy-from-env": "^2.1.0"
       }
     },
+    "node_modules/axios/node_modules/agent-base": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
+      "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 6.0.0"
+      }
+    },
+    "node_modules/axios/node_modules/https-proxy-agent": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
+      "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "6",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
     "node_modules/bail": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/bail/-/bail-2.0.2.tgz",
diff --git a/admin/package.json b/admin/package.json
index 8923031..51e14ec 100644
--- a/admin/package.json
+++ b/admin/package.json
@@ -91,7 +91,7 @@
     "@vinejs/vine": "3.0.1",
     "@vitejs/plugin-react": "4.7.0",
     "autoprefixer": "10.4.24",
-    "axios": "1.15.0",
+    "axios": "1.17.0",
     "better-sqlite3": "12.6.2",
     "bullmq": "5.67.2",
     "cheerio": "1.2.0",

From e38dbf8a650b6ad6ca9ba2ea5e598f46401c5c4d Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Tue, 2 Jun 2026 15:46:30 -0700
Subject: [PATCH 12/83] feat(zim): add "Rescan Library" button for sideloaded
 ZIM files

Adds a user-facing trigger to rebuild the Kiwix library index from the
ZIM files currently on disk. Covers the sideload case: a user copies a
.zim onto the box (USB, SSH, network share) outside NOMAD's download
flow, and Kiwix has no way to discover it without regenerating the
library index.

Reuses the existing native KiwixLibraryService.rebuildFromDisk() (which
also extracts embedded favicons natively), so no kiwix-tools container
and no icon-patch step are needed. In library mode (--monitorLibrary)
kiwix-serve hot-reloads the XML automatically; only legacy glob-mode
containers are restarted.

- KiwixLibraryService.rebuildFromDisk now returns the book count; adds
  getBookCount() for the before/after delta
- ZimService.rescanLibrary() orchestrates rebuild + legacy restart
- POST /api/zim/rescan-library + ZimController.rescanLibrary
- "Rescan Library" button on the Content Manager page (shown when Kiwix
  is installed) with a success toast reporting books found

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 admin/app/controllers/zim_controller.ts     |  8 ++++++
 admin/app/services/kiwix_library_service.ts | 17 ++++++++++-
 admin/app/services/zim_service.ts           | 30 ++++++++++++++++++++
 admin/inertia/lib/api.ts                    | 12 ++++++++
 admin/inertia/pages/settings/zim/index.tsx  | 31 ++++++++++++++++++++-
 admin/start/routes.ts                       |  2 ++
 6 files changed, 98 insertions(+), 2 deletions(-)

diff --git a/admin/app/controllers/zim_controller.ts b/admin/app/controllers/zim_controller.ts
index 006e59b..0087e76 100644
--- a/admin/app/controllers/zim_controller.ts
+++ b/admin/app/controllers/zim_controller.ts
@@ -56,6 +56,14 @@ export default class ZimController {
     }
   }
 
+  async rescanLibrary({}: HttpContext) {
+    const result = await this.zimService.rescanLibrary()
+    return {
+      message: 'Kiwix library rescanned',
+      ...result,
+    }
+  }
+
   async delete({ request, response }: HttpContext) {
     const payload = await request.validateUsing(filenameParamValidator)
 
diff --git a/admin/app/services/kiwix_library_service.ts b/admin/app/services/kiwix_library_service.ts
index c7aeabd..183afe6 100644
--- a/admin/app/services/kiwix_library_service.ts
+++ b/admin/app/services/kiwix_library_service.ts
@@ -187,7 +187,21 @@ export class KiwixLibraryService {
       .filter((b) => b.id && b.path)
   }
 
-  async rebuildFromDisk(opts?: { excludeFilenames?: string[] }): Promise<void> {
+  /**
+   * Returns the number of books currently listed in the library XML, or 0 if the
+   * file doesn't exist yet. Used to report a before/after delta on a manual rescan.
+   */
+  async getBookCount(): Promise<number> {
+    try {
+      const content = await readFile(this.getLibraryFilePath(), 'utf-8')
+      return this._parseExistingBooks(content).length
+    } catch (err: any) {
+      if (err.code === 'ENOENT') return 0
+      throw err
+    }
+  }
+
+  async rebuildFromDisk(opts?: { excludeFilenames?: string[] }): Promise<number> {
     const dirPath = join(process.cwd(), ZIM_STORAGE_PATH)
     await ensureDirectoryExists(dirPath)
 
@@ -221,6 +235,7 @@ export class KiwixLibraryService {
     const xml = this._buildXml(books)
     await this._atomicWrite(xml)
     logger.info(`[KiwixLibraryService] Rebuilt library XML with ${books.length} book(s).`)
+    return books.length
   }
 
   async addBook(filename: string): Promise<void> {
diff --git a/admin/app/services/zim_service.ts b/admin/app/services/zim_service.ts
index 4c8d430..aeaa8ff 100644
--- a/admin/app/services/zim_service.ts
+++ b/admin/app/services/zim_service.ts
@@ -390,6 +390,36 @@ export class ZimService {
     }
   }
 
+  /**
+   * Rebuilds the kiwix library XML from whatever ZIM files are currently on disk.
+   *
+   * This is the manual counterpart to the automatic rebuilds that run after a
+   * download or delete. It exists for the sideload case: a user copies a .zim file
+   * onto the box (USB, SSH, network share) outside the download flow, and kiwix has
+   * no way to discover it without regenerating the library index.
+   *
+   * In library mode (--monitorLibrary) kiwix-serve hot-reloads the XML on its own, so
+   * no restart is needed. Only legacy glob-mode containers are restarted to pick up
+   * the change. Returns the book count before and after plus the number added.
+   */
+  async rescanLibrary(): Promise<{ before: number; after: number; added: number }> {
+    const kiwixLibraryService = new KiwixLibraryService()
+    const before = await kiwixLibraryService.getBookCount()
+    const after = await kiwixLibraryService.rebuildFromDisk()
+
+    const isLegacy = await this.dockerService.isKiwixOnLegacyConfig()
+    if (isLegacy) {
+      logger.info('[ZimService] Kiwix in legacy mode — restarting container after rescan.')
+      await this.dockerService
+        .affectContainer(SERVICE_NAMES.KIWIX, 'restart')
+        .catch((error) => {
+          logger.error('[ZimService] Failed to restart KIWIX container after rescan:', error)
+        })
+    }
+
+    return { before, after, added: Math.max(0, after - before) }
+  }
+
   async delete(file: string): Promise<void> {
     let fileName = file
     if (!fileName.endsWith('.zim')) {
diff --git a/admin/inertia/lib/api.ts b/admin/inertia/lib/api.ts
index b6372e9..83950a9 100644
--- a/admin/inertia/lib/api.ts
+++ b/admin/inertia/lib/api.ts
@@ -762,6 +762,18 @@ class API {
     })()
   }
 
+  async rescanZimLibrary() {
+    return catchInternal(async () => {
+      const response = await this.client.post<{
+        message: string
+        before: number
+        after: number
+        added: number
+      }>('/zim/rescan-library')
+      return response.data
+    })()
+  }
+
   async listDownloadJobs(filetype?: string): Promise<DownloadJobWithProgress[] | undefined> {
     return catchInternal(async () => {
       const endpoint = filetype ? `/downloads/jobs/${filetype}` : '/downloads/jobs'
diff --git a/admin/inertia/pages/settings/zim/index.tsx b/admin/inertia/pages/settings/zim/index.tsx
index 68ae2b1..2c727dc 100644
--- a/admin/inertia/pages/settings/zim/index.tsx
+++ b/admin/inertia/pages/settings/zim/index.tsx
@@ -9,6 +9,7 @@ import { useModals } from '~/context/ModalContext'
 import StyledModal from '~/components/StyledModal'
 import useServiceInstalledStatus from '~/hooks/useServiceInstalledStatus'
 import Alert from '~/components/Alert'
+import { useNotifications } from '~/context/NotificationContext'
 import { ZimFileWithMetadata } from '../../../../types/zim'
 import { SERVICE_NAMES } from '../../../../constants/service_names'
 import { formatBytes } from '~/lib/util'
@@ -20,6 +21,7 @@ type SortDirection = 'asc' | 'desc'
 export default function ZimPage() {
   const queryClient = useQueryClient()
   const { openModal, closeAllModals } = useModals()
+  const { addNotification } = useNotifications()
   const { isInstalled } = useServiceInstalledStatus(SERVICE_NAMES.KIWIX)
   const [sortKey, setSortKey] = useState<SortKey>('size')
   const [sortDirection, setSortDirection] = useState<SortDirection>('desc')
@@ -105,18 +107,45 @@ export default function ZimPage() {
     },
   })
 
+  const rescanMutation = useMutation({
+    mutationFn: async () => api.rescanZimLibrary(),
+    onSuccess: (result) => {
+      // catchInternal returns undefined on error (and shows its own error toast)
+      if (!result) return
+      queryClient.invalidateQueries({ queryKey: ['zim-files'] })
+      addNotification({
+        type: 'success',
+        message:
+          result.added > 0
+            ? `Found ${result.added} new ${result.added === 1 ? 'book' : 'books'}. Library now has ${result.after}.`
+            : `Library is up to date (${result.after} ${result.after === 1 ? 'book' : 'books'}).`,
+      })
+    },
+  })
+
   return (
     <SettingsLayout>
       <Head title="Content Manager | Project N.O.M.A.D." />
       <div className="xl:pl-72 w-full">
         <main className="px-12 py-6">
-          <div className="flex items-center justify-between">
+          <div className="flex items-center justify-between gap-4">
             <div className="flex flex-col">
               <h1 className="text-4xl font-semibold mb-2">Content Manager</h1>
               <p className="text-text-muted">
                 Manage your stored content files.
               </p>
             </div>
+            {isInstalled && (
+              <StyledButton
+                variant="secondary"
+                icon={'IconRefresh'}
+                loading={rescanMutation.isPending}
+                title="Rebuild the Kiwix library index from the files on disk. Use this after manually adding ZIM files outside of NOMAD."
+                onClick={() => rescanMutation.mutate()}
+              >
+                Rescan Library
+              </StyledButton>
+            )}
           </div>
           {!isInstalled && (
             <Alert
diff --git a/admin/start/routes.ts b/admin/start/routes.ts
index 8435778..9372387 100644
--- a/admin/start/routes.ts
+++ b/admin/start/routes.ts
@@ -196,6 +196,8 @@ router
     router.delete('/custom-libraries/:id', [ZimController, 'removeCustomLibrary'])
     router.get('/browse-library', [ZimController, 'browseLibrary'])
 
+    router.post('/rescan-library', [ZimController, 'rescanLibrary'])
+
     router.delete('/:filename', [ZimController, 'delete'])
   })
   .prefix('/api/zim')

From be434d755abacefdf752d6aee5a9c41945abb383 Mon Sep 17 00:00:00 2001
From: Jake Turner <jturner@cosmistack.com>
Date: Mon, 25 May 2026 01:15:33 +0000
Subject: [PATCH 13/83] feat: supply depot

---
 .../controllers/supply_depot_controller.ts    |  13 +
 admin/app/controllers/system_controller.ts    | 403 ++++++++-
 admin/app/models/service.ts                   |  10 +
 admin/app/services/custom_app_guard.ts        | 167 ++++
 admin/app/services/docker_service.ts          | 304 ++++++-
 admin/app/services/system_service.ts          |  85 +-
 admin/app/validators/system.ts                |  94 ++
 admin/constants/service_names.ts              |  11 +
 ...001_add_supply_depot_fields_to_services.ts |  34 +
 admin/database/seeders/service_seeder.ts      | 333 ++++++-
 admin/inertia/components/CustomAppModal.tsx   | 540 ++++++++++++
 admin/inertia/components/ServiceLogsModal.tsx |  52 ++
 .../inertia/components/ServiceStatsModal.tsx  | 102 +++
 admin/inertia/components/StyledModal.tsx      |   3 +
 admin/inertia/components/inputs/Select.tsx    | 106 +++
 admin/inertia/layouts/SettingsLayout.tsx      |   2 +-
 admin/inertia/lib/api.ts                      | 145 ++++
 admin/inertia/lib/icons.ts                    |  51 +-
 admin/inertia/pages/home.tsx                  |   6 +-
 admin/inertia/pages/supply-depot.tsx          | 812 ++++++++++++++++++
 admin/start/routes.ts                         |  14 +-
 admin/tests/unit/custom_app_guard.spec.ts     | 112 +++
 admin/types/services.ts                       |   2 +
 23 files changed, 3370 insertions(+), 31 deletions(-)
 create mode 100644 admin/app/controllers/supply_depot_controller.ts
 create mode 100644 admin/app/services/custom_app_guard.ts
 create mode 100644 admin/database/migrations/1772000000001_add_supply_depot_fields_to_services.ts
 create mode 100644 admin/inertia/components/CustomAppModal.tsx
 create mode 100644 admin/inertia/components/ServiceLogsModal.tsx
 create mode 100644 admin/inertia/components/ServiceStatsModal.tsx
 create mode 100644 admin/inertia/components/inputs/Select.tsx
 create mode 100644 admin/inertia/pages/supply-depot.tsx
 create mode 100644 admin/tests/unit/custom_app_guard.spec.ts

diff --git a/admin/app/controllers/supply_depot_controller.ts b/admin/app/controllers/supply_depot_controller.ts
new file mode 100644
index 0000000..5225dd4
--- /dev/null
+++ b/admin/app/controllers/supply_depot_controller.ts
@@ -0,0 +1,13 @@
+import { SystemService } from '#services/system_service'
+import { inject } from '@adonisjs/core'
+import type { HttpContext } from '@adonisjs/core/http'
+
+@inject()
+export default class SupplyDepotController {
+  constructor(private systemService: SystemService) {}
+
+  async index({ inertia }: HttpContext) {
+    const services = await this.systemService.getServices({ installedOnly: false })
+    return inertia.render('supply-depot', { system: { services } })
+  }
+}
diff --git a/admin/app/controllers/system_controller.ts b/admin/app/controllers/system_controller.ts
index 8967e6d..abace4f 100644
--- a/admin/app/controllers/system_controller.ts
+++ b/admin/app/controllers/system_controller.ts
@@ -3,10 +3,28 @@ import { SystemService } from '#services/system_service'
 import { SystemUpdateService } from '#services/system_update_service'
 import { ContainerRegistryService } from '#services/container_registry_service'
 import { CheckServiceUpdatesJob } from '#jobs/check_service_updates_job'
-import { affectServiceValidator, checkLatestVersionValidator, installServiceValidator, subscribeToReleaseNotesValidator, updateServiceValidator } from '#validators/system';
+import {
+  affectServiceValidator,
+  checkLatestVersionValidator,
+  customAppValidator,
+  deleteCustomAppValidator,
+  installServiceValidator,
+  preflightCustomValidator,
+  preflightValidator,
+  serviceLogsValidator,
+  subscribeToReleaseNotesValidator,
+  updateCustomAppValidator,
+  updateServiceValidator,
+} from '#validators/system'
+import {
+  DEFAULT_CPUS,
+  DEFAULT_MEMORY_MB,
+  evaluateCustomApp,
+} from '#services/custom_app_guard'
 import { inject } from '@adonisjs/core'
 import type { HttpContext } from '@adonisjs/core/http'
 import logger from '@adonisjs/core/services/logger'
+import Service from '#models/service'
 
 @inject()
 export default class SystemController {
@@ -180,4 +198,387 @@ export default class SystemController {
             return 'amd64'
         }
     }
+
+    /**
+     * Pre-install preflight check: reports port conflicts and resource warnings for a service.
+     * Results are advisory — the UI shows warnings but allows the user to force-proceed.
+     */
+    async preflightCheck({ request, response }: HttpContext) {
+        const payload = await request.validateUsing(preflightValidator)
+
+        const service = await Service.query().where('service_name', payload.service_name).first()
+        if (!service) {
+            return response.status(404).send({ error: `Service ${payload.service_name} not found` })
+        }
+
+        // Extract host ports from container_config — the MySQL driver may return JSON columns
+        // as an already-parsed object rather than a string, so guard before calling JSON.parse.
+        const rawConfig = service.container_config
+        const config = rawConfig
+            ? typeof rawConfig === 'object'
+                ? rawConfig
+                : JSON.parse(rawConfig as string)
+            : null
+        const portBindings: Record<string, [{ HostPort: string }]> =
+            config?.HostConfig?.PortBindings ?? {}
+        const hostPorts = Object.values(portBindings)
+            .flat()
+            .map((b) => parseInt(b.HostPort, 10))
+            .filter((p) => !isNaN(p))
+
+        // Parse resource requirements from metadata (same object-guard as container_config)
+        let minMemoryMB = 256
+        let minDiskMB = 512
+        try {
+            const rawMeta = service.metadata
+            const meta = rawMeta
+                ? typeof rawMeta === 'object'
+                    ? rawMeta
+                    : JSON.parse(rawMeta as string)
+                : null
+            if (meta?.minMemoryMB) minMemoryMB = meta.minMemoryMB
+            if (meta?.minDiskMB) minDiskMB = meta.minDiskMB
+        } catch {}
+
+        const [{ conflicts: portConflicts }, resourceWarnings] = await Promise.all([
+            this.dockerService.checkPortConflicts(hostPorts),
+            this.systemService.checkResourceWarnings(minMemoryMB, minDiskMB),
+        ])
+
+        return response.send({ portConflicts, resourceWarnings })
+    }
+
+    /** Return the next suggested host port for a custom app (8600+ range). */
+    async suggestCustomPort({ response }: HttpContext) {
+        const port = await this.systemService.getNextSuggestedCustomPort()
+        return response.send({ port })
+    }
+
+    /**
+     * Service-less preflight for the custom-app form: given host ports, volumes and an image,
+     * report port conflicts, host resource warnings, overridable guard warnings (risky bind
+     * mounts / untrusted or moving-tag images), and hard blocks (docker socket, system dirs,
+     * malformed image). Lets the form give live feedback before a Service record exists.
+     */
+    async preflightCustomApp({ request, response }: HttpContext) {
+        const payload = await request.validateUsing(preflightCustomValidator)
+        const [{ conflicts }, resourceWarnings] = await Promise.all([
+            this.dockerService.checkPortConflicts(payload.ports ?? []),
+            this.systemService.checkResourceWarnings(256, 512),
+        ])
+        // When editing, the app's own container legitimately holds its ports — don't flag those.
+        const portConflicts = payload.exclude_service
+            ? conflicts.filter((c) => c.usedBy !== payload.exclude_service)
+            : conflicts
+        const guard = evaluateCustomApp({ image: payload.image, volumes: payload.volumes })
+        return response.send({
+            portConflicts,
+            resourceWarnings: [...resourceWarnings, ...guard.warnings],
+            blocked: guard.blocked,
+        })
+    }
+
+    /** Create and immediately begin installing a custom app container. */
+    async createCustomApp({ request, response }: HttpContext) {
+        const payload = await request.validateUsing(customAppValidator)
+
+        // Derive a stable service_name from the friendly name
+        const slug = payload.friendly_name
+            .toLowerCase()
+            .replace(/[^a-z0-9]+/g, '_')
+            .replace(/^_+|_+$/g, '')
+        const serviceName = `nomad_custom_${slug}`
+
+        const existing = await Service.query().where('service_name', serviceName).first()
+        if (existing) {
+            return response.status(409).send({
+                success: false,
+                message: `A custom app named "${payload.friendly_name}" already exists. Choose a different name.`,
+            })
+        }
+
+        // Reject duplicate host ports within the request — Docker would otherwise fail at
+        // start time with an opaque "port is already allocated" error.
+        const hostPorts = (payload.ports ?? []).map((p) => p.host)
+        const duplicateHostPorts = [...new Set(hostPorts.filter((p, i) => hostPorts.indexOf(p) !== i))]
+        if (duplicateHostPorts.length) {
+            return response.status(422).send({
+                success: false,
+                message: `Duplicate host port(s): ${duplicateHostPorts.join(', ')}. Each host port can map to only one container.`,
+            })
+        }
+
+        // Security guardrails: hard-block dangerous bind mounts / malformed images regardless of
+        // force; surface overridable warnings (risky paths, untrusted/moving-tag images) unless forced.
+        const guard = evaluateCustomApp({ image: payload.image, volumes: payload.volumes })
+        if (guard.blocked.length) {
+            return response.status(422).send({
+                success: false,
+                message: guard.blocked.join(' '),
+                blocked: guard.blocked,
+            })
+        }
+        if (!payload.force && guard.warnings.length) {
+            return response.status(409).send({
+                success: false,
+                message: guard.warnings.join(' '),
+                warnings: guard.warnings,
+            })
+        }
+
+        // Advisory preflight: surface port conflicts before creating the record so a failed
+        // install doesn't leave a phantom card. The user can re-submit with force=true to override.
+        if (!payload.force && hostPorts.length) {
+            const { conflicts } = await this.dockerService.checkPortConflicts(hostPorts)
+            if (conflicts.length) {
+                return response.status(409).send({
+                    success: false,
+                    message: `Port conflict: ${conflicts
+                        .map((c) => `${c.port} (in use by ${c.usedBy})`)
+                        .join(', ')}.`,
+                    portConflicts: conflicts,
+                })
+            }
+        }
+
+        const { containerConfig, uiLocation } = this.buildCustomContainerConfig(payload)
+
+        await Service.create({
+            service_name: serviceName,
+            friendly_name: payload.friendly_name,
+            container_image: payload.image,
+            container_config: JSON.stringify(containerConfig),
+            ui_location: uiLocation,
+            icon: payload.icon || 'IconBrandDocker',
+            installed: false,
+            installation_status: 'idle',
+            is_dependency_service: false,
+            is_custom: true,
+            category: payload.category ?? 'custom',
+            depends_on: null,
+        })
+
+        const result = await this.dockerService.createContainerPreflight(serviceName)
+        if (result.success) {
+            return response.send({ success: true, message: result.message, service_name: serviceName })
+        }
+        return response.status(400).send({ success: false, message: result.message })
+    }
+
+    /** Delete a custom app: stop + remove its container, then delete the DB record. */
+    async deleteCustomApp({ request, response }: HttpContext) {
+        const payload = await request.validateUsing(deleteCustomAppValidator)
+
+        const service = await Service.query().where('service_name', payload.service_name).first()
+        if (!service) {
+            return response.status(404).send({ error: `Service ${payload.service_name} not found` })
+        }
+        if (!service.is_custom) {
+            return response.status(403).send({ error: 'Only custom apps can be deleted.' })
+        }
+
+        await this.dockerService.removeCustomAppContainer(payload.service_name, payload.remove_image ?? false)
+        await service.delete()
+
+        return response.send({ success: true, message: `Custom app ${payload.service_name} deleted` })
+    }
+
+    /** Re-pull a custom app's image and recreate its container in place (preserving volumes). */
+    async updateCustomApp_pullLatest({ request, response }: HttpContext) {
+        const payload = await request.validateUsing(installServiceValidator)
+
+        const service = await Service.query().where('service_name', payload.service_name).first()
+        if (!service) {
+            return response.status(404).send({ success: false, message: `Service ${payload.service_name} not found` })
+        }
+        if (!service.is_custom) {
+            return response.status(403).send({ success: false, message: 'Only custom apps can be updated this way.' })
+        }
+
+        const result = await this.dockerService.recreateCustomAppContainer(payload.service_name, {
+            forcePull: true,
+        })
+        if (result.success) {
+            return response.send({ success: true, message: result.message })
+        }
+        return response.status(400).send({ success: false, message: result.message })
+    }
+
+    /** Return the last N lines of a service container's logs. */
+    async getServiceLogs({ params, request, response }: HttpContext) {
+        // Scope to managed services only — otherwise any sibling container's logs (admin app,
+        // database) would be readable by name on this unauthenticated API surface.
+        const service = await Service.query().where('service_name', params.name).first()
+        if (!service) {
+            return response.status(404).send({ success: false, message: `Service ${params.name} not found` })
+        }
+        const { tail } = await request.validateUsing(serviceLogsValidator)
+        const result = await this.dockerService.getContainerLogs(params.name, tail ?? 200)
+        if (!result.success) {
+            return response.status(404).send({ success: false, message: result.message })
+        }
+        return response.send({ success: true, logs: result.logs })
+    }
+
+    /** Return a one-shot CPU/memory usage snapshot for a running service container. */
+    async getServiceStats({ params, response }: HttpContext) {
+        // Scope to managed services only (see getServiceLogs).
+        const service = await Service.query().where('service_name', params.name).first()
+        if (!service) {
+            return response.status(404).send({ success: false, message: `Service ${params.name} not found` })
+        }
+        const result = await this.dockerService.getContainerStats(params.name)
+        if (!result.success) {
+            return response.status(404).send({ success: false, message: result.message })
+        }
+        return response.send({ success: true, running: result.running ?? false, stats: result.stats ?? null })
+    }
+
+    /** Return a custom app's current configuration in the editable form-shape. */
+    async getCustomApp({ params, response }: HttpContext) {
+        const service = await Service.query().where('service_name', params.name).first()
+        if (!service) {
+            return response.status(404).send({ error: `Service ${params.name} not found` })
+        }
+        if (!service.is_custom) {
+            return response.status(403).send({ error: 'Only custom apps can be edited.' })
+        }
+        return response.send({ success: true, app: this.parseCustomContainerConfig(service) })
+    }
+
+    /** Reconfigure a custom app: validate + guard, persist the new config, then recreate the container. */
+    async updateCustomApp({ request, response }: HttpContext) {
+        const payload = await request.validateUsing(updateCustomAppValidator)
+
+        const service = await Service.query().where('service_name', payload.service_name).first()
+        if (!service) {
+            return response.status(404).send({ success: false, message: `Service ${payload.service_name} not found` })
+        }
+        if (!service.is_custom) {
+            return response.status(403).send({ success: false, message: 'Only custom apps can be edited.' })
+        }
+
+        // Reject duplicate host ports within the request.
+        const hostPorts = (payload.ports ?? []).map((p) => p.host)
+        const duplicateHostPorts = [...new Set(hostPorts.filter((p, i) => hostPorts.indexOf(p) !== i))]
+        if (duplicateHostPorts.length) {
+            return response.status(422).send({
+                success: false,
+                message: `Duplicate host port(s): ${duplicateHostPorts.join(', ')}. Each host port can map to only one container.`,
+            })
+        }
+
+        // Security guardrails (same posture as create).
+        const guard = evaluateCustomApp({ image: payload.image, volumes: payload.volumes })
+        if (guard.blocked.length) {
+            return response.status(422).send({ success: false, message: guard.blocked.join(' '), blocked: guard.blocked })
+        }
+        if (!payload.force && guard.warnings.length) {
+            return response.status(409).send({ success: false, message: guard.warnings.join(' '), warnings: guard.warnings })
+        }
+
+        // Port conflicts — but ignore ports already held by this app's own container.
+        if (!payload.force && hostPorts.length) {
+            const { conflicts } = await this.dockerService.checkPortConflicts(hostPorts)
+            const external = conflicts.filter((c) => c.usedBy !== payload.service_name)
+            if (external.length) {
+                return response.status(409).send({
+                    success: false,
+                    message: `Port conflict: ${external
+                        .map((c) => `${c.port} (in use by ${c.usedBy})`)
+                        .join(', ')}.`,
+                    portConflicts: external,
+                })
+            }
+        }
+
+        const { containerConfig, uiLocation } = this.buildCustomContainerConfig(payload)
+        service.friendly_name = payload.friendly_name
+        service.container_image = payload.image
+        service.container_config = JSON.stringify(containerConfig)
+        service.ui_location = uiLocation
+        service.category = payload.category ?? service.category ?? 'custom'
+        if (payload.icon) service.icon = payload.icon
+        await service.save()
+
+        const result = await this.dockerService.recreateCustomAppContainer(payload.service_name)
+        if (result.success) {
+            return response.send({ success: true, message: result.message, service_name: payload.service_name })
+        }
+        return response.status(400).send({ success: false, message: result.message })
+    }
+
+    /**
+     * Build a Docker container config (HostConfig + ExposedPorts + Env) from custom-app form input,
+     * applying default resource caps. Shared by create and update so both stay in lockstep.
+     */
+    private buildCustomContainerConfig(payload: {
+        ports?: { container: number; host: number }[]
+        volumes?: { host_path: string; container_path: string }[]
+        env?: string[]
+        memory_mb?: number
+        cpus?: number
+    }): { containerConfig: Record<string, any>; uiLocation: string | null } {
+        const portBindings: Record<string, [{ HostPort: string }]> = {}
+        const exposedPorts: Record<string, {}> = {}
+        for (const { container, host } of payload.ports ?? []) {
+            portBindings[`${container}/tcp`] = [{ HostPort: String(host) }]
+            exposedPorts[`${container}/tcp`] = {}
+        }
+
+        const binds = (payload.volumes ?? []).map(
+            ({ host_path, container_path }) => `${host_path}:${container_path}`
+        )
+
+        // Resource caps so a runaway custom container can't starve the host. Memory is bytes;
+        // NanoCpus is CPUs × 1e9. Defaults are generous and user-overridable.
+        const memoryBytes = (payload.memory_mb ?? DEFAULT_MEMORY_MB) * 1024 * 1024
+        const nanoCpus = Math.round((payload.cpus ?? DEFAULT_CPUS) * 1e9)
+
+        const containerConfig: Record<string, any> = {
+            HostConfig: {
+                RestartPolicy: { Name: 'unless-stopped' },
+                PortBindings: portBindings,
+                Memory: memoryBytes,
+                NanoCpus: nanoCpus,
+                ...(binds.length ? { Binds: binds } : {}),
+            },
+            ExposedPorts: exposedPorts,
+            ...(payload.env?.length ? { Env: payload.env } : {}),
+        }
+
+        const firstHostPort = payload.ports?.[0]?.host
+        const uiLocation = firstHostPort ? String(firstHostPort) : null
+        return { containerConfig, uiLocation }
+    }
+
+    /** Inverse of buildCustomContainerConfig: turn a stored Service into the editable form-shape. */
+    private parseCustomContainerConfig(service: Service) {
+        const raw = service.container_config
+        const config = raw ? (typeof raw === 'object' ? raw : JSON.parse(raw as string)) : {}
+        const hostConfig = config?.HostConfig ?? {}
+
+        const ports = Object.entries(hostConfig.PortBindings ?? {}).map(([key, val]: [string, any]) => ({
+            container: Number.parseInt(key, 10),
+            host: Number.parseInt(val?.[0]?.HostPort, 10),
+        }))
+
+        const volumes = (hostConfig.Binds ?? []).map((bind: string) => {
+            const idx = bind.indexOf(':')
+            return { host_path: bind.slice(0, idx), container_path: bind.slice(idx + 1) }
+        })
+
+        return {
+            service_name: service.service_name,
+            friendly_name: service.friendly_name,
+            image: service.container_image,
+            category: service.category ?? 'custom',
+            icon: service.icon ?? 'IconBrandDocker',
+            ports,
+            volumes,
+            env: (config?.Env ?? []) as string[],
+            memory_mb: hostConfig.Memory ? Math.round(hostConfig.Memory / (1024 * 1024)) : undefined,
+            cpus: hostConfig.NanoCpus ? hostConfig.NanoCpus / 1e9 : undefined,
+        }
+    }
 }
\ No newline at end of file
diff --git a/admin/app/models/service.ts b/admin/app/models/service.ts
index 1c06ed5..452122a 100644
--- a/admin/app/models/service.ts
+++ b/admin/app/models/service.ts
@@ -62,6 +62,16 @@ export default class Service extends BaseModel {
   @column()
   declare metadata: string | null
 
+  @column({
+    serialize(value) {
+      return Boolean(value)
+    },
+  })
+  declare is_custom: boolean
+
+  @column()
+  declare category: string | null
+
   @column()
   declare source_repo: string | null
 
diff --git a/admin/app/services/custom_app_guard.ts b/admin/app/services/custom_app_guard.ts
new file mode 100644
index 0000000..cd1f00e
--- /dev/null
+++ b/admin/app/services/custom_app_guard.ts
@@ -0,0 +1,167 @@
+import { dirname, normalize } from 'node:path'
+import env from '#start/env'
+
+/**
+ * Security guardrails for user-defined ("custom app") containers.
+ *
+ * project-nomad runs containers as host siblings via the mounted Docker socket (DooD), so a
+ * misconfigured bind mount or image is a real host-takeover vector. The posture here is
+ * "guardrails with warnings": hard-block the genuinely catastrophic, warn-but-allow the merely
+ * risky so a trusted admin keeps their power without an easy foot-gun.
+ */
+
+export interface GuardEvaluation {
+  /** Hard rejections — the install cannot proceed until these are fixed. */
+  blocked: string[]
+  /** Advisory warnings — overridable via the "install anyway" force flag. */
+  warnings: string[]
+}
+
+/** Absolute host directories that must never be bind-mounted into a custom container. */
+const SYSTEM_BLOCK_PREFIXES = ['/etc', '/proc', '/sys', '/boot', '/dev', '/run', '/var/run']
+
+/** Registries we ship curated apps from; anything else is allowed but warned on. */
+const TRUSTED_REGISTRIES = ['docker.io', 'registry-1.docker.io', 'ghcr.io', 'lscr.io', 'quay.io']
+
+/** Resolve the managed storage root (where bind mounts are expected to live). */
+export function getStorageRoot(): string {
+  return normalize(env.get('NOMAD_STORAGE_PATH', '/opt/project-nomad/storage')).replace(/\/+$/, '')
+}
+
+/** Normalize an absolute path: collapse `..`/`.` segments and strip any trailing slash. */
+function normalizeHostPath(p: string): string {
+  return normalize(p).replace(/\/+$/, '') || '/'
+}
+
+/** True when `child` equals `ancestor` or sits beneath it. */
+function isWithin(child: string, ancestor: string): boolean {
+  return child === ancestor || child.startsWith(ancestor + '/')
+}
+
+/**
+ * Evaluate user-supplied bind mounts. Hard-blocks the Docker socket, core system directories,
+ * and any mount at or above project-nomad's own install tree (which would expose its code/data).
+ * Warns on any host path outside the managed storage root.
+ */
+export function evaluateBindMounts(
+  volumes: { host_path: string; container_path: string }[]
+): GuardEvaluation {
+  const blocked: string[] = []
+  const warnings: string[] = []
+
+  const storageRoot = getStorageRoot()
+  // The install tree is the parent of the storage root (e.g. /opt/project-nomad). Mounting it —
+  // or any ancestor, up to and including `/` — would hand a container project-nomad's own files.
+  const installRoot = dirname(storageRoot)
+
+  for (const { host_path: hostPath, container_path: containerPath } of volumes) {
+    const host = normalizeHostPath(hostPath)
+
+    if (!hostPath.startsWith('/')) {
+      blocked.push(`Volume host path "${hostPath}" must be an absolute path.`)
+      continue
+    }
+    if (!containerPath.startsWith('/')) {
+      blocked.push(`Volume container path "${containerPath}" must be an absolute path.`)
+      continue
+    }
+
+    // A colon is Docker's bind delimiter (host:container:options). A path containing one would be
+    // re-split by Docker into a different mount than the one validated here — reject it outright so
+    // the checks below can't be bypassed by a parse-differential. (The validator blocks this too;
+    // this keeps the guard self-defending for any caller that skips validation.)
+    if (hostPath.includes(':') || containerPath.includes(':')) {
+      blocked.push(`Volume paths must not contain a colon (":"): "${hostPath}" → "${containerPath}".`)
+      continue
+    }
+
+    // The Docker socket is the most dangerous mount of all — full control of the host daemon.
+    if (host.endsWith('docker.sock') || /\/docker\.sock$/.test(host)) {
+      blocked.push(
+        `Mounting the Docker socket ("${hostPath}") is not allowed — it grants full host control.`
+      )
+      continue
+    }
+
+    // Core system directories.
+    if (host === '/' || SYSTEM_BLOCK_PREFIXES.some((p) => isWithin(host, p))) {
+      blocked.push(`Mounting system directory "${hostPath}" is not allowed.`)
+      continue
+    }
+
+    // At or above project-nomad's own install tree (covers `/`, `/opt`, `/opt/project-nomad`).
+    if (host === installRoot || isWithin(installRoot, host)) {
+      blocked.push(
+        `Mounting "${hostPath}" would expose project-nomad's own files and is not allowed.`
+      )
+      continue
+    }
+
+    // Anything outside the managed storage root is allowed but flagged.
+    if (!isWithin(host, storageRoot)) {
+      warnings.push(
+        `Volume "${hostPath}" is outside the managed storage root (${storageRoot}). Make sure you trust this image with access to that path.`
+      )
+    }
+  }
+
+  return { blocked, warnings }
+}
+
+/**
+ * Evaluate a Docker image reference. Hard-blocks malformed references; warns on moving tags
+ * (`:latest`/untagged) and images from registries outside the trusted set.
+ */
+export function evaluateImageReference(image: string): GuardEvaluation {
+  const blocked: string[] = []
+  const warnings: string[] = []
+
+  const ref = image.trim()
+  // Loose validity check: no whitespace/control chars, and a sane character set for an image ref.
+  if (!ref || /\s/.test(ref) || !/^[\w./:@-]+$/.test(ref)) {
+    blocked.push(`"${image}" is not a valid image reference.`)
+    return { blocked, warnings }
+  }
+
+  // Split off any digest, then any tag, to inspect the registry and tag.
+  const [nameAndTag] = ref.split('@')
+  const firstSegment = nameAndTag.split('/')[0]
+  const hasRegistryHost =
+    nameAndTag.includes('/') && (firstSegment.includes('.') || firstSegment.includes(':'))
+  const registry = hasRegistryHost ? firstSegment.split(':')[0] : 'docker.io'
+
+  if (!TRUSTED_REGISTRIES.includes(registry)) {
+    warnings.push(
+      `Image is from "${registry}", which is outside project-nomad's trusted registries. Only install images you trust.`
+    )
+  }
+
+  // Determine the tag (ignore a colon that's part of a registry host:port in the first segment).
+  const remainder = hasRegistryHost ? nameAndTag.slice(firstSegment.length + 1) : nameAndTag
+  const tag = remainder.includes(':') ? remainder.split(':').pop() : undefined
+  const hasDigest = ref.includes('@sha256:')
+  if (!hasDigest && (!tag || tag === 'latest')) {
+    warnings.push(
+      `Image "${image}" uses a moving tag (${tag ? ':latest' : 'no tag'}). Pin a specific version for reproducible installs.`
+    )
+  }
+
+  return { blocked, warnings }
+}
+
+/** Combine bind-mount and image evaluations into a single result. */
+export function evaluateCustomApp(input: {
+  image?: string
+  volumes?: { host_path: string; container_path: string }[]
+}): GuardEvaluation {
+  const bind = evaluateBindMounts(input.volumes ?? [])
+  const img = input.image ? evaluateImageReference(input.image) : { blocked: [], warnings: [] }
+  return {
+    blocked: [...bind.blocked, ...img.blocked],
+    warnings: [...bind.warnings, ...img.warnings],
+  }
+}
+
+/** Default resource caps applied to custom containers unless the user overrides them. */
+export const DEFAULT_MEMORY_MB = 1024
+export const DEFAULT_CPUS = 1
diff --git a/admin/app/services/docker_service.ts b/admin/app/services/docker_service.ts
index aad3927..760162b 100644
--- a/admin/app/services/docker_service.ts
+++ b/admin/app/services/docker_service.ts
@@ -781,8 +781,15 @@ export class DockerService {
     try {
       const service = await Service.query().where('service_name', serviceName).first()
       if (service) {
-        service.installation_status = 'error'
-        await service.save()
+        if (service.is_custom) {
+          // Custom apps have no seeder definition to fall back to — leaving the row would
+          // surface a phantom, un-installable card. Remove the record entirely so a failed
+          // install cleanly disappears. (The 'error' broadcast has already fired upstream.)
+          await service.delete()
+        } else {
+          service.installation_status = 'error'
+          await service.save()
+        }
       }
       this.activeInstallations.delete(serviceName)
 
@@ -1363,6 +1370,299 @@ export class DockerService {
     }
   }
 
+  /**
+   * Check whether any of the supplied host ports are already bound by a running or stopped
+   * Docker container. Uses the Docker API exclusively — probing ports via net.createServer()
+   * would only test the admin container's own network namespace (DooD pattern), not the host.
+   */
+  async checkPortConflicts(
+    ports: number[]
+  ): Promise<{ conflicts: { port: number; usedBy: string }[] }> {
+    if (!ports.length) return { conflicts: [] }
+
+    try {
+      const containers = await this.docker.listContainers({ all: true })
+      const bound = new Map<number, string>()
+
+      for (const c of containers) {
+        const name = (c.Names[0] || '').replace('/', '')
+        for (const p of c.Ports) {
+          if (p.PublicPort) bound.set(p.PublicPort, name || c.Id.slice(0, 12))
+        }
+      }
+
+      const conflicts = ports
+        .filter((p) => bound.has(p))
+        .map((p) => ({ port: p, usedBy: bound.get(p)! }))
+
+      return { conflicts }
+    } catch (error: any) {
+      logger.warn(`[DockerService] checkPortConflicts failed: ${error.message}`)
+      return { conflicts: [] }
+    }
+  }
+
+  /**
+   * Remove a custom-app container and, when `removeImage` is set, its backing image too. Called
+   * before deleting the DB record. Image removal is best-effort: a shared/in-use image is left alone.
+   */
+  async removeCustomAppContainer(
+    serviceName: string,
+    removeImage = false
+  ): Promise<{ success: boolean; message: string }> {
+    try {
+      const containers = await this.docker.listContainers({ all: true })
+      const container = containers.find((c) => c.Names.includes(`/${serviceName}`))
+
+      if (!container) return { success: true, message: 'No container found — nothing to remove' }
+
+      const imageRef = container.Image
+      const c = this.docker.getContainer(container.Id)
+      if (container.State === 'running') await c.stop()
+      await c.remove({ force: true })
+
+      if (removeImage && imageRef) {
+        try {
+          await this.docker.getImage(imageRef).remove()
+        } catch (imgErr: any) {
+          // Non-fatal: the image may be shared with another container or already gone.
+          logger.warn(`[DockerService] Could not remove image ${imageRef} for ${serviceName}: ${imgErr.message}`)
+        }
+      }
+
+      this.invalidateServicesStatusCache()
+      return { success: true, message: `Container ${serviceName} removed` }
+    } catch (error: any) {
+      logger.error({ err: error }, `[DockerService] removeCustomAppContainer failed for ${serviceName}`)
+      return { success: false, message: error.message }
+    }
+  }
+
+  /** Find a container by its managed service name (`/serviceName`), or null. */
+  private async _findContainerByName(serviceName: string) {
+    const containers = await this.docker.listContainers({ all: true })
+    return containers.find((c) => c.Names.includes(`/${serviceName}`)) ?? null
+  }
+
+  /**
+   * Decode the multiplexed stream Docker returns for non-TTY container logs. Each frame is an
+   * 8-byte header ([streamType, 0,0,0, big-endian payloadSize]) followed by the payload.
+   */
+  private _demuxDockerLog(buf: Buffer): string {
+    let out = ''
+    let offset = 0
+    while (offset + 8 <= buf.length) {
+      const size = buf.readUInt32BE(offset + 4)
+      offset += 8
+      if (offset + size > buf.length) {
+        out += buf.toString('utf8', offset)
+        break
+      }
+      out += buf.toString('utf8', offset, offset + size)
+      offset += size
+    }
+    return out
+  }
+
+  /** Return the last `tail` lines of a service container's combined stdout/stderr. */
+  async getContainerLogs(
+    serviceName: string,
+    tail = 200
+  ): Promise<{ success: boolean; logs?: string; message?: string }> {
+    try {
+      const info = await this._findContainerByName(serviceName)
+      if (!info) return { success: false, message: `No container found for ${serviceName}` }
+
+      const container = this.docker.getContainer(info.Id)
+      const inspect = await container.inspect()
+      const tty = inspect.Config?.Tty ?? false
+
+      const buf = (await container.logs({
+        stdout: true,
+        stderr: true,
+        follow: false,
+        tail,
+        timestamps: false,
+      })) as unknown as Buffer
+
+      const logs = tty ? buf.toString('utf8') : this._demuxDockerLog(buf)
+      return { success: true, logs }
+    } catch (error: any) {
+      logger.error({ err: error }, `[DockerService] getContainerLogs failed for ${serviceName}`)
+      return { success: false, message: error.message }
+    }
+  }
+
+  /**
+   * Return a single resource-usage snapshot (CPU %, memory) for a running service container.
+   * Uses Docker's non-streaming stats, which include precpu_stats so CPU % is computable.
+   */
+  async getContainerStats(serviceName: string): Promise<{
+    success: boolean
+    running?: boolean
+    stats?: { cpuPercent: number; memUsageBytes: number; memLimitBytes: number; memPercent: number }
+    message?: string
+  }> {
+    try {
+      const info = await this._findContainerByName(serviceName)
+      if (!info) return { success: false, message: `No container found for ${serviceName}` }
+      if (info.State !== 'running') return { success: true, running: false }
+
+      const container = this.docker.getContainer(info.Id)
+      const s: any = await container.stats({ stream: false })
+
+      const cpuDelta =
+        (s.cpu_stats?.cpu_usage?.total_usage ?? 0) - (s.precpu_stats?.cpu_usage?.total_usage ?? 0)
+      const systemDelta =
+        (s.cpu_stats?.system_cpu_usage ?? 0) - (s.precpu_stats?.system_cpu_usage ?? 0)
+      const numCpus =
+        s.cpu_stats?.online_cpus ?? s.cpu_stats?.cpu_usage?.percpu_usage?.length ?? 1
+      const cpuPercent =
+        systemDelta > 0 && cpuDelta > 0 ? (cpuDelta / systemDelta) * numCpus * 100 : 0
+
+      // Subtract page cache from usage to better reflect the container's working set.
+      const cache = s.memory_stats?.stats?.cache ?? s.memory_stats?.stats?.inactive_file ?? 0
+      const memUsageBytes = Math.max(0, (s.memory_stats?.usage ?? 0) - cache)
+      const memLimitBytes = s.memory_stats?.limit ?? 0
+      const memPercent = memLimitBytes > 0 ? (memUsageBytes / memLimitBytes) * 100 : 0
+
+      return {
+        success: true,
+        running: true,
+        stats: {
+          cpuPercent: Math.round(cpuPercent * 10) / 10,
+          memUsageBytes,
+          memLimitBytes,
+          memPercent: Math.round(memPercent * 10) / 10,
+        },
+      }
+    } catch (error: any) {
+      logger.error({ err: error }, `[DockerService] getContainerStats failed for ${serviceName}`)
+      return { success: false, message: error.message }
+    }
+  }
+
+  /**
+   * Wait for a freshly started container to be "ready". If the image declares a HEALTHCHECK we poll
+   * its health until healthy/unhealthy (up to timeoutMs); otherwise we fall back to a 5s settle and
+   * a plain Running check. Returns whether it's ready plus a reason when not.
+   */
+  private async _awaitContainerReady(
+    container: any,
+    timeoutMs = 30000
+  ): Promise<{ ready: boolean; reason?: string }> {
+    let inspect = await container.inspect()
+    const hasHealthcheck = !!inspect.State?.Health
+
+    if (!hasHealthcheck) {
+      await new Promise((r) => setTimeout(r, 5000))
+      inspect = await container.inspect()
+      return inspect.State?.Running
+        ? { ready: true }
+        : { ready: false, reason: 'container did not stay running' }
+    }
+
+    const deadline = Date.now() + timeoutMs
+    while (Date.now() < deadline) {
+      inspect = await container.inspect()
+      if (!inspect.State?.Running) return { ready: false, reason: 'container exited' }
+      const status = inspect.State?.Health?.Status
+      if (status === 'healthy') return { ready: true }
+      if (status === 'unhealthy') return { ready: false, reason: 'failed its health check' }
+      await new Promise((r) => setTimeout(r, 2000))
+    }
+    // Still in "starting" at timeout — accept it if it's at least running rather than roll back a slow boot.
+    return inspect.State?.Running ? { ready: true } : { ready: false, reason: 'health check timed out' }
+  }
+
+  /**
+   * Recreate a custom app's container from its (already-updated) Service record, preserving data.
+   * Uses the same rename-and-rollback safety net as the update flow: the live container is renamed
+   * aside, a new one is created from the new config/image, health-gated, and only then is the old one
+   * removed — otherwise we roll back to it. Bind-mounted data is untouched throughout. Pass
+   * `forcePull` to always re-pull the image first (used by the "update" action for moving tags).
+   */
+  async recreateCustomAppContainer(
+    serviceName: string,
+    opts: { forcePull?: boolean } = {}
+  ): Promise<{ success: boolean; message: string }> {
+    const service = await Service.query().where('service_name', serviceName).first()
+    if (!service) return { success: false, message: `Service ${serviceName} not found` }
+
+    const containerConfig = this._parseContainerConfig(service.container_config)
+    const oldInfo = await this._findContainerByName(serviceName)
+    const oldName = `${serviceName}_old`
+
+    try {
+      // Stop + rename the existing container aside as a rollback safety net.
+      if (oldInfo) {
+        const oldContainer = this.docker.getContainer(oldInfo.Id)
+        if (oldInfo.State === 'running') await oldContainer.stop({ t: 10 }).catch(() => {})
+        await oldContainer.rename({ name: oldName })
+      }
+
+      // Pull the image if it's missing locally, or always when forcePull (e.g. :latest updates).
+      if (opts.forcePull || !(await this._checkImageExists(service.container_image))) {
+        const pullStream = await this.docker.pull(service.container_image)
+        await new Promise((res) => this.docker.modem.followProgress(pullStream, res))
+      }
+
+      const newContainer = await this.docker.createContainer({
+        Image: service.container_image,
+        name: serviceName,
+        Labels: {
+          ...(containerConfig?.Labels ?? {}),
+          'com.docker.compose.project': 'project-nomad-managed',
+          'io.project-nomad.managed': 'true',
+        },
+        ...(containerConfig?.User && { User: containerConfig.User }),
+        HostConfig: containerConfig?.HostConfig ?? {},
+        ...(containerConfig?.ExposedPorts && { ExposedPorts: containerConfig.ExposedPorts }),
+        ...(containerConfig?.Env && { Env: containerConfig.Env }),
+        ...(service.container_command ? { Cmd: service.container_command.split(' ') } : {}),
+        ...(process.env.NODE_ENV === 'production' && {
+          NetworkingConfig: { EndpointsConfig: { [DockerService.NOMAD_NETWORK]: {} } },
+        }),
+      })
+      await newContainer.start()
+
+      // Health gate before discarding the old container.
+      const readiness = await this._awaitContainerReady(newContainer)
+      if (!readiness.ready) throw new Error(`recreated container ${readiness.reason}`)
+
+      if (oldInfo) {
+        const oldRef = await this._findContainerByName(oldName)
+        if (oldRef) await this.docker.getContainer(oldRef.Id).remove({ force: true })
+      }
+      service.installed = true
+      service.installation_status = 'idle'
+      await service.save()
+      this.invalidateServicesStatusCache()
+      return { success: true, message: `Service ${serviceName} reconfigured successfully` }
+    } catch (error: any) {
+      logger.error({ err: error }, `[DockerService] recreateCustomAppContainer failed for ${serviceName}`)
+      // Roll back: discard the failed new container and restore the renamed original.
+      try {
+        const failedNew = await this._findContainerByName(serviceName)
+        if (failedNew) {
+          const c = this.docker.getContainer(failedNew.Id)
+          await c.stop({ t: 5 }).catch(() => {})
+          await c.remove({ force: true }).catch(() => {})
+        }
+        const renamed = await this._findContainerByName(oldName)
+        if (renamed) {
+          const c = this.docker.getContainer(renamed.Id)
+          await c.rename({ name: serviceName })
+          await c.start().catch(() => {})
+        }
+      } catch (rollbackError: any) {
+        logger.error({ err: rollbackError }, `[DockerService] rollback failed for ${serviceName}`)
+      }
+      this.invalidateServicesStatusCache()
+      return { success: false, message: `Reconfigure failed and was rolled back: ${error.message}` }
+    }
+  }
+
   /**
    * Check if a Docker image exists locally.
    * @param imageName - The name and tag of the image (e.g., "nginx:latest")
diff --git a/admin/app/services/system_service.ts b/admin/app/services/system_service.ts
index 42daac6..ed3e5e0 100644
--- a/admin/app/services/system_service.ts
+++ b/admin/app/services/system_service.ts
@@ -308,7 +308,9 @@ export class SystemService {
         'powered_by',
         'display_order',
         'container_image',
-        'available_update_version'
+        'available_update_version',
+        'is_custom',
+        'category'
       )
       .where('is_dependency_service', false)
     if (installedOnly) {
@@ -338,6 +340,8 @@ export class SystemService {
         display_order: service.display_order,
         container_image: service.container_image,
         available_update_version: service.available_update_version,
+        is_custom: service.is_custom,
+        category: service.category,
       })
     }
 
@@ -928,4 +932,83 @@ export class SystemService {
         }
       })
   }
+
+  /**
+   * Check whether the host has enough free memory and disk to comfortably run an app.
+   * Returns an array of human-readable warning strings; an empty array means no concerns.
+   * These are advisory only — the caller decides whether to block or warn.
+   */
+  async checkResourceWarnings(minMemoryMB: number, minDiskMB: number): Promise<string[]> {
+    const warnings: string[] = []
+
+    try {
+      const mem = await si.mem()
+      const availableMB = Math.floor(mem.available / 1024 / 1024)
+      if (availableMB < minMemoryMB) {
+        warnings.push(
+          `Low memory: ${availableMB} MB available, this app recommends at least ${minMemoryMB} MB free.`
+        )
+      }
+    } catch (err: any) {
+      logger.warn(`[SystemService] checkResourceWarnings mem check failed: ${err.message}`)
+    }
+
+    try {
+      const storagePath = env.get('NOMAD_STORAGE_PATH', '/opt/project-nomad/storage')
+      const fsSizes = await si.fsSize()
+      // Find the filesystem whose mount point is the longest prefix of storagePath
+      const fs = fsSizes
+        .filter((f) => storagePath.startsWith(f.mount))
+        .sort((a, b) => b.mount.length - a.mount.length)[0]
+
+      if (fs) {
+        const availableDiskMB = Math.floor((fs.size - fs.used) / 1024 / 1024)
+        if (availableDiskMB < minDiskMB) {
+          warnings.push(
+            `Low disk space: ${availableDiskMB} MB available on ${fs.mount}, this app recommends at least ${minDiskMB} MB free.`
+          )
+        }
+      }
+    } catch (err: any) {
+      logger.warn(`[SystemService] checkResourceWarnings disk check failed: ${err.message}`)
+    }
+
+    return warnings
+  }
+
+  /**
+   * Return the next suggested host port for a custom app in the 8600+ range.
+   * Looks at existing custom service records and all Docker container port bindings.
+   */
+  async getNextSuggestedCustomPort(): Promise<number> {
+    const CUSTOM_PORT_START = 8600
+    const occupied = new Set<number>()
+
+    try {
+      // Ports used by existing custom services in the DB
+      const customServices = await Service.query().where('is_custom', true)
+      for (const svc of customServices) {
+        const config = svc.container_config ? JSON.parse(svc.container_config) : null
+        const bindings = config?.HostConfig?.PortBindings ?? {}
+        for (const binding of Object.values(bindings) as any[]) {
+          const port = parseInt(binding?.[0]?.HostPort, 10)
+          if (!isNaN(port)) occupied.add(port)
+        }
+      }
+
+      // Ports used by any running Docker container in the 8600+ range
+      const containers = await this.dockerService.docker.listContainers({ all: true })
+      for (const c of containers) {
+        for (const p of c.Ports) {
+          if (p.PublicPort && p.PublicPort >= CUSTOM_PORT_START) occupied.add(p.PublicPort)
+        }
+      }
+    } catch (err: any) {
+      logger.warn(`[SystemService] getNextSuggestedCustomPort probe failed: ${err.message}`)
+    }
+
+    let candidate = CUSTOM_PORT_START
+    while (occupied.has(candidate)) candidate += 10
+    return candidate
+  }
 }
diff --git a/admin/app/validators/system.ts b/admin/app/validators/system.ts
index 41eb6a6..5e9b915 100644
--- a/admin/app/validators/system.ts
+++ b/admin/app/validators/system.ts
@@ -31,3 +31,97 @@ export const updateServiceValidator = vine.compile(
     target_version: vine.string().trim(),
   })
 )
+
+export const preflightValidator = vine.compile(
+  vine.object({
+    service_name: vine.string().trim(),
+  })
+)
+
+// Shared sub-schema for a volume bind mapping. A colon is Docker's bind delimiter
+// (host:container:options) — forbid it in either field so a path can't smuggle in an
+// extra segment that the guard reads as safe but Docker re-parses as a different mount.
+const volumeSchema = vine.object({
+  host_path: vine.string().trim().regex(/^[^:]+$/),
+  container_path: vine.string().trim().regex(/^[^:]+$/),
+})
+
+// Environment variables must be KEY=value (value may be empty), matching Docker's Env format.
+const envVarSchema = vine.string().trim().regex(/^[A-Za-z_][A-Za-z0-9_]*=[\s\S]*$/)
+
+// Service-less preflight for the custom-app form: evaluates ports, volumes and image together.
+export const preflightCustomValidator = vine.compile(
+  vine.object({
+    image: vine.string().trim().optional(),
+    ports: vine.array(vine.number().min(1).max(65535)).optional(),
+    volumes: vine.array(volumeSchema).optional(),
+    // When editing, ignore port conflicts caused by this app's own running container.
+    exclude_service: vine.string().trim().optional(),
+  })
+)
+
+export const customAppValidator = vine.compile(
+  vine.object({
+    friendly_name: vine.string().trim().minLength(1).maxLength(100),
+    image: vine.string().trim().minLength(1),
+    ports: vine
+      .array(
+        vine.object({
+          container: vine.number().min(1).max(65535),
+          host: vine.number().min(1024).max(65535),
+        })
+      )
+      .optional(),
+    volumes: vine.array(volumeSchema).optional(),
+    env: vine.array(envVarSchema).optional(),
+    category: vine
+      .enum(['productivity', 'media', 'security', 'networking', 'utility', 'ai', 'education', 'custom'])
+      .optional(),
+    icon: vine.string().trim().optional(),
+    // Optional resource caps (advanced). Default caps are applied when omitted.
+    memory_mb: vine.number().min(64).optional(),
+    cpus: vine.number().min(0.1).max(64).optional(),
+    // When true, bypass advisory preflight (port conflicts / guard warnings) and install anyway.
+    force: vine.boolean().optional(),
+  })
+)
+
+export const deleteCustomAppValidator = vine.compile(
+  vine.object({
+    service_name: vine.string().trim(),
+    // When true, also remove the backing Docker image (best-effort).
+    remove_image: vine.boolean().optional(),
+  })
+)
+
+export const serviceLogsValidator = vine.compile(
+  vine.object({
+    tail: vine.number().min(1).max(2000).optional(),
+  })
+)
+
+// Reconfigure an existing custom app: the create shape plus the target service_name.
+export const updateCustomAppValidator = vine.compile(
+  vine.object({
+    service_name: vine.string().trim(),
+    friendly_name: vine.string().trim().minLength(1).maxLength(100),
+    image: vine.string().trim().minLength(1),
+    ports: vine
+      .array(
+        vine.object({
+          container: vine.number().min(1).max(65535),
+          host: vine.number().min(1024).max(65535),
+        })
+      )
+      .optional(),
+    volumes: vine.array(volumeSchema).optional(),
+    env: vine.array(envVarSchema).optional(),
+    category: vine
+      .enum(['productivity', 'media', 'security', 'networking', 'utility', 'ai', 'education', 'custom'])
+      .optional(),
+    icon: vine.string().trim().optional(),
+    memory_mb: vine.number().min(64).optional(),
+    cpus: vine.number().min(0.1).max(64).optional(),
+    force: vine.boolean().optional(),
+  })
+)
diff --git a/admin/constants/service_names.ts b/admin/constants/service_names.ts
index 8009222..01d3299 100644
--- a/admin/constants/service_names.ts
+++ b/admin/constants/service_names.ts
@@ -5,4 +5,15 @@ export const SERVICE_NAMES = {
   CYBERCHEF: 'nomad_cyberchef',
   FLATNOTES: 'nomad_flatnotes',
   KOLIBRI: 'nomad_kolibri',
+  // Supply Depot — curated catalog (ports 8400–8499)
+  STIRLING_PDF: 'nomad_stirling_pdf',
+  FILEBROWSER: 'nomad_filebrowser',
+  CALIBREWEB: 'nomad_calibreweb',
+  IT_TOOLS: 'nomad_it_tools',
+  EXCALIDRAW: 'nomad_excalidraw',
+  MESHTASTIC_WEB: 'nomad_meshtastic_web',
+  MESHTASTICD: 'nomad_meshtasticd',
+  HOMEBOX: 'nomad_homebox',
+  VAULTWARDEN: 'nomad_vaultwarden',
+  JELLYFIN: 'nomad_jellyfin',
 }
diff --git a/admin/database/migrations/1772000000001_add_supply_depot_fields_to_services.ts b/admin/database/migrations/1772000000001_add_supply_depot_fields_to_services.ts
new file mode 100644
index 0000000..b88c66f
--- /dev/null
+++ b/admin/database/migrations/1772000000001_add_supply_depot_fields_to_services.ts
@@ -0,0 +1,34 @@
+import { BaseSchema } from '@adonisjs/lucid/schema'
+
+export default class extends BaseSchema {
+  protected tableName = 'services'
+
+  async up() {
+    this.schema.alterTable(this.tableName, (table) => {
+      table.boolean('is_custom').notNullable().defaultTo(false)
+      table.string('category').nullable()
+    })
+
+    // Backfill categories for existing curated services
+    this.defer(async (db) => {
+      const updates: Array<{ service_name: string; category: string }> = [
+        { service_name: 'nomad_kiwix_server', category: 'education' },
+        { service_name: 'nomad_kolibri', category: 'education' },
+        { service_name: 'nomad_ollama', category: 'ai' },
+        { service_name: 'nomad_cyberchef', category: 'utility' },
+        { service_name: 'nomad_flatnotes', category: 'productivity' },
+      ]
+
+      for (const { service_name, category } of updates) {
+        await db.from('services').where('service_name', service_name).update({ category })
+      }
+    })
+  }
+
+  async down() {
+    this.schema.alterTable(this.tableName, (table) => {
+      table.dropColumn('is_custom')
+      table.dropColumn('category')
+    })
+  }
+}
diff --git a/admin/database/seeders/service_seeder.ts b/admin/database/seeders/service_seeder.ts
index fd0fcec..6221201 100644
--- a/admin/database/seeders/service_seeder.ts
+++ b/admin/database/seeders/service_seeder.ts
@@ -5,16 +5,19 @@ import env from '#start/env'
 import { SERVICE_NAMES } from '../../constants/service_names.js'
 import { KIWIX_LIBRARY_CMD } from '../../constants/kiwix.js'
 
+type ServiceSeedRecord = Omit<
+  ModelAttributes<Service>,
+  'created_at' | 'updated_at' | 'id' | 'available_update_version' | 'update_checked_at' | 'metadata'
+> & { metadata?: string | null }
+
 export default class ServiceSeeder extends BaseSeeder {
   // Use environment variable with fallback to production default
   private static NOMAD_STORAGE_ABS_PATH = env.get(
     'NOMAD_STORAGE_PATH',
     '/opt/project-nomad/storage'
   )
-  private static DEFAULT_SERVICES: Omit<
-    ModelAttributes<Service>,
-    'created_at' | 'updated_at' | 'metadata' | 'id' | 'available_update_version' | 'update_checked_at'
-  >[] = [
+  private static DEFAULT_SERVICES: ServiceSeedRecord[] = [
+    // ── Core / original services ──────────────────────────────────────────────
     {
       service_name: SERVICE_NAMES.KIWIX,
       friendly_name: 'Information Library',
@@ -38,13 +41,15 @@ export default class ServiceSeeder extends BaseSeeder {
       installed: false,
       installation_status: 'idle',
       is_dependency_service: false,
+      is_custom: false,
+      category: 'education',
       depends_on: null,
     },
     {
       service_name: SERVICE_NAMES.QDRANT,
       friendly_name: 'Qdrant Vector Database',
       powered_by: null,
-      display_order: 100, // Dependency service, not shown directly
+      display_order: 100,
       description: 'Vector database for storing and searching embeddings',
       icon: 'IconRobot',
       container_image: 'qdrant/qdrant:v1.16',
@@ -57,15 +62,15 @@ export default class ServiceSeeder extends BaseSeeder {
           PortBindings: { '6333/tcp': [{ HostPort: '6333' }], '6334/tcp': [{ HostPort: '6334' }] },
         },
         ExposedPorts: { '6333/tcp': {}, '6334/tcp': {} },
-        // Disable Qdrant's anonymous telemetry to telemetry.qdrant.io. NOMAD is offline-first
-        // and ships with zero telemetry by default — Qdrant's upstream default of enabled
-        // telemetry doesn't match that posture.
+        // Disable anonymous telemetry — NOMAD is offline-first
         Env: ['QDRANT__TELEMETRY_DISABLED=true'],
       }),
       ui_location: '6333',
       installed: false,
       installation_status: 'idle',
       is_dependency_service: true,
+      is_custom: false,
+      category: null,
       depends_on: null,
     },
     {
@@ -90,6 +95,8 @@ export default class ServiceSeeder extends BaseSeeder {
       installed: false,
       installation_status: 'idle',
       is_dependency_service: false,
+      is_custom: false,
+      category: 'ai',
       depends_on: SERVICE_NAMES.QDRANT,
     },
     {
@@ -113,6 +120,8 @@ export default class ServiceSeeder extends BaseSeeder {
       installed: false,
       installation_status: 'idle',
       is_dependency_service: false,
+      is_custom: false,
+      category: 'utility',
       depends_on: null,
     },
     {
@@ -138,6 +147,8 @@ export default class ServiceSeeder extends BaseSeeder {
       installed: false,
       installation_status: 'idle',
       is_dependency_service: false,
+      is_custom: false,
+      category: 'productivity',
       depends_on: null,
     },
     {
@@ -162,18 +173,316 @@ export default class ServiceSeeder extends BaseSeeder {
       installed: false,
       installation_status: 'idle',
       is_dependency_service: false,
+      is_custom: false,
+      category: 'education',
       depends_on: null,
     },
+
+    // ── Supply Depot — curated catalog (ports 8400–8499) ─────────────────────
+
+    {
+      service_name: SERVICE_NAMES.STIRLING_PDF,
+      friendly_name: 'Stirling PDF',
+      powered_by: 'Stirling-Tools',
+      display_order: 20,
+      description: 'Locally-hosted PDF manipulation tool — merge, split, compress, convert, and more',
+      icon: 'IconFileDescription',
+      container_image: 'ghcr.io/stirling-tools/s-pdf:latest',
+      source_repo: 'https://github.com/Stirling-Tools/Stirling-PDF',
+      container_command: null,
+      container_config: JSON.stringify({
+        HostConfig: {
+          RestartPolicy: { Name: 'unless-stopped' },
+          PortBindings: { '8080/tcp': [{ HostPort: '8400' }] },
+          Binds: [
+            `${ServiceSeeder.NOMAD_STORAGE_ABS_PATH}/stirling-pdf/configs:/configs`,
+            `${ServiceSeeder.NOMAD_STORAGE_ABS_PATH}/stirling-pdf/logs:/logs`,
+          ],
+        },
+        ExposedPorts: { '8080/tcp': {} },
+        Env: ['DOCKER_ENABLE_SECURITY=false', 'LANGS=en_GB'],
+      }),
+      ui_location: '8400',
+      installed: false,
+      installation_status: 'idle',
+      is_dependency_service: false,
+      is_custom: false,
+      category: 'productivity',
+      depends_on: null,
+    },
+    {
+      service_name: SERVICE_NAMES.FILEBROWSER,
+      friendly_name: 'File Browser',
+      powered_by: 'FileBrowser',
+      display_order: 21,
+      description: 'Web-based file manager — browse, upload, download, and organize files on your device',
+      icon: 'IconFolderOpen',
+      container_image: 'filebrowser/filebrowser:v2',
+      source_repo: 'https://github.com/filebrowser/filebrowser',
+      // Stores the database alongside the files it serves so a single volume covers everything.
+      // User: root — host directories auto-created by Docker are owned root:root 755; FileBrowser's
+      // image runs as UID 1000 by default which can't write to them (DooD: we can't chown on host).
+      container_command: '--root /srv --database /srv/.filebrowser.db',
+      container_config: JSON.stringify({
+        HostConfig: {
+          RestartPolicy: { Name: 'unless-stopped' },
+          PortBindings: { '80/tcp': [{ HostPort: '8410' }] },
+          Binds: [`${ServiceSeeder.NOMAD_STORAGE_ABS_PATH}/filebrowser:/srv`],
+        },
+        ExposedPorts: { '80/tcp': {} },
+        User: 'root'
+      }),
+      ui_location: '8410',
+      installed: false,
+      installation_status: 'idle',
+      is_dependency_service: false,
+      is_custom: false,
+      category: 'utility',
+      depends_on: null,
+    },
+    {
+      service_name: SERVICE_NAMES.CALIBREWEB,
+      friendly_name: 'Calibre Web',
+      powered_by: 'Calibre-Web',
+      display_order: 22,
+      description: 'Web-based e-book reader and library manager for your Calibre collection',
+      icon: 'IconBook',
+      container_image: 'lscr.io/linuxserver/calibre-web:latest',
+      source_repo: 'https://github.com/janeczku/calibre-web',
+      container_command: null,
+      container_config: JSON.stringify({
+        HostConfig: {
+          RestartPolicy: { Name: 'unless-stopped' },
+          PortBindings: { '8083/tcp': [{ HostPort: '8420' }] },
+          Binds: [
+            `${ServiceSeeder.NOMAD_STORAGE_ABS_PATH}/calibreweb/config:/config`,
+            `${ServiceSeeder.NOMAD_STORAGE_ABS_PATH}/books:/books`,
+          ],
+        },
+        ExposedPorts: { '8083/tcp': {} },
+        Env: ['PUID=1000', 'PGID=1000'],
+      }),
+      ui_location: '8420',
+      installed: false,
+      installation_status: 'idle',
+      is_dependency_service: false,
+      is_custom: false,
+      category: 'media',
+      depends_on: null,
+      metadata: JSON.stringify({ minMemoryMB: 512, minDiskMB: 5120 }),
+    },
+    {
+      service_name: SERVICE_NAMES.IT_TOOLS,
+      friendly_name: 'IT Tools',
+      powered_by: 'IT-Tools',
+      display_order: 23,
+      description: 'Collection of handy utilities for developers — UUID, hash, encoding, formatters, and more',
+      icon: 'IconTool',
+      container_image: 'ghcr.io/corentinth/it-tools:latest',
+      source_repo: 'https://github.com/CorentinTh/it-tools',
+      container_command: null,
+      container_config: JSON.stringify({
+        HostConfig: {
+          RestartPolicy: { Name: 'unless-stopped' },
+          PortBindings: { '80/tcp': [{ HostPort: '8430' }] },
+        },
+        ExposedPorts: { '80/tcp': {} },
+      }),
+      ui_location: '8430',
+      installed: false,
+      installation_status: 'idle',
+      is_dependency_service: false,
+      is_custom: false,
+      category: 'utility',
+      depends_on: null,
+    },
+    {
+      service_name: SERVICE_NAMES.EXCALIDRAW,
+      friendly_name: 'Excalidraw',
+      powered_by: 'Excalidraw',
+      display_order: 24,
+      description: 'Virtual whiteboard for sketching hand-drawn-style diagrams — works fully offline',
+      icon: 'IconPencil',
+      container_image: 'excalidraw/excalidraw:latest',
+      source_repo: 'https://github.com/excalidraw/excalidraw',
+      container_command: null,
+      container_config: JSON.stringify({
+        HostConfig: {
+          RestartPolicy: { Name: 'unless-stopped' },
+          PortBindings: { '80/tcp': [{ HostPort: '8440' }] },
+        },
+        ExposedPorts: { '80/tcp': {} },
+      }),
+      ui_location: '8440',
+      installed: false,
+      installation_status: 'idle',
+      is_dependency_service: false,
+      is_custom: false,
+      category: 'productivity',
+      depends_on: null,
+    },
+    {
+      service_name: SERVICE_NAMES.MESHTASTIC_WEB,
+      friendly_name: 'Meshtastic Web',
+      powered_by: 'Meshtastic',
+      display_order: 30,
+      description: 'Browser-based client for managing Meshtastic mesh radio devices',
+      icon: 'IconWifi',
+      container_image: 'ghcr.io/meshtastic/web:latest',
+      source_repo: 'https://github.com/meshtastic/web',
+      container_command: null,
+      container_config: JSON.stringify({
+        HostConfig: {
+          RestartPolicy: { Name: 'unless-stopped' },
+          PortBindings: { '80/tcp': [{ HostPort: '8450' }] },
+        },
+        ExposedPorts: { '80/tcp': {} },
+      }),
+      ui_location: '8450',
+      installed: false,
+      installation_status: 'idle',
+      is_dependency_service: false,
+      is_custom: false,
+      category: 'networking',
+      depends_on: null,
+    },
+    {
+      service_name: SERVICE_NAMES.MESHTASTICD,
+      friendly_name: 'Meshtastic Daemon',
+      powered_by: 'Meshtastic',
+      display_order: 31,
+      description: 'Software-defined Meshtastic node with REST API — connect devices and build mesh networks',
+      icon: 'IconBroadcast',
+      container_image: 'meshtastic/meshtasticd:latest',
+      source_repo: 'https://github.com/meshtastic/meshtasticd',
+      container_command: null,
+      container_config: JSON.stringify({
+        HostConfig: {
+          RestartPolicy: { Name: 'unless-stopped' },
+          PortBindings: { '4403/tcp': [{ HostPort: '8460' }] },
+          Binds: [`${ServiceSeeder.NOMAD_STORAGE_ABS_PATH}/meshtasticd:/root/.portduino`],
+        },
+        ExposedPorts: { '4403/tcp': {} },
+      }),
+      ui_location: '8460',
+      installed: false,
+      installation_status: 'idle',
+      is_dependency_service: false,
+      is_custom: false,
+      category: 'networking',
+      depends_on: null,
+    },
+    {
+      service_name: SERVICE_NAMES.HOMEBOX,
+      friendly_name: 'Homebox',
+      powered_by: 'Homebox',
+      display_order: 25,
+      description: 'Home inventory and asset management — track everything you own',
+      icon: 'IconBox',
+      container_image: 'ghcr.io/hay-kot/homebox:latest',
+      source_repo: 'https://github.com/hay-kot/homebox',
+      container_command: null,
+      container_config: JSON.stringify({
+        HostConfig: {
+          RestartPolicy: { Name: 'unless-stopped' },
+          PortBindings: { '7745/tcp': [{ HostPort: '8470' }] },
+          Binds: [`${ServiceSeeder.NOMAD_STORAGE_ABS_PATH}/homebox:/data`],
+        },
+        ExposedPorts: { '7745/tcp': {} },
+      }),
+      ui_location: '8470',
+      installed: false,
+      installation_status: 'idle',
+      is_dependency_service: false,
+      is_custom: false,
+      category: 'productivity',
+      depends_on: null,
+    },
+    {
+      service_name: SERVICE_NAMES.VAULTWARDEN,
+      friendly_name: 'Vaultwarden',
+      powered_by: 'Vaultwarden',
+      display_order: 26,
+      description: 'Lightweight Bitwarden-compatible password manager server — secure your credentials offline',
+      icon: 'IconShieldLock',
+      container_image: 'vaultwarden/server:latest',
+      source_repo: 'https://github.com/dani-garcia/vaultwarden',
+      container_command: null,
+      container_config: JSON.stringify({
+        HostConfig: {
+          RestartPolicy: { Name: 'unless-stopped' },
+          PortBindings: { '80/tcp': [{ HostPort: '8480' }] },
+          Binds: [`${ServiceSeeder.NOMAD_STORAGE_ABS_PATH}/vaultwarden:/data`],
+        },
+        ExposedPorts: { '80/tcp': {} },
+        Env: ['WEBSOCKET_ENABLED=true'],
+      }),
+      ui_location: '8480',
+      installed: false,
+      installation_status: 'idle',
+      is_dependency_service: false,
+      is_custom: false,
+      category: 'security',
+      depends_on: null,
+      metadata: JSON.stringify({ minMemoryMB: 256, minDiskMB: 512 }),
+    },
+    {
+      service_name: SERVICE_NAMES.JELLYFIN,
+      friendly_name: 'Jellyfin',
+      powered_by: 'Jellyfin',
+      display_order: 27,
+      description: 'Open-source media server — stream your video, music, and photo libraries',
+      icon: 'IconMovie',
+      container_image: 'jellyfin/jellyfin:latest',
+      source_repo: 'https://github.com/jellyfin/jellyfin',
+      container_command: null,
+      container_config: JSON.stringify({
+        HostConfig: {
+          RestartPolicy: { Name: 'unless-stopped' },
+          PortBindings: { '8096/tcp': [{ HostPort: '8490' }] },
+          Binds: [
+            `${ServiceSeeder.NOMAD_STORAGE_ABS_PATH}/jellyfin/config:/config`,
+            `${ServiceSeeder.NOMAD_STORAGE_ABS_PATH}/jellyfin/cache:/cache`,
+            `${ServiceSeeder.NOMAD_STORAGE_ABS_PATH}/media:/media`,
+          ],
+        },
+        ExposedPorts: { '8096/tcp': {} },
+      }),
+      ui_location: '8490',
+      installed: false,
+      installation_status: 'idle',
+      is_dependency_service: false,
+      is_custom: false,
+      category: 'media',
+      depends_on: null,
+      metadata: JSON.stringify({ minMemoryMB: 2048, minDiskMB: 20480 }),
+    },
   ]
 
   async run() {
-    const existingServices = await Service.query().select('service_name')
-    const existingServiceNames = new Set(existingServices.map((service) => service.service_name))
+    const existingServices = await Service.query().select(['service_name', 'is_custom'])
+    const existingServiceMap = new Map(existingServices.map((s) => [s.service_name, s]))
 
     const newServices = ServiceSeeder.DEFAULT_SERVICES.filter(
-      (service) => !existingServiceNames.has(service.service_name)
+      (service) => !existingServiceMap.has(service.service_name)
     )
 
-    await Service.createMany([...newServices])
+    if (newServices.length > 0) {
+      await Service.createMany([...newServices])
+    }
+
+    // Keep container_config, container_command, and metadata in sync for curated services.
+    // Custom services are user-defined and must never be overwritten.
+    for (const service of ServiceSeeder.DEFAULT_SERVICES) {
+      const existing = existingServiceMap.get(service.service_name)
+      if (existing && !existing.is_custom) {
+        await Service.query().where('service_name', service.service_name).update({
+          container_config: service.container_config,
+          container_command: service.container_command ?? null,
+          metadata: (service as any).metadata ?? null,
+          category: service.category,
+        })
+      }
+    }
   }
 }
diff --git a/admin/inertia/components/CustomAppModal.tsx b/admin/inertia/components/CustomAppModal.tsx
new file mode 100644
index 0000000..fb04bb5
--- /dev/null
+++ b/admin/inertia/components/CustomAppModal.tsx
@@ -0,0 +1,540 @@
+import { useEffect, useState } from 'react'
+import StyledModal from './StyledModal'
+import StyledButton from './StyledButton'
+import Alert from './Alert'
+import api from '~/lib/api'
+import Input from './inputs/Input'
+import Select from './inputs/Select'
+import DynamicIcon, { DynamicIconName } from './DynamicIcon'
+import { IconTrash } from '@tabler/icons-react'
+
+interface PortMapping {
+  container: string
+  host: string
+}
+
+interface VolumeMapping {
+  host_path: string
+  container_path: string
+}
+
+interface EnvVar {
+  value: string
+}
+
+export interface CustomAppInitial {
+  service_name: string
+  friendly_name: string | null
+  image: string
+  category: string
+  icon: string
+  ports: Array<{ container: number; host: number }>
+  volumes: Array<{ host_path: string; container_path: string }>
+  env: string[]
+  memory_mb?: number
+  cpus?: number
+}
+
+interface CustomAppModalProps {
+  open: boolean
+  onClose: () => void
+  onCreated: (serviceName: string) => void
+  showError: (msg: string) => void
+  /** 'edit' reconfigures an existing custom app (prefilled from `initial`); defaults to 'create'. */
+  mode?: 'create' | 'edit'
+  initial?: CustomAppInitial | null
+}
+
+const CATEGORY_OPTIONS = [
+  { value: 'custom', label: 'Custom' },
+  { value: 'productivity', label: 'Productivity' },
+  { value: 'media', label: 'Media' },
+  { value: 'security', label: 'Security' },
+  { value: 'networking', label: 'Networking' },
+  { value: 'utility', label: 'Utility' },
+  { value: 'ai', label: 'AI' },
+  { value: 'education', label: 'Education' },
+]
+
+// Curated subset of the DynamicIcon map suitable for custom apps.
+const ICON_OPTIONS = [
+  { value: 'IconBrandDocker', label: 'Docker (default)' },
+  { value: 'IconBox', label: 'Box' },
+  { value: 'IconServer', label: 'Server' },
+  { value: 'IconDatabase', label: 'Database' },
+  { value: 'IconCode', label: 'Code' },
+  { value: 'IconTool', label: 'Tool' },
+  { value: 'IconWorld', label: 'Web' },
+  { value: 'IconShieldLock', label: 'Security' },
+  { value: 'IconMovie', label: 'Media' },
+  { value: 'IconBook', label: 'Book' },
+  { value: 'IconNotes', label: 'Notes' },
+  { value: 'IconCpu', label: 'Compute' },
+  { value: 'IconRobot', label: 'AI / Bot' },
+  { value: 'IconWifi', label: 'Network' },
+  { value: 'IconHome', label: 'Home' },
+]
+
+export default function CustomAppModal({
+  open,
+  onClose,
+  onCreated,
+  showError,
+  mode = 'create',
+  initial = null,
+}: CustomAppModalProps) {
+  const isEdit = mode === 'edit'
+  const [friendlyName, setFriendlyName] = useState('')
+  const [image, setImage] = useState('')
+  const [category, setCategory] = useState('custom')
+  const [icon, setIcon] = useState('IconBrandDocker')
+  const [ports, setPorts] = useState<PortMapping[]>([{ container: '', host: '' }])
+  const [volumes, setVolumes] = useState<VolumeMapping[]>([])
+  const [envVars, setEnvVars] = useState<EnvVar[]>([])
+  const [memoryMb, setMemoryMb] = useState('')
+  const [cpus, setCpus] = useState('')
+  const [submitting, setSubmitting] = useState(false)
+  const [portConflicts, setPortConflicts] = useState<Array<{ port: number; usedBy: string }>>([])
+  const [resourceWarnings, setResourceWarnings] = useState<string[]>([])
+  const [blocked, setBlocked] = useState<string[]>([])
+  const [forceInstall, setForceInstall] = useState(false)
+  const [checkingPreflight, setCheckingPreflight] = useState(false)
+  const [suggestedPort, setSuggestedPort] = useState<number | null>(null)
+
+  // On open: prefill from the existing app (edit) or fetch a suggested port (create).
+  useEffect(() => {
+    if (!open) return
+    if (isEdit && initial) {
+      setFriendlyName(initial.friendly_name ?? '')
+      setImage(initial.image)
+      setCategory(initial.category)
+      setIcon(initial.icon || 'IconBrandDocker')
+      setPorts(
+        initial.ports.length
+          ? initial.ports.map((p) => ({ container: String(p.container), host: String(p.host) }))
+          : [{ container: '', host: '' }]
+      )
+      setVolumes(initial.volumes)
+      setEnvVars(initial.env.map((v) => ({ value: v })))
+      setMemoryMb(initial.memory_mb != null ? String(initial.memory_mb) : '')
+      setCpus(initial.cpus != null ? String(initial.cpus) : '')
+      return
+    }
+    api.suggestCustomPort().then((res) => {
+      if (res?.port) {
+        setSuggestedPort(res.port)
+        setPorts([{ container: '', host: String(res.port) }])
+      }
+    })
+  }, [open, isEdit, initial])
+
+  // Live preflight: whenever ports, volumes or the image change, debounce a check for port
+  // conflicts, resource/guard warnings and hard blocks so the user gets feedback before submitting.
+  useEffect(() => {
+    if (!open) return
+    const validPorts = ports
+      .map((p) => parseInt(p.host, 10))
+      .filter((p) => !isNaN(p))
+    const validVolumes = volumes.filter((v) => v.host_path && v.container_path)
+
+    if (validPorts.length === 0 && validVolumes.length === 0 && !image.trim()) {
+      setPortConflicts([])
+      setResourceWarnings([])
+      setBlocked([])
+      setCheckingPreflight(false)
+      return
+    }
+
+    setCheckingPreflight(true)
+    const handle = setTimeout(async () => {
+      const res = await api.preflightCustomApp({
+        image: image.trim() || undefined,
+        ports: validPorts.length ? validPorts : undefined,
+        volumes: validVolumes.length ? validVolumes : undefined,
+        exclude_service: isEdit && initial ? initial.service_name : undefined,
+      })
+      if (res) {
+        setPortConflicts(res.portConflicts ?? [])
+        setResourceWarnings(res.resourceWarnings ?? [])
+        setBlocked(res.blocked ?? [])
+      }
+      setCheckingPreflight(false)
+    }, 400)
+
+    return () => clearTimeout(handle)
+  }, [open, ports, volumes, image])
+
+  function resetForm() {
+    setFriendlyName('')
+    setImage('')
+    setCategory('custom')
+    setIcon('IconBrandDocker')
+    setPorts([{ container: '', host: '' }])
+    setVolumes([])
+    setEnvVars([])
+    setMemoryMb('')
+    setCpus('')
+    setPortConflicts([])
+    setResourceWarnings([])
+    setBlocked([])
+    setForceInstall(false)
+    setSuggestedPort(null)
+  }
+
+  function handleClose() {
+    resetForm()
+    onClose()
+  }
+
+  // ── Port row helpers ──────────────────────────────────────────────────────
+  function updatePort(idx: number, field: keyof PortMapping, value: string) {
+    setPorts((prev) => prev.map((p, i) => (i === idx ? { ...p, [field]: value } : p)))
+  }
+  function addPort() {
+    const nextHost = suggestedPort ? suggestedPort + ports.length * 10 : 8600 + ports.length * 10
+    setPorts((prev) => [...prev, { container: '', host: String(nextHost) }])
+  }
+  function removePort(idx: number) {
+    setPorts((prev) => prev.filter((_, i) => i !== idx))
+  }
+
+  // ── Volume row helpers ────────────────────────────────────────────────────
+  function updateVolume(idx: number, field: keyof VolumeMapping, value: string) {
+    setVolumes((prev) => prev.map((v, i) => (i === idx ? { ...v, [field]: value } : v)))
+  }
+  function addVolume() {
+    setVolumes((prev) => [...prev, { host_path: '', container_path: '' }])
+  }
+  function removeVolume(idx: number) {
+    setVolumes((prev) => prev.filter((_, i) => i !== idx))
+  }
+
+  // ── Env var helpers ───────────────────────────────────────────────────────
+  function updateEnv(idx: number, value: string) {
+    setEnvVars((prev) => prev.map((e, i) => (i === idx ? { value } : e)))
+  }
+  function addEnv() {
+    setEnvVars((prev) => [...prev, { value: '' }])
+  }
+  function removeEnv(idx: number) {
+    setEnvVars((prev) => prev.filter((_, i) => i !== idx))
+  }
+
+  // ── Submit ────────────────────────────────────────────────────────────────
+  async function handleSubmit() {
+    if (!friendlyName.trim() || !image.trim()) {
+      showError('Name and image are required.')
+      return
+    }
+    if (blocked.length > 0) {
+      showError('Resolve the blocked issues before installing.')
+      return
+    }
+
+    const validPorts = ports
+      .filter((p) => p.container && p.host)
+      .map((p) => ({ container: parseInt(p.container, 10), host: parseInt(p.host, 10) }))
+      .filter((p) => !isNaN(p.container) && !isNaN(p.host))
+
+    const validVolumes = volumes.filter((v) => v.host_path && v.container_path)
+    const validEnv = envVars.map((e) => e.value).filter(Boolean)
+    const parsedMemory = parseInt(memoryMb, 10)
+    const parsedCpus = parseFloat(cpus)
+
+    setSubmitting(true)
+    try {
+      const common = {
+        friendly_name: friendlyName.trim(),
+        image: image.trim(),
+        ports: validPorts.length ? validPorts : undefined,
+        volumes: validVolumes.length ? validVolumes : undefined,
+        env: validEnv.length ? validEnv : undefined,
+        category,
+        icon,
+        memory_mb: !isNaN(parsedMemory) ? parsedMemory : undefined,
+        cpus: !isNaN(parsedCpus) ? parsedCpus : undefined,
+        // The user has already acknowledged any conflicts via the "install anyway" checkbox.
+        force: forceInstall,
+      }
+      const result =
+        isEdit && initial
+          ? await api.updateCustomApp({ service_name: initial.service_name, ...common })
+          : await api.createCustomApp(common)
+
+      if (result?.success && result.service_name) {
+        resetForm()
+        onCreated(result.service_name)
+      } else {
+        // Check if it's a port conflict error — show warnings and let user force
+        if (result?.message?.toLowerCase().includes('port') || result?.message?.toLowerCase().includes('conflict')) {
+          showError(result.message)
+        } else {
+          showError(result?.message || 'Failed to create custom app.')
+        }
+      }
+    } catch (err: any) {
+      showError(err?.message || 'Unexpected error creating custom app.')
+    } finally {
+      setSubmitting(false)
+    }
+  }
+
+  const hasWarnings = portConflicts.length > 0 || resourceWarnings.length > 0
+  const hasBlocks = blocked.length > 0
+  const canSubmit =
+    friendlyName.trim() && image.trim() && !hasBlocks && (!hasWarnings || forceInstall)
+
+  return (
+    <StyledModal
+      title={isEdit ? 'Edit Custom App' : 'Add Custom App'}
+      open={open}
+      onCancel={handleClose}
+      cancelText="Cancel"
+      onConfirm={handleSubmit}
+      confirmVariant='primary'
+      confirmText={isEdit ? 'Save & Recreate' : 'Install'}
+      confirmIcon="IconBrandDocker"
+      confirmLoading={submitting}
+      confirmDisabled={!canSubmit}
+      large
+    >
+      <div className="space-y-6 text-sm">
+        {/* Image + Name */}
+        <div className="grid grid-cols-2 gap-4">
+          <Input
+            name='image'
+            label="Docker Image"
+            placeholder="e.g. nginx:latest"
+            value={image}
+            onChange={(e) => setImage(e.target.value)}
+            required
+          />
+          <Input
+            name='friendlyName'
+            label="Display Name"
+            placeholder="My App"
+            value={friendlyName}
+            onChange={(e) => setFriendlyName(e.target.value)}
+            required
+          />
+        </div>
+
+        {/* Category + Icon */}
+        <div className="grid grid-cols-2 gap-4 items-start">
+          <Select
+            name='category'
+            label='Category'
+            helpText='Select the most relevant category for this app. This helps with visual organization and filtering.'
+            value={category}
+            onChange={(newVal) => setCategory(newVal)}
+            options={CATEGORY_OPTIONS}
+          />
+          <div className="flex items-end gap-2">
+            <Select
+              name='icon'
+              label='Icon'
+              helpText='Pick an icon shown on the app card.'
+              value={icon}
+              onChange={(newVal) => setIcon(newVal)}
+              options={ICON_OPTIONS}
+              className="flex-1 min-w-0"
+            />
+            <div
+              className="flex-shrink-0 flex items-center justify-center h-[42px] w-[42px] rounded-md border border-border-default bg-surface-secondary"
+              title="Icon preview"
+            >
+              <DynamicIcon icon={icon as DynamicIconName} className="h-6 w-6 text-desert-green" />
+            </div>
+          </div>
+        </div>
+
+        {/* Port Mappings */}
+        <div>
+          <div className="flex items-center justify-between">
+            <label className="text-sm font-medium">Port Mappings</label>
+            <StyledButton size="sm" variant="ghost" icon="IconPlus" onClick={addPort}>Add Port</StyledButton>
+          </div>
+          {ports.length === 0 && (
+            <p className="text-xs italic">No port mappings — the app won't be accessible from a browser.</p>
+          )}
+          <div className="space-y-2">
+            {ports.map((p, idx) => (
+              <div key={idx} className="flex items-center gap-2 w-full">
+                <Input
+                  name={`containerPort${idx}`}
+                  label=''
+                  type="number"
+                  placeholder="Container port"
+                  value={p.container}
+                  onChange={(e) => updatePort(idx, 'container', e.target.value)}
+                  className='w-full'
+                />
+                <span className="text-xs">→</span>
+                <Input
+                  name={`hostPort${idx}`}
+                  label=''
+                  type="number"
+                  placeholder="Host port (8600+)"
+                  value={p.host}
+                  onChange={(e) => updatePort(idx, 'host', e.target.value)}
+                  className='w-full'
+                />
+                <button
+                  type="button"
+                  onClick={() => removePort(idx)}
+                  className="hover:text-desert-red transition-colors cursor-pointer"
+                >
+                  <IconTrash className="w-5 h-5" />
+                </button>
+              </div>
+            ))}
+          </div>
+          <p className="text-xs mt-2">Host ports should be in the 8600+ range. Custom apps get ports starting at {suggestedPort ?? 8600}.</p>
+          {checkingPreflight && (
+            <p className="text-xs mt-1 italic text-text-muted">Checking port availability…</p>
+          )}
+        </div>
+
+        {/* Volume Mappings */}
+        <div>
+          <div className="flex items-center justify-between">
+            <label className="text-sm font-medium">Volume Mounts</label>
+            <StyledButton size="sm" variant="ghost" icon="IconPlus" onClick={addVolume}>Add Volume</StyledButton>
+          </div>
+          {volumes.length === 0 && (
+            <p className="text-xs italic">No volumes — data won't persist across restarts.</p>
+          )}
+          <div className="space-y-2">
+            {volumes.map((v, idx) => (
+              <div key={idx} className="flex items-center gap-2">
+                <Input
+                  name={`hostPath${idx}`}
+                  label=''
+                  type="text"
+                  placeholder="Host path (absolute)"
+                  value={v.host_path}
+                  onChange={(e) => updateVolume(idx, 'host_path', e.target.value)}
+                  className='w-full'
+                />
+                <span className="text-xs">:</span>
+                <Input
+                  name={`containerPath${idx}`}
+                  label=''
+                  type="text"
+                  placeholder="Container path"
+                  value={v.container_path}
+                  onChange={(e) => updateVolume(idx, 'container_path', e.target.value)}
+                  className='w-full'
+                />
+                <button
+                  type="button"
+                  onClick={() => removeVolume(idx)}
+                  className="hover:text-desert-red transition-colors cursor-pointer"
+                >
+                  <IconTrash className="w-5 h-5" />
+                </button>
+              </div>
+            ))}
+          </div>
+        </div>
+
+        {/* Environment Variables */}
+        <div>
+          <div className="flex items-center justify-between">
+            <label className="text-sm font-medium">Environment Variables</label>
+            <StyledButton size="sm" variant="ghost" icon="IconPlus" onClick={addEnv}>Add Variable</StyledButton>
+          </div>
+          <div className="space-y-2">
+            {envVars.map((e, idx) => (
+              <div key={idx} className="flex items-center gap-2">
+                <Input
+                  name={`envVar${idx}`}
+                  label=''
+                  placeholder="KEY=value"
+                  value={e.value}
+                  onChange={(ev) => updateEnv(idx, ev.target.value)}
+                  className='w-full font-mono'
+                />
+                <button
+                  type="button"
+                  onClick={() => removeEnv(idx)}
+                  className="hover:text-desert-red transition-colors cursor-pointer"
+                >
+                  <IconTrash className="w-5 h-5" />
+                </button>
+              </div>
+            ))}
+            {envVars.length === 0 && (
+              <p className="text-xs italic">No environment variables provided.</p>
+            )}
+          </div>
+        </div>
+
+        {/* Advanced: resource limits */}
+        <div>
+          <label className="text-sm font-medium">Resource Limits (optional)</label>
+          <div className="grid grid-cols-2 gap-4 mt-1">
+            <Input
+              name='memoryMb'
+              label=''
+              type="number"
+              placeholder="Memory (MB) — default 1024"
+              value={memoryMb}
+              onChange={(e) => setMemoryMb(e.target.value)}
+              className='w-full'
+            />
+            <Input
+              name='cpus'
+              label=''
+              type="number"
+              placeholder="CPUs — default 1"
+              value={cpus}
+              onChange={(e) => setCpus(e.target.value)}
+              className='w-full'
+            />
+          </div>
+          <p className="text-xs mt-1 italic">Caps prevent a runaway container from starving the host. Leave blank to use the defaults (1024 MB / 1 CPU).</p>
+        </div>
+
+        {/* Hard blocks — must be resolved before installing */}
+        {hasBlocks && (
+          <div className="space-y-2">
+            {blocked.map((b, i) => (
+              <Alert key={i} type="error" title="Not allowed" message={b} />
+            ))}
+          </div>
+        )}
+
+        {/* Warnings */}
+        {hasWarnings && (
+          <div className="space-y-2">
+            {portConflicts.map((c) => (
+              <Alert
+                key={c.port}
+                type="warning"
+                title={`Port ${c.port} is already in use`}
+                message={`Currently bound by: ${c.usedBy}. Installation may fail.`}
+              />
+            ))}
+            {resourceWarnings.map((w, i) => (
+              <Alert key={i} type="warning" title="Resource warning" message={w} />
+            ))}
+            <label className="flex items-center gap-2 cursor-pointer select-none mt-1">
+              <input
+                type="checkbox"
+                checked={forceInstall}
+                onChange={(e) => setForceInstall(e.target.checked)}
+                className="accent-desert-orange h-4 w-4 rounded"
+              />
+              <span className="text-text-muted text-xs">I understand — install anyway</span>
+            </label>
+          </div>
+        )}
+
+        <p className="text-sm">
+          Containers are created with <code className="font-mono">--restart=unless-stopped</code>. Data is not persisted unless you add volume mounts above.
+        </p>
+      </div>
+    </StyledModal>
+  )
+}
diff --git a/admin/inertia/components/ServiceLogsModal.tsx b/admin/inertia/components/ServiceLogsModal.tsx
new file mode 100644
index 0000000..12cfdaf
--- /dev/null
+++ b/admin/inertia/components/ServiceLogsModal.tsx
@@ -0,0 +1,52 @@
+import { useEffect, useState } from 'react'
+import StyledModal from './StyledModal'
+import api from '~/lib/api'
+
+interface ServiceLogsModalProps {
+  serviceName: string
+  friendlyName: string
+  open: boolean
+  onClose: () => void
+}
+
+/** Shows the tail of a service container's logs with a manual refresh. */
+export default function ServiceLogsModal({
+  serviceName,
+  friendlyName,
+  open,
+  onClose,
+}: ServiceLogsModalProps) {
+  const [logs, setLogs] = useState('')
+  const [loading, setLoading] = useState(false)
+
+  async function load() {
+    setLoading(true)
+    const res = await api.getServiceLogs(serviceName, 500)
+    setLogs(res?.success ? res.logs || '' : 'Unable to load logs for this container.')
+    setLoading(false)
+  }
+
+  useEffect(() => {
+    if (open) load()
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [open, serviceName])
+
+  return (
+    <StyledModal
+      title={`Logs — ${friendlyName}`}
+      open={open}
+      onCancel={onClose}
+      cancelText="Close"
+      onConfirm={load}
+      confirmText="Refresh"
+      confirmIcon="IconRefresh"
+      confirmVariant="outline"
+      confirmLoading={loading}
+      large
+    >
+      <pre className="text-xs font-mono whitespace-pre-wrap break-all max-h-[60vh] overflow-auto bg-surface-secondary rounded-md p-3 text-text-primary text-left">
+        {logs || (loading ? 'Loading…' : 'No log output.')}
+      </pre>
+    </StyledModal>
+  )
+}
diff --git a/admin/inertia/components/ServiceStatsModal.tsx b/admin/inertia/components/ServiceStatsModal.tsx
new file mode 100644
index 0000000..e61b18b
--- /dev/null
+++ b/admin/inertia/components/ServiceStatsModal.tsx
@@ -0,0 +1,102 @@
+import { useEffect, useState } from 'react'
+import StyledModal from './StyledModal'
+import { formatBytes } from '~/lib/util'
+import api from '~/lib/api'
+
+interface Stats {
+  cpuPercent: number
+  memUsageBytes: number
+  memLimitBytes: number
+  memPercent: number
+}
+
+interface ServiceStatsModalProps {
+  serviceName: string
+  friendlyName: string
+  open: boolean
+  onClose: () => void
+}
+
+function Bar({ percent, label, value }: { percent: number; label: string; value: string }) {
+  const clamped = Math.min(100, Math.max(0, percent))
+  return (
+    <div>
+      <div className="flex items-center justify-between text-xs mb-1">
+        <span className="font-medium text-text-primary">{label}</span>
+        <span className="text-text-muted font-mono">{value}</span>
+      </div>
+      <div className="h-2 w-full rounded-full bg-surface-secondary overflow-hidden">
+        <div
+          className={`h-full rounded-full transition-all ${
+            clamped > 90 ? 'bg-desert-red' : clamped > 70 ? 'bg-desert-orange' : 'bg-desert-green'
+          }`}
+          style={{ width: `${clamped}%` }}
+        />
+      </div>
+    </div>
+  )
+}
+
+/** Polls and displays live CPU/memory usage for a running service container. */
+export default function ServiceStatsModal({
+  serviceName,
+  friendlyName,
+  open,
+  onClose,
+}: ServiceStatsModalProps) {
+  const [stats, setStats] = useState<Stats | null>(null)
+  const [running, setRunning] = useState(true)
+  const [loading, setLoading] = useState(false)
+
+  useEffect(() => {
+    if (!open) return
+    let cancelled = false
+
+    async function poll() {
+      const res = await api.getServiceStats(serviceName)
+      if (cancelled || !res) return
+      setRunning(res.running)
+      setStats(res.stats)
+      setLoading(false)
+    }
+
+    setLoading(true)
+    poll()
+    const id = setInterval(poll, 2000)
+    return () => {
+      cancelled = true
+      clearInterval(id)
+    }
+  }, [open, serviceName])
+
+  return (
+    <StyledModal
+      title={`Stats — ${friendlyName}`}
+      open={open}
+      onCancel={onClose}
+      cancelText="Close"
+    >
+      <div className="space-y-4 text-sm">
+        {!running ? (
+          <p className="text-text-muted text-center py-6">
+            This app is not running. Start it to see live resource usage.
+          </p>
+        ) : !stats ? (
+          <p className="text-text-muted text-center py-6">
+            {loading ? 'Loading…' : 'No stats available.'}
+          </p>
+        ) : (
+          <>
+            <Bar label="CPU" percent={stats.cpuPercent} value={`${stats.cpuPercent.toFixed(1)}%`} />
+            <Bar
+              label="Memory"
+              percent={stats.memPercent}
+              value={`${formatBytes(stats.memUsageBytes)} / ${formatBytes(stats.memLimitBytes)} (${stats.memPercent.toFixed(1)}%)`}
+            />
+            <p className="text-xs text-text-muted">Updates every 2 seconds.</p>
+          </>
+        )}
+      </div>
+    </StyledModal>
+  )
+}
diff --git a/admin/inertia/components/StyledModal.tsx b/admin/inertia/components/StyledModal.tsx
index 0e0d784..9634590 100644
--- a/admin/inertia/components/StyledModal.tsx
+++ b/admin/inertia/components/StyledModal.tsx
@@ -13,6 +13,7 @@ export type StyledModalProps = {
   confirmIcon?: StyledButtonProps['icon']
   confirmVariant?: StyledButtonProps['variant']
   confirmLoading?: boolean
+  confirmDisabled?: boolean
   open: boolean
   onCancel?: () => void
   onConfirm?: () => void
@@ -33,6 +34,7 @@ const StyledModal: React.FC<StyledModalProps> = ({
   confirmIcon,
   confirmVariant = 'action',
   confirmLoading = false,
+  confirmDisabled = false,
   onCancel,
   onConfirm,
   icon,
@@ -94,6 +96,7 @@ const StyledModal: React.FC<StyledModalProps> = ({
                   }}
                   icon={confirmIcon}
                   loading={confirmLoading}
+                  disabled={confirmDisabled}
                 >
                   {confirmText}
                 </StyledButton>
diff --git a/admin/inertia/components/inputs/Select.tsx b/admin/inertia/components/inputs/Select.tsx
new file mode 100644
index 0000000..d7b1b32
--- /dev/null
+++ b/admin/inertia/components/inputs/Select.tsx
@@ -0,0 +1,106 @@
+import classNames from "classnames";
+import { Listbox, ListboxButton, ListboxOption, ListboxOptions } from "@headlessui/react";
+import { IconChevronDown } from "@tabler/icons-react";
+
+export interface SelectOption<T = string> {
+  value: T;
+  label: string;
+  disabled?: boolean;
+}
+
+export interface SelectProps<T = string> {
+  name: string;
+  label: string;
+  value: T;
+  onChange: (value: T) => void;
+  options: SelectOption<T>[];
+  helpText?: string;
+  placeholder?: string;
+  className?: string;
+  labelClassName?: string;
+  selectClassName?: string;
+  containerClassName?: string;
+  error?: boolean;
+  required?: boolean;
+  disabled?: boolean;
+}
+
+const Select = <T,>({
+  name,
+  label,
+  value,
+  onChange,
+  options,
+  helpText,
+  placeholder,
+  className,
+  labelClassName,
+  selectClassName,
+  containerClassName,
+  error,
+  required,
+  disabled,
+}: SelectProps<T>) => {
+  const selectedOption = options.find((o) => o.value === value);
+
+  return (
+    <div className={classNames(className)}>
+      <label
+        htmlFor={name}
+        className={classNames("block text-base/6 font-medium text-text-primary", labelClassName)}
+      >
+        {label}{required ? "*" : ""}
+      </label>
+      {helpText && <p className="mt-1 text-sm text-text-muted">{helpText}</p>}
+      <div className={classNames("mt-1.5", containerClassName)}>
+        <Listbox value={value} onChange={onChange} disabled={disabled}>
+          <div className="relative">
+            <ListboxButton
+              id={name}
+              className={classNames(
+                "flex items-center w-full rounded-md bg-surface-primary px-3 py-2 text-base border border-border-default focus:outline focus:outline-2 focus:-outline-offset-2 focus:outline-primary sm:text-sm/6 text-left",
+                selectedOption ? "text-text-primary" : "text-text-muted",
+                error ? "!border-red-500 focus:outline-red-500 !bg-red-100" : "",
+                disabled ? "opacity-50 cursor-not-allowed" : "cursor-pointer",
+                selectClassName
+              )}
+            >
+              <span className="flex-1 truncate">
+                {selectedOption ? selectedOption.label : (placeholder ?? label)}
+              </span>
+              <IconChevronDown className="w-4 h-4 text-text-muted ml-2 shrink-0 transition-transform duration-150 group-data-[open]:rotate-180 data-[open]:rotate-180 ui-open:rotate-180" />
+            </ListboxButton>
+
+            <ListboxOptions
+              transition
+              anchor="bottom start"
+              className={classNames(
+                "z-50 w-[var(--button-width)] rounded-md bg-surface-primary border border-border-default shadow-lg max-h-60 overflow-auto",
+                "transition duration-100 ease-out data-[closed]:opacity-0 data-[closed]:scale-95",
+                "mt-1 focus:outline-none"
+              )}
+            >
+              {options.map((option, index) => (
+                <ListboxOption
+                  key={index}
+                  value={option.value}
+                  disabled={option.disabled}
+                  className={classNames(
+                    "px-3 py-2 text-sm text-text-primary select-none",
+                    option.disabled
+                      ? "opacity-40 cursor-not-allowed"
+                      : "cursor-pointer data-[focus]:bg-surface-secondary data-[selected]:font-medium data-[selected]:text-primary"
+                  )}
+                >
+                  {option.label}
+                </ListboxOption>
+              ))}
+            </ListboxOptions>
+          </div>
+        </Listbox>
+      </div>
+    </div>
+  );
+};
+
+export default Select;
diff --git a/admin/inertia/layouts/SettingsLayout.tsx b/admin/inertia/layouts/SettingsLayout.tsx
index 0ecad83..2f02be6 100644
--- a/admin/inertia/layouts/SettingsLayout.tsx
+++ b/admin/inertia/layouts/SettingsLayout.tsx
@@ -23,7 +23,7 @@ export default function SettingsLayout({ children }: { children: React.ReactNode
 
   const navigation = [
     ...(aiAssistantInstallStatus.isInstalled ? [{ name: aiAssistantName, href: '/settings/models', icon: IconWand, current: false }] : []),
-    { name: 'Apps', href: '/settings/apps', icon: IconTerminal2, current: false },
+    { name: 'Supply Depot', href: '/supply-depot', icon: IconTerminal2, current: false },
     { name: 'Benchmark', href: '/settings/benchmark', icon: IconChartBar, current: false },
     { name: 'Content Explorer', href: '/settings/zim/remote-explorer', icon: IconZoom, current: false },
     { name: 'Content Manager', href: '/settings/zim', icon: IconFolder, current: false },
diff --git a/admin/inertia/lib/api.ts b/admin/inertia/lib/api.ts
index 83950a9..d0db48e 100644
--- a/admin/inertia/lib/api.ts
+++ b/admin/inertia/lib/api.ts
@@ -969,6 +969,151 @@ class API {
       return response.data
     })()
   }
+
+  async preflightCheck(service_name: string) {
+    return catchInternal(async () => {
+      const response = await this.client.get<{
+        portConflicts: Array<{ port: number; usedBy: string }>
+        resourceWarnings: string[]
+      }>('/system/services/preflight', { params: { service_name } })
+      return response.data
+    })()
+  }
+
+  async suggestCustomPort() {
+    return catchInternal(async () => {
+      const response = await this.client.get<{ port: number }>('/system/services/suggest-port')
+      return response.data
+    })()
+  }
+
+  async preflightCustomApp(payload: {
+    image?: string
+    ports?: number[]
+    volumes?: Array<{ host_path: string; container_path: string }>
+    exclude_service?: string
+  }) {
+    return catchInternal(async () => {
+      const response = await this.client.post<{
+        portConflicts: Array<{ port: number; usedBy: string }>
+        resourceWarnings: string[]
+        blocked: string[]
+      }>('/system/services/preflight-custom', payload)
+      return response.data
+    })()
+  }
+
+  async createCustomApp(payload: {
+    friendly_name: string
+    image: string
+    ports?: Array<{ container: number; host: number }>
+    volumes?: Array<{ host_path: string; container_path: string }>
+    env?: string[]
+    category?: string
+    icon?: string
+    memory_mb?: number
+    cpus?: number
+    force?: boolean
+  }) {
+    return catchInternal(async () => {
+      const response = await this.client.post<{
+        success: boolean
+        message: string
+        service_name: string
+      }>('/system/services/custom', payload)
+      return response.data
+    })()
+  }
+
+  async deleteCustomApp(service_name: string, remove_image = false) {
+    return catchInternal(async () => {
+      const response = await this.client.delete<{ success: boolean; message: string }>(
+        '/system/services/custom',
+        { data: { service_name, remove_image } }
+      )
+      return response.data
+    })()
+  }
+
+  async updateCustomAppImage(service_name: string) {
+    return catchInternal(async () => {
+      const response = await this.client.post<{ success: boolean; message: string }>(
+        '/system/services/custom/update',
+        { service_name }
+      )
+      return response.data
+    })()
+  }
+
+  async getServiceLogs(service_name: string, tail = 200) {
+    return catchInternal(async () => {
+      const response = await this.client.get<{ success: boolean; logs: string }>(
+        `/system/services/${service_name}/logs`,
+        { params: { tail } }
+      )
+      return response.data
+    })()
+  }
+
+  async getServiceStats(service_name: string) {
+    return catchInternal(async () => {
+      const response = await this.client.get<{
+        success: boolean
+        running: boolean
+        stats: {
+          cpuPercent: number
+          memUsageBytes: number
+          memLimitBytes: number
+          memPercent: number
+        } | null
+      }>(`/system/services/${service_name}/stats`)
+      return response.data
+    })()
+  }
+
+  async getCustomApp(service_name: string) {
+    return catchInternal(async () => {
+      const response = await this.client.get<{
+        success: boolean
+        app: {
+          service_name: string
+          friendly_name: string | null
+          image: string
+          category: string
+          icon: string
+          ports: Array<{ container: number; host: number }>
+          volumes: Array<{ host_path: string; container_path: string }>
+          env: string[]
+          memory_mb?: number
+          cpus?: number
+        }
+      }>(`/system/services/custom/${service_name}`)
+      return response.data
+    })()
+  }
+
+  async updateCustomApp(payload: {
+    service_name: string
+    friendly_name: string
+    image: string
+    ports?: Array<{ container: number; host: number }>
+    volumes?: Array<{ host_path: string; container_path: string }>
+    env?: string[]
+    category?: string
+    icon?: string
+    memory_mb?: number
+    cpus?: number
+    force?: boolean
+  }) {
+    return catchInternal(async () => {
+      const response = await this.client.put<{
+        success: boolean
+        message: string
+        service_name: string
+      }>('/system/services/custom', payload)
+      return response.data
+    })()
+  }
 }
 
 export default new API()
diff --git a/admin/inertia/lib/icons.ts b/admin/inertia/lib/icons.ts
index 75a039d..f021366 100644
--- a/admin/inertia/lib/icons.ts
+++ b/admin/inertia/lib/icons.ts
@@ -1,35 +1,60 @@
 import {
   IconArrowUp,
+  IconBook,
   IconBooks,
+  IconBox,
   IconBrain,
+  IconBrandDocker,
+  IconBroadcast,
   IconChefHat,
   IconCheck,
+  IconChevronDown,
   IconChevronLeft,
   IconChevronRight,
+  IconCircleCheck,
   IconCloudDownload,
   IconCloudUpload,
+  IconCode,
+  IconCopy,
   IconCpu,
   IconDatabase,
   IconDownload,
+  IconExternalLink,
+  IconFileDescription,
+  IconFolderOpen,
   IconHome,
+  IconInfoCircle,
   IconLogs,
+  IconMap,
+  IconMenu2,
+  IconMoon,
+  IconMovie,
   IconNotes,
+  IconPencil,
+  IconPlant,
   IconPlayerPlay,
+  IconPlayerStop,
   IconPlus,
   IconRefresh,
   IconRefreshAlert,
   IconRobot,
   IconSchool,
+  IconSearch,
+  IconServer,
   IconSettings,
+  IconShieldCheck,
+  IconShieldLock,
+  IconStethoscope,
+  IconSun,
+  IconTool,
   IconTrash,
   IconUpload,
   IconWand,
+  IconWifi,
   IconWorld,
   IconX,
   IconAlertTriangle,
   IconXboxX,
-  IconCircleCheck,
-  IconInfoCircle,
   IconBug,
   IconCopy,
   IconLibrary,
@@ -37,14 +62,6 @@ import {
   IconMenu2,
   IconArrowLeft,
   IconArrowRight,
-  IconSun,
-  IconMoon,
-  IconStethoscope,
-  IconShieldCheck,
-  IconTool,
-  IconPlant,
-  IconCode,
-  IconMap,
 } from '@tabler/icons-react'
 
 /**
@@ -59,11 +76,16 @@ export const icons = {
   IconArrowLeft,
   IconArrowRight,
   IconArrowUp,
+  IconBook,
   IconBooks,
+  IconBox,
   IconBrain,
+  IconBrandDocker,
+  IconBroadcast,
   IconBug,
   IconChefHat,
   IconCheck,
+  IconChevronDown,
   IconChevronLeft,
   IconChevronRight,
   IconCircleCheck,
@@ -74,6 +96,9 @@ export const icons = {
   IconCpu,
   IconDatabase,
   IconDownload,
+  IconExternalLink,
+  IconFileDescription,
+  IconFolderOpen,
   IconHome,
   IconInfoCircle,
   IconLibrary,
@@ -81,23 +106,29 @@ export const icons = {
   IconMap,
   IconMenu2,
   IconMoon,
+  IconMovie,
   IconNotes,
+  IconPencil,
   IconPlant,
   IconPlayerPlay,
+  IconPlayerStop,
   IconPlus,
   IconRefresh,
   IconRefreshAlert,
   IconRobot,
   IconSchool,
+  IconSearch,
   IconServer,
   IconSettings,
   IconShieldCheck,
+  IconShieldLock,
   IconStethoscope,
   IconSun,
   IconTool,
   IconTrash,
   IconUpload,
   IconWand,
+  IconWifi,
   IconWorld,
   IconX,
   IconXboxX
diff --git a/admin/inertia/pages/home.tsx b/admin/inertia/pages/home.tsx
index 1feebb2..b9581bc 100644
--- a/admin/inertia/pages/home.tsx
+++ b/admin/inertia/pages/home.tsx
@@ -42,10 +42,10 @@ const SYSTEM_ITEMS = [
     poweredBy: null,
   },
   {
-    label: 'Install Apps',
-    to: '/settings/apps',
+    label: 'Supply Depot',
+    to: '/supply-depot',
     target: '',
-    description: 'Not seeing your favorite app? Install it here!',
+    description: 'Browse and install curated apps, or add your own Docker container',
     icon: <IconPlus size={48} />,
     installed: true,
     displayOrder: 51,
diff --git a/admin/inertia/pages/supply-depot.tsx b/admin/inertia/pages/supply-depot.tsx
new file mode 100644
index 0000000..f8cebe1
--- /dev/null
+++ b/admin/inertia/pages/supply-depot.tsx
@@ -0,0 +1,812 @@
+import { Head } from '@inertiajs/react'
+import { useEffect, useRef, useState } from 'react'
+import {
+  IconAlertTriangle,
+  IconBox,
+  IconBrandDocker,
+  IconChartBar,
+  IconCloudDownload,
+  IconFileText,
+  IconPackage,
+  IconPencil,
+  IconPlayerPlay,
+  IconPlayerStop,
+  IconRefresh,
+  IconSearch,
+  IconTrash,
+} from '@tabler/icons-react'
+import AppLayout from '~/layouts/AppLayout'
+import DynamicIcon, { DynamicIconName } from '~/components/DynamicIcon'
+import StyledButton from '~/components/StyledButton'
+import StyledModal from '~/components/StyledModal'
+import InstallActivityFeed from '~/components/InstallActivityFeed'
+import LoadingSpinner from '~/components/LoadingSpinner'
+import Alert from '~/components/Alert'
+import CustomAppModal, { CustomAppInitial } from '~/components/CustomAppModal'
+import ServiceLogsModal from '~/components/ServiceLogsModal'
+import ServiceStatsModal from '~/components/ServiceStatsModal'
+import StyledSectionHeader from '~/components/StyledSectionHeader'
+import useErrorNotification from '~/hooks/useErrorNotification'
+import useServiceInstallationActivity from '~/hooks/useServiceInstallationActivity'
+import { ServiceSlim } from '../../types/services'
+import { getServiceLink } from '~/lib/navigation'
+import api from '~/lib/api'
+import { toTitleCase } from '../../app/utils/misc'
+
+const CATEGORIES = [
+  { id: 'all', label: 'All' },
+  { id: 'installed', label: 'Installed' },
+  { id: 'productivity', label: 'Productivity' },
+  { id: 'media', label: 'Media' },
+  { id: 'security', label: 'Security' },
+  { id: 'networking', label: 'Networking' },
+  { id: 'utility', label: 'Utility' },
+  { id: 'ai', label: 'AI' },
+  { id: 'education', label: 'Education' },
+  { id: 'custom', label: 'Custom' },
+]
+
+const CATEGORY_COLORS: Record<string, string> = {
+  productivity: 'border border-desert-green-light bg-desert-green-lighter text-desert-green-dark',
+  media: 'border border-desert-tan-light bg-desert-tan-lighter text-desert-tan-dark',
+  security: 'border border-desert-red-light bg-desert-red-lighter text-desert-red-dark',
+  networking: 'border border-desert-stone-light bg-desert-stone-lighter text-desert-stone-dark',
+  utility: 'border border-desert-olive-light bg-desert-olive-lighter text-desert-olive-dark',
+  ai: 'border border-desert-green bg-desert-green-light text-desert-green-darker',
+  education: 'border border-desert-orange-light bg-desert-orange-lighter text-desert-orange-dark',
+  custom: 'border border-border-subtle bg-surface-secondary text-text-secondary',
+}
+
+type Modal =
+  | { type: 'install'; service: ServiceSlim }
+  | { type: 'start'; service: ServiceSlim }
+  | { type: 'stop'; service: ServiceSlim }
+  | { type: 'restart'; service: ServiceSlim }
+  | { type: 'reinstall'; service: ServiceSlim }
+  | { type: 'delete'; service: ServiceSlim }
+  | { type: 'logs'; service: ServiceSlim }
+  | { type: 'stats'; service: ServiceSlim }
+  | null
+
+export default function SupplyDepotPage(props: { system: { services: ServiceSlim[] } }) {
+  const { showError } = useErrorNotification()
+  const installActivity = useServiceInstallationActivity()
+
+  const [activeCategory, setActiveCategory] = useState('all')
+  const [search, setSearch] = useState('')
+  const [modal, setModal] = useState<Modal>(null)
+  const [loading, setLoading] = useState(false)
+  const [openDropdown, setOpenDropdown] = useState<string | null>(null)
+  const [customAppOpen, setCustomAppOpen] = useState(false)
+  const [editApp, setEditApp] = useState<CustomAppInitial | null>(null)
+  const [removeImage, setRemoveImage] = useState(false)
+
+  // Preflight state — scoped to the current install modal
+  const [preflight, setPreflight] = useState<{
+    portConflicts: Array<{ port: number; usedBy: string }>
+    resourceWarnings: string[]
+  } | null>(null)
+  const [preflightLoading, setPreflightLoading] = useState(false)
+  const [forceInstall, setForceInstall] = useState(false)
+
+  const dropdownRef = useRef<HTMLDivElement>(null)
+
+  // Auto-reload when installation completes
+  useEffect(() => {
+    if (!installActivity.length) return
+    if (installActivity.some((a) => a.type === 'completed' || a.type === 'update-complete')) {
+      setTimeout(() => window.location.reload(), 3000)
+    }
+  }, [installActivity])
+
+  // Close dropdown on outside click
+  useEffect(() => {
+    function handleClick(e: MouseEvent) {
+      if (dropdownRef.current && !dropdownRef.current.contains(e.target as Node)) {
+        setOpenDropdown(null)
+      }
+    }
+    document.addEventListener('mousedown', handleClick)
+    return () => document.removeEventListener('mousedown', handleClick)
+  }, [])
+
+  // Run preflight when install modal opens
+  useEffect(() => {
+    if (modal?.type !== 'install') {
+      setPreflight(null)
+      setForceInstall(false)
+      return
+    }
+    setPreflightLoading(true)
+    api
+      .preflightCheck(modal.service.service_name)
+      .then((res) => {
+        if (res) setPreflight(res)
+      })
+      .catch(() => {}) // non-fatal; proceed without warnings
+      .finally(() => setPreflightLoading(false))
+  }, [modal])
+
+  // ── Filtering ─────────────────────────────────────────────────────────────
+  const filteredServices = props.system.services.filter((s) => {
+    if (activeCategory === 'installed' && !s.installed) return false
+    if (activeCategory !== 'all' && activeCategory !== 'installed') {
+      if (s.category !== activeCategory) return false
+    }
+    if (search.trim()) {
+      const q = search.toLowerCase()
+      return (
+        s.friendly_name?.toLowerCase().includes(q) ||
+        s.description?.toLowerCase().includes(q) ||
+        s.powered_by?.toLowerCase().includes(q) ||
+        s.category?.toLowerCase().includes(q)
+      )
+    }
+    return true
+  })
+
+  const installedServices = filteredServices.filter((s) => s.installed)
+  const availableServices = filteredServices.filter((s) => !s.installed)
+
+  // ── Actions ───────────────────────────────────────────────────────────────
+  async function handleInstall(service: ServiceSlim) {
+    const hasWarnings =
+      (preflight?.portConflicts.length ?? 0) > 0 || (preflight?.resourceWarnings.length ?? 0) > 0
+
+    if (hasWarnings && !forceInstall) return
+
+    setLoading(true)
+    setModal(null)
+    const result = await api.installService(service.service_name)
+    setLoading(false)
+    if (!result?.success) showError(result?.message || 'Failed to start installation.')
+  }
+
+  async function handleAffect(service: ServiceSlim, action: 'start' | 'stop' | 'restart') {
+    setModal(null)
+    setLoading(true)
+    const result = await api.affectService(service.service_name, action)
+    setLoading(false)
+    if (!result?.success) showError(result?.message || `Failed to ${action} service.`)
+    else setTimeout(() => window.location.reload(), 1500)
+  }
+
+  async function handleForceReinstall(service: ServiceSlim) {
+    setModal(null)
+    setLoading(true)
+    const result = await api.forceReinstallService(service.service_name)
+    setLoading(false)
+    if (!result?.success) showError(result?.message || 'Failed to start reinstall.')
+  }
+
+  async function handleDelete(service: ServiceSlim) {
+    setModal(null)
+    setLoading(true)
+    const result = await api.deleteCustomApp(service.service_name, removeImage)
+    setRemoveImage(false)
+    setLoading(false)
+    if (!result?.success) showError(result?.message || 'Failed to delete app.')
+    else setTimeout(() => window.location.reload(), 1000)
+  }
+
+  async function handleUpdate(service: ServiceSlim) {
+    setOpenDropdown(null)
+    setLoading(true)
+    const result = await api.updateCustomAppImage(service.service_name)
+    setLoading(false)
+    if (!result?.success) showError(result?.message || 'Failed to update app.')
+    else setTimeout(() => window.location.reload(), 1500)
+  }
+
+  function handleCustomAppCreated() {
+    setCustomAppOpen(false)
+    // Page will reload when installation completes via broadcast
+  }
+
+  async function handleEdit(service: ServiceSlim) {
+    setOpenDropdown(null)
+    setLoading(true)
+    const res = await api.getCustomApp(service.service_name)
+    setLoading(false)
+    if (res?.success && res.app) {
+      setEditApp(res.app)
+    } else {
+      showError('Could not load this app for editing.')
+    }
+  }
+
+  function handleEdited() {
+    setEditApp(null)
+    setTimeout(() => window.location.reload(), 1500)
+  }
+
+  // ── Install modal helpers ─────────────────────────────────────────────────
+  const hasPreflightWarnings =
+    (preflight?.portConflicts.length ?? 0) > 0 || (preflight?.resourceWarnings.length ?? 0) > 0
+
+  return (
+    <AppLayout>
+      <Head title="Supply Depot" />
+
+      {loading && <LoadingSpinner fullscreen text="Working..." />}
+
+      <div className="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8 py-8">
+        {/* ── Hero / controls panel ─────────────────────────────────────────── */}
+        <div className="rounded-lg overflow-hidden bg-desert-white border border-desert-stone-light shadow-sm mb-8">
+          {/* Green header band */}
+          <div className="relative bg-desert-green px-6 py-5 overflow-hidden">
+            {/* Diagonal line pattern */}
+            <div
+              className="absolute inset-0 opacity-10"
+              style={{
+                backgroundImage: `repeating-linear-gradient(
+                  45deg,
+                  transparent,
+                  transparent 10px,
+                  rgba(255, 255, 255, 0.1) 10px,
+                  rgba(255, 255, 255, 0.1) 20px
+                )`,
+              }}
+            />
+            <div className="absolute top-0 right-0 w-24 h-24 transform translate-x-8 -translate-y-8">
+              <div className="w-full h-full bg-desert-green-dark opacity-30 transform rotate-45" />
+            </div>
+
+            <div className="relative flex items-center gap-3">
+              <IconBox className="text-white opacity-90 flex-shrink-0" size={28} />
+              <div>
+                <h1 className="text-2xl font-bold text-white uppercase tracking-wide leading-tight">
+                  Supply Depot
+                </h1>
+                <p className="text-sm text-white/70 mt-1 max-w-xl">
+                  Browse and install curated apps, or add your own custom apps by providing a Docker
+                  image.
+                </p>
+              </div>
+            </div>
+          </div>
+
+          {/* Controls body */}
+          <div className="p-6 space-y-4">
+            {/* Activity feed (shown only while installing) */}
+            {installActivity.length > 0 && (
+              <InstallActivityFeed activity={installActivity} withHeader />
+            )}
+
+            {/* Search + Add Custom App */}
+            <div className="flex flex-col sm:flex-row gap-3">
+              <div className="relative flex-1">
+                <IconSearch className="absolute left-3 top-1/2 -translate-y-1/2 text-text-muted h-4 w-4" />
+                <input
+                  type="text"
+                  placeholder="Search apps..."
+                  value={search}
+                  onChange={(e) => setSearch(e.target.value)}
+                  className="w-full pl-9 pr-4 py-2 rounded-md bg-surface-secondary border border-desert-stone-lighter text-text-primary text-sm focus:outline-none focus:ring-1 focus:ring-desert-green placeholder:text-text-muted/50"
+                />
+              </div>
+              <StyledButton
+                icon="IconBrandDocker"
+                variant="outline"
+                onClick={() => setCustomAppOpen(true)}
+              >
+                Add Custom App
+              </StyledButton>
+            </div>
+
+            {/* Category filters */}
+            <div className="flex flex-wrap gap-2">
+              {CATEGORIES.map((cat) => (
+                <button
+                  key={cat.id}
+                  onClick={() => setActiveCategory(cat.id)}
+                  className={`px-3 py-1 rounded-full text-xs font-medium transition-colors cursor-pointer border ${
+                    activeCategory === cat.id
+                      ? 'bg-desert-green text-white border-desert-green'
+                      : 'bg-surface-secondary text-text-muted border-desert-stone-lighter hover:text-text-primary hover:border-desert-stone-light'
+                  }`}
+                >
+                  {cat.label}
+                </button>
+              ))}
+            </div>
+          </div>
+
+          {/* Bottom accent bar */}
+          <div className="h-1 bg-desert-green" />
+        </div>
+
+        {/* App cards */}
+        {filteredServices.length === 0 ? (
+          <div className="text-center py-16">
+            <IconPackage className="mx-auto mb-3 opacity-40 text-desert-stone-light" size={48} />
+            <p className="text-text-muted">No apps match your filter.</p>
+          </div>
+        ) : (
+          <div className="space-y-10">
+            {installedServices.length > 0 && (
+              <section>
+                <StyledSectionHeader title={`Installed (${installedServices.length})`} />
+                <div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 gap-4">
+                  {installedServices.map((service) => (
+                    <AppCard
+                      key={service.service_name}
+                      service={service}
+                      openDropdown={openDropdown}
+                      dropdownRef={dropdownRef}
+                      onOpenDropdown={setOpenDropdown}
+                      onInstall={() => setModal({ type: 'install', service })}
+                      onStart={() => setModal({ type: 'start', service })}
+                      onStop={() => setModal({ type: 'stop', service })}
+                      onRestart={() => setModal({ type: 'restart', service })}
+                      onReinstall={() => setModal({ type: 'reinstall', service })}
+                      onDelete={() => setModal({ type: 'delete', service })}
+                      onLogs={() => setModal({ type: 'logs', service })}
+                      onStats={() => setModal({ type: 'stats', service })}
+                      onEdit={() => handleEdit(service)}
+                      onUpdate={() => handleUpdate(service)}
+                    />
+                  ))}
+                </div>
+              </section>
+            )}
+
+            {availableServices.length > 0 && (
+              <section>
+                <StyledSectionHeader title={`Available (${availableServices.length})`} />
+                <div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 gap-4">
+                  {availableServices.map((service) => (
+                    <AppCard
+                      key={service.service_name}
+                      service={service}
+                      openDropdown={openDropdown}
+                      dropdownRef={dropdownRef}
+                      onOpenDropdown={setOpenDropdown}
+                      onInstall={() => setModal({ type: 'install', service })}
+                      onStart={() => setModal({ type: 'start', service })}
+                      onStop={() => setModal({ type: 'stop', service })}
+                      onRestart={() => setModal({ type: 'restart', service })}
+                      onReinstall={() => setModal({ type: 'reinstall', service })}
+                      onDelete={() => setModal({ type: 'delete', service })}
+                      onLogs={() => setModal({ type: 'logs', service })}
+                      onStats={() => setModal({ type: 'stats', service })}
+                      onEdit={() => handleEdit(service)}
+                      onUpdate={() => handleUpdate(service)}
+                    />
+                  ))}
+                </div>
+              </section>
+            )}
+          </div>
+        )}
+      </div>
+
+      {/* ── Modals ─────────────────────────────────────────────────────────── */}
+
+      {/* Install modal */}
+      {modal?.type === 'install' && (
+        <StyledModal
+          title={`Install ${modal.service.friendly_name ?? modal.service.service_name}`}
+          open
+          onCancel={() => setModal(null)}
+          onConfirm={() => handleInstall(modal.service)}
+          confirmText="Install"
+          confirmIcon="IconDownload"
+          confirmVariant="primary"
+          confirmLoading={loading}
+        >
+          <div className="space-y-3 text-sm text-text-muted">
+            <p>
+              This will download and start <strong className="text-text-primary">{modal.service.friendly_name}</strong>
+              {modal.service.ui_location && (
+                <> on port <strong className="text-text-primary">{modal.service.ui_location}</strong></>
+              )}.
+            </p>
+            {modal.service.powered_by && (
+              <p className="text-xs">Powered by {modal.service.powered_by}</p>
+            )}
+
+            {preflightLoading && (
+              <div className="flex items-center gap-2 text-xs text-text-muted py-2">
+                <span className="animate-spin inline-block w-3 h-3 border border-desert-green border-t-transparent rounded-full" />
+                Checking for conflicts…
+              </div>
+            )}
+
+            {!preflightLoading && preflight && hasPreflightWarnings && (
+              <div className="space-y-2 pt-1">
+                {preflight.portConflicts.map((c) => (
+                  <Alert
+                    key={c.port}
+                    type="warning"
+                    title={`Port ${c.port} already in use`}
+                    message={`Currently bound by: ${c.usedBy}. Installation may fail.`}
+                  />
+                ))}
+                {preflight.resourceWarnings.map((w, i) => (
+                  <Alert key={i} type="warning" title="Resource warning" message={w} />
+                ))}
+                <label className="flex items-center gap-2 cursor-pointer select-none mt-2">
+                  <input
+                    type="checkbox"
+                    checked={forceInstall}
+                    onChange={(e) => setForceInstall(e.target.checked)}
+                    className="accent-desert-orange h-4 w-4 rounded"
+                  />
+                  <span className="text-xs text-text-muted">I understand — install anyway</span>
+                </label>
+              </div>
+            )}
+          </div>
+        </StyledModal>
+      )}
+
+      {/* Start modal */}
+      {modal?.type === 'start' && (
+        <StyledModal
+          title={`Start ${modal.service.friendly_name ?? modal.service.service_name}`}
+          open
+          onCancel={() => setModal(null)}
+          onConfirm={() => handleAffect(modal.service, 'start')}
+          confirmText="Start"
+          confirmIcon="IconPlayerPlay"
+          confirmVariant="primary"
+          confirmLoading={loading}
+        >
+          <p className="text-sm text-text-muted">This will start the container.</p>
+        </StyledModal>
+      )}
+
+      {/* Stop modal */}
+      {modal?.type === 'stop' && (
+        <StyledModal
+          title={`Stop ${modal.service.friendly_name ?? modal.service.service_name}`}
+          open
+          onCancel={() => setModal(null)}
+          onConfirm={() => handleAffect(modal.service, 'stop')}
+          confirmText="Stop"
+          confirmIcon="IconPlayerStop"
+          confirmVariant="action"
+          confirmLoading={loading}
+        >
+          <p className="text-sm text-text-muted">The container will be stopped. Your data is preserved.</p>
+        </StyledModal>
+      )}
+
+      {/* Restart modal */}
+      {modal?.type === 'restart' && (
+        <StyledModal
+          title={`Restart ${modal.service.friendly_name ?? modal.service.service_name}`}
+          open
+          onCancel={() => setModal(null)}
+          onConfirm={() => handleAffect(modal.service, 'restart')}
+          confirmText="Restart"
+          confirmIcon="IconRefresh"
+          confirmVariant="action"
+          confirmLoading={loading}
+        >
+          <p className="text-sm text-text-muted">The container will be briefly stopped and restarted.</p>
+        </StyledModal>
+      )}
+
+      {/* Force reinstall modal */}
+      {modal?.type === 'reinstall' && (
+        <StyledModal
+          title={`Force Reinstall ${modal.service.friendly_name ?? modal.service.service_name}`}
+          open
+          onCancel={() => setModal(null)}
+          onConfirm={() => handleForceReinstall(modal.service)}
+          confirmText="Wipe & Reinstall"
+          confirmIcon="IconRefresh"
+          confirmVariant="danger"
+          confirmLoading={loading}
+          icon={<IconAlertTriangle className="text-desert-red" size={40} />}
+        >
+          <div className="space-y-2 text-sm text-text-muted">
+            <p className="font-semibold text-desert-red">This will delete all app data and cannot be undone.</p>
+            <p>The container and its associated volumes will be removed, then a fresh installation will begin.</p>
+          </div>
+        </StyledModal>
+      )}
+
+      {/* Delete custom app modal */}
+      {modal?.type === 'delete' && (
+        <StyledModal
+          title={`Delete ${modal.service.friendly_name ?? modal.service.service_name}`}
+          open
+          onCancel={() => {
+            setRemoveImage(false)
+            setModal(null)
+          }}
+          onConfirm={() => handleDelete(modal.service)}
+          confirmText="Delete"
+          confirmIcon="IconTrash"
+          confirmVariant="danger"
+          confirmLoading={loading}
+          icon={<IconAlertTriangle className="text-desert-red" size={40} />}
+        >
+          <div className="space-y-3 text-sm text-text-muted">
+            <p className="font-semibold text-desert-red">This will permanently remove this custom app.</p>
+            <p>The container will be stopped and removed. Host volume data will remain on disk.</p>
+            <label className="flex items-center gap-2 cursor-pointer select-none">
+              <input
+                type="checkbox"
+                checked={removeImage}
+                onChange={(e) => setRemoveImage(e.target.checked)}
+                className="accent-desert-red h-4 w-4 rounded"
+              />
+              <span className="text-text-muted text-xs">Also remove the Docker image to reclaim disk space</span>
+            </label>
+          </div>
+        </StyledModal>
+      )}
+
+      {/* Logs modal */}
+      {modal?.type === 'logs' && (
+        <ServiceLogsModal
+          serviceName={modal.service.service_name}
+          friendlyName={modal.service.friendly_name ?? modal.service.service_name}
+          open
+          onClose={() => setModal(null)}
+        />
+      )}
+
+      {/* Stats modal */}
+      {modal?.type === 'stats' && (
+        <ServiceStatsModal
+          serviceName={modal.service.service_name}
+          friendlyName={modal.service.friendly_name ?? modal.service.service_name}
+          open
+          onClose={() => setModal(null)}
+        />
+      )}
+
+      {/* Custom app creation modal */}
+      <CustomAppModal
+        open={customAppOpen}
+        onClose={() => setCustomAppOpen(false)}
+        onCreated={handleCustomAppCreated}
+        showError={showError}
+      />
+
+      {/* Custom app edit modal */}
+      <CustomAppModal
+        open={!!editApp}
+        mode="edit"
+        initial={editApp}
+        onClose={() => setEditApp(null)}
+        onCreated={handleEdited}
+        showError={showError}
+      />
+    </AppLayout>
+  )
+}
+
+// ── App Card component ────────────────────────────────────────────────────────
+
+interface AppCardProps {
+  service: ServiceSlim
+  openDropdown: string | null
+  dropdownRef: React.RefObject<HTMLDivElement | null>
+  onOpenDropdown: (name: string | null) => void
+  onInstall: () => void
+  onStart: () => void
+  onStop: () => void
+  onRestart: () => void
+  onReinstall: () => void
+  onDelete: () => void
+  onLogs: () => void
+  onStats: () => void
+  onEdit: () => void
+  onUpdate: () => void
+}
+
+function AppCard({
+  service,
+  openDropdown,
+  dropdownRef,
+  onOpenDropdown,
+  onInstall,
+  onStart,
+  onStop,
+  onRestart,
+  onReinstall,
+  onDelete,
+  onLogs,
+  onStats,
+  onEdit,
+  onUpdate,
+}: AppCardProps) {
+  const isRunning = service.status === 'running'
+  const isStopped = service.installed && !isRunning
+  const catColor = service.category ? CATEGORY_COLORS[service.category] ?? CATEGORY_COLORS.custom : CATEGORY_COLORS.custom
+  const isDropdownOpen = openDropdown === service.service_name
+
+  function toggleDropdown(e: React.MouseEvent) {
+    e.stopPropagation()
+    onOpenDropdown(isDropdownOpen ? null : service.service_name)
+  }
+
+  return (
+    <div
+      className={`relative flex flex-col rounded-xl border p-4 bg-surface-primary shadow-sm transition-all duration-200 hover:shadow-lg hover:-translate-y-0.5 overflow-hidden ${
+        service.installed
+          ? 'border-desert-stone-light'
+          : 'border-desert-stone-lighter hover:border-desert-stone-light'
+      }`}
+    >
+      {/* Installed accent spine */}
+      {service.installed ? (
+        <div className="absolute left-0 top-0 bottom-0 w-1 bg-desert-green" />
+      ) : null}
+
+      {/* Top row: icon + status badge */}
+      <div className="flex items-start justify-between mb-3">
+        <div className="flex items-center gap-3">
+          <div className="w-12 h-12 rounded-lg bg-desert-green-lighter border border-desert-green-light flex items-center justify-center flex-shrink-0">
+            {service.icon ? (
+              <DynamicIcon icon={service.icon as DynamicIconName} className="h-7 w-7 text-desert-green" />
+            ) : (
+              <IconBrandDocker className="h-7 w-7 text-text-muted" />
+            )}
+          </div>
+          <div className="min-w-0">
+            <p className="font-semibold text-text-primary text-sm leading-tight truncate">
+              {service.friendly_name ?? service.service_name}
+            </p>
+            {service.powered_by && (
+              <p className="text-xs text-text-muted truncate">{service.powered_by}</p>
+            )}
+          </div>
+        </div>
+
+        {/* Status indicator */}
+        <div className="flex-shrink-0 ml-2">
+          {service.installation_status === 'installing' ? (
+            <span className="flex items-center gap-1 text-xs text-desert-orange">
+              <span className="animate-spin inline-block w-3 h-3 border border-desert-orange border-t-transparent rounded-full" />
+              Installing
+            </span>
+          ) : isRunning ? (
+            <span className="flex items-center gap-1 text-xs text-desert-green">
+              <span className="h-2 w-2 rounded-full bg-desert-green" />
+              Running
+            </span>
+          ) : isStopped ? (
+            <span className="flex items-center gap-1 text-xs text-text-muted">
+              <span className="h-2 w-2 rounded-full bg-text-muted" />
+              Stopped
+            </span>
+          ) : null}
+        </div>
+      </div>
+
+      {/* Description */}
+      {service.description && (
+        <p className="text-xs text-text-muted leading-relaxed mb-3 flex-1 line-clamp-2">
+          {service.description}
+        </p>
+      )}
+
+      {/* Metadata row: category badge + port pill */}
+      <div className="flex items-center gap-2 mb-4 flex-wrap">
+        {service.category && (
+          <span className={`text-xs px-2 py-0.5 rounded-full font-medium ${catColor}`}>
+            {toTitleCase(service.category)}
+          </span>
+        )}
+        {service.is_custom ? (
+          <span className="text-xs px-2 py-0.5 rounded-full font-medium bg-surface-secondary text-text-muted border border-surface-secondary">
+            custom
+          </span>
+        ) : null}
+        {service.ui_location && !service.ui_location.startsWith('/') && (
+          <span className="text-xs px-2 py-0.5 rounded-full bg-surface-secondary text-text-muted font-mono">
+            :{service.ui_location}
+          </span>
+        )}
+      </div>
+
+      {/* Action buttons */}
+      <div className="flex items-center gap-2">
+        {!service.installed && service.installation_status !== 'installing' && (
+          <StyledButton
+            size="sm"
+            variant="primary"
+            icon="IconDownload"
+            onClick={onInstall}
+            fullWidth
+          >
+            Install
+          </StyledButton>
+        )}
+
+        {service.installed ? (
+          <>
+            {/* Open button */}
+            {service.ui_location && (
+              <a
+                href={getServiceLink(service.ui_location)}
+                target="_blank"
+                rel="noopener noreferrer"
+                className="flex-1"
+              >
+                <StyledButton size="sm" variant="primary" icon="IconExternalLink" fullWidth>
+                  Open
+                </StyledButton>
+              </a>
+            )}
+
+            {/* Manage dropdown */}
+            <div className="relative" ref={isDropdownOpen ? dropdownRef : null}>
+              <StyledButton size="sm" variant="outline" onClick={toggleDropdown} icon="IconChevronDown">
+                Manage
+              </StyledButton>
+
+              {isDropdownOpen && (
+                <div className="absolute right-0 bottom-full mb-1 w-44 bg-surface-primary border border-surface-secondary rounded-lg shadow-xl z-20 overflow-hidden">
+                  {isStopped && (
+                    <DropdownItem icon={<IconPlayerPlay className="h-4 w-4" />} label="Start" onClick={onStart} />
+                  )}
+                  {isRunning && (
+                    <DropdownItem icon={<IconPlayerStop className="h-4 w-4" />} label="Stop" onClick={onStop} />
+                  )}
+                  <DropdownItem icon={<IconRefresh className="h-4 w-4" />} label="Restart" onClick={onRestart} />
+                  <DropdownItem icon={<IconFileText className="h-4 w-4" />} label="Logs" onClick={onLogs} />
+                  <DropdownItem icon={<IconChartBar className="h-4 w-4" />} label="Stats" onClick={onStats} />
+                  {service.is_custom ? (
+                    <DropdownItem icon={<IconPencil className="h-4 w-4" />} label="Edit" onClick={onEdit} />
+                  ) : null}
+                  {service.is_custom ? (
+                    <DropdownItem icon={<IconCloudDownload className="h-4 w-4" />} label="Update (pull latest)" onClick={onUpdate} />
+                  ) : null}
+                  <DropdownItem icon={<IconRefresh className="h-4 w-4 text-desert-orange" />} label="Force Reinstall" onClick={onReinstall} danger />
+                  {service.is_custom ? (
+                    <DropdownItem icon={<IconTrash className="h-4 w-4 text-desert-red" />} label="Delete" onClick={onDelete} danger />
+                  ): null}
+                </div>
+              )}
+            </div>
+          </>
+        ) : null}
+
+        {service.installation_status === 'installing' && (
+          <div className="flex-1 flex items-center justify-center text-xs text-text-muted gap-1 py-1">
+            <span className="animate-spin inline-block w-3 h-3 border border-desert-green border-t-transparent rounded-full" />
+            In progress…
+          </div>
+        )}
+      </div>
+    </div>
+  )
+}
+
+function DropdownItem({
+  icon,
+  label,
+  onClick,
+  danger = false,
+}: {
+  icon: React.ReactNode
+  label: string
+  onClick: () => void
+  danger?: boolean
+}) {
+  return (
+    <button
+      type="button"
+      onClick={(e) => {
+        e.stopPropagation()
+        onClick()
+      }}
+      className={`flex items-center gap-2 w-full px-3 py-2 text-xs transition-colors text-left cursor-pointer ${
+        danger
+          ? 'text-desert-red hover:bg-desert-red/10'
+          : 'text-text-primary hover:bg-surface-secondary'
+      }`}
+    >
+      {icon}
+      {label}
+    </button>
+  )
+}
diff --git a/admin/start/routes.ts b/admin/start/routes.ts
index 9372387..598c951 100644
--- a/admin/start/routes.ts
+++ b/admin/start/routes.ts
@@ -16,6 +16,7 @@ import MapsController from '#controllers/maps_controller'
 import OllamaController from '#controllers/ollama_controller'
 import RagController from '#controllers/rag_controller'
 import SettingsController from '#controllers/settings_controller'
+import SupplyDepotController from '#controllers/supply_depot_controller'
 import SystemController from '#controllers/system_controller'
 import CollectionUpdatesController from '#controllers/collection_updates_controller'
 import ZimController from '#controllers/zim_controller'
@@ -29,6 +30,7 @@ router.get('/home', [HomeController, 'home'])
 router.on('/about').renderInertia('about')
 router.get('/chat', [ChatsController, 'inertia'])
 router.get('/maps', [MapsController, 'index'])
+router.get('/supply-depot', [SupplyDepotController, 'index'])
 router.on('/knowledge-base').redirectToPath('/chat?knowledge_base=true') // redirect for legacy knowledge-base links
 
 router.get('/easy-setup', [EasySetupController, 'index'])
@@ -46,7 +48,7 @@ router
 router
   .group(() => {
     router.get('/system', [SettingsController, 'system'])
-    router.get('/apps', [SettingsController, 'apps'])
+    router.on('/apps').redirectToPath('/supply-depot') // superseded by Supply Depot
     router.get('/legal', [SettingsController, 'legal'])
     router.get('/maps', [SettingsController, 'maps'])
     router.get('/models', [SettingsController, 'models'])
@@ -168,6 +170,16 @@ router
     router.post('/services/install', [SystemController, 'installService'])
     router.post('/services/force-reinstall', [SystemController, 'forceReinstallService'])
     router.post('/services/check-updates', [SystemController, 'checkServiceUpdates'])
+    router.get('/services/preflight', [SystemController, 'preflightCheck'])
+    router.get('/services/suggest-port', [SystemController, 'suggestCustomPort'])
+    router.post('/services/preflight-custom', [SystemController, 'preflightCustomApp'])
+    router.post('/services/custom', [SystemController, 'createCustomApp'])
+    router.put('/services/custom', [SystemController, 'updateCustomApp'])
+    router.post('/services/custom/update', [SystemController, 'updateCustomApp_pullLatest'])
+    router.delete('/services/custom', [SystemController, 'deleteCustomApp'])
+    router.get('/services/custom/:name', [SystemController, 'getCustomApp'])
+    router.get('/services/:name/logs', [SystemController, 'getServiceLogs'])
+    router.get('/services/:name/stats', [SystemController, 'getServiceStats'])
     router.get('/services/:name/available-versions', [SystemController, 'getAvailableVersions'])
     router.post('/services/update', [SystemController, 'updateService'])
     router.post('/subscribe-release-notes', [SystemController, 'subscribeToReleaseNotes'])
diff --git a/admin/tests/unit/custom_app_guard.spec.ts b/admin/tests/unit/custom_app_guard.spec.ts
new file mode 100644
index 0000000..9a72ab8
--- /dev/null
+++ b/admin/tests/unit/custom_app_guard.spec.ts
@@ -0,0 +1,112 @@
+import * as assert from 'node:assert/strict'
+import { test } from 'node:test'
+
+import { evaluateBindMounts, evaluateImageReference } from '../../app/services/custom_app_guard.js'
+
+// ── Bind mounts ──────────────────────────────────────────────────────────────
+// These assume the default storage root (/opt/project-nomad/storage), i.e. NOMAD_STORAGE_PATH unset.
+
+test('evaluateBindMounts hard-blocks the Docker socket', () => {
+  const { blocked } = evaluateBindMounts([
+    { host_path: '/var/run/docker.sock', container_path: '/var/run/docker.sock' },
+  ])
+  assert.equal(blocked.length, 1)
+})
+
+test('evaluateBindMounts hard-blocks core system directories', () => {
+  for (const dir of ['/etc', '/proc/foo', '/sys', '/boot', '/dev/sda']) {
+    const { blocked } = evaluateBindMounts([{ host_path: dir, container_path: '/data' }])
+    assert.equal(blocked.length, 1, `${dir} should be blocked`)
+  }
+})
+
+test('evaluateBindMounts hard-blocks mounting at or above the install tree', () => {
+  for (const dir of ['/', '/opt', '/opt/project-nomad']) {
+    const { blocked } = evaluateBindMounts([{ host_path: dir, container_path: '/data' }])
+    assert.equal(blocked.length, 1, `${dir} should be blocked`)
+  }
+})
+
+test('evaluateBindMounts allows paths under the storage root without warning', () => {
+  const { blocked, warnings } = evaluateBindMounts([
+    { host_path: '/opt/project-nomad/storage/myapp', container_path: '/data' },
+  ])
+  assert.equal(blocked.length, 0)
+  assert.equal(warnings.length, 0)
+})
+
+test('evaluateBindMounts warns (but allows) paths outside the storage root', () => {
+  const { blocked, warnings } = evaluateBindMounts([
+    { host_path: '/home/user/data', container_path: '/data' },
+  ])
+  assert.equal(blocked.length, 0)
+  assert.equal(warnings.length, 1)
+})
+
+test('evaluateBindMounts resolves .. before matching (no traversal escape)', () => {
+  // Normalizes to /etc, which must still be blocked despite the dressing-up.
+  const { blocked } = evaluateBindMounts([
+    { host_path: '/srv/../etc/shadow', container_path: '/data' },
+  ])
+  assert.equal(blocked.length, 1)
+})
+
+test('evaluateBindMounts requires absolute container paths', () => {
+  const { blocked } = evaluateBindMounts([
+    { host_path: '/opt/project-nomad/storage/x', container_path: 'relative' },
+  ])
+  assert.equal(blocked.length, 1)
+})
+
+test('evaluateBindMounts hard-blocks a colon in the host path', () => {
+  // Without this, Docker would re-split "/etc:foo" on the colon and mount /etc — bypassing the
+  // system-directory block, which only matches the string as a whole path.
+  const { blocked } = evaluateBindMounts([
+    { host_path: '/etc:foo', container_path: '/data' },
+  ])
+  assert.equal(blocked.length, 1)
+})
+
+test('evaluateBindMounts hard-blocks a colon in the container path', () => {
+  const { blocked } = evaluateBindMounts([
+    { host_path: '/opt/project-nomad/storage/x', container_path: '/data:ro' },
+  ])
+  assert.equal(blocked.length, 1)
+})
+
+// ── Image references ─────────────────────────────────────────────────────────
+
+test('evaluateImageReference warns on the latest tag', () => {
+  const { blocked, warnings } = evaluateImageReference('nginx:latest')
+  assert.equal(blocked.length, 0)
+  assert.ok(warnings.some((w) => w.includes('moving tag')))
+})
+
+test('evaluateImageReference warns when no tag is given', () => {
+  const { warnings } = evaluateImageReference('nginx')
+  assert.ok(warnings.some((w) => w.includes('moving tag')))
+})
+
+test('evaluateImageReference is clean for a pinned image from a trusted registry', () => {
+  const { blocked, warnings } = evaluateImageReference('ghcr.io/stirling-tools/s-pdf:0.30.1')
+  assert.equal(blocked.length, 0)
+  assert.equal(warnings.length, 0)
+})
+
+test('evaluateImageReference warns on an untrusted registry', () => {
+  const { warnings } = evaluateImageReference('myregistry.example.com/app:1.0.0')
+  assert.ok(warnings.some((w) => w.includes('trusted registries')))
+})
+
+test('evaluateImageReference blocks a malformed reference', () => {
+  const { blocked } = evaluateImageReference('not a valid image!!')
+  assert.equal(blocked.length, 1)
+})
+
+test('evaluateImageReference accepts a digest-pinned image without a moving-tag warning', () => {
+  const { blocked, warnings } = evaluateImageReference(
+    'ghcr.io/org/app@sha256:' + 'a'.repeat(64)
+  )
+  assert.equal(blocked.length, 0)
+  assert.equal(warnings.length, 0)
+})
diff --git a/admin/types/services.ts b/admin/types/services.ts
index cb9f45a..380001e 100644
--- a/admin/types/services.ts
+++ b/admin/types/services.ts
@@ -14,4 +14,6 @@ export type ServiceSlim = Pick<
   | 'display_order'
   | 'container_image'
   | 'available_update_version'
+  | 'is_custom'
+  | 'category'
 > & { status?: string }

