@or3/cloud 0.1.106 → 0.1.112

package/assets/Caddyfile

@@ -3,15 +3,40 @@
 	# site handler runs, so Strict-Transport-Security is only ever emitted on
 	# HTTPS responses (it is meaningless on plain HTTP).
 	header {
+		# Apply after upstream headers to avoid duplicate security-policy values.
+		defer
 		Strict-Transport-Security "max-age=31536000"
 		X-Content-Type-Options "nosniff"
-		X-Frame-Options "DENY"
 		Referrer-Policy "strict-origin-when-cross-origin"
 		Permissions-Policy "camera=(), microphone=(), geolocation=()"
+	}
+
+	# Only the two host-owned bridge documents can be embedded. Ordinary app
+	# pages still deny every ancestor, including same-origin frames.
+	@hostDocument {
+		not path /or3/portable-frame /streamsaver/mitm.html
+	}
+	header @hostDocument {
+		defer
+		X-Frame-Options "DENY"
 		# Nuxt needs same-origin scripts plus inline hydration styles/scripts. The
 		# browser exchanges OpenRouter PKCE authorization codes directly with the
 		# OpenRouter API, so that origin must remain available to connect-src.
-		Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' https://openrouter.ai; media-src 'self' blob:; worker-src 'self' blob:; frame-src 'none'; upgrade-insecure-requests"
+		Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' https://openrouter.ai; media-src 'self' blob:; worker-src 'self' blob:; frame-src 'self'; upgrade-insecure-requests"
+	}
+
+	# Preserve the portable route's hash-authorized, opaque-origin sandbox CSP.
+	# Applying the app policy here would block its worker or weaken containment.
+	@portableFrame path /or3/portable-frame
+	header @portableFrame >X-Frame-Options "SAMEORIGIN"
+
+	# The fallback streaming exporter uses this bundled same-origin bridge to
+	# register its download service worker; it cannot use an opaque origin.
+	@downloadBridge path /streamsaver/mitm.html
+	header @downloadBridge {
+		defer
+		X-Frame-Options "SAMEORIGIN"
+		Content-Security-Policy "default-src 'none'; script-src 'unsafe-inline'; connect-src 'self'; worker-src 'self'; frame-ancestors 'self'; base-uri 'none'; form-action 'none'"
 	}
 
