@or3/cloud 0.1.63 → 0.1.65

package/README.md

@@ -58,6 +58,11 @@ npx @or3/cloud stop
 npx @or3/cloud restart
 ```
 
+The canonical procedure for both development and managed deployments is
+[Updating OR3](https://github.com/Saluana/or3-chat/blob/or3-cloud/docs/cloud-updates.md).
+This package is the managed path: it accepts only published stable releases and
+never a development image.
+
 Run `verify` after every update and before declaring a deployment healthy. It
 checks the managed image digest, deep provider health, Basic Auth sign-in,
 session hydration, SQLite sync, a disposable filesystem upload/download/delete
@@ -87,6 +92,12 @@ carry a deployment-local authentication tag, so an altered or foreign archive
 cannot supply configuration or executable Compose assets. Every mutating
 command holds one deployment-wide lease; do not delete `.or3-cloud` lock or
 recovery files by hand.
+Update recovery reads the authenticated pre-update snapshot recorded in
+`backupPath`/`backupId`; restore and rollback recovery use their separate
+`previousBackupPath`/`previousBackupId` snapshot. Recovery restores that snapshot,
+including its data and release assets, before clearing the pending operation.
+Legacy `adopt-source-*` directories are preserved outside managed backup
+retention and are not treated as authenticated restore points.
 Backup artifacts are allocated in that journal before archiving, fully
 revalidated before success is reported, and safely removed by `recover` if a
 hard interruption leaves an incomplete artifact. A standalone backup and a

package/dist/cli.mjs

@@ -11,6 +11,7 @@ import { createReadStream, createWriteStream, existsSync, readFileSync } from "n
 import {
   chmod,
   copyFile,
+  lstat,
   mkdir,
   open,
   readFile,
@@ -30,7 +31,7 @@ import { fileURLToPath } from "node:url";
 import { createGunzip } from "node:zlib";
 var execFile = promisify(execFileCallback);
 var PACKAGE_ROOT = resolve(fileURLToPath(new URL("../", import.meta.url)));
-var PACKAGE_VERSION = "0.1.63";
+var PACKAGE_VERSION = "0.1.65";
 var IMAGE_REPOSITORY = "ghcr.io/saluana/or3-chat";
 var ASSET_ROOT = resolve(fileURLToPath(new URL("../assets/", import.meta.url)));
 var STATE_SCHEMA_VERSION = 1;
@@ -1835,6 +1836,9 @@ async function enumerateBackups(directory) {
   }
   const result = [];
   for (const entry of entries) {
+    if (/^adopt-source-[0-9A-Za-z-]+$/.test(entry) && (await lstat(join(backupsRoot, entry))).isDirectory()) {
+      continue;
+    }
     if (!BACKUP_ID_PATTERN.test(entry)) {
       throw new Error(`Backup store contains an unexpected artifact ${join(backupsRoot, entry)}. Refusing to use it for retention; inspect or remove it explicitly.`);
     }
@@ -2996,7 +3000,15 @@ async function resolveBackup(directory, value) {
     throw new Error(`Backup ${value} was not found in ${deploymentPaths(directory).backups}.`);
   return resolve(candidate);
 }
-async function recordedBackupPath(directory, pending, previous = false) {
+function assertDashboardOperatorMounts(mounts, directory) {
+  const destinations = new Set(mounts.map((mount) => mount.Destination));
+  for (const destination of ["/var/run/docker.sock", resolve(directory), "/run/or3-operator"]) {
+    if (!destinations.has(destination))
+      throw new Error(`Dashboard operator is missing its required ${destination} mount.`);
+  }
+}
+async function recordedBackupPath(directory, pending) {
+  const previous = pending.operation !== "update";
   const path = previous ? pending.previousBackupPath : pending.backupPath;
   const backupId = previous ? pending.previousBackupId : pending.backupId;
   const resolved = path ? resolve(path) : backupId ? await resolveBackup(directory, backupId) : undefined;
@@ -3021,7 +3033,7 @@ async function restorePreMutationSnapshot(directory, state, env) {
   const pending = state.incompleteOperation;
   if (!pending)
     throw new Error("No incomplete operation is available to restore.");
-  const previous = await recordedBackupPath(directory, pending, true);
+  const previous = await recordedBackupPath(directory, pending);
   await updatePending(directory, state, { phase: "restoring-previous" });
   if (pending.recreateDataVolume) {
     await restoreBackupData(directory, state, env, previous.path, { recreateDataVolume: true });
@@ -3309,11 +3321,7 @@ async function doctorCommand(directory) {
           if (state.deploymentId && container.Config?.Labels?.["io.or3.cloud.deployment-id"] !== state.deploymentId) {
             throw new Error("Dashboard operator deployment identity does not match managed state.");
           }
-          const destinations = new Set(container.Mounts?.map((mount) => mount.Destination));
-          for (const destination of ["/var/run/docker.sock", "/deployment", "/run/or3-operator"]) {
-            if (!destinations.has(destination))
-              throw new Error(`Dashboard operator is missing its required ${destination} mount.`);
-          }
+          assertDashboardOperatorMounts(container.Mounts ?? [], resolved);
           const ipcDirectory = await stat(paths.operatorIpc);
           const operatorSocket = await stat(join(paths.operatorIpc, "operator.sock"));
           const operatorUid = Number(env.OR3_OPERATOR_UID);
@@ -4634,11 +4642,13 @@ export {
   restoreManagedAssets,
   requiredArchiveSpace,
   redact,
+  recordedBackupPath,
   purgeVolumesFromState,
   parseFlags,
   parseEnv,
   managedAssetNames,
   isVersion,
+  enumerateBackups,
   dashboardOperatorHandoffArgs,
   copyAssets,
   checkResolvedLoopbackBinding,
@@ -4652,6 +4662,7 @@ export {
   assertPurgeBackupFreshness,
   assertImageReleaseLabels,
   assertEnoughFreeSpace,
+  assertDashboardOperatorMounts,
   assertCommandPositionals,
   assertCommandFlags,
   assertBackupMatchesDeployment,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@or3/cloud",
-  "version": "0.1.63",
+  "version": "0.1.65",
   "description": "Install and operate the OR3 Cloud container distribution",
   "type": "module",
   "license": "GPL-3.0",
@@ -18,9 +18,9 @@
   "or3Cloud": {
     "dashboardUpdateProtocol": 1,
     "dashboardUpdateMinimumSourceVersion": "0.1.40",
-    "imageDigest": "sha256:5e2dd31369dfc365a5774d67effc4eb7a876a40a45aedeb20982a585652bd206",
-    "operatorImageDigest": "sha256:ab9d864b630b6e05db05e45041a25153b82b95e735f7a1579ff5edcfebbf84f8",
-    "sourceRevision": "a14ddda64808ec91056d9f003589bd5b04986edf"
+    "imageDigest": "sha256:cce2c2331419dbb2e2d0b17e0a7da0c9f3106b3c6dc30f680a6d9f145f0c6c6e",
+    "operatorImageDigest": "sha256:b8732a186a6bcfbd47f93333b7ed90991b20f4dd569ec08aec509e9f21ab6561",
+    "sourceRevision": "19b8889981b2f5f958c23679887a9a4bebd0f58c"
   },
   "files": [
     "dist",