From 02c33b277e1c7381564764fd27d46412a81d6d3b Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Thu, 4 Jun 2026 09:21:32 -0700
Subject: [PATCH 14/83] feat: edit curated apps + fix dropdown clip + stale
 _old rollback

---
 admin/app/controllers/system_controller.ts    | 86 +++++++++++++++++--
 admin/app/models/service.ts                   |  7 ++
 admin/app/services/docker_service.ts          |  8 ++
 admin/app/services/system_service.ts          |  2 +
 ...000000002_add_user_modified_to_services.ts | 20 +++++
 admin/database/seeders/service_seeder.ts      | 19 +++-
 admin/inertia/components/CustomAppModal.tsx   |  2 +-
 admin/inertia/pages/supply-depot.tsx          | 19 ++--
 admin/types/services.ts                       |  1 +
 9 files changed, 146 insertions(+), 18 deletions(-)
 create mode 100644 admin/database/migrations/1772000000002_add_user_modified_to_services.ts

diff --git a/admin/app/controllers/system_controller.ts b/admin/app/controllers/system_controller.ts
index abace4f..f364291 100644
--- a/admin/app/controllers/system_controller.ts
+++ b/admin/app/controllers/system_controller.ts
@@ -434,19 +434,22 @@ export default class SystemController {
         return response.send({ success: true, running: result.running ?? false, stats: result.stats ?? null })
     }
 
-    /** Return a custom app's current configuration in the editable form-shape. */
+    /** Return an app's current configuration in the editable form-shape. */
     async getCustomApp({ params, response }: HttpContext) {
         const service = await Service.query().where('service_name', params.name).first()
         if (!service) {
             return response.status(404).send({ error: `Service ${params.name} not found` })
         }
-        if (!service.is_custom) {
-            return response.status(403).send({ error: 'Only custom apps can be edited.' })
+        // Custom and curated apps are both editable; hidden dependency services (e.g. Qdrant) are not.
+        if (service.is_dependency_service) {
+            return response.status(403).send({ error: 'This service cannot be edited.' })
         }
         return response.send({ success: true, app: this.parseCustomContainerConfig(service) })
     }
 
-    /** Reconfigure a custom app: validate + guard, persist the new config, then recreate the container. */
+    /** Reconfigure an app: validate + guard, persist the new config, then recreate the container.
+     * Works for both custom apps and curated (pre-configured) apps. Editing a curated app marks it
+     * user-modified so the seeder stops overwriting the user's changes. */
     async updateCustomApp({ request, response }: HttpContext) {
         const payload = await request.validateUsing(updateCustomAppValidator)
 
@@ -454,8 +457,9 @@ export default class SystemController {
         if (!service) {
             return response.status(404).send({ success: false, message: `Service ${payload.service_name} not found` })
         }
-        if (!service.is_custom) {
-            return response.status(403).send({ success: false, message: 'Only custom apps can be edited.' })
+        // Custom and curated apps are both editable; hidden dependency services (e.g. Qdrant) are not.
+        if (service.is_dependency_service) {
+            return response.status(403).send({ success: false, message: 'This service cannot be edited.' })
         }
 
         // Reject duplicate host ports within the request.
@@ -492,13 +496,21 @@ export default class SystemController {
             }
         }
 
-        const { containerConfig, uiLocation } = this.buildCustomContainerConfig(payload)
+        // Merge the form fields into the app's existing config rather than rebuilding from scratch,
+        // so advanced settings a curated app ships with (GPU device requests, special env, etc.) are
+        // preserved across an edit.
+        const { containerConfig, uiLocation } = this.mergeCustomContainerConfig(
+            service.container_config,
+            payload
+        )
         service.friendly_name = payload.friendly_name
         service.container_image = payload.image
         service.container_config = JSON.stringify(containerConfig)
         service.ui_location = uiLocation
         service.category = payload.category ?? service.category ?? 'custom'
         if (payload.icon) service.icon = payload.icon
+        // Flag as user-modified so the seeder stops overwriting this app's config on future runs.
+        service.is_user_modified = true
         await service.save()
 
         const result = await this.dockerService.recreateCustomAppContainer(payload.service_name)
@@ -552,6 +564,66 @@ export default class SystemController {
         return { containerConfig, uiLocation }
     }
 
+    /**
+     * Merge custom-app form input into an app's *existing* container config. Used by the edit path so
+     * editing a curated app only changes the fields exposed in the form (image/ports/volumes/env and,
+     * if supplied, resource caps) while preserving everything else it ships with (GPU DeviceRequests,
+     * User, custom HostConfig keys, etc.). Unlike buildCustomContainerConfig, resource caps are NOT
+     * defaulted here — a curated app intentionally left uncapped stays uncapped unless the user sets one.
+     */
+    private mergeCustomContainerConfig(
+        existingRaw: string | null,
+        payload: {
+            ports?: { container: number; host: number }[]
+            volumes?: { host_path: string; container_path: string }[]
+            env?: string[]
+            memory_mb?: number
+            cpus?: number
+        }
+    ): { containerConfig: Record<string, any>; uiLocation: string | null } {
+        const parsed = existingRaw
+            ? typeof existingRaw === 'object'
+                ? existingRaw
+                : JSON.parse(existingRaw as string)
+            : {}
+        // Deep clone so we never mutate the parsed source.
+        const containerConfig: Record<string, any> = JSON.parse(JSON.stringify(parsed ?? {}))
+        containerConfig.HostConfig = containerConfig.HostConfig ?? {}
+        // Keep a restart policy if the existing config lacked one.
+        containerConfig.HostConfig.RestartPolicy =
+            containerConfig.HostConfig.RestartPolicy ?? { Name: 'unless-stopped' }
+
+        const portBindings: Record<string, [{ HostPort: string }]> = {}
+        const exposedPorts: Record<string, {}> = {}
+        for (const { container, host } of payload.ports ?? []) {
+            portBindings[`${container}/tcp`] = [{ HostPort: String(host) }]
+            exposedPorts[`${container}/tcp`] = {}
+        }
+        containerConfig.HostConfig.PortBindings = portBindings
+        containerConfig.ExposedPorts = exposedPorts
+
+        const binds = (payload.volumes ?? []).map(
+            ({ host_path, container_path }) => `${host_path}:${container_path}`
+        )
+        if (binds.length) containerConfig.HostConfig.Binds = binds
+        else delete containerConfig.HostConfig.Binds
+
+        if (payload.env?.length) containerConfig.Env = payload.env
+        else delete containerConfig.Env
+
+        // Only touch resource caps when the user explicitly set them — preserve existing/uncapped otherwise.
+        if (payload.memory_mb != null) {
+            containerConfig.HostConfig.Memory = payload.memory_mb * 1024 * 1024
+        }
+        if (payload.cpus != null) {
+            containerConfig.HostConfig.NanoCpus = Math.round(payload.cpus * 1e9)
+        }
+
+        const firstHostPort = payload.ports?.[0]?.host
+        const uiLocation = firstHostPort ? String(firstHostPort) : null
+        return { containerConfig, uiLocation }
+    }
+
     /** Inverse of buildCustomContainerConfig: turn a stored Service into the editable form-shape. */
     private parseCustomContainerConfig(service: Service) {
         const raw = service.container_config
diff --git a/admin/app/models/service.ts b/admin/app/models/service.ts
index 452122a..b532f0f 100644
--- a/admin/app/models/service.ts
+++ b/admin/app/models/service.ts
@@ -69,6 +69,13 @@ export default class Service extends BaseModel {
   })
   declare is_custom: boolean
 
+  @column({
+    serialize(value) {
+      return Boolean(value)
+    },
+  })
+  declare is_user_modified: boolean
+
   @column()
   declare category: string | null
 
diff --git a/admin/app/services/docker_service.ts b/admin/app/services/docker_service.ts
index 760162b..19b27e0 100644
--- a/admin/app/services/docker_service.ts
+++ b/admin/app/services/docker_service.ts
@@ -1593,6 +1593,14 @@ export class DockerService {
     const oldInfo = await this._findContainerByName(serviceName)
     const oldName = `${serviceName}_old`
 
+    // Clear any stale `_old` left behind by a previous recreate that died mid-flight. Without this,
+    // the rename below would fail (name in use) and the rollback path would then destroy the live
+    // container and resurrect the stale one in its place.
+    const staleOld = await this._findContainerByName(oldName)
+    if (staleOld) {
+      await this.docker.getContainer(staleOld.Id).remove({ force: true }).catch(() => {})
+    }
+
     try {
       // Stop + rename the existing container aside as a rollback safety net.
       if (oldInfo) {
diff --git a/admin/app/services/system_service.ts b/admin/app/services/system_service.ts
index ed3e5e0..8e27d85 100644
--- a/admin/app/services/system_service.ts
+++ b/admin/app/services/system_service.ts
@@ -310,6 +310,7 @@ export class SystemService {
         'container_image',
         'available_update_version',
         'is_custom',
+        'is_user_modified',
         'category'
       )
       .where('is_dependency_service', false)
@@ -341,6 +342,7 @@ export class SystemService {
         container_image: service.container_image,
         available_update_version: service.available_update_version,
         is_custom: service.is_custom,
+        is_user_modified: service.is_user_modified,
         category: service.category,
       })
     }
diff --git a/admin/database/migrations/1772000000002_add_user_modified_to_services.ts b/admin/database/migrations/1772000000002_add_user_modified_to_services.ts
new file mode 100644
index 0000000..b4b359a
--- /dev/null
+++ b/admin/database/migrations/1772000000002_add_user_modified_to_services.ts
@@ -0,0 +1,20 @@
+import { BaseSchema } from '@adonisjs/lucid/schema'
+
+export default class extends BaseSchema {
+  protected tableName = 'services'
+
+  async up() {
+    this.schema.alterTable(this.tableName, (table) => {
+      // Set when a user edits a curated (non-custom) app. Tells the seeder to stop
+      // overwriting that service's container_config on subsequent runs, so the user's
+      // customizations (e.g. a changed port) survive reboots and upgrades.
+      table.boolean('is_user_modified').notNullable().defaultTo(false)
+    })
+  }
+
+  async down() {
+    this.schema.alterTable(this.tableName, (table) => {
+      table.dropColumn('is_user_modified')
+    })
+  }
+}
diff --git a/admin/database/seeders/service_seeder.ts b/admin/database/seeders/service_seeder.ts
index 6221201..dda4b08 100644
--- a/admin/database/seeders/service_seeder.ts
+++ b/admin/database/seeders/service_seeder.ts
@@ -7,7 +7,13 @@ import { KIWIX_LIBRARY_CMD } from '../../constants/kiwix.js'
 
 type ServiceSeedRecord = Omit<
   ModelAttributes<Service>,
-  'created_at' | 'updated_at' | 'id' | 'available_update_version' | 'update_checked_at' | 'metadata'
+  | 'created_at'
+  | 'updated_at'
+  | 'id'
+  | 'available_update_version'
+  | 'update_checked_at'
+  | 'metadata'
+  | 'is_user_modified'
 > & { metadata?: string | null }
 
 export default class ServiceSeeder extends BaseSeeder {
@@ -460,7 +466,11 @@ export default class ServiceSeeder extends BaseSeeder {
   ]
 
   async run() {
-    const existingServices = await Service.query().select(['service_name', 'is_custom'])
+    const existingServices = await Service.query().select([
+      'service_name',
+      'is_custom',
+      'is_user_modified',
+    ])
     const existingServiceMap = new Map(existingServices.map((s) => [s.service_name, s]))
 
     const newServices = ServiceSeeder.DEFAULT_SERVICES.filter(
@@ -472,10 +482,11 @@ export default class ServiceSeeder extends BaseSeeder {
     }
 
     // Keep container_config, container_command, and metadata in sync for curated services.
-    // Custom services are user-defined and must never be overwritten.
+    // Custom services are user-defined and must never be overwritten. User-modified curated
+    // services (a user edited their config) are likewise left alone so the edit survives reboots.
     for (const service of ServiceSeeder.DEFAULT_SERVICES) {
       const existing = existingServiceMap.get(service.service_name)
-      if (existing && !existing.is_custom) {
+      if (existing && !existing.is_custom && !existing.is_user_modified) {
         await Service.query().where('service_name', service.service_name).update({
           container_config: service.container_config,
           container_command: service.container_command ?? null,
diff --git a/admin/inertia/components/CustomAppModal.tsx b/admin/inertia/components/CustomAppModal.tsx
index fb04bb5..77ada8f 100644
--- a/admin/inertia/components/CustomAppModal.tsx
+++ b/admin/inertia/components/CustomAppModal.tsx
@@ -286,7 +286,7 @@ export default function CustomAppModal({
 
   return (
     <StyledModal
-      title={isEdit ? 'Edit Custom App' : 'Add Custom App'}
+      title={isEdit ? 'Edit App' : 'Add Custom App'}
       open={open}
       onCancel={handleClose}
       cancelText="Cancel"
diff --git a/admin/inertia/pages/supply-depot.tsx b/admin/inertia/pages/supply-depot.tsx
index f8cebe1..4acfd08 100644
--- a/admin/inertia/pages/supply-depot.tsx
+++ b/admin/inertia/pages/supply-depot.tsx
@@ -629,15 +629,16 @@ function AppCard({
 
   return (
     <div
-      className={`relative flex flex-col rounded-xl border p-4 bg-surface-primary shadow-sm transition-all duration-200 hover:shadow-lg hover:-translate-y-0.5 overflow-hidden ${
+      className={`relative flex flex-col rounded-xl border p-4 bg-surface-primary shadow-sm transition-all duration-200 hover:shadow-lg hover:-translate-y-0.5 ${
         service.installed
           ? 'border-desert-stone-light'
           : 'border-desert-stone-lighter hover:border-desert-stone-light'
       }`}
     >
-      {/* Installed accent spine */}
+      {/* Installed accent spine (rounded to follow the card corners — the card no longer clips
+          overflow so the Manage dropdown can open above the card without being cut off) */}
       {service.installed ? (
-        <div className="absolute left-0 top-0 bottom-0 w-1 bg-desert-green" />
+        <div className="absolute left-0 top-0 bottom-0 w-1 bg-desert-green rounded-l-xl" />
       ) : null}
 
       {/* Top row: icon + status badge */}
@@ -700,6 +701,14 @@ function AppCard({
             custom
           </span>
         ) : null}
+        {service.is_user_modified && !service.is_custom ? (
+          <span
+            className="text-xs px-2 py-0.5 rounded-full font-medium bg-desert-tan-lighter text-desert-tan-dark border border-desert-tan-light"
+            title="You've customized this app, so it won't be overwritten by catalog updates."
+          >
+            modified
+          </span>
+        ) : null}
         {service.ui_location && !service.ui_location.startsWith('/') && (
           <span className="text-xs px-2 py-0.5 rounded-full bg-surface-secondary text-text-muted font-mono">
             :{service.ui_location}
@@ -754,9 +763,7 @@ function AppCard({
                   <DropdownItem icon={<IconRefresh className="h-4 w-4" />} label="Restart" onClick={onRestart} />
                   <DropdownItem icon={<IconFileText className="h-4 w-4" />} label="Logs" onClick={onLogs} />
                   <DropdownItem icon={<IconChartBar className="h-4 w-4" />} label="Stats" onClick={onStats} />
-                  {service.is_custom ? (
-                    <DropdownItem icon={<IconPencil className="h-4 w-4" />} label="Edit" onClick={onEdit} />
-                  ) : null}
+                  <DropdownItem icon={<IconPencil className="h-4 w-4" />} label="Edit" onClick={onEdit} />
                   {service.is_custom ? (
                     <DropdownItem icon={<IconCloudDownload className="h-4 w-4" />} label="Update (pull latest)" onClick={onUpdate} />
                   ) : null}
diff --git a/admin/types/services.ts b/admin/types/services.ts
index 380001e..526af20 100644
--- a/admin/types/services.ts
+++ b/admin/types/services.ts
@@ -15,5 +15,6 @@ export type ServiceSlim = Pick<
   | 'container_image'
   | 'available_update_version'
   | 'is_custom'
+  | 'is_user_modified'
   | 'category'
 > & { status?: string }

From 7b1b480c5eea652f7b6e82f8d18235fd0890b1c1 Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Thu, 4 Jun 2026 10:30:47 -0700
Subject: [PATCH 15/83] fix(supply-depot): correct Meshtastic Web internal port
 (80->8080); add catalog port audit script

---
 admin/database/seeders/service_seeder.ts |   5 +-
 admin/scripts/audit_catalog_ports.py     | 194 +++++++++++++++++++++++
 2 files changed, 197 insertions(+), 2 deletions(-)
 create mode 100644 admin/scripts/audit_catalog_ports.py

diff --git a/admin/database/seeders/service_seeder.ts b/admin/database/seeders/service_seeder.ts
index dda4b08..c5c623c 100644
--- a/admin/database/seeders/service_seeder.ts
+++ b/admin/database/seeders/service_seeder.ts
@@ -340,9 +340,10 @@ export default class ServiceSeeder extends BaseSeeder {
       container_config: JSON.stringify({
         HostConfig: {
           RestartPolicy: { Name: 'unless-stopped' },
-          PortBindings: { '80/tcp': [{ HostPort: '8450' }] },
+          // meshtastic/web serves on 8080 inside the container, not 80.
+          PortBindings: { '8080/tcp': [{ HostPort: '8450' }] },
         },
-        ExposedPorts: { '80/tcp': {} },
+        ExposedPorts: { '8080/tcp': {} },
       }),
       ui_location: '8450',
       installed: false,
diff --git a/admin/scripts/audit_catalog_ports.py b/admin/scripts/audit_catalog_ports.py
new file mode 100644
index 0000000..8277296
--- /dev/null
+++ b/admin/scripts/audit_catalog_ports.py
@@ -0,0 +1,194 @@
+#!/usr/bin/env python3
+"""
+Supply Depot catalog port audit.
+
+For every curated (non-dependency) service in the `services` table, launch its image in a
+throwaway container using the catalog's image / command / env / volume container-paths, then
+detect what TCP port(s) the app actually listens on inside the container (via /proc/net/tcp,
+which needs no tools in the image) and compare against the container port the catalog maps.
+
+A mismatch is the "Meshtastic Web" class of bug: the catalog publishes host->containerPort but
+the app listens on a different internal port, so the published port reaches nothing.
+
+Non-invasive: separate `audit_*` containers, random host ports on 127.0.0.1, temp volumes,
+auto-removed. It never touches NOMAD's service records or real containers.
+
+Run on a NOMAD host (needs the nomad_mysql container + docker):  python3 audit_catalog_ports.py
+"""
+import json
+import os
+import shlex
+import shutil
+import subprocess
+import tempfile
+import time
+
+HOST_PORT_BASE = 9300  # throwaway host ports, well clear of catalog (8400s) and customs (8600s)
+STARTUP_TIMEOUT = 60   # seconds to wait for an app to come up (heavy JVM apps like Stirling are slow)
+MEMORY_CAP = "2g"      # generous cap; some apps (Stirling) OOM under 1g and falsely look crashed
+
+# Apps that legitimately can't run in a throwaway probe (need real data or device config), so a
+# "CRASHED"/"UNREACHABLE" verdict for them is expected and NOT a catalog port bug. Listed for the
+# reader's benefit only — the script still probes them.
+KNOWN_NEEDS_SETUP = {
+    "nomad_kiwix_server": "needs a ZIM library (managed separately by NOMAD)",
+    "nomad_meshtasticd": "needs a config.yaml with a MAC address",
+}
+
+
+def sh(cmd):
+    return subprocess.run(cmd, shell=True, capture_output=True, text=True)
+
+
+def mysql(query):
+    """Run a query in the nomad_mysql container, reading the password from its own env.
+
+    The inner command is single-quoted for the host shell so $MYSQL_PASSWORD is NOT expanded
+    on the host (where it's unset) — it reaches the container's shell literally and expands there.
+    Query must contain no double quotes (these catalog queries don't).
+    """
+    inner = 'mysql -N -unomad_user -p"$MYSQL_PASSWORD" nomad -e "%s"' % query
+    out = sh("docker exec nomad_mysql sh -c " + shlex.quote(inner))
+    if out.returncode != 0:
+        raise SystemExit("mysql query failed: " + out.stderr)
+    return out.stdout
+
+
+def parse_config(raw):
+    try:
+        return json.loads(raw) if raw else {}
+    except Exception:
+        return {}
+
+
+def container_port(cfg):
+    """First container port from PortBindings (preferred) or ExposedPorts, e.g. '8080/tcp' -> 8080."""
+    pb = (cfg.get("HostConfig") or {}).get("PortBindings") or {}
+    keys = list(pb.keys()) or list((cfg.get("ExposedPorts") or {}).keys())
+    for k in keys:
+        try:
+            return int(k.split("/")[0])
+        except ValueError:
+            continue
+    return None
+
+
+def listening_ports(name):
+    """Listening TCP ports inside a container, parsed from /proc/net/tcp{,6} (st 0A = LISTEN)."""
+    ports = set()
+    for proc in ("/proc/net/tcp", "/proc/net/tcp6"):
+        out = sh(f"docker exec {name} cat {proc} 2>/dev/null")
+        for line in out.stdout.splitlines()[1:]:
+            f = line.split()
+            if len(f) > 3 and f[3] == "0A":
+                try:
+                    ports.add(int(f[1].split(":")[1], 16))
+                except (IndexError, ValueError):
+                    pass
+    return sorted(ports)
+
+
+def image_exposed(image):
+    out = sh(f"docker image inspect {image} --format '{{{{json .Config.ExposedPorts}}}}'")
+    try:
+        d = json.loads(out.stdout.strip() or "null") or {}
+        return sorted(int(k.split("/")[0]) for k in d)
+    except Exception:
+        return []
+
+
+def main():
+    rows = mysql(
+        "SELECT service_name, container_image, COALESCE(container_command,''), container_config "
+        "FROM services WHERE category IS NOT NULL AND is_dependency_service=0 "
+        "AND is_custom=0 ORDER BY service_name"
+    )
+    services = [r.split("\t", 3) for r in rows.splitlines() if r.strip()]
+    results = []
+
+    for idx, (name, image, command, raw_cfg) in enumerate(services):
+        cfg = parse_config(raw_cfg)
+        cport = container_port(cfg)
+        env = cfg.get("Env") or []
+        binds = (cfg.get("HostConfig") or {}).get("Binds") or []
+        host_port = HOST_PORT_BASE + idx
+        cname = "audit_" + name
+        tmpdirs = []
+
+        sh(f"docker rm -f {cname} >/dev/null 2>&1")
+
+        args = ["docker", "run", "-d", "--name", cname, "--memory=" + MEMORY_CAP]
+        for e in env:
+            args += ["-e", e]
+        for b in binds:
+            cpath = b.split(":")[1] if ":" in b else b
+            td = tempfile.mkdtemp(prefix="audit_")
+            os.chmod(td, 0o777)
+            tmpdirs.append(td)
+            args += ["-v", f"{td}:{cpath}"]
+        if cport:
+            args += ["-p", f"127.0.0.1:{host_port}:{cport}/tcp"]
+        args.append(image)
+        if command.strip():
+            args += command.split()
+
+        run = subprocess.run(args, capture_output=True, text=True)
+        if run.returncode != 0:
+            results.append((name, image, cport, [], None, "START ERROR: " + run.stderr.strip()[:160]))
+            for td in tmpdirs:
+                shutil.rmtree(td, ignore_errors=True)
+            continue
+
+        # Wait for the app to come up: a reachable published port or any internal listener.
+        reachable_code, listeners = "000", []
+        deadline = time.time() + STARTUP_TIMEOUT
+        while time.time() < deadline:
+            state = sh(f"docker inspect -f '{{{{.State.Running}}}}' {cname}").stdout.strip()
+            listeners = listening_ports(cname)
+            if cport:
+                reachable_code = sh(
+                    f"curl -s -o /dev/null -m 3 -w '%{{http_code}}' http://127.0.0.1:{host_port}"
+                ).stdout.strip()
+            if (cport and cport in listeners) or (reachable_code not in ("000", "")):
+                break
+            if state == "false" and listeners == []:
+                time.sleep(2)
+            time.sleep(2)
+
+        running = sh(f"docker inspect -f '{{{{.State.Running}}}}' {cname}").stdout.strip() == "true"
+        if not running:
+            verdict = "CRASHED (exited)"
+        elif cport is None:
+            verdict = "NO PORT in catalog config"
+        elif cport in listeners:
+            verdict = f"OK (listens on {cport}, http={reachable_code})"
+        elif listeners:
+            verdict = f"PORT MISMATCH: catalog={cport}, app listens on {listeners}"
+        elif reachable_code not in ("000", ""):
+            verdict = f"OK (reachable http={reachable_code})"
+        else:
+            verdict = f"UNREACHABLE: nothing on catalog port {cport} (no listeners detected)"
+
+        results.append((name, image, cport, listeners, image_exposed(image), verdict))
+
+        sh(f"docker rm -f {cname} >/dev/null 2>&1")
+        for td in tmpdirs:
+            shutil.rmtree(td, ignore_errors=True)
+
+    print("\n===== SUPPLY DEPOT CATALOG PORT AUDIT =====\n")
+    for name, image, cport, listeners, exposed, verdict in results:
+        flag = "  " if verdict.startswith("OK") else ">>"
+        print(f"{flag} {name}")
+        print(f"     image:        {image}")
+        print(f"     catalog port: {cport}   image EXPOSE: {exposed or '-'}   listening: {listeners or '-'}")
+        print(f"     verdict:      {verdict}")
+        if name in KNOWN_NEEDS_SETUP and not verdict.startswith("OK"):
+            print(f"     note:         expected — {KNOWN_NEEDS_SETUP[name]}; not a port bug")
+        print()
+    bad = [r for r in results if not r[5].startswith("OK") and r[0] not in KNOWN_NEEDS_SETUP]
+    print(f"===== {len([r for r in results if r[5].startswith('OK')])}/{len(results)} OK; "
+          f"{len(bad)} unexpected issue(s), {len(KNOWN_NEEDS_SETUP)} known-needs-setup =====")
+
+
+if __name__ == "__main__":
+    main()

From 3501144caa709c5aa9ccf5b1140d0d7adfa8f4c3 Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Thu, 4 Jun 2026 12:35:15 -0700
Subject: [PATCH 16/83] feat(supply-depot): scheme-aware service links
 (https:port) for TLS-serving apps

---
 admin/app/controllers/system_controller.ts | 7 ++++++-
 admin/app/services/docker_service.ts       | 6 ++++++
 admin/inertia/lib/navigation.ts            | 7 +++++++
 3 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/admin/app/controllers/system_controller.ts b/admin/app/controllers/system_controller.ts
index f364291..1fc5a0d 100644
--- a/admin/app/controllers/system_controller.ts
+++ b/admin/app/controllers/system_controller.ts
@@ -499,6 +499,9 @@ export default class SystemController {
         // Merge the form fields into the app's existing config rather than rebuilding from scratch,
         // so advanced settings a curated app ships with (GPU device requests, special env, etc.) are
         // preserved across an edit.
+        // Preserve an explicit scheme (e.g. ui_location "https:8480") across an edit — otherwise a
+        // TLS-serving app's Open link would silently revert to http after any reconfigure.
+        const prevScheme = (service.ui_location || '').match(/^(https?):\d+$/)?.[1]
         const { containerConfig, uiLocation } = this.mergeCustomContainerConfig(
             service.container_config,
             payload
@@ -506,7 +509,9 @@ export default class SystemController {
         service.friendly_name = payload.friendly_name
         service.container_image = payload.image
         service.container_config = JSON.stringify(containerConfig)
-        service.ui_location = uiLocation
+        service.ui_location = prevScheme && uiLocation && /^\d+$/.test(uiLocation)
+            ? `${prevScheme}:${uiLocation}`
+            : uiLocation
         service.category = payload.category ?? service.category ?? 'custom'
         if (payload.icon) service.icon = payload.icon
         // Flag as user-modified so the seeder stops overwriting this app's config on future runs.
diff --git a/admin/app/services/docker_service.ts b/admin/app/services/docker_service.ts
index 19b27e0..71e208e 100644
--- a/admin/app/services/docker_service.ts
+++ b/admin/app/services/docker_service.ts
@@ -198,6 +198,12 @@ export class DockerService {
 
     const hostname = process.env.NODE_ENV === 'production' ? serviceName : 'localhost'
 
+    // "https:8480" / "http:8480" — explicit scheme + port (e.g. an app serving its own TLS).
+    const schemePort = service.ui_location?.match(/^(https?):(\d+)$/)
+    if (schemePort) {
+      return `${schemePort[1]}://${hostname}:${schemePort[2]}`
+    }
+
     // First, check if ui_location is set and is a valid port number
     if (service.ui_location && parseInt(service.ui_location, 10)) {
       return `http://${hostname}:${service.ui_location}`
diff --git a/admin/inertia/lib/navigation.ts b/admin/inertia/lib/navigation.ts
index 49040ef..b88255e 100644
--- a/admin/inertia/lib/navigation.ts
+++ b/admin/inertia/lib/navigation.ts
@@ -1,6 +1,13 @@
 
 
 export function getServiceLink(ui_location: string): string {
+    // "https:8480" / "http:8480" — an explicit scheme + port served on the current host. Checked
+    // before the URL parse below because new URL("https:8480") would mis-parse 8480 as the host.
+    const schemePort = ui_location.match(/^(https?):(\d+)$/);
+    if (schemePort) {
+        return `${schemePort[1]}://${window.location.hostname}:${schemePort[2]}`;
+    }
+
     // Check if the ui location is a valid URL
     try {
         const url = new URL(ui_location);

From b8674193daae2add427c12f75946b1d3f3909be8 Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Thu, 4 Jun 2026 12:47:42 -0700
Subject: [PATCH 17/83] fix(supply-depot): show clean port + lock on card pill
 for https:port ui_location

---
 admin/inertia/pages/supply-depot.tsx | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/admin/inertia/pages/supply-depot.tsx b/admin/inertia/pages/supply-depot.tsx
index 4acfd08..efdec52 100644
--- a/admin/inertia/pages/supply-depot.tsx
+++ b/admin/inertia/pages/supply-depot.tsx
@@ -621,6 +621,11 @@ function AppCard({
   const isStopped = service.installed && !isRunning
   const catColor = service.category ? CATEGORY_COLORS[service.category] ?? CATEGORY_COLORS.custom : CATEGORY_COLORS.custom
   const isDropdownOpen = openDropdown === service.service_name
+  // Port pill: an ui_location may carry an explicit scheme ("https:8480") — show just the port,
+  // with a lock when it's served over HTTPS, rather than the raw "https:8480" string.
+  const uiIsPath = !!service.ui_location && service.ui_location.startsWith('/')
+  const uiIsHttps = /^https:/.test(service.ui_location || '')
+  const uiPort = service.ui_location && !uiIsPath ? service.ui_location.replace(/^https?:/, '') : null
 
   function toggleDropdown(e: React.MouseEvent) {
     e.stopPropagation()
@@ -709,9 +714,9 @@ function AppCard({
             modified
           </span>
         ) : null}
-        {service.ui_location && !service.ui_location.startsWith('/') && (
+        {uiPort && (
           <span className="text-xs px-2 py-0.5 rounded-full bg-surface-secondary text-text-muted font-mono">
-            :{service.ui_location}
+            {uiIsHttps ? '🔒 ' : ''}:{uiPort}
           </span>
         )}
       </div>

From f488f08c960a7e155a19997018b9edc3b65fb7f2 Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Fri, 5 Jun 2026 09:34:06 -0700
Subject: [PATCH 18/83] feat(supply-depot): per-app onboarding docs, install
 fixes, and in-app Docs links

Add NOMAD-specific getting-started docs for all 9 curated Supply Depot apps,
the catalog/install fixes each one surfaced, and a way to reach the docs from
each app card.

Docs:
- New in-app Markdoc page admin/docs/supply-depot-apps.md covering all 9 apps
  (Stirling PDF, File Browser, Calibre-Web, IT Tools, Excalidraw, Homebox,
  Vaultwarden, Jellyfin, Meshtastic Web): first run/login, where data lives,
  and offline behaviour. Registered in docs_service DOC_ORDER.
- Manage > Docs dropdown item linking each app to its section
  (/docs/supply-depot-apps#<anchor>): anchor map in constants/supply_depot_docs.ts,
  heading anchors via Markdoc {% #id %}, and hash-scroll on the docs page.

Install / catalog fixes:
- Stirling PDF: open straight to the tools (SECURITY_ENABLELOGIN=false; the old
  v1 DOCKER_ENABLE_SECURITY flag was dead).
- File Browser: seed a known admin/nomad login (bcrypt) instead of a random
  log-only password; scope visibility to content folders via mount selection and
  move the DB out of the browsable root.
- Calibre-Web: bundle an empty Calibre library and seed it on install so setup
  doesn't dead-end at db config (_runPreinstallActions__CalibreWeb).
- Homebox: swap the archived hay-kot image for the maintained sysadminsmedia fork.
- Vaultwarden: generate a self-signed cert on install and serve HTTPS by default
  (_runPreinstallActions__Vaultwarden + ROCKET_TLS + ui_location https:8480), so
  the web vault has the secure context it requires.
- Jellyfin: pre-create storage/media/{Movies,TV Shows,Music,Photos} so each
  library points at its own subfolder, avoiding the overlapping-path issue that
  silently hides content (_runPreinstallActions__Jellyfin).
- Seeder run() now also syncs ui_location for non-modified curated services, so a
  catalog link/scheme/port change reaches existing installs on update.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 Dockerfile                                |   4 +
 admin/app/services/docker_service.ts      | 208 ++++++++++++++++++++-
 admin/app/services/docs_service.ts        |   9 +-
 admin/app/utils/fs.ts                     |  11 ++
 admin/constants/supply_depot_docs.ts      |  26 +++
 admin/database/seeders/service_seeder.ts  |  70 +++++--
 admin/docs/supply-depot-apps.md           | 212 ++++++++++++++++++++++
 admin/inertia/pages/docs/show.tsx         |  14 ++
 admin/inertia/pages/supply-depot.tsx      |  17 ++
 install/calibre-empty-library/README.md   |  19 ++
 install/calibre-empty-library/metadata.db | Bin 0 -> 409600 bytes
 11 files changed, 571 insertions(+), 19 deletions(-)
 create mode 100644 admin/constants/supply_depot_docs.ts
 create mode 100644 admin/docs/supply-depot-apps.md
 create mode 100644 install/calibre-empty-library/README.md
 create mode 100644 install/calibre-empty-library/metadata.db

diff --git a/Dockerfile b/Dockerfile
index 0dcc184..edf6e51 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -84,6 +84,10 @@ RUN echo "{\"version\":\"${VERSION}\"}" > /app/version.json
 COPY admin/docs /app/docs
 COPY README.md /app/README.md
 
+# Empty Calibre library, seeded into storage/books on Calibre-Web install
+# (see DockerService._runPreinstallActions__CalibreWeb)
+COPY install/calibre-empty-library/metadata.db /app/assets/calibre/metadata.db
+
 # Copy entrypoint script and ensure it's executable
 COPY install/entrypoint.sh /usr/local/bin/entrypoint.sh
 RUN chmod +x /usr/local/bin/entrypoint.sh
diff --git a/admin/app/services/docker_service.ts b/admin/app/services/docker_service.ts
index 71e208e..962233a 100644
--- a/admin/app/services/docker_service.ts
+++ b/admin/app/services/docker_service.ts
@@ -5,12 +5,19 @@ import { inject } from '@adonisjs/core'
 import transmit from '@adonisjs/transmit/services/main'
 import { doResumableDownloadWithRetry } from '../utils/downloads.js'
 import { join } from 'path'
-import { ZIM_STORAGE_PATH } from '../utils/fs.js'
+import {
+  ZIM_STORAGE_PATH,
+  BOOKS_STORAGE_PATH,
+  CALIBRE_EMPTY_LIBRARY_ASSET_PATH,
+  VAULTWARDEN_STORAGE_PATH,
+  MEDIA_STORAGE_PATH,
+  JELLYFIN_MEDIA_SUBFOLDERS,
+} from '../utils/fs.js'
 import { KiwixLibraryService } from './kiwix_library_service.js'
 import { SERVICE_NAMES } from '../../constants/service_names.js'
 import { exec } from 'child_process'
 import { promisify } from 'util'
-import { readFile } from 'node:fs/promises'
+import { readFile, mkdir, copyFile, chown, chmod, access } from 'node:fs/promises'
 import KVStore from '#models/kv_store'
 import { BROADCAST_CHANNELS } from '../../constants/broadcast.js'
 import { KIWIX_LIBRARY_CMD } from '../../constants/kiwix.js'
@@ -510,6 +517,33 @@ export class DockerService {
         )
       }
 
+      if (service.service_name === SERVICE_NAMES.CALIBREWEB) {
+        await this._runPreinstallActions__CalibreWeb()
+        this._broadcast(
+          service.service_name,
+          'preinstall-complete',
+          `Pre-install actions for Calibre-Web completed successfully.`
+        )
+      }
+
+      if (service.service_name === SERVICE_NAMES.VAULTWARDEN) {
+        await this._runPreinstallActions__Vaultwarden()
+        this._broadcast(
+          service.service_name,
+          'preinstall-complete',
+          `Pre-install actions for Vaultwarden completed successfully.`
+        )
+      }
+
+      if (service.service_name === SERVICE_NAMES.JELLYFIN) {
+        await this._runPreinstallActions__Jellyfin()
+        this._broadcast(
+          service.service_name,
+          'preinstall-complete',
+          `Pre-install actions for Jellyfin completed successfully.`
+        )
+      }
+
       // GPU-aware configuration for Ollama
       let finalImage = service.container_image
       let gpuHostConfig = containerConfig?.HostConfig || {}
@@ -783,6 +817,176 @@ export class DockerService {
     }
   }
 
+  /**
+   * Calibre-Web cannot create a library from scratch — without an existing Calibre database it
+   * dead-ends at the "Database Configuration" page. Seed an empty library (bundled in the admin
+   * image) into storage/books so the user just points Calibre-Web at /books and starts adding
+   * books. Only seeds when no metadata.db already exists, so an existing library is never clobbered.
+   * Ownership is handed to the container user (PUID/PGID 1000 in the seeder) so Calibre-Web can
+   * write to the library and create book folders on upload.
+   */
+  private async _runPreinstallActions__CalibreWeb(): Promise<void> {
+    // Keep in sync with the PUID/PGID set on the Calibre-Web service in the seeder.
+    const CALIBRE_WEB_UID = 1000
+    const CALIBRE_WEB_GID = 1000
+
+    const booksDir = join(process.cwd(), BOOKS_STORAGE_PATH)
+    const metadataPath = join(booksDir, 'metadata.db')
+    const assetPath = join(process.cwd(), CALIBRE_EMPTY_LIBRARY_ASSET_PATH)
+
+    this._broadcast(
+      SERVICE_NAMES.CALIBREWEB,
+      'preinstall',
+      `Running pre-install actions for Calibre-Web...`
+    )
+
+    try {
+      await mkdir(booksDir, { recursive: true })
+
+      // Don't clobber an existing library — only seed when there's no metadata.db yet.
+      const alreadyHasLibrary = await access(metadataPath)
+        .then(() => true)
+        .catch(() => false)
+
+      if (alreadyHasLibrary) {
+        this._broadcast(
+          SERVICE_NAMES.CALIBREWEB,
+          'preinstall',
+          `Existing Calibre library found in books folder — leaving it as-is.`
+        )
+      } else {
+        await copyFile(assetPath, metadataPath)
+        this._broadcast(
+          SERVICE_NAMES.CALIBREWEB,
+          'preinstall',
+          `Seeded an empty Calibre library into the books folder.`
+        )
+      }
+
+      // Hand the books folder + library to the Calibre-Web container user so it can read/write
+      // the library and create book folders on upload (Docker creates bind dirs as root otherwise).
+      await chown(booksDir, CALIBRE_WEB_UID, CALIBRE_WEB_GID)
+      await chown(metadataPath, CALIBRE_WEB_UID, CALIBRE_WEB_GID)
+    } catch (error: any) {
+      this._broadcast(
+        SERVICE_NAMES.CALIBREWEB,
+        'preinstall-error',
+        `Failed to prepare the Calibre library: ${error.message}`
+      )
+      throw new Error(`Pre-install action failed: ${error.message}`)
+    }
+  }
+
+  /**
+   * Vaultwarden's web vault refuses to run without a secure context — over plain HTTP it shows
+   * "You need to enable HTTPS!" and you can't register or unlock. We give it a self-signed TLS
+   * cert in its /data volume so it serves HTTPS out of the box (paired with the ROCKET_TLS env and
+   * the `https:8480` ui_location set in the seeder). Users click through a one-time browser warning;
+   * after that the vault is fully functional offline. Self-signed is the only option on a LAN
+   * appliance with no public DNS to get a trusted cert for.
+   */
+  private async _runPreinstallActions__Vaultwarden(): Promise<void> {
+    const dataDir = join(process.cwd(), VAULTWARDEN_STORAGE_PATH)
+    const certPath = join(dataDir, 'cert.pem')
+    const keyPath = join(dataDir, 'key.pem')
+
+    this._broadcast(
+      SERVICE_NAMES.VAULTWARDEN,
+      'preinstall',
+      `Running pre-install actions for Vaultwarden...`
+    )
+
+    try {
+      await mkdir(dataDir, { recursive: true })
+
+      // Don't regenerate if a cert is already present — keeps the same cert across reinstalls so
+      // users don't get a fresh browser warning every time, and never clobbers a cert an admin
+      // may have swapped in themselves.
+      const alreadyHasCert = await Promise.all([
+        access(certPath)
+          .then(() => true)
+          .catch(() => false),
+        access(keyPath)
+          .then(() => true)
+          .catch(() => false),
+      ]).then(([c, k]) => c && k)
+
+      if (alreadyHasCert) {
+        this._broadcast(
+          SERVICE_NAMES.VAULTWARDEN,
+          'preinstall',
+          `Existing Vaultwarden TLS certificate found — leaving it as-is.`
+        )
+        return
+      }
+
+      // 10-year self-signed cert. CN/SAN are cosmetic for a self-signed cert (the browser warns
+      // regardless), but a SAN keeps it structurally valid for clients that require one.
+      const execAsync = promisify(exec)
+      await execAsync(
+        `openssl req -x509 -newkey rsa:2048 -nodes ` +
+          `-keyout "${keyPath}" -out "${certPath}" -days 3650 ` +
+          `-subj "/CN=Project NOMAD Vaultwarden" ` +
+          `-addext "subjectAltName=DNS:nomad,DNS:localhost"`
+      )
+
+      // Lock the private key down; the cert can stay world-readable. Vaultwarden runs as root and
+      // reads both from /data, so no chown is needed (admin writes them as root too).
+      await chmod(keyPath, 0o600)
+      await chmod(certPath, 0o644)
+
+      this._broadcast(
+        SERVICE_NAMES.VAULTWARDEN,
+        'preinstall',
+        `Generated a self-signed HTTPS certificate for Vaultwarden.`
+      )
+    } catch (error: any) {
+      this._broadcast(
+        SERVICE_NAMES.VAULTWARDEN,
+        'preinstall-error',
+        `Failed to prepare the Vaultwarden certificate: ${error.message}`
+      )
+      throw new Error(`Pre-install action failed: ${error.message}`)
+    }
+  }
+
+  /**
+   * Jellyfin works best when each library points at its own subfolder. Pointing one library at the
+   * whole media root and another at a subfolder inside it makes Jellyfin report a "duplicate path"
+   * and silently drop the nested library's content. To steer users toward the one-folder-per-type
+   * layout (and match the documentation), we pre-create the suggested subfolders under the shared
+   * media root so they're ready to pick in the setup wizard. Idempotent: only missing folders are
+   * created (mkdir is a no-op on existing ones) and nothing the user added is ever touched.
+   */
+  private async _runPreinstallActions__Jellyfin(): Promise<void> {
+    const mediaDir = join(process.cwd(), MEDIA_STORAGE_PATH)
+
+    this._broadcast(
+      SERVICE_NAMES.JELLYFIN,
+      'preinstall',
+      `Running pre-install actions for Jellyfin...`
+    )
+
+    try {
+      await mkdir(mediaDir, { recursive: true })
+      for (const name of JELLYFIN_MEDIA_SUBFOLDERS) {
+        await mkdir(join(mediaDir, name), { recursive: true })
+      }
+      this._broadcast(
+        SERVICE_NAMES.JELLYFIN,
+        'preinstall',
+        `Prepared media folders: ${JELLYFIN_MEDIA_SUBFOLDERS.join(', ')}.`
+      )
+    } catch (error: any) {
+      this._broadcast(
+        SERVICE_NAMES.JELLYFIN,
+        'preinstall-error',
+        `Failed to prepare the Jellyfin media folders: ${error.message}`
+      )
+      throw new Error(`Pre-install action failed: ${error.message}`)
+    }
+  }
+
   private async _cleanupFailedInstallation(serviceName: string): Promise<void> {
     try {
       const service = await Service.query().where('service_name', serviceName).first()
diff --git a/admin/app/services/docs_service.ts b/admin/app/services/docs_service.ts
index 17fee29..5ff401c 100644
--- a/admin/app/services/docs_service.ts
+++ b/admin/app/services/docs_service.ts
@@ -12,10 +12,11 @@ export class DocsService {
     'home': 1,
     'getting-started': 2,
     'use-cases': 3,
-    'community-add-ons': 4,
-    'faq': 5,
-    'about': 6,
-    'release-notes': 7,
+    'supply-depot-apps': 4,
+    'community-add-ons': 5,
+    'faq': 6,
+    'about': 7,
+    'release-notes': 8,
   }
 
   async getDocs() {
diff --git a/admin/app/utils/fs.ts b/admin/app/utils/fs.ts
index d6cb5e0..0d31bc1 100644
--- a/admin/app/utils/fs.ts
+++ b/admin/app/utils/fs.ts
@@ -6,6 +6,17 @@ import { LSBlockDevice, NomadDiskInfoRaw } from '../../types/system.js'
 
 export const ZIM_STORAGE_PATH = '/storage/zim'
 export const KIWIX_LIBRARY_XML_PATH = '/storage/zim/kiwix-library.xml'
+export const BOOKS_STORAGE_PATH = '/storage/books'
+// Shared media root (Jellyfin reads it as /media; File Browser shows it as "media"). Per-type
+// subfolders are pre-created on Jellyfin install — see _runPreinstallActions__Jellyfin.
+export const MEDIA_STORAGE_PATH = '/storage/media'
+export const JELLYFIN_MEDIA_SUBFOLDERS = ['Movies', 'TV Shows', 'Music', 'Photos']
+// Empty Calibre library bundled into the admin image (see install/calibre-empty-library/).
+// Seeded into storage/books on Calibre-Web install so it doesn't dead-end at db config.
+export const CALIBRE_EMPTY_LIBRARY_ASSET_PATH = 'assets/calibre/metadata.db'
+// Vaultwarden's /data volume. A self-signed TLS cert is generated here on install so the
+// web vault has the secure context (HTTPS) it requires — see _runPreinstallActions__Vaultwarden.
+export const VAULTWARDEN_STORAGE_PATH = '/storage/vaultwarden'
 
 export async function listDirectoryContents(path: string): Promise<FileEntry[]> {
   const entries = await readdir(path, { withFileTypes: true })
diff --git a/admin/constants/supply_depot_docs.ts b/admin/constants/supply_depot_docs.ts
new file mode 100644
index 0000000..e9531db
--- /dev/null
+++ b/admin/constants/supply_depot_docs.ts
@@ -0,0 +1,26 @@
+import { SERVICE_NAMES } from './service_names.js'
+
+// In-app docs page (admin/docs/supply-depot-apps.md) served at /docs/supply-depot-apps.
+export const SUPPLY_DEPOT_DOC_PAGE = 'supply-depot-apps'
+
+// Maps a Supply Depot service to its section anchor on that page. Only services listed here get a
+// "Docs" item in the Manage dropdown, so the link never points at a section that doesn't exist yet.
+// Each anchor MUST match the heading id set in the .md file (e.g. `## Vaultwarden {% #vaultwarden %}`).
+// Add an entry here the moment that app's section is written.
+export const SUPPLY_DEPOT_DOC_ANCHORS: Record<string, string> = {
+  [SERVICE_NAMES.STIRLING_PDF]: 'stirling-pdf',
+  [SERVICE_NAMES.FILEBROWSER]: 'file-browser',
+  [SERVICE_NAMES.CALIBREWEB]: 'calibre-web',
+  [SERVICE_NAMES.IT_TOOLS]: 'it-tools',
+  [SERVICE_NAMES.EXCALIDRAW]: 'excalidraw',
+  [SERVICE_NAMES.HOMEBOX]: 'homebox',
+  [SERVICE_NAMES.VAULTWARDEN]: 'vaultwarden',
+  [SERVICE_NAMES.JELLYFIN]: 'jellyfin',
+  [SERVICE_NAMES.MESHTASTIC_WEB]: 'meshtastic-web',
+}
+
+// Returns the in-app docs link for a service, or null if it has no documentation section.
+export function getSupplyDepotDocLink(serviceName: string): string | null {
+  const anchor = SUPPLY_DEPOT_DOC_ANCHORS[serviceName]
+  return anchor ? `/docs/${SUPPLY_DEPOT_DOC_PAGE}#${anchor}` : null
+}
diff --git a/admin/database/seeders/service_seeder.ts b/admin/database/seeders/service_seeder.ts
index c5c623c..e67ac90 100644
--- a/admin/database/seeders/service_seeder.ts
+++ b/admin/database/seeders/service_seeder.ts
@@ -206,7 +206,11 @@ export default class ServiceSeeder extends BaseSeeder {
           ],
         },
         ExposedPorts: { '8080/tcp': {} },
-        Env: ['DOCKER_ENABLE_SECURITY=false', 'LANGS=en_GB'],
+        // Stirling v2 ignores the old v1 `DOCKER_ENABLE_SECURITY` flag and ships with
+        // `security.enableLogin: true` in settings.yml, so it boots behind a login wall.
+        // For a single-user offline appliance we open it straight to the tools. Users who
+        // want a login can flip this to `true` via Manage > Edit (env overrides settings.yml).
+        Env: ['SECURITY_ENABLELOGIN=false', 'LANGS=en_GB'],
       }),
       ui_location: '8400',
       installed: false,
@@ -225,17 +229,44 @@ export default class ServiceSeeder extends BaseSeeder {
       icon: 'IconFolderOpen',
       container_image: 'filebrowser/filebrowser:v2',
       source_repo: 'https://github.com/filebrowser/filebrowser',
-      // Stores the database alongside the files it serves so a single volume covers everything.
-      // User: root — host directories auto-created by Docker are owned root:root 755; FileBrowser's
-      // image runs as UID 1000 by default which can't write to them (DooD: we can't chown on host).
-      container_command: '--root /srv --database /srv/.filebrowser.db',
+      // Browsable root is storage/filebrowser/files (persistent, so files created at the top level
+      // survive updates), with the user-facing content folders mounted in beneath it. We deliberately
+      // do NOT mount the sensitive/app-internal folders (vaultwarden, ollama, qdrant, logs, other
+      // apps' config + *.db). They simply aren't present in the container, so they can't be browsed,
+      // downloaded, or deleted — this is the guardrail. FileBrowser's own rules feature would need a
+      // wrapper script / imported config shipped into the container, which the catalog model doesn't
+      // support, so mount selection is how we scope visibility. To expose another content folder,
+      // add a `${STORAGE}/<folder>:/srv/<folder>` bind here.
+      // The DB lives in storage/filebrowser/db (mounted at /db, a SIBLING of the root, not under it)
+      // so FileBrowser's own .filebrowser.db never shows up in the user's file listing. User: root so
+      // it can read/write folders owned by other UIDs.
+      container_command: '--root /srv --database /db/.filebrowser.db',
       container_config: JSON.stringify({
         HostConfig: {
           RestartPolicy: { Name: 'unless-stopped' },
           PortBindings: { '80/tcp': [{ HostPort: '8410' }] },
-          Binds: [`${ServiceSeeder.NOMAD_STORAGE_ABS_PATH}/filebrowser:/srv`],
+          Binds: [
+            `${ServiceSeeder.NOMAD_STORAGE_ABS_PATH}/filebrowser/files:/srv`,
+            `${ServiceSeeder.NOMAD_STORAGE_ABS_PATH}/filebrowser/db:/db`,
+            `${ServiceSeeder.NOMAD_STORAGE_ABS_PATH}/books:/srv/books`,
+            `${ServiceSeeder.NOMAD_STORAGE_ABS_PATH}/maps:/srv/maps`,
+            `${ServiceSeeder.NOMAD_STORAGE_ABS_PATH}/media:/srv/media`,
+            `${ServiceSeeder.NOMAD_STORAGE_ABS_PATH}/kb_uploads:/srv/kb_uploads`,
+            `${ServiceSeeder.NOMAD_STORAGE_ABS_PATH}/zim:/srv/zim`,
+          ],
         },
         ExposedPorts: { '80/tcp': {} },
+        // Without an initial password FileBrowser generates a random one and prints it only to
+        // the container logs, which a non-technical user can't reach. Seed a known admin/nomad
+        // login on first run instead (only applies when the DB doesn't exist yet); the docs tell
+        // users to change it. FB_NOAUTH / --noauth don't work on this image (v2.63.x), so a login
+        // stays, which is the safer default anyway for a read/write/delete file manager.
+        // NOTE: FB_PASSWORD must be a bcrypt hash, not plaintext. The value below is the hash of
+        // "nomad" (generated via `filebrowser hash nomad`). Login is admin / nomad.
+        Env: [
+          'FB_USERNAME=admin',
+          'FB_PASSWORD=$2a$10$Dvu3XTiLxvPTzvdOKu6y6.AmadN6Zt0ddLwK.8MQ.RCIQWunWBQXa',
+        ],
         User: 'root'
       }),
       ui_location: '8410',
@@ -386,8 +417,11 @@ export default class ServiceSeeder extends BaseSeeder {
       display_order: 25,
       description: 'Home inventory and asset management — track everything you own',
       icon: 'IconBox',
-      container_image: 'ghcr.io/hay-kot/homebox:latest',
-      source_repo: 'https://github.com/hay-kot/homebox',
+      // Maintained fork. The original hay-kot/homebox was archived June 2024;
+      // sysadminsmedia is the official continuation (drop-in: same 7745 port + /data volume,
+      // migrates an existing DB forward, telemetry off by default).
+      container_image: 'ghcr.io/sysadminsmedia/homebox:latest',
+      source_repo: 'https://github.com/sysadminsmedia/homebox',
       container_command: null,
       container_config: JSON.stringify({
         HostConfig: {
@@ -422,9 +456,16 @@ export default class ServiceSeeder extends BaseSeeder {
           Binds: [`${ServiceSeeder.NOMAD_STORAGE_ABS_PATH}/vaultwarden:/data`],
         },
         ExposedPorts: { '80/tcp': {} },
-        Env: ['WEBSOCKET_ENABLED=true'],
+        // ROCKET_TLS points at the self-signed cert generated on install by
+        // DockerService._runPreinstallActions__Vaultwarden. Vaultwarden's web vault needs a secure
+        // context (HTTPS) or it refuses to register/unlock, so it ships HTTPS-on-by-default.
+        Env: [
+          'WEBSOCKET_ENABLED=true',
+          'ROCKET_TLS={certs="/data/cert.pem",key="/data/key.pem"}',
+        ],
       }),
-      ui_location: '8480',
+      // https: prefix tells getServiceLink to build an https:// Open link on this port.
+      ui_location: 'https:8480',
       installed: false,
       installation_status: 'idle',
       is_dependency_service: false,
@@ -482,9 +523,11 @@ export default class ServiceSeeder extends BaseSeeder {
       await Service.createMany([...newServices])
     }
 
-    // Keep container_config, container_command, and metadata in sync for curated services.
-    // Custom services are user-defined and must never be overwritten. User-modified curated
-    // services (a user edited their config) are likewise left alone so the edit survives reboots.
+    // Keep curated services in sync with the catalog. Custom services are user-defined and must
+    // never be overwritten. User-modified curated services (a user edited their config) are
+    // likewise left alone so the edit survives reboots. ui_location is synced too so a catalog
+    // change to an app's link/scheme/port (e.g. Vaultwarden moving to https:8480, or a corrected
+    // internal port) reaches existing non-modified installs on update, not just fresh ones.
     for (const service of ServiceSeeder.DEFAULT_SERVICES) {
       const existing = existingServiceMap.get(service.service_name)
       if (existing && !existing.is_custom && !existing.is_user_modified) {
@@ -493,6 +536,7 @@ export default class ServiceSeeder extends BaseSeeder {
           container_command: service.container_command ?? null,
           metadata: (service as any).metadata ?? null,
           category: service.category,
+          ui_location: service.ui_location,
         })
       }
     }
diff --git a/admin/docs/supply-depot-apps.md b/admin/docs/supply-depot-apps.md
new file mode 100644
index 0000000..7b782c5
--- /dev/null
+++ b/admin/docs/supply-depot-apps.md
@@ -0,0 +1,212 @@
+# Supply Depot Apps
+
+The Supply Depot is where you install extra apps onto your NOMAD beyond the built-in tools. Each app runs in its own container on your NOMAD, fully offline, and shows up with an **Open** button once it finishes installing.
+
+This page covers what you need to know to get up and running with each app *on NOMAD specifically*: whether you log in, what the default credentials are, where your files end up, and anything you need to have on hand first. It does not cover how to use the apps themselves. Each app is its own open-source project with its own documentation, and we link out to that for every one.
+
+A quick note on logins: some of these apps have their own accounts, separate from your NOMAD login. Where an app asks you to sign in, we tell you the starting credentials and whether you should change them.
+
+---
+
+## Stirling PDF {% #stirling-pdf %}
+
+A full toolbox for working with PDFs, all on your own hardware. Merge and split files, convert to and from PDF, compress, rotate, add or remove passwords, OCR scanned documents so they're searchable, sign, stamp, and redact. There are over 50 tools in here, and because it runs locally, none of your documents ever leave your NOMAD.
+
+**Official site:** [stirlingpdf.com](https://stirlingpdf.com) · **Source:** [github.com/Stirling-Tools/Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF)
+
+**First time you open it:** It opens straight to the tools, no login required. We set Stirling up to skip its login screen, since on a NOMAD it's a personal tool on your own network and a password wall just gets in the way. You'll see "Guest" in the bottom-left corner, which is normal.
+
+**Heads up, it's a slow starter:** Stirling PDF is a big Java application. After you install it, give it 30 to 60 seconds to finish starting up before it loads cleanly. It also wants a good chunk of memory (around a gigabyte), so it's happier on a NOMAD with room to spare.
+
+**Want a password on it?** If you'd rather Stirling require a login (say a few people share your NOMAD and you want this app locked down), you can turn its login back on from NOMAD:
+
+1. On the Supply Depot page, find Stirling PDF and click **Manage > Edit**.
+2. Under **Environment Variables**, change `SECURITY_ENABLELOGIN=false` to `SECURITY_ENABLELOGIN=true`.
+3. Save. NOMAD rebuilds the app, and the login screen comes back.
+
+The first time you sign in after that, use username `admin` and password `stirling`. Stirling will make you set your own password right away. Note that this is the only way to flip the login back on: Stirling's own settings menu is locked behind being logged in, so once login is off you turn it on from NOMAD's Edit screen, not from inside Stirling.
+
+**Your data:** Your settings live in the `storage/stirling-pdf` folder on your NOMAD. The PDFs you work on are uploaded for the operation and downloaded back to your own device. Stirling isn't a long-term library, so it's not holding onto your documents.
+
+**Where your PDFs come from (and why you don't see your NOMAD's files):** Stirling works on files from whatever device you're using, your laptop, phone, or tablet. You click "Open from computer," pick a PDF, work on it, then download the result back to that device. Stirling can't reach into files stored elsewhere on your NOMAD, so it won't show you your books folder, your Knowledge Base documents, or anything sitting in File Browser. If the PDF you want is already on your NOMAD, download it from wherever it lives first (File Browser, for example), then open that copy in Stirling. It's one extra step, but it's also why your files stay exactly where you put them instead of getting pulled into another app.
+
+**Works offline:** All of the PDF tools run locally on your NOMAD, so the toolbox itself works fully offline. A few side features reach out to the internet and won't do anything when you're disconnected: the "Google Drive" import option, and the links in the footer (Survey, Discord, GitHub). None of those matter for actually working on PDFs. The one core feature with an online piece is OCR, which reads text out of scanned pages: it ships with English already installed, and adding other languages is the only part that would need a connection.
+
+## File Browser {% #file-browser %}
+
+A web-based file manager for your NOMAD. Browse folders, upload and download files, create folders, rename, move, and delete, all from your browser with nothing to install on your computer. It's a handy way to move files on and off the device or tidy things up without dropping into a command line.
+
+**Official site:** [filebrowser.org](https://filebrowser.org) · **Source:** [github.com/filebrowser/filebrowser](https://github.com/filebrowser/filebrowser)
+
+**First time you open it:** You'll get a login screen. Sign in with username `admin` and password `nomad`. **Change that password right away.** It's the same default on every NOMAD, so until you change it, anyone on your network who knows it could get in. Click the settings gear, open your profile settings, and set a new password.
+
+Unlike most of the apps here, File Browser keeps its login on purpose. It can rename and delete real files on your NOMAD, so a password is the right call even on your own network.
+
+**What you can see:** File Browser shows you your NOMAD's content folders in one place:
+
+- **books** - e-books, including anything you want Calibre-Web to read
+- **maps** - downloaded map data
+- **media** - video, music, and photos, including anything you want Jellyfin to serve
+- **zim** - downloaded offline content like Wikipedia and other reference libraries
+- **kb_uploads** - documents you've added to the Knowledge Base
+
+You can upload, download, rename, move, and delete inside these, and anything you drop in the top level is saved too. The behind-the-scenes folders that the apps actually run on (things like the AI models, the search index, and the password vault) are deliberately kept out of File Browser, so you can't browse or delete them by accident.
+
+> **A word on deleting:** what you delete here is really gone, there's no recycle bin. The content is mostly replaceable (you can re-download a map or a Wikipedia library), but if you delete a book or a video you added yourself, that copy is gone. Delete with the same care you would on your own computer.
+
+**Works offline:** Fully offline. File Browser runs entirely on your NOMAD and doesn't reach out to the internet for anything, so it works exactly the same connected or not.
+
+## Calibre-Web {% #calibre-web %}
+
+A web-based reader and library manager for your e-book collection. Read books right in your browser, organize them by author, series, and tags, and send them to a Kindle or other e-reader. It pairs with the books folder on your NOMAD, so your whole library lives on the device and goes wherever it goes.
+
+**Official site:** [github.com/janeczku/calibre-web](https://github.com/janeczku/calibre-web)
+
+**First time you open it:** Calibre-Web needs a library to point at, and NOMAD sets up an empty one for you during install, so you won't get stuck on a setup error. Here's the one-time flow:
+
+1. Open Calibre-Web. It lands on a **Database Configuration** screen.
+2. In the **Location of Calibre Database** box, type `/books` and click **Save**. You'll see "Database Settings updated" and your (empty) library opens.
+3. That's it for setup. Your library is ready to fill.
+
+If it asks you to sign in at any point, the default login is `admin` / `admin123`. **Change that password** once you're in (click `admin` in the top right, then Edit). It's the same default on every NOMAD.
+
+**Adding books:** Uploading through the web page is turned off by default. To turn it on, go to **Admin** (top right) and edit the basic configuration to allow uploads, then you'll get an Upload button. You can also drop e-book files straight into the books folder using File Browser, then use Calibre-Web's "scan" to pick them up.
+
+**Your data:** Your library lives in the `books` folder on your NOMAD (the same `books` you see in File Browser). Every book you add is stored there, so backing up that one folder backs up your whole collection.
+
+**Works offline:** Reading and managing your library works fully offline. The one feature that reaches out to the internet is "fetch metadata," which pulls book covers and descriptions from online sources. That part won't do anything when you're offline, but it doesn't affect reading or organizing the books you already have.
+
+## IT Tools {% #it-tools %}
+
+A collection of over 100 small utilities you'd otherwise go hunting for online: hash generators, base64 and URL encoders, JSON and SQL formatters, UUID generators, a QR code maker, color converters, and a lot more. It all runs locally on your NOMAD, so you can use it with no internet connection.
+
+**Official site:** [it-tools.tech](https://it-tools.tech) · **Source:** [github.com/CorentinTh/it-tools](https://github.com/CorentinTh/it-tools)
+
+**First time you open it:** It opens straight to the tools. No login, no account, no setup. Pick a tool from the sidebar and use it.
+
+**Your data:** There's nothing to manage. IT Tools doesn't store anything on your NOMAD between sessions, so there are no files, no library to set up, and no credentials to keep track of. It's the simplest app in the Supply Depot.
+
+**Works offline:** Every tool runs right in your browser against the copy on your NOMAD. Nothing here reaches out to the internet, so all of it keeps working when you're offline.
+
+## Excalidraw {% #excalidraw %}
+
+A virtual whiteboard for quick, hand-drawn-style diagrams and sketches. Draw boxes, arrows, and freehand shapes, drop in text and images, and lay out a flowchart, a network diagram, or a rough idea in seconds. The whole thing has a friendly, sketched-on-a-napkin look, and it runs right in your browser.
+
+**Official site:** [excalidraw.com](https://excalidraw.com) · **Source:** [github.com/excalidraw/excalidraw](https://github.com/excalidraw/excalidraw)
+
+**First time you open it:** It opens straight to a blank canvas. No login, no account, no setup. Pick a shape from the toolbar and start drawing. You'll see a short welcome note reminding you that your work is saved in your browser, which leads to the one thing worth understanding about Excalidraw on NOMAD.
+
+**Where your drawings live (read this part):** This version of Excalidraw has no storage on your NOMAD. Your drawing is saved inside the web browser you're using, on that one device. A few things follow from that:
+
+- Your drawing is **not shared between devices**. What you draw on your laptop won't show up when you open Excalidraw on your phone, because each browser keeps its own copy.
+- If you **clear your browser data**, or use a private/incognito window, the drawing is gone. There's no copy on the NOMAD to fall back on.
+- So **save your work to a file.** Use the menu (top-left) to **Save to...** an `.excalidraw` file, and put it somewhere safe, for example your media or documents folder via File Browser. To pick it back up later, use **Open** and load that file. This is the only way to keep a drawing for the long term or move it to another device.
+
+**Your data:** Because everything stays in your browser, there are no NOMAD folders or credentials to manage for Excalidraw. The files you save are wherever you choose to put them.
+
+**Works offline:** The whiteboard itself works offline, you can draw, edit, and save files with no internet. Three things to know:
+
+- **The signature hand-drawn font comes from the internet.** When your NOMAD is offline, Excalidraw can't fetch it and falls back to a plain font, so your diagrams look a little less sketchy. Your drawings themselves are completely unaffected, only the on-screen font changes.
+- **Excalidraw sends anonymous usage analytics when your NOMAD is online.** The app's makers include basic page-view tracking (through a service called Simple Analytics) that records that the app was opened. It doesn't see your drawings, and it can't reach anything when your NOMAD is offline, but we want you to know it's there since NOMAD is otherwise built to keep to itself.
+- **A few buttons are cloud features that don't work on NOMAD.** "Live collaboration," "Sign up," and "Excalidraw+" all point to the makers' paid online service and need the internet. They're not part of your offline whiteboard, so you can ignore them. The same goes for the shape **Library** browser, which pulls from an online gallery.
+
+## Homebox {% #homebox %}
+
+A home inventory system for keeping track of everything you own. Catalog your belongings into locations and labels, attach photos, record serial numbers, purchase prices, warranty dates, and receipts, and find anything with a search. It's a genuinely useful tool for insurance records, warranty tracking, and knowing what you have and where it is.
+
+**Official site:** [homebox.software](https://homebox.software) · **Source:** [github.com/sysadminsmedia/homebox](https://github.com/sysadminsmedia/homebox)
+
+**First time you open it:** Homebox lands on a login screen, but you don't have an account yet, so you create one. Click **Register**, then fill in:
+
+- **your email** (used as your username to log in),
+- **your name**,
+- **a password** (Homebox shows a strength meter and won't let you register until the password is strong enough, so use a real one).
+
+Click **Register**, then log in with that email and password. The first account you create is the **owner** of this Homebox. There are no default credentials to change, the account is yours from the start.
+
+**Sharing your NOMAD with others?** By default Homebox lets anyone who can reach it create their own account. That's fine if it's just you, or if you trust everyone on your network. If you'd rather lock it down so no one else can register after you've made your account:
+
+1. Create your owner account first (above).
+2. On the Supply Depot page, find Homebox and click **Manage > Edit**.
+3. Under **Environment Variables**, add `HBOX_OPTIONS_ALLOW_REGISTRATION=false`.
+4. Save. NOMAD rebuilds the app, and the Register button stops creating new accounts. You can still log in normally.
+
+**Your data:** Everything Homebox stores lives in one folder on your NOMAD, `storage/homebox`, as a single database file (plus any photos and receipts you attach). Backing up that one folder backs up your entire inventory.
+
+**Works offline:** Fully offline. Homebox runs entirely on your NOMAD, keeps all your data locally, and has no usage tracking, so it works exactly the same whether your NOMAD is connected or not. The links in its header (GitHub, Discord, the project website) need the internet, but they're just shortcuts to the project's pages and have nothing to do with your inventory.
+
+## Vaultwarden {% #vaultwarden %}
+
+A private password manager that runs on your own NOMAD. It's compatible with Bitwarden, so you can store logins, secure notes, and card details in an encrypted vault, and use the official Bitwarden browser extensions and phone apps to access it, all pointed at your NOMAD instead of someone else's cloud.
+
+**Official site:** [bitwarden.com](https://bitwarden.com) (for the apps and extensions) · **Source:** [github.com/dani-garcia/vaultwarden](https://github.com/dani-garcia/vaultwarden)
+
+**First time you open it, you'll see a security warning. That's expected, here's why:** A password manager will only run over a secure (HTTPS) connection, so NOMAD sets Vaultwarden up with HTTPS automatically. Because your NOMAD is your own private device and not a public website, it uses a self-signed security certificate, and browsers show a warning the first time they see one. It looks alarming but it's normal for a device on your own network. To get past it once:
+
+1. Click **Open** on the Vaultwarden card. Your browser shows something like *"Your connection is not private"* or *"Not secure."*
+2. Click **Advanced**, then **Proceed to (your NOMAD's address)**. (On some browsers the button says "Continue" or "Accept the Risk.")
+3. You'll land on the Vaultwarden vault. Your browser remembers your choice, so you won't see the warning again on that device.
+
+**Creating your vault:** On the login page, click **Create account**, then set your **email** and a **master password**.
+
+> **Your master password cannot be recovered.** Vaultwarden has no "forgot password" email and no reset, by design, because it never sees your password. If you forget it, the vault and everything in it is locked for good. Choose something strong that you won't lose, and consider writing it down somewhere physically safe.
+
+**Sharing your NOMAD with others?** By default anyone who can reach Vaultwarden can create their own account (each account is separate and encrypted). If you'd rather no one else can register after you've set yours up:
+
+1. Create your own account first.
+2. On the Supply Depot page, find Vaultwarden and click **Manage > Edit**.
+3. Under **Environment Variables**, add `SIGNUPS_ALLOWED=false`.
+4. Save. NOMAD rebuilds the app and new sign-ups are turned off; existing accounts keep working.
+
+**Using it from your phone and browser:** Install the official Bitwarden app or browser extension, and on its login screen choose **self-hosted** (or "Server URL") and enter `https://(your NOMAD's address):8480`. Note that some phone apps are stricter about self-signed certificates and may refuse to connect; the web vault you open from NOMAD always works.
+
+**Your data:** Your encrypted vault lives in the `storage/vaultwarden` folder on your NOMAD. Backing up that folder backs up everything. (The built-in admin panel is turned off unless you set an admin token, which most people don't need.)
+
+**Works offline:** Fully offline and private. Vaultwarden runs entirely on your NOMAD, stores your vault locally, and phones home to nobody. The Bitwarden apps and extensions also keep a local copy of your vault, so they can read your passwords even when your NOMAD or your phone is offline.
+
+## Jellyfin {% #jellyfin %}
+
+Your own media server. Point Jellyfin at a folder of movies, TV shows, music, and photos on your NOMAD, and it organizes everything with artwork and details and streams it to a web browser, phone, tablet, smart TV, or the Jellyfin apps. It's a private, offline alternative to the big streaming services for media you already own.
+
+**Official site:** [jellyfin.org](https://jellyfin.org) · **Source:** [github.com/jellyfin/jellyfin](https://github.com/jellyfin/jellyfin)
+
+**First time you open it, you'll go through a setup wizard.** It's a few quick screens:
+
+1. **Language** - pick your display language and click Next.
+2. **Create your admin account** - enter a username and password. This is the main account that controls the server, so give it a real password and keep track of it. (You can add more users, including limited ones for kids, later from the Dashboard.)
+3. **Add your media** - click **Add Media Library** and pick a content type. To make this easy, NOMAD has already created a matching folder for each type inside your media folder, so you just point each library at the one that fits:
+   - **Movies** library → the `Movies` folder
+   - **Shows** library → the `TV Shows` folder
+   - **Music** library → the `Music` folder
+   - **Photos** library → the `Photos` folder
+
+   **Point each library at its own folder, not at the whole `media` folder.** This matters: if you point one library at `media` itself (which contains all the others) and another library at, say, `Music` inside it, Jellyfin sees the same files claimed twice, calls it a "duplicate path," and your music silently won't show up. One folder per library keeps everything tidy and working. You can also skip this step and add libraries later from the Dashboard.
+4. **Metadata, remote access, finish** - accept the defaults on the remaining screens and finish. Then sign in with the account you just made.
+
+**Getting your media in:** Put your files in the matching subfolder of the **media** folder on your NOMAD (the same `media` folder you see in File Browser): movies in **Movies**, series in **TV Shows**, music in **Music** (a folder per album works great), pictures in **Photos**. The easiest workflow is to upload files with File Browser (or drop them in however you like), then in Jellyfin click **Scan Library** to pick them up. Jellyfin reads sub-folders, so a whole album folder dropped into **Music** comes in as one album. It also works best when files are named clearly (for example `Movie Name (2020).mp4`), which helps it match the right artwork and details.
+
+**Your data:** Your media lives in `storage/media`. Jellyfin's own settings, user accounts, and the artwork it downloads live in `storage/jellyfin`. Your media files are never modified, Jellyfin only reads them.
+
+**Works offline:** Streaming your own media works fully offline, that's the whole point. The one piece that uses the internet is **fetching metadata**: when Jellyfin adds a movie or show, it tries to download a cover image, description, and cast info from online databases. Offline, it can't do that, so items show up with plain names and no artwork, but they still play perfectly. Once you're back online, a library scan fills in the missing artwork.
+
+> **A note on playback performance:** Jellyfin plays most files effortlessly, but if a video's format isn't supported by your device, Jellyfin has to convert it on the fly ("transcoding"), which is heavy work for the processor. NOMAD doesn't set up graphics-card acceleration for this by default, so very large or high-resolution videos may stutter on a modest NOMAD. Playing files in a widely-supported format (like MP4/H.264) avoids transcoding and plays smoothest.
+
+## Meshtastic Web {% #meshtastic-web %}
+
+A browser-based control panel for [Meshtastic](https://meshtastic.org) devices. Meshtastic is off-grid, long-range radio messaging: small, inexpensive LoRa radios that form their own mesh network and send text messages and GPS locations for miles with no cell service, no internet, and no fees. This app is how you configure those radios and read and send messages from a full-size screen.
+
+**Official site:** [meshtastic.org](https://meshtastic.org) · **Source:** [github.com/meshtastic/web](https://github.com/meshtastic/web)
+
+**You need a Meshtastic radio to use this.** This app is just the control panel. On its own it opens to a "No devices connected" screen, because the actual work happens on a physical Meshtastic device (and the network of other radios it talks to). If you don't have one yet, the app won't do much.
+
+**First time you open it:** It opens straight in, no login. Click **New Connection** and you'll see three ways to connect to your radio:
+
+- **HTTP** - connect to a radio that's already joined to your Wi-Fi, by typing its IP address. **This is the method to use on NOMAD** (see below).
+- **Bluetooth** - pair with a nearby radio over Bluetooth.
+- **Serial** - connect to a radio plugged into a USB port.
+
+**The NOMAD-specific catch (Bluetooth and Serial need HTTPS):** Browsers only allow a website to use Bluetooth or USB when the page is loaded over a secure (HTTPS) connection. NOMAD serves Meshtastic Web over plain HTTP, so on NOMAD the **Bluetooth and Serial options won't connect**, your browser blocks them. The one that works is **HTTP**: put your Meshtastic radio on the same Wi-Fi network (Meshtastic radios can join Wi-Fi), then connect to it here by its IP address. If you specifically need to pair over USB or Bluetooth, do that from the official Meshtastic phone app or the Meshtastic website instead.
+
+**Your data:** There's nothing to set up or store on your NOMAD for this app. Your radio's settings live on the radio itself, and this app's preferences live in your browser. There's no NOMAD folder to manage.
+
+**Works offline:** Fully offline, which is the entire point of Meshtastic. The app is served from your NOMAD, and talking to your radios happens over your local network or radio, never the internet. The only online bits are the links in the footer (Vercel, legal), which don't matter for using your mesh.
diff --git a/admin/inertia/pages/docs/show.tsx b/admin/inertia/pages/docs/show.tsx
index 27695cd..95fc696 100644
--- a/admin/inertia/pages/docs/show.tsx
+++ b/admin/inertia/pages/docs/show.tsx
@@ -1,8 +1,22 @@
 import { Head } from '@inertiajs/react'
+import { useEffect } from 'react'
 import MarkdocRenderer from '~/components/MarkdocRenderer'
 import DocsLayout from '~/layouts/DocsLayout'
 
 export default function Show({ content }: { content: any; }) {
+  // Deep-link support: when arriving at /docs/<slug>#<anchor> (e.g. from a Supply Depot app's
+  // "Docs" menu item), scroll to that section. The content renders synchronously from props, so a
+  // double rAF lets the headings paint before we look one up.
+  useEffect(() => {
+    const hash = decodeURIComponent(window.location.hash.replace(/^#/, ''))
+    if (!hash) return
+    requestAnimationFrame(() =>
+      requestAnimationFrame(() => {
+        document.getElementById(hash)?.scrollIntoView({ behavior: 'smooth', block: 'start' })
+      })
+    )
+  }, [content])
+
   return (
     <DocsLayout>
       <Head title={'Documentation'} />
diff --git a/admin/inertia/pages/supply-depot.tsx b/admin/inertia/pages/supply-depot.tsx
index efdec52..a33aba1 100644
--- a/admin/inertia/pages/supply-depot.tsx
+++ b/admin/inertia/pages/supply-depot.tsx
@@ -2,6 +2,7 @@ import { Head } from '@inertiajs/react'
 import { useEffect, useRef, useState } from 'react'
 import {
   IconAlertTriangle,
+  IconBook,
   IconBox,
   IconBrandDocker,
   IconChartBar,
@@ -30,6 +31,7 @@ import useErrorNotification from '~/hooks/useErrorNotification'
 import useServiceInstallationActivity from '~/hooks/useServiceInstallationActivity'
 import { ServiceSlim } from '../../types/services'
 import { getServiceLink } from '~/lib/navigation'
+import { getSupplyDepotDocLink } from '../../constants/supply_depot_docs'
 import api from '~/lib/api'
 import { toTitleCase } from '../../app/utils/misc'
 
@@ -626,6 +628,9 @@ function AppCard({
   const uiIsPath = !!service.ui_location && service.ui_location.startsWith('/')
   const uiIsHttps = /^https:/.test(service.ui_location || '')
   const uiPort = service.ui_location && !uiIsPath ? service.ui_location.replace(/^https?:/, '') : null
+  // Per-app documentation link (in-app docs page, anchored to this app's section). Null for apps
+  // without a doc section (custom apps, undocumented catalog apps) so the Docs item is hidden.
+  const docLink = getSupplyDepotDocLink(service.service_name)
 
   function toggleDropdown(e: React.MouseEvent) {
     e.stopPropagation()
@@ -759,6 +764,18 @@ function AppCard({
 
               {isDropdownOpen && (
                 <div className="absolute right-0 bottom-full mb-1 w-44 bg-surface-primary border border-surface-secondary rounded-lg shadow-xl z-20 overflow-hidden">
+                  {docLink && (
+                    <a
+                      href={docLink}
+                      target="_blank"
+                      rel="noopener noreferrer"
+                      onClick={(e) => e.stopPropagation()}
+                      className="flex items-center gap-2 w-full px-3 py-2 text-xs transition-colors text-left cursor-pointer text-text-primary hover:bg-surface-secondary"
+                    >
+                      <IconBook className="h-4 w-4" />
+                      Docs
+                    </a>
+                  )}
                   {isStopped && (
                     <DropdownItem icon={<IconPlayerPlay className="h-4 w-4" />} label="Start" onClick={onStart} />
                   )}
diff --git a/install/calibre-empty-library/README.md b/install/calibre-empty-library/README.md
new file mode 100644
index 0000000..c00b04a
--- /dev/null
+++ b/install/calibre-empty-library/README.md
@@ -0,0 +1,19 @@
+# Empty Calibre library (Calibre-Web seed)
+
+`metadata.db` is an empty Calibre library database, generated once with
+`calibredb --with-library <dir> list` (calibre 9.9).
+
+Calibre-Web cannot create a library from scratch. On a fresh NOMAD it would dead-end
+at the "Database Configuration" page asking for an existing Calibre database. To avoid
+that, the Calibre-Web pre-install action seeds this file into `storage/books` (only when
+no `metadata.db` is already there) and hands ownership to the container's user, so the
+user just points Calibre-Web at `/books` once and starts adding books.
+
+This file is bundled into the admin image via the Dockerfile and copied at install time
+by `DockerService._runPreinstallActions__CalibreWeb()`. To regenerate it:
+
+```sh
+docker run --rm -v "$PWD/lib:/books" --entrypoint bash lscr.io/linuxserver/calibre:latest \
+  -c "calibredb --with-library /books list"
+# then copy lib/metadata.db here
+```
diff --git a/install/calibre-empty-library/metadata.db b/install/calibre-empty-library/metadata.db
new file mode 100644
index 0000000000000000000000000000000000000000..65f4d2a6b6435b8969710ea46e76a8c8036bce87
GIT binary patch
literal 409600
zcmeI*eQX@(ogeUBlG<64qG-ovCN|^K<0wAvMx;bqre#@DoYitjt+m>fmP^Zu<ID|r
zht!1oLhsDVl3&h8ib~uBEzkg06g?DZul?&#;98()`bUdHQ5?_~$o+Fbdi|qlduY)%
zZ4sm>?owQF==01oGyBZ!><eFHn~N`DliX*Xd0sxh=XvH$8m->W8kSBr>W!*qkqeQh
zBGG8%TZBX+5sCg^rvJNNCjDi^{Xl<4>HpL0b4jZh>}SZA6gl_X|LO$YFgE#9wz)j{
z7n6TB`OC@wIr(2F|8(--PyWf|A5Z>t=nqFuM=uQRPW~#SgfCvwZgx_V&!3O(tytQ6
zMPIMiw@lU48-{MG6{EJ*mhe=%prnclDW<Mv71FkuB#2QanOsp>Q3~W%A#*cTxJzy*
zcW1{)-(Rd$uZ&#2NOEi0?0yR19XM1GYq`wrH6_8ClI*+b$<$LZdF^~OV${m|1M|HK
z9geEjwCeU}wM|Q1XiIu}_s)bQFDyj&?g|lUXqHji6hk7WoC=AFxc!R}6yBnv3d$_u
z<?SOl=~FTJ&O-O#h-_|j#I(uXcg7|8;>GCRnh>7t=6c02@97OOLV?7SAwddc`C`P$
zYt&JNY9ArWoQ%ouUhEzsuYDZbjZz?aV)xBazOtpoKvkNXMoleiG|gV>wp$5fVF7Aw
zP8@1oW3?UBv!+#bQdHii>)`&@!uwj~K>G=6-z=*<nM{rKUe^RlFD5O%@kd{kBzbW$
z`uH6o9u=*&+0-_D2OED{JR~aq97i&1h<zwKXoQ?28*7(Zs+aXcmP3ykRkhwI>y5U8
z$da<0TFVy6{C<vygoq&}UOQVeGr1Cv$?q(7pLu?FH^~0f(cL>I+K*rK7<jMlTOGxe
zSV)Y;?MD*f!^}WCzPv?k5!p{1d{N-#wL;MA^eCB*^*(-yY;J(WH0jnzOg?)y%1<tw
zGZa&Quc_Bcdf?*;UswVg6Kr9arF$m7KQt`KvK;+UsWq|f#dXBDzn#P*Y4<eb9Fe5f
ziup{A?sikj6??#1hE>t+l6*^}H$i6BYFoAX`?VR8&S$gilr@)6r&g67#hUeo#Uo)C
zyRUsMqpF*hR^2AW%uQvrn7Vn(YfgHtP@tVsy)8Z3K@Vs2D8)MH?Q!6;ob!46B$Uw8
z_pEmy@rqnH*K0xHqe!)V_D{2|S@-<MBCqP1nI06)CO!1BDtqL+r<rv1y-!!oYx#WE
zE5BFADw=7j)q2_3Fmzgv7diJ}>lHNf^8Eb#-24LlkIc`%ZvS`I{yvl3y%Ck<>FMZR
z)t&^-lyiOz`6hys=uU-@dC;Sur2T|oe`A~+Fo=X*5gs&(?jguNq3C`^m7E)j$@E&e
zw8Jjj*FT}(v<LKCzDmC-YxLXFoAlco3jOx$uhDPM68i0#$qD+MUi9M&0uX=z1Rwwb
z2tWV=5P$##AOL{@78qlF!}b3FM;Kj$00bZa0SG_<0uX=z1Rwwb2t*=y{*O@r0SG_<
z0uX=z1Rwwb2tWV=5Ey&`T>lS#jL|~~KmY;|fB*y_009U<00Izz0IvTr1|R?d2tWV=
z5P$##AOHafKmY=RFMz-QKlm|54<P^n2tWV=5P$##AOHafKmY=G{*N&L0SG_<0uX=z
z1Rwwb2tWV=5Ey&`JpUj37^8;}fB*y_009U<00Izz00bZa0X+Z57=Qo-AOHafKmY;|
zfB*y_009ULz5t&84}Of%LkK_s0uX=z1Rwwb2tWV=5P$%l|6>e500Izz00bZa0SG_<
z0uX=z1O{IK&;JKM#^@mgAOHafKmY;|fB*y_009U<0MGw11|R?d2tWV=5P$##AOHaf
zKmY=RFM#L&gCAq`5CRZ@00bZa0SG_<0uX=z1R#Lt{}=-hfB*y_009U<00Izz00bZa
zfx#ER^Z&t*F?t9A2tWV=5P$##AOHafKmY;|!1I5M0SG_<0uX=z1Rwwb2tWV=5P-no
z3rtM@Dl!?pA362m<i8%jKmPU6$7BCN`rD&dVz*)wBfmdV9v&O|!|46!1)2?CTp;yS
zOkO)5jTp7E{=j^%VpzJWHLbe+SzWK!w@lU48-{MG6{EJLF0>^*y_=ns<n!mFdn=Z<
zUeVh!v?V;1E-0y@LW-$tS%tK1CJADcNhViRR+Iv{Rmj{-74DK7%H7#9()SlD)hi>H
zFOu9^HoKn!c&86l#9A(Mdre8OrX>4rdNO?~Cf`};9+8G-8MRG+NW`?s-8&PKys!}6
zyDP**%)!;glv5#55x0La!opj0RAHGVyu5vcCv!3;zk9KJc($AC6~nxzH~bL_Bv0(V
zGcL&&FGly)gdhbn@i+w%PlkjlkmZXJEw52W6|j8-DmB)7W!tVaH;tNF)-26k*@UF=
z-8V=1%9a)b)Y``hPAg$7EHJIji9@YxthR$X*0icliptw`9o*kqcweg=Xg^`?n`M<J
zlaIbCN%G=i^zl0aW<{%QHnmOX=)yhyY4H$Je~u#=>cl<{9hBEOEU|W}rFvOEWI6O8
zTvh9hvfgMbh%70~skLm8%<t!5Mu->>;<d9iosui@nEcLS_jS$h?#>v0>gevB6YYl{
zdP;Gx?ktBq%3?|^B*x<QBZ=@~rjH$8-lDdM>?aPsDDd)HA?S5(lT62YpBad3Zh*uz
z>DEY0K6^IG&kLLrK2v|Msn<$+;NuBjSOOapY*x?GJ(J%b8kS^Pj{d0Bn%H)XM|}I+
zNj#EvPeV@dNNTN^&*bQCH<etm2drgS72Ph$x2|~;WM-|lRja>Wn<43ZHp|X8bNO^?
zRq0WzS#MZ85_Yls+Sf9wx@l?EZBoqKR91_ro435?q}K`s+9}oB(xV;p&`A$Vtb^Vj
z2QJGwfw#};2|f4DdPf1T$c1yg78E{;RNH6&G~1eW&wn8Cs-BtYLD6i|<0h-JN4|TS
zNmt+dbk)3;&u6{zdv&a$nU-3umyHcWr}cP|bB~l>K{GGU&(F`zFVO$U{QT?oe`oFQ
zGs)c>QAwVjj_y_MN#IO5=f{w5A~=ceR0x>|J^D%7kLLRu<K%!rB<vFKpiy)WLH5}|
z_sgN=+)zwTO?NsNIe_Yd^UE;3l#R2?S@!(@>1aAK^z&26iS?8JWBl)oYh$ZpUyFYl
zPoMZ-C;s8ct&y4GxuHLZrlTjvo*MrHwvYX_`^?uQ`Sj`Nqoy4_?}+C8@^xPXy=1mf
z*jKB3#qf>|`@U#pCGs-||6&$gen$D1Q(d=sEWQ|%GiN#x8fCp^u>nty$qT}VGrJFo
zB%e7GeSFE55H<<Fe$A&LY!EaKFsym6?Bg`?DBW4uYfkW;t%uw8k}00)w&t&4uJ8A7
z;7GI6VEWZPI8NTKKYV8ZthKG<e=>PGCSR31g=|CD%QRT_j~9>Nw$0A_zh)n{AKkPg
zZI^3*BfjYJBxjHxAgKH>?StzTO0(23wk<z)uYDX>yS5f-Xeg31FT~`_Q=Odo#UT5B
zdiUM0O7hfH^zjQe5ldtL|C$eorL-1-eG46ExNp=ORV^U2uR}nyR;pLG8@g%gWz{r3
z*zXlf`w^&nfPBNAw>~+RygVI~^T|$uC^b#1UZtyIrCF`fk?;Tf!rtohlAKINKc)Wk
zwxfTm|I=4}0rPJoiO^#aJ>%eCApz~@G_|6w>+MTMIFgOYYU^W`u+e5Oa((2jYK<+G
zVyk7nqT8pE{_`U5EHJ!TdfBjL{by4PJ@zUa=5|GU=yb-tTAlgu<Cz{i8m3xpRxD$i
zp4IQGoi#QYDs&8&`F`Dx7|uwv<I}!SB-77zyT&TjYxMNeH0m|AzHQMTY*@CXO+S*q
zVqXG3=2uzmIoea6_YcvwGWiM<G8n^S=M3J!k3%mT{_^al%W2YnnqjY)*RuI*Jw}AT
zHusYgK;D;G)`s>lx_N^?ljr4_oPMF>ic_yv>3NYIRQ}s@yW?M$<QHCuKH_tMu9|iZ
z_vcpvVdGm594t|^ZyZa1aF|1Z@7_>%%H-9ln0)(eCqCACQ?<0fg9$G|-o5^;#BM(L
zo)meT1G|6OM;q99U}14Y97tO%fHwVr=c&9D-%*hk)?Ht$IoW)MK026-?mS~()N`F}
z??$S+ZImAb6Q>-|Om0be+j;C3*oEYCZ5v3UW}kVQC9Rg+S^APReM64#E?5m?b5m~w
zD^W`go!+)k#m#OY3z-%6M6bs#B(+?mxiYy`rBL)5M3(afqNLK-Ng;n{?3%KY$=Szk
zCmUUb@@)n4CvW7fRCY~SP2`k2=Ztdl@|coadQ^N`lIP~4-xu#iw=9A!{F2)P;ell<
zw{r%;cJf9;+XbMV-P`OQ7Uu(#T&rx>8-{hS+B2uPl)I(Pv<|VMCxd(+|LLB)Z?Gi?
zxRuo!CSL2^L$P-WHc!&mmGli^NYT6`F+WQdl1Y9Hp@CL1D>?SSmpBnDD9Z}Hd6rgI
zd5r0Elq4G&OG;Lu_x0#qy>x0x8B5~t|GPId@Dl<MfB*y_009U<00Izz00bZ~xB~e5
z|AQM_^b7(JfB*y_009U<00Izz00bc53gG#_D}kR7fB*y_009U<00Izz00bZafx#8P
z^Z&t(EqVq42tWV=5P$##AOHafKmY;|a0T%E-<7~m2tWV=5P$##AOHafKmY;|fWY7i
z;Q9aH#uhz;00bZa0SG_<0uX=z1Rwwb2)F`x{_jfQCj=k>0SG_<0uX=z1Rwwb2tZ(P
z1@QcTaAS*}K>z{}fB*y_009U<00Izz00dkCJpXqk@Dl<MfB*y_009U<00Izz00bZ~
zxB__oKe(|)&maH+2tWV=5P$##AOHafKmY=+0G|K568H%L2tWV=5P$##AOHafKmY;|
z7+e87{~z4gqGu3*00bZa0SG_<0uX=z1RwwbR{+odT?zbz00bZa0SG_<0uX=z1Rwwb
z2n?<Op8pSSY|%3aKmY;|fB*y_009U<00IzzfGdFK|E>gnLI45~fB*y_009U<00Izz
z00ahC0MGviH@4^*1Rwwb2tWV=5P$##AOHafK)@Bi^M6+YKOq1C2tWV=5P$##AOHaf
zKmY=RE5M%re<kuqk?2oP{ruEVCVn~b&rbg8<WI(bKK}Q{elqr3qYLr>C;b=cpTs_i
z6;7xpULF4L!@oN;68#&IKN|bXu|E@4Vz0;Sj~`u<<i*A4&a|biS9Gmbt6Q37)N7`?
zVVP=Kv$U|Z%Lm*oT~Ja*g%nfQvI?2eYCFnnl6>}Td^a6deV}G%=eIJ2;#w-}6cWfo
z)>bpQ6++v-m@sv%QM$*vrCRy}YnGJiHA}Bq<SMJ$>*$QPL2cCEH_B|YQKqR@eM_$y
zALuNhSu;xYvi|A<Y3SAZeO)aZTB%`JM#&^E&m<Qw#^lVIXvC<M^#|sA6~oe1t!dTm
z&#F+Fx*&XbeeuO^yBTHLSYyM`8>YG-d^q!H`c+9jb0+%u<Di;Q_$8mUuz@59?PMlb
zR92J%xmC#AOcm~u8_M0;vC;K<eaqXF%NI#*Et{q38}&w2vq({Sn<hEQB%RM@Su}I`
zbZS+hxtgZlP_2jCx<8|{r7h7is=8@u)onsYMb;~qX180b(pLH^^frW6!S`VUHn<m|
zUxBgU&q9`z<<wfXNM>ec$5`&QT;}$gl3*IM#OoFRb(V09S;A{%jd6cB%E_^$vKW)^
zUg$IyDw=7j4P7g%+jWzUA2!n#LK0uwee)GbzHlMBci9edNS2VKi@u<TWO%Z{_p{P?
zmG%2ZseL$<HjK8c`gXl^uWckyBz2>qmHZpLfX&l7oM5pq%@SVWEa9Q!k)kn~xe${t
zPj!lkrESt6u<x(#Y`-kYQ&Z7Ld_iJq?EgidD@);!#G5R>dBnz0r>~k;4S=*yq*42;
zV$`<$OkTg;f!e7OZbA~QvZOtvJLM$FvkNi#jpsVqP*p>xI{fD=yRXbk@^jBc_qY#F
z<=-#(jCk6Cl?ds>sbin)4Q9RJtXORe7563N5W?;v(Vy|$`IwxV?quAcN8B14g3d25
z?>>7@lBcJmk3O;IzLV_ySnxSJiHCqDya;b3r>`sN8wn@zn`CZ*q;gAcrYmG&AxS5l
zD|k3UXQ3rdZM{b7g}Io#@?s~&?dE#LFz?w%%hvDnyV+Sue(}ZVUdgs>ZE5{>-Y42h
zKMX1zf`=Z#Y#8?(#iNHD#;g)&3GHXKSUlV9lx4f2Z|DuZR$@zr@ZsE!@eTWw<<WCI
z3axxXt~q}kT6q$kPFPsuyMAry5B*ChKfrh0=e}0i_dbpwtuC2VlHE=KgflUE64|f}
zz3e+FbQ5QH-b~mh0K5DIAY{Lgq_aN4kPHW->~LP#mC+$#yC#!w%*5o?xlU8Js#_X6
zb94KyE(BA)v6K3BNuHaF?k?H`D7ZcNIq7o<ZvC7PF1*xj{i+!24XyEzp7zocLhtv)
zPWtQi`n7x8?s#iU>$e$SXItrqT)&#l_A~IV5w|xwVP`wH*7M}TnV77c?iBxuR@-c9
zn{3hWetl{8nXgIm>C@3iP2O=gkC)@?{%*V5Su5;I9H*_JS31tNu0L2sD!c0QuLhk?
z*W9uWbyC3#aSXi%2$1ahKRWquBlJIfK>z{}fB*y_009U<00Izz00ba#yaZ;V!;!V}
z`YZDb7Z(=h<}Ycl%)RpRtFO&nS}0wbd+ow}`L$OUHZIM-_8R;1|Ix`miO~P>1px>^
z00Izz00bZa0SG_<0uX?}F%y^>UK{P_`XBHAJ7$4Jb0Gi$2tWV=5P$##AOHafKmY;<
z5WxHY4uFPTAOHafKmY;|fB*y_009U<00PHM0MGxAS-{X-2tWV=5P$##AOHafKmY;|
zfWQF+@cjP(XxIe;5P$##AOHafKmY;|fB*y_aLfeQ^Z${_--%5A=gFT={)GO5F9<*Y
z0uX=z1Rwwb2tWV=5P$##K1+e;M@AxxPj5Er&29Q`dh&m9oc_!6jjH+K$IlLrM3PUN
z+I??}PE)6bMj~gQw*P_gl4j|fb@p#9fB5n9(UHi)6#a)YE2gS7=)YdyFzCNRZRu8{
zsk7(*Ba^=unf&?W?@j*8$)A0e9YkFafB*y_009U<00Izz00bZa0SE*IzB0TR4Z9gI
z@}=Qq)PE;n_?h9e(ZFqhp{e18(e`@)`1}7sXMBbL1Rwwb2tWV=5P$##AOHaf44we~
z{{P^`6g`3f1Rwwb2tWV=5P$##AOHaf1O@Q?KPZCF5P$##AOHafKmY;|fB*y_0D-|1
z!1MpXiz#{p0SG_<0uX=z1Rwwb2tWV=5C{t3`F~IZpCJGN2tWV=5P$##AOHafKmY=R
zCxGYwgBMfu2m%m*00bZa0SG_<0uX=z1RxL;!1Mp02tGpq0uX=z1Rwwb2tWV=5P$##
z22TLb{|7Io=n(`U009U<00Izz00bZa0SG`KD1hhxK@oh000bZa0SG_<0uX=z1Rwwb
z2n?P8p8pSCOwl6<KmY;|fB*y_009U<00IzzKu`eB|AQj<3;_s000Izz00bZa0SG_<
z0uUHH0X+X7yqKa#5P$##AOHafKmY;|fB*y_0D+(Yd;UK(`HRTpU(j#(f&c^{009U<
z00Izz00bZa0SG`~5Cq1?h9l2A9T|=eM^57T{~&}FeSiQ2AOHafKmY;|fB*y_009Ve
z7r@{D@9u-G5P$##AOHafKmY;|fB*y_0D(aeV9)=flm90||HBsqAOHafKmY;|fB*y_
z009U<00ILfFg`pTy{|V+qh1?f&;KVPe;S$GJ@t!I-<$aP#PG?=_`ewc`q+;~uSx&>
zghe++CVu}ocmA(TD$>-{RQ$&$?i>31Ro&9q|LKB~Dk|iyjB<yt&m^@vMx3uzC99;1
z#3;`a%djf?thdF<kZ^LC^@dfd*Gig|Sl24&*bX&XdXg*`@;AwPy}o6tTGP5$Z<uPu
zsBO_o2+c^|%x7}M*+BBS1pk#>b<=1`Npk19Qc&zd=mxtiJK5Q-W1Cn5c>UYW^@?HM
zqk(qHY9-K;2yKGf4{rn6Xw<7t!@WeO?XC7)^;(l8UapP}YG{^G+vH8+zq{>mJ_Q=%
z<QH1v<l}_l&EQ$u+F%(~-J}8EZrkE^{buUzM6*_^SGOCwY3gOwG(K<xSk~yc2&<2<
zOdX4KMuadDEN#>6Gy65rVVWemvmD*J%C>i`+tMFcoSJs2s@E*HUKX-e+=#oiV?nK9
zWa<q=cZ=a40v&L22!o!dbn6Ar(N?{)qfsmC585}<>DHFW=Yz_oV%s)1$WBBy>W!*q
zIkQs;F8lRd0Ep*phu+q#du{d5NkGeJ9}&%_QTEo37SG=Dk~Ez<6aVyr)i5?U^@dif
z)h#+r>NQi{uuQeN&5Bd4#-^~vS+R<R%*u*VAi|cwJ|wkVq#4$3EwL3YPgj~&@nhGN
zl}yfVQzo~n6pC~iDCWf+tgwWz2m3rr8uj<t>SpR%qjXPOuh7QPk(MNHrLt?vYGS6W
zS9D9CnI-w`5*;1<XE68Wp7nOGh9q*z9lLb)bKj+_rlr$4Q4aRbP5-QV>DHGxTyK@!
z(xaiYJ&+!s?J$sdSoSxNTKhNyX^9>VkJ&)-hyw%JO+T_w(;)0FU$cX-*J(BzHM*)<
z`wK#AA14UTY(3CyKHNBC=R9533YYZoqj~4cDM`*`qB}DdTVXncPNj?ah9NGD_VVY<
zZD(uRT`W`AvI?2$Ueruti`*(?Zl(%%$qnW1EV)llzB0w@`L!Y`<nLsbcAo#1B;U9Z
z-8tK}VdZ*>ofmYf%-MXczot34XA<_AT2Wz3zORwy2jp5de=WI_cteuY>FCa#u8lLw
z4>~oBZc6pnD4KI7Vd|UqnX%re&XVoTT76b*n7BC^bbR)klB_5_9qHk?Q(M`g`dj@q
zmSyeCw_d52wj9CoRY|^lIlfDG=sfN^w8&}8TbV*}EtMrjd%$(bOV(C1xfMbWsEd@z
zcO;#qXJj>tp0Ck!eQ~(bBdW7OwP!KgY?NuLRo~KUbhNRAZF=sbH%PN)l<H;u)dkYf
ztM&W3S~j#&!?28!NnV~w{^k`)zH}+NBZu}fd{*()Z*~XgnR?Hnq05Xpx-%WxfDW_A
zNxs^>3H{HOr(T!j3m2k0E1``DnI$yoO83eSIV(Q8B*}}59a%yq0~^_wySJ(D!H@U<
z9p`%+XgdTT009U<00Izz00bZa0SG`KQ~>Y)3uQqf1Rwwb2tWV=5P$##AOHafKwz*1
z@czHSjxTx#0SG_<0uX=z1Rwwb2tWV=5MTm${~yKy1Rwwb2tWV=5P$##AOHafKwvNh
zeDD7ouSHHo-ieH!iCr81R^*+D=O?~&$X>_ZjM*hTUe8EViW2|fjr;V)d-Szs>N<Ug
z1$`Hex?xo43oGc$)|@xHb=&5==fHkZU$=bh-Fp1BeBK+koVWGaKj<q<Leo3EIL_Y3
zeSKIuzm_W|?3doTEw*26Mqfqcd(~h2d+I`~WM%WLSDiiB`_xjoCFjL^^rd~4Lu6M<
zU!zj0H*4*$H}f?z_0~$lEsp<8hS%PD51Fqs%+IRKI&E-D;%{(cZ!M%-oV4&#`D^m5
z$~m5^t!EYff;F0fIkMh{m*Z5zMCe-&-QsK=cN70fu6&cscP@uV%SXwprkdLQO{eSO
zW5Vev6Jf8FYip=2=(OhXC)cH^8#m%VeAsc2d#^~OZz2qt1Fg+Hhk7gP0Y^J~t6zAZ
z!^V26y3pYs*v#LQ*oI{fQu@uyebxKTei7p5G45L}@CNu%41KTIur3~}31GkdvFq^n
z`f5J@?h0S#(;a7k^Ul)H;qPqgIrg1=pUJ>?>Ixn8;<g?`o@c%4?D2Um^1cQi(IVfW
zXUA%cv!%WJ67R_EU0;@_E?kIzdO0}2oebi*c9J>`XJ_*h9>sz45~otW*6{;1PZEaa
z6FbN7Rel_YUmxcSeGeu2Z*Bbpyo;K>*SdB5VC&)+>0Q*Z8_wlR=}l=WosR$Tc5vEz
zmoNNn#p3i2Z0fWO1hPHh<$#|HJFiw|?;)q;z6%#&Q;$O$&v}*q_`Hs2VsnpZMG5cM
zu{xe5?041MFTzgP?;cNfKf3WQPfR=?8IP_-#=b56^2F~B-=6s6iTgu88+v!*rRdLS
z^1q2J^}ZXhGkiyqQy1wg4DI)J^WoN-;P!DxU8k=}4Bc|mnIxIqlJa)=yXWnl34Ql%
zXaR&@CGW)F;;ne8ODnWat;qJ#3bu2XR(L&5ezGRXZ_rmd%0f#jT5YqbZR-5p?gEE@
z!;O%3_;Um>{2N`1ks@!wi=A80qVN~-X73jGA^f|O1p7?i!&}yq?-%GBKNq4qlR_)R
z^8rCYOuin{0&#mlK-}c?|KV+3@iUz&ZgpPVd!<*!{*H^g66YUrNbcow($vC2{L{9(
zUVOrdM+=_fRN8iji*J3x$A(@<0{Y5#_WJ+UivPq;6nRBQdO;p+JHN^HWLEV)P7@Ed
zLhog7^2?95>ucv0lsKZCq)tQ1*?hn;#rN*#{!w65In|06AUsL9P58vdm9O$6I$daM
z{pUQgcze1Z?;VG|jjS|v=~DdDt>9^`cl`3*r);Hm8dR+u2OL-Z-jxiDs#d+?!17Z4
zH{qVx@bc<w{S!aO^j=~gE7-p73tqh;O}+6({D%|4f#zNP(3Q(K)_fZ}4L4t=Cp_Z#
z`6g?oJ;Z|7P2PqcS4}kERhIYjx?pOx^N7~Jwhld+W9k!nywiIWGcbDHGwxi~<X2<z
zX*v47a5m{)M`WB~Dqg*amkA_c-yBNkvsw19@#OO9)T)wv=awX&k)u1Kc8TtJq+8~)
zuS{X9ck$t#ZQ56RBvAO?H}cZd++6(A@!-T`-J<_{&tci;PScESd&09Tu%5FT#g&|X
zc4y5KTfJL#9<P~kBx^P6Jp1$ik*9iJ<0A(IAOHafKmY;|fB*y_009U<00PHX0N4M=
zH+E<_1Rwwb2tWV=5P$##AOHafK%id%T>tkgg?tcz00bZa0SG_<0uX=z1Rwx`<12vc
z|Kl4wv>XBufB*y_009U<00Izz00bb=uK=$9`;|gI2tWV=5P$##AOHafKmY;|fWYw;
z!1e#}jU8GJ0SG_<0uX=z1Rwwb2tWV=5a?F`*Z=)WAs+-F009U<00Izz00bZa0SG|g
z_zK|q|M<oZEr$REAOHafKmY;|fB*y_009W}D}d|&ex;BP0uX=z1Rwwb2tWV=5P$##
zAaHyICTP>Y5<M9i`gcRClaD7)p8D-mWa1xBtepJ6CoAK>9RJ~XcI<zT{r$1;j{f=R
zUmv{^|HX;Lk?#$c=?;Of-E2*ozVJePZ`EoTo11!LW2>Z=>eZ@VvrM(QUDhn!{g^H&
zsiH!Ph0Mx|QXnBY$B6TFO<B$t6tZ?}iS3bJChPV37Rl#`Tb7V>C6hZ`D|VNvybtNH
zJ{UDqZ&+@<-TJ_D3N5qykjbqog<|Knd-++{SCy=iE|PR=Rq>^>ZFjCKIg)U47-h22
zs8?+llWn3}M)_(^xpR(DB}rzL<kqs;wo;0$ltL=Asw7g^@`d6onOUwkbYrtdw)BVO
zzEQ7emQk<0&dF<aix@Rt%}ml)nvz?(>?P0-JHvM*Idw6*Gi}t$`UBPsQ{8T^R}Ax>
z-Z0gQQQK12jdJ*wn~rQIx1_wy>kHkPL53Dh5_ZRT;&1U*yws%?TBlZI`)CE*xl1d&
z9w&E)E7J6w9Dj7v8CSgBd{U@ZW7GZ|7*WAIo-i8%spTS_IPR=)AbdHlDRescQk>j&
zxpaILiCJ%0S1rS;=qmd)!N!dJ(H~w`pZDb(V07%Ia!VwiUE=$ZE8iquA*~_7c4ouk
z`j)M*d&j51CrfvQRvxG4t+`}($Lr^zdOh20(wW1)y^=`!r;<@_b%%E42N%C*cjd1w
z`npoqE4rn3?@B9=*J$R$1G+?KJzM7b3n<&q*<-nozv;{dt!dq>JG0E`1T(tIq9k^M
z?ajX0OYjCRpQ;Bdq(K*t+U8+OpsTH+AEp3HJ5>D@t+v_JHV@bYdc4#2D_7A>OKs>{
zS>3Li23vgH6}|5WYBjo0+w1necXf|!`)zfpUb|11b=q3BzI~uZ+jCgmt~57|ntBj8
zqfE~-j17Y}qg(6g%)Md6<QJx*rhQDX2MArn+0WnbE%@#hHWk_LBvI3<I!WiVS#}<h
z%d-P>a`j$Je(|~JhjwAkaHYjLzxfJmZDmFBPvM1@HzhgwVsvNRE>)O|wB**O@A^t_
zrK`>{sg)95i@qVrGpD0FPusP$hC1Ed`|z%>4lmiQ!b>0t_A5QvE4K+P=`s1tR8+NV
z*{C<F8a)}Lb+90R$5*_tkqOzOAi)!p*>X%ieI}~grPw2!m0|zFhx$9dqP!feAR(7?
zV(@k;CQo08zQ=ps*k)yg%)D>=%B=8wti+JKPRUo+?ZLHXm&|(LcJ;2WEO!eljQ5jG
zfTXU)<b`DP6MOGc)3oYUYFcSlYc`ob<!xVy{%x#QR<=KtMQL5HBp?2UBwt-{Bi}xG
z+1~1Ud-@%Jjct>j?`PNBw#_{y8&i4R7kD4r^4Vo*?RCG^Pu*Ily7?#yPTuTyWAaNc
zID^Vv`&a|q-`4__I+rpou5)SQbZzThNnSh~-5Iuf#uqeu5eb~^dTB*p>0vvt?gY}E
z%D(p<URgA>ver4RSJ`UU%KYcC-cBSze@&Y2Nb;rg?sCN2<1A)@t_i7ykottp_Q`*%
zd%_l{gUxUAN+*R53c1u)7lqW@Ju3BgQ`nIt_=n{CcP05Uof=}b;(3g4(IO__3aMD!
z9_X&P$?5OIw|T|S2>lha2^|)bbG<6|cUjz(B>1N!p8p4KWZ)wNAOHafKmY;|fB*y_
z009U<U;qVh{Xc*~MVBA|0SG_<0uX=z1Rwwb2tWV=0Rde92SD%<0uX=z1Rwwb2tWV=
z5P$##ATWRexc(o&prT6<fB*y_009U<00Izz00bZafq($6{{tZS2muH{00Izz00bZa
z0SG_<0uUHL0bKtNU{KK|2tWV=5P$##AOHafKmY;|fIvV1*Z%<!e1rf5AOHafKmY;|
zfB*y_009ULpa8D_2QaAU5(FRs0SG_<0uX=z1Rwwb2tXhpfb0JN2tGmp0uX=z1Rwwb
z2tWV=5P$##22cRk{{t9QbO{0wfB*y_009U<00Izz00bZq5Ww|+00bW)009U<00Izz
z00bZa0SG_<0s|<3>;C}^D!K##2tWV=5P$##AOHafKmY;|2ngW%KLCP{5P$##AOHaf
zKmY;|fB*y_0D%D%!1ezC1{Ga`00bZa0SG_<0uX=z1Rwwb2m}Oh{T~3qM+iUw0uX=z
z1Rwwb2tWV=5P-k{3gG&G0E3DyK>z{}fB*y_009U<00Izz00aU8xc(1-;3EVe009U<
z00Izz00bZa0SG`~00ky!pT;A9D{|@|O?+_j^4NbH{j2fi*q@*H@yO|+XKC_h__h0;
zhtl-obMd{V)i5?U_1*U$NYhtej6a^{pBo!nCAF+qbW2z3HFdkWUNOvjdc$n}mM$o%
zqC$#=%*u*VAf0v?BhJ?~WjS9^$dZy(=x+HOX%!{pS;^$QPi)6knmt`4>C~#?OK02e
zTvu`=;pWJ%<%$WToFvPI{7tf6uWy+`yVZ(O+hTjrCU_NJ&1aX+v0c7N=G#gyveFBw
z%&L+|UCS4Wvt(wu-q4NB8rjkxlKV!zqFF}0_Ij&4lNcs3Eu&H)4Shpz=(Unwo=N(O
zR&q<1y#)GUFaEwXtt`fW@M5TZMXPN#wN2f$JHUJ8PwN^7e^#$vCl;C9s!}MjScDZU
z<n~9!6>pD;FCs>nY&7asUbaJTl&|KLJLgz+Ns?J5xwUN8tB1vukpA6SDWq1nh*9H}
z1gHZe#BGmf;%^g6R!jA=e)xuYMY*l>s`RxmI23lb?@QB{PsblW-F+x{rS%tj&$n#`
zdIbqt{GmSV1oUbU=O0V7rH^R-xs@DX_U*1WrRj^)@x6~j$+f0+uih}7A6>bfJc49k
zxogjGwA4=dA~a7rB4wxigCJ)uX?pHVd~a1i)@pR-s?F`PX6g3t_F`&=7>hZBylc0X
z*g+`2Y%c(8B@@aLG9Q@QT{P?k(!XGITf~lX8Eac6mQ2o>ZsRm+rrxjwf{vU#ryyjH
z*46<*C_~6JP>gRkr0L{^_?{{-RvO#Rn5<}~r8ab}tZvs$gB|F@#%3$Opk!0FkIaw~
zg`Eb9_SSoxHXoqnqb>v@WSlbEUZXUmq(LRUvMo)Yor>>?lb)`fnloJ4uOWy+4gsda
z0A-nlTmv;CU#WAx3&M!BarhAH#@A~Q4l-M|CQV;>!GGi~)vHy#W|_{&b3cZRK6jIo
zQy5zvMxeWckaLhmA-n#UhQAXz^>-(3j~7NSOIJ>$hrbj3kCAWh`_li>{okaQjpyS(
z7`6xWqoJLsG<{<s{`eVTfb+8})joGo#q&dTy*(`?eqHt#A{2-vuZNwAwbvo+b?CUd
z=cD|Z-np>kiJh+C_H$O|bi=v4bSm>*z7f)PX7*qwVn<=`lfI&$wF~Vl3gT)VhypA5
z$;ZHM{}<z|_)+;2X*zW_{{2mXo-f_b1hBMC@h*z@F@!vPKVkIR+O4x?9!IZ4A)|ko
zAM-mWtb_h&)09q=t^fNtv=H}339G?3$%0cXu<q&hjY?m*=oOIRyIm$E^a{0*Rfu6|
zu*0(sRJeH;{Q>7`hmW~awzItQPu&Cm(Z|yC%0m1H<DKSrgWf@?`KGv-(kt|0-d?fq
zkawVh@AT0heV%yu=<{;iN$*tEHT-+eek4ubycqw%`A*^Y?&^z+d?2ycAP8jdH4Zvw
zAE=?w>ZX4*c<F~95MEL4nD7#M91cGEu*a(4oVf{)PsEg7147K(YczDoJ5WQx>7#!f
z@WjIp0$z?g0-UP4t_r(1Kai#u=v@)<9$xFQB|Dp7|A$1`pD7sH)<a6RyRg+C%)>q%
zVTFtL>*?nsx>?UkKFFQ=z+>USV_<%m=HI)T@+^XzeG1i5ZQFjduDp0rmZuyME-&l=
zyc6^<0K|u`L{9$Y_=EUIvHx`9?(jbyx^n7+@gI-P?E4PDXS~DiM?0g^bmn~gv3LUJ
zyF(zbyEhnwq>usAdGFxRY28hC@V(m$LJh)B2OdxE^B$)f-^~S{)@hyF&&>s=^v-9$
zq4ySIJ?<?y=TY{!SDkwcVp^{Vh<Vk%?=6UX9c2W*NcR?A*f}9h-@X`sd{sF6^o`!u
z`3mQEZm<QCdqp6SU0oMI12=fQtgX8|UJ^g32>Tv-I<$)RANsxYqnH(5VeTn_m*77M
zY@ZyDMs`McfI2Qtt+IUcBapn`0QEgf0`(kaY`#bnMcx^frt^#O$BUgNiu;E(_!xDM
z6aLg*QSj&PHcMDe`;VHmW{H32qYQ*svVV?vZ8(ZK;uYr35wB9;iE_vkiR=vV&`5oT
z#yNs`71;A;pP}h{e)wxS%BXySrbi?arGLz_=Tn;9&7E=jaOZ4%&*&5?@5;fQKwd(x
z0C^d^O&gl2HDSCxjxs8&Q2#WcDMv9uSks;JDprR*EAVuT|FO&N7wY>tf$e>%-o66u
z;^|n|Klr*If3~Q(!`xordaeFLJ5rC8M?8;rR~0d>*TN#^?Y6e?e68h0-0vt?7^htS
zBEu7pVx4ii;Vd;yWj&(6p8v<<zY{t2=|p_|Z;s84mgxt4K>z{}fB*y_0D;d(U`N@R
zkfzT+7vH_<Tyr`%)}6bYR%4SV1Wp6na(Sn4spTU5Yk}^K`yAmpz0KDY|4m6JBhN+u
z+Fy~F^@erTGOUWOvR@PIFOJo;D*gLezPs{9+4uM9Xh%+lcEtHZLOnXt%H_3`cck@)
zy*{Ik;4Xj{0sa>Q_j7#|b{D`cCFIJqvNOhSxR||fxHz}P*v*B$?udCA`+ub3?cxap
zXUjgGJiAY{zCicE@GS8hUqp`LLeyC?_w_8%+KJoGa`!&$G~RiszDFfOQs5xK{_eN$
RX_%0;|4}dOG@#@D{{x9BC{h3b

literal 0
HcmV?d00001


From 555ffa879056000c565930320f303cd3d86d8c68 Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Sat, 6 Jun 2026 17:40:21 +0000
Subject: [PATCH 19/83] fix(supply-depot): reintroduce app update UI

---
 admin/inertia/pages/supply-depot.tsx | 100 +++++++++++++++++++++++++++
 1 file changed, 100 insertions(+)

diff --git a/admin/inertia/pages/supply-depot.tsx b/admin/inertia/pages/supply-depot.tsx
index a33aba1..887a7fa 100644
--- a/admin/inertia/pages/supply-depot.tsx
+++ b/admin/inertia/pages/supply-depot.tsx
@@ -2,6 +2,7 @@ import { Head } from '@inertiajs/react'
 import { useEffect, useRef, useState } from 'react'
 import {
   IconAlertTriangle,
+  IconArrowUp,
   IconBook,
   IconBox,
   IconBrandDocker,
@@ -27,14 +28,24 @@ import CustomAppModal, { CustomAppInitial } from '~/components/CustomAppModal'
 import ServiceLogsModal from '~/components/ServiceLogsModal'
 import ServiceStatsModal from '~/components/ServiceStatsModal'
 import StyledSectionHeader from '~/components/StyledSectionHeader'
+import UpdateServiceModal from '~/components/UpdateServiceModal'
 import useErrorNotification from '~/hooks/useErrorNotification'
+import useInternetStatus from '~/hooks/useInternetStatus'
 import useServiceInstallationActivity from '~/hooks/useServiceInstallationActivity'
+import { useTransmit } from 'react-adonis-transmit'
+import { BROADCAST_CHANNELS } from '../../constants/broadcast'
 import { ServiceSlim } from '../../types/services'
 import { getServiceLink } from '~/lib/navigation'
 import { getSupplyDepotDocLink } from '../../constants/supply_depot_docs'
 import api from '~/lib/api'
 import { toTitleCase } from '../../app/utils/misc'
 
+function extractTag(containerImage: string): string {
+  if (!containerImage) return ''
+  const parts = containerImage.split(':')
+  return parts.length > 1 ? parts[parts.length - 1] : 'latest'
+}
+
 const CATEGORIES = [
   { id: 'all', label: 'All' },
   { id: 'installed', label: 'Installed' },
@@ -68,16 +79,20 @@ type Modal =
   | { type: 'delete'; service: ServiceSlim }
   | { type: 'logs'; service: ServiceSlim }
   | { type: 'stats'; service: ServiceSlim }
+  | { type: 'update'; service: ServiceSlim }
   | null
 
 export default function SupplyDepotPage(props: { system: { services: ServiceSlim[] } }) {
   const { showError } = useErrorNotification()
+  const { isOnline } = useInternetStatus()
+  const { subscribe } = useTransmit()
   const installActivity = useServiceInstallationActivity()
 
   const [activeCategory, setActiveCategory] = useState('all')
   const [search, setSearch] = useState('')
   const [modal, setModal] = useState<Modal>(null)
   const [loading, setLoading] = useState(false)
+  const [checkingUpdates, setCheckingUpdates] = useState(false)
   const [openDropdown, setOpenDropdown] = useState<string | null>(null)
   const [customAppOpen, setCustomAppOpen] = useState(false)
   const [editApp, setEditApp] = useState<CustomAppInitial | null>(null)
@@ -101,6 +116,18 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
     }
   }, [installActivity])
 
+  // Listen for service update-check completion (manual or nightly), then reload so
+  // refreshed available_update_version values surface on the cards.
+  useEffect(() => {
+    const unsubscribe = subscribe(BROADCAST_CHANNELS.SERVICE_UPDATES, () => {
+      setCheckingUpdates(false)
+      window.location.reload()
+    })
+    return () => {
+      unsubscribe()
+    }
+  }, [])
+
   // Close dropdown on outside click
   useEffect(() => {
     function handleClick(e: MouseEvent) {
@@ -200,6 +227,32 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
     else setTimeout(() => window.location.reload(), 1500)
   }
 
+  // Manual trigger for the catalog-wide update check. Results stream back over the
+  // SERVICE_UPDATES broadcast (handled by the effect above), which reloads the page.
+  async function handleCheckUpdates() {
+    if (!isOnline) {
+      showError('You must have an internet connection to check for updates.')
+      return
+    }
+    try {
+      setCheckingUpdates(true)
+      const response = await api.checkServiceUpdates()
+      if (!response?.success) throw new Error(response?.message || 'Failed to dispatch update check')
+    } catch (error: any) {
+      showError(`Failed to check for updates: ${error?.message || 'Unknown error'}`)
+      setCheckingUpdates(false)
+    }
+  }
+
+  // Versioned update for a curated (non-custom) catalog app. Progress + reload are handled
+  // by the installActivity effect (update-complete) above.
+  async function handleUpdateService(service: ServiceSlim, targetVersion: string) {
+    setLoading(true)
+    const result = await api.updateService(service.service_name, targetVersion)
+    setLoading(false)
+    if (!result?.success) showError(result?.message || 'Failed to update service.')
+  }
+
   function handleCustomAppCreated() {
     setCustomAppOpen(false)
     // Page will reload when installation completes via broadcast
@@ -287,6 +340,15 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
                   className="w-full pl-9 pr-4 py-2 rounded-md bg-surface-secondary border border-desert-stone-lighter text-text-primary text-sm focus:outline-none focus:ring-1 focus:ring-desert-green placeholder:text-text-muted/50"
                 />
               </div>
+              <StyledButton
+                icon="IconRefreshAlert"
+                variant="outline"
+                onClick={handleCheckUpdates}
+                loading={checkingUpdates}
+                disabled={checkingUpdates || !isOnline}
+              >
+                Check for Updates
+              </StyledButton>
               <StyledButton
                 icon="IconBrandDocker"
                 variant="outline"
@@ -347,6 +409,7 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
                       onStats={() => setModal({ type: 'stats', service })}
                       onEdit={() => handleEdit(service)}
                       onUpdate={() => handleUpdate(service)}
+                      onUpdateVersion={() => setModal({ type: 'update', service })}
                     />
                   ))}
                 </div>
@@ -374,6 +437,7 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
                       onStats={() => setModal({ type: 'stats', service })}
                       onEdit={() => handleEdit(service)}
                       onUpdate={() => handleUpdate(service)}
+                      onUpdateVersion={() => setModal({ type: 'update', service })}
                     />
                   ))}
                 </div>
@@ -563,6 +627,22 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
         />
       )}
 
+      {/* Versioned update modal (curated apps with an available update) */}
+      {modal?.type === 'update' && (
+        <UpdateServiceModal
+          record={modal.service}
+          currentTag={extractTag(modal.service.container_image)}
+          latestVersion={modal.service.available_update_version!}
+          onCancel={() => setModal(null)}
+          onUpdate={(targetVersion) => {
+            const service = modal.service
+            setModal(null)
+            handleUpdateService(service, targetVersion)
+          }}
+          showError={showError}
+        />
+      )}
+
       {/* Custom app creation modal */}
       <CustomAppModal
         open={customAppOpen}
@@ -601,6 +681,7 @@ interface AppCardProps {
   onStats: () => void
   onEdit: () => void
   onUpdate: () => void
+  onUpdateVersion: () => void
 }
 
 function AppCard({
@@ -618,6 +699,7 @@ function AppCard({
   onStats,
   onEdit,
   onUpdate,
+  onUpdateVersion,
 }: AppCardProps) {
   const isRunning = service.status === 'running'
   const isStopped = service.installed && !isRunning
@@ -724,6 +806,17 @@ function AppCard({
             {uiIsHttps ? '🔒 ' : ''}:{uiPort}
           </span>
         )}
+        {service.available_update_version && !service.is_custom && (
+          <button
+            type="button"
+            onClick={onUpdateVersion}
+            title={`Update to ${service.available_update_version}`}
+            className="flex items-center gap-1 text-xs px-2 py-0.5 rounded-full font-medium border border-desert-green-light bg-desert-green-lighter text-desert-green-dark cursor-pointer transition-colors hover:bg-desert-green-light"
+          >
+            <IconArrowUp className="h-3 w-3" />
+            Update available
+          </button>
+        )}
       </div>
 
       {/* Action buttons */}
@@ -786,6 +879,13 @@ function AppCard({
                   <DropdownItem icon={<IconFileText className="h-4 w-4" />} label="Logs" onClick={onLogs} />
                   <DropdownItem icon={<IconChartBar className="h-4 w-4" />} label="Stats" onClick={onStats} />
                   <DropdownItem icon={<IconPencil className="h-4 w-4" />} label="Edit" onClick={onEdit} />
+                  {service.available_update_version && !service.is_custom ? (
+                    <DropdownItem
+                      icon={<IconArrowUp className="h-4 w-4 text-desert-green" />}
+                      label={`Update to ${service.available_update_version}`}
+                      onClick={onUpdateVersion}
+                    />
+                  ) : null}
                   {service.is_custom ? (
                     <DropdownItem icon={<IconCloudDownload className="h-4 w-4" />} label="Update (pull latest)" onClick={onUpdate} />
                   ) : null}

From b2bea191a85b166fc8f9fc7655d160e185af8a09 Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Sun, 7 Jun 2026 21:18:42 +0000
Subject: [PATCH 20/83] fix: minor type guarding fixes after axios bump

---
 admin/app/services/map_service.ts | 2 +-
 admin/app/utils/downloads.ts      | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/admin/app/services/map_service.ts b/admin/app/services/map_service.ts
index c1157b0..0e1c902 100644
--- a/admin/app/services/map_service.ts
+++ b/admin/app/services/map_service.ts
@@ -301,7 +301,7 @@ export class MapService implements IMapService {
       }
 
       const contentLength = response.headers['content-length']
-      const size = contentLength ? parseInt(contentLength, 10) : 0
+      const size = contentLength ? parseInt(contentLength.toString(), 10) : 0
 
       return { filename, size }
     } catch (error: any) {
diff --git a/admin/app/utils/downloads.ts b/admin/app/utils/downloads.ts
index 23988da..bfe189a 100644
--- a/admin/app/utils/downloads.ts
+++ b/admin/app/utils/downloads.ts
@@ -54,8 +54,8 @@ export async function doResumableDownload({
   // Without this default, the validator below throws `MIME type  is not allowed`
   // and breaks all downloads from kiwix's primary host (#848).
   const contentType =
-    headResponse.headers['content-type'] || 'application/octet-stream'
-  const totalBytes = parseInt(headResponse.headers['content-length'] || '0')
+    headResponse.headers['content-type']?.toString() || 'application/octet-stream'
+  const totalBytes = parseInt(headResponse.headers['content-length']?.toString() || '0', 10)
   const supportsRangeRequests = headResponse.headers['accept-ranges'] === 'bytes'
 
   // If allowedMimeTypes is provided, check content type

From fab15c68a915a8f8329b267e2ba421960a990e73 Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Fri, 5 Jun 2026 16:00:36 -0700
Subject: [PATCH 21/83] fix(storage): derive child-app bind paths from the
 admin's actual storage mount
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Child services (Kiwix, Ollama, Qdrant, Flatnotes, Kolibri) are created via the
Docker socket, so their bind mounts use a HOST path. That path was baked into
the services table at seed time from NOMAD_STORAGE_PATH (default
/opt/project-nomad/storage) — and NOMAD_STORAGE_PATH wasn't even present in
management_compose.yaml, so it always fell back to the default.

Result: relocating the admin storage volume in compose (e.g.
/mnt/big/storage:/app/storage) moved the admin's own data but left child apps
mounting the old, now-empty /opt/project-nomad/storage. Kiwix would come up
with no content. (#938)

- Add _resolveHostStorageRoot(): inspect the admin's own container, find the
  bind backing /app/storage, and use its host Source as the single source of
  truth (cached). Falls back to NOMAD_STORAGE_PATH/default if it can't be
  inspected.
- Add _applyHostStorageRoot(): rewrite the host-side prefix of each storage bind
  to that root. No-op when it already matches the seeded prefix, so default
  installs are unaffected.
- Apply it in _createContainer (covers installs + dependency recursion) and in
  the Kiwix library-mode recreate path.
- management_compose.yaml: add an explicit NOMAD_STORAGE_PATH knob and rewrite
  the comments so the admin volume, env var, and disk-collector volume that must
  agree are spelled out.

Closes #938

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 admin/app/services/docker_service.ts | 84 ++++++++++++++++++++++++++++
 install/management_compose.yaml      |  5 +-
 2 files changed, 88 insertions(+), 1 deletion(-)

diff --git a/admin/app/services/docker_service.ts b/admin/app/services/docker_service.ts
index 962233a..f0d9b8e 100644
--- a/admin/app/services/docker_service.ts
+++ b/admin/app/services/docker_service.ts
@@ -5,6 +5,8 @@ import { inject } from '@adonisjs/core'
 import transmit from '@adonisjs/transmit/services/main'
 import { doResumableDownloadWithRetry } from '../utils/downloads.js'
 import { join } from 'path'
+import os from 'node:os'
+import env from '#start/env'
 import {
   ZIM_STORAGE_PATH,
   BOOKS_STORAGE_PATH,
@@ -27,6 +29,12 @@ export class DockerService {
   public docker: Docker
   private activeInstallations: Set<string> = new Set()
   public static NOMAD_NETWORK = 'project-nomad_default'
+  public static ADMIN_CONTAINER_NAME = 'nomad_admin'
+
+  // Resolved once: the host filesystem path backing the admin's /app/storage mount.
+  // Child-service binds are rewritten to live under this so relocating the admin
+  // storage volume relocates every child app too (#938). null = not yet resolved.
+  private _hostStorageRoot: string | null = null
 
   private _servicesStatusCache: { data: { service_name: string; status: string }[]; expiresAt: number } | null = null
   private _servicesStatusInflight: Promise<{ service_name: string; status: string }[]> | null = null
@@ -447,6 +455,77 @@ export class DockerService {
    * @param serviceName
    * @returns
    */
+  /**
+   * Resolve the host filesystem path that backs the admin container's storage
+   * directory (`/app/storage`). Child services are created via the Docker socket,
+   * so their bind mounts need the path on the *host*, not inside the admin
+   * container. Deriving it from the admin's own mount means whatever host path
+   * the admin storage volume is mapped to in compose, child apps follow it
+   * automatically (#938).
+   *
+   * Falls back to NOMAD_STORAGE_PATH / the production default if the admin
+   * container or its storage mount can't be inspected.
+   */
+  private async _resolveHostStorageRoot(): Promise<string> {
+    if (this._hostStorageRoot) return this._hostStorageRoot
+    const fallback = env.get('NOMAD_STORAGE_PATH', '/opt/project-nomad/storage')
+    try {
+      const adminStorageDest = join(process.cwd(), '/storage') // e.g. /app/storage
+      const containers = await this.docker.listContainers({ all: true })
+      // Prefer the well-known admin container name; fall back to matching this
+      // process's own container by hostname (Docker defaults it to the short id).
+      let adminInfo = containers.find((c) =>
+        c.Names.includes(`/${DockerService.ADMIN_CONTAINER_NAME}`)
+      )
+      if (!adminInfo) {
+        const hn = os.hostname()
+        adminInfo = containers.find((c) => c.Id.startsWith(hn))
+      }
+      if (!adminInfo) return (this._hostStorageRoot = fallback)
+
+      const inspected = await this.docker.getContainer(adminInfo.Id).inspect()
+      const mount = (inspected.Mounts ?? []).find(
+        (m: any) => m.Type === 'bind' && m.Destination === adminStorageDest
+      )
+      if (mount?.Source) {
+        logger.info(`[DockerService] Resolved host storage root from admin mount: ${mount.Source}`)
+        return (this._hostStorageRoot = mount.Source)
+      }
+      return (this._hostStorageRoot = fallback)
+    } catch (err: any) {
+      logger.warn(
+        `[DockerService] Could not resolve host storage root, using fallback ${fallback}: ${err.message}`
+      )
+      return fallback
+    }
+  }
+
+  /**
+   * Rewrite the host side of a service's storage bind mounts so they point at the
+   * resolved host storage root. The seeded binds use the default/env prefix; if the
+   * admin storage actually lives elsewhere on the host, swap that prefix so the
+   * child container mounts the same physical location (#938). No-op when the
+   * resolved root matches the seeded prefix (the common case).
+   */
+  private async _applyHostStorageRoot(containerConfig: any): Promise<void> {
+    const binds: string[] | undefined = containerConfig?.HostConfig?.Binds
+    if (!binds?.length) return
+    const seededRoot = env.get('NOMAD_STORAGE_PATH', '/opt/project-nomad/storage')
+    const root = await this._resolveHostStorageRoot()
+    if (root === seededRoot) return
+    containerConfig.HostConfig.Binds = binds.map((b) => {
+      // bind format: "<hostSrc>:<containerDest>[:opts]" — hostSrc is a Linux abs path.
+      const firstColon = b.indexOf(':')
+      if (firstColon < 0) return b
+      const hostSrc = b.slice(0, firstColon)
+      const rest = b.slice(firstColon) // includes leading ':'
+      if (hostSrc === seededRoot || hostSrc.startsWith(seededRoot + '/')) {
+        return `${root}${hostSrc.slice(seededRoot.length)}${rest}`
+      }
+      return b
+    })
+  }
+
   async _createContainer(
     service: Service & { dependencies?: Service[] },
     containerConfig: any
@@ -454,6 +533,10 @@ export class DockerService {
     try {
       this._broadcast(service.service_name, 'initializing', '')
 
+      // Point storage binds at wherever the admin's storage volume actually lives
+      // on the host (covers dependency installs too — they recurse through here).
+      await this._applyHostStorageRoot(containerConfig)
+
       let dependencies = []
       if (service.depends_on) {
         const dependency = await Service.query().where('service_name', service.depends_on).first()
@@ -1087,6 +1170,7 @@ export class DockerService {
       await service.save()
 
       const containerConfig = this._parseContainerConfig(service.container_config)
+      await this._applyHostStorageRoot(containerConfig)
 
       // Step 4: Recreate container directly (skipping _createContainer to avoid re-downloading
       // the bootstrap ZIM — ZIM files already exist on disk)
diff --git a/install/management_compose.yaml b/install/management_compose.yaml
index f4c7b5f..fba4b0a 100644
--- a/install/management_compose.yaml
+++ b/install/management_compose.yaml
@@ -18,11 +18,14 @@ services:
     ports:
       - "8080:8080"
     volumes:
-      - /opt/project-nomad/storage:/app/storage # If you change the default storage path (/opt/project-nomad/storage), make sure to update the disk-collector config as well!
+      # To store NOMAD's data somewhere other than /opt/project-nomad/storage, change the HOST side (left of the colon) here AND set NOMAD_STORAGE_PATH below to the same host path, then update the disk-collector volume at the bottom to match. The admin auto-detects this mount so child apps (Kiwix, Ollama, etc.) follow it, but setting NOMAD_STORAGE_PATH keeps everything explicit.
+      - /opt/project-nomad/storage:/app/storage
       - /var/run/docker.sock:/var/run/docker.sock # Allows the admin service to communicate with the Host's Docker daemon
       - nomad-update-shared:/app/update-shared # Shared volume for update communication
     environment:
       - NODE_ENV=production
+      # NOMAD_STORAGE_PATH is the HOST path where NOMAD stores all of its data (ZIMs, models, notes, etc.). It MUST match the host side of the /app/storage volume above and the disk-collector volume below. The admin also auto-detects its storage mount, so child apps follow it even if this is left at the default, but keep all three in sync to avoid surprises.
+      - NOMAD_STORAGE_PATH=/opt/project-nomad/storage
       # PORT is the port the admin server listens on *inside* the container and should not be changed. If you want to change which port the admin interface is accessible from on the host, you can change the port mapping in the "ports" section (e.g. "9090:8080" to access it on port 9090 from the host)
       - PORT=8080
       - LOG_LEVEL=info

From 057fb693f64ed5b96a04eb4f6cf7a94878c3ee63 Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Sun, 7 Jun 2026 21:53:58 +0000
Subject: [PATCH 22/83] fix(storage): match default prefix too when relocating
 child-app binds
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

_applyHostStorageRoot only rewrote binds carrying the current
NOMAD_STORAGE_PATH and short-circuited when env == resolved root. That
left user-modified/custom apps — whose binds freeze the default prefix at
edit time — mounting an empty dir on the documented "set NOMAD_STORAGE_PATH
+ relocate the volume" path (#938).

- Match either the env value or the hardcoded default prefix; drop the
  root == seededRoot no-op, excluding root from the candidates instead so
  rewrites stay idempotent.
- Add ADMIN_STORAGE_DEST / DEFAULT_HOST_STORAGE_ROOT constants; replace the
  cwd-derived storage dest so admin-mount lookup can't silently break.
- Comment why a transient inspect failure is deliberately not cached.
---
 admin/app/services/docker_service.ts | 44 ++++++++++++++++++++++------
 1 file changed, 35 insertions(+), 9 deletions(-)

diff --git a/admin/app/services/docker_service.ts b/admin/app/services/docker_service.ts
index f0d9b8e..69f3ac5 100644
--- a/admin/app/services/docker_service.ts
+++ b/admin/app/services/docker_service.ts
@@ -30,6 +30,13 @@ export class DockerService {
   private activeInstallations: Set<string> = new Set()
   public static NOMAD_NETWORK = 'project-nomad_default'
   public static ADMIN_CONTAINER_NAME = 'nomad_admin'
+  // The admin's own storage mount destination inside its container (compose maps
+  // <hostPath>:/app/storage). Used to locate the backing host path (#938).
+  public static ADMIN_STORAGE_DEST = '/app/storage'
+  // Hardcoded production default host storage root. A seeded/frozen child bind can
+  // still carry this prefix even after NOMAD_STORAGE_PATH is set elsewhere, so it's
+  // matched alongside the env value when relocating binds (#938).
+  public static DEFAULT_HOST_STORAGE_ROOT = '/opt/project-nomad/storage'
 
   // Resolved once: the host filesystem path backing the admin's /app/storage mount.
   // Child-service binds are rewritten to live under this so relocating the admin
@@ -468,9 +475,9 @@ export class DockerService {
    */
   private async _resolveHostStorageRoot(): Promise<string> {
     if (this._hostStorageRoot) return this._hostStorageRoot
-    const fallback = env.get('NOMAD_STORAGE_PATH', '/opt/project-nomad/storage')
+    const fallback = env.get('NOMAD_STORAGE_PATH', DockerService.DEFAULT_HOST_STORAGE_ROOT)
     try {
-      const adminStorageDest = join(process.cwd(), '/storage') // e.g. /app/storage
+      const adminStorageDest = DockerService.ADMIN_STORAGE_DEST
       const containers = await this.docker.listContainers({ all: true })
       // Prefer the well-known admin container name; fall back to matching this
       // process's own container by hostname (Docker defaults it to the short id).
@@ -496,30 +503,49 @@ export class DockerService {
       logger.warn(
         `[DockerService] Could not resolve host storage root, using fallback ${fallback}: ${err.message}`
       )
+      // Deliberately NOT cached: a transient Docker error (e.g. socket not ready at
+      // early boot) shouldn't lock this process into the fallback for its lifetime —
+      // caching here could permanently re-hide #938 after Docker recovers. Retry next call.
       return fallback
     }
   }
 
   /**
    * Rewrite the host side of a service's storage bind mounts so they point at the
-   * resolved host storage root. The seeded binds use the default/env prefix; if the
-   * admin storage actually lives elsewhere on the host, swap that prefix so the
-   * child container mounts the same physical location (#938). No-op when the
-   * resolved root matches the seeded prefix (the common case).
+   * resolved host storage root. If the admin storage actually lives elsewhere on the
+   * host, swap a known storage-root prefix so the child container mounts the same
+   * physical location (#938).
+   *
+   * A bind's prefix may be the current NOMAD_STORAGE_PATH *or* the hardcoded default:
+   * curated services re-bake their config from the env every boot, but user-modified
+   * curated services and custom apps freeze their binds at edit time and can still
+   * carry the default prefix even after NOMAD_STORAGE_PATH is changed. Matching both
+   * (rather than only the current env, and short-circuiting when env == root) means
+   * the documented "set NOMAD_STORAGE_PATH and relocate the volume" path also fixes
+   * those frozen-prefix apps instead of leaving them mounting an empty directory.
+   * Idempotent: binds already under `root` match no other prefix and are left alone.
    */
   private async _applyHostStorageRoot(containerConfig: any): Promise<void> {
     const binds: string[] | undefined = containerConfig?.HostConfig?.Binds
     if (!binds?.length) return
-    const seededRoot = env.get('NOMAD_STORAGE_PATH', '/opt/project-nomad/storage')
     const root = await this._resolveHostStorageRoot()
-    if (root === seededRoot) return
+    // Known host-side prefixes a seeded/frozen bind might carry. Exclude `root` itself
+    // so binds already pointing at the resolved location are never rewritten.
+    const seededRoots = [
+      env.get('NOMAD_STORAGE_PATH', DockerService.DEFAULT_HOST_STORAGE_ROOT),
+      DockerService.DEFAULT_HOST_STORAGE_ROOT,
+    ].filter((r) => r !== root)
+    if (!seededRoots.length) return
     containerConfig.HostConfig.Binds = binds.map((b) => {
       // bind format: "<hostSrc>:<containerDest>[:opts]" — hostSrc is a Linux abs path.
       const firstColon = b.indexOf(':')
       if (firstColon < 0) return b
       const hostSrc = b.slice(0, firstColon)
       const rest = b.slice(firstColon) // includes leading ':'
-      if (hostSrc === seededRoot || hostSrc.startsWith(seededRoot + '/')) {
+      const seededRoot = seededRoots.find(
+        (r) => hostSrc === r || hostSrc.startsWith(r + '/')
+      )
+      if (seededRoot) {
         return `${root}${hostSrc.slice(seededRoot.length)}${rest}`
       }
       return b

From ccc221f88d1c6cc8359155a0aba8825ad80f9b84 Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Sun, 7 Jun 2026 14:34:15 -0700
Subject: [PATCH 23/83] chore: align package license with Apache-2.0 and fix
 README docs links/typos

Correct package metadata and documentation accuracy:

- Set license to Apache-2.0 in package.json, admin/package.json and both
  lockfiles (project has been Apache-2.0 since #197; metadata still said ISC)
- Replace the placeholder root package.json description with a real one
- Remove the dead README "Troubleshooting Guide" link (TROUBLESHOOTING.md
  does not exist; FAQ.md already has its own entry)
- Fix README typos: "harware", "LLM's", "of of", "uses cases"

Carries forward the worthwhile fixes from #849 by @aqilaziz, minus the
version bump that conflicted with the current release line.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 README.md               | 9 ++++-----
 admin/package-lock.json | 2 +-
 admin/package.json      | 2 +-
 package-lock.json       | 2 +-
 package.json            | 4 ++--
 5 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/README.md b/README.md
index 381cb86..46941d3 100644
--- a/README.md
+++ b/README.md
@@ -70,7 +70,7 @@ available AI tools, we highly encourage the use of a beefy, GPU-backed device to
 
 At its core, however, N.O.M.A.D. is still very lightweight. For a barebones installation of the management application itself, the following minimal specs are required:
 
-*Note: Project N.O.M.A.D. is not sponsored by any hardware manufacturer and is designed to be as hardware-agnostic as possible. The harware listed below is for example/comparison use only*
+*Note: Project N.O.M.A.D. is not sponsored by any hardware manufacturer and is designed to be as hardware-agnostic as possible. The hardware listed below is for example/comparison use only*
 
 #### Minimum Specs
 - Processor: 2 GHz dual-core processor or better
@@ -79,7 +79,7 @@ At its core, however, N.O.M.A.D. is still very lightweight. For a barebones inst
 - OS: Debian-based (Ubuntu recommended)
 - Stable internet connection (required during install only)
 
-To run LLM's and other included AI tools:
+To run LLMs and other included AI tools:
 
 #### Optimal Specs
 - Processor: AMD Ryzen 7 or Intel Core i7 or better
@@ -94,7 +94,7 @@ To run LLM's and other included AI tools:
 Again, Project N.O.M.A.D. itself is quite lightweight — it's the tools and resources you choose to install with N.O.M.A.D. that will determine the specs required for your unique deployment
 
 #### Running AI models on a different host
-By default, N.O.M.A.D.'s installer will attempt to setup Ollama on the host when the AI Assistant is installed. However, if you would like to run the AI model on a different host, you can go to the settings of of the AI assistant and input a URL for either an ollama or OpenAI-compatible API server (such as LM Studio).  
+By default, N.O.M.A.D.'s installer will attempt to setup Ollama on the host when the AI Assistant is installed. However, if you would like to run the AI model on a different host, you can go to the settings of the AI assistant and input a URL for either an ollama or OpenAI-compatible API server (such as LM Studio).  
 Note that if you use Ollama on a different host, you must start the server with this option: `OLLAMA_HOST=0.0.0.0`.  
 Ollama is the preferred way to use the AI assistant, as it has features such as model download that OpenAI API does not support. So when using LM Studio, for example, you will have to use LM Studio to download models.
 You are responsible for the setup of Ollama/OpenAI server on the other host.
@@ -110,7 +110,7 @@ To test internet connectivity, N.O.M.A.D. attempts to make a request to Cloudfla
 ## About Security
 By design, Project N.O.M.A.D. is intended to be open and available without hurdles — it includes no authentication. If you decide to connect your device to a local network after install (e.g. for allowing other devices to access its resources), you can block/open ports to control which services are exposed.
 
-**Will authentication be added in the future?** Maybe. It's not currently a priority, but if there's enough demand for it, we may consider building in an optional authentication layer in a future release to support uses cases where multiple users need access to the same instance but with different permission levels (e.g. family use with parental controls, classroom use with teacher/admin accounts, etc.). We have a suggestion for this on our public roadmap, so if this is something you'd like to see, please upvote it here: https://roadmap.projectnomad.us/posts/1/user-authentication-please-build-in-user-auth-with-admin-user-roles
+**Will authentication be added in the future?** Maybe. It's not currently a priority, but if there's enough demand for it, we may consider building in an optional authentication layer in a future release to support use cases where multiple users need access to the same instance but with different permission levels (e.g. family use with parental controls, classroom use with teacher/admin accounts, etc.). We have a suggestion for this on our public roadmap, so if this is something you'd like to see, please upvote it here: https://roadmap.projectnomad.us/posts/1/user-authentication-please-build-in-user-auth-with-admin-user-roles
 
 For now, we recommend using network-level controls to manage access if you're planning to expose your N.O.M.A.D. instance to other devices on a local network. N.O.M.A.D. is not designed to be exposed directly to the internet, and we strongly advise against doing so unless you really know what you're doing, have taken appropriate security measures, and understand the risks involved.
 