 	encode zstd gzip

package/assets/compose.yaml

@@ -71,9 +71,9 @@ services:
         - CMD-SHELL
         - >-
           if [ -x /nodejs/bin/node ]; then
-            exec /nodejs/bin/node -e "const fs=require('node:fs');try{fs.accessSync('/data',fs.constants.R_OK|fs.constants.W_OK);for(const p of [process.env.OR3_BASIC_AUTH_DB_PATH,process.env.OR3_SQLITE_DB_PATH].filter(Boolean)){const fd=fs.openSync(p,'r+');fs.closeSync(fd)}}catch{process.exit(1)}fetch('http://127.0.0.1:3000/api/health?deep=true').then(async r=>{const b=await r.json().catch(()=>({}));if(!r.ok||b.status!=='ok')process.exit(1)}).catch(()=>process.exit(1))";
+            exec /nodejs/bin/node -e "const fs=require('node:fs');try{const a=process.env.AUTH_PROVIDER||process.env.OR3_AUTH_PROVIDER||'basic-auth',s=process.env.NUXT_PUBLIC_STORAGE_PROVIDER||'fs',q=process.env.OR3_SYNC_PROVIDER||'sqlite';if(q!=='sqlite'||!(a==='basic-auth'&&s==='fs'||a==='clerk'&&s==='s3')||process.env.AUTH_PROVIDER&&process.env.OR3_AUTH_PROVIDER&&process.env.AUTH_PROVIDER!==process.env.OR3_AUTH_PROVIDER)throw Error('profile');fs.accessSync('/data',fs.constants.R_OK|fs.constants.W_OK);const paths=a==='basic-auth'?[process.env.OR3_BASIC_AUTH_DB_PATH,process.env.OR3_SQLITE_DB_PATH]:[process.env.OR3_SQLITE_DB_PATH];if(paths.some(p=>!p))throw Error('database path');for(const p of paths){const fd=fs.openSync(p,'r+');fs.closeSync(fd)}}catch{process.exit(1)}fetch('http://127.0.0.1:3000/api/health?deep=true').then(async r=>{const b=await r.json().catch(()=>({}));if(!r.ok||b.status!=='ok'||b.providers?.auth?.provider!==(process.env.AUTH_PROVIDER||process.env.OR3_AUTH_PROVIDER||'basic-auth')||b.providers?.sync?.provider!=='sqlite'||b.providers?.storage?.provider!==(process.env.NUXT_PUBLIC_STORAGE_PROVIDER||'fs'))process.exit(1)}).catch(()=>process.exit(1))";
           elif [ -x /usr/local/bin/node ]; then
-            exec /usr/local/bin/node -e "const fs=require('node:fs');try{fs.accessSync('/data',fs.constants.R_OK|fs.constants.W_OK);for(const p of [process.env.OR3_BASIC_AUTH_DB_PATH,process.env.OR3_SQLITE_DB_PATH].filter(Boolean)){const fd=fs.openSync(p,'r+');fs.closeSync(fd)}}catch{process.exit(1)}fetch('http://127.0.0.1:3000/api/health?deep=true').then(async r=>{const b=await r.json().catch(()=>({}));if(!r.ok||b.status!=='ok')process.exit(1)}).catch(()=>process.exit(1))";
+            exec /usr/local/bin/node -e "const fs=require('node:fs');try{const a=process.env.AUTH_PROVIDER||process.env.OR3_AUTH_PROVIDER||'basic-auth',s=process.env.NUXT_PUBLIC_STORAGE_PROVIDER||'fs',q=process.env.OR3_SYNC_PROVIDER||'sqlite';if(q!=='sqlite'||!(a==='basic-auth'&&s==='fs'||a==='clerk'&&s==='s3')||process.env.AUTH_PROVIDER&&process.env.OR3_AUTH_PROVIDER&&process.env.AUTH_PROVIDER!==process.env.OR3_AUTH_PROVIDER)throw Error('profile');fs.accessSync('/data',fs.constants.R_OK|fs.constants.W_OK);const paths=a==='basic-auth'?[process.env.OR3_BASIC_AUTH_DB_PATH,process.env.OR3_SQLITE_DB_PATH]:[process.env.OR3_SQLITE_DB_PATH];if(paths.some(p=>!p))throw Error('database path');for(const p of paths){const fd=fs.openSync(p,'r+');fs.closeSync(fd)}}catch{process.exit(1)}fetch('http://127.0.0.1:3000/api/health?deep=true').then(async r=>{const b=await r.json().catch(()=>({}));if(!r.ok||b.status!=='ok'||b.providers?.auth?.provider!==(process.env.AUTH_PROVIDER||process.env.OR3_AUTH_PROVIDER||'basic-auth')||b.providers?.sync?.provider!=='sqlite'||b.providers?.storage?.provider!==(process.env.NUXT_PUBLIC_STORAGE_PROVIDER||'fs'))process.exit(1)}).catch(()=>process.exit(1))";
           else exit 127; fi
       interval: 10s
       timeout: 5s

package/assets/dashboard-lifecycle.mjs

@@ -20354,6 +20354,8 @@ async function writeEnvFileDetailed(updates, options = {}) {
 
 // ../../shared/admin/configuration.ts
 var siteSettingPaths = {
+  OR3_STORAGE_CAPACITY_WARNING_PERCENT: ["storageCapacityWarningPercent"],
+  OR3_STORAGE_CAPACITY_CRITICAL_PERCENT: ["storageCapacityCriticalPercent"],
   OR3_CHAT_TOOL_ITERATIONS: ["chatToolIterations"],
   OR3_CHAT_GENERATED_IMAGES: ["chatGeneratedImages"],
   OR3_SITE_NAME: ["or3", "site", "name"],
@@ -20558,9 +20560,23 @@ function quote(value) {
   return `'${value.replaceAll("'", "'\\''")}'`;
 }
 function redact(text, secrets = []) {
-  let output2 = text;
-  for (const secret of secrets.filter(Boolean))
-    output2 = output2.replaceAll(secret, "[REDACTED]");
+  const mask = new Uint8Array(text.length);
+  for (const secret of secrets.filter(Boolean)) {
+    for (let index = text.indexOf(secret);index !== -1; index = text.indexOf(secret, index + 1))
+      mask.fill(1, index, index + secret.length);
+  }
+  let output2 = "", cursor = 0;
+  for (let index = 0;index < mask.length; ) {
+    if (!mask[index]) {
+      index += 1;
+      continue;
+    }
+    output2 += `${text.slice(cursor, index)}[REDACTED]`;
+    while (index < mask.length && mask[index])
+      index += 1;
+    cursor = index;
+  }
+  output2 += text.slice(cursor);
   output2 = output2.replace(/((?:PASSWORD|SECRET|TOKEN|JWT)\s*[=:]\s*)(?!\[REDACTED\])([^\r\n]+)/gi, "$1[REDACTED]");
   return output2;
 }
@@ -20817,10 +20833,128 @@ var SECRET_KEYS = [
   "OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD",
   "OR3_AUTH_INVITE_TOKEN_SECRET",
   "OR3_STORAGE_FS_TOKEN_SECRET",
+  "OR3_STORAGE_S3_ACCESS_KEY_ID",
+  "OR3_STORAGE_S3_SECRET_ACCESS_KEY",
+  "OR3_STORAGE_S3_SESSION_TOKEN",
+  "NUXT_CLERK_SECRET_KEY",
+  "NUXT_AUTH_INVITE_TOKEN_SECRET",
+  "NUXT_ADMIN_AUTH_PASSWORD",
+  "NUXT_ADMIN_AUTH_JWT_SECRET",
+  "OR3_LIBRARY_LINK_SECRET",
+  "NUXT_ADMIN_LIBRARY_LINK_SECRET",
+  "OR3_PLUGIN_CONNECTION_SECRET",
+  "NUXT_ADMIN_PLUGIN_CONNECTION_SECRET",
+  "OR3_BACKGROUND_ENCRYPTION_KEY",
+  "NUXT_BACKGROUND_JOBS_ENCRYPTION_KEY",
+  "OR3_WEBHOOKS_ENCRYPTION_KEY",
+  "NUXT_WEBHOOKS_ENCRYPTION_KEY",
+  "OR3_CONNECT_ENCRYPTION_KEY",
+  "NUXT_CONNECT_ENCRYPTION_KEY",
+  "OR3_CONNECT_CLOUDFLARE_API_TOKEN",
+  "NUXT_CONNECT_CLOUDFLARE_API_TOKEN",
+  "OPENROUTER_API_KEY",
+  "NUXT_OPENROUTER_API_KEY",
+  "OR3_OPENAI_API_KEY",
+  "NUXT_OPENAI_API_KEY",
+  "OR3_BILLING_STRIPE_SECRET_KEY",
+  "OR3_BILLING_STRIPE_WEBHOOK_SECRET",
+  "CONVEX_SELF_HOSTED_ADMIN_KEY",
+  "CONVEX_DEPLOY_KEY",
   "OR3_ADMIN_JWT_SECRET",
   "OR3_ADMIN_PASSWORD"
 ];
+function managedProviderProfile(env) {
+  const auth = env.AUTH_PROVIDER ?? env.OR3_AUTH_PROVIDER ?? "basic-auth";
+  const sync = env.OR3_SYNC_PROVIDER ?? "sqlite";
+  const storage = env.NUXT_PUBLIC_STORAGE_PROVIDER ?? "fs";
+  if (env.AUTH_PROVIDER && env.OR3_AUTH_PROVIDER && env.AUTH_PROVIDER !== env.OR3_AUTH_PROVIDER || sync !== "sqlite") {
+    throw new Error("backup-profile-mismatch: unsupported or inconsistent managed provider profile.");
+  }
+  if (auth === "basic-auth" && storage === "fs")
+    return "basic-sqlite-fs";
+  if (auth === "clerk" && storage === "s3")
+    return "clerk-sqlite-s3";
+  throw new Error("backup-profile-mismatch: unsupported managed provider profile.");
+}
+function assertLegacyManagedProfile(env) {
+  const overrides = {
+    SSR_AUTH_ENABLED: "true",
+    OR3_SYNC_ENABLED: "true",
+    OR3_CLOUD_SYNC_ENABLED: "true",
+    OR3_STORAGE_ENABLED: "true",
+    OR3_CLOUD_STORAGE_ENABLED: "true",
+    OR3_SQLITE_DRIVER: "better-sqlite3",
+    OR3_STORAGE_PROVIDER: "fs",
+    NUXT_AUTH_ENABLED: "true",
+    NUXT_AUTH_PROVIDER: "basic-auth",
+    NUXT_PUBLIC_AUTH_PROVIDER: "basic-auth",
+    NUXT_PUBLIC_SSR_AUTH_ENABLED: "true",
+    NUXT_SYNC_ENABLED: "true",
+    NUXT_PUBLIC_SYNC_ENABLED: "true",