@@ -122,7 +122,6 @@ Contributions are welcome and appreciated! Please see [CONTRIBUTING.md](CONTRIBU
 - **Website:** [www.projectnomad.us](https://www.projectnomad.us) - Learn more about the project
 - **Discord:** [Join the Community](https://discord.com/invite/crosstalksolutions) - Get help, share your builds, and connect with other NOMAD users
 - **Benchmark Leaderboard:** [benchmark.projectnomad.us](https://benchmark.projectnomad.us) - See how your hardware stacks up against other NOMAD builds
-- **Troubleshooting Guide:** [TROUBLESHOOTING.md](TROUBLESHOOTING.md) - Find solutions to common issues
 - **FAQ:** [FAQ.md](FAQ.md) - Find answers to frequently asked questions
 - **Community Add-Ons:** [admin/docs/community-add-ons.md](admin/docs/community-add-ons.md) - Third-party content packs built by the community
 
diff --git a/admin/package-lock.json b/admin/package-lock.json
index bf53709..1aabbee 100644
--- a/admin/package-lock.json
+++ b/admin/package-lock.json
@@ -7,7 +7,7 @@
     "": {
       "name": "project-nomad-admin",
       "version": "0.0.0",
-      "license": "ISC",
+      "license": "Apache-2.0",
       "dependencies": {
         "@adonisjs/auth": "9.6.0",
         "@adonisjs/core": "6.19.3",
diff --git a/admin/package.json b/admin/package.json
index 51e14ec..a5997d7 100644
--- a/admin/package.json
+++ b/admin/package.json
@@ -3,7 +3,7 @@
   "version": "0.0.0",
   "private": true,
   "type": "module",
-  "license": "ISC",
+  "license": "Apache-2.0",
   "author": "Crosstalk Solutions, LLC",
   "scripts": {
     "start": "node bin/server.js",
diff --git a/package-lock.json b/package-lock.json
index 802dac9..c124b33 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -7,7 +7,7 @@
     "": {
       "name": "project-nomad",
       "version": "1.32.0-rc.6",
-      "license": "ISC"
+      "license": "Apache-2.0"
     }
   }
 }
diff --git a/package.json b/package.json
index 22d213e..859541c 100644
--- a/package.json
+++ b/package.json
@@ -1,11 +1,11 @@
 {
   "name": "project-nomad",
   "version": "1.32.1",
-  "description": "\"",
+  "description": "Project N.O.M.A.D. (Node for Offline Media, Archives, and Data) - an offline-first knowledge and education server.",
   "main": "index.js",
   "scripts": {
     "test": "echo \"Error: no test specified\" && exit 1"
   },
   "author": "Crosstalk Solutions, LLC",
-  "license": "ISC"
+  "license": "Apache-2.0"
 }

From e1c7435fc441f25747efd58dc6036260f903acc2 Mon Sep 17 00:00:00 2001
From: gujishh <baiaoshh@163.com>
Date: Sat, 9 May 2026 10:50:37 +0900
Subject: [PATCH 24/83] fix(install): harden toolkit and helper script
 downloads

---
 install/install_nomad.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/install/install_nomad.sh b/install/install_nomad.sh
index 484cea1..70930f7 100644
--- a/install/install_nomad.sh
+++ b/install/install_nomad.sh
@@ -264,7 +264,7 @@ setup_nvidia_container_toolkit() {
   echo -e "${YELLOW}#${RESET} Installing NVIDIA container toolkit...\\n"
   
   # Install dependencies per https://docs.ollama.com/docker - wrapped in error handling
-  if ! curl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey 2>/dev/null | sudo gpg --dearmor -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg 2>/dev/null; then
+  if ! curl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey 2>/dev/null | sudo gpg --batch --yes --dearmor -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg 2>/dev/null; then
     echo -e "${YELLOW}#${RESET} Warning: Failed to add NVIDIA container toolkit GPG key. Continuing anyway...\\n"
     return 0
   fi
@@ -448,19 +448,19 @@ download_helper_scripts() {
   local update_script_path="${NOMAD_DIR}/update_nomad.sh"
 
   echo -e "${YELLOW}#${RESET} Downloading helper scripts...\\n"
-  if ! curl -fsSL "$START_SCRIPT_URL" -o "$start_script_path"; then
+  if ! curl -fsSL --retry 5 --retry-delay 3 "$START_SCRIPT_URL" -o "$start_script_path"; then
     echo -e "${RED}#${RESET} Failed to download the start script. Please check the URL and try again."
     exit 1
   fi
   chmod +x "$start_script_path"
 
-  if ! curl -fsSL "$STOP_SCRIPT_URL" -o "$stop_script_path"; then
+  if ! curl -fsSL --retry 5 --retry-delay 3 "$STOP_SCRIPT_URL" -o "$stop_script_path"; then
     echo -e "${RED}#${RESET} Failed to download the stop script. Please check the URL and try again."
     exit 1
   fi
   chmod +x "$stop_script_path"
 
-  if ! curl -fsSL "$UPDATE_SCRIPT_URL" -o "$update_script_path"; then
+  if ! curl -fsSL --retry 5 --retry-delay 3 "$UPDATE_SCRIPT_URL" -o "$update_script_path"; then
     echo -e "${RED}#${RESET} Failed to download the update script. Please check the URL and try again."
     exit 1
   fi

From f553a0d57d24f93c8c7f0ef3dbfdcdba6e7f34f6 Mon Sep 17 00:00:00 2001
From: John Onysko <johno10661@gmail.com>
Date: Sun, 24 May 2026 14:20:17 -0400
Subject: [PATCH 25/83] feat(config): respect REDIS_DB env var for queue and
 transmit

Allow operators to select a Redis logical database index via the
REDIS_DB environment variable. Without this, the BullMQ queue and the
@adonisjs/transmit Redis transport both implicitly used db 0, causing
key collisions when sharing a Redis instance across multiple services
or environments.

REDIS_DB is added to the env schema as an optional number; both
config/queue.ts and config/transmit.ts fall back to db 0 when unset,
preserving existing behavior.
---
 admin/.env.example       | 3 +++
 admin/config/queue.ts    | 1 +
 admin/config/transmit.ts | 1 +
 admin/start/env.ts       | 1 +
 4 files changed, 6 insertions(+)

diff --git a/admin/.env.example b/admin/.env.example
index 05a03fd..9ef158d 100644
--- a/admin/.env.example
+++ b/admin/.env.example
@@ -12,6 +12,9 @@ DB_PASSWORD=password
 DB_SSL=false
 REDIS_HOST=localhost
 REDIS_PORT=6379
+# Optional: Redis logical database index (0-15). Defaults to 0 if unset.
+# Set this when sharing a Redis instance across services to avoid key collisions.
+# REDIS_DB=0
 # Storage path for NOMAD content (ZIM files, maps, etc.)
 # On Windows dev, use an absolute path like: C:/nomad-storage
 # On Linux production, use: /opt/project-nomad/storage
diff --git a/admin/config/queue.ts b/admin/config/queue.ts
index 25053b8..0274563 100644
--- a/admin/config/queue.ts
+++ b/admin/config/queue.ts
@@ -4,6 +4,7 @@ const queueConfig = {
   connection: {
     host: env.get('REDIS_HOST'),
     port: env.get('REDIS_PORT') ?? 6379,
+    db: env.get('REDIS_DB') ?? 0,
   },
 }
 
diff --git a/admin/config/transmit.ts b/admin/config/transmit.ts
index 43f1d42..40c2936 100644
--- a/admin/config/transmit.ts
+++ b/admin/config/transmit.ts
@@ -8,6 +8,7 @@ export default defineConfig({
     driver: redis({
       host: env.get('REDIS_HOST'),
       port: env.get('REDIS_PORT'),
+      db: env.get('REDIS_DB') ?? 0,
       keyPrefix: 'transmit:',
     })
   }
diff --git a/admin/start/env.ts b/admin/start/env.ts
index 8223fa9..408f7b6 100644
--- a/admin/start/env.ts
+++ b/admin/start/env.ts
@@ -54,6 +54,7 @@ export default await Env.create(new URL('../', import.meta.url), {
   */
   REDIS_HOST: Env.schema.string({ format: 'host' }),
   REDIS_PORT: Env.schema.number(),
+  REDIS_DB: Env.schema.number.optional(),
 
   /*
   |----------------------------------------------------------

From d175259219ebeb58029ad8b30769f983ee8e5c8e Mon Sep 17 00:00:00 2001
From: Metbcy <amirbredy1@gmail.com>
Date: Sun, 31 May 2026 17:29:39 +0000
Subject: [PATCH 26/83] fix(KB): persist accumulated chunk count across batched
 ZIM dispatches

The continuation dispatch in EmbedFileJob did not pass the running chunk
count forward, so each batch started with job.data.chunks undefined.
On the final batch, totalChunks collapsed to just that batch's result
and KbIngestState.markIndexed stored a value far below what Qdrant
actually held.

Add chunksSoFar to EmbedFileJobParams and thread it through the
continuation chain so the final markIndexed call reflects the true
total across all batches.

Closes #933
---
 admin/app/jobs/embed_file_job.ts | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/admin/app/jobs/embed_file_job.ts b/admin/app/jobs/embed_file_job.ts
index 90ce677..e224a7c 100644
--- a/admin/app/jobs/embed_file_job.ts
+++ b/admin/app/jobs/embed_file_job.ts
@@ -18,6 +18,11 @@ export interface EmbedFileJobParams {
   batchOffset?: number  // Current batch offset (for ZIM files)
   totalArticles?: number // Total articles in ZIM (for progress tracking)
   isFinalBatch?: boolean // Whether this is the last batch (prevents premature deletion)
+  // Running total of chunks embedded across prior batches in this dispatch chain.
+  // Carried forward so the final batch can persist an accurate `chunks_embedded`
+  // count via KbIngestState.markIndexed (see #933 — without this, only the last
+  // batch's chunk count was stored while Qdrant held the full set).
+  chunksSoFar?: number
 }
 
 export class EmbedFileJob {
@@ -159,13 +164,16 @@ export class EmbedFileJob {
           await new Promise((resolve) => setTimeout(resolve, EmbedFileJob.CPU_BATCH_DELAY_MS))
         }
 
-        // Dispatch next batch (not final yet)
+        // Dispatch next batch (not final yet). Carry forward the running
+        // chunk count so the final batch can persist an accurate total (#933).
+        const chunksSoFarNext = (job.data.chunksSoFar || 0) + (result.chunks || 0)
         await EmbedFileJob.dispatch({
           filePath,
           fileName,
           batchOffset: nextOffset,
           totalArticles: totalArticles || result.totalArticles,
           isFinalBatch: false, // Explicitly not final
+          chunksSoFar: chunksSoFarNext,
         })
 
         // Calculate progress based on articles processed
@@ -178,7 +186,7 @@ export class EmbedFileJob {
           ...job.data,
           status: 'batch_completed',
           lastBatchAt: Date.now(),
-          chunks: (job.data.chunks || 0) + (result.chunks || 0),
+          chunks: chunksSoFarNext,
         })
 
         return {
@@ -192,8 +200,11 @@ export class EmbedFileJob {
         }
       }
 
-      // Final batch or non-batched file - mark as complete
-      const totalChunks = (job.data.chunks || 0) + (result.chunks || 0)
+      // Final batch or non-batched file - mark as complete.
+      // chunksSoFar carries the accumulated count from prior dispatched batches
+      // (each continuation passes it forward — see EmbedFileJobParams). For a
+      // non-batched file it is undefined and we just count this single result.
+      const totalChunks = (job.data.chunksSoFar || 0) + (result.chunks || 0)
       await this.safeUpdateProgress(job, 100)
       await job.updateData({
         ...job.data,

From 02d985db5ea7e7de28b68209e4930732e8155897 Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Thu, 4 Jun 2026 06:27:40 +0000
Subject: [PATCH 27/83] feat(system): add opt-in automatic updates for the core
 NOMAD app
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds a self-update path for the NOMAD admin/core image that runs without a
human in the loop, gated by layered safety checks. Recreation remains the
sidecar's job; this only decides *whether* to update now and requests it.

An hourly job (AutoUpdateJob) evaluates a side-effect-free decision pipeline
(AutoUpdateService.evaluate):
 - opt-in: disabled by default
 - in a user-configured local-time window (handles midnight wrap)
 - an eligible release: same major (major bumps stay manual), strictly newer,
   past a configurable cool-off, GA only (no drafts/prereleases), strict semver
 - pre-flight: sidecar present, no in-flight system update / downloads / app
   installs, and sufficient host disk (estimated from the registry manifest)
When all pass, it drives SystemUpdateService.requestUpdate() with a vetted tag.

Failure backoff auto-disables after 3 genuine update-request failures; transient
release-lookup errors are skips (offline-first appliances are routinely without
connectivity). Re-enabling clears the backoff state.

Settings UI exposes the toggle, window, and cool-off, with live status (eligible
target, in/out of window, last result/error). A `node ace auto-update:dry-run`
command exercises the full pipeline — and a deterministic --scenarios suite the
pure decision logic — without ever triggering an update.

New KVStore keys under autoUpdate.* hold config + last-run state.
---
 README.md                                     |  35 +
 admin/app/controllers/settings_controller.ts  |   6 +-
 admin/app/controllers/system_controller.ts    |  24 +
 admin/app/jobs/auto_update_job.ts             |  80 +++
 admin/app/services/auto_update_service.ts     | 636 ++++++++++++++++++
 .../services/container_registry_service.ts    |  60 ++
 admin/app/services/system_service.ts          |   6 +
 admin/app/services/system_update_service.ts   |  26 +-
 admin/app/validators/settings.ts              |  30 +-
 admin/commands/auto_update/dry_run.ts         | 302 +++++++++
 admin/commands/queue/work.ts                  |   4 +
 admin/constants/kv_store.ts                   |   2 +-
 admin/inertia/hooks/useAutoUpdateStatus.ts    |  11 +
 admin/inertia/lib/api.ts                      |   9 +-
 admin/inertia/pages/settings/update.tsx       | 177 +++++
 admin/start/routes.ts                         |   1 +
 admin/types/kv_store.ts                       |   9 +
 admin/types/system.ts                         |  21 +
 18 files changed, 1429 insertions(+), 10 deletions(-)
 create mode 100644 admin/app/jobs/auto_update_job.ts
 create mode 100644 admin/app/services/auto_update_service.ts
 create mode 100644 admin/commands/auto_update/dry_run.ts
 create mode 100644 admin/inertia/hooks/useAutoUpdateStatus.ts

diff --git a/README.md b/README.md
index 46941d3..417094f 100644
--- a/README.md
+++ b/README.md
@@ -117,6 +117,41 @@ For now, we recommend using network-level controls to manage access if you're pl
 ## Contributing
 Contributions are welcome and appreciated! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines on how to contribute to the project.
 
+### Testing Auto-Updates (Dry Run)
+
+The Command Center can automatically install **minor/patch** updates of itself during a configurable window, after a cool-off period, and only when pre-flight checks pass (sufficient disk for the new image, no downloads or app installs in progress). Major versions always require a manual update.
+
+Because exercising this logic with real version bumps is impractical, an Ace command runs the **entire decision pipeline without ever triggering an update**. Run it from the `admin/` directory:
+
+```bash
+# 1) Deterministic scenario suite — no network, DB, or Docker required.
+#    Proves every branch (major-only, cool-off, prerelease/draft, window wrap, …)
+#    and exits non-zero on failure, so it's safe to wire into CI.
+node ace auto-update:dry-run --scenarios
+
+# 2) Simulate "what would happen if I were running 1.32.0 right now?"
+#    against the LIVE GitHub releases feed and real pre-flight checks:
+node ace auto-update:dry-run --current=1.32.0 --force-enabled
+
+# 3) Fully offline simulation with a canned release list and a fixed clock:
+node ace auto-update:dry-run --current=1.32.0 --force-enabled \
+  --releases-file=./fixtures/releases.json --now=2026-06-04T21:00:00Z \
+  --window-start=20:00 --window-end=23:00 --cooloff=72 --skip-preflight
+```
+
+It prints the resolved decision — current version, whether the clock is inside the window, the eligible target (if any), and pre-flight blockers — ending in a clear verdict such as `WOULD UPDATE → v1.33.2` or `WOULD NOT UPDATE (outside-window): …`. **No real update is ever requested.**
+
+| Flag | Description |
+|------|-------------|
+| `--scenarios` | Run the built-in deterministic scenario suite and exit |
+| `--current=<version>` | Simulate this currently-running version (e.g. `1.32.0`) |
+| `--force-enabled` | Treat auto-update as enabled, ignoring the saved setting |
+| `--cooloff=<hours>` | Override the cool-off period |
+| `--window-start=<HH:MM>` / `--window-end=<HH:MM>` | Override the update window |
+| `--now=<ISO timestamp>` | Simulate the clock at a specific time |
+| `--releases-file=<path>` | Use a local JSON releases array instead of fetching GitHub (offline) |
+| `--skip-preflight` | Bypass the Docker/disk/queue pre-flight checks |
+
 ## Community & Resources
 
 - **Website:** [www.projectnomad.us](https://www.projectnomad.us) - Learn more about the project
diff --git a/admin/app/controllers/settings_controller.ts b/admin/app/controllers/settings_controller.ts
index 24cb4ce..b4a2058 100644
--- a/admin/app/controllers/settings_controller.ts
+++ b/admin/app/controllers/settings_controller.ts
@@ -3,7 +3,7 @@ import { BenchmarkService } from '#services/benchmark_service'
 import { MapService } from '#services/map_service'
 import { OllamaService } from '#services/ollama_service'
 import { SystemService } from '#services/system_service'
-import { getSettingSchema, updateSettingSchema } from '#validators/settings'
+import { getSettingSchema, updateSettingSchema, validateSettingValue } from '#validators/settings'
 import { inject } from '@adonisjs/core'
 import type { HttpContext } from '@adonisjs/core/http'
 
@@ -118,6 +118,10 @@ export default class SettingsController {
 
   async updateSetting({ request, response }: HttpContext) {
     const reqData = await request.validateUsing(updateSettingSchema)
+    const valueError = validateSettingValue(reqData.key, reqData.value)
+    if (valueError) {
+      return response.status(422).send({ success: false, message: valueError })
+    }
     await this.systemService.updateSetting(reqData.key, reqData.value)
     return response.status(200).send({ success: true, message: 'Setting updated successfully' })
   }
diff --git a/admin/app/controllers/system_controller.ts b/admin/app/controllers/system_controller.ts
index 1fc5a0d..4acaab4 100644
--- a/admin/app/controllers/system_controller.ts
+++ b/admin/app/controllers/system_controller.ts
@@ -2,6 +2,9 @@ import { DockerService } from '#services/docker_service';
 import { SystemService } from '#services/system_service'
 import { SystemUpdateService } from '#services/system_update_service'
 import { ContainerRegistryService } from '#services/container_registry_service'
+import { AutoUpdateService } from '#services/auto_update_service'
+import { DownloadService } from '#services/download_service'
+import { QueueService } from '#services/queue_service'
 import { CheckServiceUpdatesJob } from '#jobs/check_service_updates_job'
 import {
   affectServiceValidator,
@@ -126,6 +129,27 @@ export default class SystemController {
         response.send({ logs });
     }
 
+    async getAutoUpdateStatus({ response }: HttpContext) {
+        // Construct inline reusing already-injected singletons + the QueueService
+        // singleton (its constructor is private to prevent Redis connection leaks,
+        // so we must not let the container new a fresh one).
+        const autoUpdateService = new AutoUpdateService(
+            this.dockerService,
+            new DownloadService(QueueService.getInstance()),
+            this.systemService,
+            this.systemUpdateService,
+            this.containerRegistryService
+        )
+
+        try {
+            const status = await autoUpdateService.getStatus()
+            response.send(status)
+        } catch (error) {
+            logger.error({ err: error }, '[SystemController] Failed to get auto-update status')
+            response.status(500).send({ error: 'Failed to retrieve auto-update status' })
+        }
+    }
+
 
     async subscribeToReleaseNotes({ request }: HttpContext) {
         const reqData = await request.validateUsing(subscribeToReleaseNotesValidator);
diff --git a/admin/app/jobs/auto_update_job.ts b/admin/app/jobs/auto_update_job.ts
new file mode 100644
index 0000000..5131e7a
--- /dev/null
+++ b/admin/app/jobs/auto_update_job.ts
@@ -0,0 +1,80 @@
+import { Job } from 'bullmq'
+import { QueueService } from '#services/queue_service'
+import { DockerService } from '#services/docker_service'
+import { DownloadService } from '#services/download_service'
+import { SystemService } from '#services/system_service'
+import { SystemUpdateService } from '#services/system_update_service'
+import { ContainerRegistryService } from '#services/container_registry_service'
+import { AutoUpdateService } from '#services/auto_update_service'
+import logger from '@adonisjs/core/services/logger'
+
+/**
+ * Hourly job that evaluates whether the NOMAD application should auto-update right
+ * now and, if so, requests it. All gating (opt-in, window, eligibility, cool-off,
+ * pre-flight, backoff) lives in {@link AutoUpdateService}; this job is just the
+ * scheduled trigger. Runs hourly so it can act anywhere inside a user's window
+ * regardless of the window's length.
+ */
+export class AutoUpdateJob {
+  static get queue() {
+    return 'system'
+  }
+
+  static get key() {
+    return 'auto-update'
+  }
+
+  async handle(_job: Job) {
+    logger.info('[AutoUpdateJob] Evaluating auto-update...')
+
+    const dockerService = new DockerService()
+    const autoUpdateService = new AutoUpdateService(
+      dockerService,
+      new DownloadService(QueueService.getInstance()),
+      new SystemService(dockerService),
+      new SystemUpdateService(),
+      new ContainerRegistryService()
+    )
+
+    const result = await autoUpdateService.attempt()
+    logger.info(`[AutoUpdateJob] ${result.updated ? 'Updating' : 'No update'}: ${result.reason}`)
+    return result
+  }
+
+  static async schedule() {
+    const queueService = QueueService.getInstance()
+    const queue = queueService.getQueue(this.queue)
+
+    await queue.upsertJobScheduler(
+      'hourly-auto-update',
+      { pattern: '0 * * * *' }, // Top of every hour; attempt() gates on the window
+      {
+        name: this.key,
+        opts: {
+          removeOnComplete: { count: 12 },
+          removeOnFail: { count: 5 },
+        },
+      }
+    )
+
+    logger.info('[AutoUpdateJob] Auto-update evaluation scheduled with cron: 0 * * * *')
+  }
+
+  static async dispatch() {
+    const queueService = QueueService.getInstance()
+    const queue = queueService.getQueue(this.queue)
+
+    const job = await queue.add(
+      this.key,
+      {},
+      {
+        attempts: 1,
+        removeOnComplete: { count: 12 },
+        removeOnFail: { count: 5 },
+      }
+    )
+
+    logger.info(`[AutoUpdateJob] Dispatched ad-hoc auto-update evaluation job ${job.id}`)
+    return job
+  }
+}
diff --git a/admin/app/services/auto_update_service.ts b/admin/app/services/auto_update_service.ts
new file mode 100644
index 0000000..013f209
--- /dev/null
+++ b/admin/app/services/auto_update_service.ts
@@ -0,0 +1,636 @@
+import { inject } from '@adonisjs/core'
+import logger from '@adonisjs/core/services/logger'
+import axios from 'axios'
+import { DateTime } from 'luxon'
+import KVStore from '#models/kv_store'
+import Service from '#models/service'
+import { DockerService } from '#services/docker_service'
+import { DownloadService } from '#services/download_service'
+import { SystemService } from '#services/system_service'
+import { SystemUpdateService } from '#services/system_update_service'
+import { ContainerRegistryService } from '#services/container_registry_service'
+import { isNewerVersion, parseMajorVersion } from '../utils/version.js'
+
+/** Docker image repository for the NOMAD admin/core image (tag applied per-release). */
+const NOMAD_IMAGE_REPO = 'ghcr.io/crosstalk-solutions/project-nomad'
+const RELEASES_URL = 'https://api.github.com/repos/Crosstalk-Solutions/project-nomad/releases'
+
+/** Defaults for user-configurable settings (server-local time window + cool-off). */
+const DEFAULT_WINDOW_START = '02:00'
+const DEFAULT_WINDOW_END = '05:00'
+const DEFAULT_COOLOFF_HOURS = 72
+
+/** Require free space >= imageSize * factor to cover decompressed layers + headroom. */
+const DISK_SAFETY_FACTOR = 2
+/** Conservative fallback when the registry image size can't be determined. */
+const MIN_FREE_BYTES = 5 * 1024 * 1024 * 1024 // 5 GiB
+/** Genuine failures before auto-update disables itself to avoid an update loop. */
+const MAX_CONSECUTIVE_FAILURES = 3
+
+/**
+ * Only tags matching strict semver are eligible. Defense-in-depth: the selected
+ * tag becomes `target_tag`, which the sidecar interpolates into a host-side `sed`
+ * (install/sidecar-updater/update-watcher.sh) — so a malformed tag must never be
+ * able to reach it, even though releases come from a trusted repo.
+ */
+const SEMVER_TAG = /^\d+\.\d+\.\d+$/
+
+/** Cache the GitHub releases feed in-process to avoid hammering the API. */
+const RELEASES_CACHE_TTL_MS = 15 * 60 * 1000
+/** Briefly remember a failed fetch so repeated calls don't each block on the timeout. */
+const RELEASES_FAILURE_TTL_MS = 60 * 1000
+
+export interface AutoUpdateConfig {
+  enabled: boolean
+  windowStart: string
+  windowEnd: string
+  cooloffHours: number
+}
+
+export interface EligibleTarget {
+  version: string
+  tag: string
+  publishedAt: string
+}
+
+type BlockerSeverity = 'skip' | 'failure'
+export interface Blocker {
+  reason: string
+  severity: BlockerSeverity
+}
+
+export interface PreflightResult {
+  ok: boolean
+  blockers: Blocker[]
+}
+
+/** Minimal shape of a GitHub release entry we depend on. */
+export interface GithubRelease {
+  tag_name?: string
+  published_at?: string
+  draft?: boolean
+  prerelease?: boolean
+}
+
+/**
+ * Inputs that can be injected to exercise the decision pipeline deterministically
+ * (used by the dry-run command/tests). All are optional; when omitted the real
+ * settings/clock/GitHub feed/pre-flight are used, exactly as production runs.
+ */
+export interface EvaluateOverrides {
+  currentVersion?: string
+  releases?: GithubRelease[]
+  now?: DateTime
+  forceEnabled?: boolean
+  windowStart?: string
+  windowEnd?: string
+  cooloffHours?: number
+  /** Treat pre-flight as passing without touching Docker/disk/queues. */
+  skipPreflight?: boolean
+  /** Substitute a canned pre-flight result. */
+  fakePreflight?: PreflightResult
+}
+
+export type DecisionOutcome =
+  | 'disabled'
+  | 'outside-window'
+  | 'eligibility-error'
+  | 'no-eligible'
+  | 'blocked'
+  | 'ready'
+
+/** Side-effect-free verdict of the decision pipeline. */
+export interface AutoUpdateDecision {
+  enabled: boolean
+  currentVersion: string
+  config: AutoUpdateConfig
+  withinWindow: boolean
+  eligibleTarget: EligibleTarget | null
+  preflight: PreflightResult | null
+  outcome: DecisionOutcome
+  reason: string
+}
+
+export interface AutoUpdateStatus extends AutoUpdateConfig {
+  currentVersion: string
+  withinWindow: boolean
+  eligibleTarget: EligibleTarget | null
+  lastAttemptAt: string | null
+  lastResult: string | null
+  lastError: string | null
+  consecutiveFailures: number
+  autoDisabledReason: string | null
+}
+
+/**
+ * Decision + safety layer for automatic updates of the NOMAD application itself.
+ *
+ * It does NOT recreate containers — that remains the sidecar's job. This service
+ * decides *whether* an update should run right now (opt-in, in-window, an eligible
+ * minor/patch release exists past its cool-off, pre-flight checks pass) and, if so,
+ * drives the existing {@link SystemUpdateService.requestUpdate} with an explicit,
+ * eligibility-vetted image tag.
+ *
+ * The window/pre-flight helpers are intentionally generic so a future PR can reuse
+ * them to auto-update installed apps (driving DockerService.updateContainer instead).
+ */
+@inject()
+export class AutoUpdateService {
+  constructor(
+    private dockerService: DockerService,
+    private downloadService: DownloadService,
+    private systemService: SystemService,
+    private systemUpdateService: SystemUpdateService,
+    private containerRegistryService: ContainerRegistryService
+  ) {}
+
+  /** In-process cache of the last successful releases fetch (per-process). */
+  private static releasesCache: { releases: GithubRelease[]; at: number } | null = null
+  /** Timestamp of the last failed fetch, for short-lived negative caching. */
+  private static releasesFailureAt = 0
+
+  /** Read user-configurable settings, applying defaults. */
+  async getConfig(): Promise<AutoUpdateConfig> {
+    const [enabled, windowStart, windowEnd, cooloffHours] = await Promise.all([
+      KVStore.getValue('autoUpdate.enabled'),
+      KVStore.getValue('autoUpdate.windowStart'),
+      KVStore.getValue('autoUpdate.windowEnd'),
+      KVStore.getValue('autoUpdate.cooloffHours'),
+    ])
+
+    const parsedCooloff = Number(cooloffHours)
+    return {
+      enabled: enabled ?? false,
+      windowStart: windowStart || DEFAULT_WINDOW_START,
+      windowEnd: windowEnd || DEFAULT_WINDOW_END,
+      // `Number(null) === 0`, so an *unset* value must fall through to the default
+      // rather than silently resolving to a zero cool-off. An explicit 0 is honored.
+      cooloffHours:
+        cooloffHours != null && Number.isFinite(parsedCooloff) && parsedCooloff >= 0
+          ? parsedCooloff
+          : DEFAULT_COOLOFF_HOURS,
+    }
+  }
+
+  /**
+   * Determine whether `now` falls inside the configured update window. The window
+   * is interpreted in the container's local time (set via the TZ env var). Windows
+   * that wrap past midnight (start > end, e.g. 22:00-02:00) are handled.
+   */
+  isWithinWindow(config: AutoUpdateConfig, now: DateTime = DateTime.now()): boolean {
+    const start = this.parseMinutes(config.windowStart)
+    const end = this.parseMinutes(config.windowEnd)
+    if (start === null || end === null) return false
+
+    const current = now.hour * 60 + now.minute
+    if (start === end) return false // zero-length window
+    if (start < end) {
+      return current >= start && current < end
+    }
+    // Wraps midnight
+    return current >= start || current < end
+  }
+
+  private parseMinutes(hhmm: string): number | null {
+    const match = /^([01]\d|2[0-3]):([0-5]\d)$/.exec(hhmm)
+    if (!match) return null
+    return Number(match[1]) * 60 + Number(match[2])
+  }
+
+  /**
+   * Find the newest release that is safe to auto-apply: same major version as the
+   * running build (major bumps are deliberately left for manual update), strictly
+   * newer than current, and published at least `cooloffHours` ago. Prereleases and
+   * drafts are ignored — auto-update never rides early access.
+   *
+   * Returns null when nothing qualifies (e.g. only a major bump is newer, or the
+   * newest eligible release is still inside its cool-off window).
+   */
+  async getEligibleTarget(config: AutoUpdateConfig): Promise<EligibleTarget | null> {
+    const releases = await this.fetchReleases()
+    return this.selectEligibleTarget(
+      releases,
+      SystemService.getAppVersion(),
+      config.cooloffHours,
+      DateTime.now()
+    )
+  }
+
+  /**
+   * Fetch the published GitHub releases for the NOMAD repo, cached in-process.
+   * A successful result is reused for {@link RELEASES_CACHE_TTL_MS} so repeated
+   * status-page loads don't each hit (and risk rate-limiting) the unauthenticated
+   * GitHub API. A recent failure is negatively cached for {@link RELEASES_FAILURE_TTL_MS}
+   * so back-to-back calls while offline don't each block on the request timeout.
+   */
+  async fetchReleases(): Promise<GithubRelease[]> {
+    const now = Date.now()
+    const cached = AutoUpdateService.releasesCache
+    if (cached && now - cached.at < RELEASES_CACHE_TTL_MS) {
+      return cached.releases
+    }
+    if (now - AutoUpdateService.releasesFailureAt < RELEASES_FAILURE_TTL_MS) {
+      throw new Error('GitHub releases fetch recently failed; backing off')
+    }
+
+    try {
+      const response = await axios.get(RELEASES_URL, {
+        headers: { Accept: 'application/vnd.github+json' },
+        timeout: 5000,
+      })
+      if (!Array.isArray(response.data)) {
+        throw new Error('Unexpected response from GitHub releases API')
+      }
+      AutoUpdateService.releasesCache = { releases: response.data, at: now }
+      return response.data
+    } catch (error) {
+      AutoUpdateService.releasesFailureAt = now
+      throw error
+    }
+  }
+
+  /**
+   * Pure selection of the newest auto-applicable release from a release list.
+   * Extracted so the dry-run command and tests can drive it with fixtures.
+   * Same major as `currentVersion`, strictly newer, published on/before
+   * `now - cooloffHours`, prereleases/drafts excluded. Returns null for dev
+   * builds or when nothing qualifies.
+   */
+  selectEligibleTarget(
+    releases: GithubRelease[],
+    currentVersion: string,
+    cooloffHours: number,
+    now: DateTime
+  ): EligibleTarget | null {
+    if (currentVersion === 'dev' || currentVersion === '0.0.0') {
+      return null
+    }
+    const currentMajor = parseMajorVersion(currentVersion)
+    const cutoff = now.minus({ hours: cooloffHours })
+
+    const candidates = releases
+      .filter((r) => r && !r.draft && !r.prerelease && r.tag_name && r.published_at)
+      .map((r) => ({
+        version: String(r.tag_name).replace(/^v/, '').trim(),
+        publishedAt: String(r.published_at),
+      }))
+      .filter((r) => SEMVER_TAG.test(r.version))
+      .filter((r) => parseMajorVersion(r.version) === currentMajor)
+      .filter((r) => isNewerVersion(r.version, currentVersion))
+      .filter((r) => DateTime.fromISO(r.publishedAt) <= cutoff)
+      .sort((a, b) => (isNewerVersion(a.version, b.version) ? -1 : 1))
+
+    const best = candidates[0]
+    if (!best) return null
+
+    return {
+      version: best.version,
+      tag: `v${best.version}`,
+      publishedAt: best.publishedAt,
+    }
+  }
+
+  /**
+   * Pre-flight checks that gate an auto-update. `skip` blockers are transient
+   * (retry next window, no penalty); `failure` blockers count toward the backoff
+   * that eventually auto-disables auto-update.
+   */
+  async runPreflight(targetTag: string): Promise<PreflightResult> {
+    const blockers: Blocker[] = []
+
+    // 1. Sidecar must be present to perform the update.
+    if (!this.systemUpdateService.isSidecarAvailable()) {
+      blockers.push({ reason: 'Update sidecar is not available', severity: 'failure' })
+    }
+
+    // 2. No system update already running.
+    const updateStatus = this.systemUpdateService.getUpdateStatus()
+    if (updateStatus && !['idle', 'complete', 'error'].includes(updateStatus.stage)) {
+      blockers.push({
+        reason: `A system update is already in progress (stage: ${updateStatus.stage})`,
+        severity: 'skip',
+      })
+    }
+
+    // 3. No content/model downloads in progress.
+    try {
+      const downloads = await this.downloadService.listDownloadJobs()
+      const active = downloads.filter(
+        (d) => !!d.status && ['waiting', 'active', 'delayed'].includes(d.status)
+      )
+      if (active.length > 0) {
+        blockers.push({
+          reason: `${active.length} download(s) in progress`,
+          severity: 'skip',
+        })
+      }
+    } catch (error) {
+      logger.warn(`[AutoUpdateService] Could not check active downloads: ${error.message}`)
+    }
+
+    // 4. No app (container) install/update in progress.
+    try {
+      const installing = await Service.query().whereNot('installation_status', 'idle')
+      if (installing.length > 0) {
+        blockers.push({
+          reason: `${installing.length} app install/update(s) in progress`,
+          severity: 'skip',
+        })
+      }
+    } catch (error) {
+      logger.warn(`[AutoUpdateService] Could not check app installations: ${error.message}`)
+    }
+
+    // 5. Sufficient host storage for the new image.
+    const diskBlocker = await this.checkDiskSpace(targetTag)
+    if (diskBlocker) blockers.push(diskBlocker)
+
+    return { ok: blockers.length === 0, blockers }
+  }
+
+  /** Returns a disk blocker if free space is insufficient, otherwise null. */
+  private async checkDiskSpace(targetTag: string): Promise<Blocker | null> {
+    try {
+      const hostArch = await this.getHostArch()
+      const parsed = this.containerRegistryService.parseImageReference(
+        `${NOMAD_IMAGE_REPO}:${targetTag}`
+      )
+      const imageSize = await this.containerRegistryService.getImageDownloadSize(
+        parsed,
+        targetTag,
+        hostArch
+      )
+      const required = imageSize !== null ? imageSize * DISK_SAFETY_FACTOR : MIN_FREE_BYTES
+
+      const free = await this.getFreeBytes()
+      if (free === null) {
+        logger.warn('[AutoUpdateService] Could not determine free disk space; skipping disk check')
+        return null
+      }
+
+      if (free < required) {
+        return {
+          reason: `Insufficient disk space: ${this.gib(free)} free, ${this.gib(required)} required`,
+          severity: 'failure',
+        }
+      }
+      return null
+    } catch (error) {
+      logger.warn(`[AutoUpdateService] Disk space check failed: ${error.message}`)
+      return null
+    }
+  }
+
+  /** Free bytes on the root filesystem (best-effort, falls back to max available). */
+  private async getFreeBytes(): Promise<number | null> {
+    const info = await this.systemService.getSystemInfo()
+    if (!info?.fsSize?.length) return null
+    const root = info.fsSize.find((f) => f.mount === '/')
+    if (root) return root.available
+    return Math.max(...info.fsSize.map((f) => f.available))
+  }
+
+  private gib(bytes: number): string {
+    return `${(bytes / 1024 / 1024 / 1024).toFixed(1)} GiB`
+  }
+
+  /** Map the Docker daemon's architecture string to OCI naming (amd64/arm64/...). */
+  private async getHostArch(): Promise<string> {
+    try {
+      const info = await this.dockerService.docker.info()
+      const arch = info.Architecture || ''
+      const archMap: Record<string, string> = {
+        x86_64: 'amd64',
+        aarch64: 'arm64',
+        armv7l: 'arm',
+        amd64: 'amd64',
+        arm64: 'arm64',
+      }
+      return archMap[arch] || arch.toLowerCase()
+    } catch {
+      return 'amd64'
+    }
+  }
+
+  /**
+   * Side-effect-free core of the decision pipeline. Resolves the effective config
+   * (settings, overridable), checks the window, finds an eligible target, and runs
+   * pre-flight — returning a verdict WITHOUT requesting an update or mutating any
+   * persisted state. Both {@link attempt} (production) and {@link dryRun} (testing)
+   * are built on this so a dry run faithfully reflects what a real run would do.
+   */
+  async evaluate(overrides: EvaluateOverrides = {}): Promise<AutoUpdateDecision> {
+    const baseConfig = await this.getConfig()
+    const config: AutoUpdateConfig = {
+      enabled: overrides.forceEnabled ?? baseConfig.enabled,
+      windowStart: overrides.windowStart ?? baseConfig.windowStart,
+      windowEnd: overrides.windowEnd ?? baseConfig.windowEnd,
+      cooloffHours: overrides.cooloffHours ?? baseConfig.cooloffHours,
+    }
+    const now = overrides.now ?? DateTime.now()
+    const currentVersion = overrides.currentVersion ?? SystemService.getAppVersion()
+
+    const base = {
+      enabled: config.enabled,
+      currentVersion,
+      config,
+      withinWindow: false,
+      eligibleTarget: null as EligibleTarget | null,
+      preflight: null as PreflightResult | null,
+    }
+
+    if (!config.enabled) {
+      return { ...base, outcome: 'disabled', reason: 'Auto-update is disabled' }
+    }
+
+    const withinWindow = this.isWithinWindow(config, now)
+    if (!withinWindow) {
+      return {
+        ...base,
+        outcome: 'outside-window',
+        reason: `Outside update window (${config.windowStart}-${config.windowEnd})`,
+      }
+    }
+
+    let eligibleTarget: EligibleTarget | null
+    try {
+      const releases = overrides.releases ?? (await this.fetchReleases())
+      eligibleTarget = this.selectEligibleTarget(releases, currentVersion, config.cooloffHours, now)
+    } catch (error) {
+      return {
+        ...base,
+        withinWindow,
+        outcome: 'eligibility-error',
+        reason: `Failed to determine eligible version: ${error.message}`,
+      }
+    }
+
+    if (!eligibleTarget) {
+      return {
+        ...base,
+        withinWindow,
+        outcome: 'no-eligible',
+        reason: 'No eligible minor/patch update available (or still in cool-off)',
+      }
+    }
+
+    const preflight = overrides.fakePreflight
+      ? overrides.fakePreflight
+      : overrides.skipPreflight
+        ? { ok: true, blockers: [] }
+        : await this.runPreflight(eligibleTarget.tag)
+
+    if (!preflight.ok) {
+      const summary = preflight.blockers.map((b) => b.reason).join('; ')
+      return {
+        ...base,
+        withinWindow,
+        eligibleTarget,
+        preflight,
+        outcome: 'blocked',
+        reason: `Pre-flight blocked: ${summary}`,
+      }
+    }
+
+    return {
+      ...base,
+      withinWindow,
+      eligibleTarget,
+      preflight,
+      outcome: 'ready',
+      reason: `Ready to update to ${eligibleTarget.tag}`,
+    }
+  }
+
+  /**
+   * Run the full decision pipeline WITHOUT requesting an update or recording any
+   * state. Accepts the same injectable overrides as {@link evaluate}, so callers can
+   * simulate any scenario (a given current version, a canned release list, a fixed
+   * clock, a forced window) and see exactly what a real run would decide.
+   */
+  async dryRun(overrides: EvaluateOverrides = {}): Promise<AutoUpdateDecision> {
+    return this.evaluate(overrides)
+  }
+
+  /**
+   * The entry point invoked by AutoUpdateJob. Evaluates the decision pipeline and,
+   * when everything passes, requests the update with the vetted tag — recording the
+   * outcome to the KVStore (for the UI) and applying failure backoff.
+   */
+  async attempt(): Promise<{ updated: boolean; reason: string }> {
+    const decision = await this.evaluate()
+
+    switch (decision.outcome) {
+      case 'disabled':
+        return { updated: false, reason: decision.reason }
+
+      case 'outside-window':
+      case 'no-eligible':
+      // A failed release lookup is transient (offline-first appliances are
+      // routinely without connectivity) — treat as a skip so it never trips the
+      // backoff that auto-disables the feature. Only real update-request failures
+      // (the `ready` case below) count toward MAX_CONSECUTIVE_FAILURES.
+      case 'eligibility-error':
+        await this.recordSkip(decision.reason)
+        return { updated: false, reason: decision.reason }
+
+      case 'blocked': {
+        const hasFailure = decision.preflight!.blockers.some((b) => b.severity === 'failure')
+        if (hasFailure) {
+          await this.recordFailure(decision.reason)
+        } else {
+          await this.recordSkip(decision.reason)
+        }
+        return { updated: false, reason: decision.reason }
+      }
+
+      case 'ready': {
+        const target = decision.eligibleTarget!
+        const result = await this.systemUpdateService.requestUpdate({
+          targetTag: target.tag,
+          requester: 'auto-update',
+        })
+
+        if (result.success) {
+          await this.recordSuccess(target)
+          logger.info(`[AutoUpdateService] Auto-update requested: ${target.tag}`)
+          return { updated: true, reason: `Update requested: ${target.tag}` }
+        }
+
+        await this.recordFailure(`Update request failed: ${result.message}`)
+        return { updated: false, reason: result.message }
+      }
+    }
+  }
+
+  // --- Outcome recording -----------------------------------------------------
+
+  private async recordSuccess(target: EligibleTarget): Promise<void> {
+    await KVStore.setValue('autoUpdate.lastAttemptAt', DateTime.now().toISO()!)
+    await KVStore.setValue('autoUpdate.lastResult', `Update requested: ${target.tag}`)
+    await KVStore.clearValue('autoUpdate.lastError')
+    await KVStore.setValue('autoUpdate.consecutiveFailures', '0')
+  }
+
+  private async recordSkip(reason: string): Promise<void> {
+    await KVStore.setValue('autoUpdate.lastAttemptAt', DateTime.now().toISO()!)
+    await KVStore.setValue('autoUpdate.lastResult', reason)
+    logger.info(`[AutoUpdateService] Skipped: ${reason}`)
+  }
+
+  private async recordFailure(reason: string): Promise<void> {
+    await KVStore.setValue('autoUpdate.lastAttemptAt', DateTime.now().toISO()!)
+    await KVStore.setValue('autoUpdate.lastResult', reason)
+    await KVStore.setValue('autoUpdate.lastError', reason)
+
+    const prior = Number(await KVStore.getValue('autoUpdate.consecutiveFailures')) || 0
+    const failures = prior + 1
+    await KVStore.setValue('autoUpdate.consecutiveFailures', String(failures))
+    logger.error(`[AutoUpdateService] Failure ${failures}/${MAX_CONSECUTIVE_FAILURES}: ${reason}`)
+
+    if (failures >= MAX_CONSECUTIVE_FAILURES) {
+      await KVStore.setValue('autoUpdate.enabled', false)
+      await KVStore.setValue(
+        'autoUpdate.autoDisabledReason',
+        `Auto-update disabled after ${failures} consecutive failures. Last error: ${reason}`
+      )
+      logger.error(
+        `[AutoUpdateService] Auto-update auto-disabled after ${failures} consecutive failures`
+      )
+    }
+  }
+
+  /** Full state snapshot for the settings UI. */
+  async getStatus(): Promise<AutoUpdateStatus> {
+    const config = await this.getConfig()
+    const currentVersion = SystemService.getAppVersion()
+
+    let eligibleTarget: EligibleTarget | null = null
+    try {
+      eligibleTarget = await this.getEligibleTarget(config)
+    } catch (error) {
+      logger.warn(`[AutoUpdateService] getStatus eligibility lookup failed: ${error.message}`)
+    }
+
+    const [lastAttemptAt, lastResult, lastError, consecutiveFailures, autoDisabledReason] =
+      await Promise.all([
+        KVStore.getValue('autoUpdate.lastAttemptAt'),
+        KVStore.getValue('autoUpdate.lastResult'),
+        KVStore.getValue('autoUpdate.lastError'),
+        KVStore.getValue('autoUpdate.consecutiveFailures'),
+        KVStore.getValue('autoUpdate.autoDisabledReason'),
+      ])
+
+    return {
+      ...config,
+      currentVersion,
+      withinWindow: this.isWithinWindow(config),
+      eligibleTarget,
+      lastAttemptAt: lastAttemptAt || null,
+      lastResult: lastResult || null,
+      lastError: lastError || null,
+      consecutiveFailures: Number(consecutiveFailures) || 0,
+      autoDisabledReason: autoDisabledReason || null,
+    }
+  }
+}
diff --git a/admin/app/services/container_registry_service.ts b/admin/app/services/container_registry_service.ts
index 01251fc..afdd39d 100644
--- a/admin/app/services/container_registry_service.ts
+++ b/admin/app/services/container_registry_service.ts
@@ -200,6 +200,66 @@ export class ContainerRegistryService {
     }
   }
 
+  /**
+   * Estimate the compressed download size (in bytes) of an image tag for the
+   * given host architecture by summing its layer sizes from the manifest.
+   *
+   * Resolves a multi-arch manifest list/index down to the platform-specific
+   * manifest before summing `layers[].size`. Returns null on any failure so
+   * callers can fall back to a conservative fixed threshold rather than
+   * silently skipping a disk pre-flight check.
+   */
+  async getImageDownloadSize(
+    parsed: ParsedImageReference,
+    tag: string,
+    hostArch: string
+  ): Promise<number | null> {
+    try {
+      const token = await this.getToken(parsed.registry, parsed.fullName)
+      const manifestAccept = [
+        'application/vnd.oci.image.index.v1+json',
+        'application/vnd.docker.distribution.manifest.list.v2+json',
+        'application/vnd.oci.image.manifest.v1+json',
+        'application/vnd.docker.distribution.manifest.v2+json',
+      ].join(', ')
+
+      const fetchManifest = async (ref: string) =>
+        this.fetchWithRetry(`https://${parsed.registry}/v2/${parsed.fullName}/manifests/${ref}`, {
+          headers: { Authorization: `Bearer ${token}`, Accept: manifestAccept },
+        })
+
+      const topRes = await fetchManifest(tag)
+      if (!topRes.ok) return null
+
+      let manifest = (await topRes.json()) as {
+        mediaType?: string
+        layers?: Array<{ size?: number }>
+        manifests?: Array<{ digest?: string; platform?: { architecture?: string } }>
+      }
+
+      // Multi-arch manifest list/index — resolve to the host-arch child manifest.
+      if (manifest.manifests?.length) {
+        const match =
+          manifest.manifests.find((m) => m.platform?.architecture === hostArch) ||
+          manifest.manifests[0]
+        if (!match?.digest) return null
+
+        const childRes = await fetchManifest(match.digest)
+        if (!childRes.ok) return null
+        manifest = (await childRes.json()) as { layers?: Array<{ size?: number }> }
+      }
+
+      if (!manifest.layers?.length) return null
+
+      return manifest.layers.reduce((total, layer) => total + (layer.size || 0), 0)
+    } catch (error) {
+      logger.warn(
+        `[ContainerRegistryService] Failed to get image size for ${parsed.fullName}:${tag}: ${error.message}`
+      )
+      return null
+    }
+  }
+
   /**
    * Extract the source repository URL from an image's OCI labels.
    * Uses the standardized `org.opencontainers.image.source` label.
diff --git a/admin/app/services/system_service.ts b/admin/app/services/system_service.ts
index 8e27d85..f261496 100644
--- a/admin/app/services/system_service.ts
+++ b/admin/app/services/system_service.ts
@@ -832,6 +832,12 @@ export class SystemService {
     if (key === 'ai.assistantCustomName') {
       invalidateAssistantNameCache()
     }
+    // Re-enabling auto-update after a backoff-driven auto-disable clears the
+    // failure state so it gets a fresh start instead of immediately re-tripping.
+    if (key === 'autoUpdate.enabled' && (value === true || value === 'true')) {
+      await KVStore.setValue('autoUpdate.consecutiveFailures', '0')
+      await KVStore.clearValue('autoUpdate.autoDisabledReason')
+    }
   }
 
   /**
diff --git a/admin/app/services/system_update_service.ts b/admin/app/services/system_update_service.ts
index 73f0791..502b9f1 100644
--- a/admin/app/services/system_update_service.ts
+++ b/admin/app/services/system_update_service.ts
@@ -18,9 +18,18 @@ export class SystemUpdateService {
   private static LOG_FILE = join(SystemUpdateService.SHARED_DIR, 'update-log')
 
   /**
-   * Requests a system update by creating a request file that the sidecar will detect
+   * Requests a system update by creating a request file that the sidecar will detect.
+   *
+   * @param options.targetTag - Explicit Docker image tag to install (e.g. "v1.33.2").
+   *   When omitted, falls back to the cached `system.latestVersion` (manual-update
+   *   behavior). Auto-update passes an eligibility-vetted tag here, which may differ
+   *   from `system.latestVersion` when the newest release is a major bump.
+   * @param options.requester - Identifier recorded in the request file for auditing.
    */
-  async requestUpdate(): Promise<{ success: boolean; message: string }> {
+  async requestUpdate(options?: {
+    targetTag?: string
+    requester?: string
+  }): Promise<{ success: boolean; message: string }> {
     try {
       const currentStatus = this.getUpdateStatus()
       if (currentStatus && !['idle', 'complete', 'error'].includes(currentStatus.stage)) {
@@ -30,13 +39,18 @@ export class SystemUpdateService {
         }
       }
 
-      // Determine the Docker image tag to install.
-      const latestVersion = await KVStore.getValue('system.latestVersion')
+      // Determine the Docker image tag to install. Prefer an explicit caller-supplied
+      // tag; otherwise use the cached latest version.
+      let targetTag = options?.targetTag
+      if (!targetTag) {
+        const latestVersion = await KVStore.getValue('system.latestVersion')
+        targetTag = latestVersion ? `v${latestVersion}` : 'latest'
+      }
 
       const requestData = {
         requested_at: new Date().toISOString(),
-        requester: 'admin-api',
-        target_tag: latestVersion ? `v${latestVersion}` : 'latest',
+        requester: options?.requester ?? 'admin-api',
+        target_tag: targetTag,
       }
 
       await writeFile(SystemUpdateService.REQUEST_FILE, JSON.stringify(requestData, null, 2))
diff --git a/admin/app/validators/settings.ts b/admin/app/validators/settings.ts
index fff9d38..e9067aa 100644
--- a/admin/app/validators/settings.ts
+++ b/admin/app/validators/settings.ts
@@ -1,5 +1,6 @@
 import vine from "@vinejs/vine";
 import { SETTINGS_KEYS } from "../../constants/kv_store.js";
+import type { KVStoreKey } from "../../types/kv_store.js";
 
 export const getSettingSchema = vine.compile(vine.object({
     key: vine.enum(SETTINGS_KEYS),
@@ -8,4 +9,31 @@ export const getSettingSchema = vine.compile(vine.object({
 export const updateSettingSchema = vine.compile(vine.object({
     key: vine.enum(SETTINGS_KEYS),
     value: vine.any().optional(),
-}))
\ No newline at end of file
+}))
+
+const HHMM_PATTERN = /^([01]\d|2[0-3]):[0-5]\d$/
+
+/**
+ * Validate the *value* for keys that have format constraints beyond the generic
+ * enum/any check (the generic validator only constrains the key). Returns an
+ * error message string when invalid, or null when the value is acceptable.
+ */
+export function validateSettingValue(key: KVStoreKey, value: unknown): string | null {
+    switch (key) {
+        case 'autoUpdate.windowStart':
+        case 'autoUpdate.windowEnd':
+            if (typeof value !== 'string' || !HHMM_PATTERN.test(value)) {
+                return 'Time window values must be in 24-hour HH:MM format (e.g. "20:00").'
+            }
+            return null
+        case 'autoUpdate.cooloffHours': {
+            const num = Number(value)
+            if (!Number.isInteger(num) || num < 0 || num > 8760) {
+                return 'Cool-off must be a whole number of hours between 0 and 8760.'
+            }
+            return null
+        }
+        default:
+            return null
+    }
+}
\ No newline at end of file
diff --git a/admin/commands/auto_update/dry_run.ts b/admin/commands/auto_update/dry_run.ts
new file mode 100644
index 0000000..9590ef2
--- /dev/null
+++ b/admin/commands/auto_update/dry_run.ts
@@ -0,0 +1,302 @@
+import { BaseCommand, flags } from '@adonisjs/core/ace'
+import type { CommandOptions } from '@adonisjs/core/types/ace'
+import { readFile } from 'node:fs/promises'
+
+/**
+ * Exercise the auto-update decision pipeline WITHOUT ever triggering a real update.
+ *
+ *   # Prove the core logic deterministically (no network/DB/Docker):
+ *   node ace auto-update:dry-run --scenarios
+ *
+ *   # Simulate "what would happen if I were running 1.32.0 right now"
+ *   # against the live GitHub releases feed and real pre-flight checks:
+ *   node ace auto-update:dry-run --current=1.32.0 --force-enabled
+ *
+ *   # Fully offline simulation with a canned release list + fixed clock:
+ *   node ace auto-update:dry-run --current=1.32.0 --force-enabled \
+ *     --releases-file=./fixtures/releases.json --now=2026-06-04T21:00:00Z \
+ *     --window-start=20:00 --window-end=23:00 --skip-preflight
+ */
+export default class AutoUpdateDryRun extends BaseCommand {
+  static commandName = 'auto-update:dry-run'
+  static description = 'Dry-run the auto-update decision pipeline (never triggers an update)'
+
+  @flags.boolean({ description: 'Run the built-in deterministic scenario suite and exit' })
+  declare scenarios: boolean
+
+  @flags.string({ description: 'Simulate this currently-running version (e.g. 1.32.0)' })
+  declare current: string
+
+  @flags.boolean({ description: 'Ignore the persisted enabled setting and treat as enabled' })
+  declare forceEnabled: boolean
+
+  @flags.string({ description: 'Override cool-off hours' })
+  declare cooloff: string
+
+  @flags.string({ description: 'Override window start (HH:MM)' })
+  declare windowStart: string
+
+  @flags.string({ description: 'Override window end (HH:MM)' })
+  declare windowEnd: string
+
+  @flags.string({ description: 'Simulate the clock at this ISO timestamp' })
+  declare now: string
+
+  @flags.string({ description: 'Path to a JSON file with a GitHub releases array (offline)' })
+  declare releasesFile: string
+
+  @flags.boolean({ description: 'Bypass Docker/disk/queue pre-flight checks' })
+  declare skipPreflight: boolean
+
+  static options: CommandOptions = {
+    startApp: true,
+  }
+
+  async run() {
+    const { DateTime } = await import('luxon')
+    const { DockerService } = await import('#services/docker_service')
+    const { DownloadService } = await import('#services/download_service')
+    const { SystemService } = await import('#services/system_service')
+    const { SystemUpdateService } = await import('#services/system_update_service')
+    const { ContainerRegistryService } = await import('#services/container_registry_service')
+    const { QueueService } = await import('#services/queue_service')
+    const { AutoUpdateService } = await import('#services/auto_update_service')
+
+    const dockerService = new DockerService()
+    const svc = new AutoUpdateService(
+      dockerService,
+      new DownloadService(QueueService.getInstance()),
+      new SystemService(dockerService),
+      new SystemUpdateService(),
+      new ContainerRegistryService()
+    )
+
+    if (this.scenarios) {
+      const ok = this.runScenarios(svc, DateTime)
+      if (!ok) {
+        this.exitCode = 1
+      }
+      return
+    }
+
+    // --- Live / simulated single dry run ------------------------------------
+    const overrides: Record<string, any> = {}
+    if (this.current) overrides.currentVersion = this.current
+    if (this.forceEnabled) overrides.forceEnabled = true
+    if (this.cooloff) overrides.cooloffHours = Number(this.cooloff)
+    if (this.windowStart) overrides.windowStart = this.windowStart
+    if (this.windowEnd) overrides.windowEnd = this.windowEnd
+    if (this.skipPreflight) overrides.skipPreflight = true
+    if (this.now) overrides.now = DateTime.fromISO(this.now)
+    if (this.releasesFile) {
+      const raw = await readFile(this.releasesFile, 'utf-8')
+      overrides.releases = JSON.parse(raw)
+    }
+
+    this.logger.info('Running auto-update dry run (no update will be triggered)...')
+    const decision = await svc.dryRun(overrides)
+
+    this.logger.log('')
+    this.logger.log(`  Current version : ${decision.currentVersion}`)
+    this.logger.log(`  Enabled         : ${decision.enabled}`)
+    this.logger.log(
+      `  Window          : ${decision.config.windowStart}-${decision.config.windowEnd} ` +
+        `(currently ${decision.withinWindow ? 'inside' : 'outside'})`
+    )
+    this.logger.log(`  Cool-off hours  : ${decision.config.cooloffHours}`)
+    this.logger.log(
+      `  Eligible target : ${decision.eligibleTarget ? decision.eligibleTarget.tag + ' (published ' + decision.eligibleTarget.publishedAt + ')' : '—'}`
+    )
+    if (decision.preflight) {
+      if (decision.preflight.ok) {
+        this.logger.log(`  Pre-flight      : ok`)
+      } else {
+        this.logger.log(`  Pre-flight      : BLOCKED`)
+        for (const b of decision.preflight.blockers) {
+          this.logger.log(`      - [${b.severity}] ${b.reason}`)
+        }
+      }
+    } else {
+      this.logger.log(`  Pre-flight      : (not reached)`)
+    }
+    this.logger.log('')
+
+    const verdict =
+      decision.outcome === 'ready'
+        ? `WOULD UPDATE → ${decision.eligibleTarget!.tag}`
+        : `WOULD NOT UPDATE (${decision.outcome}): ${decision.reason}`
+    if (decision.outcome === 'ready') {
+      this.logger.success(verdict)
+    } else {
+      this.logger.info(verdict)
+    }
+  }
+
+  /**
+   * Deterministic acceptance suite over the pure decision helpers — no network,
+   * DB, or Docker. Proves every branch reviewers care about.
+   */
+  private runScenarios(svc: any, DateTime: any): boolean {
+    const NOW = '2026-06-04T12:00:00Z'
+    const now = DateTime.fromISO(NOW)
+    const daysAgo = (d: number) => now.minus({ days: d }).toISO()
+    const hoursAgo = (h: number) => now.minus({ hours: h }).toISO()
+    const rel = (tag: string, published: string, extra: object = {}) => ({
+      tag_name: tag,
+      published_at: published,
+      ...extra,
+    })
+
+    type EligCase = {
+      name: string
+      releases: any[]
+      current: string
+      cooloff: number
+      expect: string | null
+    }
+
+    const eligibility: EligCase[] = [
+      {
+        name: 'only a major bump is newer → none (major requires manual)',
+        releases: [rel('v2.0.0', daysAgo(10))],
+        current: '1.32.0',
+        cooloff: 72,
+        expect: null,
+      },
+      {
+        name: 'same-major minor newer but inside cool-off → none',
+        releases: [rel('v1.33.0', hoursAgo(10))],
+        current: '1.32.0',
+        cooloff: 72,
+        expect: null,
+      },
+      {
+        name: 'same-major patch past cool-off → selected',
+        releases: [rel('v1.32.1', daysAgo(5))],
+        current: '1.32.0',
+        cooloff: 72,
+        expect: '1.32.1',
+      },
+      {
+        name: 'mixed: newest same-major past cool-off wins; major/in-cooloff/prerelease ignored',
+        releases: [
+          rel('v2.0.0', daysAgo(30)),
+          rel('v1.34.0', hoursAgo(5)),
+          rel('v1.33.2', daysAgo(4)),
+          rel('v1.33.5', daysAgo(1), { prerelease: true }),
+          rel('v1.33.0', daysAgo(8)),
+        ],
+        current: '1.32.9',
+        cooloff: 72,
+        expect: '1.33.2',
+      },
+      {
+        name: 'draft releases ignored',
+        releases: [rel('v1.33.0', daysAgo(5), { draft: true })],
+        current: '1.32.0',
+        cooloff: 72,
+        expect: null,
+      },
+      {
+        name: 'malformed tag with injection chars → ignored (M2)',
+        releases: [rel('v1.33.0|; e reboot', daysAgo(10))],
+        current: '1.32.0',
+        cooloff: 72,
+        expect: null,
+      },
+      {
+        name: 'dev build never updates',
+        releases: [rel('v1.33.0', daysAgo(10))],
+        current: 'dev',
+        cooloff: 72,
+        expect: null,
+      },
+      {
+        name: 'cool-off of 0 applies immediately',
+        releases: [rel('v1.32.1', hoursAgo(1))],
+        current: '1.32.0',
+        cooloff: 0,
+        expect: '1.32.1',
+      },
+    ]
+
+    type WinCase = { name: string; start: string; end: string; at: string; expect: boolean }
+    const at = (hhmm: string) => `2026-06-04T${hhmm}:00`
+    const windows: WinCase[] = [
+      {
+        name: 'normal 20:00-23:00 @ 21:00 → in',
+        start: '20:00',
+        end: '23:00',
+        at: at('21:00'),
+        expect: true,
+      },
+      {
+        name: 'normal 20:00-23:00 @ 19:00 → out',
+        start: '20:00',
+        end: '23:00',
+        at: at('19:00'),
+        expect: false,
+      },
+      {
+        name: 'wrap 22:00-02:00 @ 23:00 → in',
+        start: '22:00',
+        end: '02:00',
+        at: at('23:00'),
+        expect: true,
+      },
+      {
+        name: 'wrap 22:00-02:00 @ 01:00 → in',
+        start: '22:00',
+        end: '02:00',
+        at: at('01:00'),
+        expect: true,
+      },
+      {
+        name: 'wrap 22:00-02:00 @ 12:00 → out',
+        start: '22:00',
+        end: '02:00',
+        at: at('12:00'),
+        expect: false,
+      },
+    ]
+
+    let passed = 0
+    let failed = 0
+
+    this.logger.log('')
+    this.logger.log('Eligibility scenarios:')
+    for (const c of eligibility) {
+      const got = svc.selectEligibleTarget(c.releases, c.current, c.cooloff, now)
+      const gotVersion = got ? got.version : null
+      const ok = gotVersion === c.expect
+      this.report(ok, `${c.name} (expected ${c.expect ?? 'none'}, got ${gotVersion ?? 'none'})`)
+      ok ? passed++ : failed++
+    }
+
+    this.logger.log('')
+    this.logger.log('Window scenarios:')
+    for (const c of windows) {
+      const cfg = { enabled: true, windowStart: c.start, windowEnd: c.end, cooloffHours: 72 }
+      const got = svc.isWithinWindow(cfg, DateTime.fromISO(c.at))
+      const ok = got === c.expect
+      this.report(ok, `${c.name} (expected ${c.expect}, got ${got})`)
+      ok ? passed++ : failed++
+    }
+
+    this.logger.log('')
+    if (failed === 0) {
+      this.logger.success(`All ${passed} scenarios passed`)
+    } else {
+      this.logger.error(`${failed} scenario(s) failed, ${passed} passed`)
+    }
+    return failed === 0
+  }
+
+  private report(ok: boolean, message: string) {
+    if (ok) {
+      this.logger.log(`  ${this.colors.green('✓')} ${message}`)
+    } else {
+      this.logger.log(`  ${this.colors.red('✗')} ${message}`)
+    }
+  }
+}
diff --git a/admin/commands/queue/work.ts b/admin/commands/queue/work.ts
index 49890e6..7e68122 100644
--- a/admin/commands/queue/work.ts
+++ b/admin/commands/queue/work.ts
@@ -9,6 +9,7 @@ import { RunBenchmarkJob } from '#jobs/run_benchmark_job'
 import { EmbedFileJob } from '#jobs/embed_file_job'
 import { CheckUpdateJob } from '#jobs/check_update_job'
 import { CheckServiceUpdatesJob } from '#jobs/check_service_updates_job'
+import { AutoUpdateJob } from '#jobs/auto_update_job'
 
 export default class QueueWork extends BaseCommand {
   static commandName = 'queue:work'
@@ -103,6 +104,7 @@ export default class QueueWork extends BaseCommand {
     // Schedule nightly update checks (idempotent, will persist over restarts)
     await CheckUpdateJob.scheduleNightly()
     await CheckServiceUpdatesJob.scheduleNightly()
+    await AutoUpdateJob.schedule()
 
     // Safety net: log unhandled rejections instead of crashing the worker process.
     // Individual job errors are already caught by BullMQ; this catches anything that
@@ -133,6 +135,7 @@ export default class QueueWork extends BaseCommand {
     handlers.set(EmbedFileJob.key, new EmbedFileJob())
     handlers.set(CheckUpdateJob.key, new CheckUpdateJob())
     handlers.set(CheckServiceUpdatesJob.key, new CheckServiceUpdatesJob())
+    handlers.set(AutoUpdateJob.key, new AutoUpdateJob())
 
     queues.set(RunDownloadJob.key, RunDownloadJob.queue)
     queues.set(RunExtractPmtilesJob.key, RunExtractPmtilesJob.queue)
@@ -141,6 +144,7 @@ export default class QueueWork extends BaseCommand {
     queues.set(EmbedFileJob.key, EmbedFileJob.queue)
     queues.set(CheckUpdateJob.key, CheckUpdateJob.queue)
     queues.set(CheckServiceUpdatesJob.key, CheckServiceUpdatesJob.queue)
+    queues.set(AutoUpdateJob.key, AutoUpdateJob.queue)
 
     return [handlers, queues]
   }
diff --git a/admin/constants/kv_store.ts b/admin/constants/kv_store.ts
index 6caeb72..da7a3cb 100644
--- a/admin/constants/kv_store.ts
+++ b/admin/constants/kv_store.ts
@@ -1,3 +1,3 @@
 import { KVStoreKey } from "../types/kv_store.js";
 
-export const SETTINGS_KEYS: KVStoreKey[] = ['chat.suggestionsEnabled', 'chat.lastModel', 'ui.hasVisitedEasySetup', 'ui.theme', 'system.earlyAccess', 'ai.assistantCustomName', 'ai.remoteOllamaUrl', 'ai.ollamaFlashAttention', 'rag.defaultIngestPolicy'];
\ No newline at end of file
+export const SETTINGS_KEYS: KVStoreKey[] = ['chat.suggestionsEnabled', 'chat.lastModel', 'ui.hasVisitedEasySetup', 'ui.theme', 'system.earlyAccess', 'ai.assistantCustomName', 'ai.remoteOllamaUrl', 'ai.ollamaFlashAttention', 'rag.defaultIngestPolicy', 'autoUpdate.enabled', 'autoUpdate.windowStart', 'autoUpdate.windowEnd', 'autoUpdate.cooloffHours'];
\ No newline at end of file
diff --git a/admin/inertia/hooks/useAutoUpdateStatus.ts b/admin/inertia/hooks/useAutoUpdateStatus.ts
new file mode 100644
index 0000000..57e5c22
--- /dev/null
+++ b/admin/inertia/hooks/useAutoUpdateStatus.ts
@@ -0,0 +1,11 @@
+import { useQuery } from '@tanstack/react-query'
+import api from '~/lib/api'
+import { AutoUpdateStatus } from '../../types/system'
+
+export const useAutoUpdateStatus = () => {
+  return useQuery<AutoUpdateStatus | undefined>({
+    queryKey: ['auto-update-status'],
+    queryFn: () => api.getAutoUpdateStatus(),
+    refetchOnWindowFocus: false,
+  })
+}
diff --git a/admin/inertia/lib/api.ts b/admin/inertia/lib/api.ts
index d0db48e..10400a9 100644
--- a/admin/inertia/lib/api.ts
+++ b/admin/inertia/lib/api.ts
@@ -2,7 +2,7 @@ import axios, { AxiosError, AxiosInstance } from 'axios'
 import { ListRemoteZimFilesResponse, ListZimFilesResponse } from '../../types/zim'
 import { ServiceSlim } from '../../types/services'
 import { FileEntry } from '../../types/files'
-import { CheckLatestVersionResult, SystemInformationResponse, SystemUpdateStatus } from '../../types/system'
+import { AutoUpdateStatus, CheckLatestVersionResult, SystemInformationResponse, SystemUpdateStatus } from '../../types/system'
 import { DownloadJobWithProgress, WikipediaState } from '../../types/downloads'
 import type { Country, CountryCode, CountryGroup, MapExtractPreflight } from '../../types/maps'
 import { EmbedJobWithProgress, FileWarningsResult, StoredFileInfo } from '../../types/rag'
@@ -542,6 +542,13 @@ class API {
     })()
   }
 
+  async getAutoUpdateStatus() {
+    return catchInternal(async () => {
+      const response = await this.client.get<AutoUpdateStatus>('/system/auto-update/status')
+      return response.data
+    })()
+  }
+
   async healthCheck() {
     return catchInternal(async () => {
       const response = await this.client.get<{ status: string }>('/health', {
diff --git a/admin/inertia/pages/settings/update.tsx b/admin/inertia/pages/settings/update.tsx
index 06db3bb..ffba3ba 100644
--- a/admin/inertia/pages/settings/update.tsx
+++ b/admin/inertia/pages/settings/update.tsx
@@ -15,6 +15,7 @@ import Switch from '~/components/inputs/Switch'
 import { useMutation, useQueryClient } from '@tanstack/react-query'
 import { useNotifications } from '~/context/NotificationContext'
 import { useSystemSetting } from '~/hooks/useSystemSetting'
+import { useAutoUpdateStatus } from '~/hooks/useAutoUpdateStatus'
 import { formatBytes } from '~/lib/util'
 
 type Props = {
@@ -257,6 +258,181 @@ function ContentUpdatesSection() {
   )
 }
 
+const COOLOFF_OPTIONS = [
+  { value: 24, label: '24 hours (1 day)' },
+  { value: 48, label: '48 hours (2 days)' },
+  { value: 72, label: '72 hours (3 days)' },
+  { value: 168, label: '7 days' },
+]
+
+function AutoUpdateSection() {
+  const { addNotification } = useNotifications()
+  const queryClient = useQueryClient()
+  const { data: status, isLoading } = useAutoUpdateStatus()
+
+  const [windowStart, setWindowStart] = useState('02:00')
+  const [windowEnd, setWindowEnd] = useState('05:00')
+  const [cooloff, setCooloff] = useState(72)
+
+  // Seed editable fields once the persisted status loads.
+  useEffect(() => {
+    if (status) {
+      setWindowStart(status.windowStart)
+      setWindowEnd(status.windowEnd)
+      setCooloff(status.cooloffHours)
+    }
+  }, [status?.windowStart, status?.windowEnd, status?.cooloffHours])
+
+  const saveMutation = useMutation({
+    mutationFn: ({ key, value }: { key: string; value: any }) => api.updateSetting(key, value),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ['auto-update-status'] })
+    },
+    onError: () => {
+      addNotification({ type: 'error', message: 'Failed to update auto-update setting.' })
+    },
+  })
+
+  const enabled = status?.enabled ?? false
+  const autoDisabled = !!status?.autoDisabledReason
+
+  const handleToggle = (value: boolean) => {
+    saveMutation.mutate(
+      { key: 'autoUpdate.enabled', value },
+      {
+        onSuccess: () => {
+          queryClient.invalidateQueries({ queryKey: ['auto-update-status'] })
+          addNotification({
+            type: 'success',
+            message: value ? 'Automatic updates enabled.' : 'Automatic updates disabled.',
+          })
+        },
+      }
+    )
+  }
+
+  const handleSaveWindow = async () => {
+    try {
+      await api.updateSetting('autoUpdate.windowStart', windowStart)
+      await api.updateSetting('autoUpdate.windowEnd', windowEnd)
+      await api.updateSetting('autoUpdate.cooloffHours', String(cooloff))
+      queryClient.invalidateQueries({ queryKey: ['auto-update-status'] })
+      addNotification({ type: 'success', message: 'Auto-update schedule saved.' })
+    } catch {
+      addNotification({ type: 'error', message: 'Failed to save auto-update schedule.' })
+    }
+  }
+
+  return (
+    <>
+      <StyledSectionHeader title="Automatic Updates" className="mt-8" />
+      <div className="bg-surface-primary rounded-lg border shadow-md overflow-hidden mt-6 p-6">
+        {autoDisabled && (
+          <Alert
+            type="warning"
+            title="Automatic Updates Disabled"
+            message={status?.autoDisabledReason || 'Auto-update was disabled after repeated failures.'}
+            variant="bordered"
+            className="mb-4"
+          />
+        )}
+
+        <Switch
+          checked={enabled}
+          onChange={handleToggle}
+          disabled={saveMutation.isPending || isLoading}
+          label="Enable Automatic Updates"
+          description="Automatically install minor and patch updates during your chosen window. Major versions always require a manual update due to their potentially breaking nature."
+        />
+
+        <div className="mt-6 grid grid-cols-1 md:grid-cols-3 gap-4">
+          <Input
+            name="autoUpdateWindowStart"
+            label="Window Start"
+            type="time"
+            value={windowStart}
+            onChange={(e) => setWindowStart(e.target.value)}
+            disabled={!enabled}
+            helpText="Local server time"
+          />
+          <Input
+            name="autoUpdateWindowEnd"
+            label="Window End"
+            type="time"
+            value={windowEnd}
+            onChange={(e) => setWindowEnd(e.target.value)}
+            disabled={!enabled}
+            helpText="Local server time"
+          />
+          <div>
+            <label
+              htmlFor="autoUpdateCooloff"
+              className="block text-base/6 font-medium text-text-primary"
+            >
+              Cool-off Period
+            </label>
+            <p className="mt-1 text-sm text-text-muted">Delay after a release is published</p>
+            <select
+              id="autoUpdateCooloff"
+              value={cooloff}
+              onChange={(e) => setCooloff(Number(e.target.value))}
+              disabled={!enabled}
+              className="mt-1.5 block w-full rounded-md bg-surface-primary px-3 py-2 text-base text-text-primary border border-border-default focus:outline focus:outline-2 focus:-outline-offset-2 focus:outline-primary sm:text-sm/6 disabled:opacity-50"
+            >
+              {COOLOFF_OPTIONS.map((opt) => (
+                <option key={opt.value} value={opt.value}>
+                  {opt.label}
+                </option>
+              ))}
+            </select>
+          </div>
+        </div>
+
+        <div className="mt-4 flex justify-end">
+          <StyledButton
+            variant="primary"
+            size="sm"
+            onClick={handleSaveWindow}
+            disabled={!enabled}
+          >
+            Save Schedule
+          </StyledButton>
+        </div>
+
+        {enabled && status && (
+          <div className="mt-6 pt-4 border-t border-desert-stone-light text-sm space-y-1">
+            <p className="text-desert-stone-dark">
+              <span className="font-medium">Status: </span>
+              {status.eligibleTarget
+                ? `Eligible update ready: ${status.eligibleTarget.version}`
+                : 'No eligible update — system is current or the latest release is a major version / still in cool-off.'}
+            </p>
+            <p className="text-desert-stone">
+              <span className="font-medium">Update window: </span>
+              {status.withinWindow ? 'Currently inside the window' : 'Currently outside the window'}
+            </p>
+            {status.lastResult && (
+              <p className="text-desert-stone">
+                <span className="font-medium">Last check: </span>
+                {status.lastResult}
+                {status.lastAttemptAt
+                  ? ` (${new Date(status.lastAttemptAt).toLocaleString()})`
+                  : ''}
+              </p>
+            )}
+            {status.lastError && (
+              <p className="text-desert-red">
+                <span className="font-medium">Last error: </span>
+                {status.lastError}
+              </p>
+            )}
+          </div>
+        )}
+      </div>
+    </>
+  )
+}
+
 export default function SystemUpdatePage(props: { system: Props }) {
   const { addNotification } = useNotifications()
 
@@ -668,6 +844,7 @@ export default function SystemUpdatePage(props: { system: Props }) {
               description="Receive release candidate (RC) versions before they are officially released. Note: RC versions may contain bugs and are not recommended for environments where stability and data integrity are critical."
             />
           </div>
+          <AutoUpdateSection />
           <ContentUpdatesSection />
           <div className="bg-surface-primary rounded-lg border shadow-md overflow-hidden py-6 mt-12">
             <div className="flex flex-col md:flex-row justify-between items-center p-8 gap-y-8 md:gap-y-0 gap-x-8">
diff --git a/admin/start/routes.ts b/admin/start/routes.ts
index 598c951..0379b98 100644
--- a/admin/start/routes.ts
+++ b/admin/start/routes.ts
@@ -187,6 +187,7 @@ router
     router.post('/update', [SystemController, 'requestSystemUpdate'])
     router.get('/update/status', [SystemController, 'getSystemUpdateStatus'])
     router.get('/update/logs', [SystemController, 'getSystemUpdateLogs'])
+    router.get('/auto-update/status', [SystemController, 'getAutoUpdateStatus'])
     router.get('/settings', [SettingsController, 'getSetting'])
     router.patch('/settings', [SettingsController, 'updateSetting'])
   })
diff --git a/admin/types/kv_store.ts b/admin/types/kv_store.ts
index e41f910..4193f57 100644
--- a/admin/types/kv_store.ts
+++ b/admin/types/kv_store.ts
@@ -7,6 +7,15 @@ export const KV_STORE_SCHEMA = {
   'system.updateAvailable':     'boolean',
   'system.latestVersion':       'string',
   'system.earlyAccess':         'boolean',
+  'autoUpdate.enabled':         'boolean',
+  'autoUpdate.windowStart':     'string',
+  'autoUpdate.windowEnd':       'string',
+  'autoUpdate.cooloffHours':    'string',
+  'autoUpdate.lastAttemptAt':   'string',
+  'autoUpdate.lastError':       'string',
+  'autoUpdate.lastResult':      'string',
+  'autoUpdate.consecutiveFailures': 'string',
+  'autoUpdate.autoDisabledReason':  'string',
   'ui.hasVisitedEasySetup':     'boolean',
   'ui.theme':                   'string',
   'ai.assistantCustomName':     'string',
diff --git a/admin/types/system.ts b/admin/types/system.ts
index c8ed4ab..265ea36 100644
--- a/admin/types/system.ts
+++ b/admin/types/system.ts
@@ -85,4 +85,25 @@ export type CheckLatestVersionResult = {
   currentVersion: string,
   latestVersion: string,
   message?: string
+}
+
+export type AutoUpdateEligibleTarget = {
+  version: string
+  tag: string
+  publishedAt: string
+}
+
+export type AutoUpdateStatus = {
+  enabled: boolean
+  windowStart: string
+  windowEnd: string
+  cooloffHours: number
+  currentVersion: string
+  withinWindow: boolean
+  eligibleTarget: AutoUpdateEligibleTarget | null
+  lastAttemptAt: string | null
+  lastResult: string | null
+  lastError: string | null
+  consecutiveFailures: number
+  autoDisabledReason: string | null
 }
\ No newline at end of file

From cf8db6218db7ecb0a98843e041b2e4ff3a51c314 Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Sun, 7 Jun 2026 21:07:46 +0000
Subject: [PATCH 28/83] feat(supply-depot): opt-in automatic updates for
 installed apps

---
 admin/app/controllers/system_controller.ts    |  40 ++
 admin/app/jobs/app_auto_update_job.ts         |  78 ++++
 admin/app/jobs/check_service_updates_job.ts   |   8 +
 admin/app/models/service.ts                   |  22 +
 admin/app/services/app_auto_update_service.ts | 398 +++++++++++++++++
 admin/app/services/auto_update_service.ts     |  90 +---
 admin/app/services/system_service.ts          |  10 +
 admin/app/utils/image_disk_preflight.ts       |  83 ++++
 admin/app/utils/update_window.ts              |  35 ++
 admin/app/validators/system.ts                |   9 +
 admin/commands/app_auto_update/dry_run.ts     | 227 ++++++++++
 admin/commands/queue/work.ts                  |   4 +
 admin/constants/kv_store.ts                   |   2 +-
 ..._add_app_auto_update_fields_to_services.ts |  28 ++
 admin/database/seeders/service_seeder.ts      |   4 +
 .../updates/AppAutoUpdateSection.tsx          | 101 +++++
 .../updates/ContentUpdatesSection.tsx         | 227 ++++++++++
 .../updates/CoreAutoUpdateSection.tsx         | 185 ++++++++
 admin/inertia/hooks/useAppAutoUpdateStatus.ts |  11 +
 admin/inertia/lib/api.ts                      |  19 +-
 admin/inertia/pages/settings/update.tsx       | 404 +-----------------
 admin/inertia/pages/supply-depot.tsx          |  64 ++-
 admin/start/routes.ts                         |   2 +
 admin/tests/unit/app_auto_update.spec.ts      | 143 +++++++
 admin/types/kv_store.ts                       |   3 +
 admin/types/services.ts                       |   1 +
 admin/types/system.ts                         |  25 ++
 27 files changed, 1749 insertions(+), 474 deletions(-)
 create mode 100644 admin/app/jobs/app_auto_update_job.ts
 create mode 100644 admin/app/services/app_auto_update_service.ts
 create mode 100644 admin/app/utils/image_disk_preflight.ts
 create mode 100644 admin/app/utils/update_window.ts
 create mode 100644 admin/commands/app_auto_update/dry_run.ts
 create mode 100644 admin/database/migrations/1772000000003_add_app_auto_update_fields_to_services.ts
 create mode 100644 admin/inertia/components/updates/AppAutoUpdateSection.tsx
 create mode 100644 admin/inertia/components/updates/ContentUpdatesSection.tsx
 create mode 100644 admin/inertia/components/updates/CoreAutoUpdateSection.tsx
 create mode 100644 admin/inertia/hooks/useAppAutoUpdateStatus.ts
 create mode 100644 admin/tests/unit/app_auto_update.spec.ts

diff --git a/admin/app/controllers/system_controller.ts b/admin/app/controllers/system_controller.ts
index 4acaab4..5443fe4 100644
--- a/admin/app/controllers/system_controller.ts
+++ b/admin/app/controllers/system_controller.ts
@@ -3,6 +3,7 @@ import { SystemService } from '#services/system_service'
 import { SystemUpdateService } from '#services/system_update_service'
 import { ContainerRegistryService } from '#services/container_registry_service'
 import { AutoUpdateService } from '#services/auto_update_service'
+import { AppAutoUpdateService } from '#services/app_auto_update_service'
 import { DownloadService } from '#services/download_service'
 import { QueueService } from '#services/queue_service'
 import { CheckServiceUpdatesJob } from '#jobs/check_service_updates_job'
@@ -18,6 +19,7 @@ import {
   subscribeToReleaseNotesValidator,
   updateCustomAppValidator,
   updateServiceValidator,
+  setServiceAutoUpdateValidator,
 } from '#validators/system'
 import {
   DEFAULT_CPUS,
@@ -150,6 +152,44 @@ export default class SystemController {
         }
     }
 
+    async getAppAutoUpdateStatus({ response }: HttpContext) {
+        // Constructed inline reusing already-injected singletons + the QueueService
+        // singleton (its constructor is private to prevent Redis connection leaks),
+        // mirroring getAutoUpdateStatus. Apps need no SystemUpdateService (no sidecar).
+        const appAutoUpdateService = new AppAutoUpdateService(
+            this.dockerService,
+            new DownloadService(QueueService.getInstance()),
+            this.systemService,
+            this.containerRegistryService
+        )
+
+        try {
+            const status = await appAutoUpdateService.getStatus()
+            response.send(status)
+        } catch (error) {
+            logger.error({ err: error }, '[SystemController] Failed to get app auto-update status')
+            response.status(500).send({ error: 'Failed to retrieve app auto-update status' })
+        }
+    }
+
+    async setServiceAutoUpdate({ request, response }: HttpContext) {
+        const payload = await request.validateUsing(setServiceAutoUpdateValidator)
+        const service = await Service.query().where('service_name', payload.service_name).first()
+        if (!service) {
+            return response.status(404).send({ error: `Service ${payload.service_name} not found` })
+        }
+
+        service.auto_update_enabled = payload.enabled
+        // Re-enabling clears any prior self-disable so the app gets a fresh start.
+        if (payload.enabled) {
+            service.auto_update_consecutive_failures = 0
+            service.auto_update_disabled_reason = null
+        }
+        await service.save()
+
+        return response.send({ success: true, message: 'App auto-update preference updated' })
+    }
+
 
     async subscribeToReleaseNotes({ request }: HttpContext) {
         const reqData = await request.validateUsing(subscribeToReleaseNotesValidator);
diff --git a/admin/app/jobs/app_auto_update_job.ts b/admin/app/jobs/app_auto_update_job.ts
new file mode 100644
index 0000000..3008901
--- /dev/null
+++ b/admin/app/jobs/app_auto_update_job.ts
@@ -0,0 +1,78 @@
+import { Job } from 'bullmq'
+import { QueueService } from '#services/queue_service'
+import { DockerService } from '#services/docker_service'
+import { DownloadService } from '#services/download_service'
+import { SystemService } from '#services/system_service'
+import { ContainerRegistryService } from '#services/container_registry_service'
+import { AppAutoUpdateService } from '#services/app_auto_update_service'
+import logger from '@adonisjs/core/services/logger'
+
+/**
+ * Hourly job that evaluates whether any opted-in installed apps should auto-update
+ * right now and, if so, updates them. All gating (master switch, per-app opt-in,
+ * window, cool-off, pre-flight, per-app backoff) lives in {@link AppAutoUpdateService};
+ * this job is just the scheduled trigger. Runs hourly so it can act anywhere inside a
+ * user's window regardless of the window's length. Mirrors {@link AutoUpdateJob}.
+ */
+export class AppAutoUpdateJob {
+  static get queue() {
+    return 'system'
+  }
+
+  static get key() {
+    return 'app-auto-update'
+  }
+
+  async handle(_job: Job) {
+    logger.info('[AppAutoUpdateJob] Evaluating app auto-updates...')
+
+    const dockerService = new DockerService()
+    const appAutoUpdateService = new AppAutoUpdateService(
+      dockerService,
+      new DownloadService(QueueService.getInstance()),
+      new SystemService(dockerService),
+      new ContainerRegistryService()
+    )
+
+    const result = await appAutoUpdateService.attempt()
+    logger.info(`[AppAutoUpdateJob] ${result.updated} updated: ${result.reason}`)
+    return result
+  }
+
+  static async schedule() {
+    const queueService = QueueService.getInstance()
+    const queue = queueService.getQueue(this.queue)
+
+    await queue.upsertJobScheduler(
+      'hourly-app-auto-update',
+      { pattern: '0 * * * *' }, // Top of every hour; attempt() gates on the window
+      {
+        name: this.key,
+        opts: {
+          removeOnComplete: { count: 12 },
+          removeOnFail: { count: 5 },
+        },
+      }
+    )
+
+    logger.info('[AppAutoUpdateJob] App auto-update evaluation scheduled with cron: 0 * * * *')
+  }
+
+  static async dispatch() {
+    const queueService = QueueService.getInstance()
+    const queue = queueService.getQueue(this.queue)
+
+    const job = await queue.add(
+      this.key,
+      {},
+      {
+        attempts: 1,
+        removeOnComplete: { count: 12 },
+        removeOnFail: { count: 5 },
+      }
+    )
+
+    logger.info(`[AppAutoUpdateJob] Dispatched ad-hoc app auto-update evaluation job ${job.id}`)
+    return job
+  }
+}
diff --git a/admin/app/jobs/check_service_updates_job.ts b/admin/app/jobs/check_service_updates_job.ts
index 58be73c..cdbf68e 100644
--- a/admin/app/jobs/check_service_updates_job.ts
+++ b/admin/app/jobs/check_service_updates_job.ts
@@ -39,6 +39,14 @@ export class CheckServiceUpdatesJob {
 
         const latestUpdate = updates.length > 0 ? updates[0].tag : null
 
+        // Stamp/clear the cool-off anchor only when the available version *changes*.
+        // Registry tags carry no publish date, so the auto-update cool-off is measured
+        // from when a version was first detected; leaving the timestamp untouched while
+        // the same version persists keeps the cool-off clock running.
+        if (latestUpdate !== service.available_update_version) {
+          service.available_update_first_seen_at = latestUpdate ? DateTime.now() : null
+        }
+
         service.available_update_version = latestUpdate
         service.update_checked_at = DateTime.now()
         await service.save()
diff --git a/admin/app/models/service.ts b/admin/app/models/service.ts
index b532f0f..debd701 100644
--- a/admin/app/models/service.ts
+++ b/admin/app/models/service.ts
@@ -88,6 +88,28 @@ export default class Service extends BaseModel {
   @column.dateTime()
   declare update_checked_at: DateTime | null
 
+  // Per-app opt-in for automatic updates. An app auto-updates only when both this
+  // and the global `appAutoUpdate.enabled` master switch are on.
+  @column({
+    serialize(value) {
+      return Boolean(value)
+    },
+  })
+  declare auto_update_enabled: boolean
+
+  // When the current `available_update_version` was first detected — the anchor for
+  // the auto-update cool-off (registry tags carry no publish timestamp).
+  @column.dateTime()
+  declare available_update_first_seen_at: DateTime | null
+
+  // Per-app auto-update failure backoff; at the threshold the app self-disables via
+  // `auto_update_disabled_reason` without affecting other apps.
+  @column()
+  declare auto_update_consecutive_failures: number
+
+  @column()
+  declare auto_update_disabled_reason: string | null
+
   @column.dateTime({ autoCreate: true })
   declare created_at: DateTime
 
diff --git a/admin/app/services/app_auto_update_service.ts b/admin/app/services/app_auto_update_service.ts
new file mode 100644
index 0000000..c6317b6
--- /dev/null
+++ b/admin/app/services/app_auto_update_service.ts
@@ -0,0 +1,398 @@
+import { inject } from '@adonisjs/core'
+import logger from '@adonisjs/core/services/logger'
+import { DateTime } from 'luxon'
+import KVStore from '#models/kv_store'
+import Service from '#models/service'
+import { DockerService } from '#services/docker_service'
+import { DownloadService } from '#services/download_service'
+import { SystemService } from '#services/system_service'
+import { ContainerRegistryService } from '#services/container_registry_service'
+import { isNewerVersion, parseMajorVersion } from '../utils/version.js'
+import { isWithinWindow } from '../utils/update_window.js'
+import {
+  checkImageDiskSpace,
+  type Blocker,
+  type PreflightResult,
+} from '../utils/image_disk_preflight.js'
+
+/**
+ * Defaults shared with the core auto-update. App auto-updates intentionally reuse
+ * the SAME window/cool-off settings (`autoUpdate.windowStart/windowEnd/cooloffHours`);
+ * only the enable flag (`appAutoUpdate.enabled`) is separate.
+ */
+const DEFAULT_WINDOW_START = '02:00'
+const DEFAULT_WINDOW_END = '05:00'
+const DEFAULT_COOLOFF_HOURS = 72
+
+/** Per-app genuine failures before that app self-disables (others keep running). */
+const MAX_CONSECUTIVE_FAILURES = 3
+
+export interface AppAutoUpdateConfig {
+  /** Global master switch (`appAutoUpdate.enabled`). */
+  enabled: boolean
+  windowStart: string
+  windowEnd: string
+  cooloffHours: number
+}
+
+/** An installed app that should be auto-updated this run. */
+export interface AppUpdateTarget {
+  service: Service
+  /** Exact registry tag to update to (the value in `available_update_version`). */
+  targetVersion: string
+}
+
+/** Per-app eligibility verdict (drives both selection and the status UI). */
+export interface AppEligibility {
+  eligible: boolean
+  reason: string
+  cooloffRemainingHours: number | null
+}
+
+export interface AppAutoUpdateAppStatus {
+  service_name: string
+  friendly_name: string | null
+  auto_update_enabled: boolean
+  current_version: string
+  available_update_version: string | null
+  first_seen_at: string | null
+  eligible: boolean
+  reason: string
+  cooloff_remaining_hours: number | null
+  consecutive_failures: number
+  auto_disabled_reason: string | null
+}
+
+export interface AppAutoUpdateStatus extends AppAutoUpdateConfig {
+  withinWindow: boolean
+  lastAttemptAt: string | null
+  lastResult: string | null
+  apps: AppAutoUpdateAppStatus[]
+}
+
+/**
+ * Decision + safety layer for automatic updates of installed sibling apps (the
+ * containers NOMAD deploys via the Docker socket and manages in Supply Depot).
+ *
+ * This is the app-side counterpart to {@link AutoUpdateService} and intentionally
+ * reuses its generic window/disk pre-flight helpers. Unlike the core update, an
+ * app update needs no sidecar — the admin container recreates its siblings directly
+ * via {@link DockerService.updateContainer} (in-process pull → rename → health-check
+ * → rollback). Auto-update only decides *whether* each opted-in app should update now
+ * (master switch on + per-app toggle on + in window + an eligible minor/patch past
+ * its cool-off + pre-flight passes) and then drives the existing update path.
+ *
+ * Minor/patch-only is already guaranteed upstream by
+ * {@link ContainerRegistryService.getAvailableUpdates} (same-major filter); the
+ * major-version check here is defense-in-depth.
+ */
+@inject()
+export class AppAutoUpdateService {
+  constructor(
+    private dockerService: DockerService,
+    private downloadService: DownloadService,
+    private systemService: SystemService,
+    private containerRegistryService: ContainerRegistryService
+  ) {}
+
+  /** Read the global master switch plus the shared window/cool-off settings. */
+  async getConfig(): Promise<AppAutoUpdateConfig> {
+    const [enabled, windowStart, windowEnd, cooloffHours] = await Promise.all([
+      KVStore.getValue('appAutoUpdate.enabled'),
+      KVStore.getValue('autoUpdate.windowStart'),
+      KVStore.getValue('autoUpdate.windowEnd'),
+      KVStore.getValue('autoUpdate.cooloffHours'),
+    ])
+
+    const parsedCooloff = Number(cooloffHours)
+    return {
+      enabled: enabled ?? false,
+      windowStart: windowStart || DEFAULT_WINDOW_START,
+      windowEnd: windowEnd || DEFAULT_WINDOW_END,
+      // `Number(null) === 0`, so an unset value must fall through to the default
+      // rather than silently resolving to a zero cool-off. An explicit 0 is honored.
+      cooloffHours:
+        cooloffHours !== null && Number.isFinite(parsedCooloff) && parsedCooloff >= 0
+          ? parsedCooloff
+          : DEFAULT_COOLOFF_HOURS,
+    }
+  }
+
+  /**
+   * Pure per-app eligibility verdict. An app is eligible when it has a detected
+   * update that is the same major (defense-in-depth), strictly newer, not self-
+   * disabled, and past its cool-off (measured from first-detected).
+   */
+  appEligibility(service: Service, cooloffHours: number, now: DateTime): AppEligibility {
+    if (!service.available_update_version) {
+      return { eligible: false, reason: 'Up to date', cooloffRemainingHours: null }
+    }
+    if (service.auto_update_disabled_reason) {
+      return {
+        eligible: false,
+        reason: 'Auto-update disabled after repeated failures',
+        cooloffRemainingHours: null,
+      }
+    }
+
+    const currentTag = this.containerRegistryService.parseImageReference(
+      service.container_image
+    ).tag
+    if (currentTag === 'latest') {
+      return {
+        eligible: false,
+        reason: 'Pinned to :latest — cannot version-check',
+        cooloffRemainingHours: null,
+      }
+    }
+    if (parseMajorVersion(service.available_update_version) !== parseMajorVersion(currentTag)) {
+      return {
+        eligible: false,
+        reason: 'Major version — manual update required',
+        cooloffRemainingHours: null,
+      }
+    }
+    if (!isNewerVersion(service.available_update_version, currentTag)) {
+      return { eligible: false, reason: 'Up to date', cooloffRemainingHours: null }
+    }
+    if (!service.available_update_first_seen_at) {
+      return { eligible: false, reason: 'Cool-off pending', cooloffRemainingHours: cooloffHours }
+    }
+
+    const ageHours = now.diff(service.available_update_first_seen_at, 'hours').hours
+    const remaining = cooloffHours - ageHours
+    if (remaining > 0) {
+      const rounded = Math.ceil(remaining)
+      return {
+        eligible: false,
+        reason: `In cool-off (${rounded}h remaining)`,
+        cooloffRemainingHours: rounded,
+      }
+    }
+
+    return {
+      eligible: true,
+      reason: `Eligible → ${service.available_update_version}`,
+      cooloffRemainingHours: 0,
+    }
+  }
+
+  /** Installed, opted-in apps that are eligible to update right now. */
+  async getEligibleApps(config: AppAutoUpdateConfig, now: DateTime): Promise<AppUpdateTarget[]> {
+    const apps = await Service.query().where('installed', true).where('auto_update_enabled', true)
+    const targets: AppUpdateTarget[] = []
+    for (const service of apps) {
+      const verdict = this.appEligibility(service, config.cooloffHours, now)
+      if (verdict.eligible) {
+        targets.push({ service, targetVersion: service.available_update_version! })
+      }
+    }
+    return targets
+  }
+
+  /**
+   * Run-wide pre-flight checked once per attempt (independent of any single app):
+   * never auto-update while content/model downloads are running. Transient → `skip`.
+   */
+  async runGlobalPreflight(): Promise<PreflightResult> {
+    const blockers: Blocker[] = []
+    try {
+      const downloads = await this.downloadService.listDownloadJobs()
+      const active = downloads.filter(
+        (d) => !!d.status && ['waiting', 'active', 'delayed'].includes(d.status)
+      )
+      if (active.length > 0) {
+        blockers.push({ reason: `${active.length} download(s) in progress`, severity: 'skip' })
+      }
+    } catch (error) {
+      logger.warn(`[AppAutoUpdateService] Could not check active downloads: ${error.message}`)
+    }
+    return { ok: blockers.length === 0, blockers }
+  }
+
+  /** Per-app pre-flight: not already mid-operation (`skip`) and enough disk (`failure`). */
+  async runAppPreflight(target: AppUpdateTarget): Promise<PreflightResult> {
+    const blockers: Blocker[] = []
+    const service = target.service
+
+    if (service.installation_status !== 'idle') {
+      blockers.push({
+        reason: `App has an operation in progress (status: ${service.installation_status})`,
+        severity: 'skip',
+      })
+    }
+
+    const hostArch = await this.getHostArch()
+    const targetImage = `${this.imageBase(service.container_image)}:${target.targetVersion}`
+    const diskBlocker = await checkImageDiskSpace({
+      image: targetImage,
+      hostArch,
+      containerRegistryService: this.containerRegistryService,
+      systemService: this.systemService,
+    })
+    if (diskBlocker) blockers.push(diskBlocker)
+
+    return { ok: blockers.length === 0, blockers }
+  }
+
+  /**
+   * Entry point invoked by AppAutoUpdateJob. Gates on the master switch + window,
+   * then runs each eligible app through pre-flight and {@link DockerService.updateContainer}.
+   * A failing app self-disables after repeated failures without affecting the others.
+   */
+  async attempt(): Promise<{ updated: number; reason: string }> {
+    const config = await this.getConfig()
+    const now = DateTime.now()
+
+    if (!config.enabled) {
+      return { updated: 0, reason: 'App auto-update is disabled' }
+    }
+    if (!isWithinWindow(config.windowStart, config.windowEnd, now)) {
+      const reason = `Outside update window (${config.windowStart}-${config.windowEnd})`
+      await this.recordRun(reason)
+      return { updated: 0, reason }
+    }
+
+    const eligible = await this.getEligibleApps(config, now)
+    if (eligible.length === 0) {
+      const reason = 'No eligible app updates (all current, in cool-off, or major-only)'
+      await this.recordRun(reason)
+      return { updated: 0, reason }
+    }
+
+    const global = await this.runGlobalPreflight()
+    if (!global.ok) {
+      const reason = `Pre-flight blocked: ${global.blockers.map((b) => b.reason).join('; ')}`
+      await this.recordRun(reason)
+      return { updated: 0, reason }
+    }
+
+    let updated = 0
+    let failed = 0
+    let skipped = 0
+
+    for (const target of eligible) {
+      const name = target.service.service_name
+      const preflight = await this.runAppPreflight(target)
+      if (!preflight.ok) {
+        const summary = preflight.blockers.map((b) => b.reason).join('; ')
+        if (preflight.blockers.some((b) => b.severity === 'failure')) {
+          await this.recordAppFailure(target.service, summary)
+          failed++
+        } else {
+          logger.info(`[AppAutoUpdateService] Skipped ${name}: ${summary}`)
+          skipped++
+        }
+        continue
+      }
+
+      logger.info(`[AppAutoUpdateService] Updating ${name} → ${target.targetVersion}`)
+      const result = await this.dockerService.updateContainer(name, target.targetVersion)
+      if (result.success) {
+        await this.recordAppSuccess(target.service)
+        updated++
+      } else {
+        await this.recordAppFailure(target.service, result.message)
+        failed++
+      }
+    }
+
+    const reason = `${updated} updated, ${failed} failed, ${skipped} skipped`
+    await this.recordRun(reason)
+    logger.info(`[AppAutoUpdateService] Run complete: ${reason}`)
+    return { updated, reason }
+  }
+
+  /** Clear an app's failure backoff after a successful auto-update. */
+  private async recordAppSuccess(service: Service): Promise<void> {
+    // updateContainer already advanced container_image and cleared
+    // available_update_version on its own (fresh) row; here we only touch the
+    // backoff fields, so Lucid persists just those dirty columns.
+    service.auto_update_consecutive_failures = 0
+    service.auto_update_disabled_reason = null
+    await service.save()
+  }
+
+  /** Record an app failure and self-disable it once the threshold is reached. */
+  private async recordAppFailure(service: Service, reason: string): Promise<void> {
+    const failures = (service.auto_update_consecutive_failures || 0) + 1
+    service.auto_update_consecutive_failures = failures
+    if (failures >= MAX_CONSECUTIVE_FAILURES) {
+      service.auto_update_disabled_reason = `Auto-update disabled after ${failures} consecutive failures. Last error: ${reason}`
+      logger.error(
+        `[AppAutoUpdateService] ${service.service_name} auto-disabled after ${failures} failures`
+      )
+    }
+    await service.save()
+    logger.error(
+      `[AppAutoUpdateService] ${service.service_name} failure ${failures}/${MAX_CONSECUTIVE_FAILURES}: ${reason}`
+    )
+  }
+
+  /** Record the global last-attempt summary for the settings UI. */
+  private async recordRun(reason: string): Promise<void> {
+    await KVStore.setValue('appAutoUpdate.lastAttemptAt', DateTime.now().toISO()!)
+    await KVStore.setValue('appAutoUpdate.lastResult', reason)
+  }
+
+  /** Full state snapshot for the settings UI (opted-in apps + their eligibility). */
+  async getStatus(): Promise<AppAutoUpdateStatus> {
+    const config = await this.getConfig()
+    const now = DateTime.now()
+
+    const apps = await Service.query().where('installed', true).where('auto_update_enabled', true)
+    const appStatuses: AppAutoUpdateAppStatus[] = apps.map((service) => {
+      const verdict = this.appEligibility(service, config.cooloffHours, now)
+      return {
+        service_name: service.service_name,
+        friendly_name: service.friendly_name,
+        auto_update_enabled: service.auto_update_enabled,
+        current_version: this.containerRegistryService.parseImageReference(service.container_image)
+          .tag,
+        available_update_version: service.available_update_version,
+        first_seen_at: service.available_update_first_seen_at?.toISO() ?? null,
+        eligible: verdict.eligible,
+        reason: verdict.reason,
+        cooloff_remaining_hours: verdict.cooloffRemainingHours,
+        consecutive_failures: service.auto_update_consecutive_failures || 0,
+        auto_disabled_reason: service.auto_update_disabled_reason,
+      }
+    })
+
+    const [lastAttemptAt, lastResult] = await Promise.all([
+      KVStore.getValue('appAutoUpdate.lastAttemptAt'),
+      KVStore.getValue('appAutoUpdate.lastResult'),
+    ])
+
+    return {
+      ...config,
+      withinWindow: isWithinWindow(config.windowStart, config.windowEnd, now),
+      lastAttemptAt: lastAttemptAt || null,
+      lastResult: lastResult || null,
+      apps: appStatuses,
+    }
+  }
+
+  /** Strip the tag from an image reference, leaving "registry/namespace/repo". */
+  private imageBase(image: string): string {
+    return image.includes(':') ? image.substring(0, image.lastIndexOf(':')) : image
+  }
+
+  /** Map the Docker daemon's architecture string to OCI naming (amd64/arm64/...). */
+  private async getHostArch(): Promise<string> {
+    try {
+      const info = await this.dockerService.docker.info()
+      const arch = info.Architecture || ''
+      const archMap: Record<string, string> = {
+        x86_64: 'amd64',
+        aarch64: 'arm64',
+        armv7l: 'arm',
+        amd64: 'amd64',
+        arm64: 'arm64',
+      }
+      return archMap[arch] || arch.toLowerCase()
+    } catch {
+      return 'amd64'
+    }
+  }
+}
diff --git a/admin/app/services/auto_update_service.ts b/admin/app/services/auto_update_service.ts
index 013f209..6d2bee7 100644
--- a/admin/app/services/auto_update_service.ts
+++ b/admin/app/services/auto_update_service.ts
@@ -10,6 +10,12 @@ import { SystemService } from '#services/system_service'
 import { SystemUpdateService } from '#services/system_update_service'
 import { ContainerRegistryService } from '#services/container_registry_service'
 import { isNewerVersion, parseMajorVersion } from '../utils/version.js'
+import { isWithinWindow as isWithinWindowUtil } from '../utils/update_window.js'
+import {
+  checkImageDiskSpace,
+  type Blocker,
+  type PreflightResult,
+} from '../utils/image_disk_preflight.js'
 
 /** Docker image repository for the NOMAD admin/core image (tag applied per-release). */
 const NOMAD_IMAGE_REPO = 'ghcr.io/crosstalk-solutions/project-nomad'
@@ -20,10 +26,6 @@ const DEFAULT_WINDOW_START = '02:00'
 const DEFAULT_WINDOW_END = '05:00'
 const DEFAULT_COOLOFF_HOURS = 72
 
-/** Require free space >= imageSize * factor to cover decompressed layers + headroom. */
-const DISK_SAFETY_FACTOR = 2
-/** Conservative fallback when the registry image size can't be determined. */
-const MIN_FREE_BYTES = 5 * 1024 * 1024 * 1024 // 5 GiB
 /** Genuine failures before auto-update disables itself to avoid an update loop. */
 const MAX_CONSECUTIVE_FAILURES = 3
 
@@ -53,16 +55,9 @@ export interface EligibleTarget {
   publishedAt: string
 }
 
-type BlockerSeverity = 'skip' | 'failure'
-export interface Blocker {
-  reason: string
-  severity: BlockerSeverity
-}
-
-export interface PreflightResult {
-  ok: boolean
-  blockers: Blocker[]
-}
+// Pre-flight types/primitives are shared with AppAutoUpdateService; re-exported
+// here for back-compat with existing imports of this module.
+export type { Blocker, BlockerSeverity, PreflightResult } from '../utils/image_disk_preflight.js'
 
 /** Minimal shape of a GitHub release entry we depend on. */
 export interface GithubRelease {
@@ -178,23 +173,7 @@ export class AutoUpdateService {
    * that wrap past midnight (start > end, e.g. 22:00-02:00) are handled.
    */
   isWithinWindow(config: AutoUpdateConfig, now: DateTime = DateTime.now()): boolean {
-    const start = this.parseMinutes(config.windowStart)
-    const end = this.parseMinutes(config.windowEnd)
-    if (start === null || end === null) return false
-
-    const current = now.hour * 60 + now.minute
-    if (start === end) return false // zero-length window
-    if (start < end) {
-      return current >= start && current < end
-    }
-    // Wraps midnight
-    return current >= start || current < end
-  }
-
-  private parseMinutes(hhmm: string): number | null {
-    const match = /^([01]\d|2[0-3]):([0-5]\d)$/.exec(hhmm)
-    if (!match) return null
-    return Number(match[1]) * 60 + Number(match[2])
+    return isWithinWindowUtil(config.windowStart, config.windowEnd, now)
   }
 
   /**
@@ -350,48 +329,13 @@ export class AutoUpdateService {
 
   /** Returns a disk blocker if free space is insufficient, otherwise null. */
   private async checkDiskSpace(targetTag: string): Promise<Blocker | null> {
-    try {
-      const hostArch = await this.getHostArch()
-      const parsed = this.containerRegistryService.parseImageReference(
-        `${NOMAD_IMAGE_REPO}:${targetTag}`
-      )
-      const imageSize = await this.containerRegistryService.getImageDownloadSize(
-        parsed,
-        targetTag,
-        hostArch
-      )
-      const required = imageSize !== null ? imageSize * DISK_SAFETY_FACTOR : MIN_FREE_BYTES
-
-      const free = await this.getFreeBytes()
-      if (free === null) {
-        logger.warn('[AutoUpdateService] Could not determine free disk space; skipping disk check')
-        return null
-      }
-
-      if (free < required) {
-        return {
-          reason: `Insufficient disk space: ${this.gib(free)} free, ${this.gib(required)} required`,
-          severity: 'failure',
-        }
-      }
-      return null
-    } catch (error) {
-      logger.warn(`[AutoUpdateService] Disk space check failed: ${error.message}`)
-      return null
-    }
-  }
-
-  /** Free bytes on the root filesystem (best-effort, falls back to max available). */
-  private async getFreeBytes(): Promise<number | null> {
-    const info = await this.systemService.getSystemInfo()
-    if (!info?.fsSize?.length) return null
-    const root = info.fsSize.find((f) => f.mount === '/')
-    if (root) return root.available
-    return Math.max(...info.fsSize.map((f) => f.available))
-  }
-
-  private gib(bytes: number): string {
-    return `${(bytes / 1024 / 1024 / 1024).toFixed(1)} GiB`
+    const hostArch = await this.getHostArch()
+    return checkImageDiskSpace({
+      image: `${NOMAD_IMAGE_REPO}:${targetTag}`,
+      hostArch,
+      containerRegistryService: this.containerRegistryService,
+      systemService: this.systemService,
+    })
   }
 
   /** Map the Docker daemon's architecture string to OCI naming (amd64/arm64/...). */
diff --git a/admin/app/services/system_service.ts b/admin/app/services/system_service.ts
index f261496..21bb422 100644
--- a/admin/app/services/system_service.ts
+++ b/admin/app/services/system_service.ts
@@ -309,6 +309,7 @@ export class SystemService {
         'display_order',
         'container_image',
         'available_update_version',
+        'auto_update_enabled',
         'is_custom',
         'is_user_modified',
         'category'
@@ -341,6 +342,7 @@ export class SystemService {
         display_order: service.display_order,
         container_image: service.container_image,
         available_update_version: service.available_update_version,
+        auto_update_enabled: service.auto_update_enabled,
         is_custom: service.is_custom,
         is_user_modified: service.is_user_modified,
         category: service.category,
@@ -838,6 +840,14 @@ export class SystemService {
       await KVStore.setValue('autoUpdate.consecutiveFailures', '0')
       await KVStore.clearValue('autoUpdate.autoDisabledReason')
     }
+    // Re-enabling the global app auto-update master switch clears every app's
+    // per-app failure backoff so previously self-disabled apps get a fresh start.
+    if (key === 'appAutoUpdate.enabled' && (value === true || value === 'true')) {
+      await Service.query().update({
+        auto_update_consecutive_failures: 0,
+        auto_update_disabled_reason: null,
+      })
+    }
   }
 
   /**
diff --git a/admin/app/utils/image_disk_preflight.ts b/admin/app/utils/image_disk_preflight.ts
new file mode 100644
index 0000000..cabf4e3
--- /dev/null
+++ b/admin/app/utils/image_disk_preflight.ts
@@ -0,0 +1,83 @@
+import logger from '@adonisjs/core/services/logger'
+import type { ContainerRegistryService } from '#services/container_registry_service'
+import type { SystemService } from '#services/system_service'
+
+/**
+ * Shared pre-flight primitives for update flows (core app + installed apps).
+ * Kept framework-light (plain functions + injected service instances) so both
+ * {@link AutoUpdateService} and {@link AppAutoUpdateService} reuse one implementation.
+ */
+
+export type BlockerSeverity = 'skip' | 'failure'
+
+export interface Blocker {
+  reason: string
+  severity: BlockerSeverity
+}
+
+export interface PreflightResult {
+  ok: boolean
+  blockers: Blocker[]
+}
+
+/** Require free space >= imageSize * factor to cover decompressed layers + headroom. */
+export const DISK_SAFETY_FACTOR = 2
+/** Conservative fallback when the registry image size can't be determined. */
+export const MIN_FREE_BYTES = 5 * 1024 * 1024 * 1024 // 5 GiB
+
+/** Free bytes on the root filesystem (best-effort, falls back to max available). */
+export async function getFreeBytes(systemService: SystemService): Promise<number | null> {
+  const info = await systemService.getSystemInfo()
+  if (!info?.fsSize?.length) return null
+  const root = info.fsSize.find((f) => f.mount === '/')
+  if (root) return root.available
+  return Math.max(...info.fsSize.map((f) => f.available))
+}
+
+function gib(bytes: number): string {
+  return `${(bytes / 1024 / 1024 / 1024).toFixed(1)} GiB`
+}
+
+/**
+ * Returns a `failure` disk blocker if free space is insufficient for the given
+ * image reference, otherwise null. Mirrors the core update's behavior: estimate
+ * the image's compressed download size from the registry manifest, require
+ * `size * DISK_SAFETY_FACTOR` (or {@link MIN_FREE_BYTES} when size is unknown),
+ * and never block on transient lookup errors (returns null on failure).
+ *
+ * @param image Full image reference INCLUDING tag (e.g. "ollama/ollama:0.23.2").
+ */
+export async function checkImageDiskSpace(params: {
+  image: string
+  hostArch: string
+  containerRegistryService: ContainerRegistryService
+  systemService: SystemService
+}): Promise<Blocker | null> {
+  const { image, hostArch, containerRegistryService, systemService } = params
+  try {
+    const parsed = containerRegistryService.parseImageReference(image)
+    const imageSize = await containerRegistryService.getImageDownloadSize(
+      parsed,
+      parsed.tag,
+      hostArch
+    )
+    const required = imageSize !== null ? imageSize * DISK_SAFETY_FACTOR : MIN_FREE_BYTES
+
+    const free = await getFreeBytes(systemService)
+    if (free === null) {
+      logger.warn('[ImageDiskPreflight] Could not determine free disk space; skipping disk check')
+      return null
+    }
+
+    if (free < required) {
+      return {
+        reason: `Insufficient disk space: ${gib(free)} free, ${gib(required)} required`,
+        severity: 'failure',
+      }
+    }
+    return null
+  } catch (error) {
+    logger.warn(`[ImageDiskPreflight] Disk space check failed: ${error.message}`)
+    return null
+  }
+}
diff --git a/admin/app/utils/update_window.ts b/admin/app/utils/update_window.ts
new file mode 100644
index 0000000..87597ab
--- /dev/null
+++ b/admin/app/utils/update_window.ts
@@ -0,0 +1,35 @@
+import { DateTime } from 'luxon'
+
+/**
+ * Shared update-window helpers used by both the core auto-update
+ * ({@link AutoUpdateService}) and the per-app auto-update ({@link AppAutoUpdateService}).
+ *
+ * The window is interpreted in the container's local time (set via the TZ env var).
+ * Windows that wrap past midnight (start > end, e.g. 22:00-02:00) are supported.
+ */
+
+/** Parse an "HH:MM" 24-hour string into minutes-since-midnight, or null if malformed. */
+export function parseWindowMinutes(hhmm: string): number | null {
+  const match = /^([01]\d|2[0-3]):([0-5]\d)$/.exec(hhmm)
+  if (!match) return null
+  return Number(match[1]) * 60 + Number(match[2])
+}
+
+/** Whether `now` falls inside the [windowStart, windowEnd) window (handles midnight wrap). */
+export function isWithinWindow(
+  windowStart: string,
+  windowEnd: string,
+  now: DateTime = DateTime.now()
+): boolean {
+  const start = parseWindowMinutes(windowStart)
+  const end = parseWindowMinutes(windowEnd)
+  if (start === null || end === null) return false
+
+  const current = now.hour * 60 + now.minute
+  if (start === end) return false // zero-length window
+  if (start < end) {
+    return current >= start && current < end
+  }
+  // Wraps midnight
+  return current >= start || current < end
+}
diff --git a/admin/app/validators/system.ts b/admin/app/validators/system.ts
index 5e9b915..84dfa74 100644
--- a/admin/app/validators/system.ts
+++ b/admin/app/validators/system.ts
@@ -38,6 +38,15 @@ export const preflightValidator = vine.compile(
   })
 )
 
+// Toggle per-app automatic updates (opt-in). The global master switch lives in
+// the KVStore (`appAutoUpdate.enabled`) and flows through the settings endpoint.
+export const setServiceAutoUpdateValidator = vine.compile(
+  vine.object({
+    service_name: vine.string().trim(),
+    enabled: vine.boolean(),
+  })
+)
+
 // Shared sub-schema for a volume bind mapping. A colon is Docker's bind delimiter
 // (host:container:options) — forbid it in either field so a path can't smuggle in an
 // extra segment that the guard reads as safe but Docker re-parses as a different mount.
diff --git a/admin/commands/app_auto_update/dry_run.ts b/admin/commands/app_auto_update/dry_run.ts
new file mode 100644
index 0000000..40baa96
--- /dev/null
+++ b/admin/commands/app_auto_update/dry_run.ts
@@ -0,0 +1,227 @@
+import { BaseCommand, flags } from '@adonisjs/core/ace'
+import type { CommandOptions } from '@adonisjs/core/types/ace'
+
+/**
+ * Exercise the app auto-update decision logic WITHOUT ever triggering a real update.
+ *
+ *   # Prove the per-app eligibility + window logic deterministically (no DB/Docker):
+ *   node ace app-auto-update:dry-run --scenarios
+ *
+ *   # Show, against the live DB, which opted-in apps WOULD update right now:
+ *   node ace app-auto-update:dry-run
+ */
+export default class AppAutoUpdateDryRun extends BaseCommand {
+  static commandName = 'app-auto-update:dry-run'
+  static description = 'Dry-run the app auto-update decision logic (never triggers an update)'
+
+  @flags.boolean({ description: 'Run the built-in deterministic scenario suite and exit' })
+  declare scenarios: boolean
+
+  static options: CommandOptions = {
+    startApp: true,
+  }
+
+  async run() {
+    const { DateTime } = await import('luxon')
+    const { DockerService } = await import('#services/docker_service')
+    const { DownloadService } = await import('#services/download_service')
+    const { SystemService } = await import('#services/system_service')
+    const { ContainerRegistryService } = await import('#services/container_registry_service')
+    const { QueueService } = await import('#services/queue_service')
+    const { AppAutoUpdateService } = await import('#services/app_auto_update_service')
+    const { isWithinWindow } = await import('../../app/utils/update_window.js')
+
+    const dockerService = new DockerService()
+    const svc = new AppAutoUpdateService(
+      dockerService,
+      new DownloadService(QueueService.getInstance()),
+      new SystemService(dockerService),
+      new ContainerRegistryService()
+    )
+
+    if (this.scenarios) {
+      const ok = this.runScenarios(svc, DateTime, isWithinWindow)
+      if (!ok) this.exitCode = 1
+      return
+    }
+
+    // --- Live read-only snapshot (no update triggered) ----------------------
+    const status = await svc.getStatus()
+    this.logger.log('')
+    this.logger.log(`  Master switch   : ${status.enabled ? 'enabled' : 'disabled'}`)
+    this.logger.log(
+      `  Window          : ${status.windowStart}-${status.windowEnd} ` +
+        `(currently ${status.withinWindow ? 'inside' : 'outside'})`
+    )
+    this.logger.log(`  Cool-off hours  : ${status.cooloffHours}`)
+    this.logger.log('')
+    if (status.apps.length === 0) {
+      this.logger.info('No apps are opted into auto-update.')
+      return
+    }
+    this.logger.log('Opted-in apps:')
+    for (const app of status.apps) {
+      const tag = app.eligible ? this.colors.green('WOULD UPDATE') : this.colors.dim('skip')
+      this.logger.log(
+        `  ${tag}  ${app.friendly_name || app.service_name}: ${app.current_version}` +
+          `${app.available_update_version ? ' → ' + app.available_update_version : ''} — ${app.reason}`
+      )
+    }
+  }
+
+  /**
+   * Deterministic acceptance suite over the pure decision helpers — no DB or Docker.
+   * Uses ContainerRegistryService.parseImageReference (pure) via appEligibility.
+   */
+  private runScenarios(svc: any, DateTime: any, isWithinWindow: any): boolean {
+    const now = DateTime.fromISO('2026-06-04T12:00:00Z')
+    const daysAgo = (d: number) => now.minus({ days: d })
+    const hoursAgo = (h: number) => now.minus({ hours: h })
+
+    const mk = (o: Record<string, any>) => ({
+      service_name: 'nomad_test',
+      container_image: 'ollama/ollama:0.18.1',
+      available_update_version: null,
+      available_update_first_seen_at: null,
+      auto_update_disabled_reason: null,
+      ...o,
+    })
+
+    type Case = { name: string; service: any; cooloff: number; expect: boolean }
+    const cases: Case[] = [
+      { name: 'no update → not eligible', service: mk({}), cooloff: 72, expect: false },
+      {
+        name: 'major bump → not eligible',
+        service: mk({
+          available_update_version: '1.0.0',
+          available_update_first_seen_at: daysAgo(10),
+        }),
+        cooloff: 72,
+        expect: false,
+      },
+      {
+        name: 'minor newer inside cool-off → not eligible',
+        service: mk({
+          available_update_version: '0.19.0',
+          available_update_first_seen_at: hoursAgo(10),
+        }),
+        cooloff: 72,
+        expect: false,
+      },
+      {
+        name: 'minor newer past cool-off → eligible',
+        service: mk({
+          available_update_version: '0.19.0',
+          available_update_first_seen_at: daysAgo(5),
+        }),
+        cooloff: 72,
+        expect: true,
+      },
+      {
+        name: 'null first-seen → not eligible',
+        service: mk({ available_update_version: '0.19.0', available_update_first_seen_at: null }),
+        cooloff: 72,
+        expect: false,
+      },
+      {
+        name: 'self-disabled → not eligible',
+        service: mk({
+          available_update_version: '0.19.0',
+          available_update_first_seen_at: daysAgo(30),
+          auto_update_disabled_reason: 'disabled',
+        }),
+        cooloff: 72,
+        expect: false,
+      },
+      {
+        name: ':latest pinned → not eligible',
+        service: mk({
+          container_image: 'foo/bar:latest',
+          available_update_version: '1.2.3',
+          available_update_first_seen_at: daysAgo(30),
+        }),
+        cooloff: 72,
+        expect: false,
+      },
+      {
+        name: 'cool-off 0 applies immediately',
+        service: mk({
+          available_update_version: '0.18.2',
+          available_update_first_seen_at: hoursAgo(1),
+        }),
+        cooloff: 0,
+        expect: true,
+      },
+    ]
+
+    type WinCase = { name: string; start: string; end: string; at: string; expect: boolean }
+    const at = (hhmm: string) => `2026-06-04T${hhmm}:00`
+    const windows: WinCase[] = [
+      {
+        name: 'normal 20:00-23:00 @ 21:00 → in',
+        start: '20:00',
+        end: '23:00',
+        at: at('21:00'),
+        expect: true,
+      },
+      {
+        name: 'normal 20:00-23:00 @ 19:00 → out',
+        start: '20:00',
+        end: '23:00',
+        at: at('19:00'),
+        expect: false,
+      },
+      {
+        name: 'wrap 22:00-02:00 @ 01:00 → in',
+        start: '22:00',
+        end: '02:00',
+        at: at('01:00'),
+        expect: true,
+      },
+      {
+        name: 'wrap 22:00-02:00 @ 12:00 → out',
+        start: '22:00',
+        end: '02:00',
+        at: at('12:00'),
+        expect: false,
+      },
+    ]
+
+    let passed = 0
+    let failed = 0
+
+    this.logger.log('')
+    this.logger.log('Eligibility scenarios:')
+    for (const c of cases) {
+      const got = svc.appEligibility(c.service, c.cooloff, now).eligible
+      const ok = got === c.expect
+      this.report(ok, `${c.name} (expected ${c.expect}, got ${got})`)
+      ok ? passed++ : failed++
+    }
+
+    this.logger.log('')
+    this.logger.log('Window scenarios:')
+    for (const c of windows) {
+      const got = isWithinWindow(c.start, c.end, DateTime.fromISO(c.at))
+      const ok = got === c.expect
+      this.report(ok, `${c.name} (expected ${c.expect}, got ${got})`)
+      ok ? passed++ : failed++
+    }
+
+    this.logger.log('')
+    if (failed === 0) {
+      this.logger.success(`All ${passed} scenarios passed`)
+    } else {
+      this.logger.error(`${failed} scenario(s) failed, ${passed} passed`)
+    }
+    return failed === 0
+  }
+
+  private report(ok: boolean, message: string) {
+    if (ok) {
+      this.logger.log(`  ${this.colors.green('✓')} ${message}`)
+    } else {
+      this.logger.log(`  ${this.colors.red('✗')} ${message}`)
+    }
+  }
+}
diff --git a/admin/commands/queue/work.ts b/admin/commands/queue/work.ts
index 7e68122..6db7f80 100644
--- a/admin/commands/queue/work.ts
+++ b/admin/commands/queue/work.ts
@@ -10,6 +10,7 @@ import { EmbedFileJob } from '#jobs/embed_file_job'
 import { CheckUpdateJob } from '#jobs/check_update_job'
 import { CheckServiceUpdatesJob } from '#jobs/check_service_updates_job'
 import { AutoUpdateJob } from '#jobs/auto_update_job'
+import { AppAutoUpdateJob } from '#jobs/app_auto_update_job'
 
 export default class QueueWork extends BaseCommand {
   static commandName = 'queue:work'
@@ -105,6 +106,7 @@ export default class QueueWork extends BaseCommand {
     await CheckUpdateJob.scheduleNightly()
     await CheckServiceUpdatesJob.scheduleNightly()
     await AutoUpdateJob.schedule()
+    await AppAutoUpdateJob.schedule()
 
     // Safety net: log unhandled rejections instead of crashing the worker process.
     // Individual job errors are already caught by BullMQ; this catches anything that
@@ -136,6 +138,7 @@ export default class QueueWork extends BaseCommand {
     handlers.set(CheckUpdateJob.key, new CheckUpdateJob())
     handlers.set(CheckServiceUpdatesJob.key, new CheckServiceUpdatesJob())
     handlers.set(AutoUpdateJob.key, new AutoUpdateJob())
+    handlers.set(AppAutoUpdateJob.key, new AppAutoUpdateJob())
 
     queues.set(RunDownloadJob.key, RunDownloadJob.queue)
     queues.set(RunExtractPmtilesJob.key, RunExtractPmtilesJob.queue)
@@ -145,6 +148,7 @@ export default class QueueWork extends BaseCommand {
     queues.set(CheckUpdateJob.key, CheckUpdateJob.queue)
     queues.set(CheckServiceUpdatesJob.key, CheckServiceUpdatesJob.queue)
     queues.set(AutoUpdateJob.key, AutoUpdateJob.queue)
+    queues.set(AppAutoUpdateJob.key, AppAutoUpdateJob.queue)
 
     return [handlers, queues]
   }
diff --git a/admin/constants/kv_store.ts b/admin/constants/kv_store.ts
index da7a3cb..3c66261 100644
--- a/admin/constants/kv_store.ts
+++ b/admin/constants/kv_store.ts
@@ -1,3 +1,3 @@
 import { KVStoreKey } from "../types/kv_store.js";
 
-export const SETTINGS_KEYS: KVStoreKey[] = ['chat.suggestionsEnabled', 'chat.lastModel', 'ui.hasVisitedEasySetup', 'ui.theme', 'system.earlyAccess', 'ai.assistantCustomName', 'ai.remoteOllamaUrl', 'ai.ollamaFlashAttention', 'rag.defaultIngestPolicy', 'autoUpdate.enabled', 'autoUpdate.windowStart', 'autoUpdate.windowEnd', 'autoUpdate.cooloffHours'];
\ No newline at end of file
+export const SETTINGS_KEYS: KVStoreKey[] = ['chat.suggestionsEnabled', 'chat.lastModel', 'ui.hasVisitedEasySetup', 'ui.theme', 'system.earlyAccess', 'ai.assistantCustomName', 'ai.remoteOllamaUrl', 'ai.ollamaFlashAttention', 'rag.defaultIngestPolicy', 'autoUpdate.enabled', 'autoUpdate.windowStart', 'autoUpdate.windowEnd', 'autoUpdate.cooloffHours', 'appAutoUpdate.enabled'];
\ No newline at end of file
diff --git a/admin/database/migrations/1772000000003_add_app_auto_update_fields_to_services.ts b/admin/database/migrations/1772000000003_add_app_auto_update_fields_to_services.ts
new file mode 100644
index 0000000..6a7feea
--- /dev/null
+++ b/admin/database/migrations/1772000000003_add_app_auto_update_fields_to_services.ts
@@ -0,0 +1,28 @@
+import { BaseSchema } from '@adonisjs/lucid/schema'
+
+export default class extends BaseSchema {
+  protected tableName = 'services'
+
+  async up() {
+    this.schema.alterTable(this.tableName, (table) => {
+      // Per-app opt-in for automatic updates (gated additionally by the global
+      // `appAutoUpdate.enabled` master switch). Default off — auto-update is opt-in.
+      table.boolean('auto_update_enabled').notNullable().defaultTo(false)
+      // Cool-off anchor: when the currently-available update was first detected.
+      // Registry tags carry no publish date, so cool-off is measured from first-seen.
+      table.timestamp('available_update_first_seen_at').nullable()
+      // Per-app failure backoff so one flapping app self-disables without affecting others.
+      table.integer('auto_update_consecutive_failures').notNullable().defaultTo(0)
+      table.string('auto_update_disabled_reason', 255).nullable()
+    })
+  }
+
+  async down() {
+    this.schema.alterTable(this.tableName, (table) => {
+      table.dropColumn('auto_update_enabled')
+      table.dropColumn('available_update_first_seen_at')
+      table.dropColumn('auto_update_consecutive_failures')
+      table.dropColumn('auto_update_disabled_reason')
+    })
+  }
+}
diff --git a/admin/database/seeders/service_seeder.ts b/admin/database/seeders/service_seeder.ts
index e67ac90..b691cdc 100644
--- a/admin/database/seeders/service_seeder.ts
+++ b/admin/database/seeders/service_seeder.ts
@@ -14,6 +14,10 @@ type ServiceSeedRecord = Omit<
   | 'update_checked_at'
   | 'metadata'
   | 'is_user_modified'
+  | 'auto_update_enabled'
+  | 'available_update_first_seen_at'
+  | 'auto_update_consecutive_failures'
+  | 'auto_update_disabled_reason'
 > & { metadata?: string | null }
 
 export default class ServiceSeeder extends BaseSeeder {
diff --git a/admin/inertia/components/updates/AppAutoUpdateSection.tsx b/admin/inertia/components/updates/AppAutoUpdateSection.tsx
new file mode 100644
index 0000000..8dc29a7
--- /dev/null
+++ b/admin/inertia/components/updates/AppAutoUpdateSection.tsx
@@ -0,0 +1,101 @@
+import StyledSectionHeader from '~/components/StyledSectionHeader'
+import Switch from '~/components/inputs/Switch'
+import api from '~/lib/api'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import { useNotifications } from '~/context/NotificationContext'
+import { useAppAutoUpdateStatus } from '~/hooks/useAppAutoUpdateStatus'
+
+export default function AppAutoUpdateSection() {
+  const { addNotification } = useNotifications()
+  const queryClient = useQueryClient()
+  const { data: status, isLoading } = useAppAutoUpdateStatus()
+
+  const enabled = status?.enabled ?? false
+
+  const toggleMutation = useMutation({
+    mutationFn: (value: boolean) => api.updateSetting('appAutoUpdate.enabled', value),
+    onSuccess: (_data, value) => {
+      queryClient.invalidateQueries({ queryKey: ['app-auto-update-status'] })
+      addNotification({
+        type: 'success',
+        message: value ? 'App automatic updates enabled.' : 'App automatic updates disabled.',
+      })
+    },
+    onError: () => {
+      addNotification({ type: 'error', message: 'Failed to update app auto-update setting.' })
+    },
+  })
+
+  return (
+    <>
+      <StyledSectionHeader title="Automatic App Updates" className="mt-8" />
+      <div className="bg-surface-primary rounded-lg border shadow-md overflow-hidden mt-6 p-6">
+        <Switch
+          checked={enabled}
+          onChange={(value) => toggleMutation.mutate(value)}
+          disabled={toggleMutation.isPending || isLoading}
+          label="Enable Automatic App Updates"
+          description="Automatically install minor and patch updates for apps you've opted in (toggle each app in Supply Depot). Major versions always require a manual update. Uses the same update window and cool-off period as the core schedule above."
+        />
+
+        {enabled && status && (
+          <div className="mt-6 pt-4 border-t border-desert-stone-light text-sm">
+            <p className="text-desert-stone mb-3">
+              <span className="font-medium">Update window: </span>
+              {status.windowStart}–{status.windowEnd} (
+              {status.withinWindow ? 'currently inside' : 'currently outside'}); cool-off{' '}
+              {status.cooloffHours}h.
+              {status.lastResult && (
+                <>
+                  {' '}
+                  <span className="font-medium">Last run: </span>
+                  {status.lastResult}
+                  {status.lastAttemptAt
+                    ? ` (${new Date(status.lastAttemptAt).toLocaleString()})`
+                    : ''}
+                </>
+              )}
+            </p>
+
+            {status.apps.length === 0 ? (
+              <p className="text-desert-stone-dark">
+                No apps are opted in yet. Enable auto-update on individual apps from the Supply Depot.
+              </p>
+            ) : (
+              <ul className="space-y-2">
+                {status.apps.map((app) => (
+                  <li
+                    key={app.service_name}
+                    className="flex items-start justify-between gap-4 rounded-md bg-surface-secondary px-3 py-2"
+                  >
+                    <div>
+                      <p className="font-medium text-text-primary">
+                        {app.friendly_name || app.service_name}
+                      </p>
+                      <p className="text-desert-stone">
+                        {app.current_version}
+                        {app.available_update_version
+                          ? ` → ${app.available_update_version}`
+                          : ' (up to date)'}
+                      </p>
+                      {app.auto_disabled_reason && (
+                        <p className="text-desert-red mt-0.5">{app.auto_disabled_reason}</p>
+                      )}
+                    </div>
+                    <span
+                      className={`shrink-0 text-xs font-medium ${
+                        app.eligible ? 'text-desert-green' : 'text-desert-stone'
+                      }`}
+                    >
+                      {app.reason}
+                    </span>
+                  </li>
+                ))}
+              </ul>
+            )}
+          </div>
+        )}
+      </div>
+    </>
+  )
+}
diff --git a/admin/inertia/components/updates/ContentUpdatesSection.tsx b/admin/inertia/components/updates/ContentUpdatesSection.tsx
new file mode 100644
index 0000000..d71e1fa
--- /dev/null
+++ b/admin/inertia/components/updates/ContentUpdatesSection.tsx
@@ -0,0 +1,227 @@
+import { useState } from 'react'
+import StyledButton from '~/components/StyledButton'
+import StyledTable from '~/components/StyledTable'
+import StyledSectionHeader from '~/components/StyledSectionHeader'
+import ActiveDownloads from '~/components/ActiveDownloads'
+import Alert from '~/components/Alert'
+import type { ContentUpdateCheckResult, ResourceUpdateInfo } from '../../../types/collections'
+import api from '~/lib/api'
+import { useQueryClient } from '@tanstack/react-query'
+import { useNotifications } from '~/context/NotificationContext'
+import { formatBytes } from '~/lib/util'
+
+export default function ContentUpdatesSection() {
+  const { addNotification } = useNotifications()
+  const queryClient = useQueryClient()
+  const [checkResult, setCheckResult] = useState<ContentUpdateCheckResult | null>(null)
+  const [isChecking, setIsChecking] = useState(false)
+  const [applyingIds, setApplyingIds] = useState<Set<string>>(new Set())
+  const [isApplyingAll, setIsApplyingAll] = useState(false)
+
+  const handleCheck = async () => {
+    setIsChecking(true)
+    try {
+      const result = await api.checkForContentUpdates()
+      if (result) {
+        setCheckResult(result)
+      }
+    } catch {
+      setCheckResult({
+        updates: [],
+        checked_at: new Date().toISOString(),
+        error: 'Failed to check for content updates',
+      })
+    } finally {
+      setIsChecking(false)
+    }
+  }
+
+  const handleApply = async (update: ResourceUpdateInfo) => {
+    setApplyingIds((prev) => new Set(prev).add(update.resource_id))
+    try {
+      const result = await api.applyContentUpdate(update)
+      if (result?.success) {
+        addNotification({ type: 'success', message: `Update started for ${update.resource_id}` })
+        // Remove from the updates list
+        setCheckResult((prev) =>
+          prev
+            ? { ...prev, updates: prev.updates.filter((u) => u.resource_id !== update.resource_id) }
+            : prev
+        )
+        // Force Active Downloads to refetch now — small updates finish before the next
+        // idle poll fires, so without this the user wouldn't see them.
+        queryClient.invalidateQueries({ queryKey: ['download-jobs'] })
+      } else {
+        addNotification({ type: 'error', message: result?.error || 'Failed to start update' })
+      }
+    } catch {
+      addNotification({ type: 'error', message: `Failed to start update for ${update.resource_id}` })
+    } finally {
+      setApplyingIds((prev) => {
+        const next = new Set(prev)
+        next.delete(update.resource_id)
+        return next
+      })
+    }
+  }
+
+  const handleApplyAll = async () => {
+    if (!checkResult?.updates.length) return
+    setIsApplyingAll(true)
+    try {
+      const result = await api.applyAllContentUpdates(checkResult.updates)
+      if (result?.results) {
+        const succeeded = result.results.filter((r) => r.success).length
+        const failed = result.results.filter((r) => !r.success).length
+        if (succeeded > 0) {
+          addNotification({ type: 'success', message: `Started ${succeeded} update(s)` })
+        }
+        if (failed > 0) {
+          addNotification({ type: 'error', message: `${failed} update(s) could not be started` })
+        }
+        // Remove successful updates from the list
+        const successIds = new Set(result.results.filter((r) => r.success).map((r) => r.resource_id))
+        setCheckResult((prev) =>
+          prev
+            ? { ...prev, updates: prev.updates.filter((u) => !successIds.has(u.resource_id)) }
+            : prev
+        )
+        if (successIds.size > 0) {
+          queryClient.invalidateQueries({ queryKey: ['download-jobs'] })
+        }
+      }
+    } catch {
+      addNotification({ type: 'error', message: 'Failed to apply updates' })
+    } finally {
+      setIsApplyingAll(false)
+    }
+  }
+
+  return (
+    <div className="mt-8">
+      <StyledSectionHeader title="Content Updates" />
+
+      <div className="bg-surface-primary rounded-lg border shadow-md overflow-hidden p-6">
+        <div className="flex items-center justify-between">
+          <p className="text-desert-stone-dark">
+            Check if newer versions of your installed ZIM files and maps are available.
+          </p>
+          <StyledButton
+            variant="primary"
+            icon="IconRefresh"
+            onClick={handleCheck}
+            loading={isChecking}
+          >
+            Check for Content Updates
+          </StyledButton>
+        </div>
+
+        {checkResult?.error && (
+          <Alert
+            type="warning"
+            title="Update Check Issue"
+            message={checkResult.error}
+            variant="bordered"
+            className="my-4"
+          />
+        )}
+
+        {checkResult && !checkResult.error && checkResult.updates.length === 0 && (
+          <Alert
+            type="success"
+            title="All Content Up to Date"
+            message="All your installed content is running the latest available version."
+            variant="bordered"
+            className="my-4"
+          />
+        )}
+
+        {checkResult && checkResult.updates.length > 0 && (
+          <div className="mt-4">
+            <div className="flex items-center justify-between mb-3">
+              <p className="text-sm text-desert-stone-dark">
+                {checkResult.updates.length} update(s) available
+              </p>
+              <StyledButton
+                variant="primary"
+                size="sm"
+                icon="IconDownload"
+                onClick={handleApplyAll}
+                loading={isApplyingAll}
+              >
+                Update All ({checkResult.updates.length})
+              </StyledButton>
+            </div>
+            <StyledTable
+              data={checkResult.updates}
+              columns={[
+                {
+                  accessor: 'resource_id',
+                  title: 'Title',
+                  render: (record) => (
+                    <span className="font-medium text-desert-green">{record.resource_id}</span>
+                  ),
+                },
+                {
+                  accessor: 'resource_type',
+                  title: 'Type',
+                  render: (record) => (
+                    <span
+                      className={`inline-flex items-center rounded-full px-2.5 py-0.5 text-xs font-medium ${record.resource_type === 'zim'
+                        ? 'bg-blue-100 text-blue-800'
+                        : 'bg-emerald-100 text-emerald-800'
+                        }`}
+                    >
+                      {record.resource_type === 'zim' ? 'ZIM' : 'Map'}
+                    </span>
+                  ),
+                },
+                {
+                  accessor: 'size_bytes',
+                  title: 'Size',
+                  render: (record) => (
+                    <span className="text-desert-stone-dark">
+                      {record.size_bytes ? formatBytes(record.size_bytes, 1) : '—'}
+                    </span>
+                  ),
+                },
+                {
+                  accessor: 'installed_version',
+                  title: 'Version',
+                  render: (record) => (
+                    <span className="text-desert-stone-dark">
+                      {record.installed_version} → {record.latest_version}
+                    </span>
+                  ),
+                },
+                {
+                  accessor: 'resource_id',
+                  title: '',
+                  render: (record) => (
+                    <StyledButton
+                      variant="secondary"
+                      size="sm"
+                      icon="IconDownload"
+                      onClick={() => handleApply(record)}
+                      loading={applyingIds.has(record.resource_id)}
+                    >
+                      Update
+                    </StyledButton>
+                  ),
+                },
+              ]}
+            />
+          </div>
+        )}
+
+        {checkResult?.checked_at && (
+          <p className="text-xs text-desert-stone mt-3">
+            Last checked: {new Date(checkResult.checked_at).toLocaleString()}
+          </p>
+        )}
+      </div>
+
+      <ActiveDownloads withHeader />
+    </div>
+  )
+}
diff --git a/admin/inertia/components/updates/CoreAutoUpdateSection.tsx b/admin/inertia/components/updates/CoreAutoUpdateSection.tsx
new file mode 100644
index 0000000..fcebbb3
--- /dev/null
+++ b/admin/inertia/components/updates/CoreAutoUpdateSection.tsx
@@ -0,0 +1,185 @@
+import { useEffect, useState } from 'react'
+import StyledButton from '~/components/StyledButton'
+import StyledSectionHeader from '~/components/StyledSectionHeader'
+import Alert from '~/components/Alert'
+import api from '~/lib/api'
+import Input from '~/components/inputs/Input'
+import Switch from '~/components/inputs/Switch'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import { useNotifications } from '~/context/NotificationContext'
+import { useAutoUpdateStatus } from '~/hooks/useAutoUpdateStatus'
+
+const COOLOFF_OPTIONS = [
+  { value: 24, label: '24 hours (1 day)' },
+  { value: 48, label: '48 hours (2 days)' },
+  { value: 72, label: '72 hours (3 days)' },
+  { value: 168, label: '7 days' },
+]
+
+export default function CoreAutoUpdateSection() {
+  const { addNotification } = useNotifications()
+  const queryClient = useQueryClient()
+  const { data: status, isLoading } = useAutoUpdateStatus()
+
+  const [windowStart, setWindowStart] = useState('02:00')
+  const [windowEnd, setWindowEnd] = useState('05:00')
+  const [cooloff, setCooloff] = useState(72)
+
+  // Seed editable fields once the persisted status loads.
+  useEffect(() => {
+    if (status) {
+      setWindowStart(status.windowStart)
+      setWindowEnd(status.windowEnd)
+      setCooloff(status.cooloffHours)
+    }
+  }, [status?.windowStart, status?.windowEnd, status?.cooloffHours])
+
+  const saveMutation = useMutation({
+    mutationFn: ({ key, value }: { key: string; value: any }) => api.updateSetting(key, value),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ['auto-update-status'] })
+    },
+    onError: () => {
+      addNotification({ type: 'error', message: 'Failed to update auto-update setting.' })
+    },
+  })
+
+  const enabled = status?.enabled ?? false
+  const autoDisabled = !!status?.autoDisabledReason
+
+  const handleToggle = (value: boolean) => {
+    saveMutation.mutate(
+      { key: 'autoUpdate.enabled', value },
+      {
+        onSuccess: () => {
+          queryClient.invalidateQueries({ queryKey: ['auto-update-status'] })
+          addNotification({
+            type: 'success',
+            message: value ? 'Automatic updates enabled.' : 'Automatic updates disabled.',
+          })
+        },
+      }
+    )
+  }
+
+  const handleSaveWindow = async () => {
+    try {
+      await api.updateSetting('autoUpdate.windowStart', windowStart)
+      await api.updateSetting('autoUpdate.windowEnd', windowEnd)
+      await api.updateSetting('autoUpdate.cooloffHours', String(cooloff))
+      queryClient.invalidateQueries({ queryKey: ['auto-update-status'] })
+      addNotification({ type: 'success', message: 'Auto-update schedule saved.' })
+    } catch {
+      addNotification({ type: 'error', message: 'Failed to save auto-update schedule.' })
+    }
+  }
+
+  return (
+    <>
+      <StyledSectionHeader title="Automatic Core Updates" className="mt-8" />
+      <div className="bg-surface-primary rounded-lg border shadow-md overflow-hidden mt-6 p-6">
+        {autoDisabled && (
+          <Alert
+            type="warning"
+            title="Automatic Core Updates Disabled"
+            message={status?.autoDisabledReason || 'Automatic core updates were disabled after repeated failures.'}
+            variant="bordered"
+            className="mb-4"
+          />
+        )}
+
+        <Switch
+          checked={enabled}
+          onChange={handleToggle}
+          disabled={saveMutation.isPending || isLoading}
+          label="Enable Automatic Core Updates"
+          description="Automatically install minor and patch updates during your chosen window. Major versions always require a manual update due to their potentially breaking nature."
+        />
+
+        <div className="mt-6 grid grid-cols-1 md:grid-cols-3 gap-4">
+          <Input
+            name="autoUpdateWindowStart"
+            label="Window Start"
+            type="time"
+            value={windowStart}
+            onChange={(e) => setWindowStart(e.target.value)}
+            disabled={!enabled}
+            helpText="Local server time"
+          />
+          <Input
+            name="autoUpdateWindowEnd"
+            label="Window End"
+            type="time"
+            value={windowEnd}
+            onChange={(e) => setWindowEnd(e.target.value)}
+            disabled={!enabled}
+            helpText="Local server time"
+          />
+          <div>
+            <label
+              htmlFor="autoUpdateCooloff"
+              className="block text-base/6 font-medium text-text-primary"
+            >
+              Cool-off Period
+            </label>
+            <p className="mt-1 text-sm text-text-muted">Delay after a release is published</p>
+            <select
+              id="autoUpdateCooloff"
+              value={cooloff}
+              onChange={(e) => setCooloff(Number(e.target.value))}
+              disabled={!enabled}
+              className="mt-1.5 block w-full rounded-md bg-surface-primary px-3 py-2 text-base text-text-primary border border-border-default focus:outline focus:outline-2 focus:-outline-offset-2 focus:outline-primary sm:text-sm/6 disabled:opacity-50"
+            >
+              {COOLOFF_OPTIONS.map((opt) => (
+                <option key={opt.value} value={opt.value}>
+                  {opt.label}
+                </option>
+              ))}
+            </select>
+          </div>
+        </div>
+
+        <div className="mt-4 flex justify-end">
+          <StyledButton
+            variant="primary"
+            size="sm"
+            onClick={handleSaveWindow}
+            disabled={!enabled}
+          >
+            Save Schedule
+          </StyledButton>
+        </div>
+
+        {enabled && status && (
+          <div className="mt-6 pt-4 border-t border-desert-stone-light text-sm space-y-1">
+            <p className="text-desert-stone-dark">
+              <span className="font-medium">Status: </span>
+              {status.eligibleTarget
+                ? `Eligible update ready: ${status.eligibleTarget.version}`
+                : 'No eligible update — system is current or the latest release is a major version / still in cool-off.'}
+            </p>
+            <p className="text-desert-stone">
+              <span className="font-medium">Update window: </span>
+              {status.withinWindow ? 'Currently inside the window' : 'Currently outside the window'}
+            </p>
+            {status.lastResult && (
+              <p className="text-desert-stone">
+                <span className="font-medium">Last check: </span>
+                {status.lastResult}
+                {status.lastAttemptAt
+                  ? ` (${new Date(status.lastAttemptAt).toLocaleString()})`
+                  : ''}
+              </p>
+            )}
+            {status.lastError && (
+              <p className="text-desert-red">
+                <span className="font-medium">Last error: </span>
+                {status.lastError}
+              </p>
+            )}
+          </div>
+        )}
+      </div>
+    </>
+  )
+}
diff --git a/admin/inertia/hooks/useAppAutoUpdateStatus.ts b/admin/inertia/hooks/useAppAutoUpdateStatus.ts
new file mode 100644
index 0000000..810a572
--- /dev/null
+++ b/admin/inertia/hooks/useAppAutoUpdateStatus.ts
@@ -0,0 +1,11 @@
+import { useQuery } from '@tanstack/react-query'
+import api from '~/lib/api'
+import { AppAutoUpdateStatus } from '../../types/system'
+
+export const useAppAutoUpdateStatus = () => {
+  return useQuery<AppAutoUpdateStatus | undefined>({
+    queryKey: ['app-auto-update-status'],
+    queryFn: () => api.getAppAutoUpdateStatus(),
+    refetchOnWindowFocus: false,
+  })
+}
diff --git a/admin/inertia/lib/api.ts b/admin/inertia/lib/api.ts
index 10400a9..6b9a4de 100644
--- a/admin/inertia/lib/api.ts
+++ b/admin/inertia/lib/api.ts
@@ -2,7 +2,7 @@ import axios, { AxiosError, AxiosInstance } from 'axios'
 import { ListRemoteZimFilesResponse, ListZimFilesResponse } from '../../types/zim'
 import { ServiceSlim } from '../../types/services'
 import { FileEntry } from '../../types/files'
-import { AutoUpdateStatus, CheckLatestVersionResult, SystemInformationResponse, SystemUpdateStatus } from '../../types/system'
+import { AppAutoUpdateStatus, AutoUpdateStatus, CheckLatestVersionResult, SystemInformationResponse, SystemUpdateStatus } from '../../types/system'
 import { DownloadJobWithProgress, WikipediaState } from '../../types/downloads'
 import type { Country, CountryCode, CountryGroup, MapExtractPreflight } from '../../types/maps'
 import { EmbedJobWithProgress, FileWarningsResult, StoredFileInfo } from '../../types/rag'
@@ -549,6 +549,23 @@ class API {
     })()
   }
 