+    NUXT_SYNC_PROVIDER: "sqlite",
+    NUXT_PUBLIC_SYNC_PROVIDER: "sqlite",
+    NUXT_STORAGE_ENABLED: "true",
+    NUXT_PUBLIC_STORAGE_ENABLED: "true",
+    NUXT_STORAGE_PROVIDER: "fs"
+  };
+  const ambiguous = /^(?:RUNTIME_CONFIG$|NUXT_(?:AUTH|SYNC|STORAGE|PUBLIC)$|NITRO_ENV_(?:PREFIX|EXPANSION)$|NITRO_(?:AUTH|SYNC|STORAGE|PUBLIC)(?:_|$))/;
+  if (managedProviderProfile(env) !== "basic-sqlite-fs" || Object.entries(overrides).some(([key, expected]) => env[key] !== undefined && env[key] !== expected) || Object.keys(env).some((key) => ambiguous.test(key))) {
+    throw new Error("Legacy managed state supports only the Basic/SQLite/filesystem profile; provider conversion requires a separate qualified deployment.");
+  }
+}
+var ADOPTION_SECRET_KEYS = [
+  "OR3_BASIC_AUTH_JWT_SECRET",
+  "OR3_BASIC_AUTH_REFRESH_SECRET",
+  "OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD",
+  "OR3_AUTH_INVITE_TOKEN_SECRET",
+  "OR3_STORAGE_FS_TOKEN_SECRET",
+  "OR3_ADMIN_PASSWORD",
+  "OR3_ADMIN_JWT_SECRET",
+  "NUXT_AUTH_INVITE_TOKEN_SECRET",
+  "NUXT_ADMIN_AUTH_JWT_SECRET",
+  "OR3_LIBRARY_LINK_SECRET",
+  "NUXT_ADMIN_LIBRARY_LINK_SECRET",
+  "OR3_PLUGIN_CONNECTION_SECRET",
+  "NUXT_ADMIN_PLUGIN_CONNECTION_SECRET",
+  "OR3_BACKGROUND_ENCRYPTION_KEY",
+  "NUXT_BACKGROUND_JOBS_ENCRYPTION_KEY",
+  "OR3_WEBHOOKS_ENCRYPTION_KEY",
+  "NUXT_WEBHOOKS_ENCRYPTION_KEY",
+  "OR3_CONNECT_ENCRYPTION_KEY",
+  "NUXT_CONNECT_ENCRYPTION_KEY",
+  "OR3_CONNECT_CLOUDFLARE_API_TOKEN",
+  "NUXT_CONNECT_CLOUDFLARE_API_TOKEN",
+  "OPENROUTER_API_KEY",
+  "NUXT_OPENROUTER_API_KEY",
+  "OR3_OPENAI_API_KEY",
+  "NUXT_OPENAI_API_KEY"
+];
+var ADOPTION_RUNTIME_KEYS = [
+  "OR3_MARKETPLACE_REGISTRY_ORIGIN",
+  "OR3_MARKETPLACE_INSTALL_ENABLED",
+  "OR3_MARKETPLACE_RELEASE_KEYS",
+  "OR3_INSTANCE_ID",
+  "OR3_MARKETPLACE_MAX_ARTIFACT_BYTES",
+  "OR3_MARKETPLACE_RESERVE_BYTES",
+  "OR3_BACKGROUND_STREAMING_ENABLED",
+  "OR3_BACKGROUND_STREAMING_PROVIDER",
+  "OR3_BACKGROUND_MAX_JOBS",
+  "OR3_BACKGROUND_MAX_JOBS_PER_USER",
+  "OR3_BACKGROUND_JOB_TIMEOUT",
+  "NUXT_BACKGROUND_JOBS_ENABLED",
+  "NUXT_PUBLIC_BACKGROUND_STREAMING_ENABLED",
+  "NUXT_BACKGROUND_JOBS_STORAGE_PROVIDER",
+  "NUXT_BACKGROUND_JOBS_MAX_CONCURRENT_JOBS",
+  "NUXT_BACKGROUND_JOBS_MAX_CONCURRENT_JOBS_PER_USER",
+  "NUXT_BACKGROUND_JOBS_JOB_TIMEOUT_MS",
+  "OR3_PLUGIN_ALLOWED_MODELS",
+  "OR3_PLUGIN_MODEL_PRICES",
+  "NUXT_ADMIN_PLUGIN_ALLOWED_MODELS",
+  "NUXT_ADMIN_PLUGIN_MODEL_PRICES"
+];
 var ALLOWED_ENV_KEYS = new Set([
+  ...ADOPTION_SECRET_KEYS,
+  ...ADOPTION_RUNTIME_KEYS,
   "SSR_AUTH_ENABLED",
   "NUXT_SECRETS_PROVIDER",
   "NUXT_SECRETS_NAMESPACE",
@@ -20837,6 +20971,7 @@ var ALLOWED_ENV_KEYS = new Set([
   "OR3_BASIC_AUTH_REFRESH_SECRET",
   "OR3_BASIC_AUTH_ACCESS_TTL_SECONDS",
   "OR3_BASIC_AUTH_REFRESH_TTL_SECONDS",
+  "OR3_SQLITE_DRIVER",
   "OR3_BASIC_AUTH_DB_PATH",
   "OR3_BASIC_AUTH_BOOTSTRAP_EMAIL",
   "OR3_BASIC_AUTH_BOOTSTRAP_PASSWORD",
@@ -20853,6 +20988,8 @@ var ALLOWED_ENV_KEYS = new Set([
   "OR3_CLOUD_STORAGE_ENABLED",
   "NUXT_PUBLIC_STORAGE_PROVIDER",
   "OR3_STORAGE_FS_ROOT",
+  "OR3_STORAGE_FS_CLEANUP_NAMESPACE_ID",
+  "OR3_STORAGE_RETENTION_WORKSPACES",
   "OR3_STORAGE_FS_TOKEN_SECRET",
   "OR3_STORAGE_FS_URL_TTL_SECONDS",
   "OR3_ADMIN_USERNAME",
@@ -20893,7 +21030,9 @@ function dashboardUpdatesEnabled(directory) {
   }
 }
 function secretValues(env) {
-  return SECRET_KEYS.map((key) => env[key]).filter((value) => Boolean(value));
+  const known = new Set(SECRET_KEYS);
+  const secretName = /(?:^|_)(?:PASSWORD|SECRET|TOKEN|PRIVATE_KEY|API_KEY|ACCESS_KEY|AUTH_KEY)(?:_|$)/i;
+  return Object.entries(env).filter(([key, value]) => Boolean(value) && (known.has(key) || secretName.test(key))).map(([, value]) => value);
 }
 
 // src/deployment/state-store.ts
@@ -20955,6 +21094,7 @@ import { dirname as dirname6, join as join8 } from "node:path";
 var execFile = promisify(execFileCallback);
 var COMMAND_TIMEOUT_MS = 180000;
 var STREAM_COMMAND_TIMEOUT_MS = 15 * 60000;
+var MAX_STREAM_COMMAND_TIMEOUT_MS = 4 * 60 * 60000;
 var PROCESS_ENV_PASSTHROUGH = [
   "PATH",
   "HOME",
@@ -21161,6 +21301,41 @@ async function resolvedComposeConfig(directory, mode, deadline = performance.now
 ${result.stderr}`);
   return result.stdout;
 }
+async function assertLegacyComposeProfile(directory, mode, env, deadline) {
+  assertLegacyManagedProfile(env);
+  let resolved2;
+  try {
+    resolved2 = await resolvedComposeConfig(directory, mode, deadline);
+  } catch (error62) {
+    throw new Error(redact(error62 instanceof Error ? error62.message : String(error62), secretValues(env)));
+  }
+  let service;
+  try {
+    service = parseComposeConfig(resolved2).services?.or3;
+  } catch {
+    throw new Error("Resolved Compose provider configuration is unreadable.");
+  }
+  if (!service || !service.environment || typeof service.environment !== "object")
+    throw new Error("Resolved Compose provider environment is missing.");
+  const entries = Array.isArray(service.environment) ? service.environment.map((entry) => {
+    if (typeof entry !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*=/.test(entry))
+      throw new Error("Resolved Compose provider environment is ambiguous.");
+    const index = entry.indexOf("=");
+    return [entry.slice(0, index), entry.slice(index + 1)];
+  }) : Object.entries(service.environment);
+  const effective = {};
+  const seen = new Set;
+  for (const [key, value] of entries) {
+    if (typeof key !== "string" || typeof value !== "string" || seen.has(key))
+      throw new Error("Resolved Compose provider environment is ambiguous.");
+    seen.add(key);
+    effective[key] = value;
+  }
+  assertLegacyManagedProfile(effective);
+  if ((effective.OR3_AUTH_PROVIDER || effective.AUTH_PROVIDER) !== "basic-auth" || effective.SSR_AUTH_ENABLED !== "true" || (effective.OR3_CLOUD_SYNC_ENABLED || effective.OR3_SYNC_ENABLED) !== "true" || effective.OR3_SYNC_PROVIDER !== "sqlite" || (effective.OR3_CLOUD_STORAGE_ENABLED || effective.OR3_STORAGE_ENABLED) !== "true" || (effective.OR3_STORAGE_PROVIDER || effective.NUXT_PUBLIC_STORAGE_PROVIDER) !== "fs") {
+    throw new Error("Resolved Compose provider profile is missing required Basic/SQLite/filesystem settings.");
+  }
+}
 async function assertSafeComposeBinding(directory, mode, env, deadline) {
   const config2 = await resolvedComposeConfig(directory, mode, deadline);
   const parsed = parseComposeConfig(config2);
@@ -21234,7 +21409,7 @@ async function assertRunningAppImage(directory, mode, expectedImage, deadline =
 