+  async getAppAutoUpdateStatus() {
+    return catchInternal(async () => {
+      const response = await this.client.get<AppAutoUpdateStatus>('/system/apps/auto-update/status')
+      return response.data
+    })()
+  }
+
+  async setServiceAutoUpdate(serviceName: string, enabled: boolean) {
+    return catchInternal(async () => {
+      const response = await this.client.post<{ success: boolean; message: string }>(
+        '/system/services/auto-update',
+        { service_name: serviceName, enabled }
+      )
+      return response.data
+    })()
+  }
+
   async healthCheck() {
     return catchInternal(async () => {
       const response = await this.client.get<{ status: string }>('/health', {
diff --git a/admin/inertia/pages/settings/update.tsx b/admin/inertia/pages/settings/update.tsx
index ffba3ba..4ffc033 100644
--- a/admin/inertia/pages/settings/update.tsx
+++ b/admin/inertia/pages/settings/update.tsx
@@ -1,22 +1,20 @@
 import { Head } from '@inertiajs/react'
 import SettingsLayout from '~/layouts/SettingsLayout'
 import StyledButton from '~/components/StyledButton'
-import StyledTable from '~/components/StyledTable'
 import StyledSectionHeader from '~/components/StyledSectionHeader'
-import ActiveDownloads from '~/components/ActiveDownloads'
 import Alert from '~/components/Alert'
 import { useEffect, useRef, useState } from 'react'
 import { IconAlertCircle, IconArrowBigUpLines, IconCheck, IconCircleCheck, IconReload } from '@tabler/icons-react'
 import { SystemUpdateStatus } from '../../../types/system'
-import type { ContentUpdateCheckResult, ResourceUpdateInfo } from '../../../types/collections'
 import api from '~/lib/api'
 import Input from '~/components/inputs/Input'
 import Switch from '~/components/inputs/Switch'
-import { useMutation, useQueryClient } from '@tanstack/react-query'
+import { useMutation } from '@tanstack/react-query'
 import { useNotifications } from '~/context/NotificationContext'
 import { useSystemSetting } from '~/hooks/useSystemSetting'
-import { useAutoUpdateStatus } from '~/hooks/useAutoUpdateStatus'
-import { formatBytes } from '~/lib/util'
+import CoreAutoUpdateSection from '~/components/updates/CoreAutoUpdateSection'
+import AppAutoUpdateSection from '~/components/updates/AppAutoUpdateSection'
+import ContentUpdatesSection from '~/components/updates/ContentUpdatesSection'
 
 type Props = {
   updateAvailable: boolean
@@ -42,397 +40,6 @@ const ADVANCED_STAGES: ReadonlySet<SystemUpdateStatus['stage']> = new Set([
   'complete',
 ])
 
-function ContentUpdatesSection() {
-  const { addNotification } = useNotifications()
-  const queryClient = useQueryClient()
-  const [checkResult, setCheckResult] = useState<ContentUpdateCheckResult | null>(null)
-  const [isChecking, setIsChecking] = useState(false)
-  const [applyingIds, setApplyingIds] = useState<Set<string>>(new Set())
-  const [isApplyingAll, setIsApplyingAll] = useState(false)
-
-  const handleCheck = async () => {
-    setIsChecking(true)
-    try {
-      const result = await api.checkForContentUpdates()
-      if (result) {
-        setCheckResult(result)
-      }
-    } catch {
-      setCheckResult({
-        updates: [],
-        checked_at: new Date().toISOString(),
-        error: 'Failed to check for content updates',
-      })
-    } finally {
-      setIsChecking(false)
-    }
-  }
-
-  const handleApply = async (update: ResourceUpdateInfo) => {
-    setApplyingIds((prev) => new Set(prev).add(update.resource_id))
-    try {
-      const result = await api.applyContentUpdate(update)
-      if (result?.success) {
-        addNotification({ type: 'success', message: `Update started for ${update.resource_id}` })
-        // Remove from the updates list
-        setCheckResult((prev) =>
-          prev
-            ? { ...prev, updates: prev.updates.filter((u) => u.resource_id !== update.resource_id) }
-            : prev
-        )
-        // Force Active Downloads to refetch now — small updates finish before the next
-        // idle poll fires, so without this the user wouldn't see them.
-        queryClient.invalidateQueries({ queryKey: ['download-jobs'] })
-      } else {
-        addNotification({ type: 'error', message: result?.error || 'Failed to start update' })
-      }
-    } catch {
-      addNotification({ type: 'error', message: `Failed to start update for ${update.resource_id}` })
-    } finally {
-      setApplyingIds((prev) => {
-        const next = new Set(prev)
-        next.delete(update.resource_id)
-        return next
-      })
-    }
-  }
-
-  const handleApplyAll = async () => {
-    if (!checkResult?.updates.length) return
-    setIsApplyingAll(true)
-    try {
-      const result = await api.applyAllContentUpdates(checkResult.updates)
-      if (result?.results) {
-        const succeeded = result.results.filter((r) => r.success).length
-        const failed = result.results.filter((r) => !r.success).length
-        if (succeeded > 0) {
-          addNotification({ type: 'success', message: `Started ${succeeded} update(s)` })
-        }
-        if (failed > 0) {
-          addNotification({ type: 'error', message: `${failed} update(s) could not be started` })
-        }
-        // Remove successful updates from the list
-        const successIds = new Set(result.results.filter((r) => r.success).map((r) => r.resource_id))
-        setCheckResult((prev) =>
-          prev
-            ? { ...prev, updates: prev.updates.filter((u) => !successIds.has(u.resource_id)) }
-            : prev
-        )
-        if (successIds.size > 0) {
-          queryClient.invalidateQueries({ queryKey: ['download-jobs'] })
-        }
-      }
-    } catch {
-      addNotification({ type: 'error', message: 'Failed to apply updates' })
-    } finally {
-      setIsApplyingAll(false)
-    }
-  }
-
-  return (
-    <div className="mt-8">
-      <StyledSectionHeader title="Content Updates" />
-
-      <div className="bg-surface-primary rounded-lg border shadow-md overflow-hidden p-6">
-        <div className="flex items-center justify-between">
-          <p className="text-desert-stone-dark">
-            Check if newer versions of your installed ZIM files and maps are available.
-          </p>
-          <StyledButton
-            variant="primary"
-            icon="IconRefresh"
-            onClick={handleCheck}
-            loading={isChecking}
-          >
-            Check for Content Updates
-          </StyledButton>
-        </div>
-
-        {checkResult?.error && (
-          <Alert
-            type="warning"
-            title="Update Check Issue"
-            message={checkResult.error}
-            variant="bordered"
-            className="my-4"
-          />
-        )}
-
-        {checkResult && !checkResult.error && checkResult.updates.length === 0 && (
-          <Alert
-            type="success"
-            title="All Content Up to Date"
-            message="All your installed content is running the latest available version."
-            variant="bordered"
-            className="my-4"
-          />
-        )}
-
-        {checkResult && checkResult.updates.length > 0 && (
-          <div className="mt-4">
-            <div className="flex items-center justify-between mb-3">
-              <p className="text-sm text-desert-stone-dark">
-                {checkResult.updates.length} update(s) available
-              </p>
-              <StyledButton
-                variant="primary"
-                size="sm"
-                icon="IconDownload"
-                onClick={handleApplyAll}
-                loading={isApplyingAll}
-              >
-                Update All ({checkResult.updates.length})
-              </StyledButton>
-            </div>
-            <StyledTable
-              data={checkResult.updates}
-              columns={[
-                {
-                  accessor: 'resource_id',
-                  title: 'Title',
-                  render: (record) => (
-                    <span className="font-medium text-desert-green">{record.resource_id}</span>
-                  ),
-                },
-                {
-                  accessor: 'resource_type',
-                  title: 'Type',
-                  render: (record) => (
-                    <span
-                      className={`inline-flex items-center rounded-full px-2.5 py-0.5 text-xs font-medium ${record.resource_type === 'zim'
-                        ? 'bg-blue-100 text-blue-800'
-                        : 'bg-emerald-100 text-emerald-800'
-                        }`}
-                    >
-                      {record.resource_type === 'zim' ? 'ZIM' : 'Map'}
-                    </span>
-                  ),
-                },
-                {
-                  accessor: 'size_bytes',
-                  title: 'Size',
-                  render: (record) => (
-                    <span className="text-desert-stone-dark">
-                      {record.size_bytes ? formatBytes(record.size_bytes, 1) : '—'}
-                    </span>
-                  ),
-                },
-                {
-                  accessor: 'installed_version',
-                  title: 'Version',
-                  render: (record) => (
-                    <span className="text-desert-stone-dark">
-                      {record.installed_version} → {record.latest_version}
-                    </span>
-                  ),
-                },
-                {
-                  accessor: 'resource_id',
-                  title: '',
-                  render: (record) => (
-                    <StyledButton
-                      variant="secondary"
-                      size="sm"
-                      icon="IconDownload"
-                      onClick={() => handleApply(record)}
-                      loading={applyingIds.has(record.resource_id)}
-                    >
-                      Update
-                    </StyledButton>
-                  ),
-                },
-              ]}
-            />
-          </div>
-        )}
-
-        {checkResult?.checked_at && (
-          <p className="text-xs text-desert-stone mt-3">
-            Last checked: {new Date(checkResult.checked_at).toLocaleString()}
-          </p>
-        )}
-      </div>
-
-      <ActiveDownloads withHeader />
-    </div>
-  )
-}
-
-const COOLOFF_OPTIONS = [
-  { value: 24, label: '24 hours (1 day)' },
-  { value: 48, label: '48 hours (2 days)' },
-  { value: 72, label: '72 hours (3 days)' },
-  { value: 168, label: '7 days' },
-]
-
-function AutoUpdateSection() {
-  const { addNotification } = useNotifications()
-  const queryClient = useQueryClient()
-  const { data: status, isLoading } = useAutoUpdateStatus()
-
-  const [windowStart, setWindowStart] = useState('02:00')
-  const [windowEnd, setWindowEnd] = useState('05:00')
-  const [cooloff, setCooloff] = useState(72)
-
-  // Seed editable fields once the persisted status loads.
-  useEffect(() => {
-    if (status) {
-      setWindowStart(status.windowStart)
-      setWindowEnd(status.windowEnd)
-      setCooloff(status.cooloffHours)
-    }
-  }, [status?.windowStart, status?.windowEnd, status?.cooloffHours])
-
-  const saveMutation = useMutation({
-    mutationFn: ({ key, value }: { key: string; value: any }) => api.updateSetting(key, value),
-    onSuccess: () => {
-      queryClient.invalidateQueries({ queryKey: ['auto-update-status'] })
-    },
-    onError: () => {
-      addNotification({ type: 'error', message: 'Failed to update auto-update setting.' })
-    },
-  })
-
-  const enabled = status?.enabled ?? false
-  const autoDisabled = !!status?.autoDisabledReason
-
-  const handleToggle = (value: boolean) => {
-    saveMutation.mutate(
-      { key: 'autoUpdate.enabled', value },
-      {
-        onSuccess: () => {
-          queryClient.invalidateQueries({ queryKey: ['auto-update-status'] })
-          addNotification({
-            type: 'success',
-            message: value ? 'Automatic updates enabled.' : 'Automatic updates disabled.',
-          })
-        },
-      }
-    )
-  }
-
-  const handleSaveWindow = async () => {
-    try {
-      await api.updateSetting('autoUpdate.windowStart', windowStart)
-      await api.updateSetting('autoUpdate.windowEnd', windowEnd)
-      await api.updateSetting('autoUpdate.cooloffHours', String(cooloff))
-      queryClient.invalidateQueries({ queryKey: ['auto-update-status'] })
-      addNotification({ type: 'success', message: 'Auto-update schedule saved.' })
-    } catch {
-      addNotification({ type: 'error', message: 'Failed to save auto-update schedule.' })
-    }
-  }
-
-  return (
-    <>
-      <StyledSectionHeader title="Automatic Updates" className="mt-8" />
-      <div className="bg-surface-primary rounded-lg border shadow-md overflow-hidden mt-6 p-6">
-        {autoDisabled && (
-          <Alert
-            type="warning"
-            title="Automatic Updates Disabled"
-            message={status?.autoDisabledReason || 'Auto-update was disabled after repeated failures.'}
-            variant="bordered"
-            className="mb-4"
-          />
-        )}
-
-        <Switch
-          checked={enabled}
-          onChange={handleToggle}
-          disabled={saveMutation.isPending || isLoading}
-          label="Enable Automatic Updates"
-          description="Automatically install minor and patch updates during your chosen window. Major versions always require a manual update due to their potentially breaking nature."
-        />
-
-        <div className="mt-6 grid grid-cols-1 md:grid-cols-3 gap-4">
-          <Input
-            name="autoUpdateWindowStart"
-            label="Window Start"
-            type="time"
-            value={windowStart}
-            onChange={(e) => setWindowStart(e.target.value)}
-            disabled={!enabled}
-            helpText="Local server time"
-          />
-          <Input
-            name="autoUpdateWindowEnd"
-            label="Window End"
-            type="time"
-            value={windowEnd}
-            onChange={(e) => setWindowEnd(e.target.value)}
-            disabled={!enabled}
-            helpText="Local server time"
-          />
-          <div>
-            <label
-              htmlFor="autoUpdateCooloff"
-              className="block text-base/6 font-medium text-text-primary"
-            >
-              Cool-off Period
-            </label>
-            <p className="mt-1 text-sm text-text-muted">Delay after a release is published</p>
-            <select
-              id="autoUpdateCooloff"
-              value={cooloff}
-              onChange={(e) => setCooloff(Number(e.target.value))}
-              disabled={!enabled}
-              className="mt-1.5 block w-full rounded-md bg-surface-primary px-3 py-2 text-base text-text-primary border border-border-default focus:outline focus:outline-2 focus:-outline-offset-2 focus:outline-primary sm:text-sm/6 disabled:opacity-50"
-            >
-              {COOLOFF_OPTIONS.map((opt) => (
-                <option key={opt.value} value={opt.value}>
-                  {opt.label}
-                </option>
-              ))}
-            </select>
-          </div>
-        </div>
-
-        <div className="mt-4 flex justify-end">
-          <StyledButton
-            variant="primary"
-            size="sm"
-            onClick={handleSaveWindow}
-            disabled={!enabled}
-          >
-            Save Schedule
-          </StyledButton>
-        </div>
-
-        {enabled && status && (
-          <div className="mt-6 pt-4 border-t border-desert-stone-light text-sm space-y-1">
-            <p className="text-desert-stone-dark">
-              <span className="font-medium">Status: </span>
-              {status.eligibleTarget
-                ? `Eligible update ready: ${status.eligibleTarget.version}`
-                : 'No eligible update — system is current or the latest release is a major version / still in cool-off.'}
-            </p>
-            <p className="text-desert-stone">
-              <span className="font-medium">Update window: </span>
-              {status.withinWindow ? 'Currently inside the window' : 'Currently outside the window'}
-            </p>
-            {status.lastResult && (
-              <p className="text-desert-stone">
-                <span className="font-medium">Last check: </span>
-                {status.lastResult}
-                {status.lastAttemptAt
-                  ? ` (${new Date(status.lastAttemptAt).toLocaleString()})`
-                  : ''}
-              </p>
-            )}
-            {status.lastError && (
-              <p className="text-desert-red">
-                <span className="font-medium">Last error: </span>
-                {status.lastError}
-              </p>
-            )}
-          </div>
-        )}
-      </div>
-    </>
-  )
-}
-
 export default function SystemUpdatePage(props: { system: Props }) {
   const { addNotification } = useNotifications()
 
@@ -844,7 +451,8 @@ export default function SystemUpdatePage(props: { system: Props }) {
               description="Receive release candidate (RC) versions before they are officially released. Note: RC versions may contain bugs and are not recommended for environments where stability and data integrity are critical."
             />
           </div>
-          <AutoUpdateSection />
+          <CoreAutoUpdateSection />
+          <AppAutoUpdateSection />
           <ContentUpdatesSection />
           <div className="bg-surface-primary rounded-lg border shadow-md overflow-hidden py-6 mt-12">
             <div className="flex flex-col md:flex-row justify-between items-center p-8 gap-y-8 md:gap-y-0 gap-x-8">
diff --git a/admin/inertia/pages/supply-depot.tsx b/admin/inertia/pages/supply-depot.tsx
index 887a7fa..6e498c1 100644
--- a/admin/inertia/pages/supply-depot.tsx
+++ b/admin/inertia/pages/supply-depot.tsx
@@ -1,4 +1,4 @@
-import { Head } from '@inertiajs/react'
+import { Head, router } from '@inertiajs/react'
 import { useEffect, useRef, useState } from 'react'
 import {
   IconAlertTriangle,
@@ -7,6 +7,7 @@ import {
   IconBox,
   IconBrandDocker,
   IconChartBar,
+  IconClockBolt,
   IconCloudDownload,
   IconFileText,
   IconPackage,
@@ -30,7 +31,9 @@ import ServiceStatsModal from '~/components/ServiceStatsModal'
 import StyledSectionHeader from '~/components/StyledSectionHeader'
 import UpdateServiceModal from '~/components/UpdateServiceModal'
 import useErrorNotification from '~/hooks/useErrorNotification'
+import { useNotifications } from '~/context/NotificationContext'
 import useInternetStatus from '~/hooks/useInternetStatus'
+import { useAppAutoUpdateStatus } from '~/hooks/useAppAutoUpdateStatus'
 import useServiceInstallationActivity from '~/hooks/useServiceInstallationActivity'
 import { useTransmit } from 'react-adonis-transmit'
 import { BROADCAST_CHANNELS } from '../../constants/broadcast'
@@ -84,9 +87,14 @@ type Modal =
 
 export default function SupplyDepotPage(props: { system: { services: ServiceSlim[] } }) {
   const { showError } = useErrorNotification()
+  const { addNotification } = useNotifications()
   const { isOnline } = useInternetStatus()
   const { subscribe } = useTransmit()
   const installActivity = useServiceInstallationActivity()
+  // Global master switch for app auto-updates (Settings → Updates). Per-app
+  // toggles are inert until this is on, so the UI reflects that state.
+  const { data: appAutoUpdateStatus } = useAppAutoUpdateStatus()
+  const appAutoUpdateMasterEnabled = appAutoUpdateStatus?.enabled ?? false
 
   const [activeCategory, setActiveCategory] = useState('all')
   const [search, setSearch] = useState('')
@@ -97,6 +105,9 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
   const [customAppOpen, setCustomAppOpen] = useState(false)
   const [editApp, setEditApp] = useState<CustomAppInitial | null>(null)
   const [removeImage, setRemoveImage] = useState(false)
+  // Optimistic per-app auto-update toggle state, keyed by service_name. Lets the
+  // toggle reflect instantly without a full page reload (props come from Inertia).
+  const [autoUpdateOverrides, setAutoUpdateOverrides] = useState<Record<string, boolean>>({})
 
   // Preflight state — scoped to the current install modal
   const [preflight, setPreflight] = useState<{
@@ -253,6 +264,25 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
     if (!result?.success) showError(result?.message || 'Failed to update service.')
   }
 
+  // Toggle per-app automatic updates (opt-in). Optimistically reflects the new
+  // state, reverting if the request fails. Gated by the global master switch in
+  // Settings → Updates; this only sets the per-app preference.
+  async function handleToggleAutoUpdate(service: ServiceSlim, enabled: boolean) {
+    setOpenDropdown(null)
+    setAutoUpdateOverrides((prev) => ({ ...prev, [service.service_name]: enabled }))
+    const result = await api.setServiceAutoUpdate(service.service_name, enabled)
+    if (!result?.success) {
+      setAutoUpdateOverrides((prev) => ({ ...prev, [service.service_name]: !enabled }))
+      showError(result?.message || 'Failed to update auto-update preference.')
+      return
+    }
+    const appName = service.friendly_name || service.service_name
+    addNotification({
+      message: `Auto-updates for ${appName} are ${enabled ? 'on' : 'off'}.`,
+      type: 'success',
+    })
+  }
+
   function handleCustomAppCreated() {
     setCustomAppOpen(false)
     // Page will reload when installation completes via broadcast
@@ -410,6 +440,11 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
                       onEdit={() => handleEdit(service)}
                       onUpdate={() => handleUpdate(service)}
                       onUpdateVersion={() => setModal({ type: 'update', service })}
+                      autoUpdateEnabled={
+                        autoUpdateOverrides[service.service_name] ?? service.auto_update_enabled
+                      }
+                      autoUpdateMasterEnabled={appAutoUpdateMasterEnabled}
+                      onToggleAutoUpdate={(enabled) => handleToggleAutoUpdate(service, enabled)}
                     />
                   ))}
                 </div>
@@ -682,6 +717,11 @@ interface AppCardProps {
   onEdit: () => void
   onUpdate: () => void
   onUpdateVersion: () => void
+  // Installed-only: per-app auto-update preference + toggle handler.
+  autoUpdateEnabled?: boolean
+  // Global master switch (Settings → Updates). When off, per-app toggles are inert.
+  autoUpdateMasterEnabled?: boolean
+  onToggleAutoUpdate?: (enabled: boolean) => void
 }
 
 function AppCard({
@@ -700,6 +740,9 @@ function AppCard({
   onEdit,
   onUpdate,
   onUpdateVersion,
+  autoUpdateEnabled,
+  autoUpdateMasterEnabled,
+  onToggleAutoUpdate,
 }: AppCardProps) {
   const isRunning = service.status === 'running'
   const isStopped = service.installed && !isRunning
@@ -879,6 +922,25 @@ function AppCard({
                   <DropdownItem icon={<IconFileText className="h-4 w-4" />} label="Logs" onClick={onLogs} />
                   <DropdownItem icon={<IconChartBar className="h-4 w-4" />} label="Stats" onClick={onStats} />
                   <DropdownItem icon={<IconPencil className="h-4 w-4" />} label="Edit" onClick={onEdit} />
+                  {!service.is_custom && onToggleAutoUpdate ? (
+                    autoUpdateMasterEnabled ? (
+                      <DropdownItem
+                        icon={
+                          <IconClockBolt
+                            className={`h-4 w-4 ${autoUpdateEnabled ? 'text-desert-green' : ''}`}
+                          />
+                        }
+                        label={`Auto-update: ${autoUpdateEnabled ? 'On' : 'Off'}`}
+                        onClick={() => onToggleAutoUpdate(!autoUpdateEnabled)}
+                      />
+                    ) : (
+                      <DropdownItem
+                        icon={<IconClockBolt className="h-4 w-4" />}
+                        label="App auto-updates off — open Settings"
+                        onClick={() => router.visit('/settings/update')}
+                      />
+                    )
+                  ) : null}
                   {service.available_update_version && !service.is_custom ? (
                     <DropdownItem
                       icon={<IconArrowUp className="h-4 w-4 text-desert-green" />}
diff --git a/admin/start/routes.ts b/admin/start/routes.ts
index 0379b98..8af8966 100644
--- a/admin/start/routes.ts
+++ b/admin/start/routes.ts
@@ -182,6 +182,8 @@ router
     router.get('/services/:name/stats', [SystemController, 'getServiceStats'])
     router.get('/services/:name/available-versions', [SystemController, 'getAvailableVersions'])
     router.post('/services/update', [SystemController, 'updateService'])
+    router.post('/services/auto-update', [SystemController, 'setServiceAutoUpdate'])
+    router.get('/apps/auto-update/status', [SystemController, 'getAppAutoUpdateStatus'])
     router.post('/subscribe-release-notes', [SystemController, 'subscribeToReleaseNotes'])
     router.get('/latest-version', [SystemController, 'checkLatestVersion'])
     router.post('/update', [SystemController, 'requestSystemUpdate'])
diff --git a/admin/tests/unit/app_auto_update.spec.ts b/admin/tests/unit/app_auto_update.spec.ts
new file mode 100644
index 0000000..ed99e8a
--- /dev/null
+++ b/admin/tests/unit/app_auto_update.spec.ts
@@ -0,0 +1,143 @@
+import * as assert from 'node:assert/strict'
+import { test } from 'node:test'
+import { DateTime } from 'luxon'
+
+import { AppAutoUpdateService } from '../../app/services/app_auto_update_service.js'
+import { ContainerRegistryService } from '../../app/services/container_registry_service.js'
+import { isWithinWindow } from '../../app/utils/update_window.js'
+
+// appEligibility only touches ContainerRegistryService.parseImageReference (pure,
+// offline), so the other constructor deps are irrelevant for these tests.
+const svc = new AppAutoUpdateService(
+  null as any,
+  null as any,
+  null as any,
+  new ContainerRegistryService()
+)
+
+const NOW = DateTime.fromISO('2026-06-04T12:00:00Z')
+const daysAgo = (d: number) => NOW.minus({ days: d })
+const hoursAgo = (h: number) => NOW.minus({ hours: h })
+
+function makeService(overrides: Record<string, any> = {}) {
+  return {
+    service_name: 'nomad_test',
+    container_image: 'ollama/ollama:0.18.1',
+    available_update_version: null,
+    available_update_first_seen_at: null,
+    auto_update_disabled_reason: null,
+    auto_update_enabled: true,
+    installed: true,
+    ...overrides,
+  } as any
+}
+
+// ── Per-app eligibility ───────────────────────────────────────────────────────
+
+test('no available update → not eligible (up to date)', () => {
+  const v = svc.appEligibility(makeService(), 72, NOW)
+  assert.equal(v.eligible, false)
+})
+
+test('major bump is never auto-eligible (manual update required)', () => {
+  const v = svc.appEligibility(
+    makeService({ available_update_version: '1.0.0', available_update_first_seen_at: daysAgo(10) }),
+    72,
+    NOW
+  )
+  assert.equal(v.eligible, false)
+  assert.match(v.reason, /Major version/)
+})
+
+test('same-major newer but still inside cool-off → not eligible', () => {
+  const v = svc.appEligibility(
+    makeService({
+      available_update_version: '0.19.0',
+      available_update_first_seen_at: hoursAgo(10),
+    }),
+    72,
+    NOW
+  )
+  assert.equal(v.eligible, false)
+  assert.match(v.reason, /cool-off/i)
+})
+
+test('same-major newer and past cool-off → eligible', () => {
+  const v = svc.appEligibility(
+    makeService({ available_update_version: '0.19.0', available_update_first_seen_at: daysAgo(5) }),
+    72,
+    NOW
+  )
+  assert.equal(v.eligible, true)
+})
+
+test('null first-seen → not eligible (cool-off pending)', () => {
+  const v = svc.appEligibility(
+    makeService({ available_update_version: '0.19.0', available_update_first_seen_at: null }),
+    72,
+    NOW
+  )
+  assert.equal(v.eligible, false)
+})
+
+test('self-disabled app → not eligible regardless of cool-off', () => {
+  const v = svc.appEligibility(
+    makeService({
+      available_update_version: '0.19.0',
+      available_update_first_seen_at: daysAgo(30),
+      auto_update_disabled_reason: 'Auto-update disabled after 3 consecutive failures.',
+    }),
+    72,
+    NOW
+  )
+  assert.equal(v.eligible, false)
+})
+
+test(':latest-pinned app cannot be version-checked → not eligible', () => {
+  const v = svc.appEligibility(
+    makeService({
+      container_image: 'foo/bar:latest',
+      available_update_version: '1.2.3',
+      available_update_first_seen_at: daysAgo(30),
+    }),
+    72,
+    NOW
+  )
+  assert.equal(v.eligible, false)
+})
+
+test('available equal to current (not newer) → not eligible', () => {
+  const v = svc.appEligibility(
+    makeService({
+      available_update_version: '0.18.1',
+      available_update_first_seen_at: daysAgo(30),
+    }),
+    72,
+    NOW
+  )
+  assert.equal(v.eligible, false)
+})
+
+test('cool-off of 0 applies immediately', () => {
+  const v = svc.appEligibility(
+    makeService({
+      available_update_version: '0.18.2',
+      available_update_first_seen_at: hoursAgo(1),
+    }),
+    0,
+    NOW
+  )
+  assert.equal(v.eligible, true)
+})
+
+// ── Shared update window (reused from the core auto-update) ────────────────────
+
+test('window: normal 20:00-23:00 includes 21:00, excludes 19:00', () => {
+  assert.equal(isWithinWindow('20:00', '23:00', DateTime.fromISO('2026-06-04T21:00:00')), true)
+  assert.equal(isWithinWindow('20:00', '23:00', DateTime.fromISO('2026-06-04T19:00:00')), false)
+})
+
+test('window: midnight-wrapping 22:00-02:00 includes 01:00, excludes 12:00', () => {
+  assert.equal(isWithinWindow('22:00', '02:00', DateTime.fromISO('2026-06-04T01:00:00')), true)
+  assert.equal(isWithinWindow('22:00', '02:00', DateTime.fromISO('2026-06-04T12:00:00')), false)
+})
diff --git a/admin/types/kv_store.ts b/admin/types/kv_store.ts
index 4193f57..245bd8e 100644
--- a/admin/types/kv_store.ts
+++ b/admin/types/kv_store.ts
@@ -16,6 +16,9 @@ export const KV_STORE_SCHEMA = {
   'autoUpdate.lastResult':      'string',
   'autoUpdate.consecutiveFailures': 'string',
   'autoUpdate.autoDisabledReason':  'string',
+  'appAutoUpdate.enabled':          'boolean',
+  'appAutoUpdate.lastAttemptAt':    'string',
+  'appAutoUpdate.lastResult':       'string',
   'ui.hasVisitedEasySetup':     'boolean',
   'ui.theme':                   'string',
   'ai.assistantCustomName':     'string',
diff --git a/admin/types/services.ts b/admin/types/services.ts
index 526af20..e9ccdc3 100644
--- a/admin/types/services.ts
+++ b/admin/types/services.ts
@@ -14,6 +14,7 @@ export type ServiceSlim = Pick<
   | 'display_order'
   | 'container_image'
   | 'available_update_version'
+  | 'auto_update_enabled'
   | 'is_custom'
   | 'is_user_modified'
   | 'category'
diff --git a/admin/types/system.ts b/admin/types/system.ts
index 265ea36..cc27eba 100644
--- a/admin/types/system.ts
+++ b/admin/types/system.ts
@@ -106,4 +106,29 @@ export type AutoUpdateStatus = {
   lastError: string | null
   consecutiveFailures: number
   autoDisabledReason: string | null
+}
+
+export type AppAutoUpdateAppStatus = {
+  service_name: string
+  friendly_name: string | null
+  auto_update_enabled: boolean
+  current_version: string
+  available_update_version: string | null
+  first_seen_at: string | null
+  eligible: boolean
+  reason: string
+  cooloff_remaining_hours: number | null
+  consecutive_failures: number
+  auto_disabled_reason: string | null
+}
+
+export type AppAutoUpdateStatus = {
+  enabled: boolean
+  windowStart: string
+  windowEnd: string
+  cooloffHours: number
+  withinWindow: boolean
+  lastAttemptAt: string | null
+  lastResult: string | null
+  apps: AppAutoUpdateAppStatus[]
 }
\ No newline at end of file

From 3f574e40036d712269305abd39bede16216f54ec Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Fri, 5 Jun 2026 16:24:32 -0700
Subject: [PATCH 29/83] fix(system): show a clear message when a service port
 is already in use

When a service fails to install because something on the host already binds its
port, the user saw the raw dockerode error ("Bind for 0.0.0.0:11434 failed:
port is already allocated"), which is meaningless to a non-technical user. The
most common case is a native Ollama install holding 11434.

Add _humanizeDockerError() to map host port-conflict errors to an actionable
message that names the port and, for Ollama/11434, points at the likely cause
(a host Ollama service) with the commands to stop it. Unrecognized errors pass
through unchanged. Wired into the install failure broadcast and the thrown
error.

Closes #934

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 admin/app/services/docker_service.ts | 29 ++++++++++++++++++++++++++--
 1 file changed, 27 insertions(+), 2 deletions(-)

diff --git a/admin/app/services/docker_service.ts b/admin/app/services/docker_service.ts
index 69f3ac5..87a7742 100644
--- a/admin/app/services/docker_service.ts
+++ b/admin/app/services/docker_service.ts
@@ -462,6 +462,30 @@ export class DockerService {
    * @param serviceName
    * @returns
    */
+  /**
+   * Translate low-level dockerode errors into something a non-technical user can
+   * act on. Currently handles host port conflicts — the most common install
+   * failure, where a service can't bind its port because something on the host
+   * already holds it (classic case: a native Ollama install owns 11434). Returns
+   * the original message unchanged for anything we don't recognize. (#934)
+   */
+  private _humanizeDockerError(error: any, serviceName: string): string {
+    const raw: string = error?.message ?? String(error)
+    // dockerode surfaces port conflicts as e.g.
+    //   "...Bind for 0.0.0.0:11434 failed: port is already allocated"
+    //   "...listen tcp 0.0.0.0:8090: bind: address already in use"
+    const portMatch = raw.match(/(?:Bind for [^:]+:(\d+) failed: port is already allocated|:(\d+): bind: address already in use)/i)
+    if (portMatch) {
+      const port = portMatch[1] || portMatch[2]
+      const portText = port ? `port ${port}` : 'a required port'
+      if (port === '11434' || serviceName === SERVICE_NAMES.OLLAMA) {
+        return `Couldn't start because ${portText} is already in use on this machine. This usually means Ollama is already installed and running directly on the host (outside NOMAD). Stop and disable the host Ollama service (e.g. "sudo systemctl stop ollama" then "sudo systemctl disable ollama"), then try again.`
+      }
+      return `Couldn't start because ${portText} is already in use on this machine. Stop whatever is using ${portText} on the host, then try again.`
+    }
+    return raw
+  }
+
   /**
    * Resolve the host filesystem path that backs the admin container's storage
    * directory (`/app/storage`). Child services are created via the Docker socket,
@@ -828,14 +852,15 @@ export class DockerService {
         `Service ${service.service_name} installation completed successfully.`
       )
     } catch (error: any) {
+      const friendly = this._humanizeDockerError(error, service.service_name)
       this._broadcast(
         service.service_name,
         'error',
-        `Error installing service ${service.service_name}: ${error.message}`
+        `Error installing service ${service.service_name}: ${friendly}`
       )
       // Mark install as failed and cleanup
       await this._cleanupFailedInstallation(service.service_name)
-      throw new Error(`Failed to install service ${service.service_name}: ${error.message}`)
+      throw new Error(`Failed to install service ${service.service_name}: ${friendly}`)
     }
   }
 

From dfc284c34d59ba212bd6356c852adcd35767ac98 Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Mon, 8 Jun 2026 18:03:35 +0000
Subject: [PATCH 30/83] docs: fix out of place JSDoc comment

---
 admin/app/services/docker_service.ts | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/admin/app/services/docker_service.ts b/admin/app/services/docker_service.ts
index 87a7742..7919b1d 100644
--- a/admin/app/services/docker_service.ts
+++ b/admin/app/services/docker_service.ts
@@ -455,13 +455,6 @@ export class DockerService {
     }
   }
 
-  /**
-   * Handles the long-running process of creating a Docker container for a service.
-   * NOTE: This method should not be called directly. Instead, use `createContainerPreflight` to check prerequisites first
-   * This method will also transmit server-sent events to the client to notify of progress.
-   * @param serviceName
-   * @returns
-   */
   /**
    * Translate low-level dockerode errors into something a non-technical user can
    * act on. Currently handles host port conflicts — the most common install
@@ -576,6 +569,13 @@ export class DockerService {
     })
   }
 
+  /**
+   * Handles the long-running process of creating a Docker container for a service.
+   * NOTE: This method should not be called directly. Instead, use `createContainerPreflight` to check prerequisites first
+   * This method will also transmit server-sent events to the client to notify of progress.
+   * @param serviceName
+   * @returns
+    */
   async _createContainer(
     service: Service & { dependencies?: Service[] },
     containerConfig: any

From 25000b986922a88fade899e7af6dda426b9f7fdd Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Fri, 5 Jun 2026 15:20:10 -0700
Subject: [PATCH 31/83] fix(system): roll back service update when the new
 container fails to start

The service update path stopped and renamed the old container aside before
the new one was confirmed running, but only wired up rollback if
createContainer threw or the 5s health check failed. A throw from
newContainer.start() itself (bad device/GPU config, host port already bound,
image incompatibility) bubbled straight to the outer catch, which returned a
generic 400 and never restored the old container, leaving the service down.

Retrying then wedged: the failed new container still held the service name, so
the next attempt's rename to `<name>_old` collided with the leftover from the
first attempt and threw the same error every time.

- Wrap newContainer.start() so a start failure removes the half-created
  container and rolls back to the previous one.
- Clear any stale `<name>_old` before renaming so retries can't collide.
- Dedupe the three rollback sites into a single rollbackToOld() helper (also
  removes a non-null assertion in the create-failure path that could itself
  throw when no `_old` existed).

Refs #949

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 admin/app/services/docker_service.ts | 66 ++++++++++++++++++++++------
 1 file changed, 53 insertions(+), 13 deletions(-)

diff --git a/admin/app/services/docker_service.ts b/admin/app/services/docker_service.ts
index 7919b1d..e907ca6 100644
--- a/admin/app/services/docker_service.ts
+++ b/admin/app/services/docker_service.ts
@@ -1547,8 +1547,36 @@ export class DockerService {
 
       // Step 3: Rename old container as safety net
       const oldName = `${serviceName}_old`
+
+      // Clear any stale rollback container left behind by a previously failed update.
+      // Otherwise the rename below collides with the existing `<name>_old` and throws,
+      // which wedges every subsequent retry on the same error.
+      const staleOld = (await this.docker.listContainers({ all: true })).find((c) =>
+        c.Names.includes(`/${oldName}`)
+      )
+      if (staleOld) {
+        try {
+          await this.docker.getContainer(staleOld.Id).remove({ force: true })
+        } catch {
+          // Best effort — if it can't be removed the rename below will surface the error.
+        }
+      }
+
       await oldContainer.rename({ name: oldName })
 
+      // Restore the previous container after a failed update: rename the renamed-aside
+      // old container back into place and start it, so a failure anywhere between here
+      // and the health check never leaves the service down.
+      const rollbackToOld = async () => {
+        const containers = await this.docker.listContainers({ all: true })
+        const oldRef = containers.find((c) => c.Names.includes(`/${oldName}`))
+        if (oldRef) {
+          const rollbackContainer = this.docker.getContainer(oldRef.Id)
+          await rollbackContainer.rename({ name: serviceName }).catch(() => {})
+          await rollbackContainer.start().catch(() => {})
+        }
+      }
+
       // Step 4: Create new container with inspected config + new image
       this._broadcast(serviceName, 'update-creating', `Creating updated container...`)
 
@@ -1604,16 +1632,35 @@ export class DockerService {
       } catch (createError: any) {
         // Rollback: rename old container back
         this._broadcast(serviceName, 'update-rollback', `Failed to create new container: ${createError.message}. Rolling back...`)
-        const rollbackContainer = this.docker.getContainer((await this.docker.listContainers({ all: true })).find((c) => c.Names.includes(`/${oldName}`))!.Id)
-        await rollbackContainer.rename({ name: serviceName })
-        await rollbackContainer.start()
+        await rollbackToOld()
         this.activeInstallations.delete(serviceName)
         return { success: false, message: `Failed to create updated container: ${createError.message}` }
       }
 
-      // Step 5: Start new container
+      // Step 5: Start new container. If the start itself throws (bad device/GPU config,
+      // a host port already bound, image incompatibility), roll back to the previous
+      // container instead of leaving the service stopped with no replacement running.
       this._broadcast(serviceName, 'update-starting', `Starting updated container...`)
-      await newContainer.start()
+      try {
+        await newContainer.start()
+      } catch (startError: any) {
+        this._broadcast(
+          serviceName,
+          'update-rollback',
+          `Updated container failed to start: ${startError.message}. Rolling back to previous version...`
+        )
+        try {
+          await newContainer.remove({ force: true })
+        } catch {
+          // Best effort — leave the half-created container for manual cleanup if needed.
+        }
+        await rollbackToOld()
+        this.activeInstallations.delete(serviceName)
+        return {
+          success: false,
+          message: `Update failed: new container did not start (${startError.message}). Rolled back to previous version.`,
+        }
+      }
 
       // Step 6: Health check — verify container stays running for 5 seconds
       await new Promise((resolve) => setTimeout(resolve, 5000))
@@ -1659,14 +1706,7 @@ export class DockerService {
           // Best effort cleanup
         }
 
-        // Restore old container
-        const oldContainers = await this.docker.listContainers({ all: true })
-        const oldRef = oldContainers.find((c) => c.Names.includes(`/${oldName}`))
-        if (oldRef) {
-          const rollbackContainer = this.docker.getContainer(oldRef.Id)
-          await rollbackContainer.rename({ name: serviceName })
-          await rollbackContainer.start()
-        }
+        await rollbackToOld()
 
         this.activeInstallations.delete(serviceName)
         return {

From 3977c723c28b3e1b80656c52f901f956c59235ff Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Fri, 5 Jun 2026 21:03:10 -0700
Subject: [PATCH 32/83] fix(KB): stop partial_stall warning firing on atypical
 ZIMs (link-out/PDF-heavy)

The Stored Files "partial stall" warning compares chunks in Qdrant against an
expected count from the ratio registry. The registry has an empty-pattern
catch-all (100 chunks/MB) that matches any filename, so a ZIM that matches no
specific pattern still gets a size-based estimate. For archives that are mostly
PDFs, images, or link-out stubs (e.g. irp.fas.org military-medicine), byte size
wildly over-predicts embeddable text: a 75 MB ZIM estimates ~7,236 chunks but
produces ~1, tripping a false "ingestion may have stalled" warning that re-embed
can't clear.

The catch-all is fine for rough aggregate disk-cost estimates, but it should not
drive a per-file stall signal. Add an `ignoreCatchAll` option to the ratio
lookup that excludes the empty-pattern row (returning null when only the
fallback would match), and use it in the warnings path so partial_stall only
fires when the registry has a *specific* expectation for the file. Files that
match a real pattern (wikipedia_, devdocs_, ifixit_, ...) are unaffected;
disk-cost/batch estimates keep using the fallback.

Closes #913

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 admin/app/models/kb_ratio_registry.ts    | 18 ++++++++++++---
 admin/app/services/rag_service.ts        |  7 +++++-
 admin/app/utils/kb_ratio_lookup.ts       | 18 ++++++++++++---
 admin/tests/unit/kb_ratio_lookup.spec.ts | 28 ++++++++++++++++++++++++
 4 files changed, 64 insertions(+), 7 deletions(-)

diff --git a/admin/app/models/kb_ratio_registry.ts b/admin/app/models/kb_ratio_registry.ts
index 13731b8..1d8e2e3 100644
--- a/admin/app/models/kb_ratio_registry.ts
+++ b/admin/app/models/kb_ratio_registry.ts
@@ -49,10 +49,22 @@ export default class KbRatioRegistry extends BaseModel {
     return findChunksPerMb(filename, rows)
   }
 
-  /** Estimate total chunks for a file of the given size on disk. */
-  static async estimateChunks(filename: string, fileSizeBytes: number): Promise<number | null> {
+  /**
+   * Estimate total chunks for a file of the given size on disk.
+   *
+   * `ignoreCatchAll` excludes the empty-pattern fallback, returning `null` for
+   * filenames that only the catch-all would match. The partial_stall warning
+   * uses this so it never flags ZIMs the registry can't specifically
+   * characterize (e.g. PDF/link-out-heavy archives whose byte size wildly
+   * over-predicts embeddable chunks). See #913.
+   */
+  static async estimateChunks(
+    filename: string,
+    fileSizeBytes: number,
+    opts: { ignoreCatchAll?: boolean } = {}
+  ): Promise<number | null> {
     const rows = await this.all()
-    return estimateChunkCount(filename, fileSizeBytes, rows)
+    return estimateChunkCount(filename, fileSizeBytes, rows, opts)
   }
 
   /**
diff --git a/admin/app/services/rag_service.ts b/admin/app/services/rag_service.ts
index 203913a..8c046e8 100644
--- a/admin/app/services/rag_service.ts
+++ b/admin/app/services/rag_service.ts
@@ -1242,9 +1242,14 @@ export class RagService {
         const fileSizeBytes = sizeByPath.get(source) ?? 0
         const chunksInQdrant = chunksBySource.get(source) ?? 0
         const fileName = source.split(/[/\\]/).pop() ?? source
+        // ignoreCatchAll: the partial_stall warning must only fire when the
+        // registry has a *specific* expectation for this file. The empty-pattern
+        // fallback (100 chunks/MB) over-predicts wildly for atypical ZIMs that
+        // are mostly PDFs/images/link-outs (e.g. military-medicine), producing
+        // false "ingestion stalled" warnings. Suppress Warning B in that case. (#913)
         const expectedChunks =
           fileSizeBytes > 0
-            ? await KbRatioRegistry.estimateChunks(fileName, fileSizeBytes)
+            ? await KbRatioRegistry.estimateChunks(fileName, fileSizeBytes, { ignoreCatchAll: true })
             : null
 
         const warnings = decideWarnings({ fileSizeBytes, chunksInQdrant, expectedChunks })
diff --git a/admin/app/utils/kb_ratio_lookup.ts b/admin/app/utils/kb_ratio_lookup.ts
index 1abd5c6..e5e7185 100644
--- a/admin/app/utils/kb_ratio_lookup.ts
+++ b/admin/app/utils/kb_ratio_lookup.ts
@@ -66,10 +66,21 @@ export function estimateBatch(
  *
  * Returns `null` if no row matches and no empty-string fallback is present —
  * caller decides whether to surface "unknown" or use its own default.
+ *
+ * `ignoreCatchAll` excludes the empty-string catch-all row from matching, so a
+ * filename that only the fallback would have matched returns `null` instead.
+ * Callers that need a *specific* expectation (e.g. the partial_stall warning,
+ * which must not fire on atypical ZIMs the registry can't actually characterize)
+ * pass this; rough aggregate estimates (disk cost) leave it off. See #913.
  */
-export function findChunksPerMb(filename: string, rows: RatioRow[]): number | null {
+export function findChunksPerMb(
+  filename: string,
+  rows: RatioRow[],
+  opts: { ignoreCatchAll?: boolean } = {}
+): number | null {
   let best: RatioRow | null = null
   for (const row of rows) {
+    if (opts.ignoreCatchAll && row.pattern === '') continue
     if (!filename.startsWith(row.pattern)) continue
     if (best === null || row.pattern.length > best.pattern.length) {
       best = row
@@ -88,9 +99,10 @@ export function findChunksPerMb(filename: string, rows: RatioRow[]): number | nu
 export function estimateChunkCount(
   filename: string,
   fileSizeBytes: number,
-  rows: RatioRow[]
+  rows: RatioRow[],
+  opts: { ignoreCatchAll?: boolean } = {}
 ): number | null {
-  const ratio = findChunksPerMb(filename, rows)
+  const ratio = findChunksPerMb(filename, rows, opts)
   if (ratio === null) return null
   const megabytes = fileSizeBytes / (1024 * 1024)
   return Math.round(ratio * megabytes)
diff --git a/admin/tests/unit/kb_ratio_lookup.spec.ts b/admin/tests/unit/kb_ratio_lookup.spec.ts
index 330e2a3..2c1ae61 100644
--- a/admin/tests/unit/kb_ratio_lookup.spec.ts
+++ b/admin/tests/unit/kb_ratio_lookup.spec.ts
@@ -66,6 +66,34 @@ test('estimateChunkCount returns null when no match and no fallback', () => {
   )
 })
 
+test('ignoreCatchAll: returns null for filenames only the empty-pattern fallback would match (#913)', () => {
+  // military-medicine matches no specific prefix; without ignoreCatchAll it would
+  // hit the 100 chunks/MB fallback and wildly over-predict, falsely tripping
+  // the partial_stall warning on a PDF/link-out-heavy ZIM.
+  assert.equal(
+    findChunksPerMb('irp.fas.org_en_military-medicine_2026-05.zim', SEEDED_ROWS, {
+      ignoreCatchAll: true,
+    }),
+    null
+  )
+  assert.equal(
+    estimateChunkCount('irp.fas.org_en_military-medicine_2026-05.zim', 75 * 1024 * 1024, SEEDED_ROWS, {
+      ignoreCatchAll: true,
+    }),
+    null
+  )
+})
+
+test('ignoreCatchAll: still honors a specific (non-empty) pattern match', () => {
+  // A file that matches a real prefix should be unaffected by ignoreCatchAll.
+  assert.equal(
+    findChunksPerMb('wikipedia_en_simple_all_nopic_2026-02.zim', SEEDED_ROWS, {
+      ignoreCatchAll: true,
+    }),
+    270
+  )
+})
+
 test('estimateBatch sums chunks and bytes for matched files', () => {
   const files = [
     // 100 MB devdocs -> 110,000 chunks

From 36068c645ee8014fa29885cc53f8f6bc763becca Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Sat, 6 Jun 2026 09:01:48 -0700
Subject: [PATCH 33/83] fix(KB): stop ZIM ingestion progress freezing at 99% on
 multi-page archives

On ZIMs that pack one logical article as several sub-pages (e.g. iFixit),
iterByPath yields more entries passing our isArticleEntry() filter than
archive.articleCount reports. The inter-batch progress used nextOffset /
articleCount, so the numerator outran the denominator, the ratio overflowed past
100%, and the UI (which clamps at 99%) pinned the file at 99% for the entire
remaining tail, making it look hung.

Grow the denominator to max(articleCount, nextOffset + ZIM_BATCH_SIZE) once we
pass the reported article count, so progress keeps creeping forward monotonically
instead of freezing, and clamp to 99% so only the genuinely-final batch reports
100%.

This is a graceful heuristic, not exact progress (true accuracy would require a
pre-scan to count isArticleEntry matches up front); it removes the user-visible
"stuck at 99%" symptom with no change to batch semantics.

Closes #903

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 admin/app/jobs/embed_file_job.ts | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/admin/app/jobs/embed_file_job.ts b/admin/app/jobs/embed_file_job.ts
index e224a7c..0e95791 100644
--- a/admin/app/jobs/embed_file_job.ts
+++ b/admin/app/jobs/embed_file_job.ts
@@ -176,9 +176,18 @@ export class EmbedFileJob {
           chunksSoFar: chunksSoFarNext,
         })
 
-        // Calculate progress based on articles processed
+        // Calculate progress based on articles processed.
+        //
+        // nextOffset counts entries passing our isArticleEntry() filter, but the
+        // denominator (totalArticles = archive.articleCount) uses libzim's
+        // narrower article definition. On ZIMs that pack one logical article as
+        // several sub-pages (e.g. iFixit), nextOffset outruns articleCount and a
+        // raw ratio overflows past 100%, which the UI pins at 99% for the entire
+        // tail so the file looks stuck (#903). Grow the denominator once we pass
+        // the reported count so the gauge keeps creeping forward monotonically,
+        // and never report 100% before the genuinely-final batch (handled below).
         const progress = totalArticles
-          ? Math.round((nextOffset / totalArticles) * 100)
+          ? Math.min(99, Math.round((nextOffset / Math.max(totalArticles, nextOffset + ZIM_BATCH_SIZE)) * 100))
           : 50
 
         await this.safeUpdateProgress(job, progress)

From 98d235679eb7ea7a02bda8c185903233f25dbd71 Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Sat, 6 Jun 2026 16:03:17 -0700
Subject: [PATCH 34/83] fix(docker): reject failed image pulls instead of
 treating them as success
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every Docker pull went through `followProgress(pullStream, resolve)`, passing
the Promise's resolve as dockerode's onFinished(err, output) callback — so the
error argument was ignored and a failed pull (dropped/metered connection, bad
manifest, registry error, disk full mid-pull) resolved as if it had succeeded.
The code then tried to create/start a container from a missing or partial
image, surfacing a confusing downstream error rather than the real cause. (#790)

Add a DockerService.pullImage() helper that rejects when followProgress reports
an error, and route all five pull sites through it:
  - service install
  - AMD ROCm image pull
  - service update
  - force-reinstall / recreate (forcePull)
  - sysbench benchmark image pull

Closes #790

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 admin/app/services/benchmark_service.ts |  3 +--
 admin/app/services/docker_service.ts    | 33 +++++++++++++++++++------
 2 files changed, 26 insertions(+), 10 deletions(-)

diff --git a/admin/app/services/benchmark_service.ts b/admin/app/services/benchmark_service.ts
index 47e4cf1..710b7ad 100644
--- a/admin/app/services/benchmark_service.ts
+++ b/admin/app/services/benchmark_service.ts
@@ -614,8 +614,7 @@ export class BenchmarkService {
       await this.dockerService.docker.getImage(SYSBENCH_IMAGE).inspect()
     } catch {
       this._updateStatus('starting', `Pulling sysbench image...`)
-      const pullStream = await this.dockerService.docker.pull(SYSBENCH_IMAGE)
-      await new Promise((resolve) => this.dockerService.docker.modem.followProgress(pullStream, resolve))
+      await this.dockerService.pullImage(SYSBENCH_IMAGE)
     }
   }
 
diff --git a/admin/app/services/docker_service.ts b/admin/app/services/docker_service.ts
index e907ca6..b4d40e4 100644
--- a/admin/app/services/docker_service.ts
+++ b/admin/app/services/docker_service.ts
@@ -58,6 +58,27 @@ export class DockerService {
     }
   }
 
+  /**
+   * Pull a Docker image and resolve only when the pull genuinely completes.
+   *
+   * dockerode's `followProgress(stream, onFinished)` reports failures via the
+   * first argument of onFinished. Every call site used to pass the Promise's
+   * `resolve` directly as that callback, so a failed pull (dropped/metered
+   * connection, bad manifest, registry error, disk full mid-pull) resolved as
+   * if it had succeeded — and the code then tried to create/start a container
+   * from a missing or partial image, surfacing a confusing downstream error.
+   * Rejecting on that error here lets callers fail fast with the real cause (#790).
+   */
+  async pullImage(imageName: string): Promise<void> {
+    const pullStream = await this.docker.pull(imageName)
+    await new Promise<void>((resolve, reject) => {
+      this.docker.modem.followProgress(pullStream, (error: Error | null) => {
+        if (error) reject(error)
+        else resolve()
+      })
+    })
+  }
+
   async affectContainer(
     serviceName: string,
     action: 'start' | 'stop' | 'restart'
@@ -632,13 +653,12 @@ export class DockerService {
         )
       } else {
         // Start pulling the Docker image and wait for it to complete
-        const pullStream = await this.docker.pull(service.container_image)
         this._broadcast(
           service.service_name,
           'pulling',
           `Pulling Docker image ${service.container_image}...`
         )
-        await new Promise((res) => this.docker.modem.followProgress(pullStream, res))
+        await this.pullImage(service.container_image)
       }
 
       if (service.service_name === SERVICE_NAMES.KIWIX) {
@@ -728,8 +748,7 @@ export class DockerService {
                 'pulling',
                 `Pulling Docker image ${finalImage}...`
               )
-              const rocmPullStream = await this.docker.pull(finalImage)
-              await new Promise((res) => this.docker.modem.followProgress(rocmPullStream, res))
+              await this.pullImage(finalImage)
             }
 
             const amdDevices = await this._discoverAMDDevices()
@@ -1523,8 +1542,7 @@ export class DockerService {
 
       // Step 1: Pull new image (runtimeImage diverges from newImage for AMD, see above)
       this._broadcast(serviceName, 'update-pulling', `Pulling image ${runtimeImage}...`)
-      const pullStream = await this.docker.pull(runtimeImage)
-      await new Promise((res) => this.docker.modem.followProgress(pullStream, res))
+      await this.pullImage(runtimeImage)
 
       // Step 2: Find and stop existing container
       this._broadcast(serviceName, 'update-stopping', `Stopping current container...`)
@@ -1996,8 +2014,7 @@ export class DockerService {
 
       // Pull the image if it's missing locally, or always when forcePull (e.g. :latest updates).
       if (opts.forcePull || !(await this._checkImageExists(service.container_image))) {
-        const pullStream = await this.docker.pull(service.container_image)
-        await new Promise((res) => this.docker.modem.followProgress(pullStream, res))
+        await this.pullImage(service.container_image)
       }
 
       const newContainer = await this.docker.createContainer({

From ca5ec1767ff95b0317f1ad0abf166df191fa6215 Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Sat, 6 Jun 2026 18:49:07 -0700
Subject: [PATCH 35/83] fix(security): harden assertNotPrivateUrl with
 ipaddr.js + host normalization
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replaces the regex blocklist in assertNotPrivateUrl with ipaddr.js range
classification and normalizes the host before checking it. Consolidates two
community proposals (#930 ipaddr.js parsing, #912 trailing-dot normalization)
into one validator so the SSRF-critical path lives in-house with full tests.

- Classify literal IPs by range (loopback / linkLocal / unspecified) via
  ipaddr.js instead of a hand-maintained regex list, which also catches
  alternate IPv4 encodings and avoids over-blocking mapped public IPs (the old
  `::ffff:` regex blocked every mapped address, including public ones). IPv4-
  mapped IPv6 is reduced to its embedded IPv4 before classification.
- Strip a trailing root dot from the host so `localhost.` / `127.0.0.1.` can't
  bypass the checks (they resolve to the same target as the dotless form, #911).
- Strip IPv6 brackets and lowercase for the localhost comparison.
- RFC1918, bare LAN hostnames (e.g. `nomad3`), and external FQDNs remain
  allowed — LAN appliances need them, and DNS rebinding is a fetch-time concern
  outside this guard's scope.

Adds a consolidated unit spec covering loopback/link-local/unspecified literals,
alternate encodings, IPv4-mapped v6, mixed-case + trailing-dot localhost, and
the allowed LAN/FQDN/mapped-public cases.

Resolves #922. Supersedes #930 and #912 (thanks @Gujiassh and @luyua9).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 admin/app/validators/common.ts       | 48 +++++++++++++++++--------
 admin/tests/unit/private_url.spec.ts | 53 ++++++++++++++++++++++++++++
 2 files changed, 86 insertions(+), 15 deletions(-)
 create mode 100644 admin/tests/unit/private_url.spec.ts

diff --git a/admin/app/validators/common.ts b/admin/app/validators/common.ts
index f9f4e63..077dcd3 100644
--- a/admin/app/validators/common.ts
+++ b/admin/app/validators/common.ts
@@ -14,25 +14,43 @@ import ipaddr from 'ipaddr.js'
  */
 export function assertNotPrivateUrl(urlString: string): void {
   const parsed = new URL(urlString)
-  const hostname = parsed.hostname.toLowerCase()
 
-  // `URL.hostname` strips the surrounding brackets from IPv6 literals
-  // (e.g. `http://[::1]/` → hostname `::1`), so IPv6 patterns must match
-  // the unbracketed form.
-  const blockedPatterns = [
-    /^localhost$/,
-    /^127\.\d+\.\d+\.\d+$/,
-    /^0\.0\.0\.0$/,
-    /^169\.254\.\d+\.\d+$/, // Link-local / cloud metadata
-    /^::1$/, // IPv6 loopback
-    /^fe80:/i, // IPv6 link-local
-    /^::ffff:/i, // IPv4-mapped IPv6 (e.g. ::ffff:7f00:1 = 127.0.0.1)
-    /^::$/, // IPv6 all-zeros (equivalent to 0.0.0.0)
-  ]
+  // Normalize the host before classifying it:
+  //  - lowercase for the `localhost` comparison
+  //  - strip the surrounding brackets `URL.hostname` leaves on IPv6 literals
+  //    (`http://[::1]/` → `::1`)
+  //  - strip any trailing root dot(s): `localhost.` and `127.0.0.1.` resolve to
+  //    the same target as the dotless form, so they must not slip past the
+  //    checks below (#911).
+  const hostname = parsed.hostname
+    .toLowerCase()
+    .replace(/^\[|\]$/g, '')
+    .replace(/\.+$/, '')
 
-  if (blockedPatterns.some((re) => re.test(hostname))) {
+  if (hostname === 'localhost') {
     throw new Error(`Download URL must not point to a loopback or link-local address: ${hostname}`)
   }
+
+  // Anything that isn't a literal IP (DNS names, bare LAN hostnames like
+  // `nomad3`, external FQDNs) is allowed — LAN appliances need them, and DNS
+  // rebinding is a fetch-time concern outside this guard's scope. Classifying
+  // literal addresses with ipaddr.js (rather than a regex list) catches
+  // alternate encodings and normalizes address ranges correctly (#922).
+  if (!ipaddr.isValid(hostname)) return
+
+  let addr = ipaddr.parse(hostname)
+  if (addr.kind() === 'ipv6' && (addr as ipaddr.IPv6).isIPv4MappedAddress()) {
+    // e.g. ::ffff:127.0.0.1 — classify by the embedded IPv4 so a mapped
+    // loopback/link-local is blocked while a mapped public IP is allowed.
+    addr = (addr as ipaddr.IPv6).toIPv4Address()
+  }
+
+  const range = addr.range()
+  if (range === 'loopback' || range === 'linkLocal' || range === 'unspecified') {
+    throw new Error(
+      `Download URL must not point to a loopback or link-local address: ${addr.toNormalizedString()}`
+    )
+  }
 }
 
 /**
diff --git a/admin/tests/unit/private_url.spec.ts b/admin/tests/unit/private_url.spec.ts
new file mode 100644
index 0000000..43181ed
--- /dev/null
+++ b/admin/tests/unit/private_url.spec.ts
@@ -0,0 +1,53 @@
+import * as assert from 'node:assert/strict'
+import { test } from 'node:test'
+
+import { assertNotPrivateUrl } from '../../app/validators/common.js'
+
+const expectBlocked = (url: string) => {
+  assert.throws(() => assertNotPrivateUrl(url), /loopback or link-local/)
+}
+
+const expectAllowed = (url: string) => {
+  assert.doesNotThrow(() => assertNotPrivateUrl(url))
+}
+
+test('blocks loopback and unspecified IPv4 literals', () => {
+  expectBlocked('http://127.0.0.1/file.zim')
+  expectBlocked('http://127.1.2.3/file.zim')
+  expectBlocked('http://0.0.0.0/file.zim')
+  // Alternate encodings normalized to 127.0.0.1 / 0.0.0.0 by the WHATWG URL parser
+  expectBlocked('http://0177.0.0.1/file.zim')
+  expectBlocked('http://2130706433/file.zim')
+  expectBlocked('http://0/file.zim')
+})
+
+test('blocks link-local IPv4 literals including cloud metadata', () => {
+  expectBlocked('http://169.254.169.254/latest/meta-data/')
+  expectBlocked('http://169.254.1.1/file.zim')
+})
+
+test('blocks IPv6 loopback, link-local, unspecified, and IPv4-mapped loopback', () => {
+  expectBlocked('http://[::1]/file.zim')
+  expectBlocked('http://[fe80::1]/file.zim')
+  expectBlocked('http://[::]/file.zim')
+  expectBlocked('http://[::ffff:127.0.0.1]/file.zim')
+  expectBlocked('http://[::ffff:7f00:1]/file.zim')
+})
+
+test('blocks localhost, including mixed-case and trailing-root-dot forms (#911)', () => {
+  expectBlocked('http://localhost/file.zim')
+  expectBlocked('http://LOCALHOST/file.zim')
+  expectBlocked('http://localhost./file.zim')
+  expectBlocked('http://LocalHost./file.zim')
+})
+
+test('allows RFC1918 LAN literals, bare LAN hostnames, and public FQDNs', () => {
+  expectAllowed('http://10.0.0.2/file.zim')
+  expectAllowed('http://172.16.0.2/file.zim')
+  expectAllowed('http://192.168.1.10/file.zim')
+  expectAllowed('http://nomad3/file.zim')
+  expectAllowed('http://my-nas.local/file.zim')
+  expectAllowed('https://downloads.example.com/file.zim')
+  // A mapped *public* IP must not be blocked
+  expectAllowed('http://[::ffff:8.8.8.8]/file.zim')
+})

From 026ab6df8f62738329500c54d40ef6151979a59d Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Mon, 8 Jun 2026 00:56:41 +0000
Subject: [PATCH 36/83] feat(supply-depot): add custom launch URLs for apps
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Let users override an app's "Open" link with a reverse-proxy or
local-DNS address (e.g. https://jellyfin.myhomelab.net). Falls back to
the default host+port when unset. Metadata-only — no container changes.
---
 admin/app/controllers/system_controller.ts    |  32 +++++
 admin/app/models/service.ts                   |   6 +
 admin/app/services/system_service.ts          |   2 +
 admin/app/validators/system.ts                |  28 +++++
 ...776200000001_add_custom_url_to_services.ts |  22 ++++
 admin/database/seeders/service_seeder.ts      |   1 +
 admin/inertia/components/AppUrlModal.tsx      | 113 ++++++++++++++++++
 admin/inertia/lib/api.ts                      |  10 ++
 admin/inertia/lib/navigation.ts               |  28 ++++-
 admin/inertia/pages/home.tsx                  |   7 +-
 admin/inertia/pages/settings/apps.tsx         |   4 +-
 admin/inertia/pages/supply-depot.tsx          |  35 +++++-
 admin/start/routes.ts                         |   1 +
 admin/types/services.ts                       |   1 +
 14 files changed, 282 insertions(+), 8 deletions(-)
 create mode 100644 admin/database/migrations/1776200000001_add_custom_url_to_services.ts
 create mode 100644 admin/inertia/components/AppUrlModal.tsx

diff --git a/admin/app/controllers/system_controller.ts b/admin/app/controllers/system_controller.ts
index 5443fe4..d08b8e6 100644
--- a/admin/app/controllers/system_controller.ts
+++ b/admin/app/controllers/system_controller.ts
@@ -20,6 +20,8 @@ import {
   updateCustomAppValidator,
   updateServiceValidator,
   setServiceAutoUpdateValidator,
+  setServiceCustomUrlValidator,
+  normalizeCustomUrl,
 } from '#validators/system'
 import {
   DEFAULT_CPUS,
@@ -447,6 +449,36 @@ export default class SystemController {
         return response.send({ success: true, message: `Custom app ${payload.service_name} deleted` })
     }
 
+    /** Set or clear an app's custom launch URL (works for curated and custom apps). Purely a
+     * metadata change — no container is touched. An empty/invalid value clears the override, after
+     * which the default host + port link is used again. */
+    async setServiceCustomUrl({ request, response }: HttpContext) {
+        const payload = await request.validateUsing(setServiceCustomUrlValidator)
+
+        const service = await Service.query().where('service_name', payload.service_name).first()
+        if (!service) {
+            return response.status(404).send({ success: false, message: `Service ${payload.service_name} not found` })
+        }
+        // Hidden dependency services (e.g. Qdrant) aren't user-launchable, so they have no link to set.
+        if (service.is_dependency_service) {
+            return response.status(403).send({ success: false, message: 'This service cannot be configured.' })
+        }
+
+        // Reject a non-empty value that isn't a valid http(s) URL; an empty value clears the override.
+        const normalized = normalizeCustomUrl(payload.custom_url)
+        if (payload.custom_url && payload.custom_url.trim() && !normalized) {
+            return response.status(422).send({
+                success: false,
+                message: 'Custom URL must be a valid http(s) address (e.g. https://jellyfin.myhomelab.net).',
+            })
+        }
+
+        service.custom_url = normalized
+        await service.save()
+
+        return response.send({ success: true, custom_url: service.custom_url })
+    }
+
     /** Re-pull a custom app's image and recreate its container in place (preserving volumes). */
     async updateCustomApp_pullLatest({ request, response }: HttpContext) {
         const payload = await request.validateUsing(installServiceValidator)
diff --git a/admin/app/models/service.ts b/admin/app/models/service.ts
index debd701..08c7711 100644
--- a/admin/app/models/service.ts
+++ b/admin/app/models/service.ts
@@ -59,6 +59,12 @@ export default class Service extends BaseModel {
   @column()
   declare ui_location: string | null
 
+  // User-set override for the launch ("Open") link (e.g. a reverse-proxy/local-DNS host like
+  // https://jellyfin.myhomelab.net). When null, the default host + port link derived from
+  // ui_location is used. Only affects user-facing links — never internal service-to-service URLs.
+  @column()
+  declare custom_url: string | null
+
   @column()
   declare metadata: string | null
 
diff --git a/admin/app/services/system_service.ts b/admin/app/services/system_service.ts
index 21bb422..0fff635 100644
--- a/admin/app/services/system_service.ts
+++ b/admin/app/services/system_service.ts
@@ -302,6 +302,7 @@ export class SystemService {
         'installed',
         'installation_status',
         'ui_location',
+        'custom_url',
         'friendly_name',
         'description',
         'icon',
@@ -338,6 +339,7 @@ export class SystemService {
         installation_status: service.installation_status,
         status: status ? status.status : 'unknown',
         ui_location: service.ui_location || '',
+        custom_url: service.custom_url,
         powered_by: service.powered_by,
         display_order: service.display_order,
         container_image: service.container_image,
diff --git a/admin/app/validators/system.ts b/admin/app/validators/system.ts
index 84dfa74..8f2d5a6 100644
--- a/admin/app/validators/system.ts
+++ b/admin/app/validators/system.ts
@@ -95,6 +95,34 @@ export const customAppValidator = vine.compile(
   })
 )
 
+// Set or clear an app's custom launch URL. A null/empty value clears the override; a non-empty
+// value is normalized + validated to a http(s) URL by normalizeCustomUrl in the controller.
+export const setServiceCustomUrlValidator = vine.compile(
+  vine.object({
+    service_name: vine.string().trim(),
+    custom_url: vine.string().trim().nullable(),
+  })
+)
+
+/**
+ * Normalize a user-supplied custom app URL (backend twin of the inertia helper in
+ * lib/navigation.ts). Accepts a bare host or a full URL; prepends http:// when no scheme is
+ * present. Returns the normalized href, or null when empty (clears the override) or not a valid
+ * http(s) URL. Restricting to http/https blocks javascript:/data: from ever being stored.
+ */
+export function normalizeCustomUrl(input: string | null | undefined): string | null {
+  const trimmed = (input ?? '').trim()
+  if (!trimmed) return null
+  const withScheme = /^https?:\/\//i.test(trimmed) ? trimmed : `http://${trimmed}`
+  try {
+    const url = new URL(withScheme)
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') return null
+    return url.href
+  } catch {
+    return null
+  }
+}
+
 export const deleteCustomAppValidator = vine.compile(
   vine.object({
     service_name: vine.string().trim(),
diff --git a/admin/database/migrations/1776200000001_add_custom_url_to_services.ts b/admin/database/migrations/1776200000001_add_custom_url_to_services.ts
new file mode 100644
index 0000000..91a1cf2
--- /dev/null
+++ b/admin/database/migrations/1776200000001_add_custom_url_to_services.ts
@@ -0,0 +1,22 @@
+import { BaseSchema } from '@adonisjs/lucid/schema'
+
+export default class extends BaseSchema {
+  protected tableName = 'services'
+
+  async up() {
+    this.schema.alterTable(this.tableName, (table) => {
+      // User-set override for an app's launch ("Open") link, used when the instance sits behind a
+      // reverse proxy or local DNS (e.g. https://jellyfin.myhomelab.net). When null, the default
+      // host + port link (derived from ui_location) is used. Stored separately from ui_location so
+      // the default is always recoverable, and deliberately NOT synced by the service seeder so a
+      // curated app's override survives reseeds/upgrades.
+      table.string('custom_url').nullable()
+    })
+  }
+
+  async down() {
+    this.schema.alterTable(this.tableName, (table) => {
+      table.dropColumn('custom_url')
+    })
+  }
+}
diff --git a/admin/database/seeders/service_seeder.ts b/admin/database/seeders/service_seeder.ts
index b691cdc..ae7eac8 100644
--- a/admin/database/seeders/service_seeder.ts
+++ b/admin/database/seeders/service_seeder.ts
@@ -14,6 +14,7 @@ type ServiceSeedRecord = Omit<
   | 'update_checked_at'
   | 'metadata'
   | 'is_user_modified'
+  | 'custom_url'
   | 'auto_update_enabled'
   | 'available_update_first_seen_at'
   | 'auto_update_consecutive_failures'
diff --git a/admin/inertia/components/AppUrlModal.tsx b/admin/inertia/components/AppUrlModal.tsx
new file mode 100644
index 0000000..760a259
--- /dev/null
+++ b/admin/inertia/components/AppUrlModal.tsx
@@ -0,0 +1,113 @@
+import { useEffect, useState } from 'react'
+import StyledModal from './StyledModal'
+import StyledButton from './StyledButton'
+import Input from './inputs/Input'
+import { getServiceLink, normalizeCustomUrl } from '~/lib/navigation'
+import { ServiceSlim } from '../../types/services'
+import api from '~/lib/api'
+
+interface AppUrlModalProps {
+  open: boolean
+  /** The app whose launch URL is being configured. Null while closed. */
+  service: ServiceSlim | null
+  onClose: () => void
+  /** Called after a successful save/clear so the parent can refresh the link. */
+  onSaved: () => void
+  showError: (msg: string) => void
+}
+
+/**
+ * Set or clear an app's custom launch URL — used when the instance sits behind a reverse proxy or
+ * local DNS (e.g. https://jellyfin.myhomelab.net). Leaving the field empty clears the override and
+ * reverts to the default host + port link. Works for both curated and custom apps.
+ */
+export default function AppUrlModal({ open, service, onClose, onSaved, showError }: AppUrlModalProps) {
+  const [value, setValue] = useState('')
+  const [submitting, setSubmitting] = useState(false)
+
+  // Prefill from the app's stored override each time the modal opens for a service.
+  useEffect(() => {
+    if (open && service) setValue(service.custom_url ?? '')
+  }, [open, service])
+
+  const trimmed = value.trim()
+  const normalized = normalizeCustomUrl(value)
+  const isInvalid = trimmed.length > 0 && !normalized
+  // What clicking "Open" will actually resolve to once saved.
+  const previewLink = service ? getServiceLink(service.ui_location || '', value) : ''
+  const usingDefault = !normalized
+
+  async function handleSave() {
+    if (!service || isInvalid) return
+    setSubmitting(true)
+    // Empty clears the override; the backend re-normalizes/validates the value too.
+    const result = await api.setServiceCustomUrl(service.service_name, trimmed ? trimmed : null)
+    setSubmitting(false)
+    if (!result?.success) {
+      showError('Failed to save custom URL.')
+      return
+    }
+    onSaved()
+  }
+
+  const appName = service?.friendly_name || service?.service_name || 'this app'
+
+  return (
+    <StyledModal
+      title="Set Custom URL"
+      open={open}
+      onCancel={onClose}
+      onClose={onClose}
+      cancelText="Cancel"
+      onConfirm={handleSave}
+      confirmVariant="primary"
+      confirmText="Save"
+      confirmIcon="IconCheck"
+      confirmLoading={submitting}
+      confirmDisabled={isInvalid}
+    >
+      <div className="space-y-4 text-sm">
+        <p className="text-text-muted">
+          Set where <span className="font-medium text-text-primary">{appName}</span> opens from — useful
+          if you reach it through a reverse proxy or local DNS. Leave this empty to use the default
+          address ({service?.ui_location ? `host + port ${service.ui_location}` : 'host + port'}).
+        </p>
+
+        <div>
+          <div className="flex items-end gap-2">
+            <Input
+              name="customUrl"
+              label="Custom URL"
+              placeholder="http://jellyfin.myhomelab.net"
+              value={value}
+              onChange={(e) => setValue(e.target.value)}
+              error={isInvalid}
+              className="flex-1 min-w-0"
+            />
+            {value.length > 0 && (
+              <StyledButton size="sm" variant="ghost" icon="IconX" onClick={() => setValue('')} className="mb-1.5">
+                Clear
+              </StyledButton>
+            )}
+          </div>
+          {isInvalid ? (
+            <p className="mt-1.5 text-xs text-red-500">
+              Enter a valid http(s) address (e.g. https://jellyfin.myhomelab.net). A bare host like
+              "jellyfin.lan" becomes http://jellyfin.lan.
+            </p>
+          ) : (
+            <>
+              <p className="mt-1.5 text-xs text-text-muted">
+                No scheme? We'll default to <span className="font-mono">http://</span>.</p>
+              <p className="mt-1.5 text-xs text-text-muted">
+                Opens as:{' '}
+                <span className="font-mono break-all text-text-primary">{previewLink}</span>
+                {usingDefault ? ' (default)' : ''}
+              </p>
+            </>
+          )}
+        </div>
+      </div>
+    </StyledModal>
+  )
+}
diff --git a/admin/inertia/lib/api.ts b/admin/inertia/lib/api.ts
index 6b9a4de..73b0d37 100644
--- a/admin/inertia/lib/api.ts
+++ b/admin/inertia/lib/api.ts
@@ -1049,6 +1049,16 @@ class API {
     })()
   }
 
+  async setServiceCustomUrl(service_name: string, custom_url: string | null) {
+    return catchInternal(async () => {
+      const response = await this.client.put<{ success: boolean; custom_url: string | null }>(
+        '/system/services/custom-url',
+        { service_name, custom_url }
+      )
+      return response.data
+    })()
+  }
+
   async deleteCustomApp(service_name: string, remove_image = false) {
     return catchInternal(async () => {
       const response = await this.client.delete<{ success: boolean; message: string }>(
diff --git a/admin/inertia/lib/navigation.ts b/admin/inertia/lib/navigation.ts
index b88255e..88eea02 100644
--- a/admin/inertia/lib/navigation.ts
+++ b/admin/inertia/lib/navigation.ts
@@ -1,6 +1,32 @@
 
+/**
+ * Normalize a user-supplied custom app URL. Accepts a bare host ("jellyfin.lan",
+ * "10.0.0.5:8096") or a full URL; when no scheme is present, http:// is prepended
+ * (LAN resources are usually plain HTTP). Returns the normalized href, or null when
+ * the input is empty (clears the override) or not a valid http(s) URL. Restricting to
+ * http/https is the XSS guard — javascript:/data: URLs never make it into an href.
+ */
+export function normalizeCustomUrl(input: string | null | undefined): string | null {
+    const trimmed = (input ?? '').trim();
+    if (!trimmed) return null;
+    const withScheme = /^https?:\/\//i.test(trimmed) ? trimmed : `http://${trimmed}`;
+    try {
+        const url = new URL(withScheme);
+        if (url.protocol !== 'http:' && url.protocol !== 'https:') return null;
+        return url.href;
+    } catch {
+        return null;
+    }
+}
+
+export function getServiceLink(ui_location: string, customUrl?: string | null): string {
+    // A user-set custom URL (reverse proxy / local DNS) overrides the computed default. Only
+    // accepted when it normalizes to a valid http(s) URL — otherwise fall through to the default.
+    const normalizedCustom = normalizeCustomUrl(customUrl);
+    if (normalizedCustom) {
+        return normalizedCustom;
+    }
 
-export function getServiceLink(ui_location: string): string {
     // "https:8480" / "http:8480" — an explicit scheme + port served on the current host. Checked
     // before the URL parse below because new URL("https:8480") would mis-parse 8480 as the host.
     const schemePort = ui_location.match(/^(https?):(\d+)$/);
diff --git a/admin/inertia/pages/home.tsx b/admin/inertia/pages/home.tsx
index b9581bc..bf38fc1 100644
--- a/admin/inertia/pages/home.tsx
+++ b/admin/inertia/pages/home.tsx
@@ -101,12 +101,15 @@ export default function Home(props: {
 
   // Add installed services (non-dependency services only)
   props.system.services
-    .filter((service) => service.installed && service.ui_location)
+    .filter((service) => service.installed && (service.ui_location || service.custom_url))
     .forEach((service) => {
       items.push({
         // Inject custom AI Assistant name if this is the chat service
         label: service.service_name === SERVICE_NAMES.OLLAMA && aiAssistantName ? aiAssistantName : (service.friendly_name || service.service_name),
-        to: service.ui_location ? getServiceLink(service.ui_location) : '#',
+        to:
+          service.ui_location || service.custom_url
+            ? getServiceLink(service.ui_location || '', service.custom_url)
+            : '#',
         target: '_blank',
         description:
           service.description ||
diff --git a/admin/inertia/pages/settings/apps.tsx b/admin/inertia/pages/settings/apps.tsx
index 48260c2..c5c5fbf 100644
--- a/admin/inertia/pages/settings/apps.tsx
+++ b/admin/inertia/pages/settings/apps.tsx
@@ -253,7 +253,7 @@ export default function SettingsPage(props: { system: { services: ServiceSlim[]
         <StyledButton
           icon={'IconExternalLink'}
           onClick={() => {
-            window.open(getServiceLink(record.ui_location || 'unknown'), '_blank')
+            window.open(getServiceLink(record.ui_location || 'unknown', record.custom_url), '_blank')
           }}
         >
           Open
@@ -374,7 +374,7 @@ export default function SettingsPage(props: { system: { services: ServiceSlim[]
                   title: 'Location',
                   render: (record) => (
                     <a
-                      href={getServiceLink(record.ui_location || 'unknown')}
+                      href={getServiceLink(record.ui_location || 'unknown', record.custom_url)}
                       target="_blank"
                       rel="noopener noreferrer"
                       className="text-desert-green hover:underline font-semibold"
diff --git a/admin/inertia/pages/supply-depot.tsx b/admin/inertia/pages/supply-depot.tsx
index 6e498c1..8c8dcac 100644
--- a/admin/inertia/pages/supply-depot.tsx
+++ b/admin/inertia/pages/supply-depot.tsx
@@ -17,6 +17,7 @@ import {
   IconRefresh,
   IconSearch,
   IconTrash,
+  IconWorld,
 } from '@tabler/icons-react'
 import AppLayout from '~/layouts/AppLayout'
 import DynamicIcon, { DynamicIconName } from '~/components/DynamicIcon'
@@ -26,6 +27,7 @@ import InstallActivityFeed from '~/components/InstallActivityFeed'
 import LoadingSpinner from '~/components/LoadingSpinner'
 import Alert from '~/components/Alert'
 import CustomAppModal, { CustomAppInitial } from '~/components/CustomAppModal'
+import AppUrlModal from '~/components/AppUrlModal'
 import ServiceLogsModal from '~/components/ServiceLogsModal'
 import ServiceStatsModal from '~/components/ServiceStatsModal'
 import StyledSectionHeader from '~/components/StyledSectionHeader'
@@ -104,6 +106,8 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
   const [openDropdown, setOpenDropdown] = useState<string | null>(null)
   const [customAppOpen, setCustomAppOpen] = useState(false)
   const [editApp, setEditApp] = useState<CustomAppInitial | null>(null)
+  // App whose custom launch URL is being configured (null while the modal is closed).
+  const [urlApp, setUrlApp] = useState<ServiceSlim | null>(null)
   const [removeImage, setRemoveImage] = useState(false)
   // Optimistic per-app auto-update toggle state, keyed by service_name. Lets the
   // toggle reflect instantly without a full page reload (props come from Inertia).
@@ -305,6 +309,17 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
     setTimeout(() => window.location.reload(), 1500)
   }
 
+  function handleSetUrl(service: ServiceSlim) {
+    setOpenDropdown(null)
+    setUrlApp(service)
+  }
+
+  function handleUrlSaved() {
+    setUrlApp(null)
+    // Reload so the new link flows through to the card, /home, and settings.
+    window.location.reload()
+  }
+
   // ── Install modal helpers ─────────────────────────────────────────────────
   const hasPreflightWarnings =
     (preflight?.portConflicts.length ?? 0) > 0 || (preflight?.resourceWarnings.length ?? 0) > 0
@@ -438,6 +453,7 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
                       onLogs={() => setModal({ type: 'logs', service })}
                       onStats={() => setModal({ type: 'stats', service })}
                       onEdit={() => handleEdit(service)}
+                      onSetUrl={() => handleSetUrl(service)}
                       onUpdate={() => handleUpdate(service)}
                       onUpdateVersion={() => setModal({ type: 'update', service })}
                       autoUpdateEnabled={
@@ -471,6 +487,7 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
                       onLogs={() => setModal({ type: 'logs', service })}
                       onStats={() => setModal({ type: 'stats', service })}
                       onEdit={() => handleEdit(service)}
+                      onSetUrl={() => handleSetUrl(service)}
                       onUpdate={() => handleUpdate(service)}
                       onUpdateVersion={() => setModal({ type: 'update', service })}
                     />
@@ -695,6 +712,15 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
         onCreated={handleEdited}
         showError={showError}
       />
+
+      {/* Custom launch URL modal */}
+      <AppUrlModal
+        open={!!urlApp}
+        service={urlApp}
+        onClose={() => setUrlApp(null)}
+        onSaved={handleUrlSaved}
+        showError={showError}
+      />
     </AppLayout>
   )
 }
@@ -715,6 +741,7 @@ interface AppCardProps {
   onLogs: () => void
   onStats: () => void
   onEdit: () => void
+  onSetUrl: () => void
   onUpdate: () => void
   onUpdateVersion: () => void
   // Installed-only: per-app auto-update preference + toggle handler.
@@ -738,6 +765,7 @@ function AppCard({
   onLogs,
   onStats,
   onEdit,
+  onSetUrl,
   onUpdate,
   onUpdateVersion,
   autoUpdateEnabled,
@@ -878,10 +906,10 @@ function AppCard({
 
         {service.installed ? (
           <>
-            {/* Open button */}
-            {service.ui_location && (
+            {/* Open button — shown when the app has a default location or a user-set custom URL */}
+            {(service.ui_location || service.custom_url) && (
               <a
-                href={getServiceLink(service.ui_location)}
+                href={getServiceLink(service.ui_location, service.custom_url)}
                 target="_blank"
                 rel="noopener noreferrer"
                 className="flex-1"
@@ -922,6 +950,7 @@ function AppCard({
                   <DropdownItem icon={<IconFileText className="h-4 w-4" />} label="Logs" onClick={onLogs} />
                   <DropdownItem icon={<IconChartBar className="h-4 w-4" />} label="Stats" onClick={onStats} />
                   <DropdownItem icon={<IconPencil className="h-4 w-4" />} label="Edit" onClick={onEdit} />
+                  <DropdownItem icon={<IconWorld className="h-4 w-4" />} label="Set custom URL" onClick={onSetUrl} />
                   {!service.is_custom && onToggleAutoUpdate ? (
                     autoUpdateMasterEnabled ? (
                       <DropdownItem
diff --git a/admin/start/routes.ts b/admin/start/routes.ts
index 8af8966..96b3aee 100644
--- a/admin/start/routes.ts
+++ b/admin/start/routes.ts
@@ -178,6 +178,7 @@ router
     router.post('/services/custom/update', [SystemController, 'updateCustomApp_pullLatest'])
     router.delete('/services/custom', [SystemController, 'deleteCustomApp'])
     router.get('/services/custom/:name', [SystemController, 'getCustomApp'])
+    router.put('/services/custom-url', [SystemController, 'setServiceCustomUrl'])
     router.get('/services/:name/logs', [SystemController, 'getServiceLogs'])
     router.get('/services/:name/stats', [SystemController, 'getServiceStats'])
     router.get('/services/:name/available-versions', [SystemController, 'getAvailableVersions'])
diff --git a/admin/types/services.ts b/admin/types/services.ts
index e9ccdc3..f953648 100644
--- a/admin/types/services.ts
+++ b/admin/types/services.ts
@@ -7,6 +7,7 @@ export type ServiceSlim = Pick<
   | 'installed'
   | 'installation_status'
   | 'ui_location'
+  | 'custom_url'
   | 'friendly_name'
   | 'description'
   | 'icon'

From 1b9f4f30f213223b3497b6494358bc8126b4a913 Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Sat, 6 Jun 2026 19:06:06 -0700
Subject: [PATCH 37/83] fix(kiwix): self-heal a missing or corrupt library XML
 on startup
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Kiwix runs in library mode reading kiwix-library.xml via --monitorLibrary.
Today a missing or corrupt XML is only repaired on the download path
(rebuildFromDisk after a completed download), so if the file is lost or
truncated outside that flow — storage relocation, an interrupted write, manual
deletion — Kiwix comes up serving an empty library with no path to recovery.

Add KiwixLibraryService.ensureLibraryXmlHealthy(): reads the XML, and if it's
missing (ENOENT) or fails to parse / lacks a <library> root, rebuilds it from
the ZIM files on disk. A well-formed but empty library is treated as valid (no
spurious rebuild), and filesystem errors other than ENOENT are surfaced rather
than masked. The boot provider calls it on the already-in-library-mode path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 admin/app/services/kiwix_library_service.ts | 50 +++++++++++++++++++++
 admin/providers/kiwix_migration_provider.ts | 11 ++++-
 2 files changed, 60 insertions(+), 1 deletion(-)

diff --git a/admin/app/services/kiwix_library_service.ts b/admin/app/services/kiwix_library_service.ts
index 183afe6..81f63fa 100644
--- a/admin/app/services/kiwix_library_service.ts
+++ b/admin/app/services/kiwix_library_service.ts
@@ -201,6 +201,56 @@ export class KiwixLibraryService {
     }
   }
 
+  /**
+   * True if the library XML parses and has a <library> root. A truncated or
+   * corrupt file (e.g. an interrupted write) fails this even though it exists,
+   * so the caller can rebuild rather than leave Kiwix serving a broken library.
+   * An empty-but-well-formed library is considered valid (nothing to repair).
+   */
+  private _isValidLibraryXml(xmlContent: string): boolean {
+    try {
+      const parser = new XMLParser({
+        ignoreAttributes: false,
+        attributeNamePrefix: '@_',
+        isArray: (name) => name === 'book',
+      })
+      const parsed = parser.parse(xmlContent)
+      return parsed?.library !== undefined && parsed?.library !== null
+    } catch {
+      return false
+    }
+  }
+
+  /**
+   * Boot-time safety net: if the library XML is missing or unparseable, rebuild
+   * it from the ZIM files on disk so Kiwix (running in library mode with
+   * --monitorLibrary) doesn't come up serving an empty/broken library with no
+   * path to recovery. This covers files lost or corrupted outside the normal
+   * download flow (storage relocation, interrupted write, manual deletion).
+   *
+   * Returns true if a rebuild was performed. Filesystem errors other than
+   * "not found" are surfaced rather than masked by a rebuild.
+   */
+  async ensureLibraryXmlHealthy(): Promise<boolean> {
+    let content: string
+    try {
+      content = await readFile(this.getLibraryFilePath(), 'utf-8')
+    } catch (err: any) {
+      if (err?.code === 'ENOENT') {
+        logger.warn('[KiwixLibraryService] Library XML missing on startup; rebuilding from disk.')
+        await this.rebuildFromDisk()
+        return true
+      }
+      throw err
+    }
+
+    if (this._isValidLibraryXml(content)) return false
+
+    logger.warn('[KiwixLibraryService] Library XML present but invalid; rebuilding from disk.')
+    await this.rebuildFromDisk()
+    return true
+  }
+
   async rebuildFromDisk(opts?: { excludeFilenames?: string[] }): Promise<number> {
     const dirPath = join(process.cwd(), ZIM_STORAGE_PATH)
     await ensureDirectoryExists(dirPath)
diff --git a/admin/providers/kiwix_migration_provider.ts b/admin/providers/kiwix_migration_provider.ts
index 5e010b3..e9bccf7 100644
--- a/admin/providers/kiwix_migration_provider.ts
+++ b/admin/providers/kiwix_migration_provider.ts
@@ -22,6 +22,7 @@ export default class KiwixMigrationProvider {
         const Service = (await import('#models/service')).default
         const { SERVICE_NAMES } = await import('../constants/service_names.js')
         const { DockerService } = await import('#services/docker_service')
+        const { KiwixLibraryService } = await import('#services/kiwix_library_service')
 
         const kiwixService = await Service.query()
           .where('service_name', SERVICE_NAMES.KIWIX)
@@ -36,7 +37,15 @@ export default class KiwixMigrationProvider {
         const isLegacy = await dockerService.isKiwixOnLegacyConfig()
 
         if (!isLegacy) {
-          logger.info('[KiwixMigrationProvider] Kiwix is already in library mode — no migration needed.')
+          // Already in library mode. Make sure the library XML actually exists and
+          // is parseable — if it was lost or corrupted outside the download flow,
+          // rebuild it from disk so Kiwix isn't left serving an empty library.
+          const rebuilt = await new KiwixLibraryService().ensureLibraryXmlHealthy()
+          logger.info(
+            rebuilt
+              ? '[KiwixMigrationProvider] Rebuilt missing/invalid Kiwix library XML on startup.'
+              : '[KiwixMigrationProvider] Kiwix is already in library mode — no migration needed.'
+          )
           return
         }
 

From 663c1593dfa5b539a77224d5048e32132135dcef Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Mon, 8 Jun 2026 09:18:09 -0700
Subject: [PATCH 38/83] fix(system): disable Update button while a service
 update is in flight (#931)

A multi-GB service update (e.g. nomad_ollama pulling ~6.5 GB) left the
Update button clickable with no feedback, so users clicked again thinking
it was stuck. The second click raced a concurrent updateContainer run into
Docker 304/400 errors (stop/rename on a container the first run had already
moved). The backend lock was in-memory only and never written to the DB, so
nothing durable signaled "update in progress" to the UI, and a page reload
mid-pull re-enabled the button.

Backend (docker_service.updateContainer):
- Set installation_status='installing' when the update starts and reset it
  to 'idle' in a finally on every exit path. This mirrors the install path,
  survives a page reload, and is visible to other tabs/clients.
- Reject a second update with a clear message when installation_status is
  already 'installing', instead of letting it race into Docker errors.

Frontend (settings/apps.tsx):
- Track in-flight updates per service. Seed optimistically on click and
  reconcile with the durable installation_status from the server.
- Disable the per-service Update button and show "Updating..." while in
  flight. Drop the fullscreen spinner for updates so the table and the
  activity feed (live pull/stop/start progress) stay visible.

Closes #931
---
 admin/app/services/docker_service.ts  | 26 +++++++++++++++++
 admin/inertia/pages/settings/apps.tsx | 42 +++++++++++++++++++--------
 2 files changed, 56 insertions(+), 12 deletions(-)

diff --git a/admin/app/services/docker_service.ts b/admin/app/services/docker_service.ts
index b4d40e4..c836705 100644
--- a/admin/app/services/docker_service.ts
+++ b/admin/app/services/docker_service.ts
@@ -1478,8 +1478,19 @@ export class DockerService {
       if (this.activeInstallations.has(serviceName)) {
         return { success: false, message: `Service ${serviceName} already has an operation in progress` }
       }
+      // DB-level guard mirrors the install path. Unlike the in-memory Set above, this survives a
+      // page reload and is visible to other clients, so a second Update click (or one from another
+      // tab) is rejected cleanly instead of racing two updateContainer runs into Docker 304/400
+      // errors (stop/rename on a container the first run already moved).
+      if (service.installation_status === 'installing') {
+        return { success: false, message: `Service ${serviceName} already has an update in progress` }
+      }
 
       this.activeInstallations.add(serviceName)
+      // Persist the in-progress flag so the Apps page can durably disable the Update button while
+      // the (often multi-GB, multi-minute) pull runs. Cleared in the finally below.
+      service.installation_status = 'installing'
+      await service.save()
 
       // newImage = the semver tag we record in the DB after the update (e.g. ollama/ollama:0.23.2).
       // runtimeImage = the tag we actually pull and run. For AMD-on-Ollama these diverge: we run
@@ -1741,6 +1752,21 @@ export class DockerService {
       )
       logger.error({ err: error }, `[DockerService] Update failed for ${serviceName}`)
       return { success: false, message: 'Update failed. Check server logs for details.' }
+    } finally {
+      // Always clear the in-progress flag we set above, on every exit path (success, rollback,
+      // not-found, or thrown error). The success path already persisted the new image/version on
+      // this same in-memory model, so saving again with idle preserves that — it only flips the
+      // status. The existing activeInstallations.delete() calls on each branch handle the
+      // in-memory lock; this just keeps the durable DB flag honest.
+      const svc = await Service.query().where('service_name', serviceName).first()
+      if (svc && svc.installation_status === 'installing') {
+        svc.installation_status = 'idle'
+        try {
+          await svc.save()
+        } catch (saveErr: any) {
+          logger.error({ err: saveErr }, `[DockerService] Failed to reset installation_status for ${serviceName}`)
+        }
+      }
     }
   }
 
diff --git a/admin/inertia/pages/settings/apps.tsx b/admin/inertia/pages/settings/apps.tsx
index c5c5fbf..2f23387 100644
--- a/admin/inertia/pages/settings/apps.tsx
+++ b/admin/inertia/pages/settings/apps.tsx
@@ -34,6 +34,10 @@ export default function SettingsPage(props: { system: { services: ServiceSlim[]
   const [isInstalling, setIsInstalling] = useState(false)
   const [loading, setLoading] = useState(false)
   const [checkingUpdates, setCheckingUpdates] = useState(false)
+  // Services with an update in flight. Seeded optimistically on click so the button disables
+  // instantly, and reconciled with the durable `installation_status` from the server so the
+  // disabled state survives a page reload or a second open tab while the pull runs.
+  const [updatingServices, setUpdatingServices] = useState<Set<string>>(new Set())
 
   useEffect(() => {
     if (installActivity.length === 0) return
@@ -181,16 +185,25 @@ export default function SettingsPage(props: { system: { services: ServiceSlim[]
         onCancel={closeAllModals}
         onUpdate={async (targetVersion: string) => {
           closeAllModals()
+          // Mark this service as updating instead of showing the fullscreen spinner, so the table
+          // and the activity feed stay visible (the feed streams live pull/stop/start progress)
+          // while the button shows "Updating..." and is disabled.
+          setUpdatingServices((prev) => new Set(prev).add(record.service_name))
           try {
-            setLoading(true)
             const response = await api.updateService(record.service_name, targetVersion)
             if (!response?.success) {
               throw new Error(response?.message || 'Update failed')
             }
+            // On success the backend broadcasts `update-complete`, which triggers the reload effect
+            // above and refreshes the version + status. Leave the button disabled until then.
           } catch (error) {
             console.error(`Error updating service ${record.service_name}:`, error)
             showError(`Failed to update service: ${error.message || 'Unknown error'}`)
-            setLoading(false)
+            setUpdatingServices((prev) => {
+              const next = new Set(prev)
+              next.delete(record.service_name)
+              return next
+            })
           }
         }}
         showError={showError}
@@ -258,16 +271,21 @@ export default function SettingsPage(props: { system: { services: ServiceSlim[]
         >
           Open
         </StyledButton>
-        {record.available_update_version && (
-          <StyledButton
-            icon="IconArrowUp"
-            variant="primary"
-            onClick={() => handleUpdateService(record)}
-            disabled={isInstalling || !isOnline}
-          >
-            Update
-          </StyledButton>
-        )}
+        {record.available_update_version && (() => {
+          const isUpdating =
+            updatingServices.has(record.service_name) || record.installation_status === 'installing'
+          return (
+            <StyledButton
+              icon="IconArrowUp"
+              variant="primary"
+              onClick={() => handleUpdateService(record)}
+              disabled={isInstalling || !isOnline || isUpdating}
+              loading={isUpdating}
+            >
+              {isUpdating ? 'Updating...' : 'Update'}
+            </StyledButton>
+          )
+        })()}
         {record.status && record.status !== 'unknown' && (
           <>
             <StyledButton

From df47139846596f3f4c02a1dc9920373496c8ad7f Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Mon, 8 Jun 2026 09:55:15 -0700
Subject: [PATCH 39/83] fix(content): narrow Wikipedia reconcile-skip to the
 managed selection file
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

reconcileFromFilesystem() skipped every ZIM whose filename starts with
`wikipedia_en_`, on the assumption that all such files are managed by the
WikipediaSelection model. But curated category tiers ship Wikipedia-themed
ZIMs (e.g. Medicine → Comprehensive includes `wikipedia_en_medicine_maxi`),
so those files were skipped during reconcile and their InstalledResource
rows got wiped on every restart — silently downgrading the detected tier.

Skip only the single file actually tracked by WikipediaSelection, matched
by exact filename instead of the `wikipedia_en_` prefix.

Reimplemented in-house from @johno10661's PR #774 (which was trapped on a
stale base); credit to them for the diagnosis and fix.

Closes #774
---
 admin/app/services/collection_manifest_service.ts | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/admin/app/services/collection_manifest_service.ts b/admin/app/services/collection_manifest_service.ts
index 2479f82..ac9f6e3 100644
--- a/admin/app/services/collection_manifest_service.ts
+++ b/admin/app/services/collection_manifest_service.ts
@@ -5,6 +5,7 @@ import { DateTime } from 'luxon'
 import { join } from 'path'
 import CollectionManifest from '#models/collection_manifest'
 import InstalledResource from '#models/installed_resource'
+import WikipediaSelection from '#models/wikipedia_selection'
 import { QueueService } from './queue_service.js'
 import { RunDownloadJob } from '#jobs/run_download_job'
 import { zimCategoriesSpecSchema, mapsSpecSchema, wikipediaSpecSchema } from '#validators/curated_collections'
@@ -284,10 +285,17 @@ export class CollectionManifestService {
 
       const seenZimIds = new Set<string>()
 
+      // Only skip the single Wikipedia file tracked by WikipediaSelection — not every file
+      // starting with `wikipedia_en_`. Curated category tiers (e.g. Medicine → Comprehensive)
+      // ship Wikipedia-themed ZIMs like `wikipedia_en_medicine_maxi` that must reconcile
+      // normally; otherwise their InstalledResource row gets wiped on every restart and the
+      // tier detection silently downgrades.
+      const wikipediaSelection = await WikipediaSelection.query().first()
+      const managedWikipediaFilename = wikipediaSelection?.filename ?? null
+
       for (const file of zimFiles) {
         console.log(`Processing ZIM file: ${file.name}`)
-        // Skip Wikipedia files (managed by WikipediaSelection model)
-        if (file.name.startsWith('wikipedia_en_')) continue
+        if (managedWikipediaFilename && file.name === managedWikipediaFilename) continue
 
         const parsed = CollectionManifestService.parseZimFilename(file.name)
         console.log(`Parsed ZIM filename:`, parsed)

From a315ce0f5412797b852fdd8e8829f0711af84496 Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Mon, 8 Jun 2026 09:42:00 -0700
Subject: [PATCH 40/83] fix(AI): truncate-and-retry oversized embed chunks;
 stop 30x retry storm (#881)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Dense source content produces chunks that exceed the embedding model's
context window (nomic-embed-text:v1.5 defaults to 2048 tokens). Two paths
hit this even after the prior pre-cap:

  - Older Ollama (e.g. 0.18.1, #944) ignores the num_ctx=8192 we send on
    /api/embed, so it stays at the model's 2048 default.
  - The OpenAI-compat /v1/embeddings fallback didn't pass num_ctx/truncate
    at all, so any Ollama drops to 2048 whenever it lands on the fallback.

When a chunk overflowed, the 400 was swallowed and the chunk was silently
dropped from Qdrant. Worse, the failure propagated to EmbedFileJob, which
re-embeds the entire file on each of its 30 BullMQ attempts — the "endless
queue loop" / "api/embed for weeks" / pegged GPU reported in #944/#959.

Fix:
  - OllamaService.embed(): on a context-length error, retry once with an
    aggressive 2048-safe cap (EMBED_CONTEXT_SAFE_CHARS = 2000) so the chunk
    is embedded (start-of-chunk) instead of dropped. Native-path context
    errors now bubble to this retry instead of falling through to the
    smaller-context fallback. Split the native+fallback attempt into
    _embedWithFallback().
  - Pass truncate/num_ctx on the /v1/embeddings fallback too (Ollama's
    OpenAI-compat shim forwards them).
  - EmbedFileJob: classify "input length exceeds context length" as an
    UnrecoverableError so one permanently-oversized chunk can't trigger 30
    full-file re-embeds.
  - Add OllamaService.isContextLengthError() shared by both.

Graceful degradation: a truncated chunk loses its tail but is kept in the
index, which is strictly better than today's silent drop + retry storm.

Refs #881. Supersedes the #369/#670 symptom closures that never fixed the
fallback path.
---
 admin/app/jobs/embed_file_job.ts     |  25 ++++--
 admin/app/services/ollama_service.ts | 124 ++++++++++++++++++---------
 2 files changed, 105 insertions(+), 44 deletions(-)

diff --git a/admin/app/jobs/embed_file_job.ts b/admin/app/jobs/embed_file_job.ts
index 0e95791..93f58a9 100644
--- a/admin/app/jobs/embed_file_job.ts
+++ b/admin/app/jobs/embed_file_job.ts
@@ -247,23 +247,38 @@ export class EmbedFileJob {
         message: `Successfully embedded ${result.chunks} chunks`,
       }
     } catch (error) {
-      logger.error(`[EmbedFileJob] Error embedding file ${fileName}:`, error)
+      // A chunk that still exceeds the model's context after OllamaService's truncate-and-retry is
+      // permanently oversized for this install (e.g. a model whose context is smaller than our safe
+      // cap). Re-embedding the whole file 30x re-processes everything and can never succeed — that is
+      // the "endless queue loop" / "api/embed for weeks" (#881/#944/#959). Mark it unrecoverable so
+      // BullMQ stops after one pass instead of storming.
+      let normalizedError = error
+      if (!(error instanceof UnrecoverableError) && OllamaService.isContextLengthError(error)) {
+        logger.warn(
+          `[EmbedFileJob] Context-length overflow persisted for ${fileName} after truncation; not retrying.`
+        )
+        normalizedError = new UnrecoverableError(
+          error instanceof Error ? error.message : 'Embedding input exceeds the model context length'
+        )
+      }
+
+      logger.error(`[EmbedFileJob] Error embedding file ${fileName}:`, normalizedError)
 
       await job.updateData({
         ...job.data,
         status: 'failed',
         failedAt: Date.now(),
-        error: error instanceof Error ? error.message : 'Unknown error',
+        error: normalizedError instanceof Error ? normalizedError.message : 'Unknown error',
       })
 
       // Only persist `failed` for unrecoverable errors. Retryable errors get
       // automatic BullMQ retries (30 attempts); marking state failed on every
       // transient blip would suppress the retry-driven recovery path.
-      if (error instanceof UnrecoverableError) {
+      if (normalizedError instanceof UnrecoverableError) {
         try {
           await KbIngestState.markFailed(
             filePath,
-            error instanceof Error ? error.message : 'Unknown error'
+            normalizedError instanceof Error ? normalizedError.message : 'Unknown error'
           )
         } catch (stateErr) {
           logger.warn(
@@ -273,7 +288,7 @@ export class EmbedFileJob {
         }
       }
 
-      throw error
+      throw normalizedError
     }
   }
 
diff --git a/admin/app/services/ollama_service.ts b/admin/app/services/ollama_service.ts
index 526407c..be319e9 100644
--- a/admin/app/services/ollama_service.ts
+++ b/admin/app/services/ollama_service.ts
@@ -481,9 +481,43 @@ export class OllamaService {
    */
   public static readonly EMBED_MAX_INPUT_CHARS = 4000
 
+  /**
+   * Aggressive 2048-safe character cap, applied only on a context-length retry. nomic-embed-text:v1.5
+   * defaults to a 2048-token context, and on the OpenAI-compat fallback path (or an older Ollama that
+   * ignores num_ctx for embeddings) we cannot widen it at request time. 2000 chars stays under 2048
+   * tokens even for the densest content (~1 char/token code/markup), so an oversized chunk gets
+   * truncated-and-kept instead of silently dropped from Qdrant — and the embed job stops re-embedding
+   * the whole file 30x on the one bad chunk (#881).
+   */
+  public static readonly EMBED_CONTEXT_SAFE_CHARS = 2000
+
+  /**
+   * True if the error is the model rejecting input that exceeds its context window
+   * ("input length exceeds the context length"). Matches both the native /api/embed axios error
+   * shape and the OpenAI-compat BadRequestError. Drives the truncate-and-retry here and the
+   * non-retryable classification in EmbedFileJob (#881).
+   */
+  public static isContextLengthError(err: unknown): boolean {
+    const parts: string[] = []
+    if (err instanceof Error && err.message) parts.push(err.message)
+    const anyErr = err as any
+    const data = anyErr?.response?.data
+    if (data) parts.push(typeof data === 'string' ? data : JSON.stringify(data))
+    if (anyErr?.error) parts.push(typeof anyErr.error === 'string' ? anyErr.error : JSON.stringify(anyErr.error))
+    const haystack = parts.join(' ').toLowerCase()
+    return (
+      (haystack.includes('context length') && haystack.includes('exceed')) ||
+      haystack.includes('input length exceeds')
+    )
+  }
+
   /**
    * Generate embeddings for the given input strings.
    * Tries the Ollama native /api/embed endpoint first, falls back to /v1/embeddings.
+   *
+   * If the first attempt fails because a chunk exceeds the model's context window, retries once
+   * with an aggressive 2048-safe truncation (EMBED_CONTEXT_SAFE_CHARS) so the chunk is embedded
+   * (start-of-chunk) rather than silently dropped from Qdrant (#881).
    */
   public async embed(model: string, input: string[]): Promise<{ embeddings: number[][] }> {
     await this._ensureDependencies()
@@ -491,41 +525,49 @@ export class OllamaService {
       throw new Error('AI service is not initialized.')
     }
 
-    // Runtime safety net (#881). The OpenAI-compat fallback has no equivalent of
-    // truncate:true, so a chunk that exceeds the model's loaded context_length
-    // (often 2048 for nomic-embed-text:v1.5) returns 400 and the chunk is silently
-    // dropped from Qdrant. Pre-capping at the input layer protects both paths.
-    const safeInput = input.map((s) =>
-      s.length > OllamaService.EMBED_MAX_INPUT_CHARS
-        ? s.slice(0, OllamaService.EMBED_MAX_INPUT_CHARS)
-        : s
-    )
-    const truncatedCount = input.reduce(
-      (n, s) => (s.length > OllamaService.EMBED_MAX_INPUT_CHARS ? n + 1 : n),
-      0
-    )
-    if (truncatedCount > 0) {
-      logger.debug(
-        '[OllamaService] embed: pre-capped %d/%d inputs at %d chars',
-        truncatedCount,
-        input.length,
-        OllamaService.EMBED_MAX_INPUT_CHARS
-      )
-    }
+    const cap = (arr: string[], max: number) => arr.map((s) => (s.length > max ? s.slice(0, max) : s))
+
+    // Generous pre-cap (#881): fine for the native path (num_ctx=8192) but can still exceed a
+    // 2048-context fallback on dense content. The context-length retry below is the hard backstop.
+    const safeInput = cap(input, OllamaService.EMBED_MAX_INPUT_CHARS)
 
     try {
-      // Prefer Ollama native endpoint (supports batch input natively).
-      // Pass num_ctx explicitly so we don't depend on the embedding model's
-      // modelfile defaults. Some installs ship nomic-embed-text:v1.5 with
-      // num_ctx=2048, which our chunker (sized for ~1500 tokens) can exceed
-      // on dense content, causing "input length exceeds context length" errors.
-      // truncate:true is a runtime safety net for any chunk that still overshoots.
-      // 8192 matches nomic-embed-text:v1.5's RoPE-extrapolated max.
+      return await this._embedWithFallback(model, safeInput)
+    } catch (err) {
+      if (!OllamaService.isContextLengthError(err)) throw err
+      // One or more chunks exceeded the model's context even after the pre-cap — typically an
+      // older Ollama that ignores num_ctx for embeddings, or the OpenAI-compat fallback path.
+      // Retry once, truncated hard enough to fit a 2048-token context at any density, so the
+      // chunk is embedded (truncated) instead of dropped and the job doesn't storm.
+      const hardCapped = cap(input, OllamaService.EMBED_CONTEXT_SAFE_CHARS)
+      const reduced = hardCapped.reduce((n, s, i) => (s.length < safeInput[i].length ? n + 1 : n), 0)
+      logger.warn(
+        '[OllamaService] embed: context-length overflow; retrying %d/%d inputs hard-capped at %d chars',
+        reduced,
+        input.length,
+        OllamaService.EMBED_CONTEXT_SAFE_CHARS
+      )
+      return await this._embedWithFallback(model, hardCapped)
+    }
+  }
+
+  /**
+   * Single embed attempt: native /api/embed first, then the OpenAI-compat /v1/embeddings fallback.
+   * Both paths request num_ctx/truncate (Ollama's OpenAI-compat shim forwards them). A context-length
+   * error from the native path is re-thrown rather than falling back, because the fallback has a
+   * smaller effective context and would only fail the same way — the caller (embed) retries it
+   * truncated instead.
+   */
+  private async _embedWithFallback(model: string, input: string[]): Promise<{ embeddings: number[][] }> {
+    try {
+      // Pass num_ctx explicitly so we don't depend on the embedding model's modelfile defaults.
+      // Some installs ship nomic-embed-text:v1.5 with num_ctx=2048; 8192 matches its RoPE-extrapolated
+      // max. truncate:true is a server-side net for any chunk that still overshoots.
       const response = await axios.post(
         `${this.baseUrl}/api/embed`,
         {
           model,
-          input: safeInput,
+          input,
           truncate: true,
           options: { num_ctx: 8192 },
         },
@@ -538,22 +580,26 @@ export class OllamaService {
       }
       return { embeddings: response.data.embeddings }
     } catch (err) {
-      // Capture the original error so we know *why* we fell back. Earlier bare
-      // catches here masked recurring "input length exceeds context length"
-      // failures for months (#369, #670, #881) — without this log we have no
-      // signal that /api/embed is the broken path vs the fallback.
+      // Let context-length errors bubble so embed() can retry with a smaller cap; the fallback
+      // endpoint (smaller effective context, no num_ctx honored on older Ollama) can't help here.
+      if (OllamaService.isContextLengthError(err)) throw err
+      // Log the original error so we know *why* we fell back. Earlier bare catches here masked
+      // recurring failures for months (#369, #670, #881).
       logger.warn(
         '[OllamaService] /api/embed failed, falling back to /v1/embeddings: %s',
         err instanceof Error ? err.message : String(err)
       )
-      // Fall back to OpenAI-compatible /v1/embeddings.
-      // Explicitly request float format — some backends (e.g. LM Studio) don't reliably
-      // implement the base64 encoding the OpenAI SDK requests by default.
-      const results = await this.openai.embeddings.create({
+      // Fall back to OpenAI-compatible /v1/embeddings. Explicitly request float format — some
+      // backends (e.g. LM Studio) don't reliably implement the base64 the OpenAI SDK defaults to.
+      // truncate/num_ctx are forwarded by Ollama's OpenAI-compat shim; the SDK types omit them,
+      // hence the cast. We only ever talk to a local Ollama here, not real OpenAI.
+      const results = await this.openai!.embeddings.create({
         model,
-        input: safeInput,
+        input,
         encoding_format: 'float',
-      })
+        truncate: true,
+        options: { num_ctx: 8192 },
+      } as any)
       return { embeddings: results.data.map((e) => e.embedding as number[]) }
     }
   }

From 9b84d3aa5491a140506292ce480ff2e2fcdb6ee5 Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Mon, 8 Jun 2026 10:24:28 -0700
Subject: [PATCH 41/83] fix(maps): dedupe map sources by region so duplicate
 files don't blank the map

The map style names each source by its date-stripped region (both
"washington.pmtiles" and "washington_2025-12.pmtiles" -> "washington").
When an old and new copy of the same region are both on disk, the style
emitted two sources with the same key and duplicate layer ids, which
MapLibre rejects outright -- blanking the ENTIRE map, not just that region.

Old copies linger when a newer curated version installs (#634), so a user
who updates maps can silently lose all map rendering until the stale file
is removed by hand.

generateSourcesArray() now keeps only the newest file per region: a dated
build beats an undated legacy file, and between two dated builds the later
YYYY-MM wins. The skipped duplicate is logged. The style stays valid even
when stale files are present.

Complements #981, which removes superseded curated files on install. This
is the runtime safety net that also recovers installs already in the broken
state (which a cleanup-on-install alone can't reach).

Refs #634
---
 admin/app/services/map_service.ts | 54 +++++++++++++++++++++++++------
 1 file changed, 45 insertions(+), 9 deletions(-)

diff --git a/admin/app/services/map_service.ts b/admin/app/services/map_service.ts
index 0e1c902..9de8c49 100644
--- a/admin/app/services/map_service.ts
+++ b/admin/app/services/map_service.ts
@@ -457,6 +457,18 @@ export class MapService implements IMapService {
     return await listDirectoryContentsRecursive(this.baseDirPath)
   }
 
+  /**
+   * Compare two map-file versions (YYYY-MM, or null for an undated legacy file). Returns >0 if
+   * `a` is newer than `b`, <0 if older, 0 if equal. A dated build is always newer than an undated
+   * legacy file; two dated builds compare lexicographically (correct for zero-padded YYYY-MM).
+   */
+  private static compareMapVersions(a: string | null, b: string | null): number {
+    if (a === b) return 0
+    if (a === null) return -1
+    if (b === null) return 1
+    return a < b ? -1 : 1
+  }
+
   private generateSourcesArray(host: string | null, regions: FileEntry[], protocol: string = 'http'): BaseStylesFile['sources'][] {
     const sources: BaseStylesFile['sources'][] = []
     const baseUrl = this.getPublicFileBaseUrl(host, 'pmtiles', protocol)
@@ -474,23 +486,47 @@ export class MapService implements IMapService {
       sources.push(worldSource)
     }
 
+    // Dedupe by region name, keeping only the newest file per region. The source name is the
+    // date-stripped region (e.g. both "washington.pmtiles" and "washington_2025-12.pmtiles" map
+    // to "washington"). Emitting both produces duplicate source keys and duplicate layer ids,
+    // which MapLibre rejects outright — blanking the ENTIRE map, not just that region. Old copies
+    // linger when a newer curated version installs (#634), so guard against it here so the style
+    // stays valid even if cleanup hasn't run. A dated build beats an undated legacy file; between
+    // two dated builds the later YYYY-MM wins (lexicographic compare is correct for that format).
+    const bestByRegion = new Map<string, { region: FileEntry; version: string | null }>()
     for (const region of regions) {
       if (region.type === 'file' && region.name.endsWith('.pmtiles')) {
-        // Strip .pmtiles and date suffix (e.g. "alaska_2025-12" -> "alaska") for stable source names
         const parsed = CollectionManifestService.parseMapFilename(region.name)
         const regionName = parsed ? parsed.resource_id : region.name.replace('.pmtiles', '')
-        const source: BaseStylesFile['sources'] = {}
-        const sourceUrl = urlJoin(baseUrl, region.name)
-
-        source[regionName] = {
-          type: 'vector',
-          attribution: PMTILES_ATTRIBUTION,
-          url: `pmtiles://${sourceUrl}`,
+        const version = parsed?.version ?? null
+        const existing = bestByRegion.get(regionName)
+        if (!existing || MapService.compareMapVersions(version, existing.version) > 0) {
+          if (existing) {
+            logger.warn(
+              `[MapService] Duplicate map region "${regionName}": using "${region.name}" over "${existing.region.name}" (keeping newest)`
+            )
+          }
+          bestByRegion.set(regionName, { region, version })
+        } else {
+          logger.warn(
+            `[MapService] Duplicate map region "${regionName}": skipping "${region.name}" in favor of "${existing.region.name}" (keeping newest)`
+          )
         }
-        sources.push(source)
       }
     }
 
+    for (const [regionName, { region }] of bestByRegion) {
+      const source: BaseStylesFile['sources'] = {}
+      const sourceUrl = urlJoin(baseUrl, region.name)
+
+      source[regionName] = {
+        type: 'vector',
+        attribution: PMTILES_ATTRIBUTION,
+        url: `pmtiles://${sourceUrl}`,
+      }
+      sources.push(source)
+    }
+
     return sources
   }
 

From da60c6ce9c2941ecf3d3370a6f7b09688c2dd70b Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Mon, 8 Jun 2026 10:48:57 -0700
Subject: [PATCH 42/83] feat(maps): persist map view across refresh
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The maps page reset to the default US-wide view on every refresh because
initialViewState was hardcoded. Save the position and zoom to localStorage
on each move-end (key nomad:map-view, matching the existing scale-unit
pattern) and restore it at mount: saved view → default. The restore is
bounds-checked so a corrupt value falls through to the default.

Replaces #815, whose branch had drifted far out of scope (56 files of
stale-base/merged-commit noise plus unrelated map-feature WIP). This is
just the persist-view improvement, ported cleanly onto current dev. The
null-island and coordinate-search parts of #815 targeted URL-param code
that never landed on dev, so they don't apply here.
---
 .../inertia/components/maps/MapComponent.tsx  | 52 +++++++++++++++++--
 1 file changed, 48 insertions(+), 4 deletions(-)

diff --git a/admin/inertia/components/maps/MapComponent.tsx b/admin/inertia/components/maps/MapComponent.tsx
index f7a3a8a..aa9d9c0 100644
--- a/admin/inertia/components/maps/MapComponent.tsx
+++ b/admin/inertia/components/maps/MapComponent.tsx
@@ -28,6 +28,38 @@ type MapComponentProps = {
   showCoordinatesEnabled: boolean
 }
 
+const SAVED_MAP_VIEW_KEY = 'nomad:map-view'
+const DEFAULT_MAP_VIEW = { longitude: -101, latitude: 40, zoom: 3.5 }
+
+type SavedMapView = { longitude: number; latitude: number; zoom: number }
+
+// Restore the last map position/zoom from localStorage so a refresh of /maps doesn't snap back
+// to the default US-wide view. Bounds-checked so a corrupt or out-of-range value falls through
+// to the default instead of throwing.
+const getSavedMapView = (): SavedMapView | null => {
+  try {
+    const raw = localStorage.getItem(SAVED_MAP_VIEW_KEY)
+    if (!raw) return null
+    const parsed = JSON.parse(raw)
+    if (
+      parsed &&
+      typeof parsed === 'object' &&
+      Number.isFinite(parsed.longitude) &&
+      Number.isFinite(parsed.latitude) &&
+      Number.isFinite(parsed.zoom) &&
+      parsed.latitude >= -90 &&
+      parsed.latitude <= 90 &&
+      parsed.longitude >= -180 &&
+      parsed.longitude <= 180
+    ) {
+      return { longitude: parsed.longitude, latitude: parsed.latitude, zoom: parsed.zoom }
+    }
+  } catch {
+    // ignore — fall through to default
+  }
+  return null
+}
+
 export default function MapComponent({
   isHoveringUI,
   showCoordinatesEnabled,
@@ -47,6 +79,10 @@ export default function MapComponent({
     () => (localStorage.getItem('nomad:map-scale-unit') as ScaleUnit) || 'metric'
   )
 
+  // Resolve the initial view once at mount: saved view → default. Lazy so it isn't recomputed
+  // on every render.
+  const [initialViewState] = useState(() => getSavedMapView() ?? DEFAULT_MAP_VIEW)
+
   const [cursorLngLat, setCursorLngLat] = useState<{
     lng: number
     lat: number
@@ -171,10 +207,18 @@ export default function MapComponent({
           cursor={isDraggingMap ? 'grabbing' : 'crosshair'}
           mapStyle={`${window.location.protocol}//${window.location.hostname}:${window.location.port}/api/maps/styles`}
           mapLib={maplibregl}
-          initialViewState={{
-            longitude: -101,
-            latitude: 40,
-            zoom: 3.5,
+          initialViewState={initialViewState}
+          onMoveEnd={(e) => {
+            // Persist the view so a refresh restores where the user was, not the default.
+            const { longitude, latitude, zoom } = e.viewState
+            try {
+              localStorage.setItem(
+                SAVED_MAP_VIEW_KEY,
+                JSON.stringify({ longitude, latitude, zoom })
+              )
+            } catch {
+              // ignore persistence failures (private mode, quota)
+            }
           }}
           onMouseDown={() => {
             setIsDraggingMap(true)

From 5de58da4b7f25843e4be59504f9631291318957b Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Mon, 8 Jun 2026 12:24:58 -0700
Subject: [PATCH 43/83] fix(updates): resolve relative registry pagination URL
 so tag listing doesn't crash (#945)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

listTags() follows the registry's Link-header pagination, but the next-page
URL is relative per the OCI/Docker registry spec (e.g.
"/v2/ollama/ollama/tags/list?last=0.9.3-rc5&n=1000"). The code assigned that
raw relative path straight back to `url` and re-fetched it, so fetch() threw
"Failed to parse URL from /v2/...". Any image repo with more than 1000 tags
paginates, so the entire tag list — and therefore the update check — failed
silently for ollama/ollama and filebrowser/filebrowser.

That's the root cause of #945 ("won't update past 0.24.0"): the Ollama
update check never completed, so no newer version was ever offered.

Resolve the next-page URL against the registry origin with
new URL(next, `https://${registry}`), which also passes absolute next-URLs
through unchanged for registries that return those.

Closes #945
---
 admin/app/services/container_registry_service.ts | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/admin/app/services/container_registry_service.ts b/admin/app/services/container_registry_service.ts
index afdd39d..2fc465d 100644
--- a/admin/app/services/container_registry_service.ts
+++ b/admin/app/services/container_registry_service.ts
@@ -139,11 +139,17 @@ export class ContainerRegistryService {
         allTags.push(...data.tags)
       }
 
-      // Handle pagination via Link header
+      // Handle pagination via Link header. Per the OCI/Docker registry spec the next-page
+      // URL is relative (e.g. "/v2/<repo>/tags/list?last=<tag>&n=1000"), so it must be
+      // resolved against the registry origin before re-fetching — assigning the raw relative
+      // path to `url` makes fetch() throw "Failed to parse URL". This silently broke update
+      // checks for any repo with >1000 tags (e.g. ollama/ollama, filebrowser/filebrowser),
+      // which is the root cause of #945. new URL(relative, base) also passes absolute
+      // next-URLs through unchanged, so it's safe for registries that return those.
       const linkHeader = response.headers.get('link')
       if (linkHeader) {
         const match = linkHeader.match(/<([^>]+)>;\s*rel="next"/)
-        url = match ? match[1] : ''
+        url = match ? new URL(match[1], `https://${parsed.registry}`).toString() : ''
       } else {
         url = ''
       }

From 4ece29b6d455ab3a30221c9f78fb567ab0f4153b Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Mon, 8 Jun 2026 12:44:51 -0700
Subject: [PATCH 44/83] feat(supply-depot): show installed version on cards +
 make Update pill stand out
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two card tweaks for the update workflow:

- Show the installed image tag next to the powered-by name (e.g. "Kiwix ·
  3.7.0"), so the running version is visible at a glance. Only rendered for
  installed apps; falls back to just the version when powered_by is unset.
- Change the "Update available" pill from a muted light-green tint to a solid
  desert-orange fill with white text, so an available update actually draws
  the eye instead of blending into the card.
---
 admin/inertia/pages/supply-depot.tsx | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/admin/inertia/pages/supply-depot.tsx b/admin/inertia/pages/supply-depot.tsx
index 8c8dcac..0729356 100644
--- a/admin/inertia/pages/supply-depot.tsx
+++ b/admin/inertia/pages/supply-depot.tsx
@@ -818,9 +818,20 @@ function AppCard({
             <p className="font-semibold text-text-primary text-sm leading-tight truncate">
               {service.friendly_name ?? service.service_name}
             </p>
-            {service.powered_by && (
-              <p className="text-xs text-text-muted truncate">{service.powered_by}</p>
-            )}
+            {(() => {
+              // Show the installed image tag next to the powered-by name (e.g. "Kiwix · 3.7.0").
+              // Only for installed apps — a not-yet-installed catalog entry has no meaningful
+              // running version. Falls back to just the version if powered_by is unset.
+              const version = service.installed ? extractTag(service.container_image) : ''
+              if (!service.powered_by && !version) return null
+              return (
+                <p className="text-xs text-text-muted truncate">
+                  {service.powered_by}
+                  {service.powered_by && version ? ' · ' : ''}
+                  {version ? <span className="font-mono">{version}</span> : null}
+                </p>
+              )
+            })()}
           </div>
         </div>
 
@@ -882,7 +893,7 @@ function AppCard({
             type="button"
             onClick={onUpdateVersion}
             title={`Update to ${service.available_update_version}`}
-            className="flex items-center gap-1 text-xs px-2 py-0.5 rounded-full font-medium border border-desert-green-light bg-desert-green-lighter text-desert-green-dark cursor-pointer transition-colors hover:bg-desert-green-light"
+            className="flex items-center gap-1 text-xs px-2 py-0.5 rounded-full font-semibold bg-desert-orange text-white shadow-sm cursor-pointer transition-colors hover:bg-desert-orange-dark"
           >
             <IconArrowUp className="h-3 w-3" />
             Update available

From e5565d1e9553dd88b96425c5b02e8be2037a9e39 Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Tue, 9 Jun 2026 02:29:53 +0000
Subject: [PATCH 45/83] refactor(supply-depot): extract version and subtitle
 helpers instead of IIFE for readability

---
 admin/inertia/pages/supply-depot.tsx | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/admin/inertia/pages/supply-depot.tsx b/admin/inertia/pages/supply-depot.tsx
index 0729356..44c97f3 100644
--- a/admin/inertia/pages/supply-depot.tsx
+++ b/admin/inertia/pages/supply-depot.tsx
@@ -785,6 +785,19 @@ function AppCard({
   // without a doc section (custom apps, undocumented catalog apps) so the Docs item is hidden.
   const docLink = getSupplyDepotDocLink(service.service_name)
 
+  // Subtitle under the app name: the powered-by name plus the installed image tag
+  // (e.g. "Kiwix · 3.7.0"). Only installed apps have a meaningful running version; a
+  // not-yet-installed catalog entry shows just the powered-by name. Null when neither exists.
+  const version = service.installed ? extractTag(service.container_image) : ''
+  const subtitle =
+    !service.powered_by && !version ? null : (
+      <p className="text-xs text-text-muted truncate">
+        {service.powered_by}
+        {service.powered_by && version ? ' · ' : ''}
+        {version ? <span className="font-mono">{version}</span> : null}
+      </p>
+    )
+
   function toggleDropdown(e: React.MouseEvent) {
     e.stopPropagation()
     onOpenDropdown(isDropdownOpen ? null : service.service_name)
@@ -818,20 +831,7 @@ function AppCard({
             <p className="font-semibold text-text-primary text-sm leading-tight truncate">
               {service.friendly_name ?? service.service_name}
             </p>
-            {(() => {
-              // Show the installed image tag next to the powered-by name (e.g. "Kiwix · 3.7.0").
-              // Only for installed apps — a not-yet-installed catalog entry has no meaningful
-              // running version. Falls back to just the version if powered_by is unset.
-              const version = service.installed ? extractTag(service.container_image) : ''
-              if (!service.powered_by && !version) return null
-              return (
-                <p className="text-xs text-text-muted truncate">
-                  {service.powered_by}
-                  {service.powered_by && version ? ' · ' : ''}
-                  {version ? <span className="font-mono">{version}</span> : null}
-                </p>
-              )
-            })()}
+            {subtitle}
           </div>
         </div>
 

From 2ae30a4abb983645a2b91db3e88b5f605ca5733c Mon Sep 17 00:00:00 2001
From: John Onysko <johno10661@gmail.com>
Date: Sun, 24 May 2026 15:17:34 -0400
Subject: [PATCH 46/83] fix(chat): prefer selected model for suggestions, fall
 back to smallest
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`getChatSuggestions` previously picked the largest installed model by file
size, on the assumption that bigger models give better suggestions. This
is unsafe: if any installed model exceeds available VRAM (e.g.
llama3.1:405b on a 96 GB GPU), Ollama spends minutes trying to load it
and the request 500s — making the chat page unusable for anyone who
happens to keep a flagship-sized model on disk.

Chat suggestions are short prompts that don't benefit from a flagship
model anyway. Prefer the user's selected `chat.lastModel` when set, and
fall back to the smallest installed model otherwise. `OllamaService.getModels()`
already excludes embedders, so the fallback always picks a chat model.
---
 admin/app/services/chat_service.ts | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/admin/app/services/chat_service.ts b/admin/app/services/chat_service.ts
index 2d97ad7..a5d07c9 100644
--- a/admin/app/services/chat_service.ts
+++ b/admin/app/services/chat_service.ts
@@ -1,5 +1,6 @@
 import ChatSession from '#models/chat_session'
 import ChatMessage from '#models/chat_message'
+import KVStore from '#models/kv_store'
 import logger from '@adonisjs/core/services/logger'
 import { DateTime } from 'luxon'
 import { inject } from '@adonisjs/core'
@@ -36,17 +37,23 @@ export class ChatService {
         return [] // If no models are available, return empty suggestions
       }
 
-      // Larger models generally give "better" responses, so pick the largest one
-      const largestModel = models.reduce((prev, current) => {
-        return prev.size > current.size ? prev : current
-      })
+      // Prefer the user's selected chat model. Fall back to the smallest
+      // installed model — picking the largest by file size is unsafe: if any
+      // installed model exceeds available VRAM (e.g. llama3.1:405b on a 96 GB
+      // GPU), Ollama spends minutes trying to load it and the request 500s.
+      // Suggestions are short prompts that don't benefit from a flagship model.
+      const lastModel = await KVStore.getValue('chat.lastModel')
+      const preferred = lastModel ? models.find((m) => m.name === lastModel) : undefined
+      const chosen =
+        preferred ??
+        models.reduce((prev, current) => (prev.size < current.size ? prev : current))
 
-      if (!largestModel) {
+      if (!chosen) {
         return []
       }
 
       const response = await this.ollamaService.chat({
-        model: largestModel.name,
+        model: chosen.name,
         messages: [
           {
             role: 'user',

From bbd62d8ed1a1d9f5ac49468c5e1521ea4be068c8 Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Sat, 6 Jun 2026 15:33:51 -0700
Subject: [PATCH 47/83] fix(content): remove superseded curated map/ZIM files
 when a new version installs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Only Wikipedia had version cleanup; every other curated map and non-Wikipedia
ZIM left its prior version on disk when a newer one installed, so users silently
accumulated orphaned content (potentially hundreds of GB). (#634)

The install paths already record each resource via InstalledResource
{resource_id, resource_type, version, file_path}, so the authoritative old-file
path for a resource is known. On install of a new version we now capture the
prior row before updateOrCreate repoints it, then delete the old file — gated
behind a pure, fully unit-tested decision function with strict safety rails:

  - tracked-only: requires a prior InstalledResource row for the same
    resource_id, so sideloaded/untracked files are never touched
  - genuine replacement: old and new file paths must differ
  - new-file-verified: the new file must be confirmed on disk first
  - strictly-newer: a re-install or downgrade can't wipe a newer file
  - within-storage-dir: the old path must resolve under the content store

ZIM cleanup deletes the old file directly (NOT via this.delete(), which would
drop the InstalledResource row by resource_id that updateOrCreate just
repointed) and rebuilds the Kiwix library only if a file was actually removed,
so its XML never references a deleted ZIM. Maps need no library step. Wikipedia
keeps its own existing cleanup path. All deletions are best-effort and logged;
a failure never breaks the install.

Closes #634

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 admin/app/services/map_service.ts            |  36 +++++-
 admin/app/services/zim_service.ts            |  51 +++++++-
 admin/app/utils/superseded_resource.ts       |  72 +++++++++++
 admin/tests/unit/superseded_resource.spec.ts | 118 +++++++++++++++++++
 4 files changed, 275 insertions(+), 2 deletions(-)
 create mode 100644 admin/app/utils/superseded_resource.ts
 create mode 100644 admin/tests/unit/superseded_resource.spec.ts

diff --git a/admin/app/services/map_service.ts b/admin/app/services/map_service.ts
index 9de8c49..7aa20a7 100644
--- a/admin/app/services/map_service.ts
+++ b/admin/app/services/map_service.ts
@@ -21,6 +21,7 @@ import logger from '@adonisjs/core/services/logger'
 import { assertNotPrivateUrl } from '#validators/common'
 import InstalledResource from '#models/installed_resource'
 import { CollectionManifestService } from './collection_manifest_service.js'
+import { decideSupersededDeletion } from '../utils/superseded_resource.js'
 import type { CollectionWithStatus, MapsSpec } from '../../types/collections.js'
 import type { Country, CountryCode, CountryGroup, MapExtractPreflight } from '../../types/maps.js'
 import {
@@ -199,10 +200,18 @@ export class MapService implements IMapService {
       const parsed = CollectionManifestService.parseMapFilename(filename)
       if (!parsed) continue
 
-      const filepath = join(process.cwd(), this.mapStoragePath, 'pmtiles', filename)
+      const pmtilesDir = join(process.cwd(), this.mapStoragePath, 'pmtiles')
+      const filepath = join(pmtilesDir, filename)
       const stats = await getFileStatsIfExists(filepath)
 
       try {
+        // Capture the prior install for this resource_id before updateOrCreate
+        // overwrites it, so we know the old file to clean up (#634).
+        const prior = await InstalledResource.query()
+          .where('resource_id', parsed.resource_id)
+          .where('resource_type', 'map')
+          .first()
+
         const { DateTime } = await import('luxon')
         await InstalledResource.updateOrCreate(
           { resource_id: parsed.resource_id, resource_type: 'map' },
@@ -215,6 +224,31 @@ export class MapService implements IMapService {
           }
         )
         logger.info(`[MapService] Created InstalledResource entry for: ${parsed.resource_id}`)
+
+        // Remove the superseded prior version's pmtiles file if every safety
+        // rail passes (see decideSupersededDeletion). Maps have no library index,
+        // so a direct delete of the recorded old file is sufficient.
+        const decision = decideSupersededDeletion({
+          existing: prior ? { file_path: prior.file_path, version: prior.version } : null,
+          newFilePath: filepath,
+          newVersion: parsed.version,
+          newFileExists: !!stats,
+          storageBaseDir: pmtilesDir,
+        })
+        if (decision.delete && decision.path) {
+          try {
+            await deleteFileIfExists(decision.path)
+            logger.info(
+              `[MapService] Removed superseded ${parsed.resource_id} file: ${decision.path}`
+            )
+          } catch (err) {
+            logger.warn(`[MapService] Failed to remove superseded file ${decision.path}:`, err)
+          }
+        } else if (decision.reason !== 'first_install' && decision.reason !== 'same_file') {
+          logger.info(
+            `[MapService] Kept prior ${parsed.resource_id} file (reason: ${decision.reason})`
+          )
+        }
       } catch (error) {
         logger.error(`[MapService] Failed to create InstalledResource for ${filename}:`, error)
       }
diff --git a/admin/app/services/zim_service.ts b/admin/app/services/zim_service.ts
index aeaa8ff..3b0469f 100644
--- a/admin/app/services/zim_service.ts
+++ b/admin/app/services/zim_service.ts
@@ -8,6 +8,7 @@ import * as cheerio from 'cheerio'
 import { XMLParser } from 'fast-xml-parser'
 import { isRawListRemoteZimFilesResponse, isRawRemoteZimFileEntry } from '../../util/zim.js'
 import { findReplacedWikipediaFiles } from '../utils/zim_filename.js'
+import { decideSupersededDeletion } from '../utils/superseded_resource.js'
 import logger from '@adonisjs/core/services/logger'
 import { DockerService } from './docker_service.js'
 import { inject } from '@adonisjs/core'
@@ -358,6 +359,8 @@ export class ZimService {
     }
 
     // Create InstalledResource entries for downloaded files
+    const zimStorageDir = join(process.cwd(), ZIM_STORAGE_PATH)
+    let removedSupersededZim = false
     for (const url of urls) {
       // Skip Wikipedia files (managed separately)
       if (url.includes('wikipedia_en_')) continue
@@ -368,10 +371,17 @@ export class ZimService {
       const parsed = CollectionManifestService.parseZimFilename(filename)
       if (!parsed) continue
 
-      const filepath = join(process.cwd(), ZIM_STORAGE_PATH, filename)
+      const filepath = join(zimStorageDir, filename)
       const stats = await getFileStatsIfExists(filepath)
 
       try {
+        // Capture the prior install for this resource_id BEFORE updateOrCreate
+        // overwrites it, so we know the old file path to clean up (#634).
+        const prior = await InstalledResource.query()
+          .where('resource_id', parsed.resource_id)
+          .where('resource_type', 'zim')
+          .first()
+
         const { DateTime } = await import('luxon')
         await InstalledResource.updateOrCreate(
           { resource_id: parsed.resource_id, resource_type: 'zim' },
@@ -384,10 +394,49 @@ export class ZimService {
           }
         )
         logger.info(`[ZimService] Created InstalledResource entry for: ${parsed.resource_id}`)
+
+        // Remove the superseded prior version's file if (and only if) every
+        // safety rail passes — see decideSupersededDeletion. The InstalledResource
+        // row already points at the new file, so we delete the old file directly
+        // (NOT via this.delete(), which would drop the row by resource_id).
+        const decision = decideSupersededDeletion({
+          existing: prior ? { file_path: prior.file_path, version: prior.version } : null,
+          newFilePath: filepath,
+          newVersion: parsed.version,
+          newFileExists: !!stats,
+          storageBaseDir: zimStorageDir,
+        })
+        if (decision.delete && decision.path) {
+          try {
+            await deleteFileIfExists(decision.path)
+            removedSupersededZim = true
+            logger.info(
+              `[ZimService] Removed superseded ${parsed.resource_id} file: ${decision.path}`
+            )
+          } catch (err) {
+            logger.warn(`[ZimService] Failed to remove superseded file ${decision.path}:`, err)
+          }
+        } else if (decision.reason !== 'first_install' && decision.reason !== 'same_file') {
+          logger.info(
+            `[ZimService] Kept prior ${parsed.resource_id} file (reason: ${decision.reason})`
+          )
+        }
       } catch (error) {
         logger.error(`[ZimService] Failed to create InstalledResource for ${filename}:`, error)
       }
     }
+
+    // If we removed any superseded ZIM, rebuild the Kiwix library so its XML no
+    // longer references the deleted file. The earlier rebuild in this flow ran
+    // while both versions were still on disk.
+    if (removedSupersededZim) {
+      try {
+        await new KiwixLibraryService().rebuildFromDisk()
+        logger.info('[ZimService] Rebuilt Kiwix library after removing superseded ZIM(s).')
+      } catch (err) {
+        logger.error('[ZimService] Failed to rebuild Kiwix library after cleanup:', err)
+      }
+    }
   }
 
   /**
diff --git a/admin/app/utils/superseded_resource.ts b/admin/app/utils/superseded_resource.ts
new file mode 100644
index 0000000..9094953
--- /dev/null
+++ b/admin/app/utils/superseded_resource.ts
@@ -0,0 +1,72 @@
+import { resolve, sep } from 'node:path'
+
+/**
+ * Decides whether a curated resource's PREVIOUSLY-installed file should be
+ * deleted now that a newer version has been downloaded (issue #634 — old map
+ * and ZIM versions accumulated on disk indefinitely because only Wikipedia had
+ * version cleanup).
+ *
+ * This is intentionally a pure function so every safety rail is unit-testable
+ * without touching the DB or filesystem. The caller looks up the prior
+ * `InstalledResource` row, records the new version, then asks this whether the
+ * old file is safe to remove.
+ *
+ * Safety rails (a "delete" decision requires ALL of these):
+ *  - There was a prior install for this exact resource_id (`existing` non-null).
+ *    Untracked / sideloaded files have no row and are therefore never touched.
+ *  - The old file path actually differs from the new one (a genuine version
+ *    swap, not a re-download of the same file).
+ *  - The new file is confirmed present on disk — we never remove the old copy
+ *    before the replacement is verified.
+ *  - The new version is strictly newer than the recorded one, so a re-install
+ *    or downgrade can't wipe a newer file.
+ *  - The old path resolves to within the resource's storage directory, so a
+ *    malformed DB value can't direct a delete outside the content store.
+ */
+
+export interface SupersededInputs {
+  /** Prior InstalledResource row for this resource_id, or null on first install. */
+  existing: { file_path: string; version: string } | null
+  /** Absolute path of the newly downloaded file. */
+  newFilePath: string
+  /** Version of the newly downloaded file (e.g. "2026-05"). */
+  newVersion: string
+  /** Whether the new file is confirmed present on disk. */
+  newFileExists: boolean
+  /** Absolute storage directory the old file must live under to be eligible. */
+  storageBaseDir: string
+}
+
+export type SupersededReason =
+  | 'first_install'
+  | 'same_file'
+  | 'new_file_missing'
+  | 'not_newer'
+  | 'outside_storage'
+  | 'superseded'
+
+export interface SupersededDecision {
+  delete: boolean
+  /** Resolved old path to delete — set only when `delete` is true. */
+  path?: string
+  reason: SupersededReason
+}
+
+export function decideSupersededDeletion(inputs: SupersededInputs): SupersededDecision {
+  const { existing, newFilePath, newVersion, newFileExists, storageBaseDir } = inputs
+
+  if (!existing) return { delete: false, reason: 'first_install' }
+  if (existing.file_path === newFilePath) return { delete: false, reason: 'same_file' }
+  if (!newFileExists) return { delete: false, reason: 'new_file_missing' }
+  // Versions are zero-padded date strings (YYYY-MM / YYYY-MM-DD), so a lexical
+  // compare orders them correctly. Require strictly newer.
+  if (!(newVersion > existing.version)) return { delete: false, reason: 'not_newer' }
+
+  const resolvedOld = resolve(existing.file_path)
+  const base = resolve(storageBaseDir)
+  if (resolvedOld !== base && !resolvedOld.startsWith(base + sep)) {
+    return { delete: false, reason: 'outside_storage' }
+  }
+
+  return { delete: true, path: resolvedOld, reason: 'superseded' }
+}
diff --git a/admin/tests/unit/superseded_resource.spec.ts b/admin/tests/unit/superseded_resource.spec.ts
new file mode 100644
index 0000000..46d6d47
--- /dev/null
+++ b/admin/tests/unit/superseded_resource.spec.ts
@@ -0,0 +1,118 @@
+import * as assert from 'node:assert/strict'
+import { test } from 'node:test'
+import { join } from 'node:path'
+
+import { decideSupersededDeletion } from '../../app/utils/superseded_resource.js'
+
+const STORAGE = join('/app', 'storage', 'zim')
+const OLD = join(STORAGE, 'ifixit_en_all_2026-03.zim')
+const NEW = join(STORAGE, 'ifixit_en_all_2026-05.zim')
+
+test('first install (no prior row) deletes nothing', () => {
+  const d = decideSupersededDeletion({
+    existing: null,
+    newFilePath: NEW,
+    newVersion: '2026-05',
+    newFileExists: true,
+    storageBaseDir: STORAGE,
+  })
+  assert.equal(d.delete, false)
+  assert.equal(d.reason, 'first_install')
+})
+
+test('superseded prior version is deleted', () => {
+  const d = decideSupersededDeletion({
+    existing: { file_path: OLD, version: '2026-03' },
+    newFilePath: NEW,
+    newVersion: '2026-05',
+    newFileExists: true,
+    storageBaseDir: STORAGE,
+  })
+  assert.equal(d.delete, true)
+  assert.equal(d.reason, 'superseded')
+  assert.equal(d.path, OLD)
+})
+
+test('same file path is never deleted (re-download)', () => {
+  const d = decideSupersededDeletion({
+    existing: { file_path: NEW, version: '2026-05' },
+    newFilePath: NEW,
+    newVersion: '2026-05',
+    newFileExists: true,
+    storageBaseDir: STORAGE,
+  })
+  assert.equal(d.delete, false)
+  assert.equal(d.reason, 'same_file')
+})
+
+test('old file is NOT deleted until the new file is confirmed on disk', () => {
+  const d = decideSupersededDeletion({
+    existing: { file_path: OLD, version: '2026-03' },
+    newFilePath: NEW,
+    newVersion: '2026-05',
+    newFileExists: false,
+    storageBaseDir: STORAGE,
+  })
+  assert.equal(d.delete, false)
+  assert.equal(d.reason, 'new_file_missing')
+})
+
+test('downgrade / reinstall of an older version does not wipe the newer file', () => {
+  const d = decideSupersededDeletion({
+    existing: { file_path: NEW, version: '2026-05' },
+    newFilePath: OLD,
+    newVersion: '2026-03',
+    newFileExists: true,
+    storageBaseDir: STORAGE,
+  })
+  assert.equal(d.delete, false)
+  assert.equal(d.reason, 'not_newer')
+})
+
+test('equal version is not considered newer', () => {
+  const d = decideSupersededDeletion({
+    existing: { file_path: join(STORAGE, 'ifixit_en_all_2026-05a.zim'), version: '2026-05' },
+    newFilePath: NEW,
+    newVersion: '2026-05',
+    newFileExists: true,
+    storageBaseDir: STORAGE,
+  })
+  assert.equal(d.delete, false)
+  assert.equal(d.reason, 'not_newer')
+})
+
+test('refuses to delete a path outside the storage directory', () => {
+  const d = decideSupersededDeletion({
+    existing: { file_path: '/etc/passwd', version: '2026-03' },
+    newFilePath: NEW,
+    newVersion: '2026-05',
+    newFileExists: true,
+    storageBaseDir: STORAGE,
+  })
+  assert.equal(d.delete, false)
+  assert.equal(d.reason, 'outside_storage')
+})
+
+test('refuses a traversal escape that only looks like it is under storage', () => {
+  const d = decideSupersededDeletion({
+    existing: { file_path: join(STORAGE, '..', 'mysql', 'data.ibd'), version: '2026-03' },
+    newFilePath: NEW,
+    newVersion: '2026-05',
+    newFileExists: true,
+    storageBaseDir: STORAGE,
+  })
+  assert.equal(d.delete, false)
+  assert.equal(d.reason, 'outside_storage')
+})
+
+test('YYYY-MM-DD versions order correctly against YYYY-MM', () => {
+  const d = decideSupersededDeletion({
+    existing: { file_path: OLD, version: '2026-05' },
+    newFilePath: NEW,
+    newVersion: '2026-05-12',
+    newFileExists: true,
+    storageBaseDir: STORAGE,
+  })
+  assert.equal(d.delete, true)
+  assert.equal(d.reason, 'superseded')
+})

From 9de6473f6ab87e127e11a3ec673ee3063814a7e7 Mon Sep 17 00:00:00 2001
From: akashsalan <akashsalan71@gmail.com>
Date: Sat, 30 May 2026 18:41:18 +0530
Subject: [PATCH 48/83] fix(system): prevent false offline reports when
 Cloudflare endpoint is unreachable

---
 README.md                            |  2 +-
 admin/.env.example                   |  4 ++++
 admin/app/services/system_service.ts | 35 +++++++++++++++++++++-------
 3 files changed, 32 insertions(+), 9 deletions(-)

diff --git a/README.md b/README.md
index 417094f..c859e9d 100644
--- a/README.md
+++ b/README.md
@@ -105,7 +105,7 @@ For answers to common questions about Project N.O.M.A.D., please see our [FAQ](F
 ## About Internet Usage & Privacy
 Project N.O.M.A.D. is designed for offline usage. An internet connection is only required during the initial installation (to download dependencies) and if you (the user) decide to download additional tools and resources at a later time. Otherwise, N.O.M.A.D. does not require an internet connection and has ZERO built-in telemetry.
 
-To test internet connectivity, N.O.M.A.D. attempts to make a request to Cloudflare's utility endpoint, `https://1.1.1.1/cdn-cgi/trace` and checks for a successful response.
+To test internet connectivity, N.O.M.A.D. first attempts to make a request to Cloudflare's utility endpoint, `https://1.1.1.1/cdn-cgi/trace`. If that endpoint is unreachable (for example, because your network blocks `1.1.1.1`), it falls back to other endpoints the application already contacts (the GitHub API and the Project N.O.M.A.D. API) and considers the connection online if any of them respond. You can override the endpoint used for this check with the `INTERNET_STATUS_TEST_URL` environment variable.
 
 ## About Security
 By design, Project N.O.M.A.D. is intended to be open and available without hurdles — it includes no authentication. If you decide to connect your device to a local network after install (e.g. for allowing other devices to access its resources), you can block/open ports to control which services are exposed.
diff --git a/admin/.env.example b/admin/.env.example
index 9ef158d..738d505 100644
--- a/admin/.env.example
+++ b/admin/.env.example
@@ -1,6 +1,10 @@
 PORT=8080
 HOST=localhost
 LOG_LEVEL=info
+# Optional: override the URL used to test internet connectivity.
+# Defaults to https://1.1.1.1/cdn-cgi/trace with fallbacks to hosts the app
+# already contacts. Leave unset to use the defaults.
+# INTERNET_STATUS_TEST_URL=https://1.1.1.1/cdn-cgi/trace
 APP_KEY=some_random_key
 NODE_ENV=development
 SESSION_DRIVER=cookie
diff --git a/admin/app/services/system_service.ts b/admin/app/services/system_service.ts
index 0fff635..c1bd166 100644
--- a/admin/app/services/system_service.ts
+++ b/admin/app/services/system_service.ts
@@ -35,29 +35,48 @@ export class SystemService {
   }
 
   async getInternetStatus(): Promise<boolean> {
-    const DEFAULT_TEST_URL = 'https://1.1.1.1/cdn-cgi/trace'
+    // Primary endpoint stays Cloudflare's privacy-respecting utility endpoint.
+    // The fallbacks are hosts the application already contacts elsewhere
+    // (GitHub API for update checks, the Project N.O.M.A.D. API for release-note
+    // subscriptions), so no new third-party services are introduced. They exist
+    // to avoid false "offline" reports on networks that block 1.1.1.1.
+    const DEFAULT_TEST_URLS = [
+      'https://1.1.1.1/cdn-cgi/trace',
+      'https://api.github.com',
+      'https://api.projectnomad.us',
+    ]
     const MAX_ATTEMPTS = 3
 
-    let testUrl = DEFAULT_TEST_URL
-    let customTestUrl = env.get('INTERNET_STATUS_TEST_URL')?.trim()
+    let testUrls = DEFAULT_TEST_URLS
+    const customTestUrl = env.get('INTERNET_STATUS_TEST_URL')?.trim()
 
-    // check that customTestUrl is a valid URL, if provided
+    // If a custom test URL is provided and valid, use it exclusively. This
+    // preserves the existing override behavior for operators who intentionally
+    // point connectivity checks at a specific endpoint.
     if (customTestUrl && customTestUrl !== '') {
       try {
         new URL(customTestUrl)
-        testUrl = customTestUrl
+        testUrls = [customTestUrl]
       } catch (error) {
         logger.warn(
-          `Invalid INTERNET_STATUS_TEST_URL: ${customTestUrl}. Falling back to default URL.`
+          `Invalid INTERNET_STATUS_TEST_URL: ${customTestUrl}. Falling back to default URLs.`
         )
       }
     }
 
     for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
       try {
-        const res = await axios.get(testUrl, { timeout: 5000 })
-        return res.status === 200
+        // Probe all endpoints in parallel and resolve as soon as the first one
+        // responds. Any HTTP response (including non-2xx) means we reached the
+        // internet, so accept all status codes rather than requiring a strict 200.
+        await Promise.any(
+          testUrls.map((testUrl) =>
+            axios.get(testUrl, { timeout: 5000, validateStatus: () => true })
+          )
+        )
+        return true
       } catch (error) {
+        // Promise.any only rejects (with an AggregateError) when every endpoint failed.
         logger.warn(
           `Internet status check attempt ${attempt}/${MAX_ATTEMPTS} failed: ${error instanceof Error ? error.message : error}`
         )

From 6a2d4c2bf674fee4e831262329258668e4911051 Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Mon, 8 Jun 2026 17:20:49 +0000
Subject: [PATCH 49/83] feat(content): opt-in automatic updates for installed
 ZIM & map content

---
 admin/app/controllers/system_controller.ts    |  18 +
 admin/app/jobs/content_auto_update_job.ts     |  72 +++
 admin/app/jobs/run_download_job.ts            | 166 ++++--
 admin/app/models/installed_resource.ts        |  21 +
 .../app/services/collection_update_service.ts |  81 ++-
 .../services/content_auto_update_service.ts   | 550 ++++++++++++++++++
 admin/app/services/kiwix_catalog_service.ts   | 338 +++++++++++
 admin/app/services/rag_service.ts             |  93 +++
 admin/app/services/system_service.ts          |  12 +
 .../app/utils/content_auto_update_backoff.ts  |  51 ++
 admin/app/utils/content_reindex_decision.ts   |  58 ++
 admin/app/validators/settings.ts              |  13 +-
 admin/commands/content_auto_update/dry_run.ts | 218 +++++++
 admin/commands/queue/work.ts                  |  34 ++
 admin/constants/kv_store.ts                   |   2 +-
 ...to_update_fields_to_installed_resources.ts |  36 ++
 .../updates/ContentAutoUpdateSection.tsx      | 249 ++++++++
 .../updates/ContentUpdatesSection.tsx         |   2 +-
 .../hooks/useContentAutoUpdateStatus.ts       |  11 +
 admin/inertia/lib/api.ts                      |  11 +-
 admin/inertia/pages/settings/update.tsx       |   2 +
 admin/start/routes.ts                         |   1 +
 admin/tests/unit/content_auto_update.spec.ts  | 218 +++++++
 .../unit/content_auto_update_backoff.spec.ts  |  83 +++
 .../unit/content_reindex_decision.spec.ts     |  64 ++
 admin/types/downloads.ts                      |   7 +
 admin/types/kv_store.ts                       |  12 +
 admin/types/system.ts                         |  29 +
 28 files changed, 2372 insertions(+), 80 deletions(-)
 create mode 100644 admin/app/jobs/content_auto_update_job.ts
 create mode 100644 admin/app/services/content_auto_update_service.ts
 create mode 100644 admin/app/services/kiwix_catalog_service.ts
 create mode 100644 admin/app/utils/content_auto_update_backoff.ts
 create mode 100644 admin/app/utils/content_reindex_decision.ts
 create mode 100644 admin/commands/content_auto_update/dry_run.ts
 create mode 100644 admin/database/migrations/1776200000001_add_content_auto_update_fields_to_installed_resources.ts
 create mode 100644 admin/inertia/components/updates/ContentAutoUpdateSection.tsx
 create mode 100644 admin/inertia/hooks/useContentAutoUpdateStatus.ts
 create mode 100644 admin/tests/unit/content_auto_update.spec.ts
 create mode 100644 admin/tests/unit/content_auto_update_backoff.spec.ts
 create mode 100644 admin/tests/unit/content_reindex_decision.spec.ts

diff --git a/admin/app/controllers/system_controller.ts b/admin/app/controllers/system_controller.ts
index d08b8e6..08956c6 100644
--- a/admin/app/controllers/system_controller.ts
+++ b/admin/app/controllers/system_controller.ts
@@ -4,6 +4,7 @@ import { SystemUpdateService } from '#services/system_update_service'
 import { ContainerRegistryService } from '#services/container_registry_service'
 import { AutoUpdateService } from '#services/auto_update_service'
 import { AppAutoUpdateService } from '#services/app_auto_update_service'
+import { ContentAutoUpdateService } from '#services/content_auto_update_service'
 import { DownloadService } from '#services/download_service'
 import { QueueService } from '#services/queue_service'
 import { CheckServiceUpdatesJob } from '#jobs/check_service_updates_job'
@@ -174,6 +175,23 @@ export default class SystemController {
         }
     }
 
+    async getContentAutoUpdateStatus({ response }: HttpContext) {
+        // Mirrors getAppAutoUpdateStatus. Content auto-update needs only the
+        // DownloadService (for the active-download pre-flight); the catalog and
+        // collection-update services default-construct inside the service.
+        const contentAutoUpdateService = new ContentAutoUpdateService(
+            new DownloadService(QueueService.getInstance())
+        )
+
+        try {
+            const status = await contentAutoUpdateService.getStatus()
+            response.send(status)
+        } catch (error) {
+            logger.error({ err: error }, '[SystemController] Failed to get content auto-update status')
+            response.status(500).send({ error: 'Failed to retrieve content auto-update status' })
+        }
+    }
+
     async setServiceAutoUpdate({ request, response }: HttpContext) {
         const payload = await request.validateUsing(setServiceAutoUpdateValidator)
         const service = await Service.query().where('service_name', payload.service_name).first()
diff --git a/admin/app/jobs/content_auto_update_job.ts b/admin/app/jobs/content_auto_update_job.ts
new file mode 100644
index 0000000..f331162
--- /dev/null
+++ b/admin/app/jobs/content_auto_update_job.ts
@@ -0,0 +1,72 @@
+import { Job } from 'bullmq'
+import { QueueService } from '#services/queue_service'
+import { DownloadService } from '#services/download_service'
+import { ContentAutoUpdateService } from '#services/content_auto_update_service'
+import logger from '@adonisjs/core/services/logger'
+
+/**
+ * Hourly job that evaluates whether any installed content (ZIM/map) should
+ * auto-update right now and, if so, dispatches the downloads. All gating (master
+ * switch, content window, cool-off, per-window data cap, pre-flight, backoff)
+ * lives in {@link ContentAutoUpdateService}; this job is just the scheduled
+ * trigger. Runs hourly so it can act anywhere inside a user's window regardless
+ * of the window's length. Mirrors {@link AppAutoUpdateJob}.
+ */
+export class ContentAutoUpdateJob {
+  static get queue() {
+    return 'system'
+  }
+
+  static get key() {
+    return 'content-auto-update'
+  }
+
+  async handle(_job: Job) {
+    logger.info('[ContentAutoUpdateJob] Evaluating content auto-updates...')
+
+    const contentAutoUpdateService = new ContentAutoUpdateService(
+      new DownloadService(QueueService.getInstance())
+    )
+
+    const result = await contentAutoUpdateService.attempt()
+    logger.info(`[ContentAutoUpdateJob] ${result.started} started: ${result.reason}`)
+    return result
+  }
+
+  static async schedule() {
+    const queueService = QueueService.getInstance()
+    const queue = queueService.getQueue(this.queue)
+
+    await queue.upsertJobScheduler(
+      'hourly-content-auto-update',
+      { pattern: '0 * * * *' }, // Top of every hour; attempt() gates on the window
+      {
+        name: this.key,
+        opts: {
+          removeOnComplete: { count: 12 },
+          removeOnFail: { count: 5 },
+        },
+      }
+    )
+
+    logger.info('[ContentAutoUpdateJob] Content auto-update evaluation scheduled with cron: 0 * * * *')
+  }
+
+  static async dispatch() {
+    const queueService = QueueService.getInstance()
+    const queue = queueService.getQueue(this.queue)
+
+    const job = await queue.add(
+      this.key,
+      {},
+      {
+        attempts: 1,
+        removeOnComplete: { count: 12 },
+        removeOnFail: { count: 5 },
+      }
+    )
+
+    logger.info(`[ContentAutoUpdateJob] Dispatched ad-hoc content auto-update evaluation job ${job.id}`)
+    return job
+  }
+}
diff --git a/admin/app/jobs/run_download_job.ts b/admin/app/jobs/run_download_job.ts
index 8a219e9..205b479 100644
--- a/admin/app/jobs/run_download_job.ts
+++ b/admin/app/jobs/run_download_job.ts
@@ -6,7 +6,36 @@ import { createHash } from 'crypto'
 import { DockerService } from '#services/docker_service'
 import { ZimService } from '#services/zim_service'
 import { MapService } from '#services/map_service'
+import { RagService } from '#services/rag_service'
+import { OllamaService } from '#services/ollama_service'
 import { EmbedFileJob } from './embed_file_job.js'
+import { basename, join, resolve, sep } from 'node:path'
+import { ZIM_STORAGE_PATH } from '../utils/fs.js'
+
+/** Maps live under `<cwd>/storage/maps/pmtiles`; no shared constant exists. */
+const MAP_STORAGE_PATH = '/storage/maps'
+
+/**
+ * Guard for the outdated-file deletion in {@link RunDownloadJob} `onComplete`:
+ * returns true only when `oldFilePath` sits under the expected content storage
+ * root for its type AND its filename carries this resource's id prefix. This
+ * makes the delete explicit and bounded — we only ever remove the replaced
+ * resource's own previous file, never another file, even if the
+ * InstalledResource row is stale or malformed.
+ */
+function isSafeOldContentPath(
+  oldFilePath: string,
+  resourceId: string,
+  filetype: string
+): boolean {
+  const root =
+    filetype === 'zim'
+      ? join(process.cwd(), ZIM_STORAGE_PATH)
+      : join(process.cwd(), MAP_STORAGE_PATH)
+  const resolved = resolve(oldFilePath)
+  if (!resolved.startsWith(root + sep)) return false
+  return basename(resolved).startsWith(`${resourceId}_`)
+}
 
 export class RunDownloadJob {
   static get queue() {
@@ -98,6 +127,11 @@ export class RunDownloadJob {
           lastKnownProgress = { downloadedBytes: progress.downloadedBytes, totalBytes: progress.totalBytes }
         },
         async onComplete(url) {
+          // The previous file recorded for this resource (if any). Hoisted out of
+          // the metadata block below so the ZIM branch can decide whether this
+          // download is a content UPDATE (replacing a prior file) vs a fresh
+          // install, which changes how we reconcile the knowledge base.
+          let oldFilePath: string | null = null
           try {
             // Create InstalledResource entry if metadata was provided
             if (resourceMetadata) {
@@ -111,9 +145,9 @@ export class RunDownloadJob {
                 .where('resource_id', resourceMetadata.resource_id)
                 .where('resource_type', filetype as 'zim' | 'map')
                 .first()
-              const oldFilePath = oldEntry?.file_path ?? null
+              oldFilePath = oldEntry?.file_path ?? null
 
-              await InstalledResource.updateOrCreate(
+              const installed = await InstalledResource.updateOrCreate(
                 { resource_id: resourceMetadata.resource_id, resource_type: filetype as 'zim' | 'map' },
                 {
                   version: resourceMetadata.version,
@@ -125,15 +159,45 @@ export class RunDownloadJob {
                 }
               )
 
-              // Delete the old file if it differs from the new one
-              if (oldFilePath && oldFilePath !== filepath) {
+              // A completed auto-update is the authoritative success signal for the
+              // per-resource backoff — clear it here (NOT at dispatch time, which
+              // would reset the counter every window and defeat self-disable). The
+              // matching terminal-failure increment lives in the worker `failed`
+              // handler (commands/queue/work.ts). Manual downloads (auto !== true)
+              // never touch the counter.
+              if (resourceMetadata.auto === true) {
                 try {
-                  await deleteFileIfExists(oldFilePath)
-                  console.log(`[RunDownloadJob] Deleted old file: ${oldFilePath}`)
-                } catch (deleteError) {
+                  const { recordResourceUpdateSuccess } = await import(
+                    '../utils/content_auto_update_backoff.js'
+                  )
+                  await recordResourceUpdateSuccess(installed)
+                } catch (error) {
+                  console.error(
+                    `[RunDownloadJob] Error clearing auto-update backoff for ${resourceMetadata.resource_id}:`,
+                    error
+                  )
+                }
+              }
+
+              // Step 1: delete the OUTDATED file if it differs from the new one.
+              // Guarded by isSafeOldContentPath so we can ONLY ever delete the
+              // replaced resource's own previous file — never another resource's
+              // file, even if the InstalledResource row is stale/malformed.
+              if (oldFilePath && oldFilePath !== filepath) {
+                if (isSafeOldContentPath(oldFilePath, resourceMetadata.resource_id, filetype)) {
+                  try {
+                    await deleteFileIfExists(oldFilePath)
+                    console.log(`[RunDownloadJob] Deleted old file: ${oldFilePath}`)
+                  } catch (deleteError) {
+                    console.warn(
+                      `[RunDownloadJob] Failed to delete old file ${oldFilePath}:`,
+                      deleteError
+                    )
+                  }
+                } else {
                   console.warn(
-                    `[RunDownloadJob] Failed to delete old file ${oldFilePath}:`,
-                    deleteError
+                    `[RunDownloadJob] Refusing to delete unexpected old file path for ` +
+                      `${resourceMetadata.resource_id} (${filetype}): ${oldFilePath}`
                   )
                 }
               }
@@ -144,42 +208,76 @@ export class RunDownloadJob {
               const zimService = new ZimService(dockerService)
               await zimService.downloadRemoteSuccessCallback([url], true)
 
-              // Only dispatch embedding job if AI Assistant (Ollama) is installed
+              // Only touch the knowledge base if AI Assistant (Ollama) is installed
               const ollamaUrl = await dockerService.getServiceURL('nomad_ollama')
               if (ollamaUrl) {
-                // Respect the global ingest policy. Under Manual, record the file
-                // as pending_decision so the KB panel surfaces the per-file Index
-                // affordance (PR #909) instead of silently auto-embedding behind
-                // the user's back. Unset is treated as Always to preserve legacy
-                // behavior — mirrors rag_service.ts:1587-1588.
-                const { default: KVStore } = await import('#models/kv_store')
-                const { default: KbIngestState } = await import('#models/kb_ingest_state')
-                const policyRaw = await KVStore.getValue('rag.defaultIngestPolicy')
-                const policy: 'Always' | 'Manual' = policyRaw === 'Manual' ? 'Manual' : 'Always'
+                // A content UPDATE replaces a prior file at a DIFFERENT path
+                // (version is in the filename). A fresh install has no prior row;
+                // a same-version re-download keeps the same path. The two cases
+                // reconcile the KB differently.
+                const isReplacement = !!oldFilePath && oldFilePath !== filepath
 
-                if (policy === 'Manual') {
+                if (isReplacement) {
+                  // CONTENT UPDATE: mirror the REPLACED file's prior indexed state
+                  // rather than the global Always/Manual policy. reconcileReplaced-
+                  // ContentFile removes the old file's points and re-queues the new
+                  // file IFF the old one was indexed and Qdrant is running; it is a
+                  // no-op otherwise (not installed / old not indexed / Qdrant down).
+                  // The user already chose whether this content is in the KB, so we
+                  // honor that choice in both directions. See the method for the
+                  // full 5-step contract.
                   try {
-                    // firstOrCreate so a re-download doesn't demote an existing
-                    // indexed/failed row — user keeps prior state and can re-index
-                    // explicitly from the KB panel if they want fresh content.
-                    await KbIngestState.firstOrCreate(
-                      { file_path: filepath },
-                      { file_path: filepath, state: 'pending_decision', chunks_embedded: 0 }
+                    const ragService = new RagService(dockerService, new OllamaService())
+                    const outcome = await ragService.reconcileReplacedContentFile({
+                      oldFilePath: oldFilePath!,
+                      newFilePath: filepath,
+                      fileName: url.split('/').pop() || '',
+                    })
+                    console.log(
+                      `[RunDownloadJob] KB reconciliation for replaced ${filepath}: ${outcome}`
                     )
                   } catch (error) {
                     console.error(
-                      `[RunDownloadJob] Error recording pending_decision state for ${filepath}:`,
+                      `[RunDownloadJob] Error reconciling knowledge base for replaced file ${filepath}:`,
                       error
                     )
                   }
                 } else {
-                  try {
-                    await EmbedFileJob.dispatch({
-                      fileName: url.split('/').pop() || '',
-                      filePath: filepath,
-                    })
-                  } catch (error) {
-                    console.error(`[RunDownloadJob] Error dispatching EmbedFileJob for URL ${url}:`, error)
+                  // FRESH INSTALL (or same-version re-download): respect the global
+                  // ingest policy. Under Manual, record the file as pending_decision
+                  // so the KB panel surfaces the per-file Index affordance (PR #909)
+                  // instead of silently auto-embedding behind the user's back. Unset
+                  // is treated as Always to preserve legacy behavior — mirrors
+                  // rag_service.ts:1587-1588.
+                  const { default: KVStore } = await import('#models/kv_store')
+                  const { default: KbIngestState } = await import('#models/kb_ingest_state')
+                  const policyRaw = await KVStore.getValue('rag.defaultIngestPolicy')
+                  const policy: 'Always' | 'Manual' = policyRaw === 'Manual' ? 'Manual' : 'Always'
+
+                  if (policy === 'Manual') {
+                    try {
+                      // firstOrCreate so a re-download doesn't demote an existing
+                      // indexed/failed row — user keeps prior state and can re-index
+                      // explicitly from the KB panel if they want fresh content.
+                      await KbIngestState.firstOrCreate(
+                        { file_path: filepath },
+                        { file_path: filepath, state: 'pending_decision', chunks_embedded: 0 }
+                      )
+                    } catch (error) {
+                      console.error(
+                        `[RunDownloadJob] Error recording pending_decision state for ${filepath}:`,
+                        error
+                      )
+                    }
+                  } else {
+                    try {
+                      await EmbedFileJob.dispatch({
+                        fileName: url.split('/').pop() || '',
+                        filePath: filepath,
+                      })
+                    } catch (error) {
+                      console.error(`[RunDownloadJob] Error dispatching EmbedFileJob for URL ${url}:`, error)
+                    }
                   }
                 }
               }
diff --git a/admin/app/models/installed_resource.ts b/admin/app/models/installed_resource.ts
index cee2866..0cfe36b 100644
--- a/admin/app/models/installed_resource.ts
+++ b/admin/app/models/installed_resource.ts
@@ -30,4 +30,25 @@ export default class InstalledResource extends BaseModel {
 
   @column.dateTime()
   declare installed_at: DateTime
+
+  // ── Content auto-update state (global opt-in; gated by `contentAutoUpdate.enabled`) ──
+
+  /** Newest catalog version (YYYY-MM) detected, or null when already current. */
+  @column()
+  declare available_update_version: string | null
+
+  /** Size (bytes) of the available update, captured from the catalog. */
+  @column()
+  declare available_update_size_bytes: number | null
+
+  /** Cool-off anchor: when the current available update was first detected. */
+  @column.dateTime()
+  declare available_update_first_seen_at: DateTime | null
+
+  /** Per-resource failure backoff so one flapping download self-disables. */
+  @column()
+  declare auto_update_consecutive_failures: number
+
+  @column()
+  declare auto_update_disabled_reason: string | null
 }
diff --git a/admin/app/services/collection_update_service.ts b/admin/app/services/collection_update_service.ts
index 2e19cac..8b4e388 100644
--- a/admin/app/services/collection_update_service.ts
+++ b/admin/app/services/collection_update_service.ts
@@ -1,16 +1,15 @@
 import logger from '@adonisjs/core/services/logger'
-import env from '#start/env'
 import axios from 'axios'
+import { DateTime } from 'luxon'
 import InstalledResource from '#models/installed_resource'
 import { RunDownloadJob } from '../jobs/run_download_job.js'
 import { ZIM_STORAGE_PATH } from '../utils/fs.js'
 import { join } from 'path'
 import type {
-  ResourceUpdateCheckRequest,
   ResourceUpdateInfo,
   ContentUpdateCheckResult,
 } from '../../types/collections.js'
-import { NOMAD_API_DEFAULT_BASE_URL } from '../../constants/misc.js'
+import { KiwixCatalogService, reconcileResourceUpdateState } from './kiwix_catalog_service.js'
 
 const MAP_STORAGE_PATH = '/storage/maps'
 
@@ -18,16 +17,13 @@ const ZIM_MIME_TYPES = ['application/x-zim', 'application/x-openzim', 'applicati
 const PMTILES_MIME_TYPES = ['application/vnd.pmtiles', 'application/octet-stream']
 
 export class CollectionUpdateService {
+  /**
+   * Check every installed resource against the upstream catalogs locally (Kiwix
+   * OPDS for ZIMs, GitHub for maps) — no longer routed through the external
+   * project-nomad-api. Side-effect: persists each resource's available-update
+   * state (version + cool-off anchor) so the auto-updater can act on it later.
+   */
   async checkForUpdates(): Promise<ContentUpdateCheckResult> {
-    const nomadAPIURL = env.get('NOMAD_API_URL') || NOMAD_API_DEFAULT_BASE_URL
-    if (!nomadAPIURL) {
-      return {
-        updates: [],
-        checked_at: new Date().toISOString(),
-        error: 'Nomad API is not configured. Set the NOMAD_API_URL environment variable.',
-      }
-    }
-
     const installed = await InstalledResource.all()
     if (installed.length === 0) {
       return {
@@ -36,53 +32,53 @@ export class CollectionUpdateService {
       }
     }
 
-    const requestBody: ResourceUpdateCheckRequest = {
-      resources: installed.map((r) => ({
-        resource_id: r.resource_id,
-        resource_type: r.resource_type,
-        installed_version: r.version,
-      })),
-    }
-
     try {
-      const response = await axios.post<ResourceUpdateInfo[]>(`${nomadAPIURL}/api/v1/resources/check-updates`, requestBody, {
-        timeout: 15000,
-      })
-
-      logger.info(
-        `[CollectionUpdateService] Update check complete: ${response.data.length} update(s) available`
+      const catalog = new KiwixCatalogService()
+      const latestByKey = await catalog.getLatestForResources(
+        installed.map((r) => ({ resource_id: r.resource_id, resource_type: r.resource_type }))
       )
 
-      const updates = await this.enrichWithSizes(response.data)
+      const now = DateTime.now()
+      const updates: ResourceUpdateInfo[] = []
+      for (const resource of installed) {
+        const latest = latestByKey.get(`${resource.resource_type}:${resource.resource_id}`) ?? null
+        await reconcileResourceUpdateState(resource, latest, now)
 
+        if (latest && latest.version > resource.version) {
+          updates.push({
+            resource_id: resource.resource_id,
+            resource_type: resource.resource_type,
+            installed_version: resource.version,
+            latest_version: latest.version,
+            download_url: latest.download_url,
+            size_bytes: latest.size_bytes || undefined,
+          })
+        }
+      }
+
+      logger.info(
+        `[CollectionUpdateService] Local update check complete: ${updates.length} update(s) available`
+      )
+
+      const enriched = await this.enrichWithSizes(updates)
       return {
-        updates,
+        updates: enriched,
         checked_at: new Date().toISOString(),
       }
     } catch (error) {
-      if (axios.isAxiosError(error) && error.response) {
-        logger.error(
-          `[CollectionUpdateService] Nomad API returned ${error.response.status}: ${JSON.stringify(error.response.data)}`
-        )
-        return {
-          updates: [],
-          checked_at: new Date().toISOString(),
-          error: 'Failed to check for content updates. The update service may be temporarily unavailable.',
-        }
-      }
-      const message =
-        error instanceof Error ? error.message : 'Unknown error contacting Nomad API'
+      const message = error instanceof Error ? error.message : 'Unknown error during update check'
       logger.error(`[CollectionUpdateService] Failed to check for updates: ${message}`)
       return {
         updates: [],
         checked_at: new Date().toISOString(),
-        error: 'Failed to contact the update service. Please try again later.',
+        error: 'Failed to check for content updates. Please try again later.',
       }
     }
   }
 
   async applyUpdate(
-    update: ResourceUpdateInfo
+    update: ResourceUpdateInfo,
+    options?: { auto?: boolean }
   ): Promise<{ success: boolean; jobId?: string; error?: string }> {
     // Check if a download is already in progress for this URL
     const existingJob = await RunDownloadJob.getByUrl(update.download_url)
@@ -113,6 +109,7 @@ export class CollectionUpdateService {
         resource_id: update.resource_id,
         version: update.latest_version,
         collection_ref: null,
+        auto: options?.auto ?? false,
       },
     })
 
diff --git a/admin/app/services/content_auto_update_service.ts b/admin/app/services/content_auto_update_service.ts
new file mode 100644
index 0000000..fd798ab
--- /dev/null
+++ b/admin/app/services/content_auto_update_service.ts
@@ -0,0 +1,550 @@
+import logger from '@adonisjs/core/services/logger'
+import { DateTime } from 'luxon'
+import KVStore from '#models/kv_store'
+import InstalledResource from '#models/installed_resource'
+import { DownloadService } from '#services/download_service'
+import { CollectionUpdateService } from '#services/collection_update_service'
+import {
+  KiwixCatalogService,
+  reconcileResourceUpdateState,
+  type CatalogResult,
+} from '#services/kiwix_catalog_service'
+import { isWithinWindow, parseWindowMinutes } from '../utils/update_window.js'
+import { recordResourceUpdateFailure } from '../utils/content_auto_update_backoff.js'
+import type { Blocker, PreflightResult } from '../utils/image_disk_preflight.js'
+
+/**
+ * Content auto-update is opt-in via a single global master switch and runs on
+ * its OWN window + per-window data cap (deliberately separate from the core/app
+ * `autoUpdate.*` window, since ZIM downloads are multi-GB and bandwidth
+ * sensitive). Defaults err toward an overnight window with no cap; the UI
+ * strongly recommends setting a cap.
+ */
+const DEFAULT_WINDOW_START = '02:00'
+const DEFAULT_WINDOW_END = '05:00'
+const DEFAULT_COOLOFF_HOURS = 72
+
+/** Whole-feature failures (e.g. catalog unreachable) before it self-disables. */
+const MAX_FEATURE_FAILURES = 3
+
+export interface ContentAutoUpdateConfig {
+  /** Global master switch (`contentAutoUpdate.enabled`). */
+  enabled: boolean
+  windowStart: string
+  windowEnd: string
+  cooloffHours: number
+  /** Max NEW bytes initiated per window instance. 0 = unlimited. */
+  maxBytesPerWindow: number
+}
+
+/** Per-resource eligibility verdict (drives both selection and the status UI). */
+export interface ContentEligibility {
+  eligible: boolean
+  reason: string
+  cooloffRemainingHours: number | null
+}
+
+/** An eligible resource paired with the catalog facts needed to download it. */
+export interface ContentCandidate {
+  resource: InstalledResource
+  version: string
+  download_url: string
+  size_bytes: number
+  installed_at: DateTime
+}
+
+/** Outcome of the cap-bounded greedy selection. */
+export interface ContentSelection {
+  selected: ContentCandidate[]
+  /** Single files larger than the whole cap — never auto-started (manual only). */
+  skippedOversize: ContentCandidate[]
+  /** Fit the cap but not this window's remaining budget — retried next window. */
+  deferred: ContentCandidate[]
+}
+
+export interface ContentAutoUpdateResourceStatus {
+  resource_id: string
+  resource_type: 'zim' | 'map'
+  current_version: string
+  available_update_version: string | null
+  size_bytes: number | null
+  eligible: boolean
+  reason: string
+  cooloff_remaining_hours: number | null
+  exceeds_cap: boolean
+  consecutive_failures: number
+  auto_disabled_reason: string | null
+}
+
+export interface ContentAutoUpdateStatus extends ContentAutoUpdateConfig {
+  withinWindow: boolean
+  windowBytesUsed: number
+  lastAttemptAt: string | null
+  lastResult: string | null
+  lastError: string | null
+  autoDisabledReason: string | null
+  resources: ContentAutoUpdateResourceStatus[]
+}
+
+/**
+ * Decision + safety layer for automatic content (ZIM/map) updates. This is the
+ * content-side counterpart to {@link AppAutoUpdateService}: it decides *whether*
+ * each installed resource with an available update should be downloaded now
+ * (master switch on + in the content window + past cool-off + within the data
+ * cap) and then drives the existing manual download path
+ * ({@link CollectionUpdateService.applyUpdate} → {@link RunDownloadJob}).
+ *
+ * It never installs synchronously — it dispatches resumable download jobs and
+ * lets the existing job-completion path advance the installed version and
+ * rebuild the Kiwix library.
+ */
+export class ContentAutoUpdateService {
+  constructor(
+    private downloadService: DownloadService,
+    private catalog: KiwixCatalogService = new KiwixCatalogService(),
+    private collectionUpdateService: CollectionUpdateService = new CollectionUpdateService()
+  ) {}
+
+  /** Read the master switch plus the content-specific window/cool-off/cap. */
+  async getConfig(): Promise<ContentAutoUpdateConfig> {
+    const [enabled, windowStart, windowEnd, cooloffHours, maxBytes] = await Promise.all([
+      KVStore.getValue('contentAutoUpdate.enabled'),
+      KVStore.getValue('contentAutoUpdate.windowStart'),
+      KVStore.getValue('contentAutoUpdate.windowEnd'),
+      KVStore.getValue('contentAutoUpdate.cooloffHours'),
+      KVStore.getValue('contentAutoUpdate.maxBytesPerWindow'),
+    ])
+
+    const parsedCooloff = Number(cooloffHours)
+    const parsedCap = Number(maxBytes)
+    return {
+      enabled: enabled ?? false,
+      windowStart: windowStart || DEFAULT_WINDOW_START,
+      windowEnd: windowEnd || DEFAULT_WINDOW_END,
+      // `Number(null) === 0`, so an unset value must fall through to the default
+      // rather than silently resolving to a zero cool-off. An explicit 0 is honored.
+      cooloffHours:
+        cooloffHours !== null && Number.isFinite(parsedCooloff) && parsedCooloff >= 0
+          ? parsedCooloff
+          : DEFAULT_COOLOFF_HOURS,
+      maxBytesPerWindow:
+        maxBytes !== null && Number.isFinite(parsedCap) && parsedCap >= 0 ? parsedCap : 0,
+    }
+  }
+
+  /**
+   * Pure per-resource eligibility verdict. A resource is eligible when it has a
+   * detected newer version, is not self-disabled, and is past its cool-off
+   * (measured from first-detected). Version comparison is a lexicographic
+   * compare of the YYYY-MM stamps, which sorts chronologically.
+   */
+  resourceEligibility(
+    resource: InstalledResource,
+    cooloffHours: number,
+    now: DateTime
+  ): ContentEligibility {
+    if (!resource.available_update_version) {
+      return { eligible: false, reason: 'Up to date', cooloffRemainingHours: null }
+    }
+    if (resource.auto_update_disabled_reason) {
+      return {
+        eligible: false,
+        reason: 'Auto-update disabled after repeated failures',
+        cooloffRemainingHours: null,
+      }
+    }
+    if (!(resource.available_update_version > resource.version)) {
+      return { eligible: false, reason: 'Up to date', cooloffRemainingHours: null }
+    }
+    if (!resource.available_update_first_seen_at) {
+      return { eligible: false, reason: 'Cool-off pending', cooloffRemainingHours: cooloffHours }
+    }
+
+    const ageHours = now.diff(resource.available_update_first_seen_at, 'hours').hours
+    const remaining = cooloffHours - ageHours
+    if (remaining > 0) {
+      const rounded = Math.ceil(remaining)
+      return {
+        eligible: false,
+        reason: `In cool-off (${rounded}h remaining)`,
+        cooloffRemainingHours: rounded,
+      }
+    }
+
+    return {
+      eligible: true,
+      reason: `Eligible → ${resource.available_update_version}`,
+      cooloffRemainingHours: 0,
+    }
+  }
+
+  /**
+   * Pure cap-bounded greedy selection. Oldest-installed first (stale content is
+   * prioritized), tie-broken smallest-first for predictability.
+   *
+   * - size unknown (0) → deferred (can't budget safely)
+   * - size > the WHOLE cap → skippedOversize (never auto-started; manual only)
+   * - size ≤ remaining budget → selected
+   * - otherwise → deferred (fits the cap, not this window)
+   */
+  selectUnderCap(
+    candidates: ContentCandidate[],
+    capBytes: number,
+    usedBytes: number
+  ): ContentSelection {
+    const cap = capBytes > 0 ? capBytes : Number.POSITIVE_INFINITY
+    let remaining = Math.max(0, cap - usedBytes)
+
+    const selected: ContentCandidate[] = []
+    const skippedOversize: ContentCandidate[] = []
+    const deferred: ContentCandidate[] = []
+
+    const ordered = [...candidates].sort((a, b) => {
+      const at = a.installed_at?.toMillis?.() ?? 0
+      const bt = b.installed_at?.toMillis?.() ?? 0
+      if (at !== bt) return at - bt
+      return a.size_bytes - b.size_bytes
+    })
+
+    for (const candidate of ordered) {
+      if (candidate.size_bytes <= 0) {
+        deferred.push(candidate)
+      } else if (candidate.size_bytes > cap) {
+        skippedOversize.push(candidate)
+      } else if (candidate.size_bytes <= remaining) {
+        selected.push(candidate)
+        remaining -= candidate.size_bytes
+      } else {
+        deferred.push(candidate)
+      }
+    }
+
+    return { selected, skippedOversize, deferred }
+  }
+
+  /**
+   * Run-wide pre-flight: never auto-update content while ANY download is already
+   * running. Because content downloads are multi-GB and resumable, an in-flight
+   * download from a prior window naturally blocks new starts here — exactly the
+   * "let in-flight finish, don't start new" behavior we want. Transient → `skip`.
+   */
+  async runGlobalPreflight(): Promise<PreflightResult> {
+    const blockers: Blocker[] = []
+    try {
+      const downloads = await this.downloadService.listDownloadJobs()
+      const active = downloads.filter(
+        (d) => !!d.status && ['waiting', 'active', 'delayed'].includes(d.status)
+      )
+      if (active.length > 0) {
+        blockers.push({ reason: `${active.length} download(s) in progress`, severity: 'skip' })
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error)
+      logger.warn(`[ContentAutoUpdateService] Could not check active downloads: ${message}`)
+    }
+    return { ok: blockers.length === 0, blockers }
+  }
+
+  /**
+   * Entry point invoked by ContentAutoUpdateJob. Gates on the master switch +
+   * window, runs the local catalog check, then downloads as many eligible
+   * resources as fit under the per-window data cap.
+   */
+  async attempt(): Promise<{ started: number; reason: string }> {
+    const config = await this.getConfig()
+    const now = DateTime.now()
+
+    if (!config.enabled) {
+      return { started: 0, reason: 'Content auto-update is disabled' }
+    }
+    if (!isWithinWindow(config.windowStart, config.windowEnd, now)) {
+      const reason = `Outside update window (${config.windowStart}-${config.windowEnd})`
+      await this.recordRun(reason)
+      return { started: 0, reason }
+    }
+
+    try {
+      // Reset the per-window budget once per window instance (the cron fires
+      // hourly but a window can span several hours).
+      await this.maybeResetWindowBudget(config, now)
+
+      // Local catalog check + persist available-update state for every resource.
+      const installed = await InstalledResource.all()
+      const latestByKey = await this.catalog.getLatestForResources(
+        installed.map((r) => ({ resource_id: r.resource_id, resource_type: r.resource_type }))
+      )
+      for (const resource of installed) {
+        const latest = latestByKey.get(`${resource.resource_type}:${resource.resource_id}`) ?? null
+        await reconcileResourceUpdateState(resource, latest, now)
+      }
+
+      const eligible = installed.filter(
+        (r) => this.resourceEligibility(r, config.cooloffHours, now).eligible
+      )
+      if (eligible.length === 0) {
+        await this.recordFeatureSuccess()
+        const reason = 'No eligible content updates'
+        await this.recordRun(reason)
+        return { started: 0, reason }
+      }
+
+      const global = await this.runGlobalPreflight()
+      if (!global.ok) {
+        await this.recordFeatureSuccess()
+        const reason = `Pre-flight blocked: ${global.blockers.map((b) => b.reason).join('; ')}`
+        await this.recordRun(reason)
+        return { started: 0, reason }
+      }
+
+      const candidates: ContentCandidate[] = eligible.map((r) => {
+        const latest = latestByKey.get(`${r.resource_type}:${r.resource_id}`) as CatalogResult
+        return {
+          resource: r,
+          version: latest.version,
+          download_url: latest.download_url,
+          size_bytes: r.available_update_size_bytes ?? latest.size_bytes ?? 0,
+          installed_at: r.installed_at,
+        }
+      })
+
+      const usedBytes = await this.getWindowBytesUsed()
+      const { selected, skippedOversize, deferred } = this.selectUnderCap(
+        candidates,
+        config.maxBytesPerWindow,
+        usedBytes
+      )
+
+      let started = 0
+      let failed = 0
+      let initiatedBytes = 0
+      for (const candidate of selected) {
+        const result = await this.collectionUpdateService.applyUpdate(
+          {
+            resource_id: candidate.resource.resource_id,
+            resource_type: candidate.resource.resource_type,
+            installed_version: candidate.resource.version,
+            latest_version: candidate.version,
+            download_url: candidate.download_url,
+            size_bytes: candidate.size_bytes || undefined,
+          },
+          { auto: true }
+        )
+
+        if (result.success) {
+          // Success is NOT recorded here: applyUpdate only enqueues a resumable
+          // download. The per-resource backoff is cleared once the download
+          // actually completes (RunDownloadJob.onComplete) and incremented when it
+          // fails terminally (the worker `failed` handler). Recording success on
+          // dispatch would reset the counter every window and defeat self-disable.
+          initiatedBytes += candidate.size_bytes
+          started++
+          logger.info(
+            `[ContentAutoUpdateService] Started ${candidate.resource.resource_id} → ${candidate.version}`
+          )
+        } else {
+          // A failure to even enqueue is a genuine auto-update failure; no job runs,
+          // so no terminal `failed` event will follow — count it here.
+          await recordResourceUpdateFailure(candidate.resource, result.error ?? 'dispatch failed')
+          failed++
+        }
+      }
+
+      if (initiatedBytes > 0) {
+        await this.addWindowBytesUsed(initiatedBytes)
+      }
+
+      const parts = [`${started} started`]
+      if (failed) parts.push(`${failed} failed`)
+      if (skippedOversize.length) parts.push(`${skippedOversize.length} skipped (exceeds cap)`)
+      if (deferred.length) parts.push(`${deferred.length} deferred (over budget)`)
+      const reason = parts.join(', ')
+
+      await this.recordFeatureSuccess()
+      await this.recordRun(reason)
+      logger.info(`[ContentAutoUpdateService] Run complete: ${reason}`)
+      return { started, reason }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error)
+      await this.recordFeatureFailure(message)
+      await this.recordRun(`Failed: ${message}`)
+      logger.error(`[ContentAutoUpdateService] Run failed: ${message}`)
+      return { started: 0, reason: `Failed: ${message}` }
+    }
+  }
+
+  /**
+   * Evaluate what the next run *would* do, without hitting the network,
+   * persisting state, or dispatching anything. Operates on the available-update
+   * state already persisted by the last check (manual or auto), so run a "Check
+   * for Content Updates" first if you want fresh catalog data. Used by the
+   * `content-auto-update:dry-run` command.
+   */
+  async dryRun(
+    overrides: {
+      now?: DateTime
+      forceEnabled?: boolean
+      cooloffHours?: number
+      windowStart?: string
+      windowEnd?: string
+      maxBytesPerWindow?: number
+      windowBytesUsed?: number
+    } = {}
+  ): Promise<{
+    enabled: boolean
+    withinWindow: boolean
+    config: ContentAutoUpdateConfig
+    eligibleCount: number
+    selection: ContentSelection
+  }> {
+    const base = await this.getConfig()
+    const config: ContentAutoUpdateConfig = {
+      enabled: overrides.forceEnabled ? true : base.enabled,
+      windowStart: overrides.windowStart ?? base.windowStart,
+      windowEnd: overrides.windowEnd ?? base.windowEnd,
+      cooloffHours: overrides.cooloffHours ?? base.cooloffHours,
+      maxBytesPerWindow: overrides.maxBytesPerWindow ?? base.maxBytesPerWindow,
+    }
+    const now = overrides.now ?? DateTime.now()
+    const withinWindow = isWithinWindow(config.windowStart, config.windowEnd, now)
+
+    const pending = await InstalledResource.query().whereNotNull('available_update_version')
+    const eligible = pending.filter(
+      (r) => this.resourceEligibility(r, config.cooloffHours, now).eligible
+    )
+    const candidates: ContentCandidate[] = eligible.map((r) => ({
+      resource: r,
+      version: r.available_update_version!,
+      download_url: '(dry-run)',
+      size_bytes: r.available_update_size_bytes ?? 0,
+      installed_at: r.installed_at,
+    }))
+
+    const usedBytes = overrides.windowBytesUsed ?? (await this.getWindowBytesUsed())
+    const selection = this.selectUnderCap(candidates, config.maxBytesPerWindow, usedBytes)
+
+    return {
+      enabled: config.enabled,
+      withinWindow,
+      config,
+      eligibleCount: eligible.length,
+      selection,
+    }
+  }
+
+  // ── Per-window budget ─────────────────────────────────────────────────────────
+
+  /** Most-recent window-open boundary as an absolute timestamp (handles wrap). */
+  windowStartBoundary(windowStart: string, now: DateTime): DateTime {
+    const minutes = parseWindowMinutes(windowStart) ?? 0
+    const todayStart = now.startOf('day').plus({ minutes })
+    return now >= todayStart ? todayStart : todayStart.minus({ days: 1 })
+  }
+
+  /** Reset the window budget exactly once per entry into the window. */
+  private async maybeResetWindowBudget(
+    config: ContentAutoUpdateConfig,
+    now: DateTime
+  ): Promise<void> {
+    const boundary = this.windowStartBoundary(config.windowStart, now)
+    const resetAtRaw = await KVStore.getValue('contentAutoUpdate.windowResetAt')
+    const resetAt = resetAtRaw ? DateTime.fromISO(resetAtRaw) : null
+    if (!resetAt || !resetAt.isValid || resetAt < boundary) {
+      await KVStore.setValue('contentAutoUpdate.windowBytesUsed', '0')
+      await KVStore.setValue('contentAutoUpdate.windowResetAt', now.toISO()!)
+    }
+  }
+
+  private async getWindowBytesUsed(): Promise<number> {
+    const raw = await KVStore.getValue('contentAutoUpdate.windowBytesUsed')
+    const num = Number(raw)
+    return Number.isFinite(num) && num > 0 ? num : 0
+  }
+
+  private async addWindowBytesUsed(bytes: number): Promise<void> {
+    const used = await this.getWindowBytesUsed()
+    await KVStore.setValue('contentAutoUpdate.windowBytesUsed', String(used + bytes))
+  }
+
+  // ── Backoff + run recording ───────────────────────────────────────────────────
+  // Per-resource backoff lives in ../utils/content_auto_update_backoff.ts so the
+  // job-completion path and the worker `failed` handler can share it without an
+  // import cycle. The feature-level backoff below stays here.
+
+  /** Clear the feature-level backoff after a clean run. */
+  private async recordFeatureSuccess(): Promise<void> {
+    await KVStore.setValue('contentAutoUpdate.consecutiveFailures', '0')
+    await KVStore.clearValue('contentAutoUpdate.lastError')
+  }
+
+  /** Record a whole-feature failure and self-disable the feature at the threshold. */
+  private async recordFeatureFailure(reason: string): Promise<void> {
+    const raw = await KVStore.getValue('contentAutoUpdate.consecutiveFailures')
+    const failures = (Number(raw) || 0) + 1
+    await KVStore.setValue('contentAutoUpdate.consecutiveFailures', String(failures))
+    await KVStore.setValue('contentAutoUpdate.lastError', reason)
+    if (failures >= MAX_FEATURE_FAILURES) {
+      await KVStore.setValue('contentAutoUpdate.enabled', false)
+      await KVStore.setValue(
+        'contentAutoUpdate.autoDisabledReason',
+        `Content auto-update disabled after ${failures} consecutive failures. Last error: ${reason}`
+      )
+      logger.error(
+        `[ContentAutoUpdateService] Feature auto-disabled after ${failures} consecutive failures`
+      )
+    }
+  }
+
+  private async recordRun(reason: string): Promise<void> {
+    await KVStore.setValue('contentAutoUpdate.lastAttemptAt', DateTime.now().toISO()!)
+    await KVStore.setValue('contentAutoUpdate.lastResult', reason)
+  }
+
+  // ── Status snapshot ───────────────────────────────────────────────────────────
+
+  /** Full state snapshot for the settings UI (resources with pending updates). */
+  async getStatus(): Promise<ContentAutoUpdateStatus> {
+    const config = await this.getConfig()
+    const now = DateTime.now()
+
+    const pending = await InstalledResource.query().whereNotNull('available_update_version')
+    const resources: ContentAutoUpdateResourceStatus[] = pending.map((resource) => {
+      const verdict = this.resourceEligibility(resource, config.cooloffHours, now)
+      const size = resource.available_update_size_bytes ?? null
+      const exceedsCap =
+        config.maxBytesPerWindow > 0 && size !== null && size > config.maxBytesPerWindow
+      return {
+        resource_id: resource.resource_id,
+        resource_type: resource.resource_type,
+        current_version: resource.version,
+        available_update_version: resource.available_update_version,
+        size_bytes: size,
+        eligible: verdict.eligible && !exceedsCap,
+        reason: exceedsCap ? 'Exceeds data cap — update manually' : verdict.reason,
+        cooloff_remaining_hours: verdict.cooloffRemainingHours,
+        exceeds_cap: exceedsCap,
+        consecutive_failures: resource.auto_update_consecutive_failures || 0,
+        auto_disabled_reason: resource.auto_update_disabled_reason,
+      }
+    })
+
+    const [lastAttemptAt, lastResult, lastError, autoDisabledReason, windowBytesUsed] =
+      await Promise.all([
+        KVStore.getValue('contentAutoUpdate.lastAttemptAt'),
+        KVStore.getValue('contentAutoUpdate.lastResult'),
+        KVStore.getValue('contentAutoUpdate.lastError'),
+        KVStore.getValue('contentAutoUpdate.autoDisabledReason'),
+        this.getWindowBytesUsed(),
+      ])
+
+    return {
+      ...config,
+      withinWindow: isWithinWindow(config.windowStart, config.windowEnd, now),
+      windowBytesUsed,
+      lastAttemptAt: lastAttemptAt || null,
+      lastResult: lastResult || null,
+      lastError: lastError || null,
+      autoDisabledReason: autoDisabledReason || null,
+      resources,
+    }
+  }
+}
diff --git a/admin/app/services/kiwix_catalog_service.ts b/admin/app/services/kiwix_catalog_service.ts
new file mode 100644
index 0000000..e7f0422
--- /dev/null
+++ b/admin/app/services/kiwix_catalog_service.ts
@@ -0,0 +1,338 @@
+import axios from 'axios'
+import { XMLParser } from 'fast-xml-parser'
+import { DateTime } from 'luxon'
+import logger from '@adonisjs/core/services/logger'
+import InstalledResource from '#models/installed_resource'
+import { isRawListRemoteZimFilesResponse } from '../../util/zim.js'
+
+/**
+ * Local, in-process freshness check for installed content (Kiwix ZIM files +
+ * PMTiles maps). This replaces the former dependency on the external
+ * project-nomad-api `/api/v1/resources/check-updates` endpoint — every NOMAD
+ * instance now queries the upstream catalogs directly.
+ *
+ * Downloads have always gone straight to the Kiwix/GitHub mirrors regardless of
+ * who performed the check, so moving the check in-process only shifts the
+ * lightweight *catalog* lookup. To stay mirror-respectful the auto-updater gates
+ * these calls behind the update window and bounds their concurrency; sizes come
+ * from the catalog metadata so we avoid per-file HEAD requests.
+ *
+ * Robustness over the old API: ZIM lookups use the OPDS exact `name=` filter
+ * (no lossy keyword stripping) and every returned link is still validated
+ * against the authoritative `^<id>_YYYY-MM\.zim$` filename regex, so a substring
+ * match in the catalog can never resolve to the wrong book. Parsing is fully
+ * defensive — a malformed entry is skipped, never thrown.
+ */
+
+const KIWIX_CATALOG_URL = 'https://browse.library.kiwix.org/catalog/v2/entries'
+const GITHUB_PMTILES_URL =
+  'https://api.github.com/repos/Crosstalk-Solutions/project-nomad-maps/contents/pmtiles'
+
+const CATALOG_TIMEOUT_MS = 15000
+/** Bounded paginated fallback scan when the exact `name=` lookup comes up empty. */
+const KIWIX_PAGE_SIZE = 60
+const MAX_KIWIX_FETCHES = 5
+/** Concurrent ZIM catalog lookups — keep small to avoid hammering the mirror. */
+const ZIM_CHECK_CONCURRENCY = 4
+
+/** The newest available version of a single resource (a YYYY-MM date stamp). */
+export interface CatalogResult {
+  version: string
+  download_url: string
+  size_bytes: number
+}
+
+interface CatalogZimEntry {
+  name: string | null
+  download_url: string
+  file_name: string
+  size_bytes: number
+}
+
+interface GithubContentEntry {
+  name: string
+  download_url: string | null
+  size: number
+}
+
+function escapeRegex(input: string): string {
+  return input.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
+
+export class KiwixCatalogService {
+  private parser = new XMLParser({
+    ignoreAttributes: false,
+    attributeNamePrefix: '',
+    textNodeName: '#text',
+  })
+
+  /**
+   * Resolve the newest available version for a batch of installed resources.
+   * Returns a map keyed by `"<resource_type>:<resource_id>"`; resources with no
+   * available newer version (or a failed lookup) are simply absent.
+   *
+   * ZIMs are checked one OPDS request each (bounded concurrency). All maps are
+   * resolved from a single GitHub directory listing.
+   */
+  async getLatestForResources(
+    resources: Array<{ resource_id: string; resource_type: 'zim' | 'map' }>
+  ): Promise<Map<string, CatalogResult>> {
+    const result = new Map<string, CatalogResult>()
+    const zims = resources.filter((r) => r.resource_type === 'zim')
+    const maps = resources.filter((r) => r.resource_type === 'map')
+
+    await this.forEachWithConcurrency(zims, ZIM_CHECK_CONCURRENCY, async (r) => {
+      try {
+        const latest = await this.getLatestZim(r.resource_id)
+        if (latest) result.set(`zim:${r.resource_id}`, latest)
+      } catch (error) {
+        logger.warn(
+          `[KiwixCatalogService] ZIM check failed for ${r.resource_id}: ${error instanceof Error ? error.message : error}`
+        )
+      }
+    })
+
+    if (maps.length > 0) {
+      try {
+        const listing = await this.fetchMapListing()
+        for (const r of maps) {
+          const latest = this.pickNewestMap(listing, r.resource_id)
+          if (latest) result.set(`map:${r.resource_id}`, latest)
+        }
+      } catch (error) {
+        logger.warn(
+          `[KiwixCatalogService] Map listing fetch failed: ${error instanceof Error ? error.message : error}`
+        )
+      }
+    }
+
+    return result
+  }
+
+  /** Newest catalog version of a single ZIM book, or null if none/older. */
+  async getLatestZim(resourceId: string): Promise<CatalogResult | null> {
+    const pattern = new RegExp(`^${escapeRegex(resourceId)}_(\\d{4}-\\d{2})\\.zim$`)
+
+    // 1. Exact-name lookup (the robust path).
+    const named = await this.fetchZimEntries({ name: resourceId, count: 50, start: 0 })
+    const exact = this.pickNewestZim(named, pattern)
+    if (exact) return exact
+
+    // 2. Fallback: bounded keyword scan in case the catalog ignored `name=` or
+    //    indexes the book under a slightly different name.
+    return this.scanZimByQuery(resourceId, pattern)
+  }
+
+  /** Newest catalog version of a single PMTiles map, or null if none/older. */
+  async getLatestMap(resourceId: string): Promise<CatalogResult | null> {
+    const listing = await this.fetchMapListing()
+    return this.pickNewestMap(listing, resourceId)
+  }
+
+  // ── ZIM internals ───────────────────────────────────────────────────────────
+
+  private pickNewestZim(entries: CatalogZimEntry[], pattern: RegExp): CatalogResult | null {
+    let latest: CatalogResult | null = null
+    for (const entry of entries) {
+      const match = entry.file_name.match(pattern)
+      if (!match) continue
+      const version = match[1]
+      if (!latest || version > latest.version) {
+        latest = { version, download_url: entry.download_url, size_bytes: entry.size_bytes }
+      }
+    }
+    return latest
+  }
+
+  private async scanZimByQuery(
+    resourceId: string,
+    pattern: RegExp
+  ): Promise<CatalogResult | null> {
+    let start = 0
+    let total = 0
+    let latest: CatalogResult | null = null
+
+    for (let i = 0; i < MAX_KIWIX_FETCHES; i++) {
+      const { entries, totalResults } = await this.fetchZimEntriesPage({
+        q: resourceId,
+        count: KIWIX_PAGE_SIZE,
+        start,
+      })
+      total = totalResults
+      if (entries.length === 0) break
+      start += entries.length
+
+      const candidate = this.pickNewestZim(entries, pattern)
+      if (candidate && (!latest || candidate.version > latest.version)) {
+        latest = candidate
+      }
+      if (start >= total) break
+    }
+    return latest
+  }
+
+  private async fetchZimEntries(params: {
+    name?: string
+    q?: string
+    count: number
+    start: number
+  }): Promise<CatalogZimEntry[]> {
+    const { entries } = await this.fetchZimEntriesPage(params)
+    return entries
+  }
+
+  private async fetchZimEntriesPage(params: {
+    name?: string
+    q?: string
+    count: number
+    start: number
+  }): Promise<{ entries: CatalogZimEntry[]; totalResults: number }> {
+    const res = await axios.get(KIWIX_CATALOG_URL, {
+      params: {
+        start: params.start,
+        count: params.count,
+        lang: 'eng',
+        ...(params.name ? { name: params.name } : {}),
+        ...(params.q ? { q: params.q } : {}),
+      },
+      responseType: 'text',
+      timeout: CATALOG_TIMEOUT_MS,
+    })
+    return this.parseZimEntries(res.data)
+  }
+
+  private parseZimEntries(xml: string): { entries: CatalogZimEntry[]; totalResults: number } {
+    let parsed: any
+    try {
+      parsed = this.parser.parse(xml)
+    } catch {
+      return { entries: [], totalResults: 0 }
+    }
+    if (!isRawListRemoteZimFilesResponse(parsed)) {
+      return { entries: [], totalResults: 0 }
+    }
+
+    const feed = parsed.feed
+    const totalResults = Number(feed?.totalResults)
+    const rawEntries = feed?.entry
+      ? Array.isArray(feed.entry)
+        ? feed.entry
+        : [feed.entry]
+      : []
+
+    const entries: CatalogZimEntry[] = []
+    for (const raw of rawEntries) {
+      if (!raw || typeof raw !== 'object') continue
+      const links = Array.isArray(raw.link) ? raw.link : raw.link ? [raw.link] : []
+      const downloadLink = links.find(
+        (link: any) =>
+          link &&
+          typeof link === 'object' &&
+          link.type === 'application/x-zim' &&
+          typeof link.href === 'string'
+      )
+      if (!downloadLink) continue
+
+      // The OPDS href ends with `.meta4`; strip it to get the real .zim URL.
+      const href: string = downloadLink.href
+      const download_url = href.endsWith('.meta4') ? href.slice(0, -'.meta4'.length) : href
+      const file_name = download_url.split('/').pop() || ''
+      if (!file_name) continue
+
+      const size_bytes = Number.parseInt(downloadLink.length, 10) || 0
+      entries.push({
+        name: typeof raw.name === 'string' ? raw.name : null,
+        download_url,
+        file_name,
+        size_bytes,
+      })
+    }
+
+    return { entries, totalResults: Number.isFinite(totalResults) ? totalResults : 0 }
+  }
+
+  // ── Map internals ────────────────────────────────────────────────────────────
+
+  private async fetchMapListing(): Promise<GithubContentEntry[]> {
+    const res = await axios.get(GITHUB_PMTILES_URL, {
+      headers: { Accept: 'application/vnd.github+json' },
+      timeout: CATALOG_TIMEOUT_MS,
+    })
+    return Array.isArray(res.data) ? res.data : []
+  }
+
+  private pickNewestMap(listing: GithubContentEntry[], resourceId: string): CatalogResult | null {
+    const pattern = new RegExp(`^${escapeRegex(resourceId)}_(\\d{4}-\\d{2})\\.pmtiles$`)
+    let latest: CatalogResult | null = null
+    for (const file of listing) {
+      if (!file || typeof file.name !== 'string' || !file.download_url) continue
+      const match = file.name.match(pattern)
+      if (!match) continue
+      const version = match[1]
+      if (!latest || version > latest.version) {
+        latest = {
+          version,
+          download_url: file.download_url,
+          size_bytes: typeof file.size === 'number' ? file.size : 0,
+        }
+      }
+    }
+    return latest
+  }
+
+  // ── Shared ───────────────────────────────────────────────────────────────────
+
+  private async forEachWithConcurrency<T>(
+    items: T[],
+    concurrency: number,
+    worker: (item: T) => Promise<void>
+  ): Promise<void> {
+    let cursor = 0
+    const runners = Array.from({ length: Math.min(concurrency, items.length) }, async () => {
+      while (cursor < items.length) {
+        const index = cursor++
+        await worker(items[index])
+      }
+    })
+    await Promise.all(runners)
+  }
+}
+
+/**
+ * Persist the latest-known available-update state onto an installed resource.
+ * Shared by the manual check and the auto-updater so both keep the cool-off
+ * anchor consistent.
+ *
+ * The first-seen anchor is reset **only** when the available version string
+ * actually changes, so a manual "Check for updates" never resets the auto
+ * cool-off clock. State is cleared entirely once the resource is current (the
+ * update got installed, or the upstream release was withdrawn).
+ */
+export async function reconcileResourceUpdateState(
+  resource: InstalledResource,
+  latest: CatalogResult | null,
+  now: DateTime
+): Promise<void> {
+  const hasUpdate = latest !== null && latest.version > resource.version
+
+  if (hasUpdate) {
+    if (resource.available_update_version !== latest!.version) {
+      resource.available_update_version = latest!.version
+      resource.available_update_first_seen_at = now
+    }
+    // Keep the cached size fresh even when the version is unchanged (the catalog
+    // may report a size it lacked on a previous check).
+    const size = latest!.size_bytes || null
+    if (resource.available_update_size_bytes !== size) {
+      resource.available_update_size_bytes = size
+    }
+  } else if (resource.available_update_version !== null) {
+    resource.available_update_version = null
+    resource.available_update_size_bytes = null
+    resource.available_update_first_seen_at = null
+  }
+
+  if (resource.$isDirty) {
+    await resource.save()
+  }
+}
diff --git a/admin/app/services/rag_service.ts b/admin/app/services/rag_service.ts
index 8c046e8..36c6658 100644
--- a/admin/app/services/rag_service.ts
+++ b/admin/app/services/rag_service.ts
@@ -18,6 +18,7 @@ import { join, resolve, sep } from 'node:path'
 import KVStore from '#models/kv_store'
 import KbIngestState from '#models/kb_ingest_state'
 import { decideScanAction, type IngestPolicy } from '../utils/kb_ingest_decision.js'
+import { decideContentReindex, type ReindexOutcome } from '../utils/content_reindex_decision.js'
 import KbRatioRegistry from '#models/kb_ratio_registry'
 import { decideWarnings } from '../utils/kb_warning_decision.js'
 import type { FileWarning, FileWarningsResult, StoredFileInfo } from '../../types/rag.js'
@@ -1309,6 +1310,98 @@ export class RagService {
     }
   }
 
+  /**
+   * Reconcile the knowledge base after a curated content file (a ZIM) is
+   * replaced on disk by a newer downloaded version. Called from
+   * `RunDownloadJob.onComplete` once the new file is written and the old file
+   * has been deleted from disk.
+   *
+   * The decision (see `decideContentReindex` for the exhaustive, tested
+   * contract) mirrors the REPLACED file's prior indexed state instead of the
+   * global `rag.defaultIngestPolicy`. On a content update the user has already
+   * chosen whether this content belongs in the AI knowledge base, so we honor
+   * that choice in both directions:
+   *
+   *   1. (caller already deleted the outdated file from disk)
+   *   2. Qdrant not installed          → no-op (no knowledge base exists)
+   *   3. Old file WAS indexed + Qdrant
+   *      running                       → delete ONLY the old file's points
+   *                                       (filter `source == oldFilePath`), drop
+   *                                       its ingest-state row, and queue the new
+   *                                       file for embedding — BYPASSING the
+   *                                       Always/Manual policy on purpose.
+   *   4. Old file NOT indexed          → no-op (respect the prior un-indexed /
+   *                                       browse-only choice; do NOT auto-embed
+   *                                       even under an Always policy)
+   *   5. Old indexed but Qdrant NOT
+   *      currently running             → no-op. We can't remove the stale points,
+   *                                       and a queued embed job could be cleared
+   *                                       before Qdrant returns. Acting half-way is
+   *                                       wasteful, so we defer entirely. Accepted
+   *                                       tradeoff: the old file's points linger in
+   *                                       Qdrant until a future re-index; they are
+   *                                       NOT auto-reaped here.
+   *
+   * Point deletion is exact: ZIM chunks are stored with `source` equal to the
+   * full file path (see embedAndStoreText callers), so filtering on the old path
+   * can only ever remove the replaced file's own points.
+   *
+   * Returns the decision outcome for logging/tests; never throws on a Qdrant
+   * hiccup mid-reindex (logged and surfaced as `qdrant_not_running` semantics by
+   * the caller's try/catch).
+   */
+  public async reconcileReplacedContentFile(params: {
+    oldFilePath: string
+    newFilePath: string
+    fileName: string
+  }): Promise<ReindexOutcome> {
+    const { oldFilePath, newFilePath, fileName } = params
+
+    const isReplacement = !!oldFilePath && oldFilePath !== newFilePath
+
+    // Step 2: is the knowledge base even installed? Short-circuits before any
+    // KB-state lookup, per the spec ordering.
+    const qdrantInstalled = isReplacement
+      ? !!(await this.dockerService.getServiceURL(SERVICE_NAMES.QDRANT))
+      : false
+
+    // Steps 3/4: was the OUTDATED file actually indexed? The state row is the
+    // authoritative signal (RFC #883) — chunk presence alone can't distinguish
+    // a fully-indexed file from a stalled ingestion.
+    let oldFileWasIndexed = false
+    if (isReplacement && qdrantInstalled) {
+      const oldState = await KbIngestState.query().where('file_path', oldFilePath).first()
+      oldFileWasIndexed = oldState?.state === 'indexed'
+    }
+
+    // Step 5: only check liveness once we know we'd otherwise act. The health
+    // check is a real network round-trip, so we avoid it on the common no-op
+    // paths above.
+    let qdrantRunning = false
+    if (isReplacement && qdrantInstalled && oldFileWasIndexed) {
+      qdrantRunning = (await this.checkQdrantHealth()).online
+    }
+
+    const outcome = decideContentReindex({
+      isReplacement,
+      qdrantInstalled,
+      oldFileWasIndexed,
+      qdrantRunning,
+    })
+
+    if (outcome === 'reindex') {
+      // Order matters: remove the stale points and state row BEFORE queueing the
+      // new embed so a fresh index can't be conflated with the old one. Each step
+      // targets only `oldFilePath` / `newFilePath` — never another resource.
+      await this._deletePointsBySource(oldFilePath)
+      await KbIngestState.remove(oldFilePath)
+      const { EmbedFileJob } = await import('#jobs/embed_file_job')
+      await EmbedFileJob.dispatch({ fileName, filePath: newFilePath })
+    }
+
+    return outcome
+  }
+
   public async discoverNomadDocs(force?: boolean): Promise<{ success: boolean; message: string }> {
     try {
       const README_PATH = join(process.cwd(), 'README.md')
diff --git a/admin/app/services/system_service.ts b/admin/app/services/system_service.ts
index c1bd166..d058851 100644
--- a/admin/app/services/system_service.ts
+++ b/admin/app/services/system_service.ts
@@ -1,4 +1,5 @@
 import Service from '#models/service'
+import InstalledResource from '#models/installed_resource'
 import { inject } from '@adonisjs/core'
 import { DockerService } from '#services/docker_service'
 import { ServiceSlim } from '../../types/services.js'
@@ -869,6 +870,17 @@ export class SystemService {
         auto_update_disabled_reason: null,
       })
     }
+    // Re-enabling content auto-update clears the feature-level backoff and every
+    // resource's per-resource backoff so previously self-disabled content gets a
+    // fresh start.
+    if (key === 'contentAutoUpdate.enabled' && (value === true || value === 'true')) {
+      await KVStore.setValue('contentAutoUpdate.consecutiveFailures', '0')
+      await KVStore.clearValue('contentAutoUpdate.autoDisabledReason')
+      await InstalledResource.query().update({
+        auto_update_consecutive_failures: 0,
+        auto_update_disabled_reason: null,
+      })
+    }
   }
 
   /**
diff --git a/admin/app/utils/content_auto_update_backoff.ts b/admin/app/utils/content_auto_update_backoff.ts
new file mode 100644
index 0000000..c9a83e7
--- /dev/null
+++ b/admin/app/utils/content_auto_update_backoff.ts
@@ -0,0 +1,51 @@
+import logger from '@adonisjs/core/services/logger'
+import type InstalledResource from '#models/installed_resource'
+
+/**
+ * Per-resource failure backoff for content (ZIM/map) auto-updates, shared by the
+ * three places that observe an auto-update's real lifecycle:
+ *
+ *   - {@link ContentAutoUpdateService.attempt} — a dispatch that fails to even
+ *     enqueue (counts as a failure; no job runs so no terminal event follows).
+ *   - `RunDownloadJob.onComplete` — a download that actually finished (success).
+ *   - the worker `failed` handler in `commands/queue/work.ts` — a download that
+ *     exhausted its retries (terminal failure).
+ *
+ * Kept in a dependency-light util (not on ContentAutoUpdateService) on purpose:
+ * RunDownloadJob is imported by CollectionUpdateService, which is imported by
+ * ContentAutoUpdateService, so importing the service back into the job would
+ * close an import cycle. Only the InstalledResource model and the logger are
+ * touched here.
+ */
+
+/** Genuine consecutive auto-update failures before a resource self-disables. */
+export const MAX_CONSECUTIVE_FAILURES = 3
+
+/** Clear a resource's failure backoff after a successful auto-update. */
+export async function recordResourceUpdateSuccess(resource: InstalledResource): Promise<void> {
+  if (resource.auto_update_consecutive_failures === 0 && !resource.auto_update_disabled_reason) {
+    return
+  }
+  resource.auto_update_consecutive_failures = 0
+  resource.auto_update_disabled_reason = null
+  await resource.save()
+}
+
+/** Record an auto-update failure and self-disable the resource at the threshold. */
+export async function recordResourceUpdateFailure(
+  resource: InstalledResource,
+  reason: string
+): Promise<void> {
+  const failures = (resource.auto_update_consecutive_failures || 0) + 1
+  resource.auto_update_consecutive_failures = failures
+  if (failures >= MAX_CONSECUTIVE_FAILURES) {
+    resource.auto_update_disabled_reason = `Auto-update disabled after ${failures} consecutive failures. Last error: ${reason}`
+    logger.error(
+      `[ContentAutoUpdate] ${resource.resource_id} auto-disabled after ${failures} failures`
+    )
+  }
+  await resource.save()
+  logger.error(
+    `[ContentAutoUpdate] ${resource.resource_id} failure ${failures}/${MAX_CONSECUTIVE_FAILURES}: ${reason}`
+  )
+}
diff --git a/admin/app/utils/content_reindex_decision.ts b/admin/app/utils/content_reindex_decision.ts
new file mode 100644
index 0000000..52a5ff3
--- /dev/null
+++ b/admin/app/utils/content_reindex_decision.ts
@@ -0,0 +1,58 @@
+/**
+ * Decision for reconciling the AI knowledge base (Qdrant) after a curated
+ * content file (a ZIM) is replaced by a newer downloaded version.
+ *
+ * This is the pure, I/O-free core of `RagService.reconcileReplacedContentFile`.
+ * Keeping the branching here (mirrors `decideScanAction` in
+ * `kb_ingest_decision.ts`) makes the contract exhaustively testable without a
+ * database or a live Qdrant.
+ *
+ * The logic deliberately MIRRORS the replaced file's prior indexed state rather
+ * than applying the global `rag.defaultIngestPolicy`: on a content *update* the
+ * user has already made an indexing choice for this content, so we honor it in
+ * both directions (re-index a previously-indexed file even under Manual; leave a
+ * previously-unindexed file alone even under Always). Fresh installs still go
+ * through the normal policy path — those return `not_a_replacement` here.
+ *
+ * Outcomes (evaluated top-down, short-circuiting):
+ * - `not_a_replacement` — no prior file, or the new file has the same path
+ *   (same-version re-download). Caller defers to normal ingest policy.
+ * - `qdrant_not_installed` (step 2) — no knowledge base exists; nothing to do.
+ * - `old_not_indexed` (step 4) — the replaced file was never embedded
+ *   (no state row, or state ≠ `indexed`); leave the new file un-indexed.
+ * - `qdrant_not_running` (step 5) — the replaced file WAS indexed but Qdrant is
+ *   currently offline. We do nothing: we can't remove the stale points, and a
+ *   queued embed job could be dropped before Qdrant returns. Acting half-way is
+ *   wasteful, so we defer entirely (accepted tradeoff: stale points linger).
+ * - `reindex` (step 3) — the replaced file was indexed and Qdrant is running:
+ *   delete ONLY the old file's points, drop its state row, and queue the new
+ *   file for embedding.
+ *
+ * Note the install-before-indexed ordering: step 2 short-circuits before any KB
+ * state lookup, matching the spec.
+ */
+export type ReindexOutcome =
+  | 'not_a_replacement'
+  | 'qdrant_not_installed'
+  | 'old_not_indexed'
+  | 'qdrant_not_running'
+  | 'reindex'
+
+export interface ContentReindexInput {
+  /** The replaced file existed AND its path differs from the new file's path. */
+  isReplacement: boolean
+  /** `nomad_qdrant` service exists (installed), regardless of running state. */
+  qdrantInstalled: boolean
+  /** The replaced file's `KbIngestState.state === 'indexed'`. */
+  oldFileWasIndexed: boolean
+  /** Qdrant answered a live health check (currently reachable). */
+  qdrantRunning: boolean
+}
+
+export function decideContentReindex(input: ContentReindexInput): ReindexOutcome {
+  if (!input.isReplacement) return 'not_a_replacement'
+  if (!input.qdrantInstalled) return 'qdrant_not_installed'
+  if (!input.oldFileWasIndexed) return 'old_not_indexed'
+  if (!input.qdrantRunning) return 'qdrant_not_running'
+  return 'reindex'
+}
diff --git a/admin/app/validators/settings.ts b/admin/app/validators/settings.ts
index e9067aa..fa56772 100644
--- a/admin/app/validators/settings.ts
+++ b/admin/app/validators/settings.ts
@@ -22,17 +22,28 @@ export function validateSettingValue(key: KVStoreKey, value: unknown): string |
     switch (key) {
         case 'autoUpdate.windowStart':
         case 'autoUpdate.windowEnd':
+        case 'contentAutoUpdate.windowStart':
+        case 'contentAutoUpdate.windowEnd':
             if (typeof value !== 'string' || !HHMM_PATTERN.test(value)) {
                 return 'Time window values must be in 24-hour HH:MM format (e.g. "20:00").'
             }
             return null
-        case 'autoUpdate.cooloffHours': {
+        case 'autoUpdate.cooloffHours':
+        case 'contentAutoUpdate.cooloffHours': {
             const num = Number(value)
             if (!Number.isInteger(num) || num < 0 || num > 8760) {
                 return 'Cool-off must be a whole number of hours between 0 and 8760.'
             }
             return null
         }
+        case 'contentAutoUpdate.maxBytesPerWindow': {
+            // Per-window download budget in bytes. 0 = unlimited.
+            const num = Number(value)
+            if (!Number.isInteger(num) || num < 0) {
+                return 'The per-window data cap must be a whole number of bytes (0 = unlimited).'
+            }
+            return null
+        }
         default:
             return null
     }
diff --git a/admin/commands/content_auto_update/dry_run.ts b/admin/commands/content_auto_update/dry_run.ts
new file mode 100644
index 0000000..679803c
--- /dev/null
+++ b/admin/commands/content_auto_update/dry_run.ts
@@ -0,0 +1,218 @@
+import { BaseCommand, flags } from '@adonisjs/core/ace'
+import type { CommandOptions } from '@adonisjs/core/types/ace'
+import { isWithinWindow } from '../../app/utils/update_window.js'
+
+/**
+ * Exercise the content auto-update decision pipeline WITHOUT ever dispatching a
+ * real download.
+ *
+ *   # Prove the core selection/eligibility/window logic deterministically
+ *   # (no network/DB):
+ *   node ace content-auto-update:dry-run --scenarios
+ *
+ *   # Evaluate what the next run would do against the currently-persisted
+ *   # available-update state (run a "Check for Content Updates" first to refresh
+ *   # it), forcing the feature on and overriding the cap:
+ *   node ace content-auto-update:dry-run --force-enabled --cap=20 --window-start=00:00 --window-end=23:59
+ */
+export default class ContentAutoUpdateDryRun extends BaseCommand {
+  static commandName = 'content-auto-update:dry-run'
+  static description = 'Dry-run the content auto-update decision pipeline (never dispatches a download)'
+
+  @flags.boolean({ description: 'Run the built-in deterministic scenario suite and exit' })
+  declare scenarios: boolean
+
+  @flags.boolean({ description: 'Ignore the persisted enabled setting and treat as enabled' })
+  declare forceEnabled: boolean
+
+  @flags.string({ description: 'Override cool-off hours' })
+  declare cooloff: string
+
+  @flags.string({ description: 'Override window start (HH:MM)' })
+  declare windowStart: string
+
+  @flags.string({ description: 'Override window end (HH:MM)' })
+  declare windowEnd: string
+
+  @flags.string({ description: 'Override per-window data cap in GB (0 = unlimited)' })
+  declare cap: string
+
+  @flags.string({ description: 'Override bytes already used this window' })
+  declare usedBytes: string
+
+  @flags.string({ description: 'Simulate the clock at this ISO timestamp' })
+  declare now: string
+
+  static options: CommandOptions = {
+    startApp: true,
+  }
+
+  async run() {
+    const { DateTime } = await import('luxon')
+    const { DownloadService } = await import('#services/download_service')
+    const { QueueService } = await import('#services/queue_service')
+    const { ContentAutoUpdateService } = await import('#services/content_auto_update_service')
+
+    const svc = new ContentAutoUpdateService(new DownloadService(QueueService.getInstance()))
+
+    if (this.scenarios) {
+      const ok = this.runScenarios(svc, DateTime)
+      if (!ok) this.exitCode = 1
+      return
+    }
+
+    const BYTES_PER_GB = 1024 * 1024 * 1024
+    const overrides: Record<string, any> = {}
+    if (this.forceEnabled) overrides.forceEnabled = true
+    if (this.cooloff) overrides.cooloffHours = Number(this.cooloff)
+    if (this.windowStart) overrides.windowStart = this.windowStart
+    if (this.windowEnd) overrides.windowEnd = this.windowEnd
+    if (this.cap) overrides.maxBytesPerWindow = Math.round(Number(this.cap) * BYTES_PER_GB)
+    if (this.usedBytes) overrides.windowBytesUsed = Number(this.usedBytes)
+    if (this.now) overrides.now = DateTime.fromISO(this.now)
+
+    this.logger.info('Running content auto-update dry run (no download will be dispatched)...')
+    const d = await svc.dryRun(overrides)
+
+    this.logger.log('')
+    this.logger.log(`  Enabled         : ${d.enabled}`)
+    this.logger.log(
+      `  Window          : ${d.config.windowStart}-${d.config.windowEnd} ` +
+        `(currently ${d.withinWindow ? 'inside' : 'outside'})`
+    )
+    this.logger.log(`  Cool-off hours  : ${d.config.cooloffHours}`)
+    this.logger.log(
+      `  Data cap        : ${d.config.maxBytesPerWindow > 0 ? d.config.maxBytesPerWindow + ' bytes' : 'unlimited'}`
+    )
+    this.logger.log(`  Eligible        : ${d.eligibleCount}`)
+    this.logger.log(`  Would start     : ${d.selection.selected.map((c) => c.resource.resource_id).join(', ') || '—'}`)
+    this.logger.log(
+      `  Skipped (cap)   : ${d.selection.skippedOversize.map((c) => c.resource.resource_id).join(', ') || '—'}`
+    )
+    this.logger.log(
+      `  Deferred (budget): ${d.selection.deferred.map((c) => c.resource.resource_id).join(', ') || '—'}`
+    )
+    this.logger.log('')
+  }
+
+  /**
+   * Deterministic acceptance suite over the pure decision helpers — no network
+   * or dispatch. Mirrors the per-resource eligibility, cap selection, and window
+   * branches reviewers care about.
+   */
+  private runScenarios(svc: any, DateTime: any): boolean {
+    const now = DateTime.fromISO('2026-06-04T03:00:00Z')
+    const daysAgo = (d: number) => now.minus({ days: d })
+    const hoursAgo = (h: number) => now.minus({ hours: h })
+
+    const res = (o: Record<string, any> = {}) => ({
+      resource_id: 'res',
+      version: '2024-01',
+      available_update_version: null,
+      available_update_size_bytes: null,
+      available_update_first_seen_at: null,
+      auto_update_disabled_reason: null,
+      auto_update_consecutive_failures: 0,
+      installed_at: daysAgo(100),
+      ...o,
+    })
+    const cand = (id: string, size: number, installedAt: any = daysAgo(100)) => ({
+      resource: res({ resource_id: id }),
+      version: '2024-06',
+      download_url: `(test)`,
+      size_bytes: size,
+      installed_at: installedAt,
+    })
+
+    let passed = 0
+    let failed = 0
+    const report = (ok: boolean, message: string) => {
+      this.logger.log(`  ${ok ? this.colors.green('✓') : this.colors.red('✗')} ${message}`)
+      ok ? passed++ : failed++
+    }
+
+    this.logger.log('')
+    this.logger.log('Eligibility scenarios:')
+    report(
+      svc.resourceEligibility(res(), 72, now).eligible === false,
+      'no available update → not eligible'
+    )
+    report(
+      svc.resourceEligibility(
+        res({ available_update_version: '2024-06', available_update_first_seen_at: hoursAgo(10) }),
+        72,
+        now
+      ).eligible === false,
+      'inside cool-off → not eligible'
+    )
+    report(
+      svc.resourceEligibility(
+        res({ available_update_version: '2024-06', available_update_first_seen_at: daysAgo(5) }),
+        72,
+        now
+      ).eligible === true,
+      'past cool-off → eligible'
+    )
+    report(
+      svc.resourceEligibility(
+        res({
+          available_update_version: '2024-06',
+          available_update_first_seen_at: daysAgo(30),
+          auto_update_disabled_reason: 'disabled',
+        }),
+        72,
+        now
+      ).eligible === false,
+      'self-disabled → not eligible'
+    )
+
+    this.logger.log('')
+    this.logger.log('Cap selection scenarios:')
+    {
+      const s = svc.selectUnderCap([cand('a', 1000), cand('b', 2000)], 10000, 0)
+      report(s.selected.length === 2, 'under cap selects all')
+    }
+    {
+      const s = svc.selectUnderCap([cand('huge', 50000)], 20000, 0)
+      report(
+        s.selected.length === 0 && s.skippedOversize.length === 1,
+        'oversize file → skipped, never selected'
+      )
+    }
+    {
+      const s = svc.selectUnderCap([cand('mid', 8000)], 10000, 5000)
+      report(s.selected.length === 0 && s.deferred.length === 1, 'over remaining budget → deferred')
+    }
+    {
+      const s = svc.selectUnderCap([cand('a', 0)], 10000, 0)
+      report(s.selected.length === 0 && s.deferred.length === 1, 'unknown size → deferred')
+    }
+    {
+      const s = svc.selectUnderCap([cand('big', 9_999_999_999)], 0, 0)
+      report(s.selected.length === 1, 'cap 0 → unlimited')
+    }
+
+    this.logger.log('')
+    this.logger.log('Window scenarios:')
+    report(
+      isWithinWindow('02:00', '05:00', DateTime.fromISO('2026-06-04T03:00:00')) === true,
+      'normal 02:00-05:00 @ 03:00 → in'
+    )
+    report(
+      isWithinWindow('22:00', '02:00', DateTime.fromISO('2026-06-04T01:00:00')) === true,
+      'wrap 22:00-02:00 @ 01:00 → in'
+    )
+    report(
+      isWithinWindow('22:00', '02:00', DateTime.fromISO('2026-06-04T12:00:00')) === false,
+      'wrap 22:00-02:00 @ 12:00 → out'
+    )
+
+    this.logger.log('')
+    if (failed === 0) {
+      this.logger.success(`All ${passed} scenarios passed`)
+    } else {
+      this.logger.error(`${failed} scenario(s) failed, ${passed} passed`)
+    }
+    return failed === 0
+  }
+}
diff --git a/admin/commands/queue/work.ts b/admin/commands/queue/work.ts
index 6db7f80..aa18dd8 100644
--- a/admin/commands/queue/work.ts
+++ b/admin/commands/queue/work.ts
@@ -11,6 +11,7 @@ import { CheckUpdateJob } from '#jobs/check_update_job'
 import { CheckServiceUpdatesJob } from '#jobs/check_service_updates_job'
 import { AutoUpdateJob } from '#jobs/auto_update_job'
 import { AppAutoUpdateJob } from '#jobs/app_auto_update_job'
+import { ContentAutoUpdateJob } from '#jobs/content_auto_update_job'
 
 export default class QueueWork extends BaseCommand {
   static commandName = 'queue:work'
@@ -92,6 +93,36 @@ export default class QueueWork extends BaseCommand {
             )
           }
         }
+
+        // Terminal failure of an AUTO content update → advance that resource's
+        // backoff (self-disables after MAX_CONSECUTIVE_FAILURES). BullMQ emits
+        // `failed` on every attempt, so gate on the final attempt to count each
+        // doomed download once, not once per retry. Manual downloads (auto !== true)
+        // are deliberately excluded.
+        const meta = job?.data?.resourceMetadata
+        const isTerminal = (job?.attemptsMade ?? 0) >= (job?.opts?.attempts ?? 1)
+        if (job?.name === RunDownloadJob.key && meta?.auto === true && isTerminal) {
+          try {
+            const { default: InstalledResource } = await import('#models/installed_resource')
+            const { recordResourceUpdateFailure } = await import(
+              '../../app/utils/content_auto_update_backoff.js'
+            )
+            const resource = await InstalledResource.query()
+              .where('resource_id', meta.resource_id)
+              .where('resource_type', job.data.filetype)
+              .first()
+            if (resource) {
+              await recordResourceUpdateFailure(
+                resource,
+                err instanceof Error ? err.message : String(err)
+              )
+            }
+          } catch (e: any) {
+            this.logger.error(
+              `[${queueName}] Failed to record content auto-update backoff: ${e.message}`
+            )
+          }
+        }
       })
 
       worker.on('completed', (job) => {
@@ -107,6 +138,7 @@ export default class QueueWork extends BaseCommand {
     await CheckServiceUpdatesJob.scheduleNightly()
     await AutoUpdateJob.schedule()
     await AppAutoUpdateJob.schedule()
+    await ContentAutoUpdateJob.schedule()
 
     // Safety net: log unhandled rejections instead of crashing the worker process.
     // Individual job errors are already caught by BullMQ; this catches anything that
@@ -139,6 +171,7 @@ export default class QueueWork extends BaseCommand {
     handlers.set(CheckServiceUpdatesJob.key, new CheckServiceUpdatesJob())
     handlers.set(AutoUpdateJob.key, new AutoUpdateJob())
     handlers.set(AppAutoUpdateJob.key, new AppAutoUpdateJob())
+    handlers.set(ContentAutoUpdateJob.key, new ContentAutoUpdateJob())
 
     queues.set(RunDownloadJob.key, RunDownloadJob.queue)
     queues.set(RunExtractPmtilesJob.key, RunExtractPmtilesJob.queue)
@@ -149,6 +182,7 @@ export default class QueueWork extends BaseCommand {
     queues.set(CheckServiceUpdatesJob.key, CheckServiceUpdatesJob.queue)
     queues.set(AutoUpdateJob.key, AutoUpdateJob.queue)
     queues.set(AppAutoUpdateJob.key, AppAutoUpdateJob.queue)
+    queues.set(ContentAutoUpdateJob.key, ContentAutoUpdateJob.queue)
 
     return [handlers, queues]
   }
diff --git a/admin/constants/kv_store.ts b/admin/constants/kv_store.ts
index 3c66261..e40b81e 100644
--- a/admin/constants/kv_store.ts
+++ b/admin/constants/kv_store.ts
@@ -1,3 +1,3 @@
 import { KVStoreKey } from "../types/kv_store.js";
 
-export const SETTINGS_KEYS: KVStoreKey[] = ['chat.suggestionsEnabled', 'chat.lastModel', 'ui.hasVisitedEasySetup', 'ui.theme', 'system.earlyAccess', 'ai.assistantCustomName', 'ai.remoteOllamaUrl', 'ai.ollamaFlashAttention', 'rag.defaultIngestPolicy', 'autoUpdate.enabled', 'autoUpdate.windowStart', 'autoUpdate.windowEnd', 'autoUpdate.cooloffHours', 'appAutoUpdate.enabled'];
\ No newline at end of file
+export const SETTINGS_KEYS: KVStoreKey[] = ['chat.suggestionsEnabled', 'chat.lastModel', 'ui.hasVisitedEasySetup', 'ui.theme', 'system.earlyAccess', 'ai.assistantCustomName', 'ai.remoteOllamaUrl', 'ai.ollamaFlashAttention', 'rag.defaultIngestPolicy', 'autoUpdate.enabled', 'autoUpdate.windowStart', 'autoUpdate.windowEnd', 'autoUpdate.cooloffHours', 'appAutoUpdate.enabled', 'contentAutoUpdate.enabled', 'contentAutoUpdate.windowStart', 'contentAutoUpdate.windowEnd', 'contentAutoUpdate.cooloffHours', 'contentAutoUpdate.maxBytesPerWindow'];
\ No newline at end of file
diff --git a/admin/database/migrations/1776200000001_add_content_auto_update_fields_to_installed_resources.ts b/admin/database/migrations/1776200000001_add_content_auto_update_fields_to_installed_resources.ts
new file mode 100644
index 0000000..b9f5c0d
--- /dev/null
+++ b/admin/database/migrations/1776200000001_add_content_auto_update_fields_to_installed_resources.ts
@@ -0,0 +1,36 @@
+import { BaseSchema } from '@adonisjs/lucid/schema'
+
+export default class extends BaseSchema {
+  protected tableName = 'installed_resources'
+
+  async up() {
+    this.schema.alterTable(this.tableName, (table) => {
+      // The newest catalog version detected for this resource (a YYYY-MM date
+      // stamp), or null when the installed copy is already current. Written by
+      // every freshness check (manual or auto) via reconcileResourceUpdateState.
+      table.string('available_update_version').nullable()
+      // Size of the available update (bytes), captured from the catalog so the
+      // status UI and the per-window data-cap selection don't need to re-query
+      // the mirror on every poll.
+      table.bigInteger('available_update_size_bytes').nullable()
+      // Cool-off anchor: when the currently-available update was first detected.
+      // ZIM/map versions carry no publish date we can trust, so cool-off is
+      // measured from first-seen (mirrors the per-app auto-update fields).
+      table.timestamp('available_update_first_seen_at').nullable()
+      // Per-resource failure backoff so one flapping download self-disables
+      // without affecting the rest of the auto-update run.
+      table.integer('auto_update_consecutive_failures').notNullable().defaultTo(0)
+      table.string('auto_update_disabled_reason', 255).nullable()
+    })
+  }
+
+  async down() {
+    this.schema.alterTable(this.tableName, (table) => {
+      table.dropColumn('available_update_version')
+      table.dropColumn('available_update_size_bytes')
+      table.dropColumn('available_update_first_seen_at')
+      table.dropColumn('auto_update_consecutive_failures')
+      table.dropColumn('auto_update_disabled_reason')
+    })
+  }
+}
diff --git a/admin/inertia/components/updates/ContentAutoUpdateSection.tsx b/admin/inertia/components/updates/ContentAutoUpdateSection.tsx
new file mode 100644
index 0000000..0581c2d
--- /dev/null
+++ b/admin/inertia/components/updates/ContentAutoUpdateSection.tsx
@@ -0,0 +1,249 @@
+import { useEffect, useState } from 'react'
+import StyledButton from '~/components/StyledButton'
+import StyledSectionHeader from '~/components/StyledSectionHeader'
+import Alert from '~/components/Alert'
+import api from '~/lib/api'
+import Input from '~/components/inputs/Input'
+import Switch from '~/components/inputs/Switch'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import { useNotifications } from '~/context/NotificationContext'
+import { useContentAutoUpdateStatus } from '~/hooks/useContentAutoUpdateStatus'
+import { formatBytes } from '~/lib/util'
+
+const COOLOFF_OPTIONS = [
+  { value: 24, label: '24 hours (1 day)' },
+  { value: 48, label: '48 hours (2 days)' },
+  { value: 72, label: '72 hours (3 days)' },
+  { value: 168, label: '7 days' },
+]
+
+const BYTES_PER_GB = 1024 * 1024 * 1024
+
+export default function ContentAutoUpdateSection() {
+  const { addNotification } = useNotifications()
+  const queryClient = useQueryClient()
+  const { data: status, isLoading } = useContentAutoUpdateStatus()
+
+  const [windowStart, setWindowStart] = useState('02:00')
+  const [windowEnd, setWindowEnd] = useState('05:00')
+  const [cooloff, setCooloff] = useState(72)
+  // Data cap is stored in bytes but edited in GB (0 = unlimited).
+  const [capGb, setCapGb] = useState('0')
+
+  // Seed editable fields once the persisted status loads.
+  useEffect(() => {
+    if (status) {
+      setWindowStart(status.windowStart)
+      setWindowEnd(status.windowEnd)
+      setCooloff(status.cooloffHours)
+      setCapGb(
+        status.maxBytesPerWindow > 0
+          ? String(Math.round((status.maxBytesPerWindow / BYTES_PER_GB) * 100) / 100)
+          : '0'
+      )
+    }
+  }, [status?.windowStart, status?.windowEnd, status?.cooloffHours, status?.maxBytesPerWindow])
+
+  const enabled = status?.enabled ?? false
+  const autoDisabled = !!status?.autoDisabledReason
+
+  const toggleMutation = useMutation({
+    mutationFn: (value: boolean) => api.updateSetting('contentAutoUpdate.enabled', value),
+    onSuccess: (_data, value) => {
+      queryClient.invalidateQueries({ queryKey: ['content-auto-update-status'] })
+      addNotification({
+        type: 'success',
+        message: value
+          ? 'Automatic content updates enabled.'
+          : 'Automatic content updates disabled.',
+      })
+    },
+    onError: () => {
+      addNotification({ type: 'error', message: 'Failed to update content auto-update setting.' })
+    },
+  })
+
+  const handleSaveSchedule = async () => {
+    const parsedGb = Number(capGb)
+    if (!Number.isFinite(parsedGb) || parsedGb < 0) {
+      addNotification({ type: 'error', message: 'Data cap must be 0 or a positive number of GB.' })
+      return
+    }
+    const capBytes = Math.round(parsedGb * BYTES_PER_GB)
+    try {
+      await api.updateSetting('contentAutoUpdate.windowStart', windowStart)
+      await api.updateSetting('contentAutoUpdate.windowEnd', windowEnd)
+      await api.updateSetting('contentAutoUpdate.cooloffHours', String(cooloff))
+      await api.updateSetting('contentAutoUpdate.maxBytesPerWindow', String(capBytes))
+      queryClient.invalidateQueries({ queryKey: ['content-auto-update-status'] })
+      addNotification({ type: 'success', message: 'Content update schedule saved.' })
+    } catch {
+      addNotification({ type: 'error', message: 'Failed to save content update schedule.' })
+    }
+  }
+
+  return (
+    <>
+      <StyledSectionHeader title="Automatic Content Updates" className="mt-8" />
+      <div className="bg-surface-primary rounded-lg border shadow-md overflow-hidden mt-6 p-6">
+        {autoDisabled && (
+          <Alert
+            type="warning"
+            title="Automatic Content Updates Disabled"
+            message={
+              status?.autoDisabledReason ||
+              'Automatic content updates were disabled after repeated failures.'
+            }
+            variant="bordered"
+            className="mb-4"
+          />
+        )}
+
+        <Switch
+          checked={enabled}
+          onChange={(value) => toggleMutation.mutate(value)}
+          disabled={toggleMutation.isPending || isLoading}
+          label="Enable Automatic Content Updates"
+          description="Automatically download newer versions of your installed Information Library content (ZIM files) and maps during your chosen window. Content downloads can be very large, so set a per-window data cap to limit how much is pulled at once. We recommend allowing at least 0.5 GB per update window to ensure most updates can be pulled in a timely manner, but you can set a lower cap if you have very limited bandwidth and don't mind some updates being skipped (they will still appear in the UI and can be updated manually). If an update repeatedly fails to download within the window, it will be automatically disabled and require manual intervention to re-enable."
+        />
+
+        <div className="mt-6 grid grid-cols-1 md:grid-cols-2 lg:grid-cols-4 gap-4">
+          <Input
+            name="contentWindowStart"
+            label="Window Start"
+            type="time"
+            value={windowStart}
+            onChange={(e) => setWindowStart(e.target.value)}
+            disabled={!enabled}
+            helpText="Local server time"
+          />
+          <Input
+            name="contentWindowEnd"
+            label="Window End"
+            type="time"
+            value={windowEnd}
+            onChange={(e) => setWindowEnd(e.target.value)}
+            disabled={!enabled}
+            helpText="Local server time"
+          />
+          <div>
+            <label
+              htmlFor="contentCooloff"
+              className="block text-base/6 font-medium text-text-primary"
+            >
+              Cool-off Period
+            </label>
+            <p className="mt-1 text-sm text-text-muted">Delay after a new version appears</p>
+            <select
+              id="contentCooloff"
+              value={cooloff}
+              onChange={(e) => setCooloff(Number(e.target.value))}
+              disabled={!enabled}
+              className="mt-1.5 block w-full rounded-md bg-surface-primary px-3 py-2 text-base text-text-primary border border-border-default focus:outline focus:outline-2 focus:-outline-offset-2 focus:outline-primary sm:text-sm/6 disabled:opacity-50"
+            >
+              {COOLOFF_OPTIONS.map((opt) => (
+                <option key={opt.value} value={opt.value}>
+                  {opt.label}
+                </option>
+              ))}
+            </select>
+          </div>
+          <Input
+            name="contentDataCap"
+            label="Data Cap (GB)"
+            type="number"
+            min="0"
+            step="1"
+            value={capGb}
+            onChange={(e) => setCapGb(e.target.value)}
+            disabled={!enabled}
+            helpText="Per window. 0 = unlimited"
+          />
+        </div>
+
+        <div className="mt-4 flex justify-end">
+          <StyledButton variant="primary" size="sm" onClick={handleSaveSchedule} disabled={!enabled}>
+            Save Schedule
+          </StyledButton>
+        </div>
+
+        {enabled && status && (
+          <div className="mt-6 pt-4 border-t border-desert-stone-light text-sm">
+            <p className="text-desert-stone mb-3">
+              <span className="font-medium">Update window: </span>
+              {status.windowStart}–{status.windowEnd} (
+              {status.withinWindow ? 'currently inside' : 'currently outside'}); cool-off{' '}
+              {status.cooloffHours}h; data cap{' '}
+              {status.maxBytesPerWindow > 0 ? formatBytes(status.maxBytesPerWindow) : 'unlimited'}
+              {status.maxBytesPerWindow > 0 && (
+                <> ({formatBytes(status.windowBytesUsed)} used this window)</>
+              )}
+              .
+              {status.lastResult && (
+                <>
+                  {' '}
+                  <span className="font-medium">Last run: </span>
+                  {status.lastResult}
+                  {status.lastAttemptAt
+                    ? ` (${new Date(status.lastAttemptAt).toLocaleString()})`
+                    : ''}
+                </>
+              )}
+            </p>
+
+            {status.lastError && (
+              <p className="text-desert-red mb-3">
+                <span className="font-medium">Last error: </span>
+                {status.lastError}
+              </p>
+            )}
+
+            {status.resources.length === 0 ? (
+              <p className="text-desert-stone-dark">
+                All installed content is up to date. New versions will appear here when detected.
+              </p>
+            ) : (
+              <ul className="space-y-2">
+                {status.resources.map((resource) => (
+                  <li
+                    key={`${resource.resource_type}:${resource.resource_id}`}
+                    className="flex items-start justify-between gap-4 rounded-md bg-surface-secondary px-3 py-2"
+                  >
+                    <div>
+                      <p className="font-medium text-text-primary">
+                        {resource.resource_id}{' '}
+                        <span className="text-xs uppercase text-desert-stone">
+                          {resource.resource_type}
+                        </span>
+                      </p>
+                      <p className="text-desert-stone">
+                        {resource.current_version}
+                        {resource.available_update_version
+                          ? ` → ${resource.available_update_version}`
+                          : ' (up to date)'}
+                        {resource.size_bytes ? ` · ${formatBytes(resource.size_bytes)}` : ''}
+                      </p>
+                      {resource.auto_disabled_reason && (
+                        <p className="text-desert-red mt-0.5">{resource.auto_disabled_reason}</p>
+                      )}
+                    </div>
+                    <span
+                      className={`shrink-0 text-xs font-medium ${resource.exceeds_cap
+                          ? 'text-desert-red'
+                          : resource.eligible
+                            ? 'text-desert-green'
+                            : 'text-desert-stone'
+                        }`}
+                    >
+                      {resource.exceeds_cap ? 'Skipped — exceeds data cap, update manually' : resource.reason}
+                    </span>
+                  </li>
+                ))}
+              </ul>
+            )}
+          </div>
+        )}
+      </div>
+    </>
+  )
+}
diff --git a/admin/inertia/components/updates/ContentUpdatesSection.tsx b/admin/inertia/components/updates/ContentUpdatesSection.tsx
index d71e1fa..21dbbdb 100644
--- a/admin/inertia/components/updates/ContentUpdatesSection.tsx
+++ b/admin/inertia/components/updates/ContentUpdatesSection.tsx
@@ -99,7 +99,7 @@ export default function ContentUpdatesSection() {
 
   return (
     <div className="mt-8">
-      <StyledSectionHeader title="Content Updates" />
+      <StyledSectionHeader title="Manual Content Updates" />
 
       <div className="bg-surface-primary rounded-lg border shadow-md overflow-hidden p-6">
         <div className="flex items-center justify-between">
diff --git a/admin/inertia/hooks/useContentAutoUpdateStatus.ts b/admin/inertia/hooks/useContentAutoUpdateStatus.ts
new file mode 100644
index 0000000..85974dc
--- /dev/null
+++ b/admin/inertia/hooks/useContentAutoUpdateStatus.ts
@@ -0,0 +1,11 @@
+import { useQuery } from '@tanstack/react-query'
+import api from '~/lib/api'
+import { ContentAutoUpdateStatus } from '../../types/system'
+
+export const useContentAutoUpdateStatus = () => {
+  return useQuery<ContentAutoUpdateStatus | undefined>({
+    queryKey: ['content-auto-update-status'],
+    queryFn: () => api.getContentAutoUpdateStatus(),
+    refetchOnWindowFocus: false,
+  })
+}
diff --git a/admin/inertia/lib/api.ts b/admin/inertia/lib/api.ts
index 73b0d37..f1a8a7e 100644
--- a/admin/inertia/lib/api.ts
+++ b/admin/inertia/lib/api.ts
@@ -2,7 +2,7 @@ import axios, { AxiosError, AxiosInstance } from 'axios'
 import { ListRemoteZimFilesResponse, ListZimFilesResponse } from '../../types/zim'
 import { ServiceSlim } from '../../types/services'
 import { FileEntry } from '../../types/files'
-import { AppAutoUpdateStatus, AutoUpdateStatus, CheckLatestVersionResult, SystemInformationResponse, SystemUpdateStatus } from '../../types/system'
+import { AppAutoUpdateStatus, AutoUpdateStatus, CheckLatestVersionResult, ContentAutoUpdateStatus, SystemInformationResponse, SystemUpdateStatus } from '../../types/system'
 import { DownloadJobWithProgress, WikipediaState } from '../../types/downloads'
 import type { Country, CountryCode, CountryGroup, MapExtractPreflight } from '../../types/maps'
 import { EmbedJobWithProgress, FileWarningsResult, StoredFileInfo } from '../../types/rag'
@@ -556,6 +556,15 @@ class API {
     })()
   }
 
+  async getContentAutoUpdateStatus() {
+    return catchInternal(async () => {
+      const response = await this.client.get<ContentAutoUpdateStatus>(
+        '/system/content/auto-update/status'
+      )
+      return response.data
+    })()
+  }
+
   async setServiceAutoUpdate(serviceName: string, enabled: boolean) {
     return catchInternal(async () => {
       const response = await this.client.post<{ success: boolean; message: string }>(
diff --git a/admin/inertia/pages/settings/update.tsx b/admin/inertia/pages/settings/update.tsx
index 4ffc033..3763fc0 100644
--- a/admin/inertia/pages/settings/update.tsx
+++ b/admin/inertia/pages/settings/update.tsx
@@ -14,6 +14,7 @@ import { useNotifications } from '~/context/NotificationContext'
 import { useSystemSetting } from '~/hooks/useSystemSetting'
 import CoreAutoUpdateSection from '~/components/updates/CoreAutoUpdateSection'
 import AppAutoUpdateSection from '~/components/updates/AppAutoUpdateSection'
+import ContentAutoUpdateSection from '~/components/updates/ContentAutoUpdateSection'
 import ContentUpdatesSection from '~/components/updates/ContentUpdatesSection'
 
 type Props = {
@@ -453,6 +454,7 @@ export default function SystemUpdatePage(props: { system: Props }) {
           </div>
           <CoreAutoUpdateSection />
           <AppAutoUpdateSection />
+          <ContentAutoUpdateSection />
           <ContentUpdatesSection />
           <div className="bg-surface-primary rounded-lg border shadow-md overflow-hidden py-6 mt-12">
             <div className="flex flex-col md:flex-row justify-between items-center p-8 gap-y-8 md:gap-y-0 gap-x-8">
diff --git a/admin/start/routes.ts b/admin/start/routes.ts
index 96b3aee..5553cbc 100644
--- a/admin/start/routes.ts
+++ b/admin/start/routes.ts
@@ -185,6 +185,7 @@ router
     router.post('/services/update', [SystemController, 'updateService'])
     router.post('/services/auto-update', [SystemController, 'setServiceAutoUpdate'])
     router.get('/apps/auto-update/status', [SystemController, 'getAppAutoUpdateStatus'])
+    router.get('/content/auto-update/status', [SystemController, 'getContentAutoUpdateStatus'])
     router.post('/subscribe-release-notes', [SystemController, 'subscribeToReleaseNotes'])
     router.get('/latest-version', [SystemController, 'checkLatestVersion'])
     router.post('/update', [SystemController, 'requestSystemUpdate'])
diff --git a/admin/tests/unit/content_auto_update.spec.ts b/admin/tests/unit/content_auto_update.spec.ts
new file mode 100644
index 0000000..6b9c216
--- /dev/null
+++ b/admin/tests/unit/content_auto_update.spec.ts
@@ -0,0 +1,218 @@
+import * as assert from 'node:assert/strict'
+import { test } from 'node:test'
+import { DateTime } from 'luxon'
+
+import {
+  ContentAutoUpdateService,
+  type ContentCandidate,
+} from '../../app/services/content_auto_update_service.js'
+import { isWithinWindow } from '../../app/utils/update_window.js'
+
+// resourceEligibility + selectUnderCap are pure; the I/O constructor deps are
+// irrelevant for these tests, so null them out.
+const svc = new ContentAutoUpdateService(null as any, null as any, null as any)
+
+const NOW = DateTime.fromISO('2026-06-04T03:00:00Z')
+const daysAgo = (d: number) => NOW.minus({ days: d })
+const hoursAgo = (h: number) => NOW.minus({ hours: h })
+
+function makeResource(overrides: Record<string, any> = {}) {
+  return {
+    resource_id: 'wikipedia_en_all_maxi',
+    resource_type: 'zim',
+    version: '2024-01',
+    available_update_version: null,
+    available_update_size_bytes: null,
+    available_update_first_seen_at: null,
+    auto_update_disabled_reason: null,
+    auto_update_consecutive_failures: 0,
+    installed_at: daysAgo(100),
+    ...overrides,
+  } as any
+}
+
+function makeCandidate(overrides: Partial<ContentCandidate> & { id?: string } = {}): ContentCandidate {
+  const { id, ...rest } = overrides
+  return {
+    resource: makeResource({ resource_id: id ?? 'res' }) as any,
+    version: '2024-06',
+    download_url: `https://download.kiwix.org/zim/${id ?? 'res'}_2024-06.zim`,
+    size_bytes: 1_000,
+    installed_at: daysAgo(100),
+    ...rest,
+  }
+}
+
+// ── Per-resource eligibility ───────────────────────────────────────────────────
+
+test('no available update → not eligible (up to date)', () => {
+  const v = svc.resourceEligibility(makeResource(), 72, NOW)
+  assert.equal(v.eligible, false)
+  assert.match(v.reason, /up to date/i)
+})
+
+test('newer version but still inside cool-off → not eligible', () => {
+  const v = svc.resourceEligibility(
+    makeResource({
+      available_update_version: '2024-06',
+      available_update_first_seen_at: hoursAgo(10),
+    }),
+    72,
+    NOW
+  )
+  assert.equal(v.eligible, false)
+  assert.match(v.reason, /cool-off/i)
+})
+
+test('newer version past cool-off → eligible', () => {
+  const v = svc.resourceEligibility(
+    makeResource({
+      available_update_version: '2024-06',
+      available_update_first_seen_at: daysAgo(5),
+    }),
+    72,
+    NOW
+  )
+  assert.equal(v.eligible, true)
+})
+
+test('null first-seen → not eligible (cool-off pending)', () => {
+  const v = svc.resourceEligibility(
+    makeResource({ available_update_version: '2024-06', available_update_first_seen_at: null }),
+    72,
+    NOW
+  )
+  assert.equal(v.eligible, false)
+  assert.match(v.reason, /cool-off pending/i)
+})
+
+test('self-disabled resource → not eligible regardless of cool-off', () => {
+  const v = svc.resourceEligibility(
+    makeResource({
+      available_update_version: '2024-06',
+      available_update_first_seen_at: daysAgo(30),
+      auto_update_disabled_reason: 'Auto-update disabled after 3 consecutive failures.',
+    }),
+    72,
+    NOW
+  )
+  assert.equal(v.eligible, false)
+})
+
+test('available equal to current (not newer) → not eligible', () => {
+  const v = svc.resourceEligibility(
+    makeResource({
+      available_update_version: '2024-01',
+      available_update_first_seen_at: daysAgo(30),
+    }),
+    72,
+    NOW
+  )
+  assert.equal(v.eligible, false)
+})
+
+test('cool-off of 0 applies immediately', () => {
+  const v = svc.resourceEligibility(
+    makeResource({
+      available_update_version: '2024-06',
+      available_update_first_seen_at: hoursAgo(1),
+    }),
+    0,
+    NOW
+  )
+  assert.equal(v.eligible, true)
+})
+
+// ── Cap-bounded selection ──────────────────────────────────────────────────────
+
+test('under cap selects everything', () => {
+  const candidates = [
+    makeCandidate({ id: 'a', size_bytes: 1_000 }),
+    makeCandidate({ id: 'b', size_bytes: 2_000 }),
+  ]
+  const { selected, skippedOversize, deferred } = svc.selectUnderCap(candidates, 10_000, 0)
+  assert.equal(selected.length, 2)
+  assert.equal(skippedOversize.length, 0)
+  assert.equal(deferred.length, 0)
+})
+
+test('cap 0 means unlimited', () => {
+  const candidates = [makeCandidate({ id: 'a', size_bytes: 9_999_999_999 })]
+  const { selected, skippedOversize } = svc.selectUnderCap(candidates, 0, 0)
+  assert.equal(selected.length, 1)
+  assert.equal(skippedOversize.length, 0)
+})
+
+test('single file larger than the whole cap → skippedOversize, never selected', () => {
+  const candidates = [makeCandidate({ id: 'huge', size_bytes: 50_000 })]
+  const { selected, skippedOversize, deferred } = svc.selectUnderCap(candidates, 20_000, 0)
+  assert.equal(selected.length, 0)
+  assert.equal(skippedOversize.length, 1)
+  assert.equal(deferred.length, 0)
+})
+
+test('fits the cap but not this window’s remaining budget → deferred', () => {
+  const candidates = [makeCandidate({ id: 'mid', size_bytes: 8_000 })]
+  // cap 10k, already used 5k → only 5k remaining; 8k fits the cap but not the budget.
+  const { selected, deferred, skippedOversize } = svc.selectUnderCap(candidates, 10_000, 5_000)
+  assert.equal(selected.length, 0)
+  assert.equal(deferred.length, 1)
+  assert.equal(skippedOversize.length, 0)
+})
+
+test('greedy oldest-first selection packs until budget exhausted', () => {
+  const candidates = [
+    makeCandidate({ id: 'new', size_bytes: 4_000, installed_at: daysAgo(1) }),
+    makeCandidate({ id: 'old', size_bytes: 4_000, installed_at: daysAgo(50) }),
+    makeCandidate({ id: 'mid', size_bytes: 4_000, installed_at: daysAgo(25) }),
+  ]
+  const { selected, deferred } = svc.selectUnderCap(candidates, 10_000, 0)
+  // 10k budget / 4k each → 2 selected (oldest two), 1 deferred.
+  assert.equal(selected.length, 2)
+  assert.equal(deferred.length, 1)
+  assert.deepEqual(
+    selected.map((c) => c.resource.resource_id),
+    ['old', 'mid']
+  )
+})
+
+test('budget already exhausted → everything deferred', () => {
+  const candidates = [makeCandidate({ id: 'a', size_bytes: 1_000 })]
+  const { selected, deferred } = svc.selectUnderCap(candidates, 5_000, 5_000)
+  assert.equal(selected.length, 0)
+  assert.equal(deferred.length, 1)
+})
+
+test('unknown size (0) → deferred, never selected', () => {
+  const candidates = [makeCandidate({ id: 'a', size_bytes: 0 })]
+  const { selected, deferred, skippedOversize } = svc.selectUnderCap(candidates, 10_000, 0)
+  assert.equal(selected.length, 0)
+  assert.equal(deferred.length, 1)
+  assert.equal(skippedOversize.length, 0)
+})
+
+// ── Window boundary math (per-window budget reset) ─────────────────────────────
+
+test('windowStartBoundary: same-day window resolves to today’s start', () => {
+  const now = DateTime.fromISO('2026-06-04T03:30:00')
+  const boundary = svc.windowStartBoundary('02:00', now)
+  assert.equal(boundary.toISO(), DateTime.fromISO('2026-06-04T02:00:00').toISO())
+})
+
+test('windowStartBoundary: before today’s start resolves to yesterday (wrap window)', () => {
+  const now = DateTime.fromISO('2026-06-04T01:00:00')
+  const boundary = svc.windowStartBoundary('22:00', now)
+  assert.equal(boundary.toISO(), DateTime.fromISO('2026-06-03T22:00:00').toISO())
+})
+
+// ── Shared update window ───────────────────────────────────────────────────────
+
+test('window: normal 02:00-05:00 includes 03:00, excludes 06:00', () => {
+  assert.equal(isWithinWindow('02:00', '05:00', DateTime.fromISO('2026-06-04T03:00:00')), true)
+  assert.equal(isWithinWindow('02:00', '05:00', DateTime.fromISO('2026-06-04T06:00:00')), false)
+})
+
+test('window: midnight-wrapping 22:00-02:00 includes 01:00, excludes 12:00', () => {
+  assert.equal(isWithinWindow('22:00', '02:00', DateTime.fromISO('2026-06-04T01:00:00')), true)
+  assert.equal(isWithinWindow('22:00', '02:00', DateTime.fromISO('2026-06-04T12:00:00')), false)
+})
diff --git a/admin/tests/unit/content_auto_update_backoff.spec.ts b/admin/tests/unit/content_auto_update_backoff.spec.ts
new file mode 100644
index 0000000..15fa465
--- /dev/null
+++ b/admin/tests/unit/content_auto_update_backoff.spec.ts
@@ -0,0 +1,83 @@
+import * as assert from 'node:assert/strict'
+import { test } from 'node:test'
+
+import {
+  MAX_CONSECUTIVE_FAILURES,
+  recordResourceUpdateFailure,
+  recordResourceUpdateSuccess,
+} from '../../app/utils/content_auto_update_backoff.js'
+
+// The helpers only read/write two columns and call save(); a plain object with a
+// save spy stands in for the Lucid model so the backoff logic is testable without
+// a database.
+function makeResource(overrides: Record<string, any> = {}) {
+  let saved = 0
+  return {
+    resource_id: 'wikipedia_en_all_maxi',
+    auto_update_consecutive_failures: 0,
+    auto_update_disabled_reason: null as string | null,
+    async save() {
+      saved++
+    },
+    get saveCount() {
+      return saved
+    },
+    ...overrides,
+  } as any
+}
+
+// ── Failure backoff ─────────────────────────────────────────────────────────────
+
+test('failure increments the consecutive counter', async () => {
+  const r = makeResource()
+  await recordResourceUpdateFailure(r, 'network error')
+  assert.equal(r.auto_update_consecutive_failures, 1)
+  assert.equal(r.auto_update_disabled_reason, null)
+})
+
+test('failures below the threshold do not self-disable', async () => {
+  const r = makeResource({ auto_update_consecutive_failures: 1 })
+  await recordResourceUpdateFailure(r, 'network error')
+  assert.equal(r.auto_update_consecutive_failures, 2)
+  assert.equal(r.auto_update_disabled_reason, null)
+})
+
+test('reaching the threshold self-disables with the last error in the reason', async () => {
+  const r = makeResource({ auto_update_consecutive_failures: MAX_CONSECUTIVE_FAILURES - 1 })
+  await recordResourceUpdateFailure(r, 'disk full')
+  assert.equal(r.auto_update_consecutive_failures, MAX_CONSECUTIVE_FAILURES)
+  assert.match(r.auto_update_disabled_reason, /disabled after 3 consecutive failures/i)
+  assert.match(r.auto_update_disabled_reason, /disk full/)
+})
+
+test('failure always persists', async () => {
+  const r = makeResource()
+  await recordResourceUpdateFailure(r, 'boom')
+  assert.equal(r.saveCount, 1)
+})
+
+// ── Success reset ───────────────────────────────────────────────────────────────
+
+test('success clears the counter and the disabled reason', async () => {
+  const r = makeResource({
+    auto_update_consecutive_failures: 3,
+    auto_update_disabled_reason: 'Auto-update disabled after 3 consecutive failures.',
+  })
+  await recordResourceUpdateSuccess(r)
+  assert.equal(r.auto_update_consecutive_failures, 0)
+  assert.equal(r.auto_update_disabled_reason, null)
+  assert.equal(r.saveCount, 1)
+})
+
+test('success is a no-op (no save) when already clean', async () => {
+  const r = makeResource({ auto_update_consecutive_failures: 0, auto_update_disabled_reason: null })
+  await recordResourceUpdateSuccess(r)
+  assert.equal(r.saveCount, 0)
+})
+
+test('success still resets when a stray reason lingers at zero failures', async () => {
+  const r = makeResource({ auto_update_consecutive_failures: 0, auto_update_disabled_reason: 'stale' })
+  await recordResourceUpdateSuccess(r)
+  assert.equal(r.auto_update_disabled_reason, null)
+  assert.equal(r.saveCount, 1)
+})
diff --git a/admin/tests/unit/content_reindex_decision.spec.ts b/admin/tests/unit/content_reindex_decision.spec.ts
new file mode 100644
index 0000000..805e19d
--- /dev/null
+++ b/admin/tests/unit/content_reindex_decision.spec.ts
@@ -0,0 +1,64 @@
+import * as assert from 'node:assert/strict'
+import { test } from 'node:test'
+
+import {
+  decideContentReindex,
+  type ContentReindexInput,
+} from '../../app/utils/content_reindex_decision.js'
+
+// Default to the fully-actionable case; each test overrides one axis so the
+// short-circuit ordering is exercised explicitly.
+function input(overrides: Partial<ContentReindexInput> = {}): ContentReindexInput {
+  return {
+    isReplacement: true,
+    qdrantInstalled: true,
+    oldFileWasIndexed: true,
+    qdrantRunning: true,
+    ...overrides,
+  }
+}
+
+test('fresh install / same-path re-download → not_a_replacement (defers to normal policy)', () => {
+  assert.equal(decideContentReindex(input({ isReplacement: false })), 'not_a_replacement')
+})
+
+test('not_a_replacement short-circuits before any Qdrant consideration', () => {
+  // Even with everything else "off", a non-replacement is the controlling answer.
+  assert.equal(
+    decideContentReindex(
+      input({ isReplacement: false, qdrantInstalled: false, oldFileWasIndexed: false, qdrantRunning: false })
+    ),
+    'not_a_replacement'
+  )
+})
+
+test('replacement but Qdrant not installed → qdrant_not_installed (step 2)', () => {
+  assert.equal(decideContentReindex(input({ qdrantInstalled: false })), 'qdrant_not_installed')
+})
+
+test('not-installed short-circuits before the old-indexed lookup', () => {
+  // oldFileWasIndexed should not matter once Qdrant is absent.
+  assert.equal(
+    decideContentReindex(input({ qdrantInstalled: false, oldFileWasIndexed: true })),
+    'qdrant_not_installed'
+  )
+})
+
+test('replacement, installed, but old file was never indexed → old_not_indexed (step 4)', () => {
+  assert.equal(decideContentReindex(input({ oldFileWasIndexed: false })), 'old_not_indexed')
+})
+
+test('old not indexed wins even if Qdrant is running (respects prior un-indexed choice)', () => {
+  assert.equal(
+    decideContentReindex(input({ oldFileWasIndexed: false, qdrantRunning: true })),
+    'old_not_indexed'
+  )
+})
+
+test('old indexed but Qdrant currently down → qdrant_not_running (step 5, defer entirely)', () => {
+  assert.equal(decideContentReindex(input({ qdrantRunning: false })), 'qdrant_not_running')
+})
+
+test('replacement + installed + old indexed + running → reindex (step 3)', () => {
+  assert.equal(decideContentReindex(input()), 'reindex')
+})
diff --git a/admin/types/downloads.ts b/admin/types/downloads.ts
index 71fca26..0bda197 100644
--- a/admin/types/downloads.ts
+++ b/admin/types/downloads.ts
@@ -41,6 +41,13 @@ export type RunDownloadJobParams = Omit<
     resource_id: string
     version: string
     collection_ref: string | null
+    /**
+     * True only when this download was initiated by the content auto-updater.
+     * Gates the per-resource auto-update backoff (success reset in
+     * RunDownloadJob.onComplete, terminal-failure increment in the worker
+     * `failed` handler) so manual downloads never touch the counter.
+     */
+    auto?: boolean
   }
 }
 
diff --git a/admin/types/kv_store.ts b/admin/types/kv_store.ts
index 245bd8e..5c32dbe 100644
--- a/admin/types/kv_store.ts
+++ b/admin/types/kv_store.ts
@@ -19,6 +19,18 @@ export const KV_STORE_SCHEMA = {
   'appAutoUpdate.enabled':          'boolean',
   'appAutoUpdate.lastAttemptAt':    'string',
   'appAutoUpdate.lastResult':       'string',
+  'contentAutoUpdate.enabled':           'boolean',
+  'contentAutoUpdate.windowStart':       'string',
+  'contentAutoUpdate.windowEnd':         'string',
+  'contentAutoUpdate.cooloffHours':      'string',
+  'contentAutoUpdate.maxBytesPerWindow': 'string',
+  'contentAutoUpdate.lastAttemptAt':     'string',
+  'contentAutoUpdate.lastResult':        'string',
+  'contentAutoUpdate.lastError':         'string',
+  'contentAutoUpdate.consecutiveFailures': 'string',
+  'contentAutoUpdate.autoDisabledReason':  'string',
+  'contentAutoUpdate.windowBytesUsed':   'string',
+  'contentAutoUpdate.windowResetAt':     'string',
   'ui.hasVisitedEasySetup':     'boolean',
   'ui.theme':                   'string',
   'ai.assistantCustomName':     'string',
diff --git a/admin/types/system.ts b/admin/types/system.ts
index cc27eba..fb7dfb8 100644
--- a/admin/types/system.ts
+++ b/admin/types/system.ts
@@ -131,4 +131,33 @@ export type AppAutoUpdateStatus = {
   lastAttemptAt: string | null
   lastResult: string | null
   apps: AppAutoUpdateAppStatus[]
+}
+
+export type ContentAutoUpdateResourceStatus = {
+  resource_id: string
+  resource_type: 'zim' | 'map'
+  current_version: string
+  available_update_version: string | null
+  size_bytes: number | null
+  eligible: boolean
+  reason: string
+  cooloff_remaining_hours: number | null
+  exceeds_cap: boolean
+  consecutive_failures: number
+  auto_disabled_reason: string | null
+}
+
+export type ContentAutoUpdateStatus = {
+  enabled: boolean
+  windowStart: string
+  windowEnd: string
+  cooloffHours: number
+  maxBytesPerWindow: number
+  withinWindow: boolean
+  windowBytesUsed: number
+  lastAttemptAt: string | null
+  lastResult: string | null
+  lastError: string | null
+  autoDisabledReason: string | null
+  resources: ContentAutoUpdateResourceStatus[]
 }
\ No newline at end of file

From b6a08058e8ffb4611d517c6153846cdf10c8ea57 Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Tue, 9 Jun 2026 17:50:58 +0000
Subject: [PATCH 50/83] chore(deps): bump react and react-dom

---
 admin/package-lock.json | 2694 +++++++++++++++++++++++----------------
 admin/package.json      |    4 +-
 2 files changed, 1566 insertions(+), 1132 deletions(-)