 // src/runtime/health.ts
 var DEEP_HEALTH_TIMEOUT_MS = 180000;
-var HEALTH_SCRIPT = "const fs=require('node:fs');try{fs.accessSync('/data',fs.constants.R_OK|fs.constants.W_OK);for(const path of [process.env.OR3_BASIC_AUTH_DB_PATH,process.env.OR3_SQLITE_DB_PATH].filter(Boolean)){const fd=fs.openSync(path,'r+');fs.closeSync(fd)}}catch{process.exit(1)}fetch('http://127.0.0.1:3000/api/health?deep=true').then(async response=>{const body=await response.json().catch(()=>({}));if(!response.ok||body.status!=='ok')process.exit(1)}).catch(()=>process.exit(1))";
+var HEALTH_SCRIPT = "const fs=require('node:fs');try{const auth=process.env.AUTH_PROVIDER||process.env.OR3_AUTH_PROVIDER||'basic-auth',storage=process.env.NUXT_PUBLIC_STORAGE_PROVIDER||'fs',sync=process.env.OR3_SYNC_PROVIDER||'sqlite';if(sync!=='sqlite'||!(auth==='basic-auth'&&storage==='fs'||auth==='clerk'&&storage==='s3')||process.env.AUTH_PROVIDER&&process.env.OR3_AUTH_PROVIDER&&process.env.AUTH_PROVIDER!==process.env.OR3_AUTH_PROVIDER)throw Error('profile');fs.accessSync('/data',fs.constants.R_OK|fs.constants.W_OK);const paths=auth==='basic-auth'?[process.env.OR3_BASIC_AUTH_DB_PATH,process.env.OR3_SQLITE_DB_PATH]:[process.env.OR3_SQLITE_DB_PATH];if(paths.some(p=>!p))throw Error('database path');for(const path of paths){const fd=fs.openSync(path,'r+');fs.closeSync(fd)}}catch{process.exit(1)}fetch('http://127.0.0.1:3000/api/health?deep=true').then(async response=>{const body=await response.json().catch(()=>({}));if(!response.ok||body.status!=='ok'||body.providers?.auth?.provider!==(process.env.AUTH_PROVIDER||process.env.OR3_AUTH_PROVIDER||'basic-auth')||body.providers?.sync?.provider!=='sqlite'||body.providers?.storage?.provider!==(process.env.NUXT_PUBLIC_STORAGE_PROVIDER||'fs'))process.exit(1)}).catch(()=>process.exit(1))";
 var CONTAINER_NODE = "/nodejs/bin/node";
 var LEGACY_CONTAINER_NODE = "/usr/local/bin/node";
 var CONTAINER_NODE_SHELL = `if [ -x ${CONTAINER_NODE} ]; then exec ${CONTAINER_NODE} -e "$1"; elif [ -x ${LEGACY_CONTAINER_NODE} ]; then exec ${LEGACY_CONTAINER_NODE} -e "$1"; else exit 127; fi`;
@@ -21290,6 +21465,8 @@ async function restartCommand(directory, lifecycle) {
   const loaded = await loadManaged(directory);
   assertDeploymentDirectoryIdentity(directory, loaded.state);
   assertPhaseAllowsCommand("restart", loaded.state);
+  assertLegacyManagedProfile(loaded.env);
+  await assertLegacyComposeProfile(loaded.directory, loaded.state.mode, loaded.env, lifecycle?.deadline);
   if (lifecycle) {
     await assertSafeComposeBinding(directory, loaded.state.mode, loaded.env, lifecycle.deadline);
     await assertRunningAppImage(directory, loaded.state.mode, loaded.state.image, lifecycle.deadline);