diff --git a/admin/package-lock.json b/admin/package-lock.json
index 1aabbee..434558b 100644
--- a/admin/package-lock.json
+++ b/admin/package-lock.json
@@ -59,9 +59,9 @@
         "pino-pretty": "13.1.3",
         "pmtiles": "4.4.0",
         "postcss": "8.5.15",
-        "react": "19.2.4",
+        "react": "19.2.7",
         "react-adonis-transmit": "1.0.1",
-        "react-dom": "19.2.4",
+        "react-dom": "19.2.7",
         "react-map-gl": "8.1.0",
         "react-markdown": "10.1.0",
         "reflect-metadata": "0.2.2",
@@ -101,9 +101,9 @@
       }
     },
     "node_modules/@adobe/css-tools": {
-      "version": "4.4.4",
-      "resolved": "https://registry.npmjs.org/@adobe/css-tools/-/css-tools-4.4.4.tgz",
-      "integrity": "sha512-Elp+iwUx5rN5+Y8xLt5/GRoG20WGoDCQ/1Fb+1LiGtvwbDavuSk0jhD/eZdckHAuzcDzccnkv+rEjyWfRx18gg==",
+      "version": "4.5.0",
+      "resolved": "https://registry.npmjs.org/@adobe/css-tools/-/css-tools-4.5.0.tgz",
+      "integrity": "sha512-6OzddxPio9UiWTCemp4N8cYLV2ZN1ncRnV1cVGtve7dhPOtRkleRyx32GQCYSwDYgaHU3USMm84tNsvKzRCa1Q==",
       "dev": true,
       "license": "MIT"
     },
@@ -220,9 +220,9 @@
       }
     },
     "node_modules/@adonisjs/bodyparser": {
-      "version": "10.1.3",
-      "resolved": "https://registry.npmjs.org/@adonisjs/bodyparser/-/bodyparser-10.1.3.tgz",
-      "integrity": "sha512-FtxUbVYDHrW94z4+w1dOTq31TLkD3wAoyVVCQLY9irNOBrjSH9ucKP4tq8tq2jeQffoRh3R2j7jp2VW8psSQcA==",
+      "version": "10.1.5",
+      "resolved": "https://registry.npmjs.org/@adonisjs/bodyparser/-/bodyparser-10.1.5.tgz",
+      "integrity": "sha512-eioO/rdmjzujIe6ZlSOdnEWh/GFyqQC6l+TzowYA5ukOhMw2LGd+ruZt+Frm/zHtwdzRraciVFSx7zGYRh4XkA==",
       "license": "MIT",
       "dependencies": {
         "@paralleldrive/cuid2": "^2.2.2",
@@ -342,9 +342,9 @@
       "license": "MIT"
     },
     "node_modules/@adonisjs/core/node_modules/tinyexec": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.0.2.tgz",
-      "integrity": "sha512-W/KYk+NFhkmsYpuHq5JykngiOCnxeVL8v8dFnqxSD8qEEdRfXk1SDM6JzNqcERbcGYj9tMrDQBYV9cjgnunFIg==",
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.2.4.tgz",
+      "integrity": "sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg==",
       "license": "MIT",
       "engines": {
         "node": ">=18"
@@ -409,13 +409,13 @@
       }
     },
     "node_modules/@adonisjs/eslint-plugin": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/@adonisjs/eslint-plugin/-/eslint-plugin-2.2.1.tgz",
-      "integrity": "sha512-FlMAjhWYOHpWtzQY8+VLtXHyHJ6ts15PCZ2xgSH7OcKsBiwQSEUPXH6nGiY0hlG09Li/Jqco4fEhmrf7KEi4jQ==",
+      "version": "2.2.2",
+      "resolved": "https://registry.npmjs.org/@adonisjs/eslint-plugin/-/eslint-plugin-2.2.2.tgz",
+      "integrity": "sha512-OAIrljEpbhyikG+BQ8r7195GoRDPmMEBUfSfr6ajM6IPtQMPAb/oKzeXF8XTy2CxupUoGhMd2n8+sx/pgL1m4g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/utils": "^8.51.0",
+        "@typescript-eslint/utils": "^8.56.0",
         "micromatch": "^4.0.8",
         "read-package-up": "^12.0.0"
       },
@@ -423,7 +423,7 @@
         "node": ">=20.6.0"
       },
       "peerDependencies": {
-        "eslint": "^9.9.1"
+        "eslint": "^9.9.1 || ^10.0.0"
       }
     },
     "node_modules/@adonisjs/events": {
@@ -470,9 +470,9 @@
       }
     },
     "node_modules/@adonisjs/fold/node_modules/@poppinss/utils": {
-      "version": "7.0.0-next.6",
-      "resolved": "https://registry.npmjs.org/@poppinss/utils/-/utils-7.0.0-next.6.tgz",
-      "integrity": "sha512-1OQDbCKmFROvWpmzvkQV/mCzBXSwhED8SJfJ0HiYKiLNEqYM8Kpa4EK0AfmXGQc+DdIj6eqib/vT8i5tJ2fatw==",
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/@poppinss/utils/-/utils-7.0.1.tgz",
+      "integrity": "sha512-mveSvLI2YPC114mK5HCuSYfUtjpClf1wHG1VCqZJCp4U2ypPhIt62Iku5urh0kPAFvnvCVHx2bXBSH14qMTOlQ==",
       "license": "MIT",
       "dependencies": {
         "@poppinss/exception": "^1.2.3",
@@ -862,12 +862,12 @@
       }
     },
     "node_modules/@babel/code-frame": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
-      "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.7.tgz",
+      "integrity": "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==",
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-validator-identifier": "^7.28.5",
+        "@babel/helper-validator-identifier": "^7.29.7",
         "js-tokens": "^4.0.0",
         "picocolors": "^1.1.1"
       },
@@ -876,29 +876,29 @@
       }
     },
     "node_modules/@babel/compat-data": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.0.tgz",
-      "integrity": "sha512-T1NCJqT/j9+cn8fvkt7jtwbLBfLC/1y1c7NtCeXFRgzGTsafi68MRv8yzkYSapBnFA6L3U2VSc02ciDzoAJhJg==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.7.tgz",
+      "integrity": "sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/core": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.0.tgz",
-      "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.7.tgz",
+      "integrity": "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==",
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-compilation-targets": "^7.28.6",
-        "@babel/helper-module-transforms": "^7.28.6",
-        "@babel/helpers": "^7.28.6",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/traverse": "^7.29.0",
-        "@babel/types": "^7.29.0",
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.7",
+        "@babel/helper-compilation-targets": "^7.29.7",
+        "@babel/helper-module-transforms": "^7.29.7",
+        "@babel/helpers": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/template": "^7.29.7",
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7",
         "@jridgewell/remapping": "^2.3.5",
         "convert-source-map": "^2.0.0",
         "debug": "^4.1.0",
@@ -924,13 +924,13 @@
       }
     },
     "node_modules/@babel/generator": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.0.tgz",
-      "integrity": "sha512-vSH118/wwM/pLR38g/Sgk05sNtro6TlTJKuiMXDaZqPUfjTFcudpCOt00IhOfj+1BFAX+UFAlzCU+6WXr3GLFQ==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.7.tgz",
+      "integrity": "sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ==",
       "license": "MIT",
       "dependencies": {
-        "@babel/parser": "^7.29.0",
-        "@babel/types": "^7.29.0",
+        "@babel/parser": "^7.29.7",
+        "@babel/types": "^7.29.7",
         "@jridgewell/gen-mapping": "^0.3.12",
         "@jridgewell/trace-mapping": "^0.3.28",
         "jsesc": "^3.0.2"
@@ -940,13 +940,13 @@
       }
     },
     "node_modules/@babel/helper-compilation-targets": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.28.6.tgz",
-      "integrity": "sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.29.7.tgz",
+      "integrity": "sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==",
       "license": "MIT",
       "dependencies": {
-        "@babel/compat-data": "^7.28.6",
-        "@babel/helper-validator-option": "^7.27.1",
+        "@babel/compat-data": "^7.29.7",
+        "@babel/helper-validator-option": "^7.29.7",
         "browserslist": "^4.24.0",
         "lru-cache": "^5.1.1",
         "semver": "^6.3.1"
@@ -965,36 +965,36 @@
       }
     },
     "node_modules/@babel/helper-globals": {
-      "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.28.0.tgz",
-      "integrity": "sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.29.7.tgz",
+      "integrity": "sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/helper-module-imports": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.28.6.tgz",
-      "integrity": "sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.29.7.tgz",
+      "integrity": "sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==",
       "license": "MIT",
       "dependencies": {
-        "@babel/traverse": "^7.28.6",
-        "@babel/types": "^7.28.6"
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/helper-module-transforms": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.28.6.tgz",
-      "integrity": "sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.29.7.tgz",
+      "integrity": "sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==",
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-module-imports": "^7.28.6",
-        "@babel/helper-validator-identifier": "^7.28.5",
-        "@babel/traverse": "^7.28.6"
+        "@babel/helper-module-imports": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7",
+        "@babel/traverse": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -1004,61 +1004,61 @@
       }
     },
     "node_modules/@babel/helper-plugin-utils": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.28.6.tgz",
-      "integrity": "sha512-S9gzZ/bz83GRysI7gAD4wPT/AI3uCnY+9xn+Mx/KPs2JwHJIz1W8PZkg2cqyt3RNOBM8ejcXhV6y8Og7ly/Dug==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.29.7.tgz",
+      "integrity": "sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw==",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/helper-string-parser": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.27.1.tgz",
-      "integrity": "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz",
+      "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/helper-validator-identifier": {
-      "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.28.5.tgz",
-      "integrity": "sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz",
+      "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/helper-validator-option": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.27.1.tgz",
-      "integrity": "sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.29.7.tgz",
+      "integrity": "sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/helpers": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.28.6.tgz",
-      "integrity": "sha512-xOBvwq86HHdB7WUDTfKfT/Vuxh7gElQ+Sfti2Cy6yIWNW05P8iUslOVcZ4/sKbE+/jQaukQAdz/gf3724kYdqw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.7.tgz",
+      "integrity": "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==",
       "license": "MIT",
       "dependencies": {
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.28.6"
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/parser": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.0.tgz",
-      "integrity": "sha512-IyDgFV5GeDUVX4YdF/3CPULtVGSXXMLh1xVIgdCgxApktqnQV0r7/8Nqthg+8YLGaAtdyIlo2qIdZrbCv4+7ww==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.7.tgz",
+      "integrity": "sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==",
       "license": "MIT",
       "dependencies": {
-        "@babel/types": "^7.29.0"
+        "@babel/types": "^7.29.7"
       },
       "bin": {
         "parser": "bin/babel-parser.js"
@@ -1068,12 +1068,12 @@
       }
     },
     "node_modules/@babel/plugin-transform-react-jsx-self": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-jsx-self/-/plugin-transform-react-jsx-self-7.27.1.tgz",
-      "integrity": "sha512-6UzkCs+ejGdZ5mFFC/OCUrv028ab2fp1znZmCZjAOBKiBK2jXD1O+BPSfX8X2qjJ75fZBMSnQn3Rq2mrBJK2mw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-jsx-self/-/plugin-transform-react-jsx-self-7.29.7.tgz",
+      "integrity": "sha512-TL0hMc9xzy86VD31nUiwzd5otRAcyEPcsegCxolO0PvcXuH1v0kECe/UIznYFihpkvU5wg/jk4v0TTEFfm53fw==",
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-plugin-utils": "^7.27.1"
+        "@babel/helper-plugin-utils": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -1083,12 +1083,12 @@
       }
     },
     "node_modules/@babel/plugin-transform-react-jsx-source": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-jsx-source/-/plugin-transform-react-jsx-source-7.27.1.tgz",
-      "integrity": "sha512-zbwoTsBruTeKB9hSq73ha66iFeJHuaFkUbwvqElnygoNbj/jHRsSeokowZFN3CZ64IvEqcmmkVe89OPXc7ldAw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-jsx-source/-/plugin-transform-react-jsx-source-7.29.7.tgz",
+      "integrity": "sha512-06IyK09H3wi4cGbhDBwp5gUGo0IKtnYa8tyTiephirPCK6fbobVGiXMMI5zLQ4aKEYP3wZ3ArU44o+8KMrSG/Q==",
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-plugin-utils": "^7.27.1"
+        "@babel/helper-plugin-utils": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -1098,31 +1098,31 @@
       }
     },
     "node_modules/@babel/template": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz",
-      "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.29.7.tgz",
+      "integrity": "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==",
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.28.6",
-        "@babel/parser": "^7.28.6",
-        "@babel/types": "^7.28.6"
+        "@babel/code-frame": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/traverse": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.0.tgz",
-      "integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.7.tgz",
+      "integrity": "sha512-EhlfNQtZ+NK22w5BM61ciuiq1m58ed33Wr1Xan//ZRTy6hgjnwyCffRYwzsGXdASJSUJ1guZILsErh1eQcl+zw==",
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-globals": "^7.28.0",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0",
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.7",
+        "@babel/helper-globals": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.7",
         "debug": "^4.3.1"
       },
       "engines": {
@@ -1130,13 +1130,13 @@
       }
     },
     "node_modules/@babel/types": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
-      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.7.tgz",
+      "integrity": "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==",
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-string-parser": "^7.27.1",
-        "@babel/helper-validator-identifier": "^7.28.5"
+        "@babel/helper-string-parser": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -1149,9 +1149,9 @@
       "license": "Apache-2.0"
     },
     "node_modules/@borewit/text-codec": {
-      "version": "0.2.1",
-      "resolved": "https://registry.npmjs.org/@borewit/text-codec/-/text-codec-0.2.1.tgz",
-      "integrity": "sha512-k7vvKPbf7J2fZ5klGRD9AeKfUvojuZIQ3BT5u7Jfv+puwXkUBUT5PVyMDfJZpy30CBDXGMgw7fguK/lpOMBvgw==",
+      "version": "0.2.2",
+      "resolved": "https://registry.npmjs.org/@borewit/text-codec/-/text-codec-0.2.2.tgz",
+      "integrity": "sha512-DDaRehssg1aNrH4+2hnj1B7vnUGEjU6OIlyRdkMd0aUdIUvKXrJfXsy8LVtXAy7DRvYVluWbMspsRhz2lcW0mQ==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -1196,46 +1196,60 @@
       }
     },
     "node_modules/@chevrotain/cst-dts-gen": {
-      "version": "11.1.1",
-      "resolved": "https://registry.npmjs.org/@chevrotain/cst-dts-gen/-/cst-dts-gen-11.1.1.tgz",
-      "integrity": "sha512-fRHyv6/f542qQqiRGalrfJl/evD39mAvbJLCekPazhiextEatq1Jx1K/i9gSd5NNO0ds03ek0Cbo/4uVKmOBcw==",
+      "version": "11.2.0",
+      "resolved": "https://registry.npmjs.org/@chevrotain/cst-dts-gen/-/cst-dts-gen-11.2.0.tgz",
+      "integrity": "sha512-ssJFvn/UXhQQeICw3SR/fZPmYVj+JM2mP+Lx7bZ51cOeHaMWOKp3AUMuyM3QR82aFFXTfcAp67P5GpPjGmbZWQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@chevrotain/gast": "11.1.1",
-        "@chevrotain/types": "11.1.1",
+        "@chevrotain/gast": "11.2.0",
+        "@chevrotain/types": "11.2.0",
         "lodash-es": "4.17.23"
       }
     },
+    "node_modules/@chevrotain/cst-dts-gen/node_modules/lodash-es": {
+      "version": "4.17.23",
+      "resolved": "https://registry.npmjs.org/lodash-es/-/lodash-es-4.17.23.tgz",
+      "integrity": "sha512-kVI48u3PZr38HdYz98UmfPnXl2DXrpdctLrFLCd3kOx1xUkOmpFPx7gCWWM5MPkL/fD8zb+Ph0QzjGFs4+hHWg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@chevrotain/gast": {
-      "version": "11.1.1",
-      "resolved": "https://registry.npmjs.org/@chevrotain/gast/-/gast-11.1.1.tgz",
-      "integrity": "sha512-Ko/5vPEYy1vn5CbCjjvnSO4U7GgxyGm+dfUZZJIWTlQFkXkyym0jFYrWEU10hyCjrA7rQtiHtBr0EaZqvHFZvg==",
+      "version": "11.2.0",
+      "resolved": "https://registry.npmjs.org/@chevrotain/gast/-/gast-11.2.0.tgz",
+      "integrity": "sha512-c+KoD6eSI1xjAZZoNUW+V0l13UEn+a4ShmUrjIKs1BeEWCji0Kwhmqn5FSx1K4BhWL7IQKlV7wLR4r8lLArORQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@chevrotain/types": "11.1.1",
+        "@chevrotain/types": "11.2.0",
         "lodash-es": "4.17.23"
       }
     },
+    "node_modules/@chevrotain/gast/node_modules/lodash-es": {
+      "version": "4.17.23",
+      "resolved": "https://registry.npmjs.org/lodash-es/-/lodash-es-4.17.23.tgz",
+      "integrity": "sha512-kVI48u3PZr38HdYz98UmfPnXl2DXrpdctLrFLCd3kOx1xUkOmpFPx7gCWWM5MPkL/fD8zb+Ph0QzjGFs4+hHWg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@chevrotain/regexp-to-ast": {
-      "version": "11.1.1",
-      "resolved": "https://registry.npmjs.org/@chevrotain/regexp-to-ast/-/regexp-to-ast-11.1.1.tgz",
-      "integrity": "sha512-ctRw1OKSXkOrR8VTvOxrQ5USEc4sNrfwXHa1NuTcR7wre4YbjPcKw+82C2uylg/TEwFRgwLmbhlln4qkmDyteg==",
+      "version": "11.2.0",
+      "resolved": "https://registry.npmjs.org/@chevrotain/regexp-to-ast/-/regexp-to-ast-11.2.0.tgz",
+      "integrity": "sha512-lG73pBFqbXODTbXhdZwv0oyUaI+3Irm+uOv5/W79lI3g5hasYaJnVJOm3H2NkhA0Ef4XLBU4Scr7TJDJwgFkAw==",
       "dev": true,
       "license": "Apache-2.0"
     },
     "node_modules/@chevrotain/types": {
-      "version": "11.1.1",
-      "resolved": "https://registry.npmjs.org/@chevrotain/types/-/types-11.1.1.tgz",
-      "integrity": "sha512-wb2ToxG8LkgPYnKe9FH8oGn3TMCBdnwiuNC5l5y+CtlaVRbCytU0kbVsk6CGrqTL4ZN4ksJa0TXOYbxpbthtqw==",
+      "version": "11.2.0",
+      "resolved": "https://registry.npmjs.org/@chevrotain/types/-/types-11.2.0.tgz",
+      "integrity": "sha512-vBMSj/lz/LqolbGQEHB0tlpW5BnljHVtp+kzjQfQU+5BtGMTuZCPVgaAjtKvQYXnHb/8i/02Kii00y0tsuwfsw==",
       "dev": true,
       "license": "Apache-2.0"
     },
     "node_modules/@chevrotain/utils": {
-      "version": "11.1.1",
-      "resolved": "https://registry.npmjs.org/@chevrotain/utils/-/utils-11.1.1.tgz",
-      "integrity": "sha512-71eTYMzYXYSFPrbg/ZwftSaSDld7UYlS8OQa3lNnn9jzNtpFbaReRRyghzqS7rI3CDaorqpPJJcXGHK+FE1TVQ==",
+      "version": "11.2.0",
+      "resolved": "https://registry.npmjs.org/@chevrotain/utils/-/utils-11.2.0.tgz",
+      "integrity": "sha512-+7whECg4yNWHottjvr2To2BRxL4XJVjIyyv5J4+bJ0iMOVU8j/8n1qPDLZS/90W/BObDR8VNL46lFbzY/Hosmw==",
       "dev": true,
       "license": "Apache-2.0"
     },
@@ -1287,9 +1301,9 @@
       }
     },
     "node_modules/@emnapi/runtime": {
-      "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.8.1.tgz",
-      "integrity": "sha512-mehfKSMWjjNol8659Z8KxEMrdSJDDot5SXMq00dM8BN4o+CLNXQ0xH2V7EchNHV4RmbZLmmPdEaXZc5H2FXmDg==",
+      "version": "1.11.0",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.0.tgz",
+      "integrity": "sha512-55coeOFKHv1ywEcUXJtWU5f+Jr/W5tZDvZig8DLKSwUN1JpROQ4rk/SNOQiFWmaR/VKF4zuFyW1B8JduOSv6Pg==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -1755,24 +1769,31 @@
       }
     },
     "node_modules/@eslint/config-array": {
-      "version": "0.21.1",
-      "resolved": "https://registry.npmjs.org/@eslint/config-array/-/config-array-0.21.1.tgz",
-      "integrity": "sha512-aw1gNayWpdI/jSYVgzN5pL0cfzU02GT3NBpeT/DXbx1/1x7ZKxFPd9bwrzygx/qiwIQiJ1sw/zD8qY/kRvlGHA==",
+      "version": "0.21.2",
+      "resolved": "https://registry.npmjs.org/@eslint/config-array/-/config-array-0.21.2.tgz",
+      "integrity": "sha512-nJl2KGTlrf9GjLimgIru+V/mzgSK0ABCDQRvxw5BjURL7WfH5uoWmizbH7QB6MmnMBd8cIC9uceWnezL1VZWWw==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
         "@eslint/object-schema": "^2.1.7",
         "debug": "^4.3.1",
-        "minimatch": "^3.1.2"
+        "minimatch": "^3.1.5"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       }
     },
+    "node_modules/@eslint/config-array/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@eslint/config-array/node_modules/brace-expansion": {
-      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+      "version": "1.1.15",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz",
+      "integrity": "sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1820,20 +1841,20 @@
       }
     },
     "node_modules/@eslint/eslintrc": {
-      "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.3.tgz",
-      "integrity": "sha512-Kr+LPIUVKz2qkx1HAMH8q1q6azbqBAsXJUxBl/ODDuVPX45Z9DfwB8tPjTi6nNZ8BuM3nbJxC5zCAg5elnBUTQ==",
+      "version": "3.3.5",
+      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.5.tgz",
+      "integrity": "sha512-4IlJx0X0qftVsN5E+/vGujTRIFtwuLbNsVUe7TO6zYPDR1O6nFwvwhIKEKSrl6dZchmYBITazxKoUYOjdtjlRg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "ajv": "^6.12.4",
+        "ajv": "^6.14.0",
         "debug": "^4.3.2",
         "espree": "^10.0.1",
         "globals": "^14.0.0",
         "ignore": "^5.2.0",
         "import-fresh": "^3.2.1",
         "js-yaml": "^4.1.1",
-        "minimatch": "^3.1.2",
+        "minimatch": "^3.1.5",
         "strip-json-comments": "^3.1.1"
       },
       "engines": {
@@ -1843,10 +1864,17 @@
         "url": "https://opencollective.com/eslint"
       }
     },
+    "node_modules/@eslint/eslintrc/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@eslint/eslintrc/node_modules/brace-expansion": {
-      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+      "version": "1.1.15",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz",
+      "integrity": "sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1921,22 +1949,22 @@
       }
     },
     "node_modules/@floating-ui/core": {
-      "version": "1.7.4",
-      "resolved": "https://registry.npmjs.org/@floating-ui/core/-/core-1.7.4.tgz",
-      "integrity": "sha512-C3HlIdsBxszvm5McXlB8PeOEWfBhcGBTZGkGlWc2U0KFY5IwG5OQEuQ8rq52DZmcHDlPLd+YFBK+cZcytwIFWg==",
+      "version": "1.7.5",
+      "resolved": "https://registry.npmjs.org/@floating-ui/core/-/core-1.7.5.tgz",
+      "integrity": "sha512-1Ih4WTWyw0+lKyFMcBHGbb5U5FtuHJuujoyyr5zTaWS5EYMeT6Jb2AuDeftsCsEuchO+mM2ij5+q9crhydzLhQ==",
       "license": "MIT",
       "dependencies": {
-        "@floating-ui/utils": "^0.2.10"
+        "@floating-ui/utils": "^0.2.11"
       }
     },
     "node_modules/@floating-ui/dom": {
-      "version": "1.7.5",
-      "resolved": "https://registry.npmjs.org/@floating-ui/dom/-/dom-1.7.5.tgz",
-      "integrity": "sha512-N0bD2kIPInNHUHehXhMke1rBGs1dwqvC9O9KYMyyjK7iXt7GAhnro7UlcuYcGdS/yYOlq0MAVgrow8IbWJwyqg==",
+      "version": "1.7.6",
+      "resolved": "https://registry.npmjs.org/@floating-ui/dom/-/dom-1.7.6.tgz",
+      "integrity": "sha512-9gZSAI5XM36880PPMm//9dfiEngYoC6Am2izES1FF406YFsjvyBMmeJ2g4SAju3xWwtuynNRFL2s9hgxpLI5SQ==",
       "license": "MIT",
       "dependencies": {
-        "@floating-ui/core": "^1.7.4",
-        "@floating-ui/utils": "^0.2.10"
+        "@floating-ui/core": "^1.7.5",
+        "@floating-ui/utils": "^0.2.11"
       }
     },
     "node_modules/@floating-ui/react": {
@@ -1955,12 +1983,12 @@
       }
     },
     "node_modules/@floating-ui/react-dom": {
-      "version": "2.1.7",
-      "resolved": "https://registry.npmjs.org/@floating-ui/react-dom/-/react-dom-2.1.7.tgz",
-      "integrity": "sha512-0tLRojf/1Go2JgEVm+3Frg9A3IW8bJgKgdO0BN5RkF//ufuz2joZM63Npau2ff3J6lUVYgDSNzNkR+aH3IVfjg==",
+      "version": "2.1.8",
+      "resolved": "https://registry.npmjs.org/@floating-ui/react-dom/-/react-dom-2.1.8.tgz",
+      "integrity": "sha512-cC52bHwM/n/CxS87FH0yWdngEZrjdtLW/qVruo68qg+prK7ZQ4YGdut2GyDVpoGeAYe/h899rVeOVm6Oi40k2A==",
       "license": "MIT",
       "dependencies": {
-        "@floating-ui/dom": "^1.7.5"
+        "@floating-ui/dom": "^1.7.6"
       },
       "peerDependencies": {
         "react": ">=16.8.0",
@@ -1968,15 +1996,15 @@
       }
     },
     "node_modules/@floating-ui/utils": {
-      "version": "0.2.10",
-      "resolved": "https://registry.npmjs.org/@floating-ui/utils/-/utils-0.2.10.tgz",
-      "integrity": "sha512-aGTxbpbg8/b5JfU1HXSrbH3wXZuLPJcNEcZQFMxLs3oSzgtVu6nFPkbbGGUvBcUjKV2YyB9Wxxabo+HEH9tcRQ==",
+      "version": "0.2.11",
+      "resolved": "https://registry.npmjs.org/@floating-ui/utils/-/utils-0.2.11.tgz",
+      "integrity": "sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg==",
       "license": "MIT"
     },
     "node_modules/@grpc/grpc-js": {
-      "version": "1.14.3",
-      "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.14.3.tgz",
-      "integrity": "sha512-Iq8QQQ/7X3Sac15oB6p0FmUg/klxQvXLeileoqrTRGJYLV+/9tubbr9ipz0GKHjmXVsgFPo/+W+2cA8eNcR+XA==",
+      "version": "1.14.4",
+      "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.14.4.tgz",
+      "integrity": "sha512-k9Dj3DV/itK9D06Y8f190Qgop7/Ui+D0njFV3LHMPwPT75DpXLQohE9Wmz0QElrJnzsjB7KPWiKJbOl7IPDArQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "@grpc/proto-loader": "^0.8.0",
@@ -1987,14 +2015,14 @@
       }
     },
     "node_modules/@grpc/grpc-js/node_modules/@grpc/proto-loader": {
-      "version": "0.8.0",
-      "resolved": "https://registry.npmjs.org/@grpc/proto-loader/-/proto-loader-0.8.0.tgz",
-      "integrity": "sha512-rc1hOQtjIWGxcxpb9aHAfLpIctjEnsDehj0DAiVfBlmT84uvR0uUtN2hEi/ecvWVjXUGf5qPF4qEgiLOx1YIMQ==",
+      "version": "0.8.1",
+      "resolved": "https://registry.npmjs.org/@grpc/proto-loader/-/proto-loader-0.8.1.tgz",
+      "integrity": "sha512-wtF6h+DY6M3YaDBPAmvuuA6jV8Sif9MjtOI5euKFWRgCDl5PeDpPsHR9u2l6St5ceY8AZgoNDww5+HvEsXFsGg==",
       "license": "Apache-2.0",
       "dependencies": {
         "lodash.camelcase": "^4.3.0",
         "long": "^5.0.0",
-        "protobufjs": "^7.5.3",
+        "protobufjs": "^7.5.5",
         "yargs": "^17.7.2"
       },
       "bin": {
@@ -2043,29 +2071,43 @@
       }
     },
     "node_modules/@humanfs/core": {
-      "version": "0.19.1",
-      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz",
-      "integrity": "sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==",
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
+      "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==",
       "dev": true,
       "license": "Apache-2.0",
+      "dependencies": {
+        "@humanfs/types": "^0.15.0"
+      },
       "engines": {
         "node": ">=18.18.0"
       }
     },
     "node_modules/@humanfs/node": {
-      "version": "0.16.7",
-      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.7.tgz",
-      "integrity": "sha512-/zUx+yOsIrG4Y43Eh2peDeKCxlRt/gET6aHfaKpuq267qXdYDFViVHfMaLyygZOnl0kGWxFIgsBy8QFuTLUXEQ==",
+      "version": "0.16.8",
+      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz",
+      "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@humanfs/core": "^0.19.1",
+        "@humanfs/core": "^0.19.2",
+        "@humanfs/types": "^0.15.0",
         "@humanwhocodes/retry": "^0.4.0"
       },
       "engines": {
         "node": ">=18.18.0"
       }
     },
+    "node_modules/@humanfs/types": {
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz",
+      "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
     "node_modules/@humanwhocodes/module-importer": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
@@ -2095,9 +2137,9 @@
       }
     },
     "node_modules/@img/colour": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/@img/colour/-/colour-1.0.0.tgz",
-      "integrity": "sha512-A5P/LfWGFSl6nsckYtjw9da+19jB8hkJ6ACTGcDfEJ0aE+l2n2El7dsVM7UVHZQ9s2lmYMWlrS21YLy2IR1LUw==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@img/colour/-/colour-1.1.0.tgz",
+      "integrity": "sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ==",
       "license": "MIT",
       "engines": {
         "node": ">=18"
@@ -2186,6 +2228,9 @@
       "cpu": [
         "arm"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -2202,6 +2247,9 @@
       "cpu": [
         "arm64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -2218,6 +2266,9 @@
       "cpu": [
         "ppc64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -2234,6 +2285,9 @@
       "cpu": [
         "riscv64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -2250,6 +2304,9 @@
       "cpu": [
         "s390x"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -2266,6 +2323,9 @@
       "cpu": [
         "x64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -2282,6 +2342,9 @@
       "cpu": [
         "arm64"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -2298,6 +2361,9 @@
       "cpu": [
         "x64"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "LGPL-3.0-or-later",
       "optional": true,
       "os": [
@@ -2314,6 +2380,9 @@
       "cpu": [
         "arm"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -2336,6 +2405,9 @@
       "cpu": [
         "arm64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -2358,6 +2430,9 @@
       "cpu": [
         "ppc64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -2380,6 +2455,9 @@
       "cpu": [
         "riscv64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -2402,6 +2480,9 @@
       "cpu": [
         "s390x"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -2424,6 +2505,9 @@
       "cpu": [
         "x64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -2446,6 +2530,9 @@
       "cpu": [
         "arm64"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -2468,6 +2555,9 @@
       "cpu": [
         "x64"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -2588,6 +2678,33 @@
         "react-dom": "^16.9.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
       }
     },
+    "node_modules/@internationalized/date": {
+      "version": "3.12.2",
+      "resolved": "https://registry.npmjs.org/@internationalized/date/-/date-3.12.2.tgz",
+      "integrity": "sha512-FY1Y+H64NDs+HAF6omlnWxm3mEpfgaCSWtL5l551ZZfImA+kGjPFgrnJrGjH6lfmLL0g8Z/mBu1R3kufeCp6Jw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@swc/helpers": "^0.5.0"
+      }
+    },
+    "node_modules/@internationalized/number": {
+      "version": "3.6.7",
+      "resolved": "https://registry.npmjs.org/@internationalized/number/-/number-3.6.7.tgz",
+      "integrity": "sha512-3ji1fcrT+FPAK86UqEhB/psHixYo6niWPJtt7+qRaYFynt/BaJG8GhAPimtWUpEiVSTq8ZM8L5psMxGquiB/Vg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@swc/helpers": "^0.5.0"
+      }
+    },
+    "node_modules/@internationalized/string": {
+      "version": "3.2.9",
+      "resolved": "https://registry.npmjs.org/@internationalized/string/-/string-3.2.9.tgz",
+      "integrity": "sha512-kzP/M/mbQxODlmOt4bIQZ2SBVUWUSqMLXooXixnX7noche8WHaQcA+nwFN1K2KCF/cp+LDUhcJsCicwkvhD1pg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@swc/helpers": "^0.5.0"
+      }
+    },
     "node_modules/@ioredis/commands": {
       "version": "1.5.0",
       "resolved": "https://registry.npmjs.org/@ioredis/commands/-/commands-1.5.0.tgz",
@@ -2659,12 +2776,12 @@
       }
     },
     "node_modules/@isaacs/cliui/node_modules/strip-ansi": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.2.tgz",
-      "integrity": "sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA==",
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
+      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
       "license": "MIT",
       "dependencies": {
-        "ansi-regex": "^6.0.1"
+        "ansi-regex": "^6.2.2"
       },
       "engines": {
         "node": ">=12"
@@ -2722,22 +2839,67 @@
       }
     },
     "node_modules/@japa/core": {
-      "version": "10.3.0",
-      "resolved": "https://registry.npmjs.org/@japa/core/-/core-10.3.0.tgz",
-      "integrity": "sha512-+vaqMiPnVaxlKH1sAwRQ80AwzlPysPKivhB8q1I2+BGe35lNrfiHKGMC52fuGAZBNuH5W2nInSCxr4cN/BTEIQ==",
+      "version": "10.4.0",
+      "resolved": "https://registry.npmjs.org/@japa/core/-/core-10.4.0.tgz",
+      "integrity": "sha512-1zvKL29i7r/4jqTNBsw91hk1tp6wbqFXvyV2p+Og4axDRhIXjSAfauRvBL9QuB80bOa+pDIMQ5kCTaCplSm0Eg==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "@poppinss/hooks": "^7.2.5",
-        "@poppinss/macroable": "^1.0.4",
-        "@poppinss/string": "^1.2.0",
+        "@poppinss/hooks": "^7.3.0",
+        "@poppinss/macroable": "^1.1.0",
+        "@poppinss/string": "^1.7.1",
         "async-retry": "^1.3.3",
-        "emittery": "^1.0.3",
-        "string-width": "^7.2.0",
-        "time-span": "^5.1.0"
+        "emittery": "^1.2.0",
+        "string-width": "^8.1.0"
       },
       "engines": {
-        "node": ">=18.16.0"
+        "node": ">=24.0.0"
+      }
+    },
+    "node_modules/@japa/core/node_modules/ansi-regex": {
+      "version": "6.2.2",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
+      "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==",
+      "devOptional": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-regex?sponsor=1"
+      }
+    },
+    "node_modules/@japa/core/node_modules/string-width": {
+      "version": "8.2.1",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-8.2.1.tgz",
+      "integrity": "sha512-IIaP0g3iy9Cyy18w3M9YcaDudujEAVHKt3a3QJg1+sr/oX96TbaGUubG0hJyCjCBThFH+tFpcIyoUHUn1ogaLA==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "get-east-asian-width": "^1.5.0",
+        "strip-ansi": "^7.1.2"
+      },
+      "engines": {
+        "node": ">=20"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/@japa/core/node_modules/strip-ansi": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
+      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^6.2.2"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/strip-ansi?sponsor=1"
       }
     },
     "node_modules/@japa/errors-printer": {
@@ -2756,17 +2918,29 @@
         "node": ">=18.16.0"
       }
     },
-    "node_modules/@japa/errors-printer/node_modules/youch": {
-      "version": "4.1.0-beta.13",
-      "resolved": "https://registry.npmjs.org/youch/-/youch-4.1.0-beta.13.tgz",
-      "integrity": "sha512-3+AG1Xvt+R7M7PSDudhbfbwiyveW6B8PLBIwTyEC598biEYIjHhC89i6DBEvR0EZUjGY3uGSnC429HpIa2Z09g==",
+    "node_modules/@japa/errors-printer/node_modules/@poppinss/dumper": {
+      "version": "0.7.0",
+      "resolved": "https://registry.npmjs.org/@poppinss/dumper/-/dumper-0.7.0.tgz",
+      "integrity": "sha512-0UTYalzk2t6S4rA2uHOz5bSSW2CHdv4vggJI6Alg90yvl0UgXs6XSXpH96OH+bRkX4J/06djv29pqXJ0lq5Kag==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@poppinss/colors": "^4.1.5",
-        "@poppinss/dumper": "^0.6.5",
-        "@speed-highlight/core": "^1.2.9",
-        "cookie-es": "^2.0.0",
+        "@sindresorhus/is": "^7.0.2",
+        "supports-color": "^10.0.0"
+      }
+    },
+    "node_modules/@japa/errors-printer/node_modules/youch": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/youch/-/youch-4.1.1.tgz",
+      "integrity": "sha512-mxW3qiSnl+GRxXsaUMzv2Mbada1Y8CDltET9UxejDQe6DBYlSekghl5U5K0ReAikcHDi0G1vKZEmmo/NWAGKLA==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "@poppinss/colors": "^4.1.6",
+        "@poppinss/dumper": "^0.7.0",
+        "@speed-highlight/core": "^1.2.14",
+        "cookie-es": "^3.0.1",
         "youch-core": "^0.3.3"
       }
     },
@@ -2839,18 +3013,18 @@
       }
     },
     "node_modules/@jest/diff-sequences": {
-      "version": "30.0.1",
-      "resolved": "https://registry.npmjs.org/@jest/diff-sequences/-/diff-sequences-30.0.1.tgz",
-      "integrity": "sha512-n5H8QLDJ47QqbCNn5SuFjCRDrOLEZ0h8vAHCK5RL9Ls7Xa8AQLa/YxAc9UjFqoEDM48muwtBGjtMY5cr0PLDCw==",
+      "version": "30.4.0",
+      "resolved": "https://registry.npmjs.org/@jest/diff-sequences/-/diff-sequences-30.4.0.tgz",
+      "integrity": "sha512-zOpzlfUs45l6u7jm39qr87JCHUDsaeCtvL+kQe/Vn9jSnRB4/5IPXISm0h9I1vZW/o00Kn4UTJ2MOlhnUGwv3g==",
       "license": "MIT",
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/@jest/expect-utils": {
-      "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/@jest/expect-utils/-/expect-utils-30.2.0.tgz",
-      "integrity": "sha512-1JnRfhqpD8HGpOmQp180Fo9Zt69zNtC+9lR+kT7NVL05tNXIi+QC8Csz7lfidMoVLPD3FnOtcmp0CEFnxExGEA==",
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/@jest/expect-utils/-/expect-utils-30.4.1.tgz",
+      "integrity": "sha512-ZBn5CglH8fBsQsvs4VWNzD4aWfUYks+IdOOQU3MEK71ol/BcVm+P+rtb1KpiFBpSWSCE27uOahyyf1vfqOVbcQ==",
       "license": "MIT",
       "dependencies": {
         "@jest/get-type": "30.1.0"
@@ -2869,22 +3043,22 @@
       }
     },
     "node_modules/@jest/pattern": {
-      "version": "30.0.1",
-      "resolved": "https://registry.npmjs.org/@jest/pattern/-/pattern-30.0.1.tgz",
-      "integrity": "sha512-gWp7NfQW27LaBQz3TITS8L7ZCQ0TLvtmI//4OwlQRx4rnWxcPNIYjxZpDcN4+UlGxgm3jS5QPz8IPTCkb59wZA==",
+      "version": "30.4.0",
+      "resolved": "https://registry.npmjs.org/@jest/pattern/-/pattern-30.4.0.tgz",
+      "integrity": "sha512-RAWn3+f9u8BsHijKJ71uHcFp6vmyEt6VvoWXkl6hKF3qVIuWNmudVjg12DlBPGup/frIl5UcUlH5HfEuvHpEXg==",
       "license": "MIT",
       "dependencies": {
         "@types/node": "*",
-        "jest-regex-util": "30.0.1"
+        "jest-regex-util": "30.4.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/@jest/schemas": {
-      "version": "30.0.5",
-      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-30.0.5.tgz",
-      "integrity": "sha512-DmdYgtezMkh3cpU8/1uyXakv3tJRcmcXxBOcO0tbaozPwpmh4YMsnWrQm9ZmZMfa5ocbxzbFk6O4bDPEc/iAnA==",
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-30.4.1.tgz",
+      "integrity": "sha512-i6b4qw5qnP8c5FEeBJg/uZQ4ddrkN6Ca8qISJh0pr7a5hfn3h3v5x60BEbOC7OYAGZNMs1LfFLwnW2CuK8F57Q==",
       "license": "MIT",
       "dependencies": {
         "@sinclair/typebox": "^0.34.0"
@@ -2894,13 +3068,13 @@
       }
     },
     "node_modules/@jest/types": {
-      "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/@jest/types/-/types-30.2.0.tgz",
-      "integrity": "sha512-H9xg1/sfVvyfU7o3zMfBEjQ1gcsdeTMgqHoYdN79tuLqfTtuu7WckRA1R5whDwOzxaZAeMKTYWqP+WCAi0CHsg==",
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/@jest/types/-/types-30.4.1.tgz",
+      "integrity": "sha512-f1x/vJXIfjOlEmejYpbkbgw1gOqpPECwMvMEtBqe47j7H2Hg8h8w3o3ikhSXq3MI15kg+oQ0exWO0uCtTNJLoQ==",
       "license": "MIT",
       "dependencies": {
-        "@jest/pattern": "30.0.1",
-        "@jest/schemas": "30.0.5",
+        "@jest/pattern": "30.4.0",
+        "@jest/schemas": "30.4.1",
         "@types/istanbul-lib-coverage": "^2.0.6",
         "@types/istanbul-reports": "^3.0.4",
         "@types/node": "*",
@@ -3006,9 +3180,9 @@
       "license": "ISC"
     },
     "node_modules/@mapbox/tiny-sdf": {
-      "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/@mapbox/tiny-sdf/-/tiny-sdf-2.0.7.tgz",
-      "integrity": "sha512-25gQLQMcpivjOSA40g3gO6qgiFPDpWRoMfd+G/GoppPIeP6JDaMMkMrEJnMZhKyyS6iKwVt5YKu02vCUyJM3Ug==",
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@mapbox/tiny-sdf/-/tiny-sdf-2.2.0.tgz",
+      "integrity": "sha512-LVL4wgI9YAum5V+LNVQO6QgFBPw7/MIIY4XJPNsPDMrjEwcE+JfKk1LuIl8GnF197ejVdC9QdPaxrx5gfgdGXg==",
       "license": "BSD-2-Clause"
     },
     "node_modules/@mapbox/unitbezier": {
@@ -3087,9 +3261,9 @@
       }
     },
     "node_modules/@msgpackr-extract/msgpackr-extract-darwin-arm64": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-darwin-arm64/-/msgpackr-extract-darwin-arm64-3.0.3.tgz",
-      "integrity": "sha512-QZHtlVgbAdy2zAqNA9Gu1UpIuI8Xvsd1v8ic6B2pZmeFnFcMWiPLfWXh7TVw4eGEZ/C9TH281KwhVoeQUKbyjw==",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-darwin-arm64/-/msgpackr-extract-darwin-arm64-3.0.4.tgz",
+      "integrity": "sha512-LCkGo6JDfaBhgST7UpPWgNgLINpcpabaHfyz5OBx75nUYxBsaEPxjnyNjWpeb/xBup/682QnBfRBy2/LvPutZQ==",
       "cpu": [
         "arm64"
       ],
@@ -3100,9 +3274,9 @@
       ]
     },
     "node_modules/@msgpackr-extract/msgpackr-extract-darwin-x64": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-darwin-x64/-/msgpackr-extract-darwin-x64-3.0.3.tgz",
-      "integrity": "sha512-mdzd3AVzYKuUmiWOQ8GNhl64/IoFGol569zNRdkLReh6LRLHOXxU4U8eq0JwaD8iFHdVGqSy4IjFL4reoWCDFw==",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-darwin-x64/-/msgpackr-extract-darwin-x64-3.0.4.tgz",
+      "integrity": "sha512-zExlW9zUJKZH/tOtVMttwjKa4Xm/3KcNjnE3dPN92uCktwavMxpgCA3MoJK/DOnTWsQgo224OaST27/mPNAf+w==",
       "cpu": [
         "x64"
       ],
@@ -3113,9 +3287,9 @@
       ]
     },
     "node_modules/@msgpackr-extract/msgpackr-extract-linux-arm": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-arm/-/msgpackr-extract-linux-arm-3.0.3.tgz",
-      "integrity": "sha512-fg0uy/dG/nZEXfYilKoRe7yALaNmHoYeIoJuJ7KJ+YyU2bvY8vPv27f7UKhGRpY6euFYqEVhxCFZgAUNQBM3nw==",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-arm/-/msgpackr-extract-linux-arm-3.0.4.tgz",
+      "integrity": "sha512-Tg3yX65f5GbtXLkrYEHE5oibZG9epyYWas7FogTTEJeDEF9JlXJzKgXaNhT3UXlTOeA+AfZpYZYZ0uPj7Cfquw==",
       "cpu": [
         "arm"
       ],
@@ -3126,9 +3300,9 @@
       ]
     },
     "node_modules/@msgpackr-extract/msgpackr-extract-linux-arm64": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-arm64/-/msgpackr-extract-linux-arm64-3.0.3.tgz",
-      "integrity": "sha512-YxQL+ax0XqBJDZiKimS2XQaf+2wDGVa1enVRGzEvLLVFeqa5kx2bWbtcSXgsxjQB7nRqqIGFIcLteF/sHeVtQg==",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-arm64/-/msgpackr-extract-linux-arm64-3.0.4.tgz",
+      "integrity": "sha512-dgX0P/9wGPJeHFBG+ZmhgE6bmtMt7NP5CRBGyyktpopdk/mW4POnrpQsSLtKI1dwpc+pPLuXHDh6vvskyQE/sw==",
       "cpu": [
         "arm64"
       ],
@@ -3139,9 +3313,9 @@
       ]
     },
     "node_modules/@msgpackr-extract/msgpackr-extract-linux-x64": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-x64/-/msgpackr-extract-linux-x64-3.0.3.tgz",
-      "integrity": "sha512-cvwNfbP07pKUfq1uH+S6KJ7dT9K8WOE4ZiAcsrSes+UY55E/0jLYc+vq+DO7jlmqRb5zAggExKm0H7O/CBaesg==",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-linux-x64/-/msgpackr-extract-linux-x64-3.0.4.tgz",
+      "integrity": "sha512-8TNXMEjJc3QEy7R/x1INhgiU+XakDAFUzBhaz7+Rbrs8NH5UQeHQxxmzsSBJGyV6I1jW79undiQm8tOI+D+8FQ==",
       "cpu": [
         "x64"
       ],
@@ -3152,9 +3326,9 @@
       ]
     },
     "node_modules/@msgpackr-extract/msgpackr-extract-win32-x64": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-win32-x64/-/msgpackr-extract-win32-x64-3.0.3.tgz",
-      "integrity": "sha512-x0fWaQtYp4E6sktbsdAqnehxDgEc/VwM7uLsRCYWaiGu0ykYdZPiS8zCWdnjHwyiumousxfBm4SO31eXqwEZhQ==",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@msgpackr-extract/msgpackr-extract-win32-x64/-/msgpackr-extract-win32-x64-3.0.4.tgz",
+      "integrity": "sha512-CmCXPQrkbwExx3j946/PtHWHbYJiCRBRDl4BlkRQcJB/YOwQxJRTpoo7aTsortjgoJ1x7opzTSxn7C+ASSLVjQ==",
       "cpu": [
         "x64"
       ],
@@ -3259,6 +3433,9 @@
       "cpu": [
         "arm64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3275,6 +3452,9 @@
       "cpu": [
         "arm64"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3291,6 +3471,9 @@
       "cpu": [
         "riscv64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3307,6 +3490,9 @@
       "cpu": [
         "x64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3323,6 +3509,9 @@
       "cpu": [
         "x64"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3361,9 +3550,9 @@
       }
     },
     "node_modules/@nodable/entities": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@nodable/entities/-/entities-2.1.0.tgz",
-      "integrity": "sha512-nyT7T3nbMyBI/lvr6L5TyWbFJAI9FTgVRakNoBqCD+PmID8DzFrrNdLLtHMwMszOtqZa8PAOV24ZqDnQrhQINA==",
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/@nodable/entities/-/entities-2.1.1.tgz",
+      "integrity": "sha512-Pig3HxDIoMgjdEH8OCf/dkcTmLFjJRjWuq8jSnklu284/TKOPibSRERmOykiwmyXTtv61mP+44f3GMx0tLAyjg==",
       "funding": [
         {
           "type": "github",
@@ -3426,6 +3615,28 @@
         "node": "^18.17.0 || >=20.5.0"
       }
     },
+    "node_modules/@npmcli/agent/node_modules/agent-base": {
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
+      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/@npmcli/agent/node_modules/https-proxy-agent": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.2",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
     "node_modules/@npmcli/agent/node_modules/lru-cache": {
       "version": "10.4.3",
       "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
@@ -3470,18 +3681,18 @@
       }
     },
     "node_modules/@openzim/libzim/node_modules/@types/node": {
-      "version": "24.10.10",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.10.10.tgz",
-      "integrity": "sha512-+0/4J266CBGPUq/ELg7QUHhN25WYjE0wYTPSQJn1xeu8DOlIOPxXxrNGiLmfAWl7HMMgWFWXpt9IDjMWrF5Iow==",
+      "version": "24.13.1",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.1.tgz",
+      "integrity": "sha512-RSpUJGmvsJ1ZeBehQZFhIdpsz+bIpES0nIQXko4Ybq+N+kX6XvOq3Jo+iJ82FWLdblFq85AsMikd3m35jgezYg==",
       "license": "MIT",
       "dependencies": {
-        "undici-types": "~7.16.0"
+        "undici-types": "~7.18.0"
       }
     },
     "node_modules/@openzim/libzim/node_modules/dotenv": {
-      "version": "17.2.3",
-      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.2.3.tgz",
-      "integrity": "sha512-JVUnt+DUIzu87TABbhPmNfVdBDt18BLOWjMUFJMSi/Qqg7NTYtabbvSNJGOJ7afbRuv9D/lngizHtP7QyLQ+9w==",
+      "version": "17.4.2",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.4.2.tgz",
+      "integrity": "sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw==",
       "license": "BSD-2-Clause",
       "engines": {
         "node": ">=12"
@@ -3491,9 +3702,9 @@
       }
     },
     "node_modules/@openzim/libzim/node_modules/undici-types": {
-      "version": "7.16.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
-      "integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==",
+      "version": "7.18.2",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
+      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
       "license": "MIT"
     },
     "node_modules/@paralleldrive/cuid2": {
@@ -3531,13 +3742,13 @@
       }
     },
     "node_modules/@pkgr/core": {
-      "version": "0.2.9",
-      "resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.2.9.tgz",
-      "integrity": "sha512-QNqXyfVS2wm9hweSYD2O7F0G06uurj9kZ96TRQE5Y9hU7+tgdZwIkbAKc5Ocy1HxEY2kuDQa6cQ1WRs/O5LFKA==",
+      "version": "0.3.6",
+      "resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.3.6.tgz",
+      "integrity": "sha512-SEeaJLb3qBNF/OaXnaR1NmmBbFYk1zC0ZH/52fATcRPLFg/p791YrcyFFy44Bo9sLaGuSuLp5Q6axbb/O+v/RA==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": "^12.20.0 || ^14.18.0 || >=16.0.0"
+        "node": "^14.18.0 || >=16.0.0"
       },
       "funding": {
         "url": "https://opencollective.com/pkgr"
@@ -3564,18 +3775,20 @@
       }
     },
     "node_modules/@poppinss/cliui": {
-      "version": "6.7.0",
-      "resolved": "https://registry.npmjs.org/@poppinss/cliui/-/cliui-6.7.0.tgz",
-      "integrity": "sha512-ihlhDUHw4Lfx6Euo8SSDar/rHHD8T1aFXJ1Z3NYSYjHcr9rSK5iy6zC5xvQJCeGY1BTninW520iKv/hd4lS0tA==",
+      "version": "6.8.1",
+      "resolved": "https://registry.npmjs.org/@poppinss/cliui/-/cliui-6.8.1.tgz",
+      "integrity": "sha512-o/ssbwr+r6woG65rk9eFHnn9dVUphZr/Rk+4+05ENVMBWYpYhTJGdE9RobTG5JLFubvO4gWIyFeNlC+I4EM6eA==",
       "license": "MIT",
       "dependencies": {
         "@poppinss/colors": "^4.1.6",
+        "cli-boxes": "^4.0.1",
         "cli-table3": "^0.6.5",
-        "cli-truncate": "^5.1.1",
-        "log-update": "^7.0.2",
+        "cli-truncate": "^5.2.0",
+        "log-update": "^7.2.0",
         "pretty-hrtime": "^1.0.3",
-        "string-width": "^8.1.0",
-        "supports-color": "^10.2.2"
+        "string-width": "^8.2.0",
+        "supports-color": "^10.2.2",
+        "terminal-size": "^4.0.1"
       }
     },
     "node_modules/@poppinss/cliui/node_modules/ansi-regex": {
@@ -3591,13 +3804,13 @@
       }
     },
     "node_modules/@poppinss/cliui/node_modules/string-width": {
-      "version": "8.1.1",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-8.1.1.tgz",
-      "integrity": "sha512-KpqHIdDL9KwYk22wEOg/VIqYbrnLeSApsKT/bSj6Ez7pn3CftUiLAv2Lccpq1ALcpLV9UX1Ppn92npZWu2w/aw==",
+      "version": "8.2.1",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-8.2.1.tgz",
+      "integrity": "sha512-IIaP0g3iy9Cyy18w3M9YcaDudujEAVHKt3a3QJg1+sr/oX96TbaGUubG0hJyCjCBThFH+tFpcIyoUHUn1ogaLA==",
       "license": "MIT",
       "dependencies": {
-        "get-east-asian-width": "^1.3.0",
-        "strip-ansi": "^7.1.0"
+        "get-east-asian-width": "^1.5.0",
+        "strip-ansi": "^7.1.2"
       },
       "engines": {
         "node": ">=20"
@@ -3607,12 +3820,12 @@
       }
     },
     "node_modules/@poppinss/cliui/node_modules/strip-ansi": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.2.tgz",
-      "integrity": "sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA==",
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
+      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
       "license": "MIT",
       "dependencies": {
-        "ansi-regex": "^6.0.1"
+        "ansi-regex": "^6.2.2"
       },
       "engines": {
         "node": ">=12"
@@ -3663,9 +3876,9 @@
       }
     },
     "node_modules/@poppinss/macroable": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@poppinss/macroable/-/macroable-1.1.0.tgz",
-      "integrity": "sha512-y/YKzZDuG8XrpXpM7Z1RdQpiIc0MAKyva24Ux1PB4aI7RiSI/79K8JVDcdyubriTm7vJ1LhFs8CrZpmPnx/8Pw==",
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@poppinss/macroable/-/macroable-1.1.2.tgz",
+      "integrity": "sha512-FAVBRzzWhYP5mA3lCwLH1A0fKBqq5anyjGet90Z81aRK5c/+LTGUE1zJhZrErjaenBSOOI9BVUs3WVmotneFQA==",
       "license": "MIT"
     },
     "node_modules/@poppinss/matchit": {
@@ -3716,15 +3929,15 @@
       }
     },
     "node_modules/@poppinss/string": {
-      "version": "1.7.1",
-      "resolved": "https://registry.npmjs.org/@poppinss/string/-/string-1.7.1.tgz",
-      "integrity": "sha512-OrLzv/nGDU6l6dLXIQHe8nbNSWWfuSbpB/TW5nRpZFf49CLuQlIHlSPN9IdSUv2vG+59yGM6LoibsaHn8B8mDw==",
+      "version": "1.7.2",
+      "resolved": "https://registry.npmjs.org/@poppinss/string/-/string-1.7.2.tgz",
+      "integrity": "sha512-A182GLDfi36iDCbhDrHB0xzrPM1fO3GHnhCDIdadf8C6eycgct4m7zusbLwEh6GPaj2Pz5BVos7XK16w7tZ7wQ==",
       "license": "MIT",
       "dependencies": {
         "@types/pluralize": "^0.0.33",
         "case-anything": "^3.1.2",
         "pluralize": "^8.0.0",
-        "slugify": "^1.6.6"
+        "slugify": "^1.6.9"
       }
     },
     "node_modules/@poppinss/types": {
@@ -3769,25 +3982,24 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/codegen": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/@protobufjs/codegen/-/codegen-2.0.4.tgz",
-      "integrity": "sha512-YyFaikqM5sH0ziFZCN3xDC7zeGaB/d0IUb9CATugHWbd1FRFwWwt4ld4OYMPWu5a3Xe01mGAULCdqhMlPl29Jg==",
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/@protobufjs/codegen/-/codegen-2.0.5.tgz",
+      "integrity": "sha512-zgXFLzW3Ap33e6d0Wlj4MGIm6Ce8O89n/apUaGNB/jx+hw+ruWEp7EwGUshdLKVRCxZW12fp9r40E1mQrf/34g==",
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/eventemitter": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@protobufjs/eventemitter/-/eventemitter-1.1.0.tgz",
-      "integrity": "sha512-j9ednRT81vYJ9OfVuXG6ERSTdEL1xVsNgqpkxMsbIabzSo3goCjDIveeGv5d03om39ML71RdmrGNjG5SReBP/Q==",
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@protobufjs/eventemitter/-/eventemitter-1.1.1.tgz",
+      "integrity": "sha512-vW1GmwMZNnL+gMRaovlh9yZX74kc+TTU3FObkkurpMaRtBfLP3ldjS9KQWlwZgraRE0+dheEEoAxdzcJQ8eXZg==",
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/fetch": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@protobufjs/fetch/-/fetch-1.1.0.tgz",
-      "integrity": "sha512-lljVXpqXebpsijW71PZaCYeIcE5on1w5DlQy5WH6GLbFryLUrBD4932W/E2BSpfRJWseIL4v/KPgBFxDOIdKpQ==",
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@protobufjs/fetch/-/fetch-1.1.1.tgz",
+      "integrity": "sha512-GpptLrs57adMSuHi3VNj0mAF8dwh36LMaYF6XyJ6JMWlVsc+t42tm1HSEDmOs3A8fC9yyeisgLhsTVQokOZ0zw==",
       "license": "BSD-3-Clause",
       "dependencies": {
-        "@protobufjs/aspromise": "^1.1.1",
-        "@protobufjs/inquire": "^1.1.0"
+        "@protobufjs/aspromise": "^1.1.1"
       }
     },
     "node_modules/@protobufjs/float": {
@@ -3797,9 +4009,9 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/inquire": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@protobufjs/inquire/-/inquire-1.1.0.tgz",
-      "integrity": "sha512-kdSefcPdruJiFMVSbn801t4vFK7KB/5gd2fYvrxhuJYg8ILrmn9SKSX2tZdV6V+ksulWqS7aXjBcRXl3wHoD9Q==",
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@protobufjs/inquire/-/inquire-1.1.2.tgz",
+      "integrity": "sha512-pa0vFRuws4wkvaXKK1uXZMAwAX4/t8ANaJo45iw/oQHNQ9q5xUzwgFmVJGXiga2BeN+zpX7Vf9vmsiIa2J+MUw==",
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/path": {
@@ -3815,9 +4027,9 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/@protobufjs/utf8": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@protobufjs/utf8/-/utf8-1.1.0.tgz",
-      "integrity": "sha512-Vvn3zZrhQZkkBE8LSuW3em98c0FwgO4nxzv6OdSxPKJIEKY2bGbHn+mhGIPerzI4twdxaP8/0+06HBpwf345Lw==",
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@protobufjs/utf8/-/utf8-1.1.1.tgz",
+      "integrity": "sha512-oOAWABowe8EAbMyWKM0tYDKi8Yaox52D+HWZhAIJqQXbqe0xI/GV7FhLWqlEKreMkfDjshR5FKgi3mnle0h6Eg==",
       "license": "BSD-3-Clause"
     },
     "node_modules/@protomaps/basemaps": {
@@ -3857,16 +4069,13 @@
       }
     },
     "node_modules/@react-aria/focus": {
-      "version": "3.21.3",
-      "resolved": "https://registry.npmjs.org/@react-aria/focus/-/focus-3.21.3.tgz",
-      "integrity": "sha512-FsquWvjSCwC2/sBk4b+OqJyONETUIXQ2vM0YdPAuC+QFQh2DT6TIBo6dOZVSezlhudDla69xFBd6JvCFq1AbUw==",
+      "version": "3.22.1",
+      "resolved": "https://registry.npmjs.org/@react-aria/focus/-/focus-3.22.1.tgz",
+      "integrity": "sha512-CPxtkyrBi/HYY5P3lE/57sQ6qfa0lN8E55TOm89H0kNGv0lKt+/0zP7lWERzBjRr5IxBVrQX4gFEowBN52LPaA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@react-aria/interactions": "^3.26.0",
-        "@react-aria/utils": "^3.32.0",
-        "@react-types/shared": "^3.32.1",
         "@swc/helpers": "^0.5.0",
-        "clsx": "^2.0.0"
+        "react-aria": "^3.48.0"
       },
       "peerDependencies": {
         "react": "^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1",
@@ -3874,80 +4083,24 @@
       }
     },
     "node_modules/@react-aria/interactions": {
-      "version": "3.26.0",
-      "resolved": "https://registry.npmjs.org/@react-aria/interactions/-/interactions-3.26.0.tgz",
-      "integrity": "sha512-AAEcHiltjfbmP1i9iaVw34Mb7kbkiHpYdqieWufldh4aplWgsF11YQZOfaCJW4QoR2ML4Zzoa9nfFwLXA52R7Q==",
+      "version": "3.28.1",
+      "resolved": "https://registry.npmjs.org/@react-aria/interactions/-/interactions-3.28.1.tgz",
+      "integrity": "sha512-Bqb+HrD5I5MHS2SKBhISYqo2SW8Y2dfzgF/Y1lIJq7xqLxheo9vzxPGEHhz+XzkgGfoqEJx8A6a3C7uiqS3HWA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@react-aria/ssr": "^3.9.10",
-        "@react-aria/utils": "^3.32.0",
-        "@react-stately/flags": "^3.1.2",
-        "@react-types/shared": "^3.32.1",
-        "@swc/helpers": "^0.5.0"
-      },
-      "peerDependencies": {
-        "react": "^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1",
-        "react-dom": "^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1"
-      }
-    },
-    "node_modules/@react-aria/ssr": {
-      "version": "3.9.10",
-      "resolved": "https://registry.npmjs.org/@react-aria/ssr/-/ssr-3.9.10.tgz",
-      "integrity": "sha512-hvTm77Pf+pMBhuBm760Li0BVIO38jv1IBws1xFm1NoL26PU+fe+FMW5+VZWyANR6nYL65joaJKZqOdTQMkO9IQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@swc/helpers": "^0.5.0"
-      },
-      "engines": {
-        "node": ">= 12"
-      },
-      "peerDependencies": {
-        "react": "^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1"
-      }
-    },
-    "node_modules/@react-aria/utils": {
-      "version": "3.32.0",
-      "resolved": "https://registry.npmjs.org/@react-aria/utils/-/utils-3.32.0.tgz",
-      "integrity": "sha512-/7Rud06+HVBIlTwmwmJa2W8xVtgxgzm0+kLbuFooZRzKDON6hhozS1dOMR/YLMxyJOaYOTpImcP4vRR9gL1hEg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@react-aria/ssr": "^3.9.10",
-        "@react-stately/flags": "^3.1.2",
-        "@react-stately/utils": "^3.11.0",
-        "@react-types/shared": "^3.32.1",
+        "@react-types/shared": "^3.34.0",
         "@swc/helpers": "^0.5.0",
-        "clsx": "^2.0.0"
+        "react-aria": "^3.48.0"
       },
       "peerDependencies": {
         "react": "^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1",
         "react-dom": "^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1"
       }
     },
-    "node_modules/@react-stately/flags": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/@react-stately/flags/-/flags-3.1.2.tgz",
-      "integrity": "sha512-2HjFcZx1MyQXoPqcBGALwWWmgFVUk2TuKVIQxCbRq7fPyWXIl6VHcakCLurdtYC2Iks7zizvz0Idv48MQ38DWg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@swc/helpers": "^0.5.0"
-      }
-    },
-    "node_modules/@react-stately/utils": {
-      "version": "3.11.0",
-      "resolved": "https://registry.npmjs.org/@react-stately/utils/-/utils-3.11.0.tgz",
-      "integrity": "sha512-8LZpYowJ9eZmmYLpudbo/eclIRnbhWIJZ994ncmlKlouNzKohtM8qTC6B1w1pwUbiwGdUoyzLuQbeaIor5Dvcw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@swc/helpers": "^0.5.0"
-      },
-      "peerDependencies": {
-        "react": "^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1"
-      }
-    },
     "node_modules/@react-types/shared": {
-      "version": "3.32.1",
-      "resolved": "https://registry.npmjs.org/@react-types/shared/-/shared-3.32.1.tgz",
-      "integrity": "sha512-famxyD5emrGGpFuUlgOP6fVW2h/ZaF405G5KDi3zPHzyjAWys/8W6NAVJtNbkCkhedmvL0xOhvt8feGXyXaw5w==",
+      "version": "3.35.0",
+      "resolved": "https://registry.npmjs.org/@react-types/shared/-/shared-3.35.0.tgz",
+      "integrity": "sha512-iNWvuzEwANttpQpdlu8nPBtdHb0mcCMj1ZTH//iRB5E/14IAnyRlR25rxH7pNLyzHINsPGEKnWvpwDMCT6vziQ==",
       "license": "Apache-2.0",
       "peerDependencies": {
         "react": "^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1"
@@ -3960,9 +4113,9 @@
       "license": "MIT"
     },
     "node_modules/@rollup/rollup-android-arm-eabi": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.59.0.tgz",
-      "integrity": "sha512-upnNBkA6ZH2VKGcBj9Fyl9IGNPULcjXRlg0LLeaioQWueH30p6IXtJEbKAgvyv+mJaMxSm1l6xwDXYjpEMiLMg==",
+      "version": "4.61.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.61.1.tgz",
+      "integrity": "sha512-JnBB8MdXj45cajvTuO5FmPlvFVJRQgvrz1uSEl3NwqFnReAPGwb8EanbGi4z2nRaqLzjJSv5/JmycoTKlRZxHA==",
       "cpu": [
         "arm"
       ],
@@ -3973,9 +4126,9 @@
       ]
     },
     "node_modules/@rollup/rollup-android-arm64": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.59.0.tgz",
-      "integrity": "sha512-hZ+Zxj3SySm4A/DylsDKZAeVg0mvi++0PYVceVyX7hemkw7OreKdCvW2oQ3T1FMZvCaQXqOTHb8qmBShoqk69Q==",
+      "version": "4.61.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.61.1.tgz",
+      "integrity": "sha512-Jx2g7iSjw4AOT0HDPHM9RV3GNjRXwybWtSFZiZAYUTjUwjVrYIwq3kBf+LnhqJlzXFAqTAh2F7IGI+O568exPw==",
       "cpu": [
         "arm64"
       ],
@@ -3986,9 +4139,9 @@
       ]
     },
     "node_modules/@rollup/rollup-darwin-arm64": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.59.0.tgz",
-      "integrity": "sha512-W2Psnbh1J8ZJw0xKAd8zdNgF9HRLkdWwwdWqubSVk0pUuQkoHnv7rx4GiF9rT4t5DIZGAsConRE3AxCdJ4m8rg==",
+      "version": "4.61.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.61.1.tgz",
+      "integrity": "sha512-0F1L/Z3Eqv8mT2n3dCpeO8GcTvHvVqkP5/t6DMsn0KzhYVcg+s7Ncl5DS8qjKYEeio6Az0Gt6nyBORay5qIlCA==",
       "cpu": [
         "arm64"
       ],
@@ -3999,9 +4152,9 @@
       ]
     },
     "node_modules/@rollup/rollup-darwin-x64": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.59.0.tgz",
-      "integrity": "sha512-ZW2KkwlS4lwTv7ZVsYDiARfFCnSGhzYPdiOU4IM2fDbL+QGlyAbjgSFuqNRbSthybLbIJ915UtZBtmuLrQAT/w==",
+      "version": "4.61.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.61.1.tgz",
+      "integrity": "sha512-qLttcH871ujY4YcVfUSShhOw+CsoTatYz8gRbHO7Bb92QH059/P0y5do1KMs41fY0BpD2x4AJH/gID0zFiqVKQ==",
       "cpu": [
         "x64"
       ],
@@ -4012,9 +4165,9 @@
       ]
     },
     "node_modules/@rollup/rollup-freebsd-arm64": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.59.0.tgz",
-      "integrity": "sha512-EsKaJ5ytAu9jI3lonzn3BgG8iRBjV4LxZexygcQbpiU0wU0ATxhNVEpXKfUa0pS05gTcSDMKpn3Sx+QB9RlTTA==",
+      "version": "4.61.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.61.1.tgz",
+      "integrity": "sha512-fUI4RapGE0Oh3mb8mgfvC1O2nU1RpDZUKnDQm3xB1Ipg7C2wTs5Kstz7G2uWK99a8S2yTMq8/P4uycwNa0nJyw==",
       "cpu": [
         "arm64"
       ],
@@ -4025,9 +4178,9 @@
       ]
     },
     "node_modules/@rollup/rollup-freebsd-x64": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.59.0.tgz",
-      "integrity": "sha512-d3DuZi2KzTMjImrxoHIAODUZYoUUMsuUiY4SRRcJy6NJoZ6iIqWnJu9IScV9jXysyGMVuW+KNzZvBLOcpdl3Vg==",
+      "version": "4.61.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.61.1.tgz",
+      "integrity": "sha512-H5YrdvJaDtI/U9/emrD4b++xkvp3y/JvOe4rizHbxvkyMfRS/CiRYdji+Pl8D0brEaNFWUh1drQxgAGIl6Xudw==",
       "cpu": [
         "x64"
       ],
@@ -4038,12 +4191,15 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.59.0.tgz",
-      "integrity": "sha512-t4ONHboXi/3E0rT6OZl1pKbl2Vgxf9vJfWgmUoCEVQVxhW6Cw/c8I6hbbu7DAvgp82RKiH7TpLwxnJeKv2pbsw==",
+      "version": "4.61.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.61.1.tgz",
+      "integrity": "sha512-Q8CBCCQtDFrYtXoeUXSrnFXKOnyUhx6bz+SkL6A0E7V8kAiCJ5pamq1WtbfpVGhR5TSpXY6ak3avmDc5fHTyJA==",
       "cpu": [
         "arm"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4051,12 +4207,15 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm-musleabihf": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.59.0.tgz",
-      "integrity": "sha512-CikFT7aYPA2ufMD086cVORBYGHffBo4K8MQ4uPS/ZnY54GKj36i196u8U+aDVT2LX4eSMbyHtyOh7D7Zvk2VvA==",
+      "version": "4.61.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.61.1.tgz",
+      "integrity": "sha512-nwnhk1581l0FBVellGcVCAT0Oi06onEA3WB53sf01VO3I0UPBkMH9sXONYME2K0ovXcNayJfNtHfm6mpJElatQ==",
       "cpu": [
         "arm"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4064,12 +4223,15 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm64-gnu": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.59.0.tgz",
-      "integrity": "sha512-jYgUGk5aLd1nUb1CtQ8E+t5JhLc9x5WdBKew9ZgAXg7DBk0ZHErLHdXM24rfX+bKrFe+Xp5YuJo54I5HFjGDAA==",
+      "version": "4.61.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.61.1.tgz",
+      "integrity": "sha512-x5Xr49hwt3hdW75UOZm3395YwwzPyauktslv29KpWL/T+vVAzoT3azLcTWv0eMciBNrx+DYjH4paehHoLpPvpg==",
       "cpu": [
         "arm64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4077,12 +4239,15 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm64-musl": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.59.0.tgz",
-      "integrity": "sha512-peZRVEdnFWZ5Bh2KeumKG9ty7aCXzzEsHShOZEFiCQlDEepP1dpUl/SrUNXNg13UmZl+gzVDPsiCwnV1uI0RUA==",
+      "version": "4.61.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.61.1.tgz",
+      "integrity": "sha512-unMS3H73DpaoPyyEVPjGKleM/s0mkmsauTENpw4INQY8y4+IuLNjkueQ5QCtC0D3N38Y38yhAU8OoZ20S2Tm6w==",
       "cpu": [
         "arm64"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4090,12 +4255,15 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-loong64-gnu": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.59.0.tgz",
-      "integrity": "sha512-gbUSW/97f7+r4gHy3Jlup8zDG190AuodsWnNiXErp9mT90iCy9NKKU0Xwx5k8VlRAIV2uU9CsMnEFg/xXaOfXg==",
+      "version": "4.61.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.61.1.tgz",
+      "integrity": "sha512-zNZzGRnAhwjFEYmvphJRV5XaQGjs62cCmeYYHUT//NbvEnHauw+I85nGG+SiVg5ld4GX8D1IbKIX+ozITQnhMQ==",
       "cpu": [
         "loong64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4103,12 +4271,15 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-loong64-musl": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.59.0.tgz",
-      "integrity": "sha512-yTRONe79E+o0FWFijasoTjtzG9EBedFXJMl888NBEDCDV9I2wGbFFfJQQe63OijbFCUZqxpHz1GzpbtSFikJ4Q==",
+      "version": "4.61.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.61.1.tgz",
+      "integrity": "sha512-LdpWGL8X209B2SIvWjqlc8VZgM6PKfontSerGepuldQmHYrAOtnMCXeJkxXGbC+PPZVOuu5czJo7fNV6aeW8rQ==",
       "cpu": [
         "loong64"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4116,12 +4287,15 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-ppc64-gnu": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.59.0.tgz",
-      "integrity": "sha512-sw1o3tfyk12k3OEpRddF68a1unZ5VCN7zoTNtSn2KndUE+ea3m3ROOKRCZxEpmT9nsGnogpFP9x6mnLTCaoLkA==",
+      "version": "4.61.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.61.1.tgz",
+      "integrity": "sha512-EC5kTtNaNGOmbMGqar8dvJy6y/hg99GAwjfBz++pxZhQATXGcRjd6c5en5wcbru0vkRmiMGsQKdMJOOf6sza4g==",
       "cpu": [
         "ppc64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4129,12 +4303,15 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-ppc64-musl": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.59.0.tgz",
-      "integrity": "sha512-+2kLtQ4xT3AiIxkzFVFXfsmlZiG5FXYW7ZyIIvGA7Bdeuh9Z0aN4hVyXS/G1E9bTP/vqszNIN/pUKCk/BTHsKA==",
+      "version": "4.61.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.61.1.tgz",
+      "integrity": "sha512-8hiwp6D4acEcNK78I4rP0/XtS1sknWIAMJBPdR4l6zUtyTm5KiTDr5bXmWt4foY7nAN7AThDHgkLIEZOWKbzWw==",
       "cpu": [
         "ppc64"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4142,12 +4319,15 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-riscv64-gnu": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.59.0.tgz",
-      "integrity": "sha512-NDYMpsXYJJaj+I7UdwIuHHNxXZ/b/N2hR15NyH3m2qAtb/hHPA4g4SuuvrdxetTdndfj9b1WOmy73kcPRoERUg==",
+      "version": "4.61.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.61.1.tgz",
+      "integrity": "sha512-10dh/h/BqA7DuMPWSxkR8uks18FRwnwOEqr5zOTEl+NOwP/OMzKX8OFR/Of9xxDA7D5qef1Nzar5WDD2kCCr1g==",
       "cpu": [
         "riscv64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4155,12 +4335,15 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-riscv64-musl": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.59.0.tgz",
-      "integrity": "sha512-nLckB8WOqHIf1bhymk+oHxvM9D3tyPndZH8i8+35p/1YiVoVswPid2yLzgX7ZJP0KQvnkhM4H6QZ5m0LzbyIAg==",
+      "version": "4.61.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.61.1.tgz",
+      "integrity": "sha512-YKJ5lg35DP17gcAOggnihe+APw9HLyj1Xn7gsmGumBJAUDa6NGXNixJzmkWLhcK9TOuuyQjdamzvJefkO7qHZQ==",
       "cpu": [
         "riscv64"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4168,12 +4351,15 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-s390x-gnu": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.59.0.tgz",
-      "integrity": "sha512-oF87Ie3uAIvORFBpwnCvUzdeYUqi2wY6jRFWJAy1qus/udHFYIkplYRW+wo+GRUP4sKzYdmE1Y3+rY5Gc4ZO+w==",
+      "version": "4.61.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.61.1.tgz",
+      "integrity": "sha512-Mlil5G2Jj6a7B3LWGctg+XPL9vdXYuzCtNXfxOQ0nPjc2m6ueUktocPGH9bnAM0bNRKb/bAWTujUU7IJQdQA+g==",
       "cpu": [
         "s390x"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4181,12 +4367,15 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-x64-gnu": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.59.0.tgz",
-      "integrity": "sha512-3AHmtQq/ppNuUspKAlvA8HtLybkDflkMuLK4DPo77DfthRb71V84/c4MlWJXixZz4uruIH4uaa07IqoAkG64fg==",
+      "version": "4.61.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.61.1.tgz",
+      "integrity": "sha512-bVWIOIk6pV01p4CdUbPP7CJ/434z+OooYjDuFcR+44N35YvKUC66G8MGnvcWx5mWKW3g61J+t74l3Kj15Kwn2Q==",
       "cpu": [
         "x64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4194,12 +4383,15 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-x64-musl": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.59.0.tgz",
-      "integrity": "sha512-2UdiwS/9cTAx7qIUZB/fWtToJwvt0Vbo0zmnYt7ED35KPg13Q0ym1g442THLC7VyI6JfYTP4PiSOWyoMdV2/xg==",
+      "version": "4.61.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.61.1.tgz",
+      "integrity": "sha512-qy5pBvZbqNFheBz61R1rzsezjm0J7O2oNGoWtGoY89SZYLUfxAJTBAqDChqAIdB4rCiIbi9nF7yZ83GnNiLwSw==",
       "cpu": [
         "x64"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4207,9 +4399,9 @@
       ]
     },
     "node_modules/@rollup/rollup-openbsd-x64": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.59.0.tgz",
-      "integrity": "sha512-M3bLRAVk6GOwFlPTIxVBSYKUaqfLrn8l0psKinkCFxl4lQvOSz8ZrKDz2gxcBwHFpci0B6rttydI4IpS4IS/jQ==",
+      "version": "4.61.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.61.1.tgz",
+      "integrity": "sha512-E83TXjI4zm0+5f2qO+UOudaCYIhYwpJ5jq6YCZNIZ+6CbfhKrkAGezeiASBL9ElxAxFsRS9ZhESv8mfnj6TKeg==",
       "cpu": [
         "x64"
       ],
@@ -4220,9 +4412,9 @@
       ]
     },
     "node_modules/@rollup/rollup-openharmony-arm64": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.59.0.tgz",
-      "integrity": "sha512-tt9KBJqaqp5i5HUZzoafHZX8b5Q2Fe7UjYERADll83O4fGqJ49O1FsL6LpdzVFQcpwvnyd0i+K/VSwu/o/nWlA==",
+      "version": "4.61.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.61.1.tgz",
+      "integrity": "sha512-fbWnKqVkjrJN38vNe3ahkbk6iejS/3b0Nt7EEtPpE6RBacZcGXNKbzfHN3GUUlXOPghUg0j6XUGrtjX9z1sIvA==",
       "cpu": [
         "arm64"
       ],
@@ -4233,9 +4425,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-arm64-msvc": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.59.0.tgz",
-      "integrity": "sha512-V5B6mG7OrGTwnxaNUzZTDTjDS7F75PO1ae6MJYdiMu60sq0CqN5CVeVsbhPxalupvTX8gXVSU9gq+Rx1/hvu6A==",
+      "version": "4.61.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.61.1.tgz",
+      "integrity": "sha512-ArMl38iVAbk0New1ogihQNY6iphLi4ZaRsa037gUzv5yeKPY8TD3Dmy4x2RNC1VztU/uqm+G+/RwFrSka3Oy2g==",
       "cpu": [
         "arm64"
       ],
@@ -4246,9 +4438,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-ia32-msvc": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.59.0.tgz",
-      "integrity": "sha512-UKFMHPuM9R0iBegwzKF4y0C4J9u8C6MEJgFuXTBerMk7EJ92GFVFYBfOZaSGLu6COf7FxpQNqhNS4c4icUPqxA==",
+      "version": "4.61.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.61.1.tgz",
+      "integrity": "sha512-0mYtjHS9ucAbcATycCNK9IGBk/cCe/ma7EmSLGZdsxnOA8cjRIyU04wDpVAD9NiOfLUR9KTxdiO53uOkherqjQ==",
       "cpu": [
         "ia32"
       ],
@@ -4259,9 +4451,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-x64-gnu": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.59.0.tgz",
-      "integrity": "sha512-laBkYlSS1n2L8fSo1thDNGrCTQMmxjYY5G0WFWjFFYZkKPjsMBsgJfGf4TLxXrF6RyhI60L8TMOjBMvXiTcxeA==",
+      "version": "4.61.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.61.1.tgz",
+      "integrity": "sha512-gK1iCEPfpoSG9wfBihXxvBMi8ZfcWffYkEsC/Eih+iFENTaewvNcrEQ69lIOWYO5pePHKLHHO7nq5AILGO/HQQ==",
       "cpu": [
         "x64"
       ],
@@ -4272,9 +4464,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-x64-msvc": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.59.0.tgz",
-      "integrity": "sha512-2HRCml6OztYXyJXAvdDXPKcawukWY2GpR5/nxKp4iBgiO3wcoEGkAaqctIbZcNB6KlUQBIqt8VYkNSj2397EfA==",
+      "version": "4.61.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.61.1.tgz",
+      "integrity": "sha512-X+zaP2x+j4RXGfbp/seSoRHWnPxzApilDszisZxbYH5C/jTxFhCtDNdPGZb9lJyYPs24wGxruPF7Y+sIXt9Gzw==",
       "cpu": [
         "x64"
       ],
@@ -4292,9 +4484,9 @@
       "license": "MIT"
     },
     "node_modules/@sinclair/typebox": {
-      "version": "0.34.48",
-      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.48.tgz",
-      "integrity": "sha512-kKJTNuK3AQOrgjjotVxMrCn1sUJwM76wMszfq1kdU4uYVJjvEWuFQ6HgvLt4Xz3fSmZlTOxJ/Ie13KnIcWQXFA==",
+      "version": "0.34.49",
+      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.49.tgz",
+      "integrity": "sha512-brySQQs7Jtn0joV8Xh9ZV/hZb9Ozb0pmazDIASBkYKCjXrXU3mpcFahmK/z4YDhGkQvP9mWJbVyahdtU5wQA+A==",
       "license": "MIT"
     },
     "node_modules/@sindresorhus/is": {
@@ -4323,21 +4515,21 @@
       }
     },
     "node_modules/@speed-highlight/core": {
-      "version": "1.2.14",
-      "resolved": "https://registry.npmjs.org/@speed-highlight/core/-/core-1.2.14.tgz",
-      "integrity": "sha512-G4ewlBNhUtlLvrJTb88d2mdy2KRijzs4UhnlrOSRT4bmjh/IqNElZa3zkrZ+TC47TwtlDWzVLFADljF1Ijp5hA==",
+      "version": "1.2.16",
+      "resolved": "https://registry.npmjs.org/@speed-highlight/core/-/core-1.2.16.tgz",
+      "integrity": "sha512-yNm/fYEcnpRjYduLMaddTK9XKYil6xB88+qFg79ZdZhHu1PadfoQmFW7pVTx7FZqMBNcUuThiAhxhENgtAO2/w==",
       "devOptional": true,
       "license": "CC0-1.0"
     },
     "node_modules/@stylistic/eslint-plugin": {
-      "version": "5.7.1",
-      "resolved": "https://registry.npmjs.org/@stylistic/eslint-plugin/-/eslint-plugin-5.7.1.tgz",
-      "integrity": "sha512-zjTUwIsEfT+k9BmXwq1QEFYsb4afBlsI1AXFyWQBgggMzwBFOuu92pGrE5OFx90IOjNl+lUbQoTG7f8S0PkOdg==",
+      "version": "5.10.0",
+      "resolved": "https://registry.npmjs.org/@stylistic/eslint-plugin/-/eslint-plugin-5.10.0.tgz",
+      "integrity": "sha512-nPK52ZHvot8Ju/0A4ucSX1dcPV2/1clx0kLcH5wDmrE4naKso7TUC/voUyU1O9OTKTrR6MYip6LP0ogEMQ9jPQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.9.1",
-        "@typescript-eslint/types": "^8.53.1",
+        "@typescript-eslint/types": "^8.56.0",
         "eslint-visitor-keys": "^4.2.1",
         "espree": "^10.4.0",
         "estraverse": "^5.3.0",
@@ -4347,7 +4539,7 @@
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       },
       "peerDependencies": {
-        "eslint": ">=9.0.0"
+        "eslint": "^9.0.0 || ^10.0.0"
       }
     },
     "node_modules/@swc/core": {
@@ -4444,6 +4636,9 @@
       "cpu": [
         "arm64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "Apache-2.0 AND MIT",
       "optional": true,
       "os": [
@@ -4460,6 +4655,9 @@
       "cpu": [
         "arm64"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "Apache-2.0 AND MIT",
       "optional": true,
       "os": [
@@ -4476,6 +4674,9 @@
       "cpu": [
         "x64"
       ],
+      "libc": [
+        "glibc"
+      ],
       "license": "Apache-2.0 AND MIT",
       "optional": true,
       "os": [
@@ -4492,6 +4693,9 @@
       "cpu": [
         "x64"
       ],
+      "libc": [
+        "musl"
+      ],
       "license": "Apache-2.0 AND MIT",
       "optional": true,
       "os": [
@@ -4557,18 +4761,18 @@
       "license": "Apache-2.0"
     },
     "node_modules/@swc/helpers": {
-      "version": "0.5.18",
-      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.18.tgz",
-      "integrity": "sha512-TXTnIcNJQEKwThMMqBXsZ4VGAza6bvN4pa41Rkqoio6QBKMvo+5lexeTMScGCIxtzgQJzElcvIltani+adC5PQ==",
+      "version": "0.5.23",
+      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.23.tgz",
+      "integrity": "sha512-5lSsMOTXURePglDfvuAQUqkGek9Hg2kksOYay2m0+XR++b2NWYL/4sWyuvVBIs8oKnJaxkdi9whaL/sqN13afw==",
       "license": "Apache-2.0",
       "dependencies": {
         "tslib": "^2.8.0"
       }
     },
     "node_modules/@swc/types": {
-      "version": "0.1.25",
-      "resolved": "https://registry.npmjs.org/@swc/types/-/types-0.1.25.tgz",
-      "integrity": "sha512-iAoY/qRhNH8a/hBvm3zKj9qQ4oc2+3w1unPJa2XvTK3XjeLXtzcCingVPw/9e5mn1+0yPqxcBGp9Jf0pkfMb1g==",
+      "version": "0.1.26",
+      "resolved": "https://registry.npmjs.org/@swc/types/-/types-0.1.26.tgz",
+      "integrity": "sha512-lyMwd7WGgG79RS7EERZV3T8wMdmPq3xwyg+1nmAM64kIhx5yl+juO2PYIHb7vTiPgPCj8LYjsNV2T5wiQHUEaw==",
       "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -4576,9 +4780,9 @@
       }
     },
     "node_modules/@tabler/icons": {
-      "version": "3.36.1",
-      "resolved": "https://registry.npmjs.org/@tabler/icons/-/icons-3.36.1.tgz",
-      "integrity": "sha512-f4Jg3Fof/Vru5ioix/UO4GX+sdDsF9wQo47FbtvG+utIYYVQ/QVAC0QYgcBbAjQGfbdOh2CCf0BgiFOF9Ixtjw==",
+      "version": "3.44.0",
+      "resolved": "https://registry.npmjs.org/@tabler/icons/-/icons-3.44.0.tgz",
+      "integrity": "sha512-Wn0AOZG9sg0L+bjfMqq4eNhC6pQjIrk94LvvWYNYkY8KH8wC3YILRzQlrnVJc4FUeMxH/AK97QsYCX35H3LndA==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -5027,6 +5231,39 @@
         "path-browserify": "^1.0.1"
       }
     },
+    "node_modules/@ts-morph/common/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "devOptional": true,
+      "license": "MIT"
+    },
+    "node_modules/@ts-morph/common/node_modules/brace-expansion": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz",
+      "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0"
+      }
+    },
+    "node_modules/@ts-morph/common/node_modules/minimatch": {
+      "version": "9.0.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
+      "devOptional": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^2.0.2"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/@tsconfig/node10": {
       "version": "1.0.12",
       "resolved": "https://registry.npmjs.org/@tsconfig/node10/-/node10-1.0.12.tgz",
@@ -5151,9 +5388,9 @@
       }
     },
     "node_modules/@types/debug": {
-      "version": "4.1.12",
-      "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.12.tgz",
-      "integrity": "sha512-vIChWdVG3LG1SMxEvI/AK+FWJthlrqlTu7fbrlywTkkaONwk/UAGaULXRlf8vkzFBLVm0zkMdCquhL5aOjhXPQ==",
+      "version": "4.1.13",
+      "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.13.tgz",
+      "integrity": "sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw==",
       "license": "MIT",
       "dependencies": {
         "@types/ms": "*"
@@ -5190,9 +5427,9 @@
       }
     },
     "node_modules/@types/estree": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
-      "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
+      "integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
       "license": "MIT"
     },
     "node_modules/@types/estree-jsx": {
@@ -5315,9 +5552,9 @@
       "optional": true
     },
     "node_modules/@types/lodash": {
-      "version": "4.17.23",
-      "resolved": "https://registry.npmjs.org/@types/lodash/-/lodash-4.17.23.tgz",
-      "integrity": "sha512-RDvF6wTulMPjrNdCoYRC8gNR880JNGT8uB+REUpC2Ns4pRqQJhGz90wh7rgdXDPpCczF3VGktDuFGVnz8zP7HA==",
+      "version": "4.17.24",
+      "resolved": "https://registry.npmjs.org/@types/lodash/-/lodash-4.17.24.tgz",
+      "integrity": "sha512-gIW7lQLZbue7lRSWEFql49QJJWThrTFFeIMJdp3eH4tKoxm1OvEPg02rm4wCCSHS0cL3/Fizimb35b7k8atwsQ==",
       "license": "MIT"
     },
     "node_modules/@types/lodash-es": {
@@ -5415,9 +5652,9 @@
       "license": "MIT"
     },
     "node_modules/@types/qs": {
-      "version": "6.14.0",
-      "resolved": "https://registry.npmjs.org/@types/qs/-/qs-6.14.0.tgz",
-      "integrity": "sha512-eOunJqu0K1923aExK6y8p6fsihYEn/BYuQ4g0CxAAgFc4b/ZLN4CrsRZ55srTdqoiLzU2B2evC+apEIxprEzkQ==",
+      "version": "6.15.1",
+      "resolved": "https://registry.npmjs.org/@types/qs/-/qs-6.15.1.tgz",
+      "integrity": "sha512-GZHUBZR9hckSUhrxmp1nG6NwdpM9fCunJwyThLW1X3AyHgd9IlHb6VANpQQqDr2o/qQp6McZ3y/IA2rVzKzSbw==",
       "license": "MIT"
     },
     "node_modules/@types/range-parser": {
@@ -5544,20 +5781,20 @@
       "license": "MIT"
     },
     "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.54.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.54.0.tgz",
-      "integrity": "sha512-hAAP5io/7csFStuOmR782YmTthKBJ9ND3WVL60hcOjvtGFb+HJxH4O5huAcmcZ9v9G8P+JETiZ/G1B8MALnWZQ==",
+      "version": "8.61.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.61.0.tgz",
+      "integrity": "sha512-bFNvl9ZczlVb+wR2Akszf3gHfKVj/8WanXaGJ3UstTA7brNKg0cNdk6X1Psu5V7MZ2oQtzZKOEzIUehaoxbDGw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/regexpp": "^4.12.2",
-        "@typescript-eslint/scope-manager": "8.54.0",
-        "@typescript-eslint/type-utils": "8.54.0",
-        "@typescript-eslint/utils": "8.54.0",
-        "@typescript-eslint/visitor-keys": "8.54.0",
+        "@typescript-eslint/scope-manager": "8.61.0",
+        "@typescript-eslint/type-utils": "8.61.0",
+        "@typescript-eslint/utils": "8.61.0",
+        "@typescript-eslint/visitor-keys": "8.61.0",
         "ignore": "^7.0.5",
         "natural-compare": "^1.4.0",
-        "ts-api-utils": "^2.4.0"
+        "ts-api-utils": "^2.5.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -5567,9 +5804,9 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "@typescript-eslint/parser": "^8.54.0",
-        "eslint": "^8.57.0 || ^9.0.0",
-        "typescript": ">=4.8.4 <6.0.0"
+        "@typescript-eslint/parser": "^8.61.0",
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/@typescript-eslint/eslint-plugin/node_modules/ignore": {
@@ -5583,16 +5820,16 @@
       }
     },
     "node_modules/@typescript-eslint/parser": {
-      "version": "8.54.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.54.0.tgz",
-      "integrity": "sha512-BtE0k6cjwjLZoZixN0t5AKP0kSzlGu7FctRXYuPAm//aaiZhmfq1JwdYpYr1brzEspYyFeF+8XF5j2VK6oalrA==",
+      "version": "8.61.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.61.0.tgz",
+      "integrity": "sha512-5B7PfA2e1NQGCnDHd/0lW7W3gvp3d59Ryw54FYO8Uswxo9f6ikw3AZV+Xj/TvpImmpsiYyUqAfhC6kJID1jF6w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/scope-manager": "8.54.0",
-        "@typescript-eslint/types": "8.54.0",
-        "@typescript-eslint/typescript-estree": "8.54.0",
-        "@typescript-eslint/visitor-keys": "8.54.0",
+        "@typescript-eslint/scope-manager": "8.61.0",
+        "@typescript-eslint/types": "8.61.0",
+        "@typescript-eslint/typescript-estree": "8.61.0",
+        "@typescript-eslint/visitor-keys": "8.61.0",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -5603,19 +5840,19 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "eslint": "^8.57.0 || ^9.0.0",
-        "typescript": ">=4.8.4 <6.0.0"
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/@typescript-eslint/project-service": {
-      "version": "8.54.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.54.0.tgz",
-      "integrity": "sha512-YPf+rvJ1s7MyiWM4uTRhE4DvBXrEV+d8oC3P9Y2eT7S+HBS0clybdMIPnhiATi9vZOYDc7OQ1L/i6ga6NFYK/g==",
+      "version": "8.61.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.61.0.tgz",
+      "integrity": "sha512-DV42F7MLJO6Rax7SK1yg43tcnEfGUrurSpSxKuVX+a3RCTzBlH3fuxprrOJXKCJGAaw82xXocikJ0uQaqwXgGA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.54.0",
-        "@typescript-eslint/types": "^8.54.0",
+        "@typescript-eslint/tsconfig-utils": "^8.61.0",
+        "@typescript-eslint/types": "^8.61.0",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -5626,18 +5863,18 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "typescript": ">=4.8.4 <6.0.0"
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.54.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.54.0.tgz",
-      "integrity": "sha512-27rYVQku26j/PbHYcVfRPonmOlVI6gihHtXFbTdB5sb6qA0wdAQAbyXFVarQ5t4HRojIz64IV90YtsjQSSGlQg==",
+      "version": "8.61.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.61.0.tgz",
+      "integrity": "sha512-IWdXFHFSb6mlC3HPc7QsLDm5zYEbUla6trDEHf32D3/dnuUyXd87plScSNXSbm0/RxMvObpI17sv/EDTGrGZkA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.54.0",
-        "@typescript-eslint/visitor-keys": "8.54.0"
+        "@typescript-eslint/types": "8.61.0",
+        "@typescript-eslint/visitor-keys": "8.61.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -5648,9 +5885,9 @@
       }
     },
     "node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.54.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.54.0.tgz",
-      "integrity": "sha512-dRgOyT2hPk/JwxNMZDsIXDgyl9axdJI3ogZ2XWhBPsnZUv+hPesa5iuhdYt2gzwA9t8RE5ytOJ6xB0moV0Ujvw==",
+      "version": "8.61.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.61.0.tgz",
+      "integrity": "sha512-O5Amvdv9ztMpxpf+vmFULGG78IE6Qwdr3bCGvqwG4nwc9H2qXkOYJJnRbRHyMkQTjv1d03olqwwwzHLMqpFePQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -5661,21 +5898,21 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "typescript": ">=4.8.4 <6.0.0"
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.54.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.54.0.tgz",
-      "integrity": "sha512-hiLguxJWHjjwL6xMBwD903ciAwd7DmK30Y9Axs/etOkftC3ZNN9K44IuRD/EB08amu+Zw6W37x9RecLkOo3pMA==",
+      "version": "8.61.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.61.0.tgz",
+      "integrity": "sha512-TuBiQYIkd97yBfInHCTKVYMbX4kvEmpOEuixIuzCU9p8BGT1SfyyO0d0IfDMbPIHcjn/hWnusUX5e8v5Xg+X8A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.54.0",
-        "@typescript-eslint/typescript-estree": "8.54.0",
-        "@typescript-eslint/utils": "8.54.0",
+        "@typescript-eslint/types": "8.61.0",
+        "@typescript-eslint/typescript-estree": "8.61.0",
+        "@typescript-eslint/utils": "8.61.0",
         "debug": "^4.4.3",
-        "ts-api-utils": "^2.4.0"
+        "ts-api-utils": "^2.5.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -5685,14 +5922,14 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "eslint": "^8.57.0 || ^9.0.0",
-        "typescript": ">=4.8.4 <6.0.0"
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/@typescript-eslint/types": {
-      "version": "8.54.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.54.0.tgz",
-      "integrity": "sha512-PDUI9R1BVjqu7AUDsRBbKMtwmjWcn4J3le+5LpcFgWULN3LvHC5rkc9gCVxbrsrGmO1jfPybN5s6h4Jy+OnkAA==",
+      "version": "8.61.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.61.0.tgz",
+      "integrity": "sha512-9QTQpZ5Iin4CdIodfbDQFSeiSJKidgYJYug1P9CC2xWgUTvlmixViqDZNciMjwLBZyJnG4tGmPl97rVAFb1AJg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -5704,21 +5941,21 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.54.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.54.0.tgz",
-      "integrity": "sha512-BUwcskRaPvTk6fzVWgDPdUndLjB87KYDrN5EYGetnktoeAvPtO4ONHlAZDnj5VFnUANg0Sjm7j4usBlnoVMHwA==",
+      "version": "8.61.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.61.0.tgz",
+      "integrity": "sha512-42zatd5qSvvcV1JdDBCLxYRznvP4eIHpPoZXdkPFnAmanA4FuZ5dibSnCBggY8hQnqajPpoGjXFdZ7fIJKQnlA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/project-service": "8.54.0",
-        "@typescript-eslint/tsconfig-utils": "8.54.0",
-        "@typescript-eslint/types": "8.54.0",
-        "@typescript-eslint/visitor-keys": "8.54.0",
+        "@typescript-eslint/project-service": "8.61.0",
+        "@typescript-eslint/tsconfig-utils": "8.61.0",
+        "@typescript-eslint/types": "8.61.0",
+        "@typescript-eslint/visitor-keys": "8.61.0",
         "debug": "^4.4.3",
-        "minimatch": "^9.0.5",
+        "minimatch": "^10.2.2",
         "semver": "^7.7.3",
         "tinyglobby": "^0.2.15",
-        "ts-api-utils": "^2.4.0"
+        "ts-api-utils": "^2.5.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -5728,20 +5965,20 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "typescript": ">=4.8.4 <6.0.0"
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/@typescript-eslint/utils": {
-      "version": "8.54.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.54.0.tgz",
-      "integrity": "sha512-9Cnda8GS57AQakvRyG0PTejJNlA2xhvyNtEVIMlDWOOeEyBkYWhGPnfrIAnqxLMTSTo6q8g12XVjjev5l1NvMA==",
+      "version": "8.61.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.61.0.tgz",
+      "integrity": "sha512-3bzFt7ImFMW/jVYwJamDoe/dMOdFLSC6pom6rRjdh4SZJEYupyMzem8e7vKZLclLfpHjlwSAXOUxtKxGXUiLqA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.9.1",
-        "@typescript-eslint/scope-manager": "8.54.0",
-        "@typescript-eslint/types": "8.54.0",
-        "@typescript-eslint/typescript-estree": "8.54.0"
+        "@typescript-eslint/scope-manager": "8.61.0",
+        "@typescript-eslint/types": "8.61.0",
+        "@typescript-eslint/typescript-estree": "8.61.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -5751,19 +5988,19 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "eslint": "^8.57.0 || ^9.0.0",
-        "typescript": ">=4.8.4 <6.0.0"
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.54.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.54.0.tgz",
-      "integrity": "sha512-VFlhGSl4opC0bprJiItPQ1RfUhGDIBokcPwaFH4yiBCaNPeld/9VeXbiPO1cLyorQi1G1vL+ecBk1x8o1axORA==",
+      "version": "8.61.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.61.0.tgz",
+      "integrity": "sha512-QVLZu3ZPQEE+HICQyAMZ2yLQhxf0meY/wx6Hx14YcTNj13JB3qHlX3lJ02L3fLGHgERRH71kvYDwiXIguT3AjQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.54.0",
-        "eslint-visitor-keys": "^4.2.1"
+        "@typescript-eslint/types": "8.61.0",
+        "eslint-visitor-keys": "^5.0.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -5773,28 +6010,41 @@
         "url": "https://opencollective.com/typescript-eslint"
       }
     },
+    "node_modules/@typescript-eslint/visitor-keys/node_modules/eslint-visitor-keys": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-5.0.1.tgz",
+      "integrity": "sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
     "node_modules/@ungap/structured-clone": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.0.tgz",
-      "integrity": "sha512-WmoN8qaIAo7WTYWbAZuG8PYEhn5fkz7dZrqTBZ7dtt//lL2Gwms1IcnQ5yHqjDfX8Ft5j4YzDM23f87zBfDe9g==",
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.1.tgz",
+      "integrity": "sha512-mUFwbeTqrVgDQxFveS+df2yfap6iuP20NAKAsBt5jDEoOTDew+zwLAOilHCeQJOVSvmgCX4ogqIrA0mnyr08yQ==",
       "license": "ISC"
     },
     "node_modules/@uppy/components": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@uppy/components/-/components-1.1.0.tgz",
-      "integrity": "sha512-omiNBzJn49FQznkSwOIGn3TKz+3r4T+y8sxWIBDMO6De2genzywRk1drAWO9GbSAF3htlVuvamNojQ2pSLeh3w==",
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/@uppy/components/-/components-1.2.0.tgz",
+      "integrity": "sha512-rtIr+77Rw/q5Vw++xazF1dCg2d4A4zT9CV+ZyN8Rsx8xiIr2CxCR4TaHHBy+WeC0b7Mk6yNuJ0wUa34tFJ6pKg==",
       "license": "MIT",
       "dependencies": {
         "clsx": "^2.1.1",
         "dequal": "^2.0.3",
-        "preact": "^10.5.13",
+        "preact": "^10.26.10",
         "pretty-bytes": "^6.1.1"
       },
       "peerDependencies": {
-        "@uppy/core": "^5.1.1",
-        "@uppy/image-editor": "^4.0.2",
-        "@uppy/screen-capture": "^5.0.1",
-        "@uppy/webcam": "^5.0.2"
+        "@uppy/core": "^5.2.0",
+        "@uppy/image-editor": "^4.2.0",
+        "@uppy/screen-capture": "^5.1.0",
+        "@uppy/webcam": "^5.1.0"
       },
       "peerDependenciesMeta": {
         "@uppy/image-editor": {
@@ -5915,19 +6165,20 @@
       }
     },
     "node_modules/@uppy/utils": {
-      "version": "7.1.5",
-      "resolved": "https://registry.npmjs.org/@uppy/utils/-/utils-7.1.5.tgz",
-      "integrity": "sha512-Vz4WGTjef6WebECGur4clWjpkET4o3bdvPMj1m2sD5cL+dTt69m+FIE5h5JD3HBMLEPTXPVkrXGMIFcbOYC12Q==",
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/@uppy/utils/-/utils-7.2.0.tgz",
+      "integrity": "sha512-6lC246qszMv6bTyl/+QyHwrudgeguWkA94ME1wHn+a6uRAvmtAEaUManIfGqTJfoKvWAiCJqdJPl5xRJjhAloQ==",
       "license": "MIT",
       "dependencies": {
-        "lodash": "^4.17.21",
-        "preact": "^10.5.13"
+        "lodash": "^4.17.23",
+        "preact": "^10.26.10"
       }
     },
     "node_modules/@vavite/multibuild": {
       "version": "5.1.0",
       "resolved": "https://registry.npmjs.org/@vavite/multibuild/-/multibuild-5.1.0.tgz",
       "integrity": "sha512-xhJS6oAhQqDCRFFmpZWNCcAJw7145pvlfKX/IOCQX7oqulbw9amH9rdrNXmwz79UeYgOwxXpWfEavyYTPLY1KQ==",
+      "deprecated": "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.",
       "license": "MIT",
       "dependencies": {
         "@types/node": "^18.19.67",
@@ -6111,9 +6362,9 @@
       }
     },
     "node_modules/acorn": {
-      "version": "8.15.0",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
-      "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
+      "version": "8.16.0",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.16.0.tgz",
+      "integrity": "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==",
       "license": "MIT",
       "bin": {
         "acorn": "bin/acorn"
@@ -6133,9 +6384,9 @@
       }
     },
     "node_modules/acorn-walk": {
-      "version": "8.3.4",
-      "resolved": "https://registry.npmjs.org/acorn-walk/-/acorn-walk-8.3.4.tgz",
-      "integrity": "sha512-ueEepnujpqee2o5aIYnvHU6C0A42MNdsIDeqy5BydrkuC5R1ZuUFnm27EeFJGoEHJQgn3uleRvmTXaJgfXbt4g==",
+      "version": "8.3.5",
+      "resolved": "https://registry.npmjs.org/acorn-walk/-/acorn-walk-8.3.5.tgz",
+      "integrity": "sha512-HEHNfbars9v4pgpW6SO1KSPkfoS0xVOM/9UzkJltjlsHZmJasxg8aXkuZa7SMf8vKGIBhpUsPluQSqhJFCqebw==",
       "license": "MIT",
       "dependencies": {
         "acorn": "^8.11.0"
@@ -6145,18 +6396,21 @@
       }
     },
     "node_modules/agent-base": {
-      "version": "7.1.4",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
-      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
+      "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
       "license": "MIT",
+      "dependencies": {
+        "debug": "4"
+      },
       "engines": {
-        "node": ">= 14"
+        "node": ">= 6.0.0"
       }
     },
     "node_modules/ajv": {
-      "version": "6.12.6",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
-      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
+      "version": "6.15.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
+      "integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6180,9 +6434,9 @@
       }
     },
     "node_modules/ansi-escapes": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-7.2.0.tgz",
-      "integrity": "sha512-g6LhBsl+GBPRWGWsBtutpzBYuIIdBkLEvad5C/va/74Db018+5TZiyA26cZJAr3Rft5lprVqOIPxf5Vid6tqAw==",
+      "version": "7.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-7.3.0.tgz",
+      "integrity": "sha512-BvU8nYgGQBxcmMuEeUEmNTvrMVjJNSH7RgW24vXexN4Ven6qCvy4TntnvlnwnMLTVlcRQQdbRY8NKnaIoeWDNg==",
       "license": "MIT",
       "dependencies": {
         "environment": "^1.0.0"
@@ -6218,6 +6472,18 @@
         "url": "https://github.com/chalk/ansi-styles?sponsor=1"
       }
     },
+    "node_modules/anynum": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/anynum/-/anynum-1.0.0.tgz",
+      "integrity": "sha512-xjR9/zBVnUOP6ztMIIgShjsxui80nQUQH+5xJnvrYLs+90bF25/KJqaAi8mk+B4RDtX1Nspi6fmp4YTEts8SfA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/arg": {
       "version": "4.1.3",
       "resolved": "https://registry.npmjs.org/arg/-/arg-4.1.3.tgz",
@@ -6231,6 +6497,18 @@
       "dev": true,
       "license": "Python-2.0"
     },
+    "node_modules/aria-hidden": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/aria-hidden/-/aria-hidden-1.2.6.tgz",
+      "integrity": "sha512-ik3ZgC9dY/lYVVM++OISsaYDeg1tb0VtP5uL3ouh1koGOaUMDPpbFIei4JkFimWUFPn90sbMNMXQAIVOlnYKJA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/arr-union": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/arr-union/-/arr-union-3.1.0.tgz",
@@ -6380,31 +6658,6 @@
         "proxy-from-env": "^2.1.0"
       }
     },
-    "node_modules/axios/node_modules/agent-base": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
-      "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
-      "license": "MIT",
-      "dependencies": {
-        "debug": "4"
-      },
-      "engines": {
-        "node": ">= 6.0.0"
-      }
-    },
-    "node_modules/axios/node_modules/https-proxy-agent": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
-      "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
-      "license": "MIT",
-      "dependencies": {
-        "agent-base": "6",
-        "debug": "4"
-      },
-      "engines": {
-        "node": ">= 6"
-      }
-    },
     "node_modules/bail": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/bail/-/bail-2.0.2.tgz",
@@ -6416,11 +6669,14 @@
       }
     },
     "node_modules/balanced-match": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
-      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
     },
     "node_modules/base64-js": {
       "version": "1.5.1",
@@ -6443,12 +6699,15 @@
       "license": "MIT"
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.9.19",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.9.19.tgz",
-      "integrity": "sha512-ipDqC8FrAl/76p2SSWKSI+H9tFwm7vYqXQrItCuiVPt26Km0jS+NzSsBWAaBusvSbQcfJG+JitdMm+wZAgTYqg==",
+      "version": "2.10.35",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.35.tgz",
+      "integrity": "sha512-honAfLBde0HAFLdNyBEfuuENkF6zR+ozxqxa/2zJKHBe1qzLqyTSeRKpdPEHAP03rlDGyQOPnCSxnVpVqQo9Mg==",
       "license": "Apache-2.0",
       "bin": {
-        "baseline-browser-mapping": "dist/cli.js"
+        "baseline-browser-mapping": "dist/cli.cjs"
+      },
+      "engines": {
+        "node": ">=6.0.0"
       }
     },
     "node_modules/basic-auth": {
@@ -6525,9 +6784,10 @@
       "license": "ISC"
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.3",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.3.tgz",
-      "integrity": "sha512-fy6KJm2RawA5RcHkLa1z/ScpBeA762UF9KmZQxwIbDtRJrgLzM10depAiEQ+CXYcoiqW1/m96OAAoke2nE9EeA==",
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
+      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
@@ -6536,15 +6796,6 @@
         "node": "18 || 20 || >=22"
       }
     },
-    "node_modules/brace-expansion/node_modules/balanced-match": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
-      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
-      "license": "MIT",
-      "engines": {
-        "node": "18 || 20 || >=22"
-      }
-    },
     "node_modules/braces": {
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
@@ -6558,9 +6809,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.28.1",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.1.tgz",
-      "integrity": "sha512-ZC5Bd0LgJXgwGqUknZY/vkUQ04r8NXnJZ3yYi4vDmSiZmC/pdSN0NbNRPxZpbtO4uAfDUAFffO8IZoM3Gj8IkA==",
+      "version": "4.28.2",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.2.tgz",
+      "integrity": "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==",
       "funding": [
         {
           "type": "opencollective",
@@ -6577,11 +6828,11 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "baseline-browser-mapping": "^2.9.0",
-        "caniuse-lite": "^1.0.30001759",
-        "electron-to-chromium": "^1.5.263",
-        "node-releases": "^2.0.27",
-        "update-browserslist-db": "^1.2.0"
+        "baseline-browser-mapping": "^2.10.12",
+        "caniuse-lite": "^1.0.30001782",
+        "electron-to-chromium": "^1.5.328",
+        "node-releases": "^2.0.36",
+        "update-browserslist-db": "^1.2.3"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -6624,9 +6875,9 @@
       }
     },
     "node_modules/builtin-modules": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/builtin-modules/-/builtin-modules-5.0.0.tgz",
-      "integrity": "sha512-bkXY9WsVpY7CvMhKSR6pZilZu9Ln5WDrKVBUXf2S443etkmEO4V58heTecXcUIsNsi4Rx8JUO4NfX1IcQl4deg==",
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/builtin-modules/-/builtin-modules-5.2.0.tgz",
+      "integrity": "sha512-02yxLeyxF4dNl6SlY6/5HfRSrSdZ/sCPoxy2kZNP5dZZX8LSAD9aE2gtJIUgWrsQTiMPl3mxESyrobSwvRGisQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6651,6 +6902,18 @@
         "uuid": "11.1.0"
       }
     },
+    "node_modules/bullmq/node_modules/semver": {
+      "version": "7.7.3",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
+      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/bytes": {
       "version": "3.1.2",
       "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
@@ -6769,9 +7032,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001766",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001766.tgz",
-      "integrity": "sha512-4C0lfJ0/YPjJQHagaE9x2Elb69CIqEPZeG0anQt9SIvIoOH4a4uaRl73IavyO+0qZh6MDLH//DrXThEYKHkmYA==",
+      "version": "1.0.30001797",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001797.tgz",
+      "integrity": "sha512-l8xKG+gwAIExZGl9FrF7KUwuOmk6wbEPC9Xoy/RtnWv1XG0Q4LFlagaLpUv3Kiza3W/wm27zy0yWJEieYKAP6w==",
       "funding": [
         {
           "type": "opencollective",
@@ -6947,29 +7210,36 @@
       }
     },
     "node_modules/cheerio/node_modules/undici": {
-      "version": "7.24.3",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.24.3.tgz",
-      "integrity": "sha512-eJdUmK/Wrx2d+mnWWmwwLRyA7OQCkLap60sk3dOK4ViZR7DKwwptwuIvFBg2HaiP9ESaEdhtpSymQPvytpmkCA==",
+      "version": "7.27.2",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.27.2.tgz",
+      "integrity": "sha512-uZsKNuzQxDMUY6M3pIMvy5tvlGmtq8XJ2oLAkfRKGNu+1VQAIvLy2xIVG5ATZl5wDXl/tddByAWCizRbOme+TA==",
       "license": "MIT",
       "engines": {
         "node": ">=20.18.1"
       }
     },
     "node_modules/chevrotain": {
-      "version": "11.1.1",
-      "resolved": "https://registry.npmjs.org/chevrotain/-/chevrotain-11.1.1.tgz",
-      "integrity": "sha512-f0yv5CPKaFxfsPTBzX7vGuim4oIC1/gcS7LUGdBSwl2dU6+FON6LVUksdOo1qJjoUvXNn45urgh8C+0a24pACQ==",
+      "version": "11.2.0",
+      "resolved": "https://registry.npmjs.org/chevrotain/-/chevrotain-11.2.0.tgz",
+      "integrity": "sha512-mHCHTxM51nCklUw9RzRVc0DLjAh/SAUPM4k/zMInlTIo25ldWXOZoPt7XEIk/LwoT4lFVmJcu9g5MHtx371x3A==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@chevrotain/cst-dts-gen": "11.1.1",
-        "@chevrotain/gast": "11.1.1",
-        "@chevrotain/regexp-to-ast": "11.1.1",
-        "@chevrotain/types": "11.1.1",
-        "@chevrotain/utils": "11.1.1",
+        "@chevrotain/cst-dts-gen": "11.2.0",
+        "@chevrotain/gast": "11.2.0",
+        "@chevrotain/regexp-to-ast": "11.2.0",
+        "@chevrotain/types": "11.2.0",
+        "@chevrotain/utils": "11.2.0",
         "lodash-es": "4.17.23"
       }
     },
+    "node_modules/chevrotain/node_modules/lodash-es": {
+      "version": "4.17.23",
+      "resolved": "https://registry.npmjs.org/lodash-es/-/lodash-es-4.17.23.tgz",
+      "integrity": "sha512-kVI48u3PZr38HdYz98UmfPnXl2DXrpdctLrFLCd3kOx1xUkOmpFPx7gCWWM5MPkL/fD8zb+Ph0QzjGFs4+hHWg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/chokidar": {
       "version": "4.0.3",
       "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-4.0.3.tgz",
@@ -7039,6 +7309,18 @@
         "node": ">=0.8.0"
       }
     },
+    "node_modules/cli-boxes": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/cli-boxes/-/cli-boxes-4.0.1.tgz",
+      "integrity": "sha512-5IOn+jcCEHEraYolBPs/sT4BxYCe2nHg374OPiItB1O96KZFseS2gthU4twyYzeDcFew4DaUM/xwc5BQf08JJw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.20 <19 || >=20.10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/cli-cursor": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/cli-cursor/-/cli-cursor-5.0.0.tgz",
@@ -7099,13 +7381,13 @@
       }
     },
     "node_modules/cli-truncate": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/cli-truncate/-/cli-truncate-5.1.1.tgz",
-      "integrity": "sha512-SroPvNHxUnk+vIW/dOSfNqdy1sPEFkrTk6TUtqLCnBlo3N7TNYYkzzN7uSD6+jVjrdO4+p8nH7JzH6cIvUem6A==",
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/cli-truncate/-/cli-truncate-5.2.0.tgz",
+      "integrity": "sha512-xRwvIOMGrfOAnM1JYtqQImuaNtDEv9v6oIYAs4LIHwTiKee8uwvIi363igssOC0O5U04i4AlENs79LQLu9tEMw==",
       "license": "MIT",
       "dependencies": {
-        "slice-ansi": "^7.1.0",
-        "string-width": "^8.0.0"
+        "slice-ansi": "^8.0.0",
+        "string-width": "^8.2.0"
       },
       "engines": {
         "node": ">=20"
@@ -7127,13 +7409,13 @@
       }
     },
     "node_modules/cli-truncate/node_modules/string-width": {
-      "version": "8.1.1",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-8.1.1.tgz",
-      "integrity": "sha512-KpqHIdDL9KwYk22wEOg/VIqYbrnLeSApsKT/bSj6Ez7pn3CftUiLAv2Lccpq1ALcpLV9UX1Ppn92npZWu2w/aw==",
+      "version": "8.2.1",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-8.2.1.tgz",
+      "integrity": "sha512-IIaP0g3iy9Cyy18w3M9YcaDudujEAVHKt3a3QJg1+sr/oX96TbaGUubG0hJyCjCBThFH+tFpcIyoUHUn1ogaLA==",
       "license": "MIT",
       "dependencies": {
-        "get-east-asian-width": "^1.3.0",
-        "strip-ansi": "^7.1.0"
+        "get-east-asian-width": "^1.5.0",
+        "strip-ansi": "^7.1.2"
       },
       "engines": {
         "node": ">=20"
@@ -7143,12 +7425,12 @@
       }
     },
     "node_modules/cli-truncate/node_modules/strip-ansi": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.2.tgz",
-      "integrity": "sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA==",
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
+      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
       "license": "MIT",
       "dependencies": {
-        "ansi-regex": "^6.0.1"
+        "ansi-regex": "^6.2.2"
       },
       "engines": {
         "node": ">=12"
@@ -7378,25 +7660,16 @@
       }
     },
     "node_modules/content-type": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
-      "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
+      "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
       "license": "MIT",
       "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/convert-hrtime": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/convert-hrtime/-/convert-hrtime-5.0.0.tgz",
-      "integrity": "sha512-lOETlkIeYSJWcbbcvjRKGxVMXJR+8+OQb/mTPbA4ObPMytYIsUbuOE0Jzy60hjARYszq1id0j8KgVhC+WGZVTg==",
-      "devOptional": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
+        "node": ">=18"
       },
       "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/convert-source-map": {
@@ -7419,9 +7692,9 @@
       }
     },
     "node_modules/cookie-es": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/cookie-es/-/cookie-es-2.0.0.tgz",
-      "integrity": "sha512-RAj4E421UYRgqokKUmotqAwuplYw15qtdXfY+hGzgCJ/MBjCVZcSoHK/kH9kocfjRjcDME7IiDWR/1WX1TM2Pg==",
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/cookie-es/-/cookie-es-3.1.1.tgz",
+      "integrity": "sha512-UaXxwISYJPTr9hwQxMFYZ7kNhSXboMXP+Z3TRX6f1/NyaGPfuNUZOWP1pUEb75B2HjfklIYLVRfWiFZJyC6Npg==",
       "devOptional": true,
       "license": "MIT"
     },
@@ -7443,9 +7716,9 @@
       }
     },
     "node_modules/core-js-compat": {
-      "version": "3.48.0",
-      "resolved": "https://registry.npmjs.org/core-js-compat/-/core-js-compat-3.48.0.tgz",
-      "integrity": "sha512-OM4cAF3D6VtH/WkLtWvyNC56EZVXsZdU3iqaMG2B4WvYrlqU831pc4UtG5yp0sE9z8Y02wVN7PjW5Zf9Gt0f1Q==",
+      "version": "3.49.0",
+      "resolved": "https://registry.npmjs.org/core-js-compat/-/core-js-compat-3.49.0.tgz",
+      "integrity": "sha512-VQXt1jr9cBz03b331DFDCCP90b3fanciLkgiOoy8SBHy06gNf+vQ1A3WFLqG7I8TipYIKeYK9wxd0tUrvHcOZA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7593,9 +7866,9 @@
       }
     },
     "node_modules/dayjs": {
-      "version": "1.11.19",
-      "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.19.tgz",
-      "integrity": "sha512-t5EcLVS6QPBNqM2z8fakk/NKel+Xzshgt8FFKAn+qwlD1pzZWxh0nVCrvFK7ZDb6XucZeF9z8C7CBWTRIVApAw==",
+      "version": "1.11.21",
+      "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.21.tgz",
+      "integrity": "sha512-98IT+HOahAisibz/yjKbzuOBwYcjJ7BCLPzARyHiyEBmRz4fatF+KPJszEHXsGYjUG234aH/cOjW1wwTbKUZlA==",
       "license": "MIT"
     },
     "node_modules/debug": {
@@ -7644,9 +7917,9 @@
       }
     },
     "node_modules/dedent": {
-      "version": "1.7.1",
-      "resolved": "https://registry.npmjs.org/dedent/-/dedent-1.7.1.tgz",
-      "integrity": "sha512-9JmrhGZpOlEgOLdQgSm0zxFaYoQon408V1v49aqTWuXENVlnCuY9JBZcXZiCsZQWDjTm5Qf/nIvAy77mXDAjEg==",
+      "version": "1.7.2",
+      "resolved": "https://registry.npmjs.org/dedent/-/dedent-1.7.2.tgz",
+      "integrity": "sha512-WzMx3mW98SN+zn3hgemf4OzdmyNhhhKz5Ay0pUfQiMQ3e1g+xmTJWp/pKdwKVXhdSkAEGIIzqeuWrL3mV/AXbA==",
       "devOptional": true,
       "license": "MIT",
       "peerDependencies": {
@@ -7758,9 +8031,9 @@
       "license": "MIT"
     },
     "node_modules/docker-modem": {
-      "version": "5.0.6",
-      "resolved": "https://registry.npmjs.org/docker-modem/-/docker-modem-5.0.6.tgz",
-      "integrity": "sha512-ens7BiayssQz/uAxGzH8zGXCtiV24rRWXdjNha5V4zSOcxmAZsfGVm/PPFbwQdqEkDnhG+SyR9E3zSHUbOKXBQ==",
+      "version": "5.0.7",
+      "resolved": "https://registry.npmjs.org/docker-modem/-/docker-modem-5.0.7.tgz",
+      "integrity": "sha512-XJgGhoR/CLpqshm4d3L7rzH6t8NgDFUIIpztYlLHIApeJjMZKYJMz2zxPsYxnejq5h3ELYSw/RBsi3t5h7gNTA==",
       "license": "Apache-2.0",
       "dependencies": {
         "debug": "^4.1.1",
@@ -7794,6 +8067,7 @@
       "version": "10.0.0",
       "resolved": "https://registry.npmjs.org/uuid/-/uuid-10.0.0.tgz",
       "integrity": "sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==",
+      "deprecated": "uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).",
       "funding": [
         "https://github.com/sponsors/broofa",
         "https://github.com/sponsors/ctavan"
@@ -7906,31 +8180,31 @@
       }
     },
     "node_modules/edge-lexer": {
-      "version": "6.0.4",
-      "resolved": "https://registry.npmjs.org/edge-lexer/-/edge-lexer-6.0.4.tgz",
-      "integrity": "sha512-rHlTSZUQfBu/fwnAjoaLCGGmDzpRPgUC8FEqNdJtpPEjBRCqU3a4Le7iJ8KSQfY2WvWx6NTGAwti62xj3eIz1w==",
+      "version": "6.0.5",
+      "resolved": "https://registry.npmjs.org/edge-lexer/-/edge-lexer-6.0.5.tgz",
+      "integrity": "sha512-paSprHn8GRzOUWTVLapgacqDBSOpJgOY60/V5QQ8bbNLHRKUMSxp8Z2oOO0WKtcKmb5+sAlmvG3izhbFulp19A==",
       "license": "MIT",
       "dependencies": {
         "edge-error": "^4.0.2"
       },
       "engines": {
-        "node": ">=18.16.0"
+        "node": ">=24.0.0"
       }
     },
     "node_modules/edge-parser": {
-      "version": "9.1.0",
-      "resolved": "https://registry.npmjs.org/edge-parser/-/edge-parser-9.1.0.tgz",
-      "integrity": "sha512-Z7sEbRNjjGuUVch3ELHMbjgksVjQlAjUASCwUWe+1I+nJ0mVBmUD2rn6zyes/+EjLssvEGQcIWMjLMNn1ChXgQ==",
+      "version": "9.1.1",
+      "resolved": "https://registry.npmjs.org/edge-parser/-/edge-parser-9.1.1.tgz",
+      "integrity": "sha512-kem/vInJgTzHCABdFe060WGjyGva8j23QwVbZkNFXkNAQhRz3mga5kNBuPFYQ3t73nPT2vZ8WOGV4OCS0P16Cw==",
       "license": "MIT",
       "dependencies": {
-        "acorn": "^8.15.0",
+        "acorn": "^8.16.0",
         "astring": "^1.9.0",
         "edge-error": "^4.0.2",
-        "edge-lexer": "^6.0.4",
+        "edge-lexer": "^6.0.5",
         "js-stringify": "^1.0.2"
       },
       "engines": {
-        "node": ">=18.16.0"
+        "node": ">=24.0.0"
       }
     },
     "node_modules/edge.js": {
@@ -7954,9 +8228,9 @@
       }
     },
     "node_modules/edge.js/node_modules/@poppinss/utils": {
-      "version": "7.0.0-next.6",
-      "resolved": "https://registry.npmjs.org/@poppinss/utils/-/utils-7.0.0-next.6.tgz",
-      "integrity": "sha512-1OQDbCKmFROvWpmzvkQV/mCzBXSwhED8SJfJ0HiYKiLNEqYM8Kpa4EK0AfmXGQc+DdIj6eqib/vT8i5tJ2fatw==",
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/@poppinss/utils/-/utils-7.0.1.tgz",
+      "integrity": "sha512-mveSvLI2YPC114mK5HCuSYfUtjpClf1wHG1VCqZJCp4U2ypPhIt62Iku5urh0kPAFvnvCVHx2bXBSH14qMTOlQ==",
       "license": "MIT",
       "dependencies": {
         "@poppinss/exception": "^1.2.3",
@@ -7967,13 +8241,13 @@
       }
     },
     "node_modules/edgejs-parser": {
-      "version": "0.2.18",
-      "resolved": "https://registry.npmjs.org/edgejs-parser/-/edgejs-parser-0.2.18.tgz",
-      "integrity": "sha512-O1Xg3ISESg2bl8DqP5q3x1b88cqTSgLmEBqNhGH482JdAIexDY7gh7FA9Y5kHOFwRNsTLFoziwQou0lprJ1MYQ==",
+      "version": "0.2.19",
+      "resolved": "https://registry.npmjs.org/edgejs-parser/-/edgejs-parser-0.2.19.tgz",
+      "integrity": "sha512-KO9pF1JSd6dDL7+hJM1W7PbzdTV/siSCoYbN3Ej84csh4RUBd14NvE4uzm4LOiuph9w/j+YlcBkPyp0C5SOzrQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "chevrotain": "^11.0.3"
+        "chevrotain": "^11.1.2"
       }
     },
     "node_modules/ee-first": {
@@ -7983,15 +8257,15 @@
       "license": "MIT"
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.283",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.283.tgz",
-      "integrity": "sha512-3vifjt1HgrGW/h76UEeny+adYApveS9dH2h3p57JYzBSXJIKUJAvtmIytDKjcSCt9xHfrNCFJ7gts6vkhuq++w==",
+      "version": "1.5.370",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.370.tgz",
+      "integrity": "sha512-D5tSHJReAb/Kf3Hu9F/GO4lJuSWzEWHwvQ/kKSUP7pimNgvxkSKj+gUQhHpKKACwrin7rS3byU7IxreF56rl5g==",
       "license": "ISC"
     },
     "node_modules/emittery": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/emittery/-/emittery-1.2.0.tgz",
-      "integrity": "sha512-KxdRyyFcS85pH3dnU8Y5yFUm2YJdaHwcBZWrfG8o89ZY9a13/f9itbN+YG3ELbBo9Pg5zvIozstmuV8bX13q6g==",
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/emittery/-/emittery-1.2.1.tgz",
+      "integrity": "sha512-sFz64DCRjirhwHLxofFqxYQm6DCp6o0Ix7jwKQvuCHPn4GMRZNuBZyLPu9Ccmk/QSCAMZt6FOUqA8JZCQvA9fw==",
       "license": "MIT",
       "engines": {
         "node": ">=14.16"
@@ -8038,31 +8312,6 @@
         "url": "https://github.com/fb55/encoding-sniffer?sponsor=1"
       }
     },
-    "node_modules/encoding-sniffer/node_modules/iconv-lite": {
-      "version": "0.6.3",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
-      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
-      "license": "MIT",
-      "dependencies": {
-        "safer-buffer": ">= 2.1.2 < 3.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/encoding/node_modules/iconv-lite": {
-      "version": "0.6.3",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
-      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "safer-buffer": ">= 2.1.2 < 3.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/end-of-stream": {
       "version": "1.4.5",
       "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz",
@@ -8073,9 +8322,9 @@
       }
     },
     "node_modules/enhanced-resolve": {
-      "version": "5.22.0",
-      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.22.0.tgz",
-      "integrity": "sha512-xYcDWrpELkFzz9SpZ3PlI6Eu6eD93Yf0WLDRxikGhWJ3MAir2SNZTIVCVZqZ/NUyx8AdMc2gT9C0gPiw18kG+A==",
+      "version": "5.23.0",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.23.0.tgz",
+      "integrity": "sha512-yJN/BOOLxcOW2aQgeif9mSnaUB8KtvmMMp56oA1kx1CRfBKbhZm2pJ+NBY+3eOboHxix8lfjWpHE0Ei5U8RbSA==",
       "license": "MIT",
       "dependencies": {
         "graceful-fs": "^4.2.4",
@@ -8171,9 +8420,9 @@
       "license": "MIT"
     },
     "node_modules/es-object-atoms": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
-      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz",
+      "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0"
@@ -8355,14 +8604,14 @@
       }
     },
     "node_modules/eslint-plugin-prettier": {
-      "version": "5.5.5",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-prettier/-/eslint-plugin-prettier-5.5.5.tgz",
-      "integrity": "sha512-hscXkbqUZ2sPithAuLm5MXL+Wph+U7wHngPBv9OMWwlP8iaflyxpjTYZkmdgB4/vPIhemRlBEoLrH7UC1n7aUw==",
+      "version": "5.5.6",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-prettier/-/eslint-plugin-prettier-5.5.6.tgz",
+      "integrity": "sha512-ifetmTcxWfz+4qRW3pH/ujdTq2jQIj59AxJMIN26K5avYgU8dxycUETQonWiW+wPrYXA0j3Try0l1CnwVQtDqQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "prettier-linter-helpers": "^1.0.1",
-        "synckit": "^0.11.12"
+        "synckit": "^0.11.13"
       },
       "engines": {
         "node": "^14.18.0 || >=16.0.0"
@@ -8491,10 +8740,17 @@
         "url": "https://opencollective.com/eslint"
       }
     },
+    "node_modules/eslint/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/eslint/node_modules/brace-expansion": {
-      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+      "version": "1.1.15",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz",
+      "integrity": "sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8665,17 +8921,17 @@
       }
     },
     "node_modules/expect": {
-      "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/expect/-/expect-30.2.0.tgz",
-      "integrity": "sha512-u/feCi0GPsI+988gU2FLcsHyAHTU0MX1Wg68NhAnN7z/+C5wqG+CY8J53N9ioe8RXgaoz0nBR/TYMf3AycUuPw==",
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/expect/-/expect-30.4.1.tgz",
+      "integrity": "sha512-PMARsyh/JtqC20HoGqlFcIlQAyqUtW4PlI1rup1uhYJtKuwAjbvWi3GQMAn+STdHum/dk8xrKfUM1+5SAwpolA==",
       "license": "MIT",
       "dependencies": {
-        "@jest/expect-utils": "30.2.0",
+        "@jest/expect-utils": "30.4.1",
         "@jest/get-type": "30.1.0",
-        "jest-matcher-utils": "30.2.0",
-        "jest-message-util": "30.2.0",
-        "jest-mock": "30.2.0",
-        "jest-util": "30.2.0"
+        "jest-matcher-utils": "30.4.1",
+        "jest-message-util": "30.4.1",
+        "jest-mock": "30.4.1",
+        "jest-util": "30.4.1"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
@@ -8706,9 +8962,9 @@
       }
     },
     "node_modules/fast-copy": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/fast-copy/-/fast-copy-4.0.2.tgz",
-      "integrity": "sha512-ybA6PDXIXOXivLJK/z9e+Otk7ve13I4ckBvGO5I2RRmBU1gMHLVDJYEuJYhGwez7YNlYji2M2DvVU+a9mSFDlw==",
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/fast-copy/-/fast-copy-4.0.3.tgz",
+      "integrity": "sha512-58apWr0GUiDFM8+3afrO6eYwJBn9ZAhDOzG3L+/9llab/haCARS2UIfffmOurYLwbgDRs8n0rfr6qAAPEAuAQw==",
       "license": "MIT"
     },
     "node_modules/fast-deep-equal": {
@@ -8848,9 +9104,9 @@
       }
     },
     "node_modules/fflate": {
-      "version": "0.8.2",
-      "resolved": "https://registry.npmjs.org/fflate/-/fflate-0.8.2.tgz",
-      "integrity": "sha512-cPJU47OaAoCbg0pBvzsgpTPhmhqI5eJjh/JIu8tPj5q+T7iLvW/JAYUqmE7KOB4R1ZyEhzBaIQpQpardBF5z8A==",
+      "version": "0.8.3",
+      "resolved": "https://registry.npmjs.org/fflate/-/fflate-0.8.3.tgz",
+      "integrity": "sha512-tbZNuJrLwGUp3zshBtdy4W+ORxZuIh8a5ilyIEQDC5rY1f3U20JMry0Ll3WBzU58EZKsEuJFXhb5gwv8CsPvgA==",
       "license": "MIT"
     },
     "node_modules/figures": {
@@ -8883,9 +9139,9 @@
       }
     },
     "node_modules/file-type": {
-      "version": "21.3.2",
-      "resolved": "https://registry.npmjs.org/file-type/-/file-type-21.3.2.tgz",
-      "integrity": "sha512-DLkUvGwep3poOV2wpzbHCOnSKGk1LzyXTv+aHFgN2VFl96wnp8YA9YjO2qPzg5PuL8q/SW9Pdi6WTkYOIh995w==",
+      "version": "21.3.4",
+      "resolved": "https://registry.npmjs.org/file-type/-/file-type-21.3.4.tgz",
+      "integrity": "sha512-Ievi/yy8DS3ygGvT47PjSfdFoX+2isQueoYP1cntFW1JLYAuS4GD7NUPGg4zv2iZfV52uDyk5w5Z0TdpRS6Q1g==",
       "license": "MIT",
       "dependencies": {
         "@tokenizer/inflate": "^0.4.1",
@@ -9041,9 +9297,9 @@
       }
     },
     "node_modules/flatted": {
-      "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.3.3.tgz",
-      "integrity": "sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==",
+      "version": "3.4.2",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
+      "integrity": "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==",
       "dev": true,
       "license": "ISC"
     },
@@ -9229,9 +9485,9 @@
       }
     },
     "node_modules/geojson-vt": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/geojson-vt/-/geojson-vt-4.0.2.tgz",
-      "integrity": "sha512-AV9ROqlNqoZEIJGfm1ncNjEXfkz2hdFlZf0qkVfmkwdKa8vj7H16YUOT81rJw1rdFhyEDlN2Tds91p/glzbl5A==",
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/geojson-vt/-/geojson-vt-4.0.3.tgz",
+      "integrity": "sha512-jR1MwkLaZGa8Zftct9ZFruyWFrdl9ZyD2OliXNy9Qq5bBPeg5wHVpBQF9p5GjnicSDQqvBVpysxTPKmWdsfWMA==",
       "license": "ISC"
     },
     "node_modules/get-caller-file": {
@@ -9244,9 +9500,9 @@
       }
     },
     "node_modules/get-east-asian-width": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/get-east-asian-width/-/get-east-asian-width-1.4.0.tgz",
-      "integrity": "sha512-QZjmEOC+IT1uk6Rx0sX22V6uHWVwbdbxf1faPqJ1QhLdGgsRGCZoyaQBm/piRdJy/D2um6hM1UP7ZEeQ4EkP+Q==",
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/get-east-asian-width/-/get-east-asian-width-1.6.0.tgz",
+      "integrity": "sha512-QRbvDIbx6YklUe6RxeTeleMR0yv3cYH6PsPZHcnVn7xv7zO1BHN8r0XETu8n6Ye3Q+ahtSarc3WgtNWmehIBfA==",
       "license": "MIT",
       "engines": {
         "node": ">=18"
@@ -9289,9 +9545,9 @@
       }
     },
     "node_modules/get-port": {
-      "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/get-port/-/get-port-7.1.0.tgz",
-      "integrity": "sha512-QB9NKEeDg3xxVwCCwJQ9+xycaz6pBB6iQ76wiWMl1927n0Kir6alPiP+yuiICLLU4jpMe08dXfpebuQppFA2zw==",
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/get-port/-/get-port-7.2.0.tgz",
+      "integrity": "sha512-afP4W205ONCuMoPBqcR6PSXnzX35KTcJygfJfcp+QY+uwm3p20p1YczWXhlICIzGMCxYBQcySEcOgsJcrkyobg==",
       "devOptional": true,
       "license": "MIT",
       "engines": {
@@ -9401,6 +9657,36 @@
         "node": ">=10.13.0"
       }
     },
+    "node_modules/glob/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "license": "MIT"
+    },
+    "node_modules/glob/node_modules/brace-expansion": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz",
+      "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==",
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0"
+      }
+    },
+    "node_modules/glob/node_modules/minimatch": {
+      "version": "9.0.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^2.0.2"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/global-prefix": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/global-prefix/-/global-prefix-4.0.0.tgz",
@@ -9416,12 +9702,12 @@
       }
     },
     "node_modules/global-prefix/node_modules/isexe": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-3.1.1.tgz",
-      "integrity": "sha512-LpB/54B+/2J5hqQ7imZHfdU31OlgQqx7ZicVlkm9kzg9/w8GKLEcFfJl/t7DCEDueOyBAD6zCCwTO6Fzs0NoEQ==",
-      "license": "ISC",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-3.1.5.tgz",
+      "integrity": "sha512-6B3tLtFqtQS4ekarvLVMZ+X+VlvQekbe4taUkf/rhVO3d/h0M2rfARm/pXLcPEsjjMsFgrFgSrhQIxcSVrBz8w==",
+      "license": "BlueOak-1.0.0",
       "engines": {
-        "node": ">=16"
+        "node": ">=18"
       }
     },
     "node_modules/global-prefix/node_modules/which": {
@@ -9576,9 +9862,9 @@
       }
     },
     "node_modules/hasown": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
-      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
+      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
       "license": "MIT",
       "dependencies": {
         "function-bind": "^1.1.2"
@@ -9652,9 +9938,9 @@
       "license": "MIT"
     },
     "node_modules/hosted-git-info": {
-      "version": "9.0.2",
-      "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-9.0.2.tgz",
-      "integrity": "sha512-M422h7o/BR3rmCQ8UHi7cyyMqKltdP9Uo+J2fXK+RSAY+wTcKOIRyhTuKv4qn+DJf3g+PL890AzId5KZpX+CBg==",
+      "version": "9.0.3",
+      "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-9.0.3.tgz",
+      "integrity": "sha512-Hc+ghLoSt6QaYZUv0WBiIvmMDZuZZ7oaDvdH8MbfOO4lOsxdXLEvuC6ePoGs9H1X9oCLyq6+NVN0MKqD+ydxyg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -9665,9 +9951,9 @@
       }
     },
     "node_modules/hosted-git-info/node_modules/lru-cache": {
-      "version": "11.2.5",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.2.5.tgz",
-      "integrity": "sha512-vFrFJkWtJvJnD5hg+hJvVE8Lh/TcMzKnTgCWmtBipwI5yLX/iX+5UB2tfuyODF5E7k9xEzMdYgGqaSb1c0c5Yw==",
+      "version": "11.5.1",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.1.tgz",
+      "integrity": "sha512-RPimw/7aMdv2oqRrxKwvZXcPfwBrn/JZ2xYcY9Hus/6LaS3VOAKVWKWgNLCFSiOm1ESXinjsDlidVU7JlnCN2A==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
@@ -9883,17 +10169,26 @@
         "node": ">= 14"
       }
     },
+    "node_modules/http-proxy-agent/node_modules/agent-base": {
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
+      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14"
+      }
+    },
     "node_modules/https-proxy-agent": {
-      "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
-      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
+      "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
       "license": "MIT",
       "dependencies": {
-        "agent-base": "^7.1.2",
+        "agent-base": "6",
         "debug": "4"
       },
       "engines": {
-        "node": ">= 14"
+        "node": ">= 6"
       }
     },
     "node_modules/human-signals": {
@@ -9907,25 +10202,21 @@
       }
     },
     "node_modules/iconv-lite": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
-      "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
+      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
       "license": "MIT",
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3.0.0"
       },
       "engines": {
         "node": ">=0.10.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/idb-keyval": {
-      "version": "6.2.2",
-      "resolved": "https://registry.npmjs.org/idb-keyval/-/idb-keyval-6.2.2.tgz",
-      "integrity": "sha512-yjD9nARJ/jb1g+CvD0tlhUHOrJ9Sy0P8T9MF3YaLlHnSRpwPfpTX0XIvpmw3gAJUmEu3FiICLBDPXVwyEvrleg==",
+      "version": "6.2.5",
+      "resolved": "https://registry.npmjs.org/idb-keyval/-/idb-keyval-6.2.5.tgz",
+      "integrity": "sha512-eKQkTnS0relYsSOYomx8ozIbmdsQCKUdhyuIaQ2DZgKuaxtyQQMkyD/wlnQN32pO3yutN1b1L8uqwcDKaJd7/Q==",
       "license": "Apache-2.0"
     },
     "node_modules/ieee754": {
@@ -10089,9 +10380,9 @@
       }
     },
     "node_modules/ip-address": {
-      "version": "10.1.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.1.0.tgz",
-      "integrity": "sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q==",
+      "version": "10.2.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz",
+      "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==",
       "license": "MIT",
       "engines": {
         "node": ">= 12"
@@ -10147,12 +10438,12 @@
       }
     },
     "node_modules/is-core-module": {
-      "version": "2.16.1",
-      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.16.1.tgz",
-      "integrity": "sha512-UfoeMA6fIJ8wTYFEUjelnaGI67v6+N7qXJEvQuIGa99l4xsCruSYOVSQ0uPANn4dAzm8lkYPaKLrrijLq7x23w==",
+      "version": "2.16.2",
+      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.16.2.tgz",
+      "integrity": "sha512-evOr8xfXKxE6qSR0hSXL2r3sd7ALj8+7jQEUvPYcm5sgZFdJ+AYzT6yNmJenvIYQBgIGwfwz08sL8zoL7yq2BA==",
       "license": "MIT",
       "dependencies": {
-        "hasown": "^2.0.2"
+        "hasown": "^2.0.3"
       },
       "engines": {
         "node": ">= 0.4"
@@ -10334,48 +10625,49 @@
       }
     },
     "node_modules/jest-diff": {
-      "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-diff/-/jest-diff-30.2.0.tgz",
-      "integrity": "sha512-dQHFo3Pt4/NLlG5z4PxZ/3yZTZ1C7s9hveiOj+GCN+uT109NC2QgsoVZsVOAvbJ3RgKkvyLGXZV9+piDpWbm6A==",
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/jest-diff/-/jest-diff-30.4.1.tgz",
+      "integrity": "sha512-CRpFK0RtLriVDGcPPAnR6HMVI8bSR2jnUIgralhauzYQZIb4RH9AtEInTuQr65LmmGggGcRT6HIASxwqsVsmlA==",
       "license": "MIT",
       "dependencies": {
-        "@jest/diff-sequences": "30.0.1",
+        "@jest/diff-sequences": "30.4.0",
         "@jest/get-type": "30.1.0",
         "chalk": "^4.1.2",
-        "pretty-format": "30.2.0"
+        "pretty-format": "30.4.1"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/jest-matcher-utils": {
-      "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-matcher-utils/-/jest-matcher-utils-30.2.0.tgz",
-      "integrity": "sha512-dQ94Nq4dbzmUWkQ0ANAWS9tBRfqCrn0bV9AMYdOi/MHW726xn7eQmMeRTpX2ViC00bpNaWXq+7o4lIQ3AX13Hg==",
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/jest-matcher-utils/-/jest-matcher-utils-30.4.1.tgz",
+      "integrity": "sha512-zvYfX5CaeEkFrrLS9suWe9rvJrm9J1Iv3ua8kIBv9GEPzcnsfBf0bob37la7s67fs0nlBC3EuvkOLnXQKxtx4A==",
       "license": "MIT",
       "dependencies": {
         "@jest/get-type": "30.1.0",
         "chalk": "^4.1.2",
-        "jest-diff": "30.2.0",
-        "pretty-format": "30.2.0"
+        "jest-diff": "30.4.1",
+        "pretty-format": "30.4.1"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/jest-message-util": {
-      "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-30.2.0.tgz",
-      "integrity": "sha512-y4DKFLZ2y6DxTWD4cDe07RglV88ZiNEdlRfGtqahfbIjfsw1nMCPx49Uev4IA/hWn3sDKyAnSPwoYSsAEdcimw==",
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-30.4.1.tgz",
+      "integrity": "sha512-kwCKIvq0MCW1HzLoGola9Te6JUdzgV0loyKJ3Qghrkz9i5/RRIHsL95BMQc2HBBhlBKC4j22K9p11TGHH8RBpQ==",
       "license": "MIT",
       "dependencies": {
         "@babel/code-frame": "^7.27.1",
-        "@jest/types": "30.2.0",
+        "@jest/types": "30.4.1",
         "@types/stack-utils": "^2.0.3",
         "chalk": "^4.1.2",
         "graceful-fs": "^4.2.11",
-        "micromatch": "^4.0.8",
-        "pretty-format": "30.2.0",
+        "jest-util": "30.4.1",
+        "picomatch": "^4.0.3",
+        "pretty-format": "30.4.1",
         "slash": "^3.0.0",
         "stack-utils": "^2.0.6"
       },
@@ -10393,49 +10685,49 @@
       }
     },
     "node_modules/jest-mock": {
-      "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-mock/-/jest-mock-30.2.0.tgz",
-      "integrity": "sha512-JNNNl2rj4b5ICpmAcq+WbLH83XswjPbjH4T7yvGzfAGCPh1rw+xVNbtk+FnRslvt9lkCcdn9i1oAoKUuFsOxRw==",
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/jest-mock/-/jest-mock-30.4.1.tgz",
+      "integrity": "sha512-/i8SVb8/NSB7RfNi8gfqu8gxLV23KaL5EpAttyb9iz8qWRIqXRLflycz/32wXsYkOnaUlx8NAKnJYtpsmXUmfw==",
       "license": "MIT",
       "dependencies": {
-        "@jest/types": "30.2.0",
+        "@jest/types": "30.4.1",
         "@types/node": "*",
-        "jest-util": "30.2.0"
+        "jest-util": "30.4.1"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/jest-regex-util": {
-      "version": "30.0.1",
-      "resolved": "https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-30.0.1.tgz",
-      "integrity": "sha512-jHEQgBXAgc+Gh4g0p3bCevgRCVRkB4VB70zhoAE48gxeSr1hfUOsM/C2WoJgVL7Eyg//hudYENbm3Ne+/dRVVA==",
+      "version": "30.4.0",
+      "resolved": "https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-30.4.0.tgz",
+      "integrity": "sha512-mWlvLviKIgIQ8VCuM1xRdD0TWp3zlzionlmDBjuXVBs+VkmXq6FgW9T4Emr7oGz/Rk6feDCGyiugolcQEyp3mg==",
       "license": "MIT",
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/jest-util": {
-      "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-30.2.0.tgz",
-      "integrity": "sha512-QKNsM0o3Xe6ISQU869e+DhG+4CK/48aHYdJZGlFQVTjnbvgpcKyxpzk29fGiO7i/J8VENZ+d2iGnSsvmuHywlA==",
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-30.4.1.tgz",
+      "integrity": "sha512-vjQb1sACEiv13DKJMDToJpzVW0joCsIQrmbg0fi7CyOOt+g9jTuQl2A216pWRBYhOVt53XbL/2LbMKg1BECWOw==",
       "license": "MIT",
       "dependencies": {
-        "@jest/types": "30.2.0",
+        "@jest/types": "30.4.1",
         "@types/node": "*",
         "chalk": "^4.1.2",
         "ci-info": "^4.2.0",
         "graceful-fs": "^4.2.11",
-        "picomatch": "^4.0.2"
+        "picomatch": "^4.0.3"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/jiti": {
-      "version": "2.6.1",
-      "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.6.1.tgz",
-      "integrity": "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==",
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.7.0.tgz",
+      "integrity": "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==",
       "license": "MIT",
       "bin": {
         "jiti": "lib/jiti-cli.mjs"
@@ -10463,10 +10755,20 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
-      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
+      "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
       "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
       "license": "MIT",
       "dependencies": {
         "argparse": "^2.0.1"
@@ -10591,9 +10893,9 @@
       }
     },
     "node_modules/kdbush": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/kdbush/-/kdbush-4.0.2.tgz",
-      "integrity": "sha512-WbCVYJ27Sz8zi9Q7Q0xHC+05iwkm3Znipc2XTlrnJbsHMYktW4hPhXUE8Ys1engBrvffoSCqbil1JQAa7clRpA==",
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/kdbush/-/kdbush-4.1.0.tgz",
+      "integrity": "sha512-e9vurzrXJQrFX6ckpHP3bvj5l+9CnYzkxDNnNQ1h2QTqdWsUAJgXiKdGNcOa1EY85dU8KbQ+z/FdQdB7P+9yfQ==",
       "license": "ISC"
     },
     "node_modules/keyv": {
@@ -10625,9 +10927,9 @@
       }
     },
     "node_modules/knex": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/knex/-/knex-3.1.0.tgz",
-      "integrity": "sha512-GLoII6hR0c4ti243gMs5/1Rb3B+AjwMOfjYm97pu0FOQa7JH56hgBxYf5WK2525ceSbBY1cjeZ9yk99GPMB6Kw==",
+      "version": "3.2.10",
+      "resolved": "https://registry.npmjs.org/knex/-/knex-3.2.10.tgz",
+      "integrity": "sha512-oypTHfrc9i72iyxaUQBKHOxhcr0xM65MPf6FpN02nimsftXwzXprIkLjfXdubvhbu4PMWLp023q8o8CYvHSuZw==",
       "license": "MIT",
       "dependencies": {
         "colorette": "2.0.19",
@@ -10638,7 +10940,7 @@
         "get-package-type": "^0.1.0",
         "getopts": "2.3.0",
         "interpret": "^2.2.0",
-        "lodash": "^4.17.21",
+        "lodash": "^4.18.1",
         "pg-connection-string": "2.6.2",
         "rechoir": "^0.8.0",
         "resolve-from": "^5.0.0",
@@ -10651,6 +10953,9 @@
       "engines": {
         "node": ">=16"
       },
+      "peerDependencies": {
+        "pg-query-stream": "^4.14.0"
+      },
       "peerDependenciesMeta": {
         "better-sqlite3": {
           "optional": true
@@ -10667,6 +10972,9 @@
         "pg-native": {
           "optional": true
         },
+        "pg-query-stream": {
+          "optional": true
+        },
         "sqlite3": {
           "optional": true
         },
@@ -10721,9 +11029,9 @@
       }
     },
     "node_modules/laravel-precognition": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/laravel-precognition/-/laravel-precognition-1.0.1.tgz",
-      "integrity": "sha512-BYaDUjEclKbxuQTG9yZnRjjD7ag1Xh+8hGOXmcrw91/vpbIOJ8cSFADTI0kvwetIr3AM1vOJzYwaoA9+KHhLwA==",
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/laravel-precognition/-/laravel-precognition-1.0.2.tgz",
+      "integrity": "sha512-0H08JDdMWONrL/N314fvsO3FATJwGGlFKGkMF3nNmizVFJaWs17816iM+sX7Rp8d5hUjYCx6WLfsehSKfaTxjg==",
       "license": "MIT",
       "dependencies": {
         "axios": "^1.4.0",
@@ -11036,9 +11344,9 @@
       "license": "MIT"
     },
     "node_modules/lodash-es": {
-      "version": "4.17.23",
-      "resolved": "https://registry.npmjs.org/lodash-es/-/lodash-es-4.17.23.tgz",
-      "integrity": "sha512-kVI48u3PZr38HdYz98UmfPnXl2DXrpdctLrFLCd3kOx1xUkOmpFPx7gCWWM5MPkL/fD8zb+Ph0QzjGFs4+hHWg==",
+      "version": "4.18.1",
+      "resolved": "https://registry.npmjs.org/lodash-es/-/lodash-es-4.18.1.tgz",
+      "integrity": "sha512-J8xewKD/Gk22OZbhpOVSwcs60zhd95ESDwezOFuA3/099925PdHJ7OFHNTGtajL3AlZkykD32HykiMo+BIBI8A==",
       "license": "MIT"
     },
     "node_modules/lodash.camelcase": {
@@ -11067,16 +11375,16 @@
       "license": "MIT"
     },
     "node_modules/log-update": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/log-update/-/log-update-7.0.2.tgz",
-      "integrity": "sha512-cSSF1K5w9juI2+JeSRAdaTUZJf6cJB0aWwWO1nQQkcWw44+bIfXmhZMwK2eEsv6tXvU3UfKX/kzcX6SP+1tLAw==",
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/log-update/-/log-update-7.2.0.tgz",
+      "integrity": "sha512-iLs7dGSyjZiUgvrUvuD3FndAxVJk+TywBkkkwUSm9HdYoskJalWg5qVsEiXeufPvRVPbCUmNQewg798rx+sPXg==",
       "license": "MIT",
       "dependencies": {
-        "ansi-escapes": "^7.1.0",
+        "ansi-escapes": "^7.3.0",
         "cli-cursor": "^5.0.0",
-        "slice-ansi": "^7.1.2",
-        "strip-ansi": "^7.1.2",
-        "wrap-ansi": "^9.0.2"
+        "slice-ansi": "^8.0.0",
+        "strip-ansi": "^7.2.0",
+        "wrap-ansi": "^10.0.0"
       },
       "engines": {
         "node": ">=20"
@@ -11098,12 +11406,12 @@
       }
     },
     "node_modules/log-update/node_modules/strip-ansi": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.2.tgz",
-      "integrity": "sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA==",
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
+      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
       "license": "MIT",
       "dependencies": {
-        "ansi-regex": "^6.0.1"
+        "ansi-regex": "^6.2.2"
       },
       "engines": {
         "node": ">=12"
@@ -11150,9 +11458,9 @@
       }
     },
     "node_modules/lru.min": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/lru.min/-/lru.min-1.1.3.tgz",
-      "integrity": "sha512-Lkk/vx6ak3rYkRR0Nhu4lFUT2VDnQSxBe8Hbl7f36358p6ow8Bnvr8lrLt98H8J1aGxfhbX4Fs5tYg2+FTwr5Q==",
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/lru.min/-/lru.min-1.1.4.tgz",
+      "integrity": "sha512-DqC6n3QQ77zdFpCMASA1a3Jlb64Hv2N2DciFGkO/4L9+q/IpIAuRlKOvCXabtRW6cQf8usbmM6BE/TOPysCdIA==",
       "license": "MIT",
       "engines": {
         "bun": ">=1.0.0",
@@ -11320,9 +11628,9 @@
       }
     },
     "node_modules/mdast-util-from-markdown": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/mdast-util-from-markdown/-/mdast-util-from-markdown-2.0.2.tgz",
-      "integrity": "sha512-uZhTV/8NBuw0WHkPTrCqDOl0zVe1BIng5ZtHoDk49ME1qqcjYmmLmOf0gELgcRMxN4w2iuIeVso5/6QymSrgmA==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/mdast-util-from-markdown/-/mdast-util-from-markdown-2.0.3.tgz",
+      "integrity": "sha512-W4mAWTvSlKvf8L6J+VN9yLSqQ9AOAAvHuoDAmPkz4dHf553m5gVj2ejadHJhoJmcmxEnOv6Pa8XJhpxE93kb8Q==",
       "license": "MIT",
       "dependencies": {
         "@types/mdast": "^4.0.0",
@@ -12267,15 +12575,16 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "9.0.8",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.8.tgz",
-      "integrity": "sha512-reYkDYtj/b19TeqbNZCV4q9t+Yxylf/rYBsLb42SXJatTv4/ylq5lEiAmhA/IToxO7NI2UzNMghHoHuaqDkAjw==",
-      "license": "ISC",
+      "version": "10.2.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
+      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^5.0.2"
+        "brace-expansion": "^5.0.5"
       },
       "engines": {
-        "node": ">=16 || 14 >=14.17"
+        "node": "18 || 20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
@@ -12291,10 +12600,10 @@
       }
     },
     "node_modules/minipass": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.2.tgz",
-      "integrity": "sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==",
-      "license": "ISC",
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+      "license": "BlueOak-1.0.0",
       "engines": {
         "node": ">=16 || 14 >=14.17"
       }
@@ -12329,10 +12638,10 @@
       }
     },
     "node_modules/minipass-flush": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/minipass-flush/-/minipass-flush-1.0.5.tgz",
-      "integrity": "sha512-JmQSYYpPUqX5Jyn1mXaRwOda1uQ8HP5KAT/oDSLCzt1BYRhQU0/hDtsB1ufZfEEzMZ9aAVmsBw8+FWsIXlClWw==",
-      "license": "ISC",
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/minipass-flush/-/minipass-flush-1.0.7.tgz",
+      "integrity": "sha512-TbqTz9cUwWyHS2Dy89P3ocAGUGxKjjLuR9z8w4WUTGAVgEj17/4nhgo2Du56i0Fm3Pm30g4iA8Lcqctc76jCzA==",
+      "license": "BlueOak-1.0.0",
       "dependencies": {
         "minipass": "^3.0.0"
       },
@@ -12467,9 +12776,9 @@
       }
     },
     "node_modules/msgpackr-extract": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/msgpackr-extract/-/msgpackr-extract-3.0.3.tgz",
-      "integrity": "sha512-P0efT1C9jIdVRefqjzOQ9Xml57zpOXnIuS+csaB4MdZbTdmGDLo8XhzBG1N7aO11gKDDkJvBLULeFTo46wwreA==",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/msgpackr-extract/-/msgpackr-extract-3.0.4.tgz",
+      "integrity": "sha512-4kmO/MdyUIkLIvTPr8VHLil4AtoKIoniWPIEk5+CDy0xnWC84azhSFmuJ7PxZdsYtiP5kEeQsORAVIeMgxT+Hw==",
       "hasInstallScript": true,
       "license": "MIT",
       "optional": true,
@@ -12480,12 +12789,12 @@
         "download-msgpackr-prebuilds": "bin/download-prebuilds.js"
       },
       "optionalDependencies": {
-        "@msgpackr-extract/msgpackr-extract-darwin-arm64": "3.0.3",
-        "@msgpackr-extract/msgpackr-extract-darwin-x64": "3.0.3",
-        "@msgpackr-extract/msgpackr-extract-linux-arm": "3.0.3",
-        "@msgpackr-extract/msgpackr-extract-linux-arm64": "3.0.3",
-        "@msgpackr-extract/msgpackr-extract-linux-x64": "3.0.3",
-        "@msgpackr-extract/msgpackr-extract-win32-x64": "3.0.3"
+        "@msgpackr-extract/msgpackr-extract-darwin-arm64": "3.0.4",
+        "@msgpackr-extract/msgpackr-extract-darwin-x64": "3.0.4",
+        "@msgpackr-extract/msgpackr-extract-linux-arm": "3.0.4",
+        "@msgpackr-extract/msgpackr-extract-linux-arm64": "3.0.4",
+        "@msgpackr-extract/msgpackr-extract-linux-x64": "3.0.4",
+        "@msgpackr-extract/msgpackr-extract-win32-x64": "3.0.4"
       }
     },
     "node_modules/murmurhash-js": {
@@ -12523,6 +12832,22 @@
         "node": ">= 8.0"
       }
     },
+    "node_modules/mysql2/node_modules/iconv-lite": {
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
+      "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
     "node_modules/named-placeholders": {
       "version": "1.1.6",
       "resolved": "https://registry.npmjs.org/named-placeholders/-/named-placeholders-1.1.6.tgz",
@@ -12542,16 +12867,16 @@
       "license": "MIT"
     },
     "node_modules/nan": {
-      "version": "2.25.0",
-      "resolved": "https://registry.npmjs.org/nan/-/nan-2.25.0.tgz",
-      "integrity": "sha512-0M90Ag7Xn5KMLLZ7zliPWP3rT90P6PN+IzVFS0VqmnPktBk3700xUVv8Ikm9EUaUE5SDWdp/BIxdENzVznpm1g==",
+      "version": "2.27.0",
+      "resolved": "https://registry.npmjs.org/nan/-/nan-2.27.0.tgz",
+      "integrity": "sha512-hC+0LidcL3XE4rp1C4H54KujgXKzbfyTngZTwBByQxsOxCEKZT0MPQ4hOKUH2jU1OYstqdDH4onyHPDzcV0XdQ==",
       "license": "MIT",
       "optional": true
     },
     "node_modules/nanoid": {
-      "version": "5.1.6",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-5.1.6.tgz",
-      "integrity": "sha512-c7+7RQ+dMB5dPwwCp4ee1/iV/q2P6aK1mTZcfr1BTuVlyW9hJYiMPybJCcnBlQtuSmTIWNeazm/zqNoZSSElBg==",
+      "version": "5.1.11",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-5.1.11.tgz",
+      "integrity": "sha512-v+KEsUv2ps74PaSKv0gHTxTCgMXOIfBEbaqa6w6ISIGC7ZsvHN4N9oJ8d4cmf0n5oTzQz2SLmThbQWhjd/8eKg==",
       "funding": [
         {
           "type": "github",
@@ -12589,9 +12914,9 @@
       }
     },
     "node_modules/node-abi": {
-      "version": "3.87.0",
-      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.87.0.tgz",
-      "integrity": "sha512-+CGM1L1CgmtheLcBuleyYOn7NWPVu0s0EJH2C4puxgEZb9h8QpR9G2dBfZJOAUhi7VQxuBPMd0hiISWcTyiYyQ==",
+      "version": "3.92.0",
+      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.92.0.tgz",
+      "integrity": "sha512-KdHvFWZjEKDf0cakgFjebl371GPsISX2oZHcuyKqM7DtogIsHrqKeLTo8wBHxaXRAQlY2PsPlZmfo+9ZCxEREQ==",
       "license": "MIT",
       "dependencies": {
         "semver": "^7.3.5"
@@ -12607,9 +12932,9 @@
       "license": "MIT"
     },
     "node_modules/node-addon-api": {
-      "version": "8.5.0",
-      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-8.5.0.tgz",
-      "integrity": "sha512-/bRZty2mXUIFY/xU5HLvveNHlswNJej+RnxBjOMkidWfwZzgTbPG1E3K5TOxRLOR+5hX7bSofy8yf1hZevMS8A==",
+      "version": "8.8.0",
+      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-8.8.0.tgz",
+      "integrity": "sha512-c5Ko1fZJIJmzhFIkhRN76WTq+fC6tWnGy9CXA0fA+XygsWZmEwG8vmbkNqxMyoaa0Tin4djul49NzdVcJJcjeA==",
       "license": "MIT",
       "engines": {
         "node": "^18 || ^20 || >= 21"
@@ -12675,12 +13000,12 @@
       }
     },
     "node_modules/node-gyp/node_modules/isexe": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-3.1.1.tgz",
-      "integrity": "sha512-LpB/54B+/2J5hqQ7imZHfdU31OlgQqx7ZicVlkm9kzg9/w8GKLEcFfJl/t7DCEDueOyBAD6zCCwTO6Fzs0NoEQ==",
-      "license": "ISC",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-3.1.5.tgz",
+      "integrity": "sha512-6B3tLtFqtQS4ekarvLVMZ+X+VlvQekbe4taUkf/rhVO3d/h0M2rfARm/pXLcPEsjjMsFgrFgSrhQIxcSVrBz8w==",
+      "license": "BlueOak-1.0.0",
       "engines": {
-        "node": ">=16"
+        "node": ">=18"
       }
     },
     "node_modules/node-gyp/node_modules/which": {
@@ -12699,10 +13024,13 @@
       }
     },
     "node_modules/node-releases": {
-      "version": "2.0.27",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.27.tgz",
-      "integrity": "sha512-nmh3lCkYZ3grZvqcCH+fjmQ7X+H0OeZgP40OierEaAptX4XofMh5kwNbWh7lBduUzCcV/8kZ+NDLCwm2iorIlA==",
-      "license": "MIT"
+      "version": "2.0.47",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.47.tgz",
+      "integrity": "sha512-Uzmd6LXpouKo8EUK68IjH4+E01w/hXyV3R3g/geCJo+rXLNfh1xucB+LOzYEOQPSiUK3h/xZf0cQGcSsmyL2Og==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
     },
     "node_modules/nopt": {
       "version": "8.1.0",
@@ -13374,9 +13702,9 @@
       }
     },
     "node_modules/pino": {
-      "version": "10.3.0",
-      "resolved": "https://registry.npmjs.org/pino/-/pino-10.3.0.tgz",
-      "integrity": "sha512-0GNPNzHXBKw6U/InGe79A3Crzyk9bcSyObF9/Gfo9DLEf5qj5RF50RSjsu0W1rZ6ZqRGdzDFCRBQvi9/rSGPtA==",
+      "version": "10.3.1",
+      "resolved": "https://registry.npmjs.org/pino/-/pino-10.3.1.tgz",
+      "integrity": "sha512-r34yH/GlQpKZbU1BvFFqOjhISRo1MNx1tWYsYvmj6KIRHSPMT2+yHOEb1SG6NMvRoHRF0a07kCOox/9yakl1vg==",
       "license": "MIT",
       "dependencies": {
         "@pinojs/redact": "^0.4.0",
@@ -13539,9 +13867,9 @@
       "license": "ISC"
     },
     "node_modules/preact": {
-      "version": "10.28.3",
-      "resolved": "https://registry.npmjs.org/preact/-/preact-10.28.3.tgz",
-      "integrity": "sha512-tCmoRkPQLpBeWzpmbhryairGnhW9tKV6c6gr/w+RhoRoKEJwsjzipwp//1oCpGPOchvSLaAPlpcJi9MwMmoPyA==",
+      "version": "10.29.2",
+      "resolved": "https://registry.npmjs.org/preact/-/preact-10.29.2.tgz",
+      "integrity": "sha512-7tNmwg/7mzzAoB/8kSg6Hl37JraAZw3Z3A0JSY7VXlZwo82Xn0G7wKbNNs2qoF4ZEEsQGTwDAroNdqKs1ofJxQ==",
       "license": "MIT",
       "funding": {
         "type": "opencollective",
@@ -13552,6 +13880,7 @@
       "version": "7.1.3",
       "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.3.tgz",
       "integrity": "sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==",
+      "deprecated": "No longer maintained. Please contact the author of the relevant native addon; alternatives are available.",
       "license": "MIT",
       "dependencies": {
         "detect-libc": "^2.0.0",
@@ -13614,15 +13943,15 @@
       }
     },
     "node_modules/prettier-plugin-edgejs": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/prettier-plugin-edgejs/-/prettier-plugin-edgejs-1.0.6.tgz",
-      "integrity": "sha512-RZ3xPEiHfw6ca/YzfKmu6rSOviheC9THfGlqg7rs8srbr1RugJQ8k3KmjLHH1oXadQBzZeIeZ3d25Dhs+fe4UA==",
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/prettier-plugin-edgejs/-/prettier-plugin-edgejs-1.0.7.tgz",
+      "integrity": "sha512-IP3dEjxGUXnU9Ev6znBzPBvM6x2nIebP4NUW1Z5g1XEi37FgEzSPmQExkdVOdtf2B6oeC8r4pzIvBobLx7ewMw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@adobe/css-tools": "^4.4.4",
-        "edgejs-parser": "^0.2.18",
-        "prettier": "^3.6.2",
+        "edgejs-parser": "^0.2.19",
+        "prettier": "^3.8.1",
         "uglify-js": "^3.19.2"
       }
     },
@@ -13639,14 +13968,15 @@
       }
     },
     "node_modules/pretty-format": {
-      "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-30.2.0.tgz",
-      "integrity": "sha512-9uBdv/B4EefsuAL+pWqueZyZS2Ba+LxfFeQ9DN14HU4bN8bhaxKdkpjpB6fs9+pSjIBu+FXQHImEg8j/Lw0+vA==",
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-30.4.1.tgz",
+      "integrity": "sha512-K6KiKMHTL4jjX4u3Kir2EW07nRfcqVTXIImx50wbjHQTcZPgg+gjVeNTIT3l3L1Rd4UefxfogquC9J37SoFyyw==",
       "license": "MIT",
       "dependencies": {
-        "@jest/schemas": "30.0.5",
+        "@jest/schemas": "30.4.1",
         "ansi-styles": "^5.2.0",
-        "react-is": "^18.3.1"
+        "react-is-18": "npm:react-is@^18.3.1",
+        "react-is-19": "npm:react-is@^19.2.5"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
@@ -13749,9 +14079,9 @@
       }
     },
     "node_modules/property-information": {
-      "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/property-information/-/property-information-7.1.0.tgz",
-      "integrity": "sha512-TwEZ+X+yCJmYfL7TPUOcvBZ4QfoT5YenQiJuX//0th53DE6w0xxLEtfK3iyryQFddXuvkIk51EEgrJQ0WJkOmQ==",
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/property-information/-/property-information-7.2.0.tgz",
+      "integrity": "sha512-IAtzIB6sUiWaJYrX9smp3V46pBGbBeLFRGdh25kg1334VcBlD8HzhPeNIWQH9zhGmo2itIe25EHt9dQP7G5hmg==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -13759,24 +14089,24 @@
       }
     },
     "node_modules/protobufjs": {
-      "version": "7.5.5",
-      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.5.5.tgz",
-      "integrity": "sha512-3wY1AxV+VBNW8Yypfd1yQY9pXnqTAN+KwQxL8iYm3/BjKYMNg4i0owhEe26PWDOMaIrzeeF98Lqd5NGz4omiIg==",
+      "version": "7.6.2",
+      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.2.tgz",
+      "integrity": "sha512-N9EiLovGEQOJSPF26Ij7qUGvahfEnq0eeYZ02aigIedkmz1qZSwjnP9SBITHJuF/6MYbIW4HDN8zdYjsjqJKXQ==",
       "hasInstallScript": true,
       "license": "BSD-3-Clause",
       "dependencies": {
         "@protobufjs/aspromise": "^1.1.2",
         "@protobufjs/base64": "^1.1.2",
-        "@protobufjs/codegen": "^2.0.4",
-        "@protobufjs/eventemitter": "^1.1.0",
-        "@protobufjs/fetch": "^1.1.0",
+        "@protobufjs/codegen": "^2.0.5",
+        "@protobufjs/eventemitter": "^1.1.1",
+        "@protobufjs/fetch": "^1.1.1",
         "@protobufjs/float": "^1.0.2",
-        "@protobufjs/inquire": "^1.1.0",
+        "@protobufjs/inquire": "^1.1.2",
         "@protobufjs/path": "^1.1.2",
         "@protobufjs/pool": "^1.1.0",
-        "@protobufjs/utf8": "^1.1.0",
+        "@protobufjs/utf8": "^1.1.1",
         "@types/node": ">=13.7.0",
-        "long": "^5.0.0"
+        "long": "^5.3.2"
       },
       "engines": {
         "node": ">=12.0.0"
@@ -13820,9 +14150,9 @@
       }
     },
     "node_modules/pump": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.3.tgz",
-      "integrity": "sha512-todwxLMY7/heScKmntwQG8CXVkWUOdYxIvY2s0VWAAMh/nd8SoYiRaKjlr7+iCs984f2P8zvrfWcDDYVb73NfA==",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.4.tgz",
+      "integrity": "sha512-VS7sjc6KR7e1ukRFhQSY5LM2uBWAUPiOPa/A3mkKmiMwSmRFUITt0xuj+/lesgnCv+dPIEYlkzrcyXgquIHMcA==",
       "license": "MIT",
       "dependencies": {
         "end-of-stream": "^1.1.0",
@@ -13851,9 +14181,9 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.14.2",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.2.tgz",
-      "integrity": "sha512-V/yCWTTF7VJ9hIh18Ugr2zhJMP01MY7c5kh4J870L7imm6/DIzBsNLTXzMwUA3yZ5b/KBqLx8Kp3uRvd7xSe3Q==",
+      "version": "6.15.2",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz",
+      "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "side-channel": "^1.1.0"
@@ -13948,6 +14278,22 @@
         "node": ">= 0.10"
       }
     },
+    "node_modules/raw-body/node_modules/iconv-lite": {
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
+      "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
     "node_modules/rc": {
       "version": "1.2.8",
       "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
@@ -13979,9 +14325,9 @@
       }
     },
     "node_modules/react": {
-      "version": "19.2.4",
-      "resolved": "https://registry.npmjs.org/react/-/react-19.2.4.tgz",
-      "integrity": "sha512-9nfp2hYpCwOjAN+8TZFGhtWEwgvWHXqESH8qT89AT/lWklpLON22Lc8pEtnpsZz7VmawabSU0gCjnj8aC0euHQ==",
+      "version": "19.2.7",
+      "resolved": "https://registry.npmjs.org/react/-/react-19.2.7.tgz",
+      "integrity": "sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ==",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -14050,16 +14396,37 @@
         "loose-envify": "^1.1.0"
       }
     },
+    "node_modules/react-aria": {
+      "version": "3.49.0",
+      "resolved": "https://registry.npmjs.org/react-aria/-/react-aria-3.49.0.tgz",
+      "integrity": "sha512-4+oK9FwJQWYhyA5zLfj/feOGY0zZbkE1muoF4gyxMroHVypjcYaRSTlJwvxph2zIlxt757KX6xIK2wJ5Aw1Kog==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@internationalized/date": "^3.12.2",
+        "@internationalized/number": "^3.6.7",
+        "@internationalized/string": "^3.2.9",
+        "@react-types/shared": "^3.35.0",
+        "@swc/helpers": "^0.5.0",
+        "aria-hidden": "^1.2.3",
+        "clsx": "^2.0.0",
+        "react-stately": "3.47.0",
+        "use-sync-external-store": "^1.6.0"
+      },
+      "peerDependencies": {
+        "react": "^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1",
+        "react-dom": "^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1"
+      }
+    },
     "node_modules/react-dom": {
-      "version": "19.2.4",
-      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.4.tgz",
-      "integrity": "sha512-AXJdLo8kgMbimY95O2aKQqsz2iWi9jMgKJhRBAxECE4IFxfcazB2LmzloIoibJI3C12IlY20+KFaLv+71bUJeQ==",
+      "version": "19.2.7",
+      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.7.tgz",
+      "integrity": "sha512-t0BRVXvbiE/o20Hfw669rLbMCDWtYZLvmJigy2f0MxsXF+71pxhR3xOkspmsO8h3ZlNzyibAmtCa3l4lYKk6gQ==",
       "license": "MIT",
       "dependencies": {
         "scheduler": "^0.27.0"
       },
       "peerDependencies": {
-        "react": "^19.2.4"
+        "react": "^19.2.7"
       }
     },
     "node_modules/react-is": {
@@ -14068,6 +14435,20 @@
       "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
       "license": "MIT"
     },
+    "node_modules/react-is-18": {
+      "name": "react-is",
+      "version": "18.3.1",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
+      "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
+      "license": "MIT"
+    },
+    "node_modules/react-is-19": {
+      "name": "react-is",
+      "version": "19.2.7",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-19.2.7.tgz",
+      "integrity": "sha512-kZFnouyVv7eP/Phmrlo9FK+zcAdriZJvzxXHF1Sl1P377WSGe2G/JxVolhTrB/jeV47lKImhNUsijjHAAbcl/A==",
+      "license": "MIT"
+    },
     "node_modules/react-map-gl": {
       "version": "8.1.0",
       "resolved": "https://registry.npmjs.org/react-map-gl/-/react-map-gl-8.1.0.tgz",
@@ -14128,6 +14509,23 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/react-stately": {
+      "version": "3.47.0",
+      "resolved": "https://registry.npmjs.org/react-stately/-/react-stately-3.47.0.tgz",
+      "integrity": "sha512-H3ar+SOWP920EbVg7qWfP3fZjZiwhlEJAEJQqjt+w8oKijCwFgr0+R4941PIHscOXRNRvEOjvWilitImC0DdBg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@internationalized/date": "^3.12.2",
+        "@internationalized/number": "^3.6.7",
+        "@internationalized/string": "^3.2.9",
+        "@react-types/shared": "^3.35.0",
+        "@swc/helpers": "^0.5.0",
+        "use-sync-external-store": "^1.6.0"
+      },
+      "peerDependencies": {
+        "react": "^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1"
+      }
+    },
     "node_modules/read-package-up": {
       "version": "12.0.0",
       "resolved": "https://registry.npmjs.org/read-package-up/-/read-package-up-12.0.0.tgz",
@@ -14147,17 +14545,17 @@
       }
     },
     "node_modules/read-pkg": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/read-pkg/-/read-pkg-10.0.0.tgz",
-      "integrity": "sha512-A70UlgfNdKI5NSvTTfHzLQj7NJRpJ4mT5tGafkllJ4wh71oYuGm/pzphHcmW4s35iox56KSK721AihodoXSc/A==",
+      "version": "10.1.0",
+      "resolved": "https://registry.npmjs.org/read-pkg/-/read-pkg-10.1.0.tgz",
+      "integrity": "sha512-I8g2lArQiP78ll51UeMZojewtYgIRCKCWqZEgOO8c/uefTI+XDXvCSXu3+YNUaTNvZzobrL5+SqHjBrByRRTdg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/normalize-package-data": "^2.4.4",
         "normalize-package-data": "^8.0.0",
         "parse-json": "^8.3.0",
-        "type-fest": "^5.2.0",
-        "unicorn-magic": "^0.3.0"
+        "type-fest": "^5.4.4",
+        "unicorn-magic": "^0.4.0"
       },
       "engines": {
         "node": ">=20"
@@ -14166,6 +14564,19 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/read-pkg/node_modules/unicorn-magic": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/unicorn-magic/-/unicorn-magic-0.4.0.tgz",
+      "integrity": "sha512-wH590V9VNgYH9g3lH9wWjTrUoKsjLF6sGLjhR4sH1LWpLmCOH0Zf7PukhDA8BiS7KHe4oPNkcTHqYkj7SOGUOw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/readable-stream": {
       "version": "3.6.2",
       "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
@@ -14360,11 +14771,12 @@
       }
     },
     "node_modules/resolve": {
-      "version": "1.22.11",
-      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.11.tgz",
-      "integrity": "sha512-RfqAvLnMl313r7c9oclB1HhUEAezcpLjz95wFH4LVuhk9JF/r22qmVP9AMmOU4vMX7Q8pN8jwNg/CSpdFnMjTQ==",
+      "version": "1.22.12",
+      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.12.tgz",
+      "integrity": "sha512-TyeJ1zif53BPfHootBGwPRYT1RUt6oGWsaQr8UyZW/eAm9bKoijtvruSDEmZHm92CwS9nj7/fWttqPCgzep8CA==",
       "license": "MIT",
       "dependencies": {
+        "es-errors": "^1.3.0",
         "is-core-module": "^2.16.1",
         "path-parse": "^1.0.7",
         "supports-preserve-symlinks-flag": "^1.0.0"
@@ -14442,12 +14854,12 @@
       "license": "MIT"
     },
     "node_modules/rollup": {
-      "version": "4.59.0",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.59.0.tgz",
-      "integrity": "sha512-2oMpl67a3zCH9H79LeMcbDhXW/UmWG/y2zuqnF2jQq5uq9TbM9TVyXvA4+t+ne2IIkBdrLpAaRQAvo7YI/Yyeg==",
+      "version": "4.61.1",
+      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.61.1.tgz",
+      "integrity": "sha512-I4KW6iuRpuu2uHBLraZ1wNZe0DP7lnRha+VJ9tNaYVaVgKhW0aI3h4RYnoRPeql0flHm/Co55b7snEDcOfOJrA==",
       "license": "MIT",
       "dependencies": {
-        "@types/estree": "1.0.8"
+        "@types/estree": "1.0.9"
       },
       "bin": {
         "rollup": "dist/bin/rollup"
@@ -14457,31 +14869,31 @@
         "npm": ">=8.0.0"
       },
       "optionalDependencies": {
-        "@rollup/rollup-android-arm-eabi": "4.59.0",
-        "@rollup/rollup-android-arm64": "4.59.0",
-        "@rollup/rollup-darwin-arm64": "4.59.0",
-        "@rollup/rollup-darwin-x64": "4.59.0",
-        "@rollup/rollup-freebsd-arm64": "4.59.0",
-        "@rollup/rollup-freebsd-x64": "4.59.0",
-        "@rollup/rollup-linux-arm-gnueabihf": "4.59.0",
-        "@rollup/rollup-linux-arm-musleabihf": "4.59.0",
-        "@rollup/rollup-linux-arm64-gnu": "4.59.0",
-        "@rollup/rollup-linux-arm64-musl": "4.59.0",
-        "@rollup/rollup-linux-loong64-gnu": "4.59.0",
-        "@rollup/rollup-linux-loong64-musl": "4.59.0",
-        "@rollup/rollup-linux-ppc64-gnu": "4.59.0",
-        "@rollup/rollup-linux-ppc64-musl": "4.59.0",
-        "@rollup/rollup-linux-riscv64-gnu": "4.59.0",
-        "@rollup/rollup-linux-riscv64-musl": "4.59.0",
-        "@rollup/rollup-linux-s390x-gnu": "4.59.0",
-        "@rollup/rollup-linux-x64-gnu": "4.59.0",
-        "@rollup/rollup-linux-x64-musl": "4.59.0",
-        "@rollup/rollup-openbsd-x64": "4.59.0",
-        "@rollup/rollup-openharmony-arm64": "4.59.0",
-        "@rollup/rollup-win32-arm64-msvc": "4.59.0",
-        "@rollup/rollup-win32-ia32-msvc": "4.59.0",
-        "@rollup/rollup-win32-x64-gnu": "4.59.0",
-        "@rollup/rollup-win32-x64-msvc": "4.59.0",
+        "@rollup/rollup-android-arm-eabi": "4.61.1",
+        "@rollup/rollup-android-arm64": "4.61.1",
+        "@rollup/rollup-darwin-arm64": "4.61.1",
+        "@rollup/rollup-darwin-x64": "4.61.1",
+        "@rollup/rollup-freebsd-arm64": "4.61.1",
+        "@rollup/rollup-freebsd-x64": "4.61.1",
+        "@rollup/rollup-linux-arm-gnueabihf": "4.61.1",
+        "@rollup/rollup-linux-arm-musleabihf": "4.61.1",
+        "@rollup/rollup-linux-arm64-gnu": "4.61.1",
+        "@rollup/rollup-linux-arm64-musl": "4.61.1",
+        "@rollup/rollup-linux-loong64-gnu": "4.61.1",
+        "@rollup/rollup-linux-loong64-musl": "4.61.1",
+        "@rollup/rollup-linux-ppc64-gnu": "4.61.1",
+        "@rollup/rollup-linux-ppc64-musl": "4.61.1",
+        "@rollup/rollup-linux-riscv64-gnu": "4.61.1",
+        "@rollup/rollup-linux-riscv64-musl": "4.61.1",
+        "@rollup/rollup-linux-s390x-gnu": "4.61.1",
+        "@rollup/rollup-linux-x64-gnu": "4.61.1",
+        "@rollup/rollup-linux-x64-musl": "4.61.1",
+        "@rollup/rollup-openbsd-x64": "4.61.1",
+        "@rollup/rollup-openharmony-arm64": "4.61.1",
+        "@rollup/rollup-win32-arm64-msvc": "4.61.1",
+        "@rollup/rollup-win32-ia32-msvc": "4.61.1",
+        "@rollup/rollup-win32-x64-gnu": "4.61.1",
+        "@rollup/rollup-win32-x64-msvc": "4.61.1",
         "fsevents": "~2.3.2"
       }
     },
@@ -14573,9 +14985,9 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/semver": {
-      "version": "7.7.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
-      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.3.tgz",
+      "integrity": "sha512-wnilbGyMxzbY7dNOl7jpKbLSjcfeweJWU5j4+u5qW+6/wuGD9KzIGOyZnQVSBM9E7DtWaaH3CyHkppYrKYoxwg==",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -14771,14 +15183,14 @@
       }
     },
     "node_modules/side-channel": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
-      "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz",
+      "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
-        "object-inspect": "^1.13.3",
-        "side-channel-list": "^1.0.0",
+        "object-inspect": "^1.13.4",
+        "side-channel-list": "^1.0.1",
         "side-channel-map": "^1.0.1",
         "side-channel-weakmap": "^1.0.2"
       },
@@ -14790,13 +15202,13 @@
       }
     },
     "node_modules/side-channel-list": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.0.tgz",
-      "integrity": "sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==",
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
+      "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
-        "object-inspect": "^1.13.3"
+        "object-inspect": "^1.13.4"
       },
       "engines": {
         "node": ">= 0.4"
@@ -14918,16 +15330,16 @@
       "license": "ISC"
     },
     "node_modules/slice-ansi": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/slice-ansi/-/slice-ansi-7.1.2.tgz",
-      "integrity": "sha512-iOBWFgUX7caIZiuutICxVgX1SdxwAVFFKwt1EvMYYec/NWO5meOJ6K5uQxhrYBdQJne4KxiqZc+KptFOWFSI9w==",
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/slice-ansi/-/slice-ansi-8.0.0.tgz",
+      "integrity": "sha512-stxByr12oeeOyY2BlviTNQlYV5xOj47GirPr4yA1hE9JCtxfQN0+tVbkxwCtYDQWhEKWFHsEK48ORg5jrouCAg==",
       "license": "MIT",
       "dependencies": {
-        "ansi-styles": "^6.2.1",
-        "is-fullwidth-code-point": "^5.0.0"
+        "ansi-styles": "^6.2.3",
+        "is-fullwidth-code-point": "^5.1.0"
       },
       "engines": {
-        "node": ">=18"
+        "node": ">=20"
       },
       "funding": {
         "url": "https://github.com/chalk/slice-ansi?sponsor=1"
@@ -14946,9 +15358,9 @@
       }
     },
     "node_modules/slugify": {
-      "version": "1.6.6",
-      "resolved": "https://registry.npmjs.org/slugify/-/slugify-1.6.6.tgz",
-      "integrity": "sha512-h+z7HKHYXj6wJU+AnS/+IH8Uh9fdcX1Lrhg1/VMdf9PwoBQXFcXiAdsy2tSK0P6gKwJLXp02r90ahUCqHk9rrw==",
+      "version": "1.6.9",
+      "resolved": "https://registry.npmjs.org/slugify/-/slugify-1.6.9.tgz",
+      "integrity": "sha512-vZ7rfeehZui7wQs438JXBckYLkIIdfHOXsaVEUMyS5fHo1483l1bMdo0EDSWYclY0yZKFOipDy4KHuKs6ssvdg==",
       "license": "MIT",
       "engines": {
         "node": ">=8.0.0"
@@ -14965,12 +15377,12 @@
       }
     },
     "node_modules/socks": {
-      "version": "2.8.7",
-      "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.7.tgz",
-      "integrity": "sha512-HLpt+uLy/pxB+bum/9DzAgiKS8CX1EvbWxI4zlmgGCExImLdiad2iCwXT5Z4c9c3Eq8rP2318mPW2c+QbtjK8A==",
+      "version": "2.8.9",
+      "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.9.tgz",
+      "integrity": "sha512-LJhUYUvItdQ0LkJTmPeaEObWXAqFyfmP85x0tch/ez9cahmhlBBLbIqDFnvBnUJGagb0JbIQrkBs1wJ+yRYpEw==",
       "license": "MIT",
       "dependencies": {
-        "ip-address": "^10.0.1",
+        "ip-address": "^10.1.1",
         "smart-buffer": "^4.2.0"
       },
       "engines": {
@@ -14992,10 +15404,19 @@
         "node": ">= 14"
       }
     },
+    "node_modules/socks-proxy-agent/node_modules/agent-base": {
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
+      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14"
+      }
+    },
     "node_modules/sonic-boom": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/sonic-boom/-/sonic-boom-4.2.0.tgz",
-      "integrity": "sha512-INb7TM37/mAcsGmc9hyyI6+QR3rR1zVRu36B0NeGXKnOOLiZOfER5SA+N7X7k3yUYRzLWafduTDvJAfDswwEww==",
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/sonic-boom/-/sonic-boom-4.2.1.tgz",
+      "integrity": "sha512-w6AxtubXa2wTXAUsZMMWERrsIRAdrK0Sc+FUytWvYAhBJLyuI4llrMIC1DtlNSdI99EI86KZum2MMq3EAZlF9Q==",
       "license": "MIT",
       "dependencies": {
         "atomic-sleep": "^1.0.0"
@@ -15094,9 +15515,9 @@
       }
     },
     "node_modules/spdx-license-ids": {
-      "version": "3.0.22",
-      "resolved": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.22.tgz",
-      "integrity": "sha512-4PRT4nh1EImPbt2jASOKHX7PB7I+e4IWNLvkKFDxNhJlfjbYlleYQh285Z/3mPTHSAK/AvdMmw5BNNuYH8ShgQ==",
+      "version": "3.0.23",
+      "resolved": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.23.tgz",
+      "integrity": "sha512-CWLcCCH7VLu13TgOH+r8p1O/Znwhqv/dbb6lqWy67G+pT1kHmeD/+V36AVb/vq8QMIQwVShJ6Ssl5FPh0fuSdw==",
       "dev": true,
       "license": "CC0-1.0"
     },
@@ -15224,9 +15645,9 @@
       }
     },
     "node_modules/stacktracey": {
-      "version": "2.1.8",
-      "resolved": "https://registry.npmjs.org/stacktracey/-/stacktracey-2.1.8.tgz",
-      "integrity": "sha512-Kpij9riA+UNg7TnphqjH7/CzctQ/owJGNbFkfEeve4Z4uxT5+JapVLFXcsurIfN34gnTWZNJ/f7NMG0E8JDzTw==",
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/stacktracey/-/stacktracey-2.2.0.tgz",
+      "integrity": "sha512-ETyQEz+CzXiLjEbyJqpbp+/T79RQD/6wqFucRBIlVNZfYq2Ay7wbretD4cxpbymZlaPWx58aIhPEY1Cr8DlVvg==",
       "license": "Unlicense",
       "dependencies": {
         "as-table": "^1.0.36",
@@ -15323,12 +15744,12 @@
       }
     },
     "node_modules/string-width/node_modules/strip-ansi": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.2.tgz",
-      "integrity": "sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA==",
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
+      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
       "license": "MIT",
       "dependencies": {
-        "ansi-regex": "^6.0.1"
+        "ansi-regex": "^6.2.2"
       },
       "engines": {
         "node": ">=12"
@@ -15440,21 +15861,24 @@
       }
     },
     "node_modules/strnum": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.3.0.tgz",
-      "integrity": "sha512-ums3KNd42PGyx5xaoVTO1mjU1bH3NpY4vsrVlnv9PNGqQj8wd7rJ6nEypLrJ7z5vxK5RP0yMLo6J/Gsm62DI5Q==",
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.4.0.tgz",
+      "integrity": "sha512-sHrVyWWdq28RbhjuJdZsA1SnGRJV6NiXbk6AXBxDOsgAcA+lmpUZCYjOdLBxkXMwis6RRe7dlZt4VlIWFVzkmg==",
       "funding": [
         {
           "type": "github",
           "url": "https://github.com/sponsors/NaturalIntelligence"
         }
       ],
-      "license": "MIT"
+      "license": "MIT",
+      "dependencies": {
+        "anynum": "^1.0.0"
+      }
     },
     "node_modules/strtok3": {
-      "version": "10.3.4",
-      "resolved": "https://registry.npmjs.org/strtok3/-/strtok3-10.3.4.tgz",
-      "integrity": "sha512-KIy5nylvC5le1OdaaoCJ07L+8iQzJHGH6pWDuzS+d07Cu7n1MZ2x26P8ZKIWfbK02+XIL8Mp4RkWeqdUCrDMfg==",
+      "version": "10.3.5",
+      "resolved": "https://registry.npmjs.org/strtok3/-/strtok3-10.3.5.tgz",
+      "integrity": "sha512-ki4hZQfh5rX0QDLLkOCj+h+CVNkqmp/CMf8v8kZpkNVK6jGQooMytqzLZYUVYIZcFZ6yDB70EfD8POcFXiF5oA==",
       "license": "MIT",
       "dependencies": {
         "@tokenizer/token": "^0.3.0"
@@ -15519,13 +15943,13 @@
       }
     },
     "node_modules/synckit": {
-      "version": "0.11.12",
-      "resolved": "https://registry.npmjs.org/synckit/-/synckit-0.11.12.tgz",
-      "integrity": "sha512-Bh7QjT8/SuKUIfObSXNHNSK6WHo6J1tHCqJsuaFDP7gP0fkzSfTxI8y85JrppZ0h8l0maIgc2tfuZQ6/t3GtnQ==",
+      "version": "0.11.13",
+      "resolved": "https://registry.npmjs.org/synckit/-/synckit-0.11.13.tgz",
+      "integrity": "sha512-eNRKgb3z66Yp3D2CixVujOUvXLFUTij/zVnV8KRyvFdQwpz7I5DS8UfRkTeLzb64u+dkzDSdelE24izu+zSSUg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@pkgr/core": "^0.2.9"
+        "@pkgr/core": "^0.3.6"
       },
       "engines": {
         "node": "^14.18.0 || >=16.0.0"
@@ -15675,6 +16099,18 @@
         "node": ">=10"
       }
     },
+    "node_modules/terminal-size": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/terminal-size/-/terminal-size-4.0.1.tgz",
+      "integrity": "sha512-avMLDQpUI9I5XFrklECw1ZEUPJhqzcwSWsyyI8blhRLT+8N1jLJWLWWYQpB2q2xthq8xDvjZPISVh53T/+CLYQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/tesseract.js": {
       "version": "7.0.0",
       "resolved": "https://registry.npmjs.org/tesseract.js/-/tesseract.js-7.0.0.tgz",
@@ -15700,17 +16136,23 @@
       "license": "Apache-2.0"
     },
     "node_modules/thread-stream": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/thread-stream/-/thread-stream-4.0.0.tgz",
-      "integrity": "sha512-4iMVL6HAINXWf1ZKZjIPcz5wYaOdPhtO8ATvZ+Xqp3BTdaqtAwQkNmKORqcIo5YkQqGXq5cwfswDwMqqQNrpJA==",
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/thread-stream/-/thread-stream-4.2.0.tgz",
+      "integrity": "sha512-e2zZ96wSChazBsbENf/Pcm/4swHt2cEKQ92rhUjkL9GCKiTDJIaTBenjE/m9DXi0QBmTMDkFDdOomUy20A1tDQ==",
       "license": "MIT",
       "dependencies": {
-        "real-require": "^0.2.0"
+        "real-require": "^1.0.0"
       },
       "engines": {
         "node": ">=20"
       }
     },
+    "node_modules/thread-stream/node_modules/real-require": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/real-require/-/real-require-1.0.0.tgz",
+      "integrity": "sha512-P4nbQYQfePJxRSmY+v/KINxVucm4NF3p3s7pJveMTtom52FR4YGltUQLB8idDXwDDWW+eYrWDFbuzUnjoWHF7g==",
+      "license": "MIT"
+    },
     "node_modules/tildify": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/tildify/-/tildify-2.0.0.tgz",
@@ -15720,22 +16162,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/time-span": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/time-span/-/time-span-5.1.0.tgz",
-      "integrity": "sha512-75voc/9G4rDIJleOo4jPvN4/YC4GRZrY8yy1uU4lwrB3XEQbWve8zXoO5No4eFrGcTAMYyoY67p8jRQdtA1HbA==",
-      "devOptional": true,
-      "license": "MIT",
-      "dependencies": {
-        "convert-hrtime": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/tinyexec": {
       "version": "0.3.2",
       "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-0.3.2.tgz",
@@ -15744,13 +16170,13 @@
       "license": "MIT"
     },
     "node_modules/tinyglobby": {
-      "version": "0.2.15",
-      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.15.tgz",
-      "integrity": "sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==",
+      "version": "0.2.17",
+      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
+      "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
       "license": "MIT",
       "dependencies": {
         "fdir": "^6.5.0",
-        "picomatch": "^4.0.3"
+        "picomatch": "^4.0.4"
       },
       "engines": {
         "node": ">=12.0.0"
@@ -15846,9 +16272,9 @@
       }
     },
     "node_modules/ts-api-utils": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-2.4.0.tgz",
-      "integrity": "sha512-3TaVTaAv2gTiMB35i3FiGJaRfwb3Pyn/j3m/bfAvGe8FB7CF6u+LMYqYlDh7reQf7UNvoTvdfAqHGmPGOSsPmA==",
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-2.5.0.tgz",
+      "integrity": "sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -16017,9 +16443,9 @@
       }
     },
     "node_modules/type-fest": {
-      "version": "5.4.3",
-      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-5.4.3.tgz",
-      "integrity": "sha512-AXSAQJu79WGc79/3e9/CR77I/KQgeY1AhNvcShIH4PTcGYyC4xv6H4R4AUOwkPS5799KlVDAu8zExeCrkGquiA==",
+      "version": "5.7.0",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-5.7.0.tgz",
+      "integrity": "sha512-1URUxUqfHFM1c+zfSPsa3gnkO7Aq21qyH75SIduNYz4SzY964rn1X2vCMQaHSHhktiw+0kPa2iyb6PUpXqB6Vg==",
       "dev": true,
       "license": "(MIT OR CC0-1.0)",
       "dependencies": {
@@ -16033,17 +16459,21 @@
       }
     },
     "node_modules/type-is": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.0.1.tgz",
-      "integrity": "sha512-OZs6gsjF4vMp32qrCbiVSkrFmXtG/AZhY3t0iAMrMBiAZyV9oALtXO8hsrHbMXF9x6L3grlFuwW2oAz7cav+Gw==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.1.0.tgz",
+      "integrity": "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==",
       "license": "MIT",
       "dependencies": {
-        "content-type": "^1.0.5",
+        "content-type": "^2.0.0",
         "media-typer": "^1.1.0",
         "mime-types": "^3.0.0"
       },
       "engines": {
-        "node": ">= 0.6"
+        "node": ">= 18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/typescript": {
@@ -16060,16 +16490,16 @@
       }
     },
     "node_modules/typescript-eslint": {
-      "version": "8.54.0",
-      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.54.0.tgz",
-      "integrity": "sha512-CKsJ+g53QpsNPqbzUsfKVgd3Lny4yKZ1pP4qN3jdMOg/sisIDLGyDMezycquXLE5JsEU0wp3dGNdzig0/fmSVQ==",
+      "version": "8.61.0",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.61.0.tgz",
+      "integrity": "sha512-8y31Rd0eGTrDKqhy6vT0HtzhN+YLjQizwX3aA3hPXP/ynSfnrBXcQY5IzsP9/DM7+klX4IUncZZjkchP0z+rUw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/eslint-plugin": "8.54.0",
-        "@typescript-eslint/parser": "8.54.0",
-        "@typescript-eslint/typescript-estree": "8.54.0",
-        "@typescript-eslint/utils": "8.54.0"
+        "@typescript-eslint/eslint-plugin": "8.61.0",
+        "@typescript-eslint/parser": "8.61.0",
+        "@typescript-eslint/typescript-estree": "8.61.0",
+        "@typescript-eslint/utils": "8.61.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -16079,8 +16509,8 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "eslint": "^8.57.0 || ^9.0.0",
-        "typescript": ">=4.8.4 <6.0.0"
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/typewise": {
@@ -16136,9 +16566,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "6.24.1",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.24.1.tgz",
-      "integrity": "sha512-sC+b0tB1whOCzbtlx20fx3WgCXwkW627p4EA9uM+/tNNPkSS+eSEld6pAs9nDv7WbY1UUljBMYPtu9BCOrCWKA==",
+      "version": "6.26.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.26.0.tgz",
+      "integrity": "sha512-4yqz8a3n5HmGTlsbADNtr/dJlhkh/55Rq798G6ibiULcXbDtaLpTl1pvdqcbFfeoj3iSi52lePFM7h9H21cw/A==",
       "license": "MIT",
       "engines": {
         "node": ">=18.17"
@@ -16393,9 +16823,9 @@
       }
     },
     "node_modules/validator": {
-      "version": "13.15.26",
-      "resolved": "https://registry.npmjs.org/validator/-/validator-13.15.26.tgz",
-      "integrity": "sha512-spH26xU080ydGggxRyR1Yhcbgx+j3y5jbNXk/8L+iRvdIEQ4uTRH2Sgf2dokud6Q4oAtsbNvJ1Ft+9xmm6IZcA==",
+      "version": "13.15.35",
+      "resolved": "https://registry.npmjs.org/validator/-/validator-13.15.35.tgz",
+      "integrity": "sha512-TQ5pAGhd5whStmqWvYF4OjQROlmv9SMFVt37qoCBdqRffuuklWYQlCNnEs2ZaIBD1kZRNnikiZOS1eqgkar0iw==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.10"
@@ -16563,18 +16993,6 @@
         "node": ">=18"
       }
     },
-    "node_modules/whatwg-encoding/node_modules/iconv-lite": {
-      "version": "0.6.3",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
-      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
-      "license": "MIT",
-      "dependencies": {
-        "safer-buffer": ">= 2.1.2 < 3.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/whatwg-fetch": {
       "version": "3.6.20",
       "resolved": "https://registry.npmjs.org/whatwg-fetch/-/whatwg-fetch-3.6.20.tgz",
@@ -16638,17 +17056,17 @@
       "license": "MIT"
     },
     "node_modules/wrap-ansi": {
-      "version": "9.0.2",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-9.0.2.tgz",
-      "integrity": "sha512-42AtmgqjV+X1VpdOfyTGOYRi0/zsoLqtXQckTmqTeybT+BDIbM/Guxo7x3pE2vtpr1ok6xRqM9OpBe+Jyoqyww==",
+      "version": "10.0.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-10.0.0.tgz",
+      "integrity": "sha512-SGcvg80f0wUy2/fXES19feHMz8E0JoXv2uNgHOu4Dgi2OrCy1lqwFYEJz1BLbDI0exjPMe/ZdzZ/YpGECBG/aQ==",
       "license": "MIT",
       "dependencies": {
-        "ansi-styles": "^6.2.1",
-        "string-width": "^7.0.0",
-        "strip-ansi": "^7.1.0"
+        "ansi-styles": "^6.2.3",
+        "string-width": "^8.2.0",
+        "strip-ansi": "^7.1.2"
       },
       "engines": {
-        "node": ">=18"
+        "node": ">=20"
       },
       "funding": {
         "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
@@ -16725,13 +17143,29 @@
         "url": "https://github.com/chalk/ansi-styles?sponsor=1"
       }
     },
-    "node_modules/wrap-ansi/node_modules/strip-ansi": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.2.tgz",
-      "integrity": "sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA==",
+    "node_modules/wrap-ansi/node_modules/string-width": {
+      "version": "8.2.1",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-8.2.1.tgz",
+      "integrity": "sha512-IIaP0g3iy9Cyy18w3M9YcaDudujEAVHKt3a3QJg1+sr/oX96TbaGUubG0hJyCjCBThFH+tFpcIyoUHUn1ogaLA==",
       "license": "MIT",
       "dependencies": {
-        "ansi-regex": "^6.0.1"
+        "get-east-asian-width": "^1.5.0",
+        "strip-ansi": "^7.1.2"
+      },
+      "engines": {
+        "node": ">=20"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/wrap-ansi/node_modules/strip-ansi": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
+      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^6.2.2"
       },
       "engines": {
         "node": ">=12"
diff --git a/admin/package.json b/admin/package.json
index a5997d7..8457b0c 100644
--- a/admin/package.json
+++ b/admin/package.json
@@ -112,9 +112,9 @@
     "pino-pretty": "13.1.3",
     "pmtiles": "4.4.0",
     "postcss": "8.5.15",
-    "react": "19.2.4",
+    "react": "19.2.7",
     "react-adonis-transmit": "1.0.1",
-    "react-dom": "19.2.4",
+    "react-dom": "19.2.7",
     "react-map-gl": "8.1.0",
     "react-markdown": "10.1.0",
     "reflect-metadata": "0.2.2",

From d4972445d9140979dba1da140b0f667d2f283176 Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Tue, 9 Jun 2026 17:58:16 +0000
Subject: [PATCH 51/83] chore(deps): bump autoprefixer

---
 admin/package-lock.json | 12 ++++++------
 admin/package.json      |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/admin/package-lock.json b/admin/package-lock.json
index 434558b..4c2edd8 100644
--- a/admin/package-lock.json
+++ b/admin/package-lock.json
@@ -37,7 +37,7 @@
         "@uppy/react": "5.1.1",
         "@vinejs/vine": "3.0.1",
         "@vitejs/plugin-react": "4.7.0",
-        "autoprefixer": "10.4.24",
+        "autoprefixer": "10.5.0",
         "axios": "1.17.0",
         "better-sqlite3": "12.6.2",
         "bullmq": "5.67.2",
@@ -6602,9 +6602,9 @@
       }
     },
     "node_modules/autoprefixer": {
-      "version": "10.4.24",
-      "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.4.24.tgz",
-      "integrity": "sha512-uHZg7N9ULTVbutaIsDRoUkoS8/h3bdsmVJYZ5l3wv8Cp/6UIIoRDm90hZ+BwxUj/hGBEzLxdHNSKuFpn8WOyZw==",
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.5.0.tgz",
+      "integrity": "sha512-FMhOoZV4+qR6aTUALKX2rEqGG+oyATvwBt9IIzVR5rMa2HRWPkxf+P+PAJLD1I/H5/II+HuZcBJYEFBpq39ong==",
       "funding": [
         {
           "type": "opencollective",
@@ -6621,8 +6621,8 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "browserslist": "^4.28.1",
-        "caniuse-lite": "^1.0.30001766",
+        "browserslist": "^4.28.2",
+        "caniuse-lite": "^1.0.30001787",
         "fraction.js": "^5.3.4",
         "picocolors": "^1.1.1",
         "postcss-value-parser": "^4.2.0"
diff --git a/admin/package.json b/admin/package.json
index 8457b0c..069efce 100644
--- a/admin/package.json
+++ b/admin/package.json
@@ -90,7 +90,7 @@
     "@uppy/react": "5.1.1",
     "@vinejs/vine": "3.0.1",
     "@vitejs/plugin-react": "4.7.0",
-    "autoprefixer": "10.4.24",
+    "autoprefixer": "10.5.0",
     "axios": "1.17.0",
     "better-sqlite3": "12.6.2",
     "bullmq": "5.67.2",

From 37ad684fbd6614aebf32cf747db6c7a25eef5fa0 Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Tue, 9 Jun 2026 18:16:05 +0000
Subject: [PATCH 52/83] fix(bullmq): bump to 5.77.6 and update set calls w new
 args shape

---
 admin/app/jobs/download_model_job.ts      |  2 +-
 admin/app/jobs/run_download_job.ts        |  2 +-
 admin/app/jobs/run_extract_pmtiles_job.ts |  2 +-
 admin/package-lock.json                   | 77 +++++++++++------------
 admin/package.json                        |  2 +-
 5 files changed, 41 insertions(+), 44 deletions(-)

diff --git a/admin/app/jobs/download_model_job.ts b/admin/app/jobs/download_model_job.ts
index 2ba0080..c79d59e 100644
--- a/admin/app/jobs/download_model_job.ts
+++ b/admin/app/jobs/download_model_job.ts
@@ -37,7 +37,7 @@ export class DownloadModelJob {
     const queueService = QueueService.getInstance()
     const queue = queueService.getQueue(this.queue)
     const client = await queue.client
-    await client.set(this.cancelKey(jobId), '1', 'EX', 300) // 5 min TTL
+    await client.set(this.cancelKey(jobId), '1', { EX: 300 }) // 5 min TTL
   }
 
   async handle(job: Job) {
diff --git a/admin/app/jobs/run_download_job.ts b/admin/app/jobs/run_download_job.ts
index 205b479..c9a5999 100644
--- a/admin/app/jobs/run_download_job.ts
+++ b/admin/app/jobs/run_download_job.ts
@@ -63,7 +63,7 @@ export class RunDownloadJob {
     const queueService = QueueService.getInstance()
     const queue = queueService.getQueue(this.queue)
     const client = await queue.client
-    await client.set(this.cancelKey(jobId), '1', 'EX', 300) // 5 min TTL
+    await client.set(this.cancelKey(jobId), '1', { EX: 300 }) // 5 min TTL
   }
 
   async handle(job: Job) {
diff --git a/admin/app/jobs/run_extract_pmtiles_job.ts b/admin/app/jobs/run_extract_pmtiles_job.ts
index de7049f..b216d14 100644
--- a/admin/app/jobs/run_extract_pmtiles_job.ts
+++ b/admin/app/jobs/run_extract_pmtiles_job.ts
@@ -52,7 +52,7 @@ export class RunExtractPmtilesJob {
     const queueService = QueueService.getInstance()
     const queue = queueService.getQueue(this.queue)
     const client = await queue.client
-    await client.set(this.cancelKey(jobId), '1', 'EX', 300)
+    await client.set(this.cancelKey(jobId), '1', { EX: 300 })
   }
 
   /** Awaits job.updateProgress and swallows BullMQ stale-job errors (code -1),
diff --git a/admin/package-lock.json b/admin/package-lock.json
index 4c2edd8..6e3c1a1 100644
--- a/admin/package-lock.json
+++ b/admin/package-lock.json
@@ -40,7 +40,7 @@
         "autoprefixer": "10.5.0",
         "axios": "1.17.0",
         "better-sqlite3": "12.6.2",
-        "bullmq": "5.67.2",
+        "bullmq": "5.77.6",
         "cheerio": "1.2.0",
         "compression": "1.8.1",
         "dockerode": "4.0.9",
@@ -2706,9 +2706,9 @@
       }
     },
     "node_modules/@ioredis/commands": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/@ioredis/commands/-/commands-1.5.0.tgz",
-      "integrity": "sha512-eUgLqrMf8nJkZxT24JvVRrQya1vZkQh8BBeYNwGDqa5I0VUi8ACx7uFvAaLxintokpTenkK6DASvo/bvNbBGow==",
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/@ioredis/commands/-/commands-1.5.1.tgz",
+      "integrity": "sha512-JH8ZL/ywcJyR9MmJ5BNqZllXNZQqQbnVZOqpPQqE1vHiFgAw4NHbvE0FOduNU8IX9babitBT46571OnPTT0Zcw==",
       "license": "MIT"
     },
     "node_modules/@isaacs/cliui": {
@@ -6888,24 +6888,34 @@
       }
     },
     "node_modules/bullmq": {
-      "version": "5.67.2",
-      "resolved": "https://registry.npmjs.org/bullmq/-/bullmq-5.67.2.tgz",
-      "integrity": "sha512-3KYqNqQptKcgksACO1li4YW9/jxEh6XWa1lUg4OFrHa80Pf0C7H9zeb6ssbQQDfQab/K3QCXopbZ40vrvcyrLw==",
+      "version": "5.77.6",
+      "resolved": "https://registry.npmjs.org/bullmq/-/bullmq-5.77.6.tgz",
+      "integrity": "sha512-WCpSoCD4vWyRD+btOsFrO7iBGInrTgG155gTZCV8qY0Yex2KtsbVtFERx6V1WZ2xWl/5ZxnLar8Z8ufnS4f5jg==",
       "license": "MIT",
       "dependencies": {
         "cron-parser": "4.9.0",
-        "ioredis": "5.9.2",
-        "msgpackr": "1.11.5",
+        "ioredis": "5.10.1",
+        "msgpackr": "2.0.1",
         "node-abort-controller": "3.1.1",
-        "semver": "7.7.3",
-        "tslib": "2.8.1",
-        "uuid": "11.1.0"
+        "semver": "7.8.0",
+        "tslib": "2.8.1"
+      },
+      "engines": {
+        "node": ">=12.22.0"
+      },
+      "peerDependencies": {
+        "redis": ">=5.0.0"
+      },
+      "peerDependenciesMeta": {
+        "redis": {
+          "optional": true
+        }
       }
     },
     "node_modules/bullmq/node_modules/semver": {
-      "version": "7.7.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
-      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
+      "version": "7.8.0",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.0.tgz",
+      "integrity": "sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -8063,20 +8073,6 @@
         "node": ">= 8.0"
       }
     },
-    "node_modules/dockerode/node_modules/uuid": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-10.0.0.tgz",
-      "integrity": "sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==",
-      "deprecated": "uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).",
-      "funding": [
-        "https://github.com/sponsors/broofa",
-        "https://github.com/sponsors/ctavan"
-      ],
-      "license": "MIT",
-      "bin": {
-        "uuid": "dist/bin/uuid"
-      }
-    },
     "node_modules/dom-serializer": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/dom-serializer/-/dom-serializer-2.0.0.tgz",
@@ -10356,12 +10352,12 @@
       }
     },
     "node_modules/ioredis": {
-      "version": "5.9.2",
-      "resolved": "https://registry.npmjs.org/ioredis/-/ioredis-5.9.2.tgz",
-      "integrity": "sha512-tAAg/72/VxOUW7RQSX1pIxJVucYKcjFjfvj60L57jrZpYCHC3XN0WCQ3sNYL4Gmvv+7GPvTAjc+KSdeNuE8oWQ==",
+      "version": "5.10.1",
+      "resolved": "https://registry.npmjs.org/ioredis/-/ioredis-5.10.1.tgz",
+      "integrity": "sha512-HuEDBTI70aYdx1v6U97SbNx9F1+svQKBDo30o0b9fw055LMepzpOOd0Ccg9Q6tbqmBSJaMuY0fB7yw9/vjBYCA==",
       "license": "MIT",
       "dependencies": {
-        "@ioredis/commands": "1.5.0",
+        "@ioredis/commands": "1.5.1",
         "cluster-key-slot": "^1.1.0",
         "debug": "^4.3.4",
         "denque": "^2.1.0",
@@ -12767,9 +12763,9 @@
       "license": "MIT"
     },
     "node_modules/msgpackr": {
-      "version": "1.11.5",
-      "resolved": "https://registry.npmjs.org/msgpackr/-/msgpackr-1.11.5.tgz",
-      "integrity": "sha512-UjkUHN0yqp9RWKy0Lplhh+wlpdt9oQBYgULZOiFhV3VclSF1JnSQWZ5r9gORQlNYaUKQoR8itv7g7z1xDDuACA==",
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/msgpackr/-/msgpackr-2.0.1.tgz",
+      "integrity": "sha512-9J+tqTEsbHqY8YohazYgty7LgerFIWxvMLpUjqETSmjHojtJm2WnX2kK/2a1fLI7CO7ERP1YSEUXMucz4j+yBA==",
       "license": "MIT",
       "optionalDependencies": {
         "msgpackr-extract": "^3.0.2"
@@ -16793,16 +16789,17 @@
       "license": "MIT"
     },
     "node_modules/uuid": {
-      "version": "11.1.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.0.tgz",
-      "integrity": "sha512-0/A9rDy9P7cJ+8w1c9WD9V//9Wj15Ce2MPz8Ri6032usz+NfePxx5AcN3bN+r6ZL6jEo066/yNYB3tn4pQEx+A==",
+      "version": "10.0.0",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-10.0.0.tgz",
+      "integrity": "sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==",
+      "deprecated": "uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).",
       "funding": [
         "https://github.com/sponsors/broofa",
         "https://github.com/sponsors/ctavan"
       ],
       "license": "MIT",
       "bin": {
-        "uuid": "dist/esm/bin/uuid"
+        "uuid": "dist/bin/uuid"
       }
     },
     "node_modules/v8-compile-cache-lib": {
diff --git a/admin/package.json b/admin/package.json
index 069efce..bb0146b 100644
--- a/admin/package.json
+++ b/admin/package.json
@@ -93,7 +93,7 @@
     "autoprefixer": "10.5.0",
     "axios": "1.17.0",
     "better-sqlite3": "12.6.2",
-    "bullmq": "5.67.2",
+    "bullmq": "5.77.6",
     "cheerio": "1.2.0",
     "compression": "1.8.1",
     "dockerode": "4.0.9",

From 5eb208fb504321eacb25834fcfea26a2670f602b Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Tue, 9 Jun 2026 19:02:05 +0000
Subject: [PATCH 53/83] docs: update release notes

---
 NEXT_RELEASE.md             | 29 +++++++++++++++++++
 NEXT_RELEASE_NOTES.md       | 37 ++++++++++++++++++++++++
 NEXT_RELEASE_OVERVIEW.md    | 56 +++++++++++++++++++++++++++++++++++++
 NEXT_RELEASE_QA.md          | 47 +++++++++++++++++++++++++++++++
 admin/docs/release-notes.md | 42 ++++++++++++++++++++++++++++
 5 files changed, 211 insertions(+)
 create mode 100644 NEXT_RELEASE.md
 create mode 100644 NEXT_RELEASE_NOTES.md
 create mode 100644 NEXT_RELEASE_OVERVIEW.md
 create mode 100644 NEXT_RELEASE_QA.md

diff --git a/NEXT_RELEASE.md b/NEXT_RELEASE.md
new file mode 100644
index 0000000..9d516bd
--- /dev/null
+++ b/NEXT_RELEASE.md
@@ -0,0 +1,29 @@
+https://github.com/Crosstalk-Solutions/project-nomad/pull/976
+https://github.com/Crosstalk-Solutions/project-nomad/pull/989
+https://github.com/Crosstalk-Solutions/project-nomad/pull/990
+https://github.com/Crosstalk-Solutions/project-nomad/pull/861
+https://github.com/Crosstalk-Solutions/project-nomad/pull/939
+https://github.com/Crosstalk-Solutions/project-nomad/pull/961
+https://github.com/Crosstalk-Solutions/project-nomad/pull/991
+https://github.com/Crosstalk-Solutions/project-nomad/pull/977
+https://github.com/Crosstalk-Solutions/project-nomad/pull/975
+https://github.com/Crosstalk-Solutions/project-nomad/pull/978
+https://github.com/Crosstalk-Solutions/project-nomad/pull/980
+https://github.com/Crosstalk-Solutions/project-nomad/pull/983
+https://github.com/Crosstalk-Solutions/project-nomad/pull/985
+https://github.com/Crosstalk-Solutions/project-nomad/pull/991
+https://github.com/Crosstalk-Solutions/project-nomad/pull/986
+https://github.com/Crosstalk-Solutions/project-nomad/pull/993
+https://github.com/Crosstalk-Solutions/project-nomad/pull/995
+https://github.com/Crosstalk-Solutions/project-nomad/pull/994
+https://github.com/Crosstalk-Solutions/project-nomad/pull/997
+https://github.com/Crosstalk-Solutions/project-nomad/pull/998
+https://github.com/Crosstalk-Solutions/project-nomad/pull/999
+https://github.com/Crosstalk-Solutions/project-nomad/pull/1000
+https://github.com/Crosstalk-Solutions/project-nomad/pull/940
+https://github.com/Crosstalk-Solutions/project-nomad/pull/981
+https://github.com/Crosstalk-Solutions/project-nomad/pull/954
+https://github.com/Crosstalk-Solutions/project-nomad/pull/996
+https://github.com/Crosstalk-Solutions/project-nomad/pull/1001
+https://github.com/Crosstalk-Solutions/project-nomad/pull/1002
+https://github.com/Crosstalk-Solutions/project-nomad/pull/1003
diff --git a/NEXT_RELEASE_NOTES.md b/NEXT_RELEASE_NOTES.md
new file mode 100644
index 0000000..f77f731
--- /dev/null
+++ b/NEXT_RELEASE_NOTES.md
@@ -0,0 +1,37 @@
+## Version 1.33.0 - June 9, 2026
+
+> Note: version number and date are a best guess for review — adjust as needed before publishing.
+
+### Features
+- **Automatic App Updates**: Installed apps (the "Supply Depot" sibling containers) can now keep themselves up to date with opt-in, hands-off minor/patch updates, mirroring the core auto-update feature. Updates are gated behind a two-level opt-in — a global master switch in Settings → Updates **and** a per-app toggle in the Supply Depot — and respect the shared update window, cool-off period, disk/in-progress pre-flight checks, and per-app failure backoff. Major versions are never auto-applied. Thanks @jakeaturner for the contribution!
+- **Automatic Content Updates**: Completing the auto-update trilogy, installed Kiwix ZIM files and PMTiles maps can now update themselves on an opt-in basis. Content updates run on their own dedicated overnight window and bandwidth cap (separate from the app/core schedule, since content downloads are multi-GB), check the upstream Kiwix and PMTiles catalogs directly, and keep the AI Knowledge Base in sync when a ZIM is replaced. Thanks @jakeaturner for the contribution!
+- **Supply Depot — Custom Launch URLs**: You can now override an app's "Open" link with a reverse-proxy or local-DNS address (e.g. `https://jellyfin.myhomelab.net`). The override is stored separately so the default link is always recoverable, survives reseeds/upgrades, and is validated on both client and server. Thanks @jakeaturner for the contribution!
+- **Supply Depot — Version & Update visibility**: App cards now show the installed version next to the app name (e.g. `Kiwix · 3.7.0`), and the "Update available" pill now stands out with a solid desert-orange fill so available updates actually draw the eye. Thanks @chriscrosstalk for the contribution!
+- **Maps — Persistent View**: The Maps page now remembers your position and zoom across refreshes instead of resetting to the default US-wide view. The saved view is bounds-checked, so a corrupt value safely falls back to the default. Thanks @chriscrosstalk for the contribution!
+- **Configuration — Redis database selection**: Added a `REDIS_DB` environment variable so operators can pick a Redis logical database (0–15) for the job queue and live-update transport. This prevents key collisions when a single Redis instance is shared across multiple stacks (common in homelabs). Defaults to db 0, preserving existing behavior. Thanks @johno10661 for the contribution!
+
+### Bug Fixes
+- **Storage**: When the admin storage volume is relocated to another disk, child apps (Kiwix, Ollama, Qdrant, Flatnotes, Kolibri) now automatically follow to the new location instead of mounting the old, empty path. The host storage root is now derived from the admin's actual mount, with an explicit `NOMAD_STORAGE_PATH` override and clearer compose comments. Thanks @chriscrosstalk for the fix!
+- **System**: A failed service update now rolls back to the previous container if the new one fails to start, so the service stays up on the old version instead of being left down. Also clears any stale leftover container so a retry can't wedge indefinitely. Thanks @chriscrosstalk for the fix!
+- **System**: Service install failures caused by a host port conflict (commonly a native Ollama install already on port 11434) now show a clear, actionable message with the exact commands to resolve it, instead of a raw Docker error. Thanks @chriscrosstalk for the fix!
+- **System**: The per-service Update button is now disabled and shows "Updating..." while an update is in flight, preventing double-clicks that previously raced into Docker errors. The in-progress state is durable, so it survives a page reload during a multi-GB pull. Thanks @chriscrosstalk for the fix!
+- **System Updates**: Update checks no longer crash for images with more than 1,000 tags (Ollama, Filebrowser). Registry pagination URLs are now resolved correctly, so the "Check for Updates" flow returns versions instead of failing silently — fixing Ollama appearing pinned at an old version. Thanks @chriscrosstalk for the fix!
+- **System**: Internet status checks no longer report "No internet connection" on networks that block or hijack Cloudflare's 1.1.1.1. The check now probes additional hosts the app already contacts (GitHub and the Project N.O.M.A.D. API) in parallel and accepts any HTTP response as "online." Thanks @akashsalan for the fix!
+- **AI Assistant**: Oversized embedding chunks are now truncated and retried instead of being silently dropped, ending the retry storm that could peg the GPU and flood logs (the "api/embed for weeks" issue). The OpenAI-compatible fallback path now also passes context and truncation settings. Thanks @chriscrosstalk for the fix!
+- **AI Assistant**: Chat suggestions now use your selected model (falling back to the *smallest* installed model) instead of the largest. This prevents a flagship model that exceeds available VRAM from hanging the chat page and returning a 500 error. Thanks @johno10661 for the fix!
+- **Knowledge Base**: The embedded-chunk count for batched ZIM ingestion is now persisted accurately across continuation batches, instead of reporting only the final batch's count. Thanks @Metbcy for the fix!
+- **Knowledge Base**: The "ingestion may have stalled" (partial-stall) warning no longer fires falsely on link-out- or PDF-heavy ZIMs that legitimately have little embeddable text. Thanks @chriscrosstalk for the fix!
+- **Knowledge Base**: ZIM ingestion progress no longer freezes at 99% on multi-page archives (e.g. iFixit). Progress now creeps forward monotonically and only reports 100% on the genuinely final batch. Thanks @chriscrosstalk for the fix!
+- **Content**: Installing a newer version of a curated map or ZIM now removes the superseded file from disk, preventing silent accumulation of orphaned content (potentially hundreds of GB). Deletion is gated behind strict safety rails — only tracked, genuinely-replaced, strictly-newer files within the content store are ever removed; sideloaded files are never touched. Thanks @chriscrosstalk for the fix!
+- **Content**: Curated Wikipedia-themed ZIMs (e.g. `wikipedia_en_medicine_maxi` from Medicine → Comprehensive) are no longer wiped on restart. Reconciliation now skips only the single file actually managed by the Wikipedia selector, matched by exact filename. Thanks @chriscrosstalk for the fix!
+- **Maps**: Having both an old and new copy of the same map region on disk no longer blanks the entire map. Map sources are now de-duplicated to the newest file per region, and already-broken installs recover automatically on the next page load. Thanks @chriscrosstalk for the fix!
+- **Information Library (Kiwix)**: Kiwix now self-heals a missing or corrupt library file on startup by rebuilding it from the ZIM files on disk, instead of coming up with an empty library and no path to recovery. Thanks @chriscrosstalk for the fix!
+- **Docker**: Failed image pulls (dropped/metered connection, bad manifest, disk full mid-pull) are now correctly treated as failures across all pull paths, instead of proceeding to create a container from a missing or partial image and surfacing a confusing downstream error. Thanks @chriscrosstalk for the fix!
+- **Security**: Hardened the private-URL/SSRF guard by replacing the regex blocklist with proper IP-range classification (`ipaddr.js`) and normalizing the host first. This blocks alternate IP encodings and trailing-dot bypasses (e.g. `localhost.`) while no longer over-blocking legitimate public addresses. RFC1918 ranges and bare LAN hostnames remain allowed for local appliances. Thanks @chriscrosstalk for the fix!
+- **Install**: Hardened the install script — the NVIDIA toolkit GPG step now runs non-interactively so it doesn't silently skip on non-TTY installs, and helper-script downloads now retry to reduce transient partial-install failures. Thanks @Gujiassh for the fix!
+
+### Improvements
+- **License & Docs**: Corrected the package license metadata to `Apache-2.0` (the project has been Apache-2.0 for some time), added a real project description, and fixed a dead Troubleshooting link plus several README typos. Thanks @chriscrosstalk for the contribution!
+- **Dependencies**: Bumped React and React DOM. Thanks @jakeaturner for the contribution!
+- **Dependencies**: Bumped autoprefixer. Thanks @jakeaturner for the contribution!
+- **Dependencies**: Bumped BullMQ to 5.77.6 and updated affected job calls to the new arguments shape. Thanks @jakeaturner for the contribution!
diff --git a/NEXT_RELEASE_OVERVIEW.md b/NEXT_RELEASE_OVERVIEW.md
new file mode 100644
index 0000000..59458f5
--- /dev/null
+++ b/NEXT_RELEASE_OVERVIEW.md
@@ -0,0 +1,56 @@
+# Next Release — Overview for RC/Beta Testers
+
+This release's headline is the **automatic-update trilogy** finally coming together, plus a batch of reliability fixes for updates, content management, the Knowledge Base, and maps. A lot of this cycle was hardening real-world failure modes reported by the community.
+
+## Headline: Auto-Update Trilogy is complete
+
+NOMAD can now keep itself current at three layers, each **opt-in and off by default**:
+
+1. **Core / Admin** — already shipped previously.
+2. **Installed Apps (Supply Depot)** — *new this release.* Hands-off minor/patch updates for sibling-container apps.
+3. **Installed Content (ZIM + Maps)** — *new this release.* Opt-in updater for Kiwix ZIM files and PMTiles maps.
+
+Key design points testers should understand:
+- **App updates use a two-level opt-in**: a global master switch (Settings → Updates) **and** a per-app toggle (Supply Depot). Both must be on. This is deliberate — third-party app images are outside our control, so each app's auto-update requires an explicit choice.
+- **Content updates are separate on purpose**: they run on their own overnight window and bandwidth cap because ZIM downloads are multi-GB. The UI strongly recommends setting a cap.
+- **Major versions are never auto-applied.** Only minor/patch.
+- Both features have **failure backoff / self-disable** so a misbehaving upstream can't loop forever, and **pre-flight checks** (disk space, no downloads in progress) gate every run.
+- When content auto-updates replace a ZIM, the **AI Knowledge Base mirrors the prior indexed state** (re-indexes if it was indexed, leaves it alone if not).
+
+## Update reliability fixes (these unblock the above)
+- **Update checks no longer crash on high-tag-count images** (Ollama, Filebrowser had >1000 tags). Previously Ollama appeared "stuck" at an old version because the check failed before evaluating newer tags.
+- **Failed service updates now roll back** to the previous container instead of leaving the service down — and no longer wedge on retry.
+- **The Update button now disables + shows "Updating..."** during in-flight updates and survives a page reload, preventing double-click races.
+- **Port-conflict errors are now human-readable** (e.g. a native Ollama already on :11434 now gives you the exact fix commands).
+- **App cards now show the installed version** and a much more visible orange "Update available" pill.
+
+## Knowledge Base / AI Assistant
+- **Embed retry storm fixed**: oversized chunks are truncated-and-retried instead of silently dropped and re-embedded 30× (the "pegged GPU / api/embed for weeks" issue).
+- **ZIM ingestion progress no longer freezes at 99%** on multi-page archives (iFixit).
+- **Accurate embedded-chunk counts** across batched ZIM ingestion.
+- **No more false "ingestion stalled" warnings** on link-out/PDF-heavy ZIMs that legitimately have little text.
+- **Chat suggestions** now use your selected model (or the smallest installed), so a too-large flagship model can't hang the chat page.
+
+## Maps
+- **View persists across refresh** (position + zoom).
+- **Duplicate region files no longer blank the entire map**; broken installs self-recover on next load.
+
+## Content management
+- **Superseded curated files are now cleaned up** when a newer version installs (no more silent multi-GB orphan accumulation), behind strict safety rails so sideloaded files are never touched.
+- **Curated Wikipedia-themed ZIMs no longer get wiped on restart.**
+
+## Storage / Install / System / Security
+- **Relocating the admin storage volume now moves child apps with it** (Kiwix no longer comes up empty after moving storage to another disk).
+- **Kiwix self-heals a missing/corrupt library file on startup.**
+- **Failed Docker image pulls are now treated as failures** instead of proceeding with a partial image.
+- **False "No internet connection" reports fixed** on networks that block Cloudflare 1.1.1.1.
+- **Install script hardened** (non-interactive NVIDIA GPG step, download retries).
+- **SSRF / private-URL guard hardened** with proper IP-range classification and host normalization.
+- **New `REDIS_DB` env var** to pick a Redis logical database (homelab shared-Redis scenarios).
+
+## Also
+- License metadata corrected to Apache-2.0; README link/typo fixes.
+- Dependency bumps: React / React DOM, autoprefixer, BullMQ 5.77.6.
+
+## Honesty notes for testers
+Several fixes were verified by logic/typecheck and unit tests but flagged for **live validation on a real NOMAD host** by their authors — particularly: dense-ZIM embedding (no retry storm), multi-page ZIM progress, superseded-file cleanup (two-version install), storage relocation on a moved-disk box, and the post-#999 update-check flow. These are good targets for hands-on testing.
diff --git a/NEXT_RELEASE_QA.md b/NEXT_RELEASE_QA.md
new file mode 100644
index 0000000..5eeb381
--- /dev/null
+++ b/NEXT_RELEASE_QA.md
@@ -0,0 +1,47 @@
+# Next Release — QA / Smoke-Test Checklist for RC/Beta Testers
+
+High-level things to poke at. No need to go deep on internals — just confirm the happy path works and the new toggles behave. Items marked ⭐ are the highest-value live tests (authors specifically asked for real-host validation).
+
+## Automatic Updates (new)
+- [ ] **Settings → Updates** loads and shows the new sections: Core, Automatic App Updates, and Content Updates.
+- [ ] **App auto-updates are off by default.** Confirm the global master switch and each per-app toggle (Supply Depot → Manage) start off.
+- [ ] With the master switch **off**, a per-app toggle reads "App auto-updates off — open Settings" and takes you to the Updates page.
+- [ ] Turn on the master switch + one app's toggle; confirm it persists across a reload and shows eligibility / cool-off / last-run status.
+- [ ] **Content Updates**: enable the opt-in switch, confirm it prompts/recommends setting a bandwidth cap and uses its own overnight window.
+- [ ] (If feasible) ⭐ Let an eligible app or content item actually auto-update in its window and confirm it succeeds and reflects the new version.
+
+## Update reliability
+- [ ] ⭐ **Check for Updates** on a box with **Ollama** installed — it should return versions (not silently fail / appear pinned).
+- [ ] Trigger a service update (e.g. AI Assistant/Ollama). The **Update button disables and shows "Updating..."**, and the activity feed shows live progress.
+- [ ] Reload the page mid-update — the button stays disabled (state is durable).
+- [ ] Click Update twice quickly — the second click is rejected cleanly, no Docker error.
+- [ ] **Port conflict message**: with a native Ollama running on :11434, attempt to install/start nomad_ollama and confirm you get a clear message with fix commands (not a raw Docker error).
+- [ ] ⭐ Force a service update to fail to start and confirm the **old container is restored** (service stays up) and a retry isn't wedged.
+- [ ] App cards show the **installed version** (e.g. `Kiwix · 3.7.0`) and a visible **orange "Update available"** pill where applicable.
+
+## AI Assistant / Knowledge Base
+- [ ] ⭐ Ingest a **dense ZIM** (e.g. medlineplus / a stackexchange ZIM) on a CPU/low-VRAM box — confirm **no endless `api/embed` loop**, no pegged GPU, and Qdrant point count grows.
+- [ ] ⭐ Ingest a **multi-page ZIM** (iFixit) — progress should climb smoothly and **not freeze at 99%**; it completes.
+- [ ] Ingest a **link-out/PDF-heavy ZIM** — confirm it does **not** show a false "ingestion may have stalled" warning.
+- [ ] After batched ZIM ingestion, the reported **embedded-chunk count looks right** (not absurdly low vs. what was stored).
+- [ ] **Chat suggestions** load quickly and don't error, even with a large model on disk; they use your selected model.
+
+## Maps
+- [ ] Pan/zoom the map, **refresh** — the view is restored (not reset to US-wide).
+- [ ] If you have an old + new copy of the same region on disk, the **map still renders** (doesn't go fully blank).
+
+## Content management
+- [ ] ⭐ Install a curated map or ZIM, then install a **newer version** — confirm the **old file is removed**, the new one is present and served, and any **sideloaded** same-resource file is left untouched.
+- [ ] Install a curated **Wikipedia-themed ZIM** (e.g. Medicine → Comprehensive), **restart**, and confirm it's **still listed** (not wiped, tier not downgraded).
+
+## Storage / Install / System
+- [ ] ⭐ **Relocate the admin storage volume** to another disk (via compose) and confirm Kiwix and other child apps find their content at the new location (Kiwix not empty).
+- [ ] Delete/corrupt the Kiwix library file, restart — Kiwix **self-heals** and serves content again.
+- [ ] On a network that blocks Cloudflare 1.1.1.1, confirm NOMAD does **not** show "No internet connection" while downloads work.
+- [ ] Run the install script on a non-TTY / scripted environment — NVIDIA toolkit setup is **not** silently skipped.
+- [ ] (Homelab) Set `REDIS_DB=10` and confirm queue jobs and live updates work without colliding with other Redis users.
+
+## Sanity / regression
+- [ ] Default install (no storage relocation, no auto-update opt-in) behaves exactly as before — none of the new gates change default behavior.
+- [ ] App "Open" links work; setting a **custom URL** on an app overrides the link and shows the live "Opens as:" preview; clearing it restores the default.
+- [ ] General UI smoke: dashboard, Supply Depot, Content Manager, Maps, AI chat all load without console errors.
diff --git a/admin/docs/release-notes.md b/admin/docs/release-notes.md
index 758cdbe..5184d85 100644
--- a/admin/docs/release-notes.md
+++ b/admin/docs/release-notes.md
@@ -1,5 +1,47 @@
 # Release Notes
 
+## Unreleased
+
+### Features
+- **Supply Depot — Custom Apps**: The Supply Depot is NOMAD's new home for installable apps, and it now lets you run your *own* custom Docker containers — not just the curated catalog. Specify an image, port mappings, volume binds, environment variables, and memory/CPU limits, and NOMAD spins it up as a managed sibling container. A live, debounced pre-flight check warns about port conflicts and resource limits as you type and hard-blocks unsafe configurations, with an "install anyway" override for warning-only cases (e.g. an untrusted registry or a `:latest` tag). Installed custom apps can be edited, updated (re-pull latest + recreate with a safe rollback if the new container fails), and removed (optionally deleting the image), and every installed app — curated or custom — gets per-container **Logs** and **Stats** modals. Host-path binds are hardened against escapes and logs/stats are scoped to NOMAD-managed containers only. Thanks @jakeaturner for the contribution!
+- **Supply Depot — Curated App Onboarding & Fixes**: Each curated app now ships with NOMAD-specific getting-started docs (first run, default logins, where data lives, what does and doesn't work offline), deep-linked from a **Manage › Docs** item on the card. Alongside it is a round of install fixes so the nine documented apps — Stirling PDF, File Browser, Calibre-Web, IT Tools, Excalidraw, Homebox, Vaultwarden, Jellyfin, Meshtastic Web — work out of the box: seeded logins instead of random passwords buried in logs, a bundled Calibre library, HTTPS-by-default where the app requires a secure context (Vaultwarden), corrected internal ports (Meshtastic Web), pre-created media folders (Jellyfin), and a swap to a maintained image (Homebox). You can now also **edit curated apps**, not just custom ones — edits are merged into the app's existing config (preserving advanced settings like GPU device requests) and flag the app so the seeder stops overwriting it, while untouched apps still receive catalog updates. Thanks @chriscrosstalk for the contribution!
+- **Automatic Core Updates**: NOMAD's own admin/core image can now update itself hands-off, gated by layered safety checks. It's opt-in and off by default, runs only inside a user-configured time window, and applies only same-major, strictly-newer GA releases (major bumps stay manual) past a configurable cool-off — behind pre-flight checks for the update sidecar, no in-flight updates/downloads/installs, and sufficient host disk. It auto-disables after repeated genuine failures, while transient offline release lookups are treated as harmless skips. Settings → Updates exposes the toggle, window, cool-off, and live status. This is the first leg of the auto-update trilogy. Thanks @jakeaturner for the contribution!
+- **Automatic App Updates**: Installed apps (the "Supply Depot" sibling containers) can now keep themselves up to date with opt-in, hands-off minor/patch updates, mirroring the core auto-update feature. Updates are gated behind a two-level opt-in — a global master switch in Settings → Updates **and** a per-app toggle in the Supply Depot — and respect the shared update window, cool-off period, disk/in-progress pre-flight checks, and per-app failure backoff. Major versions are never auto-applied. Thanks @jakeaturner for the contribution!
+- **Automatic Content Updates**: Completing the auto-update trilogy, installed Kiwix ZIM files and PMTiles maps can now update themselves on an opt-in basis. Content updates run on their own dedicated overnight window and bandwidth cap (separate from the app/core schedule, since content downloads are multi-GB), check the upstream Kiwix and PMTiles catalogs directly (no more reliance on external Project N.O.M.A.D. API), and keep the AI Knowledge Base in sync when a ZIM is replaced. Thanks @jakeaturner for the contribution!
+- **Supply Depot — Custom Launch URLs**: You can now override an app's "Open" link with a reverse-proxy or local-DNS address (e.g. `https://jellyfin.myhomelab.net`). The override is stored separately so the default link is always recoverable, survives reseeds/upgrades, and is validated on both client and server. Thanks @jakeaturner for the contribution!
+- **Supply Depot — Version & Update visibility**: App cards now show the installed version next to the app name (e.g. `Kiwix · 3.7.0`), and the "Update available" pill now stands out with a solid desert-orange fill so available updates actually draw the eye. Thanks @chriscrosstalk for the contribution!
+- **Maps — Persistent View**: The Maps page now remembers your position and zoom across refreshes instead of resetting to the default US-wide view. The saved view is bounds-checked, so a corrupt value safely falls back to the default. Thanks @chriscrosstalk for the contribution!
+- **Content Manager — Rescan Library**: A new "Rescan Library" button rebuilds the Kiwix index from the ZIM files currently on disk, so files **sideloaded** outside NOMAD's download flow (USB stick, SSH, network share) can be served without dropping to a terminal. It reports how many new books were found and, in library mode, hot-reloads without a container restart. Thanks @chriscrosstalk for the contribution!
+- **Configuration — Redis database selection**: Added a `REDIS_DB` environment variable so operators can pick a Redis logical database (0–15) for the job queue and live-update transport. This prevents key collisions when a single Redis instance is shared across multiple stacks (common in homelabs). Defaults to db 0, preserving existing behavior. Thanks @johno10661 for the contribution!
+
+### Bug Fixes
+- **Storage**: When the admin storage volume is relocated to another disk, child apps (Kiwix, Ollama, Qdrant, Flatnotes, Kolibri) now automatically follow to the new location instead of mounting the old, empty path. The host storage root is now derived from the admin's actual mount, with an explicit `NOMAD_STORAGE_PATH` override and clearer compose comments. Thanks @chriscrosstalk for the fix!
+- **System**: A failed service update now rolls back to the previous container if the new one fails to start, so the service stays up on the old version instead of being left down. Also clears any stale leftover container so a retry can't wedge indefinitely. Thanks @chriscrosstalk for the fix!
+- **System**: Service install failures caused by a host port conflict (commonly a native Ollama install already on port 11434) now show a clear, actionable message with the exact commands to resolve it, instead of a raw Docker error. Thanks @chriscrosstalk for the fix!
+- **System**: The per-service Update button is now disabled and shows "Updating..." while an update is in flight, preventing double-clicks that previously raced into Docker errors. The in-progress state is durable, so it survives a page reload during a multi-GB pull. Thanks @chriscrosstalk for the fix!
+- **System Updates**: Update checks no longer crash for images with more than 1,000 tags (e.g Ollama). Registry pagination URLs are now resolved correctly, so the "Check for Updates" flow returns versions instead of failing silently — fixing Ollama appearing pinned at an old version. Thanks @chriscrosstalk for the fix!
+- **System**: Internet status checks no longer report "No internet connection" on networks that block or hijack Cloudflare's 1.1.1.1. The check now probes additional hosts the app already contacts (GitHub and the Project N.O.M.A.D. API) in parallel and accepts any HTTP response as "online." Thanks @akashsalan for the fix!
+- **AI Assistant**: Oversized embedding chunks are now truncated and retried instead of being silently dropped, ending the retry storm that could peg the GPU and flood logs (the "api/embed for weeks" issue). The OpenAI-compatible fallback path now also passes context and truncation settings. Thanks @chriscrosstalk for the fix!
+- **AI Assistant**: Chat suggestions now use your selected model (falling back to the *smallest* installed model) instead of the largest. This prevents a flagship model that exceeds available VRAM from hanging the chat page and returning a 500 error. Thanks @johno10661 for the fix!
+- **AI Assistant**: The assistant no longer disclaims "Sorry, I couldn't find specific context regarding X..." when relevant material was actually retrieved. The RAG prompt now treats retrieved context as the authoritative source and falls back to general knowledge silently, the model-visible relevance scores that primed smaller models to distrust correct context were replaced with neutral source-title labels, and a conservative heading-match boost improves the ranking of already-retrieved chunks. Thanks @jakeaturner for the fix!
+- **Knowledge Base**: The embedded-chunk count for batched ZIM ingestion is now persisted accurately across continuation batches, instead of reporting only the final batch's count. Thanks @Metbcy for the fix!
+- **Knowledge Base**: The "ingestion may have stalled" (partial-stall) warning no longer fires falsely on link-out- or PDF-heavy ZIMs that legitimately have little embeddable text. Thanks @chriscrosstalk for the fix!
+- **Knowledge Base**: ZIM ingestion progress no longer freezes at 99% on multi-page archives (e.g. iFixit). Progress now creeps forward monotonically and only reports 100% on the genuinely final batch. Thanks @chriscrosstalk for the fix!
+- **Content**: Installing a newer version of a curated map or ZIM now removes the superseded file from disk, preventing silent accumulation of orphaned content (potentially hundreds of GB). Deletion is gated behind strict safety rails — only tracked, genuinely-replaced, strictly-newer files within the content store are ever removed; sideloaded files are never touched. Thanks @chriscrosstalk for the fix!
+- **Content**: Curated Wikipedia-themed ZIMs (e.g. `wikipedia_en_medicine_maxi` from Medicine → Comprehensive) are no longer wiped on restart. Reconciliation now skips only the single file actually managed by the Wikipedia selector, matched by exact filename. Thanks @chriscrosstalk for the fix!
+- **Maps**: Having both an old and new copy of the same map region on disk no longer blanks the entire map. Map sources are now de-duplicated to the newest file per region, and already-broken installs recover automatically on the next page load. Thanks @chriscrosstalk for the fix!
+- **Information Library (Kiwix)**: Kiwix now self-heals a missing or corrupt library file on startup by rebuilding it from the ZIM files on disk, instead of coming up with an empty library and no path to recovery. Thanks @chriscrosstalk for the fix!
+- **Docker**: Failed image pulls (dropped/metered connection, bad manifest, disk full mid-pull) are now correctly treated as failures across all pull paths, instead of proceeding to create a container from a missing or partial image and surfacing a confusing downstream error. Thanks @chriscrosstalk for the fix!
+- **Security**: Hardened the private-URL/SSRF guard by replacing the regex blocklist with proper IP-range classification (`ipaddr.js`) and normalizing the host first. This blocks alternate IP encodings and trailing-dot bypasses (e.g. `localhost.`) while no longer over-blocking legitimate public addresses. RFC1918 ranges and bare LAN hostnames remain allowed for local appliances. Thanks @chriscrosstalk for the fix!
+- **Install**: Hardened the install script — the NVIDIA toolkit GPG step now runs non-interactively so it doesn't silently skip on non-TTY installs, and helper-script downloads now retry to reduce transient partial-install failures. Thanks @Gujiassh for the fix!
+
+### Improvements
+- **License & Docs**: Corrected the package license metadata to `Apache-2.0` (the project has been Apache-2.0 for some time), added a real project description, and fixed a dead Troubleshooting link plus several README typos. Thanks @aqilaziz for the contribution!
+- **Docs**: Fixed a few typos and punctuation in the README. Thanks @teccdev for the contribution!
+- **Dependencies**: Bumped React and React DOM. Thanks @jakeaturner for the contribution!
+- **Dependencies**: Bumped autoprefixer. Thanks @jakeaturner for the contribution!
+- **Dependencies**: Bumped BullMQ to 5.77.6 and updated affected job calls to the new arguments shape. Thanks @jakeaturner for the contribution!
+
 ## Version 1.32.1 - May 27, 2026
 
 ### Features

From 61ef8f3697073ef7a07fee0b8d3c52b07802709d Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Tue, 9 Jun 2026 19:03:49 +0000
Subject: [PATCH 54/83] chore: force bump main version

---
 NEXT_RELEASE.md          | 29 ---------------------
 NEXT_RELEASE_NOTES.md    | 37 --------------------------
 NEXT_RELEASE_OVERVIEW.md | 56 ----------------------------------------
 NEXT_RELEASE_QA.md       | 47 ---------------------------------
 package.json             |  2 +-
 5 files changed, 1 insertion(+), 170 deletions(-)
 delete mode 100644 NEXT_RELEASE.md
 delete mode 100644 NEXT_RELEASE_NOTES.md
 delete mode 100644 NEXT_RELEASE_OVERVIEW.md
 delete mode 100644 NEXT_RELEASE_QA.md

diff --git a/NEXT_RELEASE.md b/NEXT_RELEASE.md
deleted file mode 100644
index 9d516bd..0000000
--- a/NEXT_RELEASE.md
+++ /dev/null
@@ -1,29 +0,0 @@
-https://github.com/Crosstalk-Solutions/project-nomad/pull/976
-https://github.com/Crosstalk-Solutions/project-nomad/pull/989
-https://github.com/Crosstalk-Solutions/project-nomad/pull/990
-https://github.com/Crosstalk-Solutions/project-nomad/pull/861
-https://github.com/Crosstalk-Solutions/project-nomad/pull/939
-https://github.com/Crosstalk-Solutions/project-nomad/pull/961
-https://github.com/Crosstalk-Solutions/project-nomad/pull/991
-https://github.com/Crosstalk-Solutions/project-nomad/pull/977
-https://github.com/Crosstalk-Solutions/project-nomad/pull/975
-https://github.com/Crosstalk-Solutions/project-nomad/pull/978
-https://github.com/Crosstalk-Solutions/project-nomad/pull/980
-https://github.com/Crosstalk-Solutions/project-nomad/pull/983
-https://github.com/Crosstalk-Solutions/project-nomad/pull/985
-https://github.com/Crosstalk-Solutions/project-nomad/pull/991
-https://github.com/Crosstalk-Solutions/project-nomad/pull/986
-https://github.com/Crosstalk-Solutions/project-nomad/pull/993
-https://github.com/Crosstalk-Solutions/project-nomad/pull/995
-https://github.com/Crosstalk-Solutions/project-nomad/pull/994
-https://github.com/Crosstalk-Solutions/project-nomad/pull/997
-https://github.com/Crosstalk-Solutions/project-nomad/pull/998
-https://github.com/Crosstalk-Solutions/project-nomad/pull/999
-https://github.com/Crosstalk-Solutions/project-nomad/pull/1000
-https://github.com/Crosstalk-Solutions/project-nomad/pull/940
-https://github.com/Crosstalk-Solutions/project-nomad/pull/981
-https://github.com/Crosstalk-Solutions/project-nomad/pull/954
-https://github.com/Crosstalk-Solutions/project-nomad/pull/996
-https://github.com/Crosstalk-Solutions/project-nomad/pull/1001
-https://github.com/Crosstalk-Solutions/project-nomad/pull/1002
-https://github.com/Crosstalk-Solutions/project-nomad/pull/1003
diff --git a/NEXT_RELEASE_NOTES.md b/NEXT_RELEASE_NOTES.md
deleted file mode 100644
index f77f731..0000000
--- a/NEXT_RELEASE_NOTES.md
+++ /dev/null
@@ -1,37 +0,0 @@
-## Version 1.33.0 - June 9, 2026
-
-> Note: version number and date are a best guess for review — adjust as needed before publishing.
-
-### Features
-- **Automatic App Updates**: Installed apps (the "Supply Depot" sibling containers) can now keep themselves up to date with opt-in, hands-off minor/patch updates, mirroring the core auto-update feature. Updates are gated behind a two-level opt-in — a global master switch in Settings → Updates **and** a per-app toggle in the Supply Depot — and respect the shared update window, cool-off period, disk/in-progress pre-flight checks, and per-app failure backoff. Major versions are never auto-applied. Thanks @jakeaturner for the contribution!
-- **Automatic Content Updates**: Completing the auto-update trilogy, installed Kiwix ZIM files and PMTiles maps can now update themselves on an opt-in basis. Content updates run on their own dedicated overnight window and bandwidth cap (separate from the app/core schedule, since content downloads are multi-GB), check the upstream Kiwix and PMTiles catalogs directly, and keep the AI Knowledge Base in sync when a ZIM is replaced. Thanks @jakeaturner for the contribution!
-- **Supply Depot — Custom Launch URLs**: You can now override an app's "Open" link with a reverse-proxy or local-DNS address (e.g. `https://jellyfin.myhomelab.net`). The override is stored separately so the default link is always recoverable, survives reseeds/upgrades, and is validated on both client and server. Thanks @jakeaturner for the contribution!
-- **Supply Depot — Version & Update visibility**: App cards now show the installed version next to the app name (e.g. `Kiwix · 3.7.0`), and the "Update available" pill now stands out with a solid desert-orange fill so available updates actually draw the eye. Thanks @chriscrosstalk for the contribution!
-- **Maps — Persistent View**: The Maps page now remembers your position and zoom across refreshes instead of resetting to the default US-wide view. The saved view is bounds-checked, so a corrupt value safely falls back to the default. Thanks @chriscrosstalk for the contribution!
-- **Configuration — Redis database selection**: Added a `REDIS_DB` environment variable so operators can pick a Redis logical database (0–15) for the job queue and live-update transport. This prevents key collisions when a single Redis instance is shared across multiple stacks (common in homelabs). Defaults to db 0, preserving existing behavior. Thanks @johno10661 for the contribution!
-
-### Bug Fixes
-- **Storage**: When the admin storage volume is relocated to another disk, child apps (Kiwix, Ollama, Qdrant, Flatnotes, Kolibri) now automatically follow to the new location instead of mounting the old, empty path. The host storage root is now derived from the admin's actual mount, with an explicit `NOMAD_STORAGE_PATH` override and clearer compose comments. Thanks @chriscrosstalk for the fix!
-- **System**: A failed service update now rolls back to the previous container if the new one fails to start, so the service stays up on the old version instead of being left down. Also clears any stale leftover container so a retry can't wedge indefinitely. Thanks @chriscrosstalk for the fix!
-- **System**: Service install failures caused by a host port conflict (commonly a native Ollama install already on port 11434) now show a clear, actionable message with the exact commands to resolve it, instead of a raw Docker error. Thanks @chriscrosstalk for the fix!
-- **System**: The per-service Update button is now disabled and shows "Updating..." while an update is in flight, preventing double-clicks that previously raced into Docker errors. The in-progress state is durable, so it survives a page reload during a multi-GB pull. Thanks @chriscrosstalk for the fix!
-- **System Updates**: Update checks no longer crash for images with more than 1,000 tags (Ollama, Filebrowser). Registry pagination URLs are now resolved correctly, so the "Check for Updates" flow returns versions instead of failing silently — fixing Ollama appearing pinned at an old version. Thanks @chriscrosstalk for the fix!
-- **System**: Internet status checks no longer report "No internet connection" on networks that block or hijack Cloudflare's 1.1.1.1. The check now probes additional hosts the app already contacts (GitHub and the Project N.O.M.A.D. API) in parallel and accepts any HTTP response as "online." Thanks @akashsalan for the fix!
-- **AI Assistant**: Oversized embedding chunks are now truncated and retried instead of being silently dropped, ending the retry storm that could peg the GPU and flood logs (the "api/embed for weeks" issue). The OpenAI-compatible fallback path now also passes context and truncation settings. Thanks @chriscrosstalk for the fix!
-- **AI Assistant**: Chat suggestions now use your selected model (falling back to the *smallest* installed model) instead of the largest. This prevents a flagship model that exceeds available VRAM from hanging the chat page and returning a 500 error. Thanks @johno10661 for the fix!
-- **Knowledge Base**: The embedded-chunk count for batched ZIM ingestion is now persisted accurately across continuation batches, instead of reporting only the final batch's count. Thanks @Metbcy for the fix!
-- **Knowledge Base**: The "ingestion may have stalled" (partial-stall) warning no longer fires falsely on link-out- or PDF-heavy ZIMs that legitimately have little embeddable text. Thanks @chriscrosstalk for the fix!
-- **Knowledge Base**: ZIM ingestion progress no longer freezes at 99% on multi-page archives (e.g. iFixit). Progress now creeps forward monotonically and only reports 100% on the genuinely final batch. Thanks @chriscrosstalk for the fix!
-- **Content**: Installing a newer version of a curated map or ZIM now removes the superseded file from disk, preventing silent accumulation of orphaned content (potentially hundreds of GB). Deletion is gated behind strict safety rails — only tracked, genuinely-replaced, strictly-newer files within the content store are ever removed; sideloaded files are never touched. Thanks @chriscrosstalk for the fix!
-- **Content**: Curated Wikipedia-themed ZIMs (e.g. `wikipedia_en_medicine_maxi` from Medicine → Comprehensive) are no longer wiped on restart. Reconciliation now skips only the single file actually managed by the Wikipedia selector, matched by exact filename. Thanks @chriscrosstalk for the fix!
-- **Maps**: Having both an old and new copy of the same map region on disk no longer blanks the entire map. Map sources are now de-duplicated to the newest file per region, and already-broken installs recover automatically on the next page load. Thanks @chriscrosstalk for the fix!
-- **Information Library (Kiwix)**: Kiwix now self-heals a missing or corrupt library file on startup by rebuilding it from the ZIM files on disk, instead of coming up with an empty library and no path to recovery. Thanks @chriscrosstalk for the fix!
-- **Docker**: Failed image pulls (dropped/metered connection, bad manifest, disk full mid-pull) are now correctly treated as failures across all pull paths, instead of proceeding to create a container from a missing or partial image and surfacing a confusing downstream error. Thanks @chriscrosstalk for the fix!
-- **Security**: Hardened the private-URL/SSRF guard by replacing the regex blocklist with proper IP-range classification (`ipaddr.js`) and normalizing the host first. This blocks alternate IP encodings and trailing-dot bypasses (e.g. `localhost.`) while no longer over-blocking legitimate public addresses. RFC1918 ranges and bare LAN hostnames remain allowed for local appliances. Thanks @chriscrosstalk for the fix!
-- **Install**: Hardened the install script — the NVIDIA toolkit GPG step now runs non-interactively so it doesn't silently skip on non-TTY installs, and helper-script downloads now retry to reduce transient partial-install failures. Thanks @Gujiassh for the fix!
-
-### Improvements
-- **License & Docs**: Corrected the package license metadata to `Apache-2.0` (the project has been Apache-2.0 for some time), added a real project description, and fixed a dead Troubleshooting link plus several README typos. Thanks @chriscrosstalk for the contribution!
-- **Dependencies**: Bumped React and React DOM. Thanks @jakeaturner for the contribution!
-- **Dependencies**: Bumped autoprefixer. Thanks @jakeaturner for the contribution!
-- **Dependencies**: Bumped BullMQ to 5.77.6 and updated affected job calls to the new arguments shape. Thanks @jakeaturner for the contribution!
diff --git a/NEXT_RELEASE_OVERVIEW.md b/NEXT_RELEASE_OVERVIEW.md
deleted file mode 100644
index 59458f5..0000000
--- a/NEXT_RELEASE_OVERVIEW.md
+++ /dev/null
@@ -1,56 +0,0 @@
-# Next Release — Overview for RC/Beta Testers
-
-This release's headline is the **automatic-update trilogy** finally coming together, plus a batch of reliability fixes for updates, content management, the Knowledge Base, and maps. A lot of this cycle was hardening real-world failure modes reported by the community.
-
-## Headline: Auto-Update Trilogy is complete
-
-NOMAD can now keep itself current at three layers, each **opt-in and off by default**:
-
-1. **Core / Admin** — already shipped previously.
-2. **Installed Apps (Supply Depot)** — *new this release.* Hands-off minor/patch updates for sibling-container apps.
-3. **Installed Content (ZIM + Maps)** — *new this release.* Opt-in updater for Kiwix ZIM files and PMTiles maps.
-
-Key design points testers should understand:
-- **App updates use a two-level opt-in**: a global master switch (Settings → Updates) **and** a per-app toggle (Supply Depot). Both must be on. This is deliberate — third-party app images are outside our control, so each app's auto-update requires an explicit choice.
-- **Content updates are separate on purpose**: they run on their own overnight window and bandwidth cap because ZIM downloads are multi-GB. The UI strongly recommends setting a cap.
-- **Major versions are never auto-applied.** Only minor/patch.
-- Both features have **failure backoff / self-disable** so a misbehaving upstream can't loop forever, and **pre-flight checks** (disk space, no downloads in progress) gate every run.
-- When content auto-updates replace a ZIM, the **AI Knowledge Base mirrors the prior indexed state** (re-indexes if it was indexed, leaves it alone if not).
-
-## Update reliability fixes (these unblock the above)
-- **Update checks no longer crash on high-tag-count images** (Ollama, Filebrowser had >1000 tags). Previously Ollama appeared "stuck" at an old version because the check failed before evaluating newer tags.
-- **Failed service updates now roll back** to the previous container instead of leaving the service down — and no longer wedge on retry.
-- **The Update button now disables + shows "Updating..."** during in-flight updates and survives a page reload, preventing double-click races.
-- **Port-conflict errors are now human-readable** (e.g. a native Ollama already on :11434 now gives you the exact fix commands).
-- **App cards now show the installed version** and a much more visible orange "Update available" pill.
-
-## Knowledge Base / AI Assistant
-- **Embed retry storm fixed**: oversized chunks are truncated-and-retried instead of silently dropped and re-embedded 30× (the "pegged GPU / api/embed for weeks" issue).
-- **ZIM ingestion progress no longer freezes at 99%** on multi-page archives (iFixit).
-- **Accurate embedded-chunk counts** across batched ZIM ingestion.
-- **No more false "ingestion stalled" warnings** on link-out/PDF-heavy ZIMs that legitimately have little text.
-- **Chat suggestions** now use your selected model (or the smallest installed), so a too-large flagship model can't hang the chat page.
-
-## Maps
-- **View persists across refresh** (position + zoom).
-- **Duplicate region files no longer blank the entire map**; broken installs self-recover on next load.
-
-## Content management
-- **Superseded curated files are now cleaned up** when a newer version installs (no more silent multi-GB orphan accumulation), behind strict safety rails so sideloaded files are never touched.
-- **Curated Wikipedia-themed ZIMs no longer get wiped on restart.**
-
-## Storage / Install / System / Security
-- **Relocating the admin storage volume now moves child apps with it** (Kiwix no longer comes up empty after moving storage to another disk).
-- **Kiwix self-heals a missing/corrupt library file on startup.**
-- **Failed Docker image pulls are now treated as failures** instead of proceeding with a partial image.
-- **False "No internet connection" reports fixed** on networks that block Cloudflare 1.1.1.1.
-- **Install script hardened** (non-interactive NVIDIA GPG step, download retries).
-- **SSRF / private-URL guard hardened** with proper IP-range classification and host normalization.
-- **New `REDIS_DB` env var** to pick a Redis logical database (homelab shared-Redis scenarios).
-
-## Also
-- License metadata corrected to Apache-2.0; README link/typo fixes.
-- Dependency bumps: React / React DOM, autoprefixer, BullMQ 5.77.6.
-
-## Honesty notes for testers
-Several fixes were verified by logic/typecheck and unit tests but flagged for **live validation on a real NOMAD host** by their authors — particularly: dense-ZIM embedding (no retry storm), multi-page ZIM progress, superseded-file cleanup (two-version install), storage relocation on a moved-disk box, and the post-#999 update-check flow. These are good targets for hands-on testing.
diff --git a/NEXT_RELEASE_QA.md b/NEXT_RELEASE_QA.md
deleted file mode 100644
index 5eeb381..0000000
--- a/NEXT_RELEASE_QA.md
+++ /dev/null
@@ -1,47 +0,0 @@
-# Next Release — QA / Smoke-Test Checklist for RC/Beta Testers
-
-High-level things to poke at. No need to go deep on internals — just confirm the happy path works and the new toggles behave. Items marked ⭐ are the highest-value live tests (authors specifically asked for real-host validation).
-
-## Automatic Updates (new)
-- [ ] **Settings → Updates** loads and shows the new sections: Core, Automatic App Updates, and Content Updates.
-- [ ] **App auto-updates are off by default.** Confirm the global master switch and each per-app toggle (Supply Depot → Manage) start off.
-- [ ] With the master switch **off**, a per-app toggle reads "App auto-updates off — open Settings" and takes you to the Updates page.
-- [ ] Turn on the master switch + one app's toggle; confirm it persists across a reload and shows eligibility / cool-off / last-run status.
-- [ ] **Content Updates**: enable the opt-in switch, confirm it prompts/recommends setting a bandwidth cap and uses its own overnight window.
-- [ ] (If feasible) ⭐ Let an eligible app or content item actually auto-update in its window and confirm it succeeds and reflects the new version.
-
-## Update reliability
-- [ ] ⭐ **Check for Updates** on a box with **Ollama** installed — it should return versions (not silently fail / appear pinned).
-- [ ] Trigger a service update (e.g. AI Assistant/Ollama). The **Update button disables and shows "Updating..."**, and the activity feed shows live progress.
-- [ ] Reload the page mid-update — the button stays disabled (state is durable).
-- [ ] Click Update twice quickly — the second click is rejected cleanly, no Docker error.
-- [ ] **Port conflict message**: with a native Ollama running on :11434, attempt to install/start nomad_ollama and confirm you get a clear message with fix commands (not a raw Docker error).
-- [ ] ⭐ Force a service update to fail to start and confirm the **old container is restored** (service stays up) and a retry isn't wedged.
-- [ ] App cards show the **installed version** (e.g. `Kiwix · 3.7.0`) and a visible **orange "Update available"** pill where applicable.
-
-## AI Assistant / Knowledge Base
-- [ ] ⭐ Ingest a **dense ZIM** (e.g. medlineplus / a stackexchange ZIM) on a CPU/low-VRAM box — confirm **no endless `api/embed` loop**, no pegged GPU, and Qdrant point count grows.
-- [ ] ⭐ Ingest a **multi-page ZIM** (iFixit) — progress should climb smoothly and **not freeze at 99%**; it completes.
-- [ ] Ingest a **link-out/PDF-heavy ZIM** — confirm it does **not** show a false "ingestion may have stalled" warning.
-- [ ] After batched ZIM ingestion, the reported **embedded-chunk count looks right** (not absurdly low vs. what was stored).
-- [ ] **Chat suggestions** load quickly and don't error, even with a large model on disk; they use your selected model.
-
-## Maps
-- [ ] Pan/zoom the map, **refresh** — the view is restored (not reset to US-wide).
-- [ ] If you have an old + new copy of the same region on disk, the **map still renders** (doesn't go fully blank).
-
-## Content management
-- [ ] ⭐ Install a curated map or ZIM, then install a **newer version** — confirm the **old file is removed**, the new one is present and served, and any **sideloaded** same-resource file is left untouched.
-- [ ] Install a curated **Wikipedia-themed ZIM** (e.g. Medicine → Comprehensive), **restart**, and confirm it's **still listed** (not wiped, tier not downgraded).
-
-## Storage / Install / System
-- [ ] ⭐ **Relocate the admin storage volume** to another disk (via compose) and confirm Kiwix and other child apps find their content at the new location (Kiwix not empty).
-- [ ] Delete/corrupt the Kiwix library file, restart — Kiwix **self-heals** and serves content again.
-- [ ] On a network that blocks Cloudflare 1.1.1.1, confirm NOMAD does **not** show "No internet connection" while downloads work.
-- [ ] Run the install script on a non-TTY / scripted environment — NVIDIA toolkit setup is **not** silently skipped.
-- [ ] (Homelab) Set `REDIS_DB=10` and confirm queue jobs and live updates work without colliding with other Redis users.
-
-## Sanity / regression
-- [ ] Default install (no storage relocation, no auto-update opt-in) behaves exactly as before — none of the new gates change default behavior.
-- [ ] App "Open" links work; setting a **custom URL** on an app overrides the link and shows the live "Opens as:" preview; clearing it restores the default.
-- [ ] General UI smoke: dashboard, Supply Depot, Content Manager, Maps, AI chat all load without console errors.
diff --git a/package.json b/package.json
index 859541c..c9cc0d7 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "project-nomad",
-  "version": "1.32.1",
+  "version": "1.39.0",
   "description": "Project N.O.M.A.D. (Node for Offline Media, Archives, and Data) - an offline-first knowledge and education server.",
   "main": "index.js",
   "scripts": {

From 536ad4927731121a7cd0eb2554c06ca5c6b6f359 Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Thu, 11 Jun 2026 09:00:48 -0700
Subject: [PATCH 55/83] docs: update in-app docs for v1.33 Supply Depot +
 auto-updates

Refresh the in-app Markdoc docs for the v1.33 feature set:

- Repoint dead /settings/apps links to the Supply Depot (/supply-depot)
  across home, getting-started, and faq; reword "Apps page" / "Settings
  -> Apps" to "Supply Depot". The old /apps route now redirects to the
  Supply Depot.
- Expand supply-depot-apps.md with a "Managing your apps" section (Docs/
  Edit/Logs/Stats/Update/Remove, version + update-available visibility,
  custom launch URLs, per-app auto-update toggle) and a "Bringing your
  own app" section for custom Docker containers.
- Add a new "Updates" doc (updates.md) covering the auto-update trilogy
  (core/apps/content), manual updates, and the Early Access channel;
  wire it into DOC_ORDER and cross-link from home, getting-started, faq.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 admin/app/services/docs_service.ts |  7 ++--
 admin/docs/faq.md                  | 21 ++++++----
 admin/docs/getting-started.md      | 12 +++---
 admin/docs/home.md                 |  8 ++--
 admin/docs/supply-depot-apps.md    | 32 ++++++++++++++
 admin/docs/updates.md              | 67 ++++++++++++++++++++++++++++++
 6 files changed, 128 insertions(+), 19 deletions(-)
 create mode 100644 admin/docs/updates.md

diff --git a/admin/app/services/docs_service.ts b/admin/app/services/docs_service.ts
index 5ff401c..4ada614 100644
--- a/admin/app/services/docs_service.ts
+++ b/admin/app/services/docs_service.ts
@@ -14,9 +14,10 @@ export class DocsService {
     'use-cases': 3,
     'supply-depot-apps': 4,
     'community-add-ons': 5,
-    'faq': 6,
-    'about': 7,
-    'release-notes': 8,
+    'updates': 6,
+    'faq': 7,
+    'about': 8,
+    'release-notes': 9,
   }
 
   async getDocs() {
diff --git a/admin/docs/faq.md b/admin/docs/faq.md
index e41c611..1a73ea6 100644
--- a/admin/docs/faq.md
+++ b/admin/docs/faq.md
@@ -73,7 +73,7 @@ This helps you balance content coverage against storage usage.
 2. Type your question or request
 3. The AI responds in conversational style
 
-The AI must be installed first — enable it during Easy Setup or install it from the [Apps](/settings/apps) page.
+The AI must be installed first — enable it during Easy Setup or install it from the [Supply Depot](/supply-depot) page.
 
 ### How do I upload documents to the Knowledge Base?
 1. Go to **[Knowledge Base →](/knowledge-base)**
@@ -104,7 +104,7 @@ The Early Access Channel lets you opt in to receive release candidate builds wit
 2. Refresh the page (Ctrl+R or Cmd+R)
 3. Go back to the Command Center and try again
 4. Check Settings → System to see if the service is running
-5. Try restarting the service (Stop, then Start in Apps manager)
+5. Try restarting the service (Stop, then Start in the Supply Depot)
 
 ### Maps show a gray/blank area
 
@@ -119,7 +119,7 @@ The Maps feature requires downloaded map data. If you see a blank area:
 This usually means the Information Library service started before its Kiwix library index was fully initialized.
 
 Try this recovery flow:
-1. Go to **[Apps](/settings/apps)**
+1. Go to **[Supply Depot](/supply-depot)**
 2. Stop **Information Library (Kiwix)**
 3. Wait 10-15 seconds, then start it again
 4. If the error persists, run **Force Reinstall** for Information Library from the same page
@@ -140,7 +140,7 @@ N.O.M.A.D. automatically detects NVIDIA GPUs when the NVIDIA Container Toolkit i
 
 1. **Install an NVIDIA GPU** in your server (if not already present)
 2. **Install the NVIDIA Container Toolkit** on the host — follow the [official installation guide](https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/install-guide.html)
-3. **Reinstall the AI Assistant** — Go to [Apps](/settings/apps), find AI Assistant, and click **Force Reinstall**
+3. **Reinstall the AI Assistant** — Go to [Supply Depot](/supply-depot), find AI Assistant, and click **Force Reinstall**
 
 N.O.M.A.D. will detect the GPU during installation and configure the AI to use it automatically. You'll see "NVIDIA container runtime detected" in the installation progress.
 
@@ -151,7 +151,7 @@ N.O.M.A.D. will detect the GPU during installation and configure the AI to use i
 When you add or swap a GPU, N.O.M.A.D. needs to reconfigure the AI container to use it:
 
 1. Make sure the **NVIDIA Container Toolkit** is installed on the host
-2. Go to **[Apps](/settings/apps)**
+2. Go to **[Supply Depot](/supply-depot)**
 3. Find the **AI Assistant** and click **Force Reinstall**
 
 Force Reinstall recreates the AI container with GPU support enabled. Without this step, the AI continues to run on CPU only.
@@ -163,7 +163,7 @@ N.O.M.A.D. checks whether your GPU is actually accessible inside the AI containe
 ### AI Chat not available
 
 The AI Chat page requires the AI Assistant to be installed first:
-1. Go to **[Apps](/settings/apps)**
+1. Go to **[Supply Depot](/supply-depot)**
 2. Install the **AI Assistant**
 3. Wait for the installation to complete
 4. The AI Chat will then be accessible from the home screen or [Chat](/chat)
@@ -171,7 +171,7 @@ The AI Chat page requires the AI Assistant to be installed first:
 ### Knowledge Base upload stuck
 
 If a document upload appears stuck in the Knowledge Base:
-1. Check that the AI Assistant is running in **Settings → Apps**
+1. Check that the AI Assistant is running in **Settings → Supply Depot**
 2. Large documents take time to process — wait a few minutes
 3. Try uploading a smaller document to verify the system is working
 4. Check **Settings → System** for any error messages
@@ -190,7 +190,7 @@ If submission fails, check the error message for details.
 The service might still be starting up. Wait 1-2 minutes and try again.
 
 If the problem persists:
-1. Go to **Settings → Apps**
+1. Go to **Settings → Supply Depot**
 2. Find the problematic service
 3. Click **Restart**
 4. Wait 30 seconds, then try again
@@ -233,12 +233,17 @@ Yes, while you have internet access. Updates include:
 - Security improvements
 - Performance enhancements
 
+### Can N.O.M.A.D. update itself automatically?
+Yes. N.O.M.A.D. can keep its software, its installed apps, and its content current on its own. Automatic updates are **opt-in and off by default** — you turn on what you want from **Settings → Updates** (and, for apps, a per-app toggle in the Supply Depot). They only run inside a time window you choose, after safety checks, and never apply major version jumps automatically. See the **[Updates guide](/docs/updates)** for a full walkthrough.
+
 ### How do I update content (Wikipedia, etc.)?
 Content updates are separate from software updates:
 1. Go to **Settings → Content Manager** or **Content Explorer**
 2. Check for newer versions of your installed content
 3. Download updated versions as needed
 
+You can also turn on **automatic content updates** so installed Wikipedia/ZIM libraries and map regions refresh on their own overnight — see the [Updates guide](/docs/updates).
+
 Tip: New Wikipedia snapshots are released approximately monthly.
 
 ### What happens if an update fails?
diff --git a/admin/docs/getting-started.md b/admin/docs/getting-started.md
index 3287da5..de65ddc 100644
--- a/admin/docs/getting-started.md
+++ b/admin/docs/getting-started.md
@@ -37,7 +37,7 @@ The Information Library stores compressed versions of websites and references th
 - Classic books from Project Gutenberg
 
 **How to use it:**
-1. Click **Information Library** from the Command Center home screen or [Apps](/settings/apps) page
+1. Click **Information Library** from the Command Center home screen or the [Supply Depot](/supply-depot)
 2. Choose a collection (like Wikipedia)
 3. Search or browse just like the regular website
 
@@ -54,7 +54,7 @@ The Education Platform provides complete educational courses that work offline.
 - Works for all ages
 
 **How to use it:**
-1. Click **Education Platform** from the Command Center home screen or [Apps](/settings/apps) page
+1. Click **Education Platform** from the Command Center home screen or the [Supply Depot](/supply-depot)
 2. Sign in or create a learner account
 3. Browse courses and start learning
 
@@ -82,9 +82,9 @@ N.O.M.A.D. includes a built-in AI chat interface powered by Ollama. It runs enti
 
 **Tip:** Be specific in your questions. Instead of "tell me about plants," try "what vegetables grow well in shade?"
 
-**Note:** The AI Assistant must be installed first. Enable it during Easy Setup or install it from the [Apps](/settings/apps) page.
+**Note:** The AI Assistant must be installed first. Enable it during Easy Setup or install it from the [Supply Depot](/supply-depot).
 
-**GPU Acceleration:** If your server has an NVIDIA GPU with the [NVIDIA Container Toolkit](https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/install-guide.html) installed, N.O.M.A.D. will automatically use it for AI — dramatically faster responses (10-20x improvement). If you add a GPU later, go to [Apps](/settings/apps) and **Force Reinstall** the AI Assistant to enable it.
+**GPU Acceleration:** If your server has an NVIDIA GPU with the [NVIDIA Container Toolkit](https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/install-guide.html) installed, N.O.M.A.D. will automatically use it for AI — dramatically faster responses (10-20x improvement). If you add a GPU later, go to the [Supply Depot](/supply-depot) and **Force Reinstall** the AI Assistant to enable it.
 
 ---
 
@@ -141,7 +141,7 @@ View maps without internet. Download the regions you need before going offline.
 
 As your needs change, you can add more content anytime:
 
-- **More apps:** Settings → Apps
+- **More apps:** Settings → Supply Depot
 - **More references:** Settings → Content Explorer or Content Manager
 - **More map regions:** Settings → Maps Manager
 - **More educational content:** Through Kolibri's built-in content browser
@@ -184,6 +184,8 @@ While you have internet, periodically check for updates:
 
 Content updates (Wikipedia, maps, etc.) can be managed separately from software updates.
 
+**Automatic updates:** N.O.M.A.D. can also keep itself current without you having to check. Software, installed apps, and content can each be set to update automatically on an opt-in basis, with safety checks and a time window you control. See the **[Updates guide](/docs/updates)** for the full picture.
+
 **Early Access Channel:** Want the latest features before they hit stable? Enable the Early Access Channel from the Check for Updates page to receive release candidate builds. You can switch back to stable anytime.
 
 ### Monitoring System Health
diff --git a/admin/docs/home.md b/admin/docs/home.md
index a059a4f..f8d92ff 100644
--- a/admin/docs/home.md
+++ b/admin/docs/home.md
@@ -15,12 +15,12 @@ Think of it as having Wikipedia, Khan Academy, an AI assistant, and offline maps
 ### Browse Offline Knowledge
 Access millions of Wikipedia articles, medical references, how-to guides, and ebooks — all stored locally on your server. No internet required.
 
-*Launch the Information Library from the home screen or the [Apps](/settings/apps) page.*
+*Launch the Information Library from the home screen or the [Supply Depot](/supply-depot).*
 
 ### Learn Something New
 Khan Academy courses covering math, science, economics, and more. Complete with videos and exercises, all available offline.
 
-*Launch the Education Platform from the home screen or the [Apps](/settings/apps) page.*
+*Launch the Education Platform from the home screen or the [Supply Depot](/supply-depot).*
 
 ### Chat with AI
 Ask questions, get explanations, brainstorm ideas, or get help with writing. Your local AI assistant works completely offline — and you can upload documents to the Knowledge Base for document-aware responses.
@@ -60,7 +60,7 @@ Or explore the **[Getting Started Guide](/docs/getting-started)** for a walkthro
 |--------------|---------|
 | Chat with the AI | [AI Chat →](/chat) |
 | Upload documents for AI | [Knowledge Base →](/knowledge-base) |
-| Download more content | [Install Apps →](/settings/apps) |
+| Install more apps | [Supply Depot →](/supply-depot) |
 | Add Wikipedia/reference content | [Content Explorer →](/settings/zim/remote-explorer) |
 | Manage installed content | [Content Manager →](/settings/zim) |
 | Download map regions | [Maps Manager →](/settings/maps) |
@@ -80,4 +80,6 @@ N.O.M.A.D. works best when kept up to date while you have internet access. This
 
 When you go offline, you'll have everything you need — the last synced versions of all your content.
 
+You can update on demand, or turn on **automatic updates** so N.O.M.A.D. keeps its software, apps, and content current on its own while you have internet. See the **[Updates guide](/docs/updates)** for how it works.
+
 **[Check for Updates →](/settings/update)**
diff --git a/admin/docs/supply-depot-apps.md b/admin/docs/supply-depot-apps.md
index 7b782c5..bd9eb0a 100644
--- a/admin/docs/supply-depot-apps.md
+++ b/admin/docs/supply-depot-apps.md
@@ -8,6 +8,38 @@ A quick note on logins: some of these apps have their own accounts, separate fro
 
 ---
 
+## Managing your apps
+
+Every app you install gets a **Manage** menu on its card. From there you can:
+
+- **Docs** — jump straight to the NOMAD getting-started notes for that app (the same per-app sections you'll find below).
+- **Edit** — change an app's settings: port mappings, volume binds, environment variables, and memory/CPU limits. This works for curated apps too, not just custom ones. Your edits are merged into the app's existing setup, so advanced settings (like GPU access on the AI Assistant) are preserved, and an edited app stops getting overwritten by catalog updates.
+- **Logs** and **Stats** — open a live view of an app's log output or its current memory and CPU use, handy when something isn't behaving.
+- **Update** and **Remove** — pull the latest version of an app, or remove it (optionally deleting its image too). If an update's new container fails to start, NOMAD automatically rolls back to the version that was working.
+
+**Seeing what version you're running:** Each app card shows the installed version right next to the app name (for example, `Kiwix · 3.7.0`). When a newer version is available, an orange **Update available** pill appears on the card so it's easy to spot at a glance.
+
+**Custom "Open" links:** By default the **Open** button points at the app on your NOMAD's own address. If you run a reverse proxy or local DNS and would rather open an app at a friendlier address (for example `https://jellyfin.myhomelab.net`), use **Manage › Edit** to set a custom launch URL. NOMAD keeps your original link safely on file, so you can always switch back, and the override sticks across upgrades.
+
+**Keeping apps updated automatically:** Installed apps can update themselves hands-off. This is opt-in at two levels — a master switch in **Settings → Updates** and a per-app toggle in the Supply Depot — and only minor and patch updates are ever applied automatically (major versions always stay manual). See the [Updates guide](/docs/updates) for the full story.
+
+---
+
+## Bringing your own app
+
+Beyond the curated catalog, the Supply Depot can run **your own Docker container** as a managed app alongside everything else. Click **Add a custom app** and tell NOMAD:
+
+- the **image** to pull (for example `ghcr.io/owner/app:1.2.3`),
+- any **port mappings**, **volume binds**, **environment variables**, and **memory/CPU limits** it needs.
+
+As you fill it in, NOMAD runs a live pre-flight check and warns you about things like port conflicts or risky settings. Some warnings (an untrusted registry, or a `:latest` tag that can't be version-tracked) are advisory and you can choose **Install anyway**; genuinely unsafe configurations are blocked outright.
+
+Once installed, a custom app behaves like any other: it gets the same **Manage** menu (Edit, Logs, Stats, Update, Remove), shows its version on the card, and can opt in to automatic updates. NOMAD hardens host-path binds and scopes logs and stats to its own managed containers, so a custom app can't reach outside what you give it.
+
+> A custom app is exactly that — yours. NOMAD runs it and gets out of the way; it doesn't provide setup docs or support for software outside the curated catalog. Check the project's own documentation for how to use it.
+
+---
+
 ## Stirling PDF {% #stirling-pdf %}
 
 A full toolbox for working with PDFs, all on your own hardware. Merge and split files, convert to and from PDF, compress, rotate, add or remove passwords, OCR scanned documents so they're searchable, sign, stamp, and redact. There are over 50 tools in here, and because it runs locally, none of your documents ever leave your NOMAD.
diff --git a/admin/docs/updates.md b/admin/docs/updates.md
new file mode 100644
index 0000000..0d372f9
--- /dev/null
+++ b/admin/docs/updates.md
@@ -0,0 +1,67 @@
+# Keeping N.O.M.A.D. Updated
+
+N.O.M.A.D. works best when it's kept current while you have internet, so it's ready with the latest software and content the next time you go offline. This page explains what can be updated, how to do it on demand, and how to let N.O.M.A.D. handle it for you automatically.
+
+---
+
+## The three kinds of updates
+
+There are three separate things that can be updated, and you control each one independently:
+
+1. **Software (the core)** — N.O.M.A.D. itself: the Command Center, new features, bug fixes, and security improvements.
+2. **Apps** — the installable apps from the [Supply Depot](/supply-depot) (Kiwix, the AI Assistant, and any others you've added).
+3. **Content** — your offline material: Wikipedia and other Kiwix libraries, and downloaded map regions.
+
+You can update any of these on demand, or set any of them to update automatically.
+
+---
+
+## Updating on demand
+
+To check for and install updates yourself:
+
+1. Go to **[Settings → Check for Updates](/settings/update)**.
+2. If a software update is available, click to install it. N.O.M.A.D. downloads the update and restarts (usually 2–5 minutes).
+3. Apps can be updated from their card in the [Supply Depot](/supply-depot) using **Manage › Update**.
+4. Content is managed from **Settings → Content Manager** and **Content Explorer**, where you can download newer versions of installed libraries and maps.
+
+If a software or app update ever fails, N.O.M.A.D. is designed to recover gracefully — the previous working version keeps running, so your server stays up.
+
+---
+
+## Automatic updates
+
+N.O.M.A.D. can keep itself current without you having to remember to check. **Automatic updates are opt-in and off by default** — nothing updates on its own until you turn it on. You manage all of it from **Settings → Updates**.
+
+A few things are true across all three:
+
+- **You choose a time window.** Automatic updates only run during the hours you set, so they never interrupt you mid-use.
+- **Major versions are never automatic.** Only minor and patch updates apply on their own; a big version jump always waits for you to do it manually, on purpose.
+- **Safety checks come first.** Before applying anything, N.O.M.A.D. confirms there's enough disk space and that no other update, download, or install is already in progress.
+- **Being offline is harmless.** If N.O.M.A.D. can't reach the internet to check, it simply skips that round and tries again later.
+
+### Automatic software (core) updates
+
+Turn this on from **Settings → Updates**. When enabled, N.O.M.A.D. updates its own core to newer releases within the same major version, during your chosen window, after a configurable **cool-off** period (so a brand-new release has time to prove itself before your server takes it). The same page shows the toggle, the window, the cool-off setting, and live status. If updates fail repeatedly for a real reason, N.O.M.A.D. turns the feature back off and lets you know rather than retrying forever.
+
+### Automatic app updates
+
+App auto-updates are opt-in at **two levels**: a master switch in **Settings → Updates**, *and* a per-app toggle on each app's card in the [Supply Depot](/supply-depot). Both have to be on for an app to update itself. App updates share the same update window and cool-off as the core, apply only minor and patch versions, and back off automatically for any individual app that keeps failing.
+
+### Automatic content updates
+
+Installed Wikipedia/ZIM libraries and map regions can refresh themselves too. Because content downloads are large (often many gigabytes), content updates run on their **own dedicated overnight window** with a **bandwidth cap**, separate from the software and app schedule. N.O.M.A.D. checks the upstream Kiwix and map catalogs directly, and when a Wikipedia library is replaced with a newer version, it keeps the AI Knowledge Base in sync automatically.
+
+---
+
+## Early Access Channel
+
+Want new features before they reach the stable release? Enable the **Early Access Channel** from the [Check for Updates](/settings/update) page to receive release-candidate builds. Early-access builds may contain rough edges — you can switch back to stable at any time.
+
+---
+
+## Before you go offline
+
+Whatever you choose, the habit that matters most is simple: **update while you still have internet.** Whether you do it by hand or let automatic updates handle it, make sure your software and content are current before you head somewhere without a connection. When you're offline, you'll have the last synced versions of everything ready to go.
+
+**[Check for Updates →](/settings/update)** · **[See what's new in each version →](/docs/release-notes)**

From e2beb7ebebf3d23a3563151087650c841d0093dd Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Thu, 11 Jun 2026 10:44:29 -0700
Subject: [PATCH 56/83] docs: document Supply Depot + auto-updates in README
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bring the GitHub-facing README in line with the v1.33 feature set:

- Add Supply Depot (one-click app catalog + bring-your-own custom
  Docker containers) and Automatic Updates to the "Built-in
  capabilities" list and the "What's Included" table.
- Fix the Offline Maps row, which claimed "navigation" — NOMAD maps
  are download/view only, with no routing. Reword to "offline viewing
  and search."

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 README.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index c859e9d..ba7738e 100644
--- a/README.md
+++ b/README.md
@@ -48,6 +48,8 @@ N.O.M.A.D. is a management UI ("Command Center") and API that orchestrates a col
 - **Data Tools** — encryption, encoding, and analysis via [CyberChef](https://gchq.github.io/CyberChef/)
 - **Notes** — local note-taking via [FlatNotes](https://github.com/dullage/flatnotes)
 - **System Benchmark** — hardware scoring with a [community leaderboard](https://benchmark.projectnomad.us)
+- **Supply Depot** — a one-click app catalog (PDF tools, file browser, e-book library, password manager, and more) plus the ability to run your own custom Docker containers
+- **Automatic Updates** — opt-in, hands-off updates for the core software, installed apps, and offline content, on a schedule you control
 - **Easy Setup Wizard** — guided first-time configuration with curated content collections
 
 N.O.M.A.D. also includes built-in tools like a Wikipedia content selector, ZIM library manager, and content explorer.
@@ -59,10 +61,11 @@ N.O.M.A.D. also includes built-in tools like a Wikipedia content selector, ZIM l
 | Information Library | Kiwix | Offline Wikipedia, medical references, survival guides, ebooks |
 | AI Assistant | Ollama + Qdrant | Built-in chat with document upload and semantic search |
 | Education Platform | Kolibri | Khan Academy courses, progress tracking, multi-user support |
-| Offline Maps | ProtoMaps | Downloadable regional maps with search and navigation |
+| Offline Maps | ProtoMaps | Downloadable regional maps for offline viewing and search |
 | Data Tools | CyberChef | Encryption, encoding, hashing, and data analysis |
 | Notes | FlatNotes | Local note-taking with markdown support |
 | System Benchmark | Built-in | Hardware scoring, Builder Tags, and community leaderboard |
+| Supply Depot | Built-in | One-click app catalog + bring-your-own custom Docker containers |
 
 ## Device Requirements
 While many similar offline survival computers are designed to be run on bare-minimum, lightweight hardware, Project N.O.M.A.D. is quite the opposite. To install and run the

From 83576ec33d8a16ef758c978abd9b8f6eed14dfd4 Mon Sep 17 00:00:00 2001
From: johno10661 <johno10661@gmail.com>
Date: Mon, 15 Jun 2026 16:30:45 -0400
Subject: [PATCH 57/83] feat(supply-depot): add uninstall for curated apps
 (#1006)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Curated catalog apps could be installed, stopped, and force-reinstalled,
but never removed — the only path off a device was manual docker + DB
surgery. Custom apps already had delete; this adds the equivalent for
curated apps.

POST /api/system/services/uninstall stops and removes the app's
container (optionally its image, same best-effort semantics as custom
app delete) and flips the record back to not-installed so the card
returns to the available catalog. Host bind-mount data is deliberately
left on disk, so a later reinstall picks the app back up where it left
off — unlike force-reinstall, which clears volumes.

Guards: custom apps are rejected (use delete), dependency services are
rejected, and uninstalling a not-installed app is a 409.

UI: installed curated cards get an Uninstall action in the card menu,
with a confirm modal that explains data is preserved and offers the
same remove-image checkbox as custom app delete.
---
 admin/app/controllers/system_controller.ts | 32 ++++++++++++++
 admin/app/services/docker_service.ts       | 28 ++++++++++++
 admin/app/validators/system.ts             |  8 ++++
 admin/inertia/lib/api.ts                   | 10 +++++
 admin/inertia/pages/supply-depot.tsx       | 51 +++++++++++++++++++++-
 admin/start/routes.ts                      |  1 +
 6 files changed, 129 insertions(+), 1 deletion(-)

diff --git a/admin/app/controllers/system_controller.ts b/admin/app/controllers/system_controller.ts
index 08956c6..22f2cde 100644
--- a/admin/app/controllers/system_controller.ts
+++ b/admin/app/controllers/system_controller.ts
@@ -18,6 +18,7 @@ import {
   preflightValidator,
   serviceLogsValidator,
   subscribeToReleaseNotesValidator,
+  uninstallServiceValidator,
   updateCustomAppValidator,
   updateServiceValidator,
   setServiceAutoUpdateValidator,
@@ -467,6 +468,37 @@ export default class SystemController {
         return response.send({ success: true, message: `Custom app ${payload.service_name} deleted` })
     }
 
+    /** Uninstall a curated catalog app: stop + remove its container (optionally its image) and
+     * return the card to the available catalog. App data under the storage path stays on disk,
+     * so a later reinstall picks it back up. Custom apps are removed via deleteCustomApp instead,
+     * which also drops their DB record. */
+    async uninstallService({ request, response }: HttpContext) {
+        const payload = await request.validateUsing(uninstallServiceValidator)
+
+        const service = await Service.query().where('service_name', payload.service_name).first()
+        if (!service) {
+            return response.status(404).send({ error: `Service ${payload.service_name} not found` })
+        }
+        if (service.is_custom) {
+            return response.status(403).send({ error: 'Custom apps are removed via delete.' })
+        }
+        if (service.is_dependency_service) {
+            return response.status(403).send({ error: 'Dependency services cannot be uninstalled directly.' })
+        }
+        if (!service.installed) {
+            return response.status(409).send({ error: `Service ${payload.service_name} is not installed` })
+        }
+
+        const result = await this.dockerService.uninstallService(
+            payload.service_name,
+            payload.remove_image ?? false
+        )
+        if (!result.success) {
+            return response.status(500).send({ success: false, message: result.message })
+        }
+        return response.send({ success: true, message: result.message })
+    }
+
     /** Set or clear an app's custom launch URL (works for curated and custom apps). Purely a
      * metadata change — no container is touched. An empty/invalid value clears the override, after
      * which the default host + port link is used again. */
diff --git a/admin/app/services/docker_service.ts b/admin/app/services/docker_service.ts
index c836705..b951108 100644
--- a/admin/app/services/docker_service.ts
+++ b/admin/app/services/docker_service.ts
@@ -1867,6 +1867,34 @@ export class DockerService {
     }
   }
 
+  /**
+   * Uninstall a curated catalog app: stop and remove its container (and, optionally, its image),
+   * then mark the record not-installed so the card returns to the available catalog. Host
+   * bind-mount data is deliberately left on disk — a later reinstall picks it back up. Contrast
+   * with forceReinstall, which clears volumes and immediately recreates the container.
+   */
+  async uninstallService(
+    serviceName: string,
+    removeImage = false
+  ): Promise<{ success: boolean; message: string }> {
+    const service = await Service.query().where('service_name', serviceName).first()
+    if (!service || !service.installed) {
+      return { success: false, message: `Service ${serviceName} not found or not installed` }
+    }
+
+    // Container/image removal is shared with custom-app deletion — the lookup is by container
+    // name, which is the service_name for curated and custom apps alike.
+    const removal = await this.removeCustomAppContainer(serviceName, removeImage)
+    if (!removal.success) return removal
+
+    service.installed = false
+    service.installation_status = 'idle'
+    await service.save()
+    this.invalidateServicesStatusCache()
+
+    return { success: true, message: `Service ${serviceName} uninstalled` }
+  }
+
   /** Find a container by its managed service name (`/serviceName`), or null. */
   private async _findContainerByName(serviceName: string) {
     const containers = await this.docker.listContainers({ all: true })
diff --git a/admin/app/validators/system.ts b/admin/app/validators/system.ts
index 8f2d5a6..45a1144 100644
--- a/admin/app/validators/system.ts
+++ b/admin/app/validators/system.ts
@@ -131,6 +131,14 @@ export const deleteCustomAppValidator = vine.compile(
   })
 )
 
+export const uninstallServiceValidator = vine.compile(
+  vine.object({
+    service_name: vine.string().trim(),
+    // When true, also remove the backing Docker image (best-effort).
+    remove_image: vine.boolean().optional(),
+  })
+)
+
 export const serviceLogsValidator = vine.compile(
   vine.object({
     tail: vine.number().min(1).max(2000).optional(),
diff --git a/admin/inertia/lib/api.ts b/admin/inertia/lib/api.ts
index f1a8a7e..0b66758 100644
--- a/admin/inertia/lib/api.ts
+++ b/admin/inertia/lib/api.ts
@@ -1078,6 +1078,16 @@ class API {
     })()
   }
 
+  async uninstallService(service_name: string, remove_image = false) {
+    return catchInternal(async () => {
+      const response = await this.client.post<{ success: boolean; message: string }>(
+        '/system/services/uninstall',
+        { service_name, remove_image }
+      )
+      return response.data
+    })()
+  }
+
   async updateCustomAppImage(service_name: string) {
     return catchInternal(async () => {
       const response = await this.client.post<{ success: boolean; message: string }>(
diff --git a/admin/inertia/pages/supply-depot.tsx b/admin/inertia/pages/supply-depot.tsx
index 44c97f3..889f588 100644
--- a/admin/inertia/pages/supply-depot.tsx
+++ b/admin/inertia/pages/supply-depot.tsx
@@ -82,6 +82,7 @@ type Modal =
   | { type: 'restart'; service: ServiceSlim }
   | { type: 'reinstall'; service: ServiceSlim }
   | { type: 'delete'; service: ServiceSlim }
+  | { type: 'uninstall'; service: ServiceSlim }
   | { type: 'logs'; service: ServiceSlim }
   | { type: 'stats'; service: ServiceSlim }
   | { type: 'update'; service: ServiceSlim }
@@ -233,6 +234,16 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
     else setTimeout(() => window.location.reload(), 1000)
   }
 
+  async function handleUninstall(service: ServiceSlim) {
+    setModal(null)
+    setLoading(true)
+    const result = await api.uninstallService(service.service_name, removeImage)
+    setRemoveImage(false)
+    setLoading(false)
+    if (!result?.success) showError(result?.message || 'Failed to uninstall app.')
+    else setTimeout(() => window.location.reload(), 1000)
+  }
+
   async function handleUpdate(service: ServiceSlim) {
     setOpenDropdown(null)
     setLoading(true)
@@ -450,6 +461,7 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
                       onRestart={() => setModal({ type: 'restart', service })}
                       onReinstall={() => setModal({ type: 'reinstall', service })}
                       onDelete={() => setModal({ type: 'delete', service })}
+                      onUninstall={() => setModal({ type: 'uninstall', service })}
                       onLogs={() => setModal({ type: 'logs', service })}
                       onStats={() => setModal({ type: 'stats', service })}
                       onEdit={() => handleEdit(service)}
@@ -484,6 +496,7 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
                       onRestart={() => setModal({ type: 'restart', service })}
                       onReinstall={() => setModal({ type: 'reinstall', service })}
                       onDelete={() => setModal({ type: 'delete', service })}
+                      onUninstall={() => setModal({ type: 'uninstall', service })}
                       onLogs={() => setModal({ type: 'logs', service })}
                       onStats={() => setModal({ type: 'stats', service })}
                       onEdit={() => handleEdit(service)}
@@ -659,6 +672,38 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
         </StyledModal>
       )}
 
+      {/* Uninstall curated app modal */}
+      {modal?.type === 'uninstall' && (
+        <StyledModal
+          title={`Uninstall ${modal.service.friendly_name ?? modal.service.service_name}`}
+          open
+          onCancel={() => {
+            setRemoveImage(false)
+            setModal(null)
+          }}
+          onConfirm={() => handleUninstall(modal.service)}
+          confirmText="Uninstall"
+          confirmIcon="IconTrash"
+          confirmVariant="danger"
+          confirmLoading={loading}
+          icon={<IconAlertTriangle className="text-desert-red" size={40} />}
+        >
+          <div className="space-y-3 text-sm text-text-muted">
+            <p className="font-semibold text-desert-red">This will remove the app from this device.</p>
+            <p>The container will be stopped and removed, and the app returns to the catalog below. App data under the storage folder stays on disk, so reinstalling brings it back as it was.</p>
+            <label className="flex items-center gap-2 cursor-pointer select-none">
+              <input
+                type="checkbox"
+                checked={removeImage}
+                onChange={(e) => setRemoveImage(e.target.checked)}
+                className="accent-desert-red h-4 w-4 rounded"
+              />
+              <span className="text-text-muted text-xs">Also remove the Docker image to reclaim disk space</span>
+            </label>
+          </div>
+        </StyledModal>
+      )}
+
       {/* Logs modal */}
       {modal?.type === 'logs' && (
         <ServiceLogsModal
@@ -738,6 +783,7 @@ interface AppCardProps {
   onRestart: () => void
   onReinstall: () => void
   onDelete: () => void
+  onUninstall: () => void
   onLogs: () => void
   onStats: () => void
   onEdit: () => void
@@ -762,6 +808,7 @@ function AppCard({
   onRestart,
   onReinstall,
   onDelete,
+  onUninstall,
   onLogs,
   onStats,
   onEdit,
@@ -994,7 +1041,9 @@ function AppCard({
                   <DropdownItem icon={<IconRefresh className="h-4 w-4 text-desert-orange" />} label="Force Reinstall" onClick={onReinstall} danger />
                   {service.is_custom ? (
                     <DropdownItem icon={<IconTrash className="h-4 w-4 text-desert-red" />} label="Delete" onClick={onDelete} danger />
-                  ): null}
+                  ): (
+                    <DropdownItem icon={<IconTrash className="h-4 w-4 text-desert-red" />} label="Uninstall" onClick={onUninstall} danger />
+                  )}
                 </div>
               )}
             </div>
diff --git a/admin/start/routes.ts b/admin/start/routes.ts
index 5553cbc..b48f15b 100644
--- a/admin/start/routes.ts
+++ b/admin/start/routes.ts
@@ -169,6 +169,7 @@ router
     router.post('/services/affect', [SystemController, 'affectService'])
     router.post('/services/install', [SystemController, 'installService'])
     router.post('/services/force-reinstall', [SystemController, 'forceReinstallService'])
+    router.post('/services/uninstall', [SystemController, 'uninstallService'])
     router.post('/services/check-updates', [SystemController, 'checkServiceUpdates'])
     router.get('/services/preflight', [SystemController, 'preflightCheck'])
     router.get('/services/suggest-port', [SystemController, 'suggestCustomPort'])

From bd65c885beb32f11efe27568020d2a79acce3a1f Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Tue, 9 Jun 2026 13:59:06 -0700
Subject: [PATCH 58/83] feat(supply-depot): add MeshCore Web with self-signed
 HTTPS

Adds the MeshCore web client to the Supply Depot catalog (host port 8500),
alongside the existing Meshtastic apps. Uses aXistem's prebuilt image of Liam
Cottle's MeshCore client (MeshCore is a sibling LoRa mesh project to Meshtastic).

The image is stock nginx serving a static Flutter build over HTTP, but the
client reaches radios via Web Bluetooth / Web Serial, which browsers only allow
from a secure (HTTPS) context. So we serve it over HTTPS: a new preinstall hook
generates a self-signed cert + a small SSL nginx config into storage/meshcore-web,
both bind-mounted into the container (the config over the image's default.conf),
publishing 443. Same one-time browser-warning approach as Vaultwarden, whose
openssl cert generation is refactored into a shared _ensureSelfSignedCert helper.

Also adds a NOMAD-specific docs section + Manage>Docs anchor, and registers the
IconAntenna icon. Meshtastic Web left unchanged.

Validated on NOMAD3 (v1.33.0-rc.1): the image + SSL config + self-signed cert
serves the MeshCore Flutter app over HTTPS 200 with working SPA fallback.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 admin/app/services/docker_service.ts     | 158 ++++++++++++++++-------
 admin/app/utils/fs.ts                    |   5 +
 admin/constants/service_names.ts         |   1 +
 admin/constants/supply_depot_docs.ts     |   1 +
 admin/database/seeders/service_seeder.ts |  37 ++++++
 admin/docs/supply-depot-apps.md          |  20 +++
 admin/inertia/lib/icons.ts               |   2 +
 admin/scripts/audit_catalog_ports.py     |   1 +
 8 files changed, 181 insertions(+), 44 deletions(-)

diff --git a/admin/app/services/docker_service.ts b/admin/app/services/docker_service.ts
index b951108..68a631a 100644
--- a/admin/app/services/docker_service.ts
+++ b/admin/app/services/docker_service.ts
@@ -12,6 +12,7 @@ import {
   BOOKS_STORAGE_PATH,
   CALIBRE_EMPTY_LIBRARY_ASSET_PATH,
   VAULTWARDEN_STORAGE_PATH,
+  MESHCORE_WEB_STORAGE_PATH,
   MEDIA_STORAGE_PATH,
   JELLYFIN_MEDIA_SUBFOLDERS,
 } from '../utils/fs.js'
@@ -19,7 +20,7 @@ import { KiwixLibraryService } from './kiwix_library_service.js'
 import { SERVICE_NAMES } from '../../constants/service_names.js'
 import { exec } from 'child_process'
 import { promisify } from 'util'
-import { readFile, mkdir, copyFile, chown, chmod, access } from 'node:fs/promises'
+import { readFile, mkdir, copyFile, chown, chmod, access, writeFile } from 'node:fs/promises'
 import KVStore from '#models/kv_store'
 import { BROADCAST_CHANNELS } from '../../constants/broadcast.js'
 import { KIWIX_LIBRARY_CMD } from '../../constants/kiwix.js'
@@ -697,6 +698,15 @@ export class DockerService {
         )
       }
 
+      if (service.service_name === SERVICE_NAMES.MESHCORE_WEB) {
+        await this._runPreinstallActions__MeshCoreWeb()
+        this._broadcast(
+          service.service_name,
+          'preinstall-complete',
+          `Pre-install actions for MeshCore Web completed successfully.`
+        )
+      }
+
       // GPU-aware configuration for Ollama
       let finalImage = service.container_image
       let gpuHostConfig = containerConfig?.HostConfig || {}
@@ -1030,18 +1040,58 @@ export class DockerService {
     }
   }
 
+  /**
+   * Ensure a self-signed TLS cert (cert.pem + key.pem) exists in `certDir`, generating one if not.
+   * Used by apps that need a secure (HTTPS) context but run on a LAN appliance with no public DNS to
+   * get a trusted cert for. Idempotent: an existing pair is left untouched, so the cert is stable
+   * across reinstalls (no fresh browser warning each time) and a cert an admin swapped in by hand is
+   * never clobbered. The private key is locked to 0600; the cert stays world-readable.
+   */
+  private async _ensureSelfSignedCert(
+    certDir: string,
+    commonName: string
+  ): Promise<{ certPath: string; keyPath: string }> {
+    const certPath = join(certDir, 'cert.pem')
+    const keyPath = join(certDir, 'key.pem')
+
+    await mkdir(certDir, { recursive: true })
+
+    const alreadyHasCert = await Promise.all([
+      access(certPath)
+        .then(() => true)
+        .catch(() => false),
+      access(keyPath)
+        .then(() => true)
+        .catch(() => false),
+    ]).then(([c, k]) => c && k)
+
+    if (alreadyHasCert) return { certPath, keyPath }
+
+    // 10-year self-signed cert. CN/SAN are cosmetic for a self-signed cert (the browser warns
+    // regardless), but a SAN keeps it structurally valid for clients that require one.
+    const execAsync = promisify(exec)
+    await execAsync(
+      `openssl req -x509 -newkey rsa:2048 -nodes ` +
+        `-keyout "${keyPath}" -out "${certPath}" -days 3650 ` +
+        `-subj "/CN=${commonName}" ` +
+        `-addext "subjectAltName=DNS:nomad,DNS:localhost"`
+    )
+
+    await chmod(keyPath, 0o600)
+    await chmod(certPath, 0o644)
+
+    return { certPath, keyPath }
+  }
+
   /**
    * Vaultwarden's web vault refuses to run without a secure context — over plain HTTP it shows
    * "You need to enable HTTPS!" and you can't register or unlock. We give it a self-signed TLS
    * cert in its /data volume so it serves HTTPS out of the box (paired with the ROCKET_TLS env and
    * the `https:8480` ui_location set in the seeder). Users click through a one-time browser warning;
-   * after that the vault is fully functional offline. Self-signed is the only option on a LAN
-   * appliance with no public DNS to get a trusted cert for.
+   * after that the vault is fully functional offline.
    */
   private async _runPreinstallActions__Vaultwarden(): Promise<void> {
     const dataDir = join(process.cwd(), VAULTWARDEN_STORAGE_PATH)
-    const certPath = join(dataDir, 'cert.pem')
-    const keyPath = join(dataDir, 'key.pem')
 
     this._broadcast(
       SERVICE_NAMES.VAULTWARDEN,
@@ -1050,48 +1100,11 @@ export class DockerService {
     )
 
     try {
-      await mkdir(dataDir, { recursive: true })
-
-      // Don't regenerate if a cert is already present — keeps the same cert across reinstalls so
-      // users don't get a fresh browser warning every time, and never clobbers a cert an admin
-      // may have swapped in themselves.
-      const alreadyHasCert = await Promise.all([
-        access(certPath)
-          .then(() => true)
-          .catch(() => false),
-        access(keyPath)
-          .then(() => true)
-          .catch(() => false),
-      ]).then(([c, k]) => c && k)
-
-      if (alreadyHasCert) {
-        this._broadcast(
-          SERVICE_NAMES.VAULTWARDEN,
-          'preinstall',
-          `Existing Vaultwarden TLS certificate found — leaving it as-is.`
-        )
-        return
-      }
-
-      // 10-year self-signed cert. CN/SAN are cosmetic for a self-signed cert (the browser warns
-      // regardless), but a SAN keeps it structurally valid for clients that require one.
-      const execAsync = promisify(exec)
-      await execAsync(
-        `openssl req -x509 -newkey rsa:2048 -nodes ` +
-          `-keyout "${keyPath}" -out "${certPath}" -days 3650 ` +
-          `-subj "/CN=Project NOMAD Vaultwarden" ` +
-          `-addext "subjectAltName=DNS:nomad,DNS:localhost"`
-      )
-
-      // Lock the private key down; the cert can stay world-readable. Vaultwarden runs as root and
-      // reads both from /data, so no chown is needed (admin writes them as root too).
-      await chmod(keyPath, 0o600)
-      await chmod(certPath, 0o644)
-
+      await this._ensureSelfSignedCert(dataDir, 'Project NOMAD Vaultwarden')
       this._broadcast(
         SERVICE_NAMES.VAULTWARDEN,
         'preinstall',
-        `Generated a self-signed HTTPS certificate for Vaultwarden.`
+        `Vaultwarden HTTPS certificate is ready.`
       )
     } catch (error: any) {
       this._broadcast(
@@ -1103,6 +1116,63 @@ export class DockerService {
     }
   }
 
+  /**
+   * The MeshCore web client (aXistem's prebuilt image) is stock nginx serving a static Flutter build
+   * over plain HTTP. The client reaches a radio over Web Bluetooth / Web Serial, which browsers only
+   * permit from a secure (HTTPS) context — so over plain HTTP the app loads but can't connect to a
+   * thing. We generate a self-signed cert and a small SSL nginx config here; the seeder bind-mounts
+   * both into the container (the config over the image's default.conf) so it serves the same static
+   * files over HTTPS instead. Same one-time-browser-warning approach as Vaultwarden.
+   */
+  private async _runPreinstallActions__MeshCoreWeb(): Promise<void> {
+    const appDir = join(process.cwd(), MESHCORE_WEB_STORAGE_PATH)
+    const certDir = join(appDir, 'certs')
+    const nginxConfPath = join(appDir, 'nginx-ssl.conf')
+
+    this._broadcast(
+      SERVICE_NAMES.MESHCORE_WEB,
+      'preinstall',
+      `Running pre-install actions for MeshCore Web...`
+    )
+
+    try {
+      await this._ensureSelfSignedCert(certDir, 'Project NOMAD MeshCore Web')
+
+      // SSL server block bind-mounted over the image's default.conf. Serves the Flutter build that
+      // already lives at /usr/share/nginx/html in the image, over HTTPS only, with the SPA fallback
+      // that single-page apps need. Cert paths match the /certs bind mount set in the seeder.
+      const nginxConf =
+        [
+          'server {',
+          '    listen 443 ssl;',
+          '    server_name _;',
+          '    ssl_certificate     /certs/cert.pem;',
+          '    ssl_certificate_key /certs/key.pem;',
+          '    root /usr/share/nginx/html;',
+          '    index index.html;',
+          '    location / {',
+          '        try_files $uri $uri/ /index.html;',
+          '    }',
+          '}',
+        ].join('\n') + '\n'
+      await writeFile(nginxConfPath, nginxConf)
+      await chmod(nginxConfPath, 0o644)
+
+      this._broadcast(
+        SERVICE_NAMES.MESHCORE_WEB,
+        'preinstall',
+        `MeshCore Web HTTPS certificate and config are ready.`
+      )
+    } catch (error: any) {
+      this._broadcast(
+        SERVICE_NAMES.MESHCORE_WEB,
+        'preinstall-error',
+        `Failed to prepare MeshCore Web: ${error.message}`
+      )
+      throw new Error(`Pre-install action failed: ${error.message}`)
+    }
+  }
+
   /**
    * Jellyfin works best when each library points at its own subfolder. Pointing one library at the
    * whole media root and another at a subfolder inside it makes Jellyfin report a "duplicate path"
diff --git a/admin/app/utils/fs.ts b/admin/app/utils/fs.ts
index 0d31bc1..69b5463 100644
--- a/admin/app/utils/fs.ts
+++ b/admin/app/utils/fs.ts
@@ -17,6 +17,11 @@ export const CALIBRE_EMPTY_LIBRARY_ASSET_PATH = 'assets/calibre/metadata.db'
 // Vaultwarden's /data volume. A self-signed TLS cert is generated here on install so the
 // web vault has the secure context (HTTPS) it requires — see _runPreinstallActions__Vaultwarden.
 export const VAULTWARDEN_STORAGE_PATH = '/storage/vaultwarden'
+// MeshCore Web's working dir. On install a self-signed cert (certs/) and an SSL nginx config
+// (nginx-ssl.conf) are generated here, then bind-mounted into the container so the static client is
+// served over HTTPS — required for its Web Bluetooth/Serial connections. See
+// _runPreinstallActions__MeshCoreWeb.
+export const MESHCORE_WEB_STORAGE_PATH = '/storage/meshcore-web'
 
 export async function listDirectoryContents(path: string): Promise<FileEntry[]> {
   const entries = await readdir(path, { withFileTypes: true })
diff --git a/admin/constants/service_names.ts b/admin/constants/service_names.ts
index 01d3299..b5e30e4 100644
--- a/admin/constants/service_names.ts
+++ b/admin/constants/service_names.ts
@@ -13,6 +13,7 @@ export const SERVICE_NAMES = {
   EXCALIDRAW: 'nomad_excalidraw',
   MESHTASTIC_WEB: 'nomad_meshtastic_web',
   MESHTASTICD: 'nomad_meshtasticd',
+  MESHCORE_WEB: 'nomad_meshcore_web',
   HOMEBOX: 'nomad_homebox',
   VAULTWARDEN: 'nomad_vaultwarden',
   JELLYFIN: 'nomad_jellyfin',
diff --git a/admin/constants/supply_depot_docs.ts b/admin/constants/supply_depot_docs.ts
index e9531db..9cf29c5 100644
--- a/admin/constants/supply_depot_docs.ts
+++ b/admin/constants/supply_depot_docs.ts
@@ -17,6 +17,7 @@ export const SUPPLY_DEPOT_DOC_ANCHORS: Record<string, string> = {
   [SERVICE_NAMES.VAULTWARDEN]: 'vaultwarden',
   [SERVICE_NAMES.JELLYFIN]: 'jellyfin',
   [SERVICE_NAMES.MESHTASTIC_WEB]: 'meshtastic-web',
+  [SERVICE_NAMES.MESHCORE_WEB]: 'meshcore-web',
 }
 
 // Returns the in-app docs link for a service, or null if it has no documentation section.
diff --git a/admin/database/seeders/service_seeder.ts b/admin/database/seeders/service_seeder.ts
index ae7eac8..47aa9a6 100644
--- a/admin/database/seeders/service_seeder.ts
+++ b/admin/database/seeders/service_seeder.ts
@@ -415,6 +415,43 @@ export default class ServiceSeeder extends BaseSeeder {
       category: 'networking',
       depends_on: null,
     },
+    {
+      service_name: SERVICE_NAMES.MESHCORE_WEB,
+      friendly_name: 'MeshCore Web',
+      powered_by: 'MeshCore',
+      display_order: 32,
+      description: 'Browser-based client for MeshCore mesh radio devices',
+      icon: 'IconAntenna',
+      // aXistem's prebuilt image of Liam Cottle's MeshCore web client (MeshCore is a sibling LoRa
+      // mesh project to Meshtastic).
+      container_image: 'ghcr.io/axistem-dev/meshcore-web:latest',
+      source_repo: 'https://github.com/aXistem-dev/meshcore-web',
+      container_command: null,
+      container_config: JSON.stringify({
+        HostConfig: {
+          RestartPolicy: { Name: 'unless-stopped' },
+          // The image is stock nginx:alpine serving the Flutter build over HTTP on 80. MeshCore's
+          // client reaches a radio via Web Bluetooth / Web Serial, which browsers only permit from a
+          // secure (HTTPS) context — so we serve it over HTTPS. _runPreinstallActions__MeshCoreWeb
+          // writes a self-signed cert + an SSL server config into storage/meshcore-web; we bind both
+          // in (the config over the image's default.conf) and publish 443. The https: prefix on
+          // ui_location builds an https:// Open link (one-time cert warning, same as Vaultwarden).
+          PortBindings: { '443/tcp': [{ HostPort: '8500' }] },
+          Binds: [
+            `${ServiceSeeder.NOMAD_STORAGE_ABS_PATH}/meshcore-web/nginx-ssl.conf:/etc/nginx/conf.d/default.conf:ro`,
+            `${ServiceSeeder.NOMAD_STORAGE_ABS_PATH}/meshcore-web/certs:/certs:ro`,
+          ],
+        },
+        ExposedPorts: { '443/tcp': {} },
+      }),
+      ui_location: 'https:8500',
+      installed: false,
+      installation_status: 'idle',
+      is_dependency_service: false,
+      is_custom: false,
+      category: 'networking',
+      depends_on: null,
+    },
     {
       service_name: SERVICE_NAMES.HOMEBOX,
       friendly_name: 'Homebox',
diff --git a/admin/docs/supply-depot-apps.md b/admin/docs/supply-depot-apps.md
index bd9eb0a..9e73ecf 100644
--- a/admin/docs/supply-depot-apps.md
+++ b/admin/docs/supply-depot-apps.md
@@ -242,3 +242,23 @@ A browser-based control panel for [Meshtastic](https://meshtastic.org) devices.
 **Your data:** There's nothing to set up or store on your NOMAD for this app. Your radio's settings live on the radio itself, and this app's preferences live in your browser. There's no NOMAD folder to manage.
 
 **Works offline:** Fully offline, which is the entire point of Meshtastic. The app is served from your NOMAD, and talking to your radios happens over your local network or radio, never the internet. The only online bits are the links in the footer (Vercel, legal), which don't matter for using your mesh.
+
+## MeshCore Web {% #meshcore-web %}
+
+A browser-based client for [MeshCore](https://meshcore.co.uk) radios. MeshCore is another take on off-grid, long-range LoRa mesh messaging, a sibling to Meshtastic: small radios that form their own network and pass text and location for miles with no cell service, no internet, and no fees. This app is how you configure a MeshCore radio and read and send messages from a full-size screen. If you're not already running MeshCore gear, the Meshtastic client above is the more common starting point. This one is here for people who use MeshCore.
+
+**Official site:** [meshcore.co.uk](https://meshcore.co.uk) · **Source:** [github.com/aXistem-dev/meshcore-web](https://github.com/aXistem-dev/meshcore-web) (a packaged build of Liam Cottle's MeshCore client)
+
+**You need a MeshCore radio to use this.** Like the Meshtastic client, this is just the control panel. With no radio connected, there's nothing for it to talk to.
+
+**First time you open it, you'll see a security warning. That's expected, here's why:** MeshCore connects to your radio over USB or Bluetooth, and browsers only let a web page use USB or Bluetooth when the page is loaded over a secure (HTTPS) connection. So NOMAD serves this app over HTTPS, and because your NOMAD is a private device with no public web address, it uses a self-signed certificate that browsers warn about the first time they see it. To get past it once:
+
+1. Click **Open** on the MeshCore Web card. Your browser shows something like *"Your connection is not private"* or *"Not secure."*
+2. Click **Advanced**, then **Proceed to (your NOMAD's address)**. (On some browsers the button says "Continue" or "Accept the Risk.")
+3. You'll land in MeshCore Web. Your browser remembers your choice, so you won't see the warning again on that device.
+
+**Connecting your radio:** Use **Chrome or Edge**, which have the best support for browser USB and Bluetooth. Plug the radio into the computer you're browsing from (USB), or have it nearby (Bluetooth), then connect to it from inside the app. The radio connects to **the computer you're using**, not to the NOMAD itself, so connect from a device that has the radio plugged in or in Bluetooth range. Some phones are stricter about self-signed certificates and may refuse to connect; a desktop Chrome or Edge is the most reliable.
+
+**Your data:** There's nothing to set up or store on your NOMAD for this app. Your radio's settings live on the radio itself, and the app's preferences live in your browser. There's no NOMAD folder to manage.
+
+**Works offline:** Fully offline, which is the whole point of MeshCore. The app is served from your NOMAD and talks to your radio directly over USB or Bluetooth, never the internet.
diff --git a/admin/inertia/lib/icons.ts b/admin/inertia/lib/icons.ts
index f021366..ce58a2e 100644
--- a/admin/inertia/lib/icons.ts
+++ b/admin/inertia/lib/icons.ts
@@ -1,4 +1,5 @@
 import {
+  IconAntenna,
   IconArrowUp,
   IconBook,
   IconBooks,
@@ -72,6 +73,7 @@ import {
  * very limited subset of the full Tabler Icons library.
  */
 export const icons = {
+  IconAntenna,
   IconAlertTriangle,
   IconArrowLeft,
   IconArrowRight,
diff --git a/admin/scripts/audit_catalog_ports.py b/admin/scripts/audit_catalog_ports.py
index 8277296..b72d667 100644
--- a/admin/scripts/audit_catalog_ports.py
+++ b/admin/scripts/audit_catalog_ports.py
@@ -33,6 +33,7 @@ MEMORY_CAP = "2g"      # generous cap; some apps (Stirling) OOM under 1g and fal
 KNOWN_NEEDS_SETUP = {
     "nomad_kiwix_server": "needs a ZIM library (managed separately by NOMAD)",
     "nomad_meshtasticd": "needs a config.yaml with a MAC address",
+    "nomad_meshcore_web": "serves HTTPS on 443 only with the bind-mounted SSL config (absent in a bare probe)",
 }
 
 

From 475781ffa20a9c5f1c77ca9f09dbb2a77b9e3ec0 Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Tue, 16 Jun 2026 23:57:30 +0000
Subject: [PATCH 59/83] build: ensure openssl installed in admin container

---
 Dockerfile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Dockerfile b/Dockerfile
index edf6e51..c9224e6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,6 +4,7 @@ FROM node:22-slim AS base
 RUN apt-get update && apt-get install -y \
       bash \
       curl \
+      openssl \
       graphicsmagick \
       libvips-dev \
       build-essential \

From 1b040c8b9a21b4d4f90092ff60df7911f5c27858 Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Wed, 17 Jun 2026 00:29:49 +0000
Subject: [PATCH 60/83] fix: pin default meshcore web image

---
 admin/database/seeders/service_seeder.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/admin/database/seeders/service_seeder.ts b/admin/database/seeders/service_seeder.ts
index 47aa9a6..bdc9f7c 100644
--- a/admin/database/seeders/service_seeder.ts
+++ b/admin/database/seeders/service_seeder.ts
@@ -424,7 +424,7 @@ export default class ServiceSeeder extends BaseSeeder {
       icon: 'IconAntenna',
       // aXistem's prebuilt image of Liam Cottle's MeshCore web client (MeshCore is a sibling LoRa
       // mesh project to Meshtastic).
-      container_image: 'ghcr.io/axistem-dev/meshcore-web:latest',
+      container_image: 'ghcr.io/axistem-dev/meshcore-web:v1.45.0',
       source_repo: 'https://github.com/aXistem-dev/meshcore-web',
       container_command: null,
       container_config: JSON.stringify({

From 8982d93a31e570208e31db9b42bb4acf08d8ab03 Mon Sep 17 00:00:00 2001
From: Jake Turner <52841588+jakeaturner@users.noreply.github.com>
Date: Wed, 17 Jun 2026 17:07:07 -0700
Subject: [PATCH 61/83] feat: replace legacy Kolibri image default with latest
 v19 image (#1019)

* feat: replace legacy Kolibri image default with latest v19 image
* feat(supply-depot): add content migration instructions for Edu Platform Gen 1 to 2
---
 admin/app/models/service.ts                   | 10 +++
 admin/app/services/system_service.ts          |  7 +++
 admin/constants/service_names.ts              |  1 +
 admin/constants/supply_depot_docs.ts          |  2 +
 .../1776300000001_deprecate_legacy_kolibri.ts | 43 +++++++++++++
 admin/database/seeders/service_seeder.ts      | 29 ++++++---
 admin/docs/supply-depot-apps.md               | 20 ++++++
 admin/inertia/pages/easy-setup/index.tsx      |  2 +-
 admin/inertia/pages/supply-depot.tsx          | 61 +++++++++++++++----
 admin/types/services.ts                       |  1 +
 10 files changed, 156 insertions(+), 20 deletions(-)
 create mode 100644 admin/database/migrations/1776300000001_deprecate_legacy_kolibri.ts

diff --git a/admin/app/models/service.ts b/admin/app/models/service.ts
index 08c7711..8d192ef 100644
--- a/admin/app/models/service.ts
+++ b/admin/app/models/service.ts
@@ -85,6 +85,16 @@ export default class Service extends BaseModel {
   @column()
   declare category: string | null
 
+  // When true the service is sunset: hidden from the install catalog unless it is already
+  // installed (see SystemService.getServices). Lets a deprecated app stay manageable for users who
+  // still run it while keeping new users from installing it.
+  @column({
+    serialize(value) {
+      return Boolean(value)
+    },
+  })
+  declare is_deprecated: boolean
+
   @column()
   declare source_repo: string | null
 
diff --git a/admin/app/services/system_service.ts b/admin/app/services/system_service.ts
index d058851..7e7412b 100644
--- a/admin/app/services/system_service.ts
+++ b/admin/app/services/system_service.ts
@@ -333,9 +333,15 @@ export class SystemService {
         'auto_update_enabled',
         'is_custom',
         'is_user_modified',
+        'is_deprecated',
         'category'
       )
       .where('is_dependency_service', false)
+      // Deprecated/sunset apps stay visible only while still installed, so the user can manage and
+      // uninstall them — they never reappear in the install catalog once removed.
+      .where((q) => {
+        q.where('is_deprecated', false).orWhere('installed', true)
+      })
     if (installedOnly) {
       query.where('installed', true)
     }
@@ -367,6 +373,7 @@ export class SystemService {
         auto_update_enabled: service.auto_update_enabled,
         is_custom: service.is_custom,
         is_user_modified: service.is_user_modified,
+        is_deprecated: service.is_deprecated,
         category: service.category,
       })
     }
diff --git a/admin/constants/service_names.ts b/admin/constants/service_names.ts
index b5e30e4..8bbc817 100644
--- a/admin/constants/service_names.ts
+++ b/admin/constants/service_names.ts
@@ -5,6 +5,7 @@ export const SERVICE_NAMES = {
   CYBERCHEF: 'nomad_cyberchef',
   FLATNOTES: 'nomad_flatnotes',
   KOLIBRI: 'nomad_kolibri',
+  KOLIBRI_GEN2: 'nomad_kolibri_2',
   // Supply Depot — curated catalog (ports 8400–8499)
   STIRLING_PDF: 'nomad_stirling_pdf',
   FILEBROWSER: 'nomad_filebrowser',
diff --git a/admin/constants/supply_depot_docs.ts b/admin/constants/supply_depot_docs.ts
index 9cf29c5..a4ad6cb 100644
--- a/admin/constants/supply_depot_docs.ts
+++ b/admin/constants/supply_depot_docs.ts
@@ -17,6 +17,8 @@ export const SUPPLY_DEPOT_DOC_ANCHORS: Record<string, string> = {
   [SERVICE_NAMES.VAULTWARDEN]: 'vaultwarden',
   [SERVICE_NAMES.JELLYFIN]: 'jellyfin',
   [SERVICE_NAMES.MESHTASTIC_WEB]: 'meshtastic-web',
+  [SERVICE_NAMES.KOLIBRI]: 'kolibri',
+  [SERVICE_NAMES.KOLIBRI_GEN2]: 'kolibri',
   [SERVICE_NAMES.MESHCORE_WEB]: 'meshcore-web',
 }
 
diff --git a/admin/database/migrations/1776300000001_deprecate_legacy_kolibri.ts b/admin/database/migrations/1776300000001_deprecate_legacy_kolibri.ts
new file mode 100644
index 0000000..571b036
--- /dev/null
+++ b/admin/database/migrations/1776300000001_deprecate_legacy_kolibri.ts
@@ -0,0 +1,43 @@
+import { BaseSchema } from '@adonisjs/lucid/schema'
+import { SERVICE_NAMES } from '../../constants/service_names.js'
+
+export default class extends BaseSchema {
+  protected tableName = 'services'
+
+  async up() {
+    // Generic deprecation flag (reusable for future sunsets): a deprecated service is hidden from
+    // the install catalog unless it is already installed — see SystemService.getServices().
+    this.schema.alterTable(this.tableName, (table) => {
+      table.boolean('is_deprecated').notNullable().defaultTo(false)
+    })
+
+    // Sunset the legacy treehouses/kolibri:0.12.8 entry, replaced by the learningequality Gen 2
+    // entry seeded as `nomad_kolibri_2`. The seeder is additive + sync-existing and never deletes,
+    // so without this step every existing deployment keeps an orphaned `nomad_kolibri` row and can
+    // still install the dead 6-year-old image. Conditional handling keeps it data-safe:
+    this.defer(async (db) => {
+      // Never installed → just an orphaned catalog row; drop it outright.
+      await db
+        .from(this.tableName)
+        .where('service_name', SERVICE_NAMES.KOLIBRI)
+        .where('installed', false)
+        .delete()
+
+      // Currently installed → a running 0.12.8 container holds port 8300 + a bind mount. Keep the
+      // row (it's Nomad's only handle to open/stop/uninstall that container) but flag it deprecated
+      // so it shows a "Legacy" badge and drops out of the catalog once the user uninstalls it.
+      await db
+        .from(this.tableName)
+        .where('service_name', SERVICE_NAMES.KOLIBRI)
+        .where('installed', true)
+        .update({ is_deprecated: true })
+    })
+  }
+
+  async down() {
+    // Note: the legacy-row deletion in up() is a one-way data change and is not restored here.
+    this.schema.alterTable(this.tableName, (table) => {
+      table.dropColumn('is_deprecated')
+    })
+  }
+}
diff --git a/admin/database/seeders/service_seeder.ts b/admin/database/seeders/service_seeder.ts
index bdc9f7c..bf71539 100644
--- a/admin/database/seeders/service_seeder.ts
+++ b/admin/database/seeders/service_seeder.ts
@@ -14,6 +14,7 @@ type ServiceSeedRecord = Omit<
   | 'update_checked_at'
   | 'metadata'
   | 'is_user_modified'
+  | 'is_deprecated'
   | 'custom_url'
   | 'auto_update_enabled'
   | 'available_update_first_seen_at'
@@ -163,24 +164,38 @@ export default class ServiceSeeder extends BaseSeeder {
       depends_on: null,
     },
     {
-      service_name: SERVICE_NAMES.KOLIBRI,
-      friendly_name: 'Education Platform',
+      // "Kolibri Gen 2" — the upstream-official learningequality image replacing the ~6-year-old
+      // community treehouses/kolibri:0.12.8. This is a distinct catalog entry (own service_name,
+      // volume, and ports), not an in-place upgrade: the new image uses a different repo, mounts at
+      // /kolibri instead of /root/.kolibri, and crosses 7 minor versions of Kolibri's own data
+      // schema. Existing 0.12.8 installs are sunset via the deprecate-legacy-kolibri migration and
+      // keep running on 8300 until uninstalled; content is re-imported into the fresh Gen 2 install.
+      service_name: SERVICE_NAMES.KOLIBRI_GEN2,
+      friendly_name: 'Education Platform (Gen 2)',
       powered_by: 'Kolibri',
       display_order: 2,
       description: 'Interactive learning platform with video courses and exercises',
       icon: 'IconSchool',
-      container_image: 'treehouses/kolibri:0.12.8',
+      container_image: 'learningequality/kolibri:0.19.4',
       source_repo: 'https://github.com/learningequality/kolibri',
       container_command: null,
       container_config: JSON.stringify({
         HostConfig: {
           RestartPolicy: { Name: 'unless-stopped' },
-          PortBindings: { '8080/tcp': [{ HostPort: '8300' }] },
-          Binds: [`${ServiceSeeder.NOMAD_STORAGE_ABS_PATH}/kolibri:/root/.kolibri`],
+          // 8080 = web UI. 8311 = zip-content server (interactive exercises / HTML5 apps), served
+          // from a separate "alternate origin" the browser connects to DIRECTLY. KOLIBRI_ZIP_CONTENT_PORT
+          // sets the port Kolibri both LISTENS on inside the container AND advertises in content URLs,
+          // so the internal port, the published host port, and that env value must all be identical
+          // (8311) — otherwise content URLs point at a host port that doesn't route to the listener
+          // and every content page fails with ERR_CONNECTION_REFUSED. The image's default 8081 is
+          // unused here. The image refuses to start without /kolibri mounted (KOLIBRI_HOME = /kolibri).
+          PortBindings: { '8080/tcp': [{ HostPort: '8310' }], '8311/tcp': [{ HostPort: '8311' }] },
+          Binds: [`${ServiceSeeder.NOMAD_STORAGE_ABS_PATH}/kolibri-gen2:/kolibri`],
         },
-        ExposedPorts: { '8080/tcp': {} },
+        ExposedPorts: { '8080/tcp': {}, '8311/tcp': {} },
+        Env: ['KOLIBRI_ZIP_CONTENT_PORT=8311'],
       }),
-      ui_location: '8300',
+      ui_location: '8310',
       installed: false,
       installation_status: 'idle',
       is_dependency_service: false,
diff --git a/admin/docs/supply-depot-apps.md b/admin/docs/supply-depot-apps.md
index 9e73ecf..7118132 100644
--- a/admin/docs/supply-depot-apps.md
+++ b/admin/docs/supply-depot-apps.md
@@ -243,6 +243,26 @@ A browser-based control panel for [Meshtastic](https://meshtastic.org) devices.
 