package/assets/dashboard-operator.mjs

@@ -317,6 +317,22 @@ async function readLastReceipt() {
   }
 }
 
+/** Read-only allowlist: a recorded snapshot is not current checksum evidence. */
+export function projectRecoveryState(state) {
+  const safeId = value => typeof value === 'string' && /^[A-Za-z0-9_-]{1,100}$/.test(value) ? value : null;
+  const safeTime = value => typeof value === 'string' && value.length <= 64 && Number.isFinite(Date.parse(value)) ? value : null;
+  const snapshotId = safeId(state?.rollback?.backupId);
+  const pending = state?.incompleteOperation;
+  return {
+    observedAt: new Date().toISOString(), source: 'managed_operator',
+    snapshot: snapshotId ? { id: snapshotId, capturedAt: safeTime(state.rollback.createdAt), verification: 'operator_reported' } : null,
+    coverage: ['canonical', 'auth', 'files', 'configuration', 'billing_trials_support', 'credential_escrow', 'independent_copy'].map(component => ({ component, status: 'unknown', verifiedAt: null })),
+    lastRecoveryTestAt: null,
+    incompleteOperation: pending && safeId(pending.id) && ['init', 'update', 'restore', 'adopt', 'credentials-reset', 'backup', 'rollback'].includes(pending.operation)
+      ? { id: pending.id, operation: pending.operation, startedAt: safeTime(pending.startedAt) } : null,
+  };
+}
+
 async function status(includeReceipt = false) {
   const version = await currentVersion();
   const [job, checked] = await Promise.all([readJob(), readReleaseCheck()]);
@@ -992,6 +1008,7 @@ async function main() {
           if (await service.handle(service.controller, request, response)) return;
         } catch { return send(response, 503, { code: 'controller_unavailable' }); }
       }
+      if (request.method === 'GET' && request.url === '/v2/recovery') return send(response, 200, { protocolVersion: 2, recovery: projectRecoveryState(await managedState()) });
       if (request.method === 'GET' && route === '/status') return reply(200, await status(isV2));
       if (request.method === 'POST' && route === '/check') {
         if (!consumeRateLimit(checkAttempts, Date.now(), 30, 60_000)) {