 **Works offline:** Fully offline, which is the entire point of Meshtastic. The app is served from your NOMAD, and talking to your radios happens over your local network or radio, never the internet. The only online bits are the links in the footer (Vercel, legal), which don't matter for using your mesh.
 
+## Education Platform (Kolibri) {% #kolibri %}
+
+A complete offline learning platform from Learning Equality. Kolibri pulls together video lessons, exercises, and readings into structured channels, organizes them into classes and lessons, tracks learner progress, and works entirely on your NOMAD with no internet. It's built for schools and learners in places with little or no connectivity.
+
+**Official site:** [learningequality.org/kolibri](https://learningequality.org/kolibri) · **Source:** [github.com/learningequality/kolibri](https://github.com/learningequality/kolibri)
+
+**First time you open it, you'll go through a quick setup wizard.** Pick your facility type and create the **admin account** (this is the super-user that manages the whole device, so give it a real password and keep track of it). Once you're in, you import learning content as **channels**.
+
+**Importing content:** Kolibri's content is delivered as channels you import. Open **Device → Channels → Import**, and either pull channels from Kolibri Studio (online) or import from a local drive or another Kolibri device if you already have the content files. There's a lot available, so import just the channels you need; they can be large.
+
+**Migrating content from Education Platform (Gen 1):** Earlier NOMAD releases shipped a much older Kolibri (the `treehouses/kolibri:0.12.8` image). The Education Platform "Gen 2" is a newer, upstream-official Kolibri and installs **fresh** — your old channels and learner data are **not** carried over automatically, because the two versions store data too differently to migrate safely. If you were running the old one and want to import your existing channels into the new one, here's the process:
+
+1. Install "Education Platform (Gen 2)" from the catalog (it runs alongside the old one on a different port, so nothing is disrupted while you set it up).
+2. Launch the new one, walk through the setup wizard, then from the sidebar menu, navigate to **Device > Channels > Import**. Choose the "Local network or internet" option, and then "Add new device". In the dialog that appears, enter the IP address of your NOMAD with the old Education Platform port (8300 by default, so for example `http://192.168.1.36:8300`), give it a name (anything you'd like), and click "Add", and then "Continue". 
+3. You can now select individual channels from the old Education Platform, or choose "Select entire channels instead" to import everything at once. Click "Import" when ready, and the transfer will start.
+3. Once you're happy with the new install and have any content copied over, uninstall the old Education Platform from its card (it carries a **legacy** badge). It's also recommended to choose to remove the old image and data volume when uninstalling to avoid confusion and free up space, but if you want to keep it around for a while just in case, that's totally fine too.
+
+**Your data:** Your imported channels, classes, and learner progress live in the `storage/kolibri-gen2` folder on your NOMAD. Backing up that folder backs up your whole Kolibri.
+
+**Works offline:** Fully offline once content is imported, that's what Kolibri is for. The only step that uses the internet is importing channels from Kolibri Studio; everything after that, browsing lessons, doing exercises, tracking progress, runs entirely on your NOMAD.
 ## MeshCore Web {% #meshcore-web %}
 
 A browser-based client for [MeshCore](https://meshcore.co.uk) radios. MeshCore is another take on off-grid, long-range LoRa mesh messaging, a sibling to Meshtastic: small radios that form their own network and pass text and location for miles with no cell service, no internet, and no fees. This app is how you configure a MeshCore radio and read and send messages from a full-size screen. If you're not already running MeshCore gear, the Meshtastic client above is the more common starting point. This one is here for people who use MeshCore.
diff --git a/admin/inertia/pages/easy-setup/index.tsx b/admin/inertia/pages/easy-setup/index.tsx
index c1fa42e..da97cf8 100644
--- a/admin/inertia/pages/easy-setup/index.tsx
+++ b/admin/inertia/pages/easy-setup/index.tsx
@@ -61,7 +61,7 @@ function buildCoreCapabilities(aiAssistantName: string): Capability[] {
         'Interactive exercises and quizzes',
         'Progress tracking for learners',
       ],
-      services: [SERVICE_NAMES.KOLIBRI],
+      services: [SERVICE_NAMES.KOLIBRI_GEN2],
       icon: 'IconSchool',
     },
     {
diff --git a/admin/inertia/pages/supply-depot.tsx b/admin/inertia/pages/supply-depot.tsx
index 889f588..3943e99 100644
--- a/admin/inertia/pages/supply-depot.tsx
+++ b/admin/inertia/pages/supply-depot.tsx
@@ -2,6 +2,7 @@ import { Head, router } from '@inertiajs/react'
 import { useEffect, useRef, useState } from 'react'
 import {
   IconAlertTriangle,
+  IconArrowRight,
   IconArrowUp,
   IconBook,
   IconBox,
@@ -44,6 +45,7 @@ import { getServiceLink } from '~/lib/navigation'
 import { getSupplyDepotDocLink } from '../../constants/supply_depot_docs'
 import api from '~/lib/api'
 import { toTitleCase } from '../../app/utils/misc'
+import { SERVICE_NAMES } from '../../constants/service_names'
 
 function extractTag(containerImage: string): string {
   if (!containerImage) return ''
@@ -168,7 +170,7 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
       .then((res) => {
         if (res) setPreflight(res)
       })
-      .catch(() => {}) // non-fatal; proceed without warnings
+      .catch(() => { }) // non-fatal; proceed without warnings
       .finally(() => setPreflightLoading(false))
   }, [modal])
 
@@ -193,6 +195,16 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
   const installedServices = filteredServices.filter((s) => s.installed)
   const availableServices = filteredServices.filter((s) => !s.installed)
 
+  // Whether the new Kolibri (Gen 2) install exists — gates the "Migrate content to Gen 2" action on
+  // the legacy Kolibri card. Computed from the full (unfiltered) list so a search filter can't hide it.
+  const educationGen2Installed = props.system.services.some(
+    (s) => s.service_name === SERVICE_NAMES.KOLIBRI_GEN2 && s.installed
+  )
+
+  useEffect(() => {
+    console.log("Education Gen 2 installed:", educationGen2Installed)
+  }, [educationGen2Installed])
+
   // ── Actions ───────────────────────────────────────────────────────────────
   async function handleInstall(service: ServiceSlim) {
     const hasWarnings =
@@ -420,11 +432,10 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
                 <button
                   key={cat.id}
                   onClick={() => setActiveCategory(cat.id)}
-                  className={`px-3 py-1 rounded-full text-xs font-medium transition-colors cursor-pointer border ${
-                    activeCategory === cat.id
+                  className={`px-3 py-1 rounded-full text-xs font-medium transition-colors cursor-pointer border ${activeCategory === cat.id
                       ? 'bg-desert-green text-white border-desert-green'
                       : 'bg-surface-secondary text-text-muted border-desert-stone-lighter hover:text-text-primary hover:border-desert-stone-light'
-                  }`}
+                    }`}
                 >
                   {cat.label}
                 </button>
@@ -473,6 +484,8 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
                       }
                       autoUpdateMasterEnabled={appAutoUpdateMasterEnabled}
                       onToggleAutoUpdate={(enabled) => handleToggleAutoUpdate(service, enabled)}
+                      migrationInstructionsHref={(service.service_name.startsWith(SERVICE_NAMES.KOLIBRI) && educationGen2Installed) ? getSupplyDepotDocLink(SERVICE_NAMES.KOLIBRI) || undefined : undefined}
+                      migrationInstructionsText={(service.service_name === SERVICE_NAMES.KOLIBRI) ? 'How to migrate content to Gen 2' : "How to migrate content from Gen 1"}
                     />
                   ))}
                 </div>
@@ -795,6 +808,8 @@ interface AppCardProps {
   // Global master switch (Settings → Updates). When off, per-app toggles are inert.
   autoUpdateMasterEnabled?: boolean
   onToggleAutoUpdate?: (enabled: boolean) => void
+  migrationInstructionsHref?: string
+  migrationInstructionsText?: string
 }
 
 function AppCard({
@@ -818,6 +833,8 @@ function AppCard({
   autoUpdateEnabled,
   autoUpdateMasterEnabled,
   onToggleAutoUpdate,
+  migrationInstructionsHref,
+  migrationInstructionsText,
 }: AppCardProps) {
   const isRunning = service.status === 'running'
   const isStopped = service.installed && !isRunning
@@ -852,11 +869,10 @@ function AppCard({
 
   return (
     <div
-      className={`relative flex flex-col rounded-xl border p-4 bg-surface-primary shadow-sm transition-all duration-200 hover:shadow-lg hover:-translate-y-0.5 ${
-        service.installed
+      className={`relative flex flex-col rounded-xl border p-4 bg-surface-primary shadow-sm transition-all duration-200 hover:shadow-lg hover:-translate-y-0.5 ${service.installed
           ? 'border-desert-stone-light'
           : 'border-desert-stone-lighter hover:border-desert-stone-light'
-      }`}
+        }`}
     >
       {/* Installed accent spine (rounded to follow the card corners — the card no longer clips
           overflow so the Manage dropdown can open above the card without being cut off) */}
@@ -930,6 +946,14 @@ function AppCard({
             modified
           </span>
         ) : null}
+        {service.is_deprecated ? (
+          <span
+            className="text-xs px-2 py-0.5 rounded-full font-medium bg-desert-orange-lighter text-desert-orange-dark border border-desert-orange-light"
+            title="This is a legacy version that's no longer maintained. Install the current Education Platform from the catalog, then uninstall this one."
+          >
+            legacy
+          </span>
+        ) : null}
         {uiPort && (
           <span className="text-xs px-2 py-0.5 rounded-full bg-surface-secondary text-text-muted font-mono">
             {uiIsHttps ? '🔒 ' : ''}:{uiPort}
@@ -967,7 +991,7 @@ function AppCard({
             {/* Open button — shown when the app has a default location or a user-set custom URL */}
             {(service.ui_location || service.custom_url) && (
               <a
-                href={getServiceLink(service.ui_location, service.custom_url)}
+                href={getServiceLink(service.ui_location || "", service.custom_url)}
                 target="_blank"
                 rel="noopener noreferrer"
                 className="flex-1"
@@ -1009,6 +1033,20 @@ function AppCard({
                   <DropdownItem icon={<IconChartBar className="h-4 w-4" />} label="Stats" onClick={onStats} />
                   <DropdownItem icon={<IconPencil className="h-4 w-4" />} label="Edit" onClick={onEdit} />
                   <DropdownItem icon={<IconWorld className="h-4 w-4" />} label="Set custom URL" onClick={onSetUrl} />
+                  {
+                    migrationInstructionsHref ? (
+                      <a
+                      href={migrationInstructionsHref}
+                      target="_blank"
+                      rel="noopener noreferrer"
+                      onClick={(e) => e.stopPropagation()}
+                      className="flex items-center gap-2 w-full px-3 py-2 text-xs transition-colors text-left cursor-pointer text-text-primary hover:bg-surface-secondary"
+                    >
+                      <IconBook className="h-4 w-4" />
+                      {migrationInstructionsText || 'Migration instructions'}
+                    </a>
+                    ) : (null)
+                  }
                   {!service.is_custom && onToggleAutoUpdate ? (
                     autoUpdateMasterEnabled ? (
                       <DropdownItem
@@ -1041,7 +1079,7 @@ function AppCard({
                   <DropdownItem icon={<IconRefresh className="h-4 w-4 text-desert-orange" />} label="Force Reinstall" onClick={onReinstall} danger />
                   {service.is_custom ? (
                     <DropdownItem icon={<IconTrash className="h-4 w-4 text-desert-red" />} label="Delete" onClick={onDelete} danger />
-                  ): (
+                  ) : (
                     <DropdownItem icon={<IconTrash className="h-4 w-4 text-desert-red" />} label="Uninstall" onClick={onUninstall} danger />
                   )}
                 </div>
@@ -1079,11 +1117,10 @@ function DropdownItem({
         e.stopPropagation()
         onClick()
       }}
-      className={`flex items-center gap-2 w-full px-3 py-2 text-xs transition-colors text-left cursor-pointer ${
-        danger
+      className={`flex items-center gap-2 w-full px-3 py-2 text-xs transition-colors text-left cursor-pointer ${danger
           ? 'text-desert-red hover:bg-desert-red/10'
           : 'text-text-primary hover:bg-surface-secondary'
-      }`}
+        }`}
     >
       {icon}
       {label}
diff --git a/admin/types/services.ts b/admin/types/services.ts
index f953648..0883c90 100644
--- a/admin/types/services.ts
+++ b/admin/types/services.ts
@@ -18,5 +18,6 @@ export type ServiceSlim = Pick<
   | 'auto_update_enabled'
   | 'is_custom'
   | 'is_user_modified'
+  | 'is_deprecated'
   | 'category'
 > & { status?: string }

From b507b8bd4e0c3f731354a245ee7e0f7cfc5fd8d7 Mon Sep 17 00:00:00 2001
From: Jake Turner <52841588+jakeaturner@users.noreply.github.com>
Date: Fri, 19 Jun 2026 09:47:14 -0700
Subject: [PATCH 62/83] chore(deps): bump mysql2 in admin (#1021)

---
 admin/package-lock.json | 37 ++++++++++++++++++++-----------------
 admin/package.json      |  2 +-
 2 files changed, 21 insertions(+), 18 deletions(-)

diff --git a/admin/package-lock.json b/admin/package-lock.json
index 6e3c1a1..915f81c 100644
--- a/admin/package-lock.json
+++ b/admin/package-lock.json
@@ -51,7 +51,7 @@
         "jszip": "3.10.1",
         "luxon": "3.7.2",
         "maplibre-gl": "4.7.1",
-        "mysql2": "3.16.2",
+        "mysql2": "3.22.5",
         "ollama": "0.6.3",
         "openai": "6.38.0",
         "pdf-parse": "2.4.5",
@@ -12809,9 +12809,9 @@
       }
     },
     "node_modules/mysql2": {
-      "version": "3.16.2",
-      "resolved": "https://registry.npmjs.org/mysql2/-/mysql2-3.16.2.tgz",
-      "integrity": "sha512-JsqBpYNy7pH20lGfPuSyRSIcCxSeAIwxWADpV64nP9KeyN3ZKpHZgjKXuBKsh7dH6FbOvf1bOgoVKjSUPXRMTw==",
+      "version": "3.22.5",
+      "resolved": "https://registry.npmjs.org/mysql2/-/mysql2-3.22.5.tgz",
+      "integrity": "sha512-95uZ2TrPWAZdwpB3vvvDbmEMcNG8yIeNCyu6GUcr/QnWEE/wXm7+mhOCsdQfWQDTV7qYT/PDUZ4U4UPP4AsXqQ==",
       "license": "MIT",
       "dependencies": {
         "aws-ssl-profiles": "^1.1.2",
@@ -12819,13 +12819,15 @@
         "generate-function": "^2.3.1",
         "iconv-lite": "^0.7.2",
         "long": "^5.3.2",
-        "lru.min": "^1.1.3",
+        "lru.min": "^1.1.4",
         "named-placeholders": "^1.1.6",
-        "seq-queue": "^0.0.5",
-        "sqlstring": "^2.3.3"
+        "sql-escaper": "^1.3.3"
       },
       "engines": {
         "node": ">= 8.0"
+      },
+      "peerDependencies": {
+        "@types/node": ">= 8"
       }
     },
     "node_modules/mysql2/node_modules/iconv-lite": {
@@ -15031,11 +15033,6 @@
       "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
       "license": "MIT"
     },
-    "node_modules/seq-queue": {
-      "version": "0.0.5",
-      "resolved": "https://registry.npmjs.org/seq-queue/-/seq-queue-0.0.5.tgz",
-      "integrity": "sha512-hr3Wtp/GZIc/6DAGPDcV4/9WoZhjrkXsi5B/07QgX8tsdc6ilr7BFM6PM6rbdAX1kFSDYeZGLipIZZKyQP0O5Q=="
-    },
     "node_modules/serialize-error": {
       "version": "12.0.0",
       "resolved": "https://registry.npmjs.org/serialize-error/-/serialize-error-12.0.0.tgz",
@@ -15581,13 +15578,19 @@
         "node": ">= 10.x"
       }
     },
-    "node_modules/sqlstring": {
-      "version": "2.3.3",
-      "resolved": "https://registry.npmjs.org/sqlstring/-/sqlstring-2.3.3.tgz",
-      "integrity": "sha512-qC9iz2FlN7DQl3+wjwn3802RTyjCx7sDvfQEXchwa6CWOx07/WVfh91gBmQ9fahw8snwGEWU3xGzOt4tFyHLxg==",
+    "node_modules/sql-escaper": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/sql-escaper/-/sql-escaper-1.3.3.tgz",
+      "integrity": "sha512-BsTCV265VpTp8tm1wyIm1xqQCS+Q9NHx2Sr+WcnUrgLrQ6yiDIvHYJV5gHxsj1lMBy2zm5twLaZao8Jd+S8JJw==",
       "license": "MIT",
       "engines": {
-        "node": ">= 0.6"
+        "bun": ">=1.0.0",
+        "deno": ">=2.0.0",
+        "node": ">=12.0.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/mysqljs/sql-escaper?sponsor=1"
       }
     },
     "node_modules/ssh2": {
diff --git a/admin/package.json b/admin/package.json
index bb0146b..ab09d33 100644
--- a/admin/package.json
+++ b/admin/package.json
@@ -104,7 +104,7 @@
     "jszip": "3.10.1",
     "luxon": "3.7.2",
     "maplibre-gl": "4.7.1",
-    "mysql2": "3.16.2",
+    "mysql2": "3.22.5",
     "ollama": "0.6.3",
     "openai": "6.38.0",
     "pdf-parse": "2.4.5",

From fe6735fdcb597818086dd3025228d2941ebc2dd1 Mon Sep 17 00:00:00 2001
From: Lorenzo Galassi <104760516+LorenzoGalassi@users.noreply.github.com>
Date: Fri, 19 Jun 2026 19:19:16 +0200
Subject: [PATCH 63/83] fix(queue): share one ioredis connection across BullMQ
 queues and workers (#1009)

BullMQ instantiates a fresh ioredis client per Queue/Worker when handed a
plain {host, port} config object, and under sustained ZIM ingestion the
embed pipeline leaked ~1 client/sec until Redis maxclients was exhausted.
Pass a single shared ioredis instance (maxRetriesPerRequest: null, as
required by BullMQ) so all queues and workers reuse one client pool.
Workers still duplicate the connection once for their blocking client,
which is expected and bounded.

Closes #885
---
 admin/app/services/queue_service.ts | 10 +++++-----
 admin/config/queue.ts               | 22 +++++++++++++++++-----
 admin/package-lock.json             |  1 +
 admin/package.json                  |  1 +
 4 files changed, 24 insertions(+), 10 deletions(-)

diff --git a/admin/app/services/queue_service.ts b/admin/app/services/queue_service.ts
index bad976b..5e31e2f 100644
--- a/admin/app/services/queue_service.ts
+++ b/admin/app/services/queue_service.ts
@@ -1,11 +1,11 @@
 import { Queue } from 'bullmq'
 import queueConfig from '#config/queue'
 
-// Process-wide singleton. Each `Queue` opens two ioredis connections (one for
-// commands, one blocking). Instantiating a fresh QueueService per dispatch /
-// status lookup leaks both, and under sustained job churn (e.g. multi-batch ZIM
-// ingestion enqueueing a continuation every few seconds) it saturates Redis's
-// maxclients within hours.
+// Process-wide singleton. Instantiating a fresh QueueService per dispatch /
+// status lookup leaks connections, and under sustained job churn (e.g.
+// multi-batch ZIM ingestion enqueueing a continuation every few seconds) it
+// saturates Redis's maxclients within hours. All queues additionally reuse the
+// single shared ioredis instance exported from #config/queue (#885).
 export class QueueService {
   private queues: Map<string, Queue> = new Map()
 
diff --git a/admin/config/queue.ts b/admin/config/queue.ts
index 0274563..3c6a112 100644
--- a/admin/config/queue.ts
+++ b/admin/config/queue.ts
@@ -1,11 +1,23 @@
 import env from '#start/env'
+import { Redis } from 'ioredis'
+
+// BullMQ treats a plain `{host, port}` connection object as a recipe: every
+// Queue / Worker instantiates its own ioredis client from it, and script
+// commands executed against those clients can spawn further short-lived
+// connections. Under sustained ZIM ingestion this leaked ~1 client/sec until
+// Redis maxclients was exhausted (#885). Passing a single shared ioredis
+// instance instead gives BullMQ a pool to reuse — Workers still duplicate it
+// once for their blocking client, which is expected and bounded.
+// `maxRetriesPerRequest: null` is mandatory for connections shared with BullMQ.
+const sharedConnection = new Redis({
+  host: env.get('REDIS_HOST'),
+  port: env.get('REDIS_PORT') ?? 6379,
+  db: env.get('REDIS_DB') ?? 0,
+  maxRetriesPerRequest: null,
+})
 
 const queueConfig = {
-  connection: {
-    host: env.get('REDIS_HOST'),
-    port: env.get('REDIS_PORT') ?? 6379,
-    db: env.get('REDIS_DB') ?? 0,
-  },
+  connection: sharedConnection,
 }
 
 export default queueConfig
diff --git a/admin/package-lock.json b/admin/package-lock.json
index 915f81c..f89f626 100644
--- a/admin/package-lock.json
+++ b/admin/package-lock.json
@@ -47,6 +47,7 @@
         "edge.js": "6.4.0",
         "fast-xml-parser": "5.7.0",
         "fuse.js": "7.1.0",
+        "ioredis": "5.10.1",
         "ipaddr.js": "2.4.0",
         "jszip": "3.10.1",
         "luxon": "3.7.2",
diff --git a/admin/package.json b/admin/package.json
index ab09d33..5736f30 100644
--- a/admin/package.json
+++ b/admin/package.json
@@ -100,6 +100,7 @@
     "edge.js": "6.4.0",
     "fast-xml-parser": "5.7.0",
     "fuse.js": "7.1.0",
+    "ioredis": "5.10.1",
     "ipaddr.js": "2.4.0",
     "jszip": "3.10.1",
     "luxon": "3.7.2",

From a7d05859d46678da7a1c26ee31f177296d7f05ca Mon Sep 17 00:00:00 2001
From: Henry Estela <hestela@mailbox.org>
Date: Sun, 19 Apr 2026 22:51:50 -0700
Subject: [PATCH 64/83] feat(zim): add zim uploader in content manager

adds a collapsible file uploader to accept zim file uploads into kiwix.
---
 admin/app/controllers/zim_controller.ts       |  86 ++++++++++++++
 admin/app/services/zim_service.ts             | 107 ++++++++++++++++++
 admin/config/bodyparser.ts                    |   2 +-
 .../inertia/components/ZimUploader/index.tsx  |  77 +++++++++++++
 admin/inertia/pages/settings/zim/index.tsx    |  48 ++++++--
 .../pages/settings/zim/remote-explorer.tsx    |  18 ++-
 admin/package-lock.json                       |  69 ++++++++++-
 admin/package.json                            |   1 +
 admin/start/routes.ts                         |   1 +
 9 files changed, 397 insertions(+), 12 deletions(-)
 create mode 100644 admin/inertia/components/ZimUploader/index.tsx

diff --git a/admin/app/controllers/zim_controller.ts b/admin/app/controllers/zim_controller.ts
index 0087e76..aed0136 100644
--- a/admin/app/controllers/zim_controller.ts
+++ b/admin/app/controllers/zim_controller.ts
@@ -8,7 +8,12 @@ import {
 } from '#validators/common'
 import { addCustomLibraryValidator, browseLibraryValidator, idParamValidator, listRemoteZimValidator } from '#validators/zim'
 import { inject } from '@adonisjs/core'
+import logger from '@adonisjs/core/services/logger'
 import type { HttpContext } from '@adonisjs/core/http'
+import { createWriteStream } from 'fs'
+import { rename } from 'fs/promises'
+import { join, resolve, sep } from 'path'
+import { ZIM_STORAGE_PATH, ensureDirectoryExists, sanitizeFilename } from '../utils/fs.js'
 
 @inject()
 export default class ZimController {
@@ -83,6 +88,87 @@ export default class ZimController {
     }
   }
 
+  async upload({ request, response }: HttpContext) {
+    let filename: string | null = null
+    let tmpPath: string | null = null
+    let uploadError: string | null = null
+
+    try {
+      const basePath = resolve(join(process.cwd(), ZIM_STORAGE_PATH))
+      await ensureDirectoryExists(basePath)
+
+      request.multipart.onFile('*', {}, async (part) => {
+        const clientName = part.filename || ''
+        if (!clientName.toLowerCase().endsWith('.zim')) {
+          part.resume()
+          uploadError = 'INVALID_TYPE'
+          return
+        }
+
+        const sanitized = sanitizeFilename(clientName)
+        const finalPath = resolve(join(basePath, sanitized))
+
+        if (!finalPath.startsWith(basePath + sep)) {
+          part.resume()
+          uploadError = 'INVALID_FILENAME'
+          return
+        }
+
+        const { access } = await import('fs/promises')
+        const exists = await access(finalPath).then(() => true).catch(() => false)
+        if (exists) {
+          part.resume()
+          uploadError = 'DUPLICATE_FILENAME'
+          return
+        }
+
+        filename = sanitized
+        tmpPath = finalPath + '.tmp'
+        const ws = createWriteStream(tmpPath)
+
+        await new Promise<void>((res, rej) => {
+          ws.on('error', rej)
+          ws.on('finish', res)
+          part.on('error', rej)
+          part.pipe(ws)
+        })
+
+        await rename(tmpPath, finalPath)
+        tmpPath = null
+      })
+
+      await request.multipart.process()
+
+      if (uploadError === 'INVALID_TYPE') {
+        return response.status(422).send({ message: 'Only .zim files are accepted' })
+      }
+      if (uploadError === 'INVALID_FILENAME') {
+        return response.status(422).send({ message: 'Invalid filename' })
+      }
+      if (uploadError === 'DUPLICATE_FILENAME') {
+        return response.status(409).send({ message: 'A ZIM file with that name already exists' })
+      }
+      if (!filename) {
+        return response.status(400).send({ message: 'No file received' })
+      }
+
+      const { added } = await this.zimService.registerLocalUpload(filename)
+
+      return response.status(201).send({
+        message: 'ZIM file uploaded and registered successfully',
+        filename,
+        added,
+      })
+    } catch (error) {
+      logger.error('[ZimController] Upload failed:', error)
+      if (tmpPath) {
+        const { unlink } = await import('fs/promises')
+        await unlink(tmpPath).catch(() => {})
+      }
+      return response.status(500).send({ message: 'Upload failed' })
+    }
+  }
+
   // Wikipedia selector endpoints
 
   async getWikipediaState({}: HttpContext) {
diff --git a/admin/app/services/zim_service.ts b/admin/app/services/zim_service.ts
index 3b0469f..5a362e0 100644
--- a/admin/app/services/zim_service.ts
+++ b/admin/app/services/zim_service.ts
@@ -25,6 +25,7 @@ import vine from '@vinejs/vine'
 import { wikipediaOptionsFileSchema } from '#validators/curated_collections'
 import WikipediaSelection from '#models/wikipedia_selection'
 import InstalledResource from '#models/installed_resource'
+import CollectionManifest from '#models/collection_manifest'
 import { RunDownloadJob } from '#jobs/run_download_job'
 import { SERVICE_NAMES } from '../../constants/service_names.js'
 import { CollectionManifestService } from './collection_manifest_service.js'
@@ -469,6 +470,97 @@ export class ZimService {
     return { before, after, added: Math.max(0, after - before) }
   }
 
+  async registerLocalUpload(filename: string): Promise<{ added: number }> {
+    let added = 0
+    try {
+      const result = await this.rescanLibrary()
+      added = result.added
+    } catch (err) {
+      logger.error('[ZimService] Failed to rebuild kiwix library after local upload:', err)
+    }
+
+    const parsed = CollectionManifestService.parseZimFilename(filename)
+    if (parsed) {
+      const filepath = join(process.cwd(), ZIM_STORAGE_PATH, filename)
+      const stats = await getFileStatsIfExists(filepath)
+      try {
+        const { DateTime } = await import('luxon')
+        await InstalledResource.updateOrCreate(
+          { resource_id: parsed.resource_id, resource_type: 'zim' },
+          {
+            version: parsed.version,
+            url: `local-upload://${filename}`,
+            file_path: filepath,
+            file_size_bytes: stats ? Number(stats.size) : null,
+            installed_at: DateTime.now(),
+          }
+        )
+      } catch (error) {
+        logger.error(`[ZimService] Failed to create InstalledResource for ${filename}:`, error)
+      }
+    }
+
+    // If the uploaded file matches a known Wikipedia option, mark it as installed
+    try {
+      const manifest = await CollectionManifest.find('wikipedia')
+      if (manifest) {
+        const spec = manifest.spec_data as { options: Array<{ id: string; url: string | null }> }
+        const matchedOption = spec.options.find(
+          (opt) => opt.url && opt.url.split('/').pop() === filename
+        )
+        if (matchedOption && matchedOption.url) {
+          const existing = await WikipediaSelection.query().first()
+          if (existing) {
+            existing.option_id = matchedOption.id
+            existing.url = matchedOption.url
+            existing.filename = filename
+            existing.status = 'installed'
+            await existing.save()
+          } else {
+            await WikipediaSelection.create({
+              option_id: matchedOption.id,
+              url: matchedOption.url,
+              filename,
+              status: 'installed',
+            })
+          }
+          logger.info(`[ZimService] Marked Wikipedia option '${matchedOption.id}' as installed from local upload`)
+
+          // Remove any other wikipedia_en_*.zim files, same as the download flow
+          const allFiles = await this.list()
+          const staleWikipediaFiles = allFiles.files.filter(
+            (f) => f.name.startsWith('wikipedia_en_') && f.name !== filename
+          )
+          for (const stale of staleWikipediaFiles) {
+            try {
+              await this.delete(stale.name)
+              logger.info(`[ZimService] Deleted stale Wikipedia file after upload: ${stale.name}`)
+            } catch (err) {
+              logger.warn(`[ZimService] Could not delete stale Wikipedia file: ${stale.name}`, err)
+            }
+          }
+        }
+      }
+    } catch (error) {
+      logger.error(`[ZimService] Failed to update WikipediaSelection for ${filename}:`, error)
+    }
+
+    const ollamaUrl = await this.dockerService.getServiceURL('nomad_ollama')
+    if (ollamaUrl) {
+      try {
+        const { EmbedFileJob } = await import('#jobs/embed_file_job')
+        await EmbedFileJob.dispatch({
+          fileName: filename,
+          filePath: join(process.cwd(), ZIM_STORAGE_PATH, filename),
+        })
+      } catch (error) {
+        logger.error(`[ZimService] EmbedFileJob dispatch failed after local upload:`, error)
+      }
+    }
+
+    return { added }
+  }
+
   async delete(file: string): Promise<void> {
     let fileName = file
     if (!fileName.endsWith('.zim')) {
@@ -505,6 +597,21 @@ export class ZimService {
         .delete()
       logger.info(`[ZimService] Deleted InstalledResource entry for: ${parsed.resource_id}`)
     }
+
+    // If this file was the active Wikipedia selection, clear the selection
+    try {
+      const selection = await WikipediaSelection.query().first()
+      if (selection && selection.filename === fileName) {
+        selection.option_id = 'none'
+        selection.status = 'none'
+        selection.filename = null
+        selection.url = null
+        await selection.save()
+        logger.info(`[ZimService] Cleared WikipediaSelection after deleting ${fileName}`)
+      }
+    } catch (error) {
+      logger.error(`[ZimService] Failed to clear WikipediaSelection after deleting ${fileName}:`, error)
+    }
   }
 
   // Wikipedia selector methods
diff --git a/admin/config/bodyparser.ts b/admin/config/bodyparser.ts
index c995755..2c85bd9 100644
--- a/admin/config/bodyparser.ts
+++ b/admin/config/bodyparser.ts
@@ -41,7 +41,7 @@ const bodyParserConfig = defineConfig({
      */
     autoProcess: true,
     convertEmptyStringsToNull: true,
-    processManually: [],
+    processManually: ['/api/zim/upload'],
 
     /**
      * Maximum limit of data to parse including all files
diff --git a/admin/inertia/components/ZimUploader/index.tsx b/admin/inertia/components/ZimUploader/index.tsx
new file mode 100644
index 0000000..a734c0f
--- /dev/null
+++ b/admin/inertia/components/ZimUploader/index.tsx
@@ -0,0 +1,77 @@
+import Uppy from '@uppy/core'
+import Dashboard from '@uppy/react/dashboard'
+import XHRUpload from '@uppy/xhr-upload'
+import '@uppy/core/css/style.min.css'
+import '@uppy/dashboard/css/style.min.css'
+import { useEffect, useRef, useState } from 'react'
+
+interface ZimUploaderProps {
+  onUploadComplete: (added: number) => void
+  existingFilenames: string[]
+}
+
+export default function ZimUploader({ onUploadComplete, existingFilenames }: ZimUploaderProps) {
+  const existingFilenamesRef = useRef(existingFilenames)
+  useEffect(() => {
+    existingFilenamesRef.current = existingFilenames
+  }, [existingFilenames])
+
+  const [uppy] = useState(() =>
+    new Uppy({
+      restrictions: {
+        maxNumberOfFiles: 5,
+        allowedFileTypes: ['.zim'],
+      },
+      autoProceed: false,
+    }).use(XHRUpload, {
+      endpoint: '/api/zim/upload',
+      fieldName: 'file',
+      getResponseError: (responseText) => {
+        try {
+          const body = JSON.parse(responseText)
+          if (body?.message) return new Error(body.message)
+        } catch {}
+        return new Error('Upload failed')
+      },
+    })
+  )
+
+  useEffect(() => {
+    const handleFileAdded = (file: { id: string; name: string }) => {
+      if (existingFilenamesRef.current.includes(file.name)) {
+        uppy.removeFile(file.id)
+        uppy.info('A ZIM file with that name already exists', 'error', 6000)
+        return
+      }
+
+      const isWikipedia = (name: string) => name.startsWith('wikipedia_en_')
+      if (isWikipedia(file.name)) {
+        const alreadyQueued = uppy.getFiles().some((f) => f.id !== file.id && isWikipedia(f.name))
+        if (alreadyQueued) {
+          uppy.removeFile(file.id)
+          uppy.info('Only one Wikipedia file can be uploaded at a time', 'error', 6000)
+        }
+      }
+    }
+    const handleComplete = (result: { successful: Array<{ response?: { body?: { added?: number } } }> }) => {
+      const added = result.successful.reduce((sum, f) => sum + (f.response?.body?.added ?? 0), 0)
+      onUploadComplete(added)
+    }
+    uppy.on('file-added', handleFileAdded)
+    uppy.on('complete', handleComplete)
+    return () => {
+      uppy.off('file-added', handleFileAdded)
+      uppy.off('complete', handleComplete)
+      uppy.destroy()
+    }
+  }, [uppy, onUploadComplete])
+
+  return (
+    <Dashboard
+      uppy={uppy}
+      width="100%"
+      height={300}
+      note="ZIM files only. Large files (up to 20 GB) are supported. For best results, upload from the same machine or over a stable LAN connection. Larger files should be copied directly to the storage volume"
+    />
+  )
+}
diff --git a/admin/inertia/pages/settings/zim/index.tsx b/admin/inertia/pages/settings/zim/index.tsx
index 2c727dc..8dacf78 100644
--- a/admin/inertia/pages/settings/zim/index.tsx
+++ b/admin/inertia/pages/settings/zim/index.tsx
@@ -10,6 +10,7 @@ import StyledModal from '~/components/StyledModal'
 import useServiceInstalledStatus from '~/hooks/useServiceInstalledStatus'
 import Alert from '~/components/Alert'
 import { useNotifications } from '~/context/NotificationContext'
+import ZimUploader from '~/components/ZimUploader'
 import { ZimFileWithMetadata } from '../../../../types/zim'
 import { SERVICE_NAMES } from '../../../../constants/service_names'
 import { formatBytes } from '~/lib/util'
@@ -25,6 +26,7 @@ export default function ZimPage() {
   const { isInstalled } = useServiceInstalledStatus(SERVICE_NAMES.KIWIX)
   const [sortKey, setSortKey] = useState<SortKey>('size')
   const [sortDirection, setSortDirection] = useState<SortDirection>('desc')
+  const [showUploader, setShowUploader] = useState(false)
   const { data, isLoading } = useQuery<ZimFileWithMetadata[]>({
     queryKey: ['zim-files'],
     queryFn: getFiles,
@@ -135,18 +137,50 @@ export default function ZimPage() {
                 Manage your stored content files.
               </p>
             </div>
-            {isInstalled && (
+            <div className="flex items-center gap-2">
               <StyledButton
                 variant="secondary"
-                icon={'IconRefresh'}
-                loading={rescanMutation.isPending}
-                title="Rebuild the Kiwix library index from the files on disk. Use this after manually adding ZIM files outside of NOMAD."
-                onClick={() => rescanMutation.mutate()}
+                icon={showUploader ? 'IconX' : 'IconUpload'}
+                onClick={() => setShowUploader((v) => !v)}
               >
-                Rescan Library
+                {showUploader ? 'Hide Uploader' : 'Upload ZIM File'}
               </StyledButton>
-            )}
+              {isInstalled && (
+                <StyledButton
+                  variant="secondary"
+                  icon={'IconRefresh'}
+                  loading={rescanMutation.isPending}
+                  title="Rebuild the Kiwix library index from the files on disk. Use this after manually adding ZIM files outside of NOMAD."
+                  onClick={() => rescanMutation.mutate()}
+                >
+                  Rescan Library
+                </StyledButton>
+              )}
+            </div>
           </div>
+          {showUploader && (
+            <div className="mt-6">
+              <p className="text-text-muted text-sm mb-3">
+                Upload a ZIM file from your browser. Files up to 20 GB are supported. For best results upload from the same machine or over a stable LAN connection. Larger files should be copied directly to the storage volume.
+              </p>
+              <ZimUploader
+                existingFilenames={data?.map((f) => f.name) ?? []}
+                onUploadComplete={(added) => {
+                  queryClient.invalidateQueries({ queryKey: ['zim-files'] })
+                  queryClient.invalidateQueries({ queryKey: ['wikipedia-state'] })
+                  queryClient.invalidateQueries({ queryKey: ['curated-categories'] })
+                  setShowUploader(false)
+                  addNotification({
+                    type: 'success',
+                    message:
+                      added > 0
+                        ? `Upload complete. ${added} new ${added === 1 ? 'book' : 'books'} added to the library.`
+                        : 'Upload complete. Library is up to date.',
+                  })
+                }}
+              />
+            </div>
+          )}
           {!isInstalled && (
             <Alert
               title="The Kiwix application is not installed. Please install it to view downloaded ZIM files"
diff --git a/admin/inertia/pages/settings/zim/remote-explorer.tsx b/admin/inertia/pages/settings/zim/remote-explorer.tsx
index 7fcfed1..a19d9b3 100644
--- a/admin/inertia/pages/settings/zim/remote-explorer.tsx
+++ b/admin/inertia/pages/settings/zim/remote-explorer.tsx
@@ -40,10 +40,12 @@ import type { CategoryWithStatus, SpecTier } from '../../../../types/collections
 import useDownloads from '~/hooks/useDownloads'
 import ActiveDownloads from '~/components/ActiveDownloads'
 import { SERVICE_NAMES } from '../../../../constants/service_names'
+import { ZimFileWithMetadata } from '../../../../types/zim'
 
 const CURATED_CATEGORIES_KEY = 'curated-categories'
 const WIKIPEDIA_STATE_KEY = 'wikipedia-state'
 const CUSTOM_LIBRARIES_KEY = 'custom-libraries'
+const ZIM_FILES_KEY = 'zim-files'
 
 type CustomLibrary = { id: number; name: string; base_url: string; is_default: boolean }
 type BrowseResult = {
@@ -104,6 +106,15 @@ export default function ZimRemoteExplorer() {
     refetchOnWindowFocus: false,
   })
 
+  const { data: localFiles } = useQuery<ZimFileWithMetadata[]>({
+    queryKey: [ZIM_FILES_KEY],
+    queryFn: async () => {
+      const res = await api.listZimFiles()
+      return res.data.files
+    },
+    refetchOnWindowFocus: false,
+  })
+
   const { data: downloads, invalidate: invalidateDownloads } = useDownloads({
     filetype: 'zim',
     enabled: true,
@@ -152,15 +163,16 @@ export default function ZimRemoteExplorer() {
 
   const flatData = useMemo(() => {
     const mapped = data?.pages.flatMap((page) => page.items) || []
-    // remove items that are currently downloading
+    const localNames = new Set(localFiles?.map((f) => f.name) ?? [])
     return mapped.filter((item) => {
       const isDownloading = downloads?.some((download) => {
         const filename = item.download_url.split('/').pop()
         return filename && download.filepath.endsWith(filename)
       })
-      return !isDownloading
+      const isPresent = localNames.has(item.file_name)
+      return !isDownloading && !isPresent
     })
-  }, [data, downloads])
+  }, [data, downloads, localFiles])
   const hasMore = useMemo(() => data?.pages[data.pages.length - 1]?.has_more || false, [data])
 
   const fetchOnBottomReached = useCallback(
diff --git a/admin/package-lock.json b/admin/package-lock.json
index f89f626..fe48e34 100644
--- a/admin/package-lock.json
+++ b/admin/package-lock.json
@@ -4589,6 +4589,7 @@
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "Apache-2.0 AND MIT",
       "optional": true,
       "os": [
@@ -4605,6 +4606,7 @@
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "Apache-2.0 AND MIT",
       "optional": true,
       "os": [
@@ -4621,6 +4623,7 @@
       "cpu": [
         "arm"
       ],
+      "dev": true,
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -4713,6 +4716,7 @@
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "Apache-2.0 AND MIT",
       "optional": true,
       "os": [
@@ -4729,6 +4733,7 @@
       "cpu": [
         "ia32"
       ],
+      "dev": true,
       "license": "Apache-2.0 AND MIT",
       "optional": true,
       "os": [
@@ -4745,6 +4750,7 @@
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "Apache-2.0 AND MIT",
       "optional": true,
       "os": [
@@ -5684,6 +5690,12 @@
         "@types/react": "^19.2.0"
       }
     },
+    "node_modules/@types/retry": {
+      "version": "0.12.2",
+      "resolved": "https://registry.npmjs.org/@types/retry/-/retry-0.12.2.tgz",
+      "integrity": "sha512-XISRgDJ2Tc5q4TRqvgJtzsRkFYNJzZrhTdtMoGVBttwzzQJkPnS3WWTFc7kuDRoPtPakl+T+OfdEUjYJj7Jbow==",
+      "license": "MIT"
+    },
     "node_modules/@types/send": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/@types/send/-/send-1.2.1.tgz",
@@ -6030,6 +6042,20 @@
       "integrity": "sha512-mUFwbeTqrVgDQxFveS+df2yfap6iuP20NAKAsBt5jDEoOTDew+zwLAOilHCeQJOVSvmgCX4ogqIrA0mnyr08yQ==",
       "license": "ISC"
     },
+    "node_modules/@uppy/companion-client": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/@uppy/companion-client/-/companion-client-5.1.1.tgz",
+      "integrity": "sha512-DzrOWTbIZHvtgAFXBMYHk2wD27NjpBSVhY2tEiEIUhPd2CxbFRZjHM/N3HOt3VwZEAP471QWFLlJRWPcIY3A2Q==",
+      "license": "MIT",
+      "dependencies": {
+        "@uppy/utils": "^7.1.1",
+        "namespace-emitter": "^2.0.1",
+        "p-retry": "^6.1.0"
+      },
+      "peerDependencies": {
+        "@uppy/core": "^5.1.1"
+      }
+    },
     "node_modules/@uppy/components": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/@uppy/components/-/components-1.2.0.tgz",
@@ -6175,6 +6201,19 @@
         "preact": "^10.26.10"
       }
     },
+    "node_modules/@uppy/xhr-upload": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/@uppy/xhr-upload/-/xhr-upload-5.2.0.tgz",
+      "integrity": "sha512-3LV/X5Of6BINnKplP+CwUJ0a4/7cRFfzxwGyXnW+uCrNQHoo09dttcz3begWHejGvzenQHuUnMO3Fxyc71Pryg==",
+      "license": "MIT",
+      "dependencies": {
+        "@uppy/companion-client": "^5.1.1",
+        "@uppy/utils": "^7.2.0"
+      },
+      "peerDependencies": {
+        "@uppy/core": "^5.2.0"
+      }
+    },
     "node_modules/@vavite/multibuild": {
       "version": "5.1.0",
       "resolved": "https://registry.npmjs.org/@vavite/multibuild/-/multibuild-5.1.0.tgz",
@@ -10514,6 +10553,18 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
+    "node_modules/is-network-error": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/is-network-error/-/is-network-error-1.3.1.tgz",
+      "integrity": "sha512-6QCxa49rQbmUWLfk0nuGqzql9U8uaV2H6279bRErPBHe/109hCzsLUBUHfbEtvLIHBd6hyXbgedBSHevm43Edw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/is-number": {
       "version": "7.0.0",
       "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
@@ -13346,6 +13397,23 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/p-retry": {
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/p-retry/-/p-retry-6.2.1.tgz",
+      "integrity": "sha512-hEt02O4hUct5wtwg4H4KcWgDdm+l1bOaEy/hWzd8xtXB9BqxTWBBhb+2ImAtH4Cv4rPjV76xN3Zumqk3k3AhhQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/retry": "0.12.2",
+        "is-network-error": "^1.0.0",
+        "retry": "^0.13.1"
+      },
+      "engines": {
+        "node": ">=16.17"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/p-timeout": {
       "version": "6.1.4",
       "resolved": "https://registry.npmjs.org/p-timeout/-/p-timeout-6.1.4.tgz",
@@ -14829,7 +14897,6 @@
       "version": "0.13.1",
       "resolved": "https://registry.npmjs.org/retry/-/retry-0.13.1.tgz",
       "integrity": "sha512-XQBQ3I8W1Cge0Seh+6gjj03LbmRFWuoszgK9ooCpwYIrhhoO80pfq4cUkU5DkknwfOfFteRwlZ56PYOGYyFWdg==",
-      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">= 4"
diff --git a/admin/package.json b/admin/package.json
index 5736f30..18254d8 100644
--- a/admin/package.json
+++ b/admin/package.json
@@ -88,6 +88,7 @@
     "@uppy/core": "5.2.0",
     "@uppy/dashboard": "5.1.0",
     "@uppy/react": "5.1.1",
+    "@uppy/xhr-upload": "5.2.0",
     "@vinejs/vine": "3.0.1",
     "@vitejs/plugin-react": "4.7.0",
     "autoprefixer": "10.5.0",
diff --git a/admin/start/routes.ts b/admin/start/routes.ts
index b48f15b..165426b 100644
--- a/admin/start/routes.ts
+++ b/admin/start/routes.ts
@@ -206,6 +206,7 @@ router
     router.post('/download-remote', [ZimController, 'downloadRemote'])
     router.post('/download-category-tier', [ZimController, 'downloadCategoryTier'])
 
+    router.post('/upload', [ZimController, 'upload'])
     router.get('/wikipedia', [ZimController, 'getWikipediaState'])
     router.post('/wikipedia/select', [ZimController, 'selectWikipedia'])
 

From fad9e30ddc86d26548eee1bdf38eb68f4d177931 Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Sat, 20 Jun 2026 03:36:40 +0000
Subject: [PATCH 65/83] fix(zim): stabilize uploader state to avoid cancel on
 tab refocus

Also improves surfacing of upload error messages
---
 .../inertia/components/ZimUploader/index.tsx  | 24 ++++++++++++++++---
 admin/inertia/pages/settings/zim/index.tsx    |  1 +
 admin/package-lock.json                       |  7 +-----
 3 files changed, 23 insertions(+), 9 deletions(-)

diff --git a/admin/inertia/components/ZimUploader/index.tsx b/admin/inertia/components/ZimUploader/index.tsx
index a734c0f..7f08398 100644
--- a/admin/inertia/components/ZimUploader/index.tsx
+++ b/admin/inertia/components/ZimUploader/index.tsx
@@ -16,6 +16,16 @@ export default function ZimUploader({ onUploadComplete, existingFilenames }: Zim
     existingFilenamesRef.current = existingFilenames
   }, [existingFilenames])
 
+  // Keep the latest callback in a ref so the Uppy lifecycle effect below does
+  // not depend on it. The parent passes a new inline function on every render,
+  // and if that identity were in the effect deps, a re-render mid-upload (e.g.
+  // a window-focus refetch) would tear down and `uppy.destroy()` the instance,
+  // aborting the in-flight upload.
+  const onUploadCompleteRef = useRef(onUploadComplete)
+  useEffect(() => {
+    onUploadCompleteRef.current = onUploadComplete
+  }, [onUploadComplete])
+
   const [uppy] = useState(() =>
     new Uppy({
       restrictions: {
@@ -53,9 +63,17 @@ export default function ZimUploader({ onUploadComplete, existingFilenames }: Zim
         }
       }
     }
-    const handleComplete = (result: { successful: Array<{ response?: { body?: { added?: number } } }> }) => {
+    const handleComplete = (result: {
+      successful: Array<{ response?: { body?: { added?: number } } }>
+      failed: Array<unknown>
+    }) => {
+      // Uppy emits `complete` even when uploads fail or are aborted. Only treat
+      // the run as a success when nothing failed — otherwise leave the uploader
+      // open so the Dashboard can surface the error instead of closing it with a
+      // false "Upload complete" toast.
+      if (result.failed.length > 0) return
       const added = result.successful.reduce((sum, f) => sum + (f.response?.body?.added ?? 0), 0)
-      onUploadComplete(added)
+      onUploadCompleteRef.current(added)
     }
     uppy.on('file-added', handleFileAdded)
     uppy.on('complete', handleComplete)
@@ -64,7 +82,7 @@ export default function ZimUploader({ onUploadComplete, existingFilenames }: Zim
       uppy.off('complete', handleComplete)
       uppy.destroy()
     }
-  }, [uppy, onUploadComplete])
+  }, [uppy])
 
   return (
     <Dashboard
diff --git a/admin/inertia/pages/settings/zim/index.tsx b/admin/inertia/pages/settings/zim/index.tsx
index 8dacf78..23dc53d 100644
--- a/admin/inertia/pages/settings/zim/index.tsx
+++ b/admin/inertia/pages/settings/zim/index.tsx
@@ -30,6 +30,7 @@ export default function ZimPage() {
   const { data, isLoading } = useQuery<ZimFileWithMetadata[]>({
     queryKey: ['zim-files'],
     queryFn: getFiles,
+    refetchOnWindowFocus: false,
   })
 
   async function getFiles() {
diff --git a/admin/package-lock.json b/admin/package-lock.json
index fe48e34..0a18db6 100644
--- a/admin/package-lock.json
+++ b/admin/package-lock.json
@@ -35,6 +35,7 @@
         "@uppy/core": "5.2.0",
         "@uppy/dashboard": "5.1.0",
         "@uppy/react": "5.1.1",
+        "@uppy/xhr-upload": "5.2.0",
         "@vinejs/vine": "3.0.1",
         "@vitejs/plugin-react": "4.7.0",
         "autoprefixer": "10.5.0",
@@ -4589,7 +4590,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "Apache-2.0 AND MIT",
       "optional": true,
       "os": [
@@ -4606,7 +4606,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "Apache-2.0 AND MIT",
       "optional": true,
       "os": [
@@ -4623,7 +4622,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "Apache-2.0",
       "optional": true,
       "os": [
@@ -4716,7 +4714,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "Apache-2.0 AND MIT",
       "optional": true,
       "os": [
@@ -4733,7 +4730,6 @@
       "cpu": [
         "ia32"
       ],
-      "dev": true,
       "license": "Apache-2.0 AND MIT",
       "optional": true,
       "os": [
@@ -4750,7 +4746,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "Apache-2.0 AND MIT",
       "optional": true,
       "os": [

From 5181637926983f6bec412e3241939de97afcbe52 Mon Sep 17 00:00:00 2001
From: Benjamin Smith <bravosierra99@gmail.com>
Date: Sat, 20 Jun 2026 00:42:17 -0400
Subject: [PATCH 66/83] feat(KnowledgeBase): add document viewer, download,
 metadata, and sorting (#721)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rebuilt on top of dev's RFC #883 state-machine UI rather than the now-defunct
StoredFile shape:

- Extend StoredFileInfo with fileName/size/uploadedAt/isUserUpload
- Populate metadata from on-disk stats in RagService.getStoredFiles
- Add fileSourceSchema validator + getFileContent/downloadFile endpoints
  scoped to the uploads directory only (tighter than the original PR — matches
  docs_service traversal pattern)
- KnowledgeBaseModal: sortable Size and Uploaded columns; View/Download
  buttons on upload-bucket rows; new FileViewerModal for in-browser text
  preview. Bucket grouping preserved — sort applies within each bucket.
- Use formatBytes from ~/lib/util rather than redefining
---
 admin/app/controllers/rag_controller.ts       |  21 ++-
 admin/app/services/rag_service.ts             |  86 +++++++++-
 admin/app/validators/rag.ts                   |   6 +
 .../components/chat/KnowledgeBaseModal.tsx    | 155 +++++++++++++++++-
 admin/inertia/lib/api.ts                      |  11 ++
 admin/inertia/lib/kb_file_grouping.ts         |  59 ++++++-
 admin/start/routes.ts                         |   2 +
 admin/tests/unit/kb_file_grouping.spec.ts     |  89 +++++++++-
 admin/types/rag.ts                            |   9 +
 9 files changed, 418 insertions(+), 20 deletions(-)

diff --git a/admin/app/controllers/rag_controller.ts b/admin/app/controllers/rag_controller.ts
index 16cedcd..68cb5ae 100644
--- a/admin/app/controllers/rag_controller.ts
+++ b/admin/app/controllers/rag_controller.ts
@@ -7,7 +7,7 @@ import app from '@adonisjs/core/services/app'
 import { randomBytes } from 'node:crypto'
 import { sanitizeFilename } from '../utils/fs.js'
 import { basename } from 'node:path'
-import { deleteFileSchema, embedFileSchema, estimateBatchSchema, getJobStatusSchema } from '#validators/rag'
+import { deleteFileSchema, embedFileSchema, estimateBatchSchema, fileSourceSchema, getJobStatusSchema } from '#validators/rag'
 import logger from '@adonisjs/core/services/logger'
 
 @inject()
@@ -162,4 +162,23 @@ export default class RagController {
     const result = await KbRatioRegistry.estimateBatch(normalized)
     return response.status(200).json(result)
   }
+
+  public async getFileContent({ request, response }: HttpContext) {
+    const { source } = await request.validateUsing(fileSourceSchema)
+    const result = await this.ragService.readFileContent(source)
+    if (!result) {
+      return response.status(404).json({ error: 'File not found or not viewable' })
+    }
+    return response.status(200).json(result)
+  }
+
+  public async downloadFile({ request, response }: HttpContext) {
+    const { source } = await request.validateUsing(fileSourceSchema)
+    const filePath = await this.ragService.resolveDownloadPath(source)
+    if (!filePath) {
+      return response.status(404).json({ error: 'File not found' })
+    }
+    const fileName = filePath.split(/[/\\]/).at(-1) ?? 'download'
+    return response.attachment(filePath, fileName)
+  }
 }
diff --git a/admin/app/services/rag_service.ts b/admin/app/services/rag_service.ts
index 36c6658..29b65cf 100644
--- a/admin/app/services/rag_service.ts
+++ b/admin/app/services/rag_service.ts
@@ -1140,20 +1140,90 @@ export class RagService {
         )
       }
 
-      return Array.from(sources).map((source) => {
-        const row = stateByPath.get(source)
-        return {
-          source,
-          state: row?.state ?? null,
-          chunksEmbedded: row?.chunks_embedded ?? 0,
-        }
-      })
+      const uploadsAbsPath = resolve(join(process.cwd(), RagService.UPLOADS_STORAGE_PATH))
+      return await Promise.all(
+        Array.from(sources).map(async (source) => {
+          const row = stateByPath.get(source)
+          const fileName = source.split(/[/\\]/).at(-1) ?? source
+          const isUserUpload = resolve(source).startsWith(uploadsAbsPath + sep)
+          const stats = await getFileStatsIfExists(source)
+          return {
+            source,
+            state: row?.state ?? null,
+            chunksEmbedded: row?.chunks_embedded ?? 0,
+            fileName,
+            size: stats?.size ?? null,
+            uploadedAt: stats?.modifiedTime.toISOString() ?? null,
+            isUserUpload,
+          }
+        })
+      )
     } catch (error) {
       logger.error('Error retrieving stored files:', error)
       return []
     }
   }
 
+  /**
+   * Resolve a stored-file `source` to an absolute disk path, but only if the
+   * path lives under the uploads directory. Mirrors the docs_service traversal
+   * guard: resolve, then require the resolved path to be strictly inside the
+   * base + path separator (so siblings of `kb_uploads` can't slip through).
+   * Returns null for anything else — ZIMs, admin docs, README, or paths
+   * outside the app entirely. The viewer/download endpoints lean on this so
+   * they don't need to repeat the check.
+   */
+  private resolveUploadPath(source: string): string | null {
+    const uploadsAbsPath = resolve(join(process.cwd(), RagService.UPLOADS_STORAGE_PATH))
+    const resolved = resolve(source)
+    if (!resolved.startsWith(uploadsAbsPath + sep)) return null
+    return resolved
+  }
+
+  private static readonly VIEWABLE_TEXT_EXTENSIONS: ReadonlySet<string> = new Set([
+    'md', 'txt', 'csv', 'json', 'yaml', 'yml', 'toml', 'xml', 'html',
+  ])
+
+  /**
+   * Read the text content of a user-uploaded file for in-browser viewing.
+   * Returns null when the source is outside uploads, missing, or not a
+   * recognized text extension. The extension allowlist is intentionally narrow
+   * — PDFs/EPUBs/ZIMs round-trip through Download, not the viewer.
+   */
+  public async readFileContent(
+    source: string
+  ): Promise<{ content: string; extension: string; fileName: string } | null> {
+    const resolved = this.resolveUploadPath(source)
+    if (!resolved) return null
+
+    const extension = resolved.split('.').at(-1)?.toLowerCase() ?? ''
+    if (!RagService.VIEWABLE_TEXT_EXTENSIONS.has(extension)) return null
+
+    const stats = await getFileStatsIfExists(resolved)
+    if (!stats) return null
+
+    try {
+      const { readFile } = await import('node:fs/promises')
+      const content = await readFile(resolved, 'utf-8')
+      const fileName = resolved.split(/[/\\]/).at(-1) ?? resolved
+      return { content, extension, fileName }
+    } catch (error) {
+      logger.warn({ err: error, source }, '[RagService.readFileContent] read failed')
+      return null
+    }
+  }
+
+  /**
+   * Resolve a download-target path for a stored upload. Returns null if the
+   * source isn't an upload or the file is missing on disk.
+   */
+  public async resolveDownloadPath(source: string): Promise<string | null> {
+    const resolved = this.resolveUploadPath(source)
+    if (!resolved) return null
+    const stats = await getFileStatsIfExists(resolved)
+    return stats ? resolved : null
+  }
+
   /**
    * Compute whether the first-chat JIT prompt should fire and surface the file
    * count the banner uses in its copy ("Index your N existing files?"). The
diff --git a/admin/app/validators/rag.ts b/admin/app/validators/rag.ts
index 5bef836..b57fcee 100644
--- a/admin/app/validators/rag.ts
+++ b/admin/app/validators/rag.ts
@@ -19,6 +19,12 @@ export const embedFileSchema = vine.compile(
   })
 )
 
+export const fileSourceSchema = vine.compile(
+  vine.object({
+    source: vine.string().minLength(1),
+  })
+)
+
 export const estimateBatchSchema = vine.compile(
   vine.object({
     files: vine
diff --git a/admin/inertia/components/chat/KnowledgeBaseModal.tsx b/admin/inertia/components/chat/KnowledgeBaseModal.tsx
index 4bae969..e9efbcf 100644
--- a/admin/inertia/components/chat/KnowledgeBaseModal.tsx
+++ b/admin/inertia/components/chat/KnowledgeBaseModal.tsx
@@ -10,9 +10,19 @@ import api from '~/lib/api'
 import {
   groupAndSortKbFiles,
   type KbFileGroup,
+  type KbFileSort,
+  type KbFileSortKey,
 } from '~/lib/kb_file_grouping'
 import type { KbIngestStateValue } from '../../../types/kb_ingest_state'
-import { IconX } from '@tabler/icons-react'
+import { formatBytes } from '~/lib/util'
+import {
+  IconArrowsSort,
+  IconDownload,
+  IconEye,
+  IconSortAscending,
+  IconSortDescending,
+  IconX,
+} from '@tabler/icons-react'
 import { useModals } from '~/context/ModalContext'
 import StyledModal from '../StyledModal'
 import ActiveEmbedJobs from '~/components/ActiveEmbedJobs'
@@ -23,6 +33,42 @@ interface KnowledgeBaseModalProps {
   onClose: () => void
 }
 
+// File extensions the in-browser viewer can render. Must stay in sync with
+// `RagService.VIEWABLE_TEXT_EXTENSIONS` — anything outside this set falls back
+// to Download.
+const VIEWABLE_EXTENSIONS = new Set(['md', 'txt', 'csv', 'json', 'yaml', 'yml', 'toml', 'xml', 'html'])
+
+function isViewableExtension(filename: string): boolean {
+  const ext = filename.split('.').at(-1)?.toLowerCase() ?? ''
+  return VIEWABLE_EXTENSIONS.has(ext)
+}
+
+function renderSortHeader(
+  label: string,
+  key: KbFileSortKey,
+  sort: KbFileSort,
+  setSort: (s: KbFileSort) => void
+): React.ReactNode {
+  const active = sort.key === key
+  const Icon = !active ? IconArrowsSort : sort.direction === 'asc' ? IconSortAscending : IconSortDescending
+  return (
+    <button
+      type="button"
+      className="inline-flex items-center gap-1 text-left hover:text-text-primary transition-colors"
+      onClick={() => {
+        if (!active) {
+          setSort({ key, direction: 'asc' })
+        } else {
+          setSort({ key, direction: sort.direction === 'asc' ? 'desc' : 'asc' })
+        }
+      }}
+    >
+      <span>{label}</span>
+      <Icon size={14} className={active ? 'text-text-primary' : 'text-text-muted'} aria-hidden="true" />
+    </button>
+  )
+}
+
 /**
  * Compact label for the per-row ingestion state. Files that exist in Qdrant
  * with no `kb_ingest_state` row (`state === null`) are legacy/pre-RFC-883
@@ -101,6 +147,8 @@ export default function KnowledgeBaseModal({ aiAssistantName = "AI Assistant", o
   const [confirmReembed, setConfirmReembed] = useState<{ source: string; displayName: string } | null>(null)
   const [bulkMode, setBulkMode] = useState<null | 'reembed' | 'reset'>(null)
   const [resetTyped, setResetTyped] = useState('')
+  const [sort, setSort] = useState<KbFileSort>({ key: 'name', direction: 'asc' })
+  const [viewerSource, setViewerSource] = useState<string | null>(null)
   const fileUploaderRef = useRef<React.ComponentRef<typeof FileUploader>>(null)
   const { openModal, closeModal } = useModals()
   const queryClient = useQueryClient()
@@ -555,7 +603,7 @@ export default function KnowledgeBaseModal({ aiAssistantName = "AI Assistant", o
               columns={[
                 {
                   accessor: 'source',
-                  title: 'File Name',
+                  title: renderSortHeader('File Name', 'name', sort, setSort),
                   render(record) {
                     const warnings = fileWarnings[record.source] ?? []
                     const pill = renderStatePill(record)
@@ -594,6 +642,35 @@ export default function KnowledgeBaseModal({ aiAssistantName = "AI Assistant", o
                     )
                   },
                 },
+                {
+                  accessor: 'size',
+                  title: renderSortHeader('Size', 'size', sort, setSort),
+                  className: 'whitespace-nowrap',
+                  render(record) {
+                    // The collapsed admin_docs group has no single size — leave blank
+                    // rather than misleadingly summing across N files.
+                    if (record.bucket === 'admin_docs' || record.size === null) {
+                      return <span className="text-text-muted">—</span>
+                    }
+                    return <span className="text-text-secondary">{formatBytes(record.size)}</span>
+                  },
+                },
+                {
+                  accessor: 'uploadedAt',
+                  title: renderSortHeader('Uploaded', 'uploadedAt', sort, setSort),
+                  className: 'whitespace-nowrap',
+                  render(record) {
+                    if (record.bucket === 'admin_docs' || !record.uploadedAt) {
+                      return <span className="text-text-muted">—</span>
+                    }
+                    const d = new Date(record.uploadedAt)
+                    return (
+                      <span className="text-text-secondary" title={d.toISOString()}>
+                        {d.toLocaleDateString()}
+                      </span>
+                    )
+                  },
+                },
                 {
                   accessor: 'source',
                   title: '',
@@ -642,6 +719,9 @@ export default function KnowledgeBaseModal({ aiAssistantName = "AI Assistant", o
                     const actionPendingForThisRow =
                       embedMutation.isPending && embedMutation.variables?.source === record.source
 
+                    const canView = record.isUserUpload && isViewableExtension(record.displayName) && record.size !== null
+                    const canDownload = record.isUserUpload && record.size !== null
+
                     return (
                       <div className="flex justify-end items-center gap-2">
                         {action && (
@@ -662,6 +742,24 @@ export default function KnowledgeBaseModal({ aiAssistantName = "AI Assistant", o
                             {action.label}
                           </StyledButton>
                         )}
+                        {canView && (
+                          <StyledButton
+                            variant="ghost"
+                            size="sm"
+                            icon="IconEye"
+                            onClick={() => setViewerSource(record.source)}
+                          >View</StyledButton>
+                        )}
+                        {canDownload && (
+                          <StyledButton
+                            variant="ghost"
+                            size="sm"
+                            icon="IconDownload"
+                            onClick={() => {
+                              window.location.href = `/api/rag/files/download?source=${encodeURIComponent(record.source)}`
+                            }}
+                          >Download</StyledButton>
+                        )}
                         <StyledButton
                           variant="danger"
                           size="sm"
@@ -675,7 +773,7 @@ export default function KnowledgeBaseModal({ aiAssistantName = "AI Assistant", o
                   },
                 },
               ]}
-              data={groupAndSortKbFiles(storedFiles)}
+              data={groupAndSortKbFiles(storedFiles, sort)}
               loading={isLoadingFiles}
             />
           </div>
@@ -807,6 +905,57 @@ export default function KnowledgeBaseModal({ aiAssistantName = "AI Assistant", o
           </div>
         </StyledModal>
       )}
+
+      {viewerSource && (
+        <FileViewerModal
+          source={viewerSource}
+          onClose={() => setViewerSource(null)}
+        />
+      )}
     </div>
   )
 }
+
+function FileViewerModal({ source, onClose }: { source: string; onClose: () => void }) {
+  const { data, isLoading, isFetched } = useQuery({
+    queryKey: ['rag', 'file-content', source],
+    queryFn: () => api.getFileContent(source),
+    staleTime: 60_000,
+  })
+
+  // Title falls back to the trailing path segment so the modal still has a
+  // useful header while the fetch is in-flight or if it failed.
+  const fallbackName = source.split(/[/\\]/).at(-1) ?? source
+  const title = data?.fileName ?? fallbackName
+  // `catchInternal` swallows errors and resolves to undefined, surfacing a
+  // toast — so the "couldn't load" branch is gated on a finished-but-empty
+  // fetch rather than on react-query's `isError`.
+  const showError = isFetched && !data
+
+  return (
+    <StyledModal
+      title={title}
+      open={true}
+      onClose={onClose}
+      onCancel={onClose}
+      cancelText="Close"
+      large
+    >
+      <div className="text-left text-sm">
+        {isLoading && (
+          <div className="text-text-secondary">Loading…</div>
+        )}
+        {showError && (
+          <div className="text-amber-700 dark:text-amber-300">
+            Couldn't load file. It may have been moved or its type isn't viewable.
+          </div>
+        )}
+        {data && (
+          <pre className="max-h-[60vh] overflow-auto whitespace-pre-wrap rounded border border-border-subtle bg-surface-secondary p-3 font-mono text-xs text-text-primary">
+            {data.content}
+          </pre>
+        )}
+      </div>
+    </StyledModal>
+  )
+}
diff --git a/admin/inertia/lib/api.ts b/admin/inertia/lib/api.ts
index 0b66758..f15138b 100644
--- a/admin/inertia/lib/api.ts
+++ b/admin/inertia/lib/api.ts
@@ -514,6 +514,17 @@ class API {
     })()
   }
 
+  async getFileContent(source: string) {
+    return catchInternal(async () => {
+      const response = await this.client.get<{
+        content: string
+        extension: string
+        fileName: string
+      }>('/rag/files/content', { params: { source } })
+      return response.data
+    })()
+  }
+
   async getSystemInfo() {
     return catchInternal(async () => {
       const response = await this.client.get<SystemInformationResponse>('/system/info')
diff --git a/admin/inertia/lib/kb_file_grouping.ts b/admin/inertia/lib/kb_file_grouping.ts
index 3d2ae04..cfe0789 100644
--- a/admin/inertia/lib/kb_file_grouping.ts
+++ b/admin/inertia/lib/kb_file_grouping.ts
@@ -52,19 +52,62 @@ export interface KbFileGroup {
   /** Chunks currently embedded for this source; 0 for state-row-less or
    * zero-chunk files. Always 0 for the collapsed admin_docs group. */
   chunksEmbedded: number
+  /** File size in bytes from disk. Null for the collapsed admin_docs group,
+   * and for any file the scanner couldn't stat. */
+  size: number | null
+  /** Last-modified timestamp (ISO 8601). Null for collapsed groups and for
+   * files the scanner couldn't stat. */
+  uploadedAt: string | null
+  /** True when the row corresponds to a user upload — drives whether the
+   * view/download buttons render. False for the collapsed admin_docs group. */
+  isUserUpload: boolean
 }
 
 const BUCKET_SORT_ORDER: KbFileBucket[] = ['zim', 'upload', 'admin_docs', 'other']
 
+export type KbFileSortKey = 'name' | 'size' | 'uploadedAt'
+export type KbFileSortDirection = 'asc' | 'desc'
+export interface KbFileSort {
+  key: KbFileSortKey
+  direction: KbFileSortDirection
+}
+
+const DEFAULT_SORT: KbFileSort = { key: 'name', direction: 'asc' }
+
+function compareForSort(a: StoredFileInfo, b: StoredFileInfo, sort: KbFileSort): number {
+  // Files the scanner couldn't stat sort to the end regardless of direction so
+  // they don't pollute the top of size/uploaded-at views.
+  const aMissing = sort.key !== 'name' && (sort.key === 'size' ? a.size === null : a.uploadedAt === null)
+  const bMissing = sort.key !== 'name' && (sort.key === 'size' ? b.size === null : b.uploadedAt === null)
+  if (aMissing && !bMissing) return 1
+  if (!aMissing && bMissing) return -1
+
+  let cmp = 0
+  if (sort.key === 'size') {
+    cmp = (a.size ?? 0) - (b.size ?? 0)
+  } else if (sort.key === 'uploadedAt') {
+    cmp = (a.uploadedAt ?? '').localeCompare(b.uploadedAt ?? '')
+  }
+  if (cmp === 0) {
+    // Tiebreak (and primary key for 'name') is filename — keeps stable order.
+    cmp = sourceToDisplayName(a.source).localeCompare(sourceToDisplayName(b.source))
+  }
+  return sort.direction === 'desc' ? -cmp : cmp
+}
+
 /**
  * Group stored-file rows into table rows for the Stored Files panel.
  *
  * - Admin docs (`/app/docs/*`, README) collapse into a single
  *   "Project NOMAD documentation · N files" row.
- * - ZIMs, uploads, and others stay as individual rows, sorted by bucket then
- *   alphabetically by filename so related items cluster naturally.
+ * - ZIMs, uploads, and others stay as individual rows, sorted within their
+ *   bucket by the active sort key. Bucket order itself is fixed — sorting
+ *   never flattens or reorders the groups themselves.
  */
-export function groupAndSortKbFiles(files: StoredFileInfo[]): KbFileGroup[] {
+export function groupAndSortKbFiles(
+  files: StoredFileInfo[],
+  sort: KbFileSort = DEFAULT_SORT
+): KbFileGroup[] {
   const buckets: Record<KbFileBucket, StoredFileInfo[]> = {
     zim: [],
     upload: [],
@@ -90,13 +133,14 @@ export function groupAndSortKbFiles(files: StoredFileInfo[]): KbFileGroup[] {
         members: members.map((m) => m.source),
         state: null,
         chunksEmbedded: 0,
+        size: null,
+        uploadedAt: null,
+        isUserUpload: false,
       })
       continue
     }
 
-    for (const file of members.sort((a, b) =>
-      sourceToDisplayName(a.source).localeCompare(sourceToDisplayName(b.source))
-    )) {
+    for (const file of members.sort((a, b) => compareForSort(a, b, sort))) {
       groups.push({
         bucket,
         source: file.source,
@@ -105,6 +149,9 @@ export function groupAndSortKbFiles(files: StoredFileInfo[]): KbFileGroup[] {
         members: [],
         state: file.state,
         chunksEmbedded: file.chunksEmbedded,
+        size: file.size,
+        uploadedAt: file.uploadedAt,
+        isUserUpload: file.isUserUpload,
       })
     }
   }
diff --git a/admin/start/routes.ts b/admin/start/routes.ts
index 165426b..e4f23c7 100644
--- a/admin/start/routes.ts
+++ b/admin/start/routes.ts
@@ -147,6 +147,8 @@ router
     router.get('/file-warnings', [RagController, 'getFileWarnings'])
     router.delete('/files', [RagController, 'deleteFile'])
     router.post('/files/embed', [RagController, 'embedFile'])
+    router.get('/files/content', [RagController, 'getFileContent'])
+    router.get('/files/download', [RagController, 'downloadFile'])
     router.get('/active-jobs', [RagController, 'getActiveJobs'])
     router.get('/failed-jobs', [RagController, 'getFailedJobs'])
     router.delete('/failed-jobs', [RagController, 'cleanupFailedJobs'])
diff --git a/admin/tests/unit/kb_file_grouping.spec.ts b/admin/tests/unit/kb_file_grouping.spec.ts
index 2dbab98..c8bad45 100644
--- a/admin/tests/unit/kb_file_grouping.spec.ts
+++ b/admin/tests/unit/kb_file_grouping.spec.ts
@@ -11,9 +11,19 @@ import type { StoredFileInfo } from '../../types/rag.js'
 /** Wrap source paths into the minimal StoredFileInfo shape that
  * `groupAndSortKbFiles` now expects. State + chunk count are irrelevant to
  * grouping/sorting behavior; the per-file state-pill rendering is exercised
- * separately in the modal's component tests (added in the follow-up PR). */
+ * separately in the modal's component tests (added in the follow-up PR).
+ * Metadata fields default to nullish/false — individual tests that exercise
+ * sort-by-size or sort-by-uploadedAt override as needed. */
 const asInfos = (sources: string[]): StoredFileInfo[] =>
-  sources.map((source) => ({ source, state: null, chunksEmbedded: 0 }))
+  sources.map((source) => ({
+    source,
+    state: null,
+    chunksEmbedded: 0,
+    fileName: sourceToDisplayName(source),
+    size: null,
+    uploadedAt: null,
+    isUserUpload: classifyKbFile(source) === 'upload',
+  }))
 
 test('classifyKbFile distinguishes ZIM, upload, admin_docs, and other', () => {
   assert.equal(
@@ -106,3 +116,78 @@ test('groupAndSortKbFiles preserves a stable synthetic key for the admin docs gr
   // can be used as a React key without colliding with any real file row.
   assert.equal(groups[0].source, '__admin_docs_group__')
 })
+
+/** Sized fixtures for the sort tests. `size` and `uploadedAt` are set so the
+ * three sort keys (name, size, uploadedAt) produce visibly different orders —
+ * if a test passed for name it had better fail for size. */
+const sized: StoredFileInfo[] = [
+  { source: '/app/storage/kb_uploads/charlie.txt', state: null, chunksEmbedded: 0, fileName: 'charlie.txt', size: 100, uploadedAt: '2026-01-01T00:00:00Z', isUserUpload: true },
+  { source: '/app/storage/kb_uploads/alpha.txt',   state: null, chunksEmbedded: 0, fileName: 'alpha.txt',   size: 300, uploadedAt: '2026-03-01T00:00:00Z', isUserUpload: true },
+  { source: '/app/storage/kb_uploads/bravo.txt',   state: null, chunksEmbedded: 0, fileName: 'bravo.txt',   size: 200, uploadedAt: '2026-02-01T00:00:00Z', isUserUpload: true },
+]
+
+test('groupAndSortKbFiles sorts by size ascending', () => {
+  const groups = groupAndSortKbFiles(sized, { key: 'size', direction: 'asc' })
+  assert.deepEqual(groups.map((g) => g.displayName), ['charlie.txt', 'bravo.txt', 'alpha.txt'])
+})
+
+test('groupAndSortKbFiles sorts by size descending', () => {
+  const groups = groupAndSortKbFiles(sized, { key: 'size', direction: 'desc' })
+  assert.deepEqual(groups.map((g) => g.displayName), ['alpha.txt', 'bravo.txt', 'charlie.txt'])
+})
+
+test('groupAndSortKbFiles sorts by uploadedAt ascending', () => {
+  const groups = groupAndSortKbFiles(sized, { key: 'uploadedAt', direction: 'asc' })
+  assert.deepEqual(groups.map((g) => g.displayName), ['charlie.txt', 'bravo.txt', 'alpha.txt'])
+})
+
+test('groupAndSortKbFiles sorts by uploadedAt descending', () => {
+  const groups = groupAndSortKbFiles(sized, { key: 'uploadedAt', direction: 'desc' })
+  assert.deepEqual(groups.map((g) => g.displayName), ['alpha.txt', 'bravo.txt', 'charlie.txt'])
+})
+
+test('groupAndSortKbFiles parks files with null size at the end of size sort', () => {
+  const withMissing: StoredFileInfo[] = [
+    ...sized,
+    { source: '/app/storage/kb_uploads/zzz_missing.txt', state: null, chunksEmbedded: 0, fileName: 'zzz_missing.txt', size: null, uploadedAt: null, isUserUpload: true },
+  ]
+  // Missing-size files sort last regardless of direction so the "real" data
+  // owns the top of the view either way.
+  const asc = groupAndSortKbFiles(withMissing, { key: 'size', direction: 'asc' })
+  assert.equal(asc.at(-1)?.displayName, 'zzz_missing.txt')
+  const desc = groupAndSortKbFiles(withMissing, { key: 'size', direction: 'desc' })
+  assert.equal(desc.at(-1)?.displayName, 'zzz_missing.txt')
+})
+
+test('groupAndSortKbFiles preserves bucket order across all sort modes', () => {
+  const mixed: StoredFileInfo[] = [
+    { source: '/app/storage/zim/big.zim',           state: null, chunksEmbedded: 0, fileName: 'big.zim',     size: 999, uploadedAt: '2026-01-01T00:00:00Z', isUserUpload: false },
+    { source: '/app/storage/kb_uploads/small.txt',  state: null, chunksEmbedded: 0, fileName: 'small.txt',   size: 1,   uploadedAt: '2026-09-01T00:00:00Z', isUserUpload: true },
+    { source: '/app/docs/release-notes.md',         state: null, chunksEmbedded: 0, fileName: 'release-notes.md', size: 50, uploadedAt: '2026-05-01T00:00:00Z', isUserUpload: false },
+  ]
+  // Even if size-desc would put zim first naturally, sort runs *within* a
+  // bucket — buckets themselves stay in the canonical zim → upload → admin_docs
+  // order. This is the invariant that lets the per-bucket grouping stay
+  // legible while still giving the user a sortable view.
+  for (const direction of ['asc', 'desc'] as const) {
+    for (const key of ['name', 'size', 'uploadedAt'] as const) {
+      const groups = groupAndSortKbFiles(mixed, { key, direction })
+      assert.deepEqual(
+        groups.map((g) => g.bucket),
+        ['zim', 'upload', 'admin_docs'],
+        `bucket order changed for ${key}/${direction}`
+      )
+    }
+  }
+})
+
+test('groupAndSortKbFiles emits null metadata + isUserUpload=false for the admin_docs group', () => {
+  const groups = groupAndSortKbFiles(asInfos([
+    '/app/docs/release-notes.md',
+    '/app/README.md',
+  ]))
+  assert.equal(groups[0].bucket, 'admin_docs')
+  assert.equal(groups[0].size, null)
+  assert.equal(groups[0].uploadedAt, null)
+  assert.equal(groups[0].isUserUpload, false)
+})
diff --git a/admin/types/rag.ts b/admin/types/rag.ts
index 0b9c6c8..465a539 100644
--- a/admin/types/rag.ts
+++ b/admin/types/rag.ts
@@ -56,6 +56,15 @@ export type StoredFileInfo = {
   source: string
   state: import('./kb_ingest_state.js').KbIngestStateValue | null
   chunksEmbedded: number
+  /** Filename portion of `source` (last path segment). */
+  fileName: string
+  /** File size in bytes from disk; null if the file is missing or unreadable. */
+  size: number | null
+  /** Last-modified timestamp from disk (ISO 8601); null if unavailable. */
+  uploadedAt: string | null
+  /** True when `source` lives under the user-uploads directory. Drives which
+   * rows offer view/download in the UI. */
+  isUserUpload: boolean
 }
 
 /**

From 02c9f72bf0b76a17d1488b26985e12d5b54eff1d Mon Sep 17 00:00:00 2001
From: Jake Turner <52841588+jakeaturner@users.noreply.github.com>
Date: Fri, 19 Jun 2026 21:42:44 -0700
Subject: [PATCH 67/83] fix(UI): unifies Supply Depot icon and improves loading
 UX (#1022)

---
 admin/inertia/components/LoadingSpinner.tsx | 11 +--
 admin/inertia/layouts/SettingsLayout.tsx    |  4 +-
 admin/inertia/pages/home.tsx                |  4 +-
 admin/inertia/pages/supply-depot.tsx        | 79 ++++++++++++++-------
 4 files changed, 65 insertions(+), 33 deletions(-)

diff --git a/admin/inertia/components/LoadingSpinner.tsx b/admin/inertia/components/LoadingSpinner.tsx
index 493e9b0..8744ac4 100644
--- a/admin/inertia/components/LoadingSpinner.tsx
+++ b/admin/inertia/components/LoadingSpinner.tsx
@@ -8,7 +8,7 @@ interface LoadingSpinnerProps {
 
 const LoadingSpinner: React.FC<LoadingSpinnerProps> = ({
   text,
-  fullscreen = true,
+  fullscreen = false,
   iconOnly = false,
   light = false,
   className,
@@ -29,9 +29,12 @@ const LoadingSpinner: React.FC<LoadingSpinnerProps> = ({
   }
 
   return (
-    <div className={className}>
-      <div className="ui active inverted dimmer">
-        <div className="ui text loader">{!iconOnly && <span>{text || 'Loading'}</span>}</div>
+    <div
+      className={`fixed inset-0 z-[100] flex items-center justify-center bg-black/50 backdrop-blur-sm ${className || ''}`}
+    >
+      <div className="flex flex-col items-center justify-center">
+        <div className="w-10 h-10 border-[3px] border-white border-t-transparent rounded-full animate-spin" />
+        {!iconOnly && <div className="text-white mt-3 font-medium">{text || 'Loading'}</div>}
       </div>
     </div>
   )
diff --git a/admin/inertia/layouts/SettingsLayout.tsx b/admin/inertia/layouts/SettingsLayout.tsx
index 2f02be6..b014444 100644
--- a/admin/inertia/layouts/SettingsLayout.tsx
+++ b/admin/inertia/layouts/SettingsLayout.tsx
@@ -1,5 +1,6 @@
 import {
   IconArrowBigUpLines,
+  IconBox,
   IconChartBar,
   IconDashboard,
   IconFolder,
@@ -7,7 +8,6 @@ import {
   IconHeart,
   IconMapRoute,
   IconSettings,
-  IconTerminal2,
   IconWand,
   IconZoom
 } from '@tabler/icons-react'
@@ -23,7 +23,7 @@ export default function SettingsLayout({ children }: { children: React.ReactNode
 
   const navigation = [
     ...(aiAssistantInstallStatus.isInstalled ? [{ name: aiAssistantName, href: '/settings/models', icon: IconWand, current: false }] : []),
-    { name: 'Supply Depot', href: '/supply-depot', icon: IconTerminal2, current: false },
+    { name: 'Supply Depot', href: '/supply-depot', icon: IconBox, current: false },
     { name: 'Benchmark', href: '/settings/benchmark', icon: IconChartBar, current: false },
     { name: 'Content Explorer', href: '/settings/zim/remote-explorer', icon: IconZoom, current: false },
     { name: 'Content Manager', href: '/settings/zim', icon: IconFolder, current: false },
diff --git a/admin/inertia/pages/home.tsx b/admin/inertia/pages/home.tsx
index bf38fc1..a782327 100644
--- a/admin/inertia/pages/home.tsx
+++ b/admin/inertia/pages/home.tsx
@@ -1,8 +1,8 @@
 import {
   IconBolt,
+  IconBox,
   IconHelp,
   IconMapRoute,
-  IconPlus,
   IconSettings,
   IconWifiOff,
 } from '@tabler/icons-react'
@@ -46,7 +46,7 @@ const SYSTEM_ITEMS = [
     to: '/supply-depot',
     target: '',
     description: 'Browse and install curated apps, or add your own Docker container',
-    icon: <IconPlus size={48} />,
+    icon: <IconBox size={48} />,
     installed: true,
     displayOrder: 51,
     poweredBy: null,
diff --git a/admin/inertia/pages/supply-depot.tsx b/admin/inertia/pages/supply-depot.tsx
index 3943e99..80a20ff 100644
--- a/admin/inertia/pages/supply-depot.tsx
+++ b/admin/inertia/pages/supply-depot.tsx
@@ -201,10 +201,6 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
     (s) => s.service_name === SERVICE_NAMES.KOLIBRI_GEN2 && s.installed
   )
 
-  useEffect(() => {
-    console.log("Education Gen 2 installed:", educationGen2Installed)
-  }, [educationGen2Installed])
-
   // ── Actions ───────────────────────────────────────────────────────────────
   async function handleInstall(service: ServiceSlim) {
     const hasWarnings =
@@ -212,48 +208,61 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
 
     if (hasWarnings && !forceInstall) return
 
+    // Keep the modal open with a spinning confirm button while the request is in
+    // flight; close it once the install job is dispatched. Progress then streams
+    // via the InstallActivityFeed broadcast, so we drop the loading flag here.
     setLoading(true)
-    setModal(null)
     const result = await api.installService(service.service_name)
+    setModal(null)
     setLoading(false)
     if (!result?.success) showError(result?.message || 'Failed to start installation.')
   }
 
   async function handleAffect(service: ServiceSlim, action: 'start' | 'stop' | 'restart') {
-    setModal(null)
     setLoading(true)
     const result = await api.affectService(service.service_name, action)
-    setLoading(false)
-    if (!result?.success) showError(result?.message || `Failed to ${action} service.`)
-    else setTimeout(() => window.location.reload(), 1500)
+    setModal(null)
+    if (!result?.success) {
+      setLoading(false)
+      showError(result?.message || `Failed to ${action} service.`)
+    } else {
+      // Keep loading=true so the overlay covers the page until it reloads.
+      setTimeout(() => window.location.reload(), 1500)
+    }
   }
 
   async function handleForceReinstall(service: ServiceSlim) {
-    setModal(null)
     setLoading(true)
     const result = await api.forceReinstallService(service.service_name)
+    setModal(null)
     setLoading(false)
     if (!result?.success) showError(result?.message || 'Failed to start reinstall.')
   }
 
   async function handleDelete(service: ServiceSlim) {
-    setModal(null)
     setLoading(true)
     const result = await api.deleteCustomApp(service.service_name, removeImage)
     setRemoveImage(false)
-    setLoading(false)
-    if (!result?.success) showError(result?.message || 'Failed to delete app.')
-    else setTimeout(() => window.location.reload(), 1000)
+    setModal(null)
+    if (!result?.success) {
+      setLoading(false)
+      showError(result?.message || 'Failed to delete app.')
+    } else {
+      setTimeout(() => window.location.reload(), 1000)
+    }
   }
 
   async function handleUninstall(service: ServiceSlim) {
-    setModal(null)
     setLoading(true)
     const result = await api.uninstallService(service.service_name, removeImage)
     setRemoveImage(false)
-    setLoading(false)
-    if (!result?.success) showError(result?.message || 'Failed to uninstall app.')
-    else setTimeout(() => window.location.reload(), 1000)
+    setModal(null)
+    if (!result?.success) {
+      setLoading(false)
+      showError(result?.message || 'Failed to uninstall app.')
+    } else {
+      setTimeout(() => window.location.reload(), 1000)
+    }
   }
 
   async function handleUpdate(service: ServiceSlim) {
@@ -351,7 +360,7 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
     <AppLayout>
       <Head title="Supply Depot" />
 
-      {loading && <LoadingSpinner fullscreen text="Working..." />}
+      {loading && !modal && <LoadingSpinner fullscreen text="Working..." />}
 
       <div className="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8 py-8">
         {/* ── Hero / controls panel ─────────────────────────────────────────── */}
@@ -532,7 +541,10 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
         <StyledModal
           title={`Install ${modal.service.friendly_name ?? modal.service.service_name}`}
           open
-          onCancel={() => setModal(null)}
+          onCancel={() => {
+            if (loading) return
+            setModal(null)
+          }}
           onConfirm={() => handleInstall(modal.service)}
           confirmText="Install"
           confirmIcon="IconDownload"
@@ -590,7 +602,10 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
         <StyledModal
           title={`Start ${modal.service.friendly_name ?? modal.service.service_name}`}
           open
-          onCancel={() => setModal(null)}
+          onCancel={() => {
+            if (loading) return
+            setModal(null)
+          }}
           onConfirm={() => handleAffect(modal.service, 'start')}
           confirmText="Start"
           confirmIcon="IconPlayerPlay"
@@ -606,7 +621,10 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
         <StyledModal
           title={`Stop ${modal.service.friendly_name ?? modal.service.service_name}`}
           open
-          onCancel={() => setModal(null)}
+          onCancel={() => {
+            if (loading) return
+            setModal(null)
+          }}
           onConfirm={() => handleAffect(modal.service, 'stop')}
           confirmText="Stop"
           confirmIcon="IconPlayerStop"
@@ -622,7 +640,10 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
         <StyledModal
           title={`Restart ${modal.service.friendly_name ?? modal.service.service_name}`}
           open
-          onCancel={() => setModal(null)}
+          onCancel={() => {
+            if (loading) return
+            setModal(null)
+          }}
           onConfirm={() => handleAffect(modal.service, 'restart')}
           confirmText="Restart"
           confirmIcon="IconRefresh"
@@ -638,7 +659,10 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
         <StyledModal
           title={`Force Reinstall ${modal.service.friendly_name ?? modal.service.service_name}`}
           open
-          onCancel={() => setModal(null)}
+          onCancel={() => {
+            if (loading) return
+            setModal(null)
+          }}
           onConfirm={() => handleForceReinstall(modal.service)}
           confirmText="Wipe & Reinstall"
           confirmIcon="IconRefresh"
@@ -659,6 +683,7 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
           title={`Delete ${modal.service.friendly_name ?? modal.service.service_name}`}
           open
           onCancel={() => {
+            if (loading) return
             setRemoveImage(false)
             setModal(null)
           }}
@@ -691,6 +716,7 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
           title={`Uninstall ${modal.service.friendly_name ?? modal.service.service_name}`}
           open
           onCancel={() => {
+            if (loading) return
             setRemoveImage(false)
             setModal(null)
           }}
@@ -743,7 +769,10 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
           record={modal.service}
           currentTag={extractTag(modal.service.container_image)}
           latestVersion={modal.service.available_update_version!}
-          onCancel={() => setModal(null)}
+          onCancel={() => {
+            if (loading) return
+            setModal(null)
+          }}
           onUpdate={(targetVersion) => {
             const service = modal.service
             setModal(null)

From 4a795df79342cf9e9bb004b18194c701d99b49f3 Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Mon, 22 Jun 2026 20:53:02 +0000
Subject: [PATCH 68/83] feat: configurable internet test url override in new
 Advanced Settings page

---
 README.md                                    |   4 +-
 admin/app/controllers/settings_controller.ts |  14 ++
 admin/app/services/system_service.ts         |  24 ++--
 admin/app/validators/settings.ts             |  18 +++
 admin/constants/kv_store.ts                  |   2 +-
 admin/inertia/layouts/SettingsLayout.tsx     |   2 +
 admin/inertia/pages/settings/advanced.tsx    | 130 +++++++++++++++++++
 admin/inertia/pages/supply-depot.tsx         |  41 +++---
 admin/start/routes.ts                        |   1 +
 admin/types/kv_store.ts                      |   1 +
 10 files changed, 210 insertions(+), 27 deletions(-)
 create mode 100644 admin/inertia/pages/settings/advanced.tsx

diff --git a/README.md b/README.md
index ba7738e..b380417 100644
--- a/README.md
+++ b/README.md
@@ -108,7 +108,9 @@ For answers to common questions about Project N.O.M.A.D., please see our [FAQ](F
 ## About Internet Usage & Privacy
 Project N.O.M.A.D. is designed for offline usage. An internet connection is only required during the initial installation (to download dependencies) and if you (the user) decide to download additional tools and resources at a later time. Otherwise, N.O.M.A.D. does not require an internet connection and has ZERO built-in telemetry.
 
-To test internet connectivity, N.O.M.A.D. first attempts to make a request to Cloudflare's utility endpoint, `https://1.1.1.1/cdn-cgi/trace`. If that endpoint is unreachable (for example, because your network blocks `1.1.1.1`), it falls back to other endpoints the application already contacts (the GitHub API and the Project N.O.M.A.D. API) and considers the connection online if any of them respond. You can override the endpoint used for this check with the `INTERNET_STATUS_TEST_URL` environment variable.
+To test internet connectivity, N.O.M.A.D. first attempts to make a request to Cloudflare's utility endpoint, `https://1.1.1.1/cdn-cgi/trace`. If that endpoint is unreachable (for example, because your network blocks `1.1.1.1`), it falls back to other endpoints the application already contacts (the GitHub API and the Project N.O.M.A.D. API) and considers the connection online if any of them respond.
+
+You can override the endpoint used for this check in two ways. The connectivity test URL can be configured from the UI under **Settings → Advanced** (stored locally on your instance), or you can set the `INTERNET_STATUS_TEST_URL` environment variable. When set, the environment variable always takes precedence over the UI-configured value. If neither is set, the built-in defaults above are used.
 
 ## About Security
 By design, Project N.O.M.A.D. is intended to be open and available without hurdles — it includes no authentication. If you decide to connect your device to a local network after install (e.g. for allowing other devices to access its resources), you can block/open ports to control which services are exposed.
diff --git a/admin/app/controllers/settings_controller.ts b/admin/app/controllers/settings_controller.ts
index b4a2058..4675d4b 100644
--- a/admin/app/controllers/settings_controller.ts
+++ b/admin/app/controllers/settings_controller.ts
@@ -6,6 +6,7 @@ import { SystemService } from '#services/system_service'
 import { getSettingSchema, updateSettingSchema, validateSettingValue } from '#validators/settings'
 import { inject } from '@adonisjs/core'
 import type { HttpContext } from '@adonisjs/core/http'
+import env from '#start/env'
 
 @inject()
 export default class SettingsController {
@@ -110,6 +111,19 @@ export default class SettingsController {
     })
   }
 
+  async advanced({ inertia }: HttpContext) {
+    // When the env var is set it always takes precedence over the stored value,
+    // so surface that to the UI to disable the field and explain the override.
+    const envOverride = Boolean(env.get('INTERNET_STATUS_TEST_URL')?.trim())
+    const internetStatusTestUrl = await KVStore.getValue('system.internetStatusTestUrl')
+    return inertia.render('settings/advanced', {
+      advanced: {
+        internetStatusTestUrl: internetStatusTestUrl ?? '',
+        internetStatusTestUrlEnvOverride: envOverride,
+      },
+    })
+  }
+
   async getSetting({ request, response }: HttpContext) {
     const { key } = await getSettingSchema.validate({ key: request.qs().key });
     const value = await KVStore.getValue(key);
diff --git a/admin/app/services/system_service.ts b/admin/app/services/system_service.ts
index 7e7412b..6f9d041 100644
--- a/admin/app/services/system_service.ts
+++ b/admin/app/services/system_service.ts
@@ -49,31 +49,37 @@ export class SystemService {
     const MAX_ATTEMPTS = 3
 
     let testUrls = DEFAULT_TEST_URLS
-    const customTestUrl = env.get('INTERNET_STATUS_TEST_URL')?.trim()
 
-    // If a custom test URL is provided and valid, use it exclusively. This
-    // preserves the existing override behavior for operators who intentionally
-    // point connectivity checks at a specific endpoint.
+    // Resolve the test endpoint in priority order: the INTERNET_STATUS_TEST_URL
+    // env var always wins (legacy override for operators who intentionally point
+    // connectivity checks at a specific endpoint), then the UI-configurable value
+    // stored in KVStore, and finally the built-in defaults.
+    const envTestUrl = env.get('INTERNET_STATUS_TEST_URL')?.trim()
+    const kvTestUrl = (await KVStore.getValue('system.internetStatusTestUrl'))?.trim()
+    const customTestUrl = envTestUrl || kvTestUrl
+
+    // If a custom test URL is provided and valid, use it exclusively.
     if (customTestUrl && customTestUrl !== '') {
       try {
         new URL(customTestUrl)
         testUrls = [customTestUrl]
       } catch (error) {
         logger.warn(
-          `Invalid INTERNET_STATUS_TEST_URL: ${customTestUrl}. Falling back to default URLs.`
+          `Invalid internet status test URL: ${customTestUrl}. Falling back to default URLs.`
         )
       }
     }
 
     for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
       try {
-        // Probe all endpoints in parallel and resolve as soon as the first one
+        // Probe all test endpoints in parallel and resolve as soon as the first one
         // responds. Any HTTP response (including non-2xx) means we reached the
         // internet, so accept all status codes rather than requiring a strict 200.
         await Promise.any(
-          testUrls.map((testUrl) =>
-            axios.get(testUrl, { timeout: 5000, validateStatus: () => true })
-          )
+          testUrls.map((testUrl) => {
+            logger.debug(`[SystemService] Checking internet connectivity via: ${testUrl}`)
+            return axios.get(testUrl, { timeout: 5000, validateStatus: () => true })
+          })
         )
         return true
       } catch (error) {
diff --git a/admin/app/validators/settings.ts b/admin/app/validators/settings.ts
index fa56772..089e922 100644
--- a/admin/app/validators/settings.ts
+++ b/admin/app/validators/settings.ts
@@ -36,6 +36,24 @@ export function validateSettingValue(key: KVStoreKey, value: unknown): string |
             }
             return null
         }
+        case 'system.internetStatusTestUrl': {
+            // Empty clears the setting (reverts to env var / built-in defaults).
+            if (value === '' || value === undefined || value === null) {
+                return null
+            }
+            if (typeof value !== 'string') {
+                return 'Test URL must be a string.'
+            }
+            try {
+                const url = new URL(value)
+                if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+                    return 'Test URL must use http or https.'
+                }
+            } catch {
+                return 'Test URL must be a valid URL (e.g. "https://example.com").'
+            }
+            return null
+        }
         case 'contentAutoUpdate.maxBytesPerWindow': {
             // Per-window download budget in bytes. 0 = unlimited.
             const num = Number(value)
diff --git a/admin/constants/kv_store.ts b/admin/constants/kv_store.ts
index e40b81e..35b9617 100644
--- a/admin/constants/kv_store.ts
+++ b/admin/constants/kv_store.ts
@@ -1,3 +1,3 @@
 import { KVStoreKey } from "../types/kv_store.js";
 
-export const SETTINGS_KEYS: KVStoreKey[] = ['chat.suggestionsEnabled', 'chat.lastModel', 'ui.hasVisitedEasySetup', 'ui.theme', 'system.earlyAccess', 'ai.assistantCustomName', 'ai.remoteOllamaUrl', 'ai.ollamaFlashAttention', 'rag.defaultIngestPolicy', 'autoUpdate.enabled', 'autoUpdate.windowStart', 'autoUpdate.windowEnd', 'autoUpdate.cooloffHours', 'appAutoUpdate.enabled', 'contentAutoUpdate.enabled', 'contentAutoUpdate.windowStart', 'contentAutoUpdate.windowEnd', 'contentAutoUpdate.cooloffHours', 'contentAutoUpdate.maxBytesPerWindow'];
\ No newline at end of file
+export const SETTINGS_KEYS: KVStoreKey[] = ['chat.suggestionsEnabled', 'chat.lastModel', 'ui.hasVisitedEasySetup', 'ui.theme', 'system.earlyAccess', 'system.internetStatusTestUrl', 'ai.assistantCustomName', 'ai.remoteOllamaUrl', 'ai.ollamaFlashAttention', 'rag.defaultIngestPolicy', 'autoUpdate.enabled', 'autoUpdate.windowStart', 'autoUpdate.windowEnd', 'autoUpdate.cooloffHours', 'appAutoUpdate.enabled', 'contentAutoUpdate.enabled', 'contentAutoUpdate.windowStart', 'contentAutoUpdate.windowEnd', 'contentAutoUpdate.cooloffHours', 'contentAutoUpdate.maxBytesPerWindow'];
\ No newline at end of file
diff --git a/admin/inertia/layouts/SettingsLayout.tsx b/admin/inertia/layouts/SettingsLayout.tsx
index b014444..6dc868d 100644
--- a/admin/inertia/layouts/SettingsLayout.tsx
+++ b/admin/inertia/layouts/SettingsLayout.tsx
@@ -1,4 +1,5 @@
 import {
+  IconAdjustments,
   IconArrowBigUpLines,
   IconBox,
   IconChartBar,
@@ -42,6 +43,7 @@ export default function SettingsLayout({ children }: { children: React.ReactNode
       current: false,
     },
     { name: 'System', href: '/settings/system', icon: IconSettings, current: false },
+    { name: 'Advanced', href: '/settings/advanced', icon: IconAdjustments, current: false },
     { name: 'Support the Project', href: '/settings/support', icon: IconHeart, current: false },
     { name: 'Legal Notices', href: '/settings/legal', icon: IconGavel, current: false },
   ]
diff --git a/admin/inertia/pages/settings/advanced.tsx b/admin/inertia/pages/settings/advanced.tsx
new file mode 100644
index 0000000..1f9da31
--- /dev/null
+++ b/admin/inertia/pages/settings/advanced.tsx
@@ -0,0 +1,130 @@
+import { Head } from '@inertiajs/react'
+import { useState } from 'react'
+import SettingsLayout from '~/layouts/SettingsLayout'
+import StyledButton from '~/components/StyledButton'
+import StyledSectionHeader from '~/components/StyledSectionHeader'
+import Alert from '~/components/Alert'
+import Input from '~/components/inputs/Input'
+import { useNotifications } from '~/context/NotificationContext'
+import { useMutation } from '@tanstack/react-query'
+import api from '~/lib/api'
+
+export default function AdvancedPage(props: {
+  advanced: {
+    internetStatusTestUrl: string
+    internetStatusTestUrlEnvOverride: boolean
+  }
+}) {
+  const { addNotification } = useNotifications()
+  const { internetStatusTestUrlEnvOverride } = props.advanced
+
+  const [internetStatusTestUrl, setInternetStatusTestUrl] = useState(
+    props.advanced.internetStatusTestUrl ?? ''
+  )
+  const [testUrlError, setTestUrlError] = useState<string | null>(null)
+
+  // Mirror the backend validation (admin/app/validators/settings.ts) for instant
+  // feedback. The backend remains the source of truth and returns 422 on failure.
+  function validateTestUrl(value: string): string | null {
+    if (value.trim() === '') return null // empty clears the setting
+    try {
+      const url = new URL(value)
+      if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        return 'Test URL must use http or https.'
+      }
+    } catch {
+      return 'Test URL must be a valid URL (e.g. "https://example.com").'
+    }
+    return null
+  }
+
+  const updateTestUrlMutation = useMutation({
+    mutationFn: async (value: string) => {
+      return await api.updateSetting('system.internetStatusTestUrl', value)
+    },
+    onSuccess: () => {
+      addNotification({ message: 'Setting updated successfully.', type: 'success' })
+    },
+    onError: (error: any) => {
+      const msg =
+        error?.response?.data?.message ||
+        error?.message ||
+        'There was an error updating the setting. Please try again.'
+      setTestUrlError(msg)
+      addNotification({ message: msg, type: 'error' })
+    },
+  })
+
+  function handleSaveTestUrl() {
+    const trimmed = internetStatusTestUrl.trim()
+    const validationError = validateTestUrl(trimmed)
+    if (validationError) {
+      setTestUrlError(validationError)
+      return
+    }
+    setTestUrlError(null)
+    updateTestUrlMutation.mutate(trimmed)
+  }
+
+  return (
+    <SettingsLayout>
+      <Head title="Advanced Settings | Project N.O.M.A.D." />
+      <div className="xl:pl-72 w-full">
+        <main className="px-12 py-6">
+          <h1 className="text-4xl font-semibold mb-4">Advanced</h1>
+          <p className="text-text-muted mb-4">
+            Advanced configuration for operators. These settings are optional — the defaults work
+            for most deployments.
+          </p>
+
+          <StyledSectionHeader title="Connectivity" className="mt-8 mb-4" />
+          <div className="bg-surface-primary rounded-lg border-2 border-border-subtle p-6">
+            <p className="text-sm text-text-secondary mb-4">
+              N.O.M.A.D. periodically checks whether it can reach the internet. By default it probes
+              Cloudflare's utility endpoint with a few fallbacks. Set a custom endpoint below if your
+              network blocks the defaults. Leave blank to use the built-in defaults.
+            </p>
+
+            {internetStatusTestUrlEnvOverride && (
+              <Alert
+                type="info"
+                variant="bordered"
+                title="Managed by environment variable"
+                message="The INTERNET_STATUS_TEST_URL environment variable is set and takes precedence over this setting. Remove it to manage the test URL here."
+                className="!mb-4"
+              />
+            )}
+
+            <div className="flex items-end gap-3">
+              <div className="flex-1">
+                <Input
+                  name="internetStatusTestUrl"
+                  label="Internet Status Test URL"
+                  helpText="A single http(s) URL used to check connectivity. Any HTTP response counts as online."
+                  placeholder="https://1.1.1.1/cdn-cgi/trace"
+                  value={internetStatusTestUrl}
+                  disabled={internetStatusTestUrlEnvOverride}
+                  error={Boolean(testUrlError)}
+                  onChange={(e) => {
+                    setInternetStatusTestUrl(e.target.value)
+                    setTestUrlError(null)
+                  }}
+                />
+                {testUrlError && <p className="text-sm text-red-600 mt-1">{testUrlError}</p>}
+              </div>
+              <StyledButton
+                variant="primary"
+                onClick={handleSaveTestUrl}
+                loading={updateTestUrlMutation.isPending}
+                disabled={updateTestUrlMutation.isPending || internetStatusTestUrlEnvOverride}
+                className="mb-0.5"
+              >
+                Save
+              </StyledButton>
+            </div>
+          </div>
+        </main>
+      </div>
+    </SettingsLayout>
+  )
+}
diff --git a/admin/inertia/pages/supply-depot.tsx b/admin/inertia/pages/supply-depot.tsx
index 80a20ff..3bf700e 100644
--- a/admin/inertia/pages/supply-depot.tsx
+++ b/admin/inertia/pages/supply-depot.tsx
@@ -363,6 +363,16 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
       {loading && !modal && <LoadingSpinner fullscreen text="Working..." />}
 
       <div className="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8 py-8">
+        {!isOnline && (
+          <Alert
+            title="No internet connection. You may not be able to download files."
+            message=""
+            type="warning"
+            variant="solid"
+            className="!mb-4"
+          />
+        )}
+
         {/* ── Hero / controls panel ─────────────────────────────────────────── */}
         <div className="rounded-lg overflow-hidden bg-desert-white border border-desert-stone-light shadow-sm mb-8">
           {/* Green header band */}
@@ -383,7 +393,6 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
             <div className="absolute top-0 right-0 w-24 h-24 transform translate-x-8 -translate-y-8">
               <div className="w-full h-full bg-desert-green-dark opacity-30 transform rotate-45" />
             </div>
-
             <div className="relative flex items-center gap-3">
               <IconBox className="text-white opacity-90 flex-shrink-0" size={28} />
               <div>
@@ -442,8 +451,8 @@ export default function SupplyDepotPage(props: { system: { services: ServiceSlim
                   key={cat.id}
                   onClick={() => setActiveCategory(cat.id)}
                   className={`px-3 py-1 rounded-full text-xs font-medium transition-colors cursor-pointer border ${activeCategory === cat.id
-                      ? 'bg-desert-green text-white border-desert-green'
-                      : 'bg-surface-secondary text-text-muted border-desert-stone-lighter hover:text-text-primary hover:border-desert-stone-light'
+                    ? 'bg-desert-green text-white border-desert-green'
+                    : 'bg-surface-secondary text-text-muted border-desert-stone-lighter hover:text-text-primary hover:border-desert-stone-light'
                     }`}
                 >
                   {cat.label}
@@ -899,8 +908,8 @@ function AppCard({
   return (
     <div
       className={`relative flex flex-col rounded-xl border p-4 bg-surface-primary shadow-sm transition-all duration-200 hover:shadow-lg hover:-translate-y-0.5 ${service.installed
-          ? 'border-desert-stone-light'
-          : 'border-desert-stone-lighter hover:border-desert-stone-light'
+        ? 'border-desert-stone-light'
+        : 'border-desert-stone-lighter hover:border-desert-stone-light'
         }`}
     >
       {/* Installed accent spine (rounded to follow the card corners — the card no longer clips
@@ -1065,15 +1074,15 @@ function AppCard({
                   {
                     migrationInstructionsHref ? (
                       <a
-                      href={migrationInstructionsHref}
-                      target="_blank"
-                      rel="noopener noreferrer"
-                      onClick={(e) => e.stopPropagation()}
-                      className="flex items-center gap-2 w-full px-3 py-2 text-xs transition-colors text-left cursor-pointer text-text-primary hover:bg-surface-secondary"
-                    >
-                      <IconBook className="h-4 w-4" />
-                      {migrationInstructionsText || 'Migration instructions'}
-                    </a>
+                        href={migrationInstructionsHref}
+                        target="_blank"
+                        rel="noopener noreferrer"
+                        onClick={(e) => e.stopPropagation()}
+                        className="flex items-center gap-2 w-full px-3 py-2 text-xs transition-colors text-left cursor-pointer text-text-primary hover:bg-surface-secondary"
+                      >
+                        <IconBook className="h-4 w-4" />
+                        {migrationInstructionsText || 'Migration instructions'}
+                      </a>
                     ) : (null)
                   }
                   {!service.is_custom && onToggleAutoUpdate ? (
@@ -1147,8 +1156,8 @@ function DropdownItem({
         onClick()
       }}
       className={`flex items-center gap-2 w-full px-3 py-2 text-xs transition-colors text-left cursor-pointer ${danger
-          ? 'text-desert-red hover:bg-desert-red/10'
-          : 'text-text-primary hover:bg-surface-secondary'
+        ? 'text-desert-red hover:bg-desert-red/10'
+        : 'text-text-primary hover:bg-surface-secondary'
         }`}
     >
       {icon}
diff --git a/admin/start/routes.ts b/admin/start/routes.ts
index e4f23c7..6c19135 100644
--- a/admin/start/routes.ts
+++ b/admin/start/routes.ts
@@ -57,6 +57,7 @@ router
     router.get('/zim/remote-explorer', [SettingsController, 'zimRemote'])
     router.get('/benchmark', [SettingsController, 'benchmark'])
     router.get('/support', [SettingsController, 'support'])
+    router.get('/advanced', [SettingsController, 'advanced'])
   })
   .prefix('/settings')
 
diff --git a/admin/types/kv_store.ts b/admin/types/kv_store.ts
index 5c32dbe..1156c3e 100644
--- a/admin/types/kv_store.ts
+++ b/admin/types/kv_store.ts
@@ -7,6 +7,7 @@ export const KV_STORE_SCHEMA = {
   'system.updateAvailable':     'boolean',
   'system.latestVersion':       'string',
   'system.earlyAccess':         'boolean',
+  'system.internetStatusTestUrl': 'string',
   'autoUpdate.enabled':         'boolean',
   'autoUpdate.windowStart':     'string',
   'autoUpdate.windowEnd':       'string',

From f0142b67f894988d696724895fd253607d73e275 Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Mon, 22 Jun 2026 22:05:02 +0000
Subject: [PATCH 69/83] chore(docs): update release notes

---
 admin/docs/release-notes.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/admin/docs/release-notes.md b/admin/docs/release-notes.md
index 5184d85..fa6ee87 100644
--- a/admin/docs/release-notes.md
+++ b/admin/docs/release-notes.md
@@ -13,6 +13,7 @@
 - **Maps — Persistent View**: The Maps page now remembers your position and zoom across refreshes instead of resetting to the default US-wide view. The saved view is bounds-checked, so a corrupt value safely falls back to the default. Thanks @chriscrosstalk for the contribution!
 - **Content Manager — Rescan Library**: A new "Rescan Library" button rebuilds the Kiwix index from the ZIM files currently on disk, so files **sideloaded** outside NOMAD's download flow (USB stick, SSH, network share) can be served without dropping to a terminal. It reports how many new books were found and, in library mode, hot-reloads without a container restart. Thanks @chriscrosstalk for the contribution!
 - **Configuration — Redis database selection**: Added a `REDIS_DB` environment variable so operators can pick a Redis logical database (0–15) for the job queue and live-update transport. This prevents key collisions when a single Redis instance is shared across multiple stacks (common in homelabs). Defaults to db 0, preserving existing behavior. Thanks @johno10661 for the contribution!
+- **Advanced Settings — Internet Test URL**: Added a new Advanced Settings page with an option to override the default internet test "beacon" URL (more advanced settings to come). Previously, overriding this URL required an ENV variable change and container restart. The legacy ENV variable is still respected if you've set it. Thanks @jakeaturner for the contribution!
 
 ### Bug Fixes
 - **Storage**: When the admin storage volume is relocated to another disk, child apps (Kiwix, Ollama, Qdrant, Flatnotes, Kolibri) now automatically follow to the new location instead of mounting the old, empty path. The host storage root is now derived from the admin's actual mount, with an explicit `NOMAD_STORAGE_PATH` override and clearer compose comments. Thanks @chriscrosstalk for the fix!

From 88ac4d5ec4fd3dae0b9a5343382776db3bca54eb Mon Sep 17 00:00:00 2001
From: Jake Turner <52841588+jakeaturner@users.noreply.github.com>
Date: Mon, 22 Jun 2026 21:19:49 -0700
Subject: [PATCH 70/83] feat(RAG): adds the ability to cancel all embedding
 jobs (#1034)

---
 admin/app/controllers/rag_controller.ts       |  8 ++
 admin/app/jobs/embed_file_job.ts              | 56 ++++++++++++++
 .../components/chat/KnowledgeBaseModal.tsx    | 76 ++++++++++++++++---
 admin/inertia/lib/api.ts                      |  7 ++
 admin/start/routes.ts                         |  1 +
 5 files changed, 137 insertions(+), 11 deletions(-)

diff --git a/admin/app/controllers/rag_controller.ts b/admin/app/controllers/rag_controller.ts
index 68cb5ae..7738d0f 100644
--- a/admin/app/controllers/rag_controller.ts
+++ b/admin/app/controllers/rag_controller.ts
@@ -110,6 +110,14 @@ export default class RagController {
     })
   }
 
+  public async cancelAllJobs({ response }: HttpContext) {
+    const result = await EmbedFileJob.cancelAllJobs()
+    return response.status(200).json({
+      message: `Cancelled ${result.cancelled} job${result.cancelled !== 1 ? 's' : ''}${result.filesDeleted > 0 ? `, deleted ${result.filesDeleted} file${result.filesDeleted !== 1 ? 's' : ''}` : ''}.`,
+      ...result,
+    })
+  }
+
   public async policyPromptState({ response }: HttpContext) {
     const result = await this.ragService.getPolicyPromptState()
     return response.status(200).json(result)
diff --git a/admin/app/jobs/embed_file_job.ts b/admin/app/jobs/embed_file_job.ts
index 93f58a9..ba52ca8 100644
--- a/admin/app/jobs/embed_file_job.ts
+++ b/admin/app/jobs/embed_file_job.ts
@@ -164,6 +164,22 @@ export class EmbedFileJob {
           await new Promise((resolve) => setTimeout(resolve, EmbedFileJob.CPU_BATCH_DELAY_MS))
         }
 
+        // Bail before re-populating the queue if this job was cancelled mid-batch.
+        // cancelAllJobs() obliterates the queue (including this active job), but a
+        // worker already inside handle() would otherwise dispatch its continuation
+        // afterwards and silently revive a cancelled ZIM ingestion. If our own job
+        // key is gone, the cancel happened — skip the dispatch. Mirrors the
+        // "tolerate external removal" handling in safeUpdateProgress above.
+        const stillQueued = await QueueService.getInstance()
+          .getQueue(EmbedFileJob.queue)
+          .getJob(job.id!)
+        if (!stillQueued) {
+          logger.info(
+            `[EmbedFileJob] Job ${fileName} was cancelled; skipping continuation dispatch`
+          )
+          return { success: false, cancelled: true, fileName, filePath }
+        }
+
         // Dispatch next batch (not final yet). Carry forward the running
         // chunk count so the final batch can persist an accurate total (#933).
         const chunksSoFarNext = (job.data.chunksSoFar || 0) + (result.chunks || 0)
@@ -443,6 +459,46 @@ export class EmbedFileJob {
     return { cleaned, filesDeleted }
   }
 
+  /** Unconditionally clear every embedding job regardless of state.
+   *
+   *  cleanupFailedJobs only removes jobs explicitly tagged status === 'failed',
+   *  which leaves stuck jobs (waiting / active / delayed / paused that never
+   *  reached 'failed') unreachable from the UI — the operator's only recourse was
+   *  flushing Redis by hand. This wipes the whole queue, including a locked active
+   *  job, via obliterate({ force: true }) (plain obliterate/job.remove throw on a
+   *  locked job). It touches only Redis, so it is safe while Qdrant/Ollama are
+   *  offline — which is exactly when jobs pile up and wedge. */
+  static async cancelAllJobs(): Promise<{ cancelled: number; filesDeleted: number }> {
+    const queueService = QueueService.getInstance()
+    const queue = queueService.getQueue(this.queue)
+    const jobs = await queue.getJobs(['waiting', 'active', 'delayed', 'paused', 'failed'])
+
+    let filesDeleted = 0
+    for (const job of jobs) {
+      const filePath = (job.data as EmbedFileJobParams).filePath
+      // Same guard as cleanupFailedJobs: only delete user uploads, never ZIM
+      // library files or Nomad docs that live outside the uploads path.
+      if (filePath && filePath.includes(RagService.UPLOADS_STORAGE_PATH)) {
+        try {
+          await fs.unlink(filePath)
+          filesDeleted++
+        } catch {
+          // File may already be deleted — that's fine
+        }
+      }
+    }
+
+    const cancelled = jobs.length
+
+    // force: true removes the locked/active job too. An in-flight worker may keep
+    // running its current batch in memory; the self-exists guard in handle()
+    // prevents it from dispatching a continuation back into the cleared queue.
+    await queue.obliterate({ force: true })
+
+    logger.info(`[EmbedFileJob] Cancelled ${cancelled} jobs, deleted ${filesDeleted} files`)
+    return { cancelled, filesDeleted }
+  }
+
   static async getStatus(filePath: string): Promise<{
     exists: boolean
     status?: string
diff --git a/admin/inertia/components/chat/KnowledgeBaseModal.tsx b/admin/inertia/components/chat/KnowledgeBaseModal.tsx
index e9efbcf..cd47d04 100644
--- a/admin/inertia/components/chat/KnowledgeBaseModal.tsx
+++ b/admin/inertia/components/chat/KnowledgeBaseModal.tsx
@@ -262,6 +262,20 @@ export default function KnowledgeBaseModal({ aiAssistantName = "AI Assistant", o
     },
   })
 
+  const cancelAllMutation = useMutation({
+    mutationFn: () => api.cancelAllEmbedJobs(),
+    onSuccess: (data) => {
+      addNotification({ type: 'success', message: data?.message || 'All embedding jobs cancelled.' })
+      queryClient.invalidateQueries({ queryKey: ['embed-jobs'] })
+      queryClient.invalidateQueries({ queryKey: ['failedEmbedJobs'] })
+      queryClient.invalidateQueries({ queryKey: ['storedFiles'] })
+      queryClient.invalidateQueries({ queryKey: ['kbFileWarnings'] })
+    },
+    onError: (error: any) => {
+      addNotification({ type: 'error', message: error?.message || 'Failed to cancel jobs.' })
+    },
+  })
+
   const startQdrantMutation = useMutation({
     mutationFn: () => api.affectService(SERVICE_NAMES.QDRANT, 'start'),
     onSuccess: () => {
@@ -358,6 +372,31 @@ export default function KnowledgeBaseModal({ aiAssistantName = "AI Assistant", o
     }
   }
 
+  const handleConfirmCancelAll = () => {
+    openModal(
+      <StyledModal
+        title='Cancel All Embedding Jobs?'
+        onConfirm={() => {
+          cancelAllMutation.mutate()
+          closeModal('confirm-cancel-all-modal')
+        }}
+        onCancel={() => closeModal('confirm-cancel-all-modal')}
+        open={true}
+        confirmText='Cancel All Jobs'
+        cancelText='Keep Jobs'
+        confirmVariant='danger'
+      >
+        <p className='text-text-primary'>
+          This stops <strong>every</strong> embedding job — including ones still in progress or
+          stuck — and clears the processing queue. The uploaded source files for those jobs are
+          deleted, so you'll need to re-upload anything you still want indexed. Stored files that
+          already finished embedding are not affected. Are you sure you want to proceed?
+        </p>
+      </StyledModal>,
+      'confirm-cancel-all-modal'
+    )
+  }
+
   const handleConfirmSync = () => {
     openModal(
       <StyledModal
@@ -533,18 +572,33 @@ export default function KnowledgeBaseModal({ aiAssistantName = "AI Assistant", o
           </div>
 
           <div className="my-8">
-            <div className="flex items-center justify-between mb-4">
+            <div className="flex items-center justify-between mb-4 gap-2 flex-wrap">
               <StyledSectionHeader title="Processing Queue" className="!mb-0" />
-              <StyledButton
-                variant="danger"
-                size="md"
-                icon="IconTrash"
-                onClick={() => cleanupFailedMutation.mutate()}
-                loading={cleanupFailedMutation.isPending}
-                disabled={cleanupFailedMutation.isPending || qdrantOffline}
-              >
-                Clean Up Failed
-              </StyledButton>
+              <div className="flex items-center gap-2 flex-wrap">
+                <StyledButton
+                  variant="danger"
+                  size="md"
+                  icon="IconTrash"
+                  onClick={() => cleanupFailedMutation.mutate()}
+                  loading={cleanupFailedMutation.isPending}
+                  disabled={cleanupFailedMutation.isPending || qdrantOffline}
+                >
+                  Clean Up Failed
+                </StyledButton>
+                {/* Not gated on qdrantOffline: clearing stuck jobs must work during
+                    a Qdrant/Ollama outage, which is exactly when they wedge. */}
+                <StyledButton
+                  variant="danger"
+                  size="md"
+                  icon="IconPlayerStop"
+                  onClick={handleConfirmCancelAll}
+                  loading={cancelAllMutation.isPending}
+                  disabled={cancelAllMutation.isPending}
+                  title="Stop and clear every embedding job regardless of state, including stuck or in-progress ones. Deletes the uploaded source files for those jobs."
+                >
+                  Cancel All Jobs
+                </StyledButton>
+              </div>
             </div>
             <ActiveEmbedJobs withHeader={false} />
           </div>
diff --git a/admin/inertia/lib/api.ts b/admin/inertia/lib/api.ts
index f15138b..9782e9e 100644
--- a/admin/inertia/lib/api.ts
+++ b/admin/inertia/lib/api.ts
@@ -479,6 +479,13 @@ class API {
     })()
   }
 
+  async cancelAllEmbedJobs(): Promise<{ message: string; cancelled: number; filesDeleted: number } | undefined> {
+    return catchInternal(async () => {
+      const response = await this.client.delete<{ message: string; cancelled: number; filesDeleted: number }>('/rag/jobs')
+      return response.data
+    })()
+  }
+
   async checkRAGHealth() {
     return catchInternal(async () => {
       const response = await this.client.get<{ online: boolean; message?: string }>('/rag/health')
diff --git a/admin/start/routes.ts b/admin/start/routes.ts
index 6c19135..ca068cc 100644
--- a/admin/start/routes.ts
+++ b/admin/start/routes.ts
@@ -153,6 +153,7 @@ router
     router.get('/active-jobs', [RagController, 'getActiveJobs'])
     router.get('/failed-jobs', [RagController, 'getFailedJobs'])
     router.delete('/failed-jobs', [RagController, 'cleanupFailedJobs'])
+    router.delete('/jobs', [RagController, 'cancelAllJobs'])
     router.get('/job-status', [RagController, 'getJobStatus'])
     router.post('/sync', [RagController, 'scanAndSync'])
     router.post('/re-embed-all', [RagController, 'reembedAll'])

From 5af27e990462d695f42c50233490a2681044b007 Mon Sep 17 00:00:00 2001
From: Jake Turner <52841588+jakeaturner@users.noreply.github.com>
Date: Mon, 22 Jun 2026 21:20:37 -0700
Subject: [PATCH 71/83] fix(supply-depot): ensure all curated images pinned to
 specific versions (#1033)

---
 admin/database/seeders/service_seeder.ts | 42 +++++-------------------
 1 file changed, 8 insertions(+), 34 deletions(-)

diff --git a/admin/database/seeders/service_seeder.ts b/admin/database/seeders/service_seeder.ts
index bf71539..4613cc2 100644
--- a/admin/database/seeders/service_seeder.ts
+++ b/admin/database/seeders/service_seeder.ts
@@ -213,7 +213,7 @@ export default class ServiceSeeder extends BaseSeeder {
       display_order: 20,
       description: 'Locally-hosted PDF manipulation tool — merge, split, compress, convert, and more',
       icon: 'IconFileDescription',
-      container_image: 'ghcr.io/stirling-tools/s-pdf:latest',
+      container_image: 'ghcr.io/stirling-tools/s-pdf:2.13.1',
       source_repo: 'https://github.com/Stirling-Tools/Stirling-PDF',
       container_command: null,
       container_config: JSON.stringify({
@@ -304,7 +304,7 @@ export default class ServiceSeeder extends BaseSeeder {
       display_order: 22,
       description: 'Web-based e-book reader and library manager for your Calibre collection',
       icon: 'IconBook',
-      container_image: 'lscr.io/linuxserver/calibre-web:latest',
+      container_image: 'linuxserver/calibre-web:0.6.26-ls386',
       source_repo: 'https://github.com/janeczku/calibre-web',
       container_command: null,
       container_config: JSON.stringify({
@@ -335,7 +335,7 @@ export default class ServiceSeeder extends BaseSeeder {
       display_order: 23,
       description: 'Collection of handy utilities for developers — UUID, hash, encoding, formatters, and more',
       icon: 'IconTool',
-      container_image: 'ghcr.io/corentinth/it-tools:latest',
+      container_image: 'ghcr.io/corentinth/it-tools:2024.10.22-7ca5933',
       source_repo: 'https://github.com/CorentinTh/it-tools',
       container_command: null,
       container_config: JSON.stringify({
@@ -360,7 +360,7 @@ export default class ServiceSeeder extends BaseSeeder {
       display_order: 24,
       description: 'Virtual whiteboard for sketching hand-drawn-style diagrams — works fully offline',
       icon: 'IconPencil',
-      container_image: 'excalidraw/excalidraw:latest',
+      container_image: 'excalidraw/excalidraw:sha-4bfc5bb',
       source_repo: 'https://github.com/excalidraw/excalidraw',
       container_command: null,
       container_config: JSON.stringify({
@@ -385,7 +385,7 @@ export default class ServiceSeeder extends BaseSeeder {
       display_order: 30,
       description: 'Browser-based client for managing Meshtastic mesh radio devices',
       icon: 'IconWifi',
-      container_image: 'ghcr.io/meshtastic/web:latest',
+      container_image: 'ghcr.io/meshtastic/web:2.7.1',
       source_repo: 'https://github.com/meshtastic/web',
       container_command: null,
       container_config: JSON.stringify({
@@ -404,32 +404,6 @@ export default class ServiceSeeder extends BaseSeeder {
       category: 'networking',
       depends_on: null,
     },
-    {
-      service_name: SERVICE_NAMES.MESHTASTICD,
-      friendly_name: 'Meshtastic Daemon',
-      powered_by: 'Meshtastic',
-      display_order: 31,
-      description: 'Software-defined Meshtastic node with REST API — connect devices and build mesh networks',
-      icon: 'IconBroadcast',
-      container_image: 'meshtastic/meshtasticd:latest',
-      source_repo: 'https://github.com/meshtastic/meshtasticd',
-      container_command: null,
-      container_config: JSON.stringify({
-        HostConfig: {
-          RestartPolicy: { Name: 'unless-stopped' },
-          PortBindings: { '4403/tcp': [{ HostPort: '8460' }] },
-          Binds: [`${ServiceSeeder.NOMAD_STORAGE_ABS_PATH}/meshtasticd:/root/.portduino`],
-        },
-        ExposedPorts: { '4403/tcp': {} },
-      }),
-      ui_location: '8460',
-      installed: false,
-      installation_status: 'idle',
-      is_dependency_service: false,
-      is_custom: false,
-      category: 'networking',
-      depends_on: null,
-    },
     {
       service_name: SERVICE_NAMES.MESHCORE_WEB,
       friendly_name: 'MeshCore Web',
@@ -477,7 +451,7 @@ export default class ServiceSeeder extends BaseSeeder {
       // Maintained fork. The original hay-kot/homebox was archived June 2024;
       // sysadminsmedia is the official continuation (drop-in: same 7745 port + /data volume,
       // migrates an existing DB forward, telemetry off by default).
-      container_image: 'ghcr.io/sysadminsmedia/homebox:latest',
+      container_image: 'ghcr.io/sysadminsmedia/homebox:0.26.2',
       source_repo: 'https://github.com/sysadminsmedia/homebox',
       container_command: null,
       container_config: JSON.stringify({
@@ -503,7 +477,7 @@ export default class ServiceSeeder extends BaseSeeder {
       display_order: 26,
       description: 'Lightweight Bitwarden-compatible password manager server — secure your credentials offline',
       icon: 'IconShieldLock',
-      container_image: 'vaultwarden/server:latest',
+      container_image: 'vaultwarden/server:1.36.0',
       source_repo: 'https://github.com/dani-garcia/vaultwarden',
       container_command: null,
       container_config: JSON.stringify({
@@ -538,7 +512,7 @@ export default class ServiceSeeder extends BaseSeeder {
       display_order: 27,
       description: 'Open-source media server — stream your video, music, and photo libraries',
       icon: 'IconMovie',
-      container_image: 'jellyfin/jellyfin:latest',
+      container_image: 'jellyfin/jellyfin:10.11.11',
       source_repo: 'https://github.com/jellyfin/jellyfin',
       container_command: null,
       container_config: JSON.stringify({

From 0143afe7cc1da710346aa51a8f76bdff30360761 Mon Sep 17 00:00:00 2001
From: Jake Turner <52841588+jakeaturner@users.noreply.github.com>
Date: Mon, 22 Jun 2026 21:41:00 -0700
Subject: [PATCH 72/83] fix(supply-depot): bump default Ollama and CyberChef
 image versions (#1036)

---
 admin/database/seeders/service_seeder.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/admin/database/seeders/service_seeder.ts b/admin/database/seeders/service_seeder.ts
index 4613cc2..77362b1 100644
--- a/admin/database/seeders/service_seeder.ts
+++ b/admin/database/seeders/service_seeder.ts
@@ -92,7 +92,7 @@ export default class ServiceSeeder extends BaseSeeder {
       display_order: 3,
       description: 'Local AI chat that runs entirely on your hardware - no internet required',
       icon: 'IconWand',
-      container_image: 'ollama/ollama:0.18.1',
+      container_image: 'ollama/ollama:0.24.0',
       source_repo: 'https://github.com/ollama/ollama',
       container_command: 'serve',
       container_config: JSON.stringify({
@@ -118,7 +118,7 @@ export default class ServiceSeeder extends BaseSeeder {
       display_order: 11,
       description: 'Swiss Army knife for data encoding, encryption, and analysis',
       icon: 'IconChefHat',
-      container_image: 'ghcr.io/gchq/cyberchef:10.22.1',
+      container_image: 'ghcr.io/gchq/cyberchef:10.24.0',
       source_repo: 'https://github.com/gchq/CyberChef',
       container_command: null,
       container_config: JSON.stringify({

From 9609edc281b2ff52140c60ca06da83246f734465 Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Tue, 23 Jun 2026 04:41:34 +0000
Subject: [PATCH 73/83] chore(docs): update release notes

---
 admin/docs/release-notes.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/admin/docs/release-notes.md b/admin/docs/release-notes.md
index fa6ee87..1b93104 100644
--- a/admin/docs/release-notes.md
+++ b/admin/docs/release-notes.md
@@ -14,6 +14,7 @@
 - **Content Manager — Rescan Library**: A new "Rescan Library" button rebuilds the Kiwix index from the ZIM files currently on disk, so files **sideloaded** outside NOMAD's download flow (USB stick, SSH, network share) can be served without dropping to a terminal. It reports how many new books were found and, in library mode, hot-reloads without a container restart. Thanks @chriscrosstalk for the contribution!
 - **Configuration — Redis database selection**: Added a `REDIS_DB` environment variable so operators can pick a Redis logical database (0–15) for the job queue and live-update transport. This prevents key collisions when a single Redis instance is shared across multiple stacks (common in homelabs). Defaults to db 0, preserving existing behavior. Thanks @johno10661 for the contribution!
 - **Advanced Settings — Internet Test URL**: Added a new Advanced Settings page with an option to override the default internet test "beacon" URL (more advanced settings to come). Previously, overriding this URL required an ENV variable change and container restart. The legacy ENV variable is still respected if you've set it. Thanks @jakeaturner for the contribution!
+- **RAG**: Embedding jobs can now be cancelled, allowing users to clear stuck jobs that haven't explicitly failed. Thanks @jakeaturner for the contribution!
 
 ### Bug Fixes
 - **Storage**: When the admin storage volume is relocated to another disk, child apps (Kiwix, Ollama, Qdrant, Flatnotes, Kolibri) now automatically follow to the new location instead of mounting the old, empty path. The host storage root is now derived from the admin's actual mount, with an explicit `NOMAD_STORAGE_PATH` override and clearer compose comments. Thanks @chriscrosstalk for the fix!
@@ -42,6 +43,8 @@
 - **Dependencies**: Bumped React and React DOM. Thanks @jakeaturner for the contribution!
 - **Dependencies**: Bumped autoprefixer. Thanks @jakeaturner for the contribution!
 - **Dependencies**: Bumped BullMQ to 5.77.6 and updated affected job calls to the new arguments shape. Thanks @jakeaturner for the contribution!
+- **Supply Depot**: Pinned all curated image versions to ensure consistent baseline deployments. Thanks @jakeaturner for the contribution!
+- **Supply Depot**: Bumped the default versions of CyberChef to 10.24.0 and Ollama to 0.24.0. Thanks @jakeaturner for the contribution!
 
 ## Version 1.32.1 - May 27, 2026
 

From 76ce7253406cf94714e68c3adbc7e58f4e8bf3c6 Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Sat, 20 Jun 2026 04:58:30 +0000
Subject: [PATCH 74/83] chore(release): set version to 1.33.0-rc.1

---
 package-lock.json | 4 ++--
 package.json      | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index c124b33..2fdbcef 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "project-nomad",
-  "version": "1.32.0-rc.6",
+  "version": "1.33.0-rc.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "project-nomad",
-      "version": "1.32.0-rc.6",
+      "version": "1.33.0-rc.1",
       "license": "Apache-2.0"
     }
   }
diff --git a/package.json b/package.json
index c9cc0d7..baecd35 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "project-nomad",
-  "version": "1.39.0",
+  "version": "1.33.0-rc.1",
   "description": "Project N.O.M.A.D. (Node for Offline Media, Archives, and Data) - an offline-first knowledge and education server.",
   "main": "index.js",
   "scripts": {

From d8cca183f9461866a972429869bd487958508ce9 Mon Sep 17 00:00:00 2001
From: cosmistack-bot <dev@cosmistack.com>
Date: Tue, 23 Jun 2026 04:48:59 +0000
Subject: [PATCH 75/83] chore(release): 1.33.0 [skip ci]

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index baecd35..80ab61b 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "project-nomad",
-  "version": "1.33.0-rc.1",
+  "version": "1.33.0",
   "description": "Project N.O.M.A.D. (Node for Offline Media, Archives, and Data) - an offline-first knowledge and education server.",
   "main": "index.js",
   "scripts": {

From c9a86790de1028a42b7344a97b51fbced83ca4c5 Mon Sep 17 00:00:00 2001
From: cosmistack-bot <dev@cosmistack.com>
Date: Tue, 23 Jun 2026 04:49:49 +0000
Subject: [PATCH 76/83] docs(release): finalize v1.33.0 release notes [skip ci]

---
 admin/docs/release-notes.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/admin/docs/release-notes.md b/admin/docs/release-notes.md
index 1b93104..540bd66 100644
--- a/admin/docs/release-notes.md
+++ b/admin/docs/release-notes.md
@@ -1,6 +1,6 @@
 # Release Notes
 
-## Unreleased
+## Version 1.33.0 - June 23, 2026
 
 ### Features
 - **Supply Depot — Custom Apps**: The Supply Depot is NOMAD's new home for installable apps, and it now lets you run your *own* custom Docker containers — not just the curated catalog. Specify an image, port mappings, volume binds, environment variables, and memory/CPU limits, and NOMAD spins it up as a managed sibling container. A live, debounced pre-flight check warns about port conflicts and resource limits as you type and hard-blocks unsafe configurations, with an "install anyway" override for warning-only cases (e.g. an untrusted registry or a `:latest` tag). Installed custom apps can be edited, updated (re-pull latest + recreate with a safe rollback if the new container fails), and removed (optionally deleting the image), and every installed app — curated or custom — gets per-container **Logs** and **Stats** modals. Host-path binds are hardened against escapes and logs/stats are scoped to NOMAD-managed containers only. Thanks @jakeaturner for the contribution!

From f4af81ef02d9c7529f812e8701c2275aaa776d50 Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Tue, 23 Jun 2026 17:40:10 +0000
Subject: [PATCH 77/83] fix: lazy-connect + retry for ioredis to avoid blocked
 startup

---
 admin/config/queue.ts | 19 +++++++++++++++++++
 install/entrypoint.sh | 23 +++++++++++++++++++++++
 2 files changed, 42 insertions(+)

diff --git a/admin/config/queue.ts b/admin/config/queue.ts
index 3c6a112..5b33d1e 100644
--- a/admin/config/queue.ts
+++ b/admin/config/queue.ts
@@ -1,4 +1,5 @@
 import env from '#start/env'
+import logger from '@adonisjs/core/services/logger'
 import { Redis } from 'ioredis'
 
 // BullMQ treats a plain `{host, port}` connection object as a recipe: every
@@ -14,6 +15,24 @@ const sharedConnection = new Redis({
   port: env.get('REDIS_PORT') ?? 6379,
   db: env.get('REDIS_DB') ?? 0,
   maxRetriesPerRequest: null,
+  // Don't open the socket at module import time. Importing this file (during
+  // `node ace migration:run`, `db:seed`, `queue:work`, or HTTP boot) otherwise
+  // races Docker's network/DNS lifecycle: on a fresh `up` the `redis` name is
+  // not yet resolvable (EAI_AGAIN), and on a recreate the embedded DNS briefly
+  // serves the previous container's IP (ECONNREFUSED to the stale address).
+  // Lazy-connecting defers the first dial until BullMQ actually needs Redis —
+  // after the entrypoint has confirmed it is reachable — so each (re)connect
+  // re-resolves the current IP instead of hammering a stale one.
+  lazyConnect: true,
+  // Bounded, backing-off retry so a transient outage doesn't busy-loop.
+  retryStrategy: (times) => Math.min(times * 200, 2000),
+})
+
+// Without an `error` listener ioredis logs the raw "[ioredis] Unhandled error
+// event" lines and, on some Node versions, an EventEmitter `error` with no
+// listener can crash the process. Route them through the app logger instead.
+sharedConnection.on('error', (err) => {
+  logger.error({ err }, 'Shared Redis connection error')
 })
 
 const queueConfig = {
diff --git a/install/entrypoint.sh b/install/entrypoint.sh
index 4361903..7375e71 100644
--- a/install/entrypoint.sh
+++ b/install/entrypoint.sh
@@ -7,6 +7,29 @@ echo "Starting entrypoint script..."
 # Ensure required storage directories exist (volume may be freshly mounted)
 mkdir -p /app/storage/logs /app/storage/kb_uploads
 
+# Wait for Redis to be reachable before booting anything that opens a BullMQ
+# connection. `depends_on: condition: service_healthy` only gates a clean
+# `up --recreate`; it is NOT re-checked on `docker compose restart` or a
+# `restart: unless-stopped` bounce, so without this the app can race Docker's
+# DNS (EAI_AGAIN) or dial a restarted Redis container's stale IP (ECONNREFUSED).
+# This isn't load-bearing since legacy installs used a mounted entrypoint script
+# that may override this script, but it's a cost-nothing check for newer installs.
+# The real check is done by the application itself, but this provides a safety net.
+REDIS_HOST="${REDIS_HOST:-redis}"
+REDIS_PORT="${REDIS_PORT:-6379}"
+echo "Waiting for Redis at ${REDIS_HOST}:${REDIS_PORT}..."
+for i in $(seq 1 60); do
+  if node -e "const net=require('net');const s=net.connect(Number(process.env.REDIS_PORT||6379),process.env.REDIS_HOST||'redis');s.on('connect',()=>{s.end();process.exit(0)});s.on('error',()=>process.exit(1));" 2>/dev/null; then
+    echo "Redis is up and running!"
+    break
+  fi
+  if [ "$i" -eq 60 ]; then
+    echo "Timed out waiting for Redis at ${REDIS_HOST}:${REDIS_PORT}" >&2
+    exit 1
+  fi
+  sleep 1
+done
+
 # Run AdonisJS migrations
 echo "Running AdonisJS migrations..."
 node ace migration:run --force

From 0ee5dda5344dd9a4baf5388a28d51b2245c9435c Mon Sep 17 00:00:00 2001
From: cosmistack-bot <dev@cosmistack.com>
Date: Tue, 23 Jun 2026 17:41:25 +0000
Subject: [PATCH 78/83] chore(release): 1.33.1 [skip ci]

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 80ab61b..4acf1f6 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "project-nomad",
-  "version": "1.33.0",
+  "version": "1.33.1",
   "description": "Project N.O.M.A.D. (Node for Offline Media, Archives, and Data) - an offline-first knowledge and education server.",
   "main": "index.js",
   "scripts": {

From e82a2934c75d9336eef4d0b7adc43b03a25ec15b Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Tue, 23 Jun 2026 17:49:17 +0000
Subject: [PATCH 79/83] Revert "chore(release): 1.33.1 [skip ci]"

This reverts commit 0ee5dda5344dd9a4baf5388a28d51b2245c9435c.
---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 4acf1f6..80ab61b 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "project-nomad",
-  "version": "1.33.1",
+  "version": "1.33.0",
   "description": "Project N.O.M.A.D. (Node for Offline Media, Archives, and Data) - an offline-first knowledge and education server.",
   "main": "index.js",
   "scripts": {

From 587600ba7802b693924e569d1a4fc8420a48546c Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Tue, 23 Jun 2026 17:49:36 +0000
Subject: [PATCH 80/83] Revert "docs(release): finalize v1.33.0 release notes
 [skip ci]"

This reverts commit c9a86790de1028a42b7344a97b51fbced83ca4c5.
---
 admin/docs/release-notes.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/admin/docs/release-notes.md b/admin/docs/release-notes.md
index 540bd66..1b93104 100644
--- a/admin/docs/release-notes.md
+++ b/admin/docs/release-notes.md
@@ -1,6 +1,6 @@
 # Release Notes
 
-## Version 1.33.0 - June 23, 2026
+## Unreleased
 
 ### Features
 - **Supply Depot — Custom Apps**: The Supply Depot is NOMAD's new home for installable apps, and it now lets you run your *own* custom Docker containers — not just the curated catalog. Specify an image, port mappings, volume binds, environment variables, and memory/CPU limits, and NOMAD spins it up as a managed sibling container. A live, debounced pre-flight check warns about port conflicts and resource limits as you type and hard-blocks unsafe configurations, with an "install anyway" override for warning-only cases (e.g. an untrusted registry or a `:latest` tag). Installed custom apps can be edited, updated (re-pull latest + recreate with a safe rollback if the new container fails), and removed (optionally deleting the image), and every installed app — curated or custom — gets per-container **Logs** and **Stats** modals. Host-path binds are hardened against escapes and logs/stats are scoped to NOMAD-managed containers only. Thanks @jakeaturner for the contribution!

From c794d5e4b0bd3f9473a7fa599b016bcad3d9f94c Mon Sep 17 00:00:00 2001
From: jakeaturner <jturner@cosmistack.com>
Date: Tue, 23 Jun 2026 17:49:54 +0000
Subject: [PATCH 81/83] Revert "chore(release): 1.33.0 [skip ci]"

This reverts commit d8cca183f9461866a972429869bd487958508ce9.
---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 80ab61b..baecd35 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "project-nomad",
-  "version": "1.33.0",
+  "version": "1.33.0-rc.1",
   "description": "Project N.O.M.A.D. (Node for Offline Media, Archives, and Data) - an offline-first knowledge and education server.",
   "main": "index.js",
   "scripts": {

From cf294bf90833c3a85c54c5bf31918195aabfad03 Mon Sep 17 00:00:00 2001
From: cosmistack-bot <dev@cosmistack.com>
Date: Tue, 23 Jun 2026 17:51:38 +0000
Subject: [PATCH 82/83] chore(release): 1.33.0 [skip ci]

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index baecd35..80ab61b 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "project-nomad",
-  "version": "1.33.0-rc.1",
+  "version": "1.33.0",
   "description": "Project N.O.M.A.D. (Node for Offline Media, Archives, and Data) - an offline-first knowledge and education server.",
   "main": "index.js",
   "scripts": {

From 6a4f02dd4626c64f38ac07e4740bc250ba13fea1 Mon Sep 17 00:00:00 2001
From: cosmistack-bot <dev@cosmistack.com>
Date: Tue, 23 Jun 2026 17:52:28 +0000
Subject: [PATCH 83/83] docs(release): finalize v1.33.0 release notes [skip ci]

---
 admin/docs/release-notes.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/admin/docs/release-notes.md b/admin/docs/release-notes.md
index 1b93104..540bd66 100644
--- a/admin/docs/release-notes.md
+++ b/admin/docs/release-notes.md
@@ -1,6 +1,6 @@
 # Release Notes
 
-## Unreleased
+## Version 1.33.0 - June 23, 2026
 
 ### Features
 - **Supply Depot — Custom Apps**: The Supply Depot is NOMAD's new home for installable apps, and it now lets you run your *own* custom Docker containers — not just the curated catalog. Specify an image, port mappings, volume binds, environment variables, and memory/CPU limits, and NOMAD spins it up as a managed sibling container. A live, debounced pre-flight check warns about port conflicts and resource limits as you type and hard-blocks unsafe configurations, with an "install anyway" override for warning-only cases (e.g. an untrusted registry or a `:latest` tag). Installed custom apps can be edited, updated (re-pull latest + recreate with a safe rollback if the new container fails), and removed (optionally deleting the image), and every installed app — curated or custom — gets per-container **Logs** and **Stats** modals. Host-path binds are hardened against escapes and logs/stats are scoped to NOMAD-managed containers only. Thanks @jakeaturner for the contribution!