@or3/cloud 0.1.64 → 0.1.66

package/README.md

@@ -92,6 +92,17 @@ carry a deployment-local authentication tag, so an altered or foreign archive
 cannot supply configuration or executable Compose assets. Every mutating
 command holds one deployment-wide lease; do not delete `.or3-cloud` lock or
 recovery files by hand.
+Update recovery reads the authenticated pre-update snapshot recorded in
+`backupPath`/`backupId`; restore and rollback recovery use their separate
+`previousBackupPath`/`previousBackupId` snapshot. Recovery restores that snapshot,
+including its data and release assets, before clearing the pending operation.
+Legacy `adopt-source-*` directories are preserved outside managed backup
+retention and are not treated as authenticated restore points.
+Backups from releases before authentication tags existed are also preserved:
+`backup list` and retention skip `backup-*` entries with no `manifest.auth` and
+print a warning. They do not sign, migrate, or delete those archives. An existing
+but invalid tag remains an error; restore, recovery, and export still require
+valid deployment authentication.
 Backup artifacts are allocated in that journal before archiving, fully
 revalidated before success is reported, and safely removed by `recover` if a
 hard interruption leaves an incomplete artifact. A standalone backup and a

package/dist/cli.mjs

@@ -11,6 +11,7 @@ import { createReadStream, createWriteStream, existsSync, readFileSync } from "n
 import {
   chmod,
   copyFile,
+  lstat,
   mkdir,
   open,
   readFile,
@@ -30,7 +31,7 @@ import { fileURLToPath } from "node:url";
 import { createGunzip } from "node:zlib";
 var execFile = promisify(execFileCallback);
 var PACKAGE_ROOT = resolve(fileURLToPath(new URL("../", import.meta.url)));
-var PACKAGE_VERSION = "0.1.64";
+var PACKAGE_VERSION = "0.1.66";
 var IMAGE_REPOSITORY = "ghcr.io/saluana/or3-chat";
 var ASSET_ROOT = resolve(fileURLToPath(new URL("../assets/", import.meta.url)));
 var STATE_SCHEMA_VERSION = 1;
@@ -1835,10 +1836,21 @@ async function enumerateBackups(directory) {
   }
   const result = [];
   for (const entry of entries) {
+    if (/^adopt-source-[0-9A-Za-z-]+$/.test(entry) && (await lstat(join(backupsRoot, entry))).isDirectory()) {
+      continue;
+    }
     if (!BACKUP_ID_PATTERN.test(entry)) {
       throw new Error(`Backup store contains an unexpected artifact ${join(backupsRoot, entry)}. Refusing to use it for retention; inspect or remove it explicitly.`);
     }
     const path = join(backupsRoot, entry);
+    try {
+      await lstat(join(path, "manifest.auth"));
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        throw error;
+      console.warn(`Preserving unauthenticated backup ${entry}: no manifest.auth; excluded from managed backup listing and retention.`);
+      continue;
+    }
     const manifest = await readManifest(path, directory);
     if (manifest.backupId !== entry) {
       throw new Error(`Backup directory ${path} does not match manifest ID ${manifest.backupId}. Refusing to use it for retention.`);
@@ -2742,7 +2754,7 @@ async function backupListCommand(directory) {
   const loaded = await loadManaged(directory);
   const backups = await enumerateBackups(loaded.directory);
   if (backups.length === 0) {
-    console.log(`No backups exist yet for ${loaded.directory}. Run "npx @or3/cloud backup" to create one.`);
+    console.log(`No authenticated backups are available for ${loaded.directory}. Run "npx @or3/cloud backup" to create one.`);
     return;
   }
   console.log(`OR3 Cloud backups for ${loaded.directory} (${backups.length}):`);
@@ -2996,7 +3008,15 @@ async function resolveBackup(directory, value) {
     throw new Error(`Backup ${value} was not found in ${deploymentPaths(directory).backups}.`);
   return resolve(candidate);
 }
-async function recordedBackupPath(directory, pending, previous = false) {
+function assertDashboardOperatorMounts(mounts, directory) {
+  const destinations = new Set(mounts.map((mount) => mount.Destination));
+  for (const destination of ["/var/run/docker.sock", resolve(directory), "/run/or3-operator"]) {
+    if (!destinations.has(destination))
+      throw new Error(`Dashboard operator is missing its required ${destination} mount.`);
+  }
+}
+async function recordedBackupPath(directory, pending) {
+  const previous = pending.operation !== "update";
   const path = previous ? pending.previousBackupPath : pending.backupPath;
   const backupId = previous ? pending.previousBackupId : pending.backupId;
   const resolved = path ? resolve(path) : backupId ? await resolveBackup(directory, backupId) : undefined;
@@ -3021,7 +3041,7 @@ async function restorePreMutationSnapshot(directory, state, env) {
   const pending = state.incompleteOperation;
   if (!pending)
     throw new Error("No incomplete operation is available to restore.");
-  const previous = await recordedBackupPath(directory, pending, true);
+  const previous = await recordedBackupPath(directory, pending);
   await updatePending(directory, state, { phase: "restoring-previous" });
   if (pending.recreateDataVolume) {
     await restoreBackupData(directory, state, env, previous.path, { recreateDataVolume: true });
@@ -3309,11 +3329,7 @@ async function doctorCommand(directory) {
           if (state.deploymentId && container.Config?.Labels?.["io.or3.cloud.deployment-id"] !== state.deploymentId) {
             throw new Error("Dashboard operator deployment identity does not match managed state.");
           }
-          const destinations = new Set(container.Mounts?.map((mount) => mount.Destination));
-          for (const destination of ["/var/run/docker.sock", "/deployment", "/run/or3-operator"]) {
-            if (!destinations.has(destination))
-              throw new Error(`Dashboard operator is missing its required ${destination} mount.`);
-          }
+          assertDashboardOperatorMounts(container.Mounts ?? [], resolved);
           const ipcDirectory = await stat(paths.operatorIpc);
           const operatorSocket = await stat(join(paths.operatorIpc, "operator.sock"));
           const operatorUid = Number(env.OR3_OPERATOR_UID);
@@ -4634,11 +4650,13 @@ export {
   restoreManagedAssets,
   requiredArchiveSpace,
   redact,
+  recordedBackupPath,
   purgeVolumesFromState,
   parseFlags,
   parseEnv,
   managedAssetNames,
   isVersion,
+  enumerateBackups,
   dashboardOperatorHandoffArgs,
   copyAssets,
   checkResolvedLoopbackBinding,
@@ -4652,6 +4670,7 @@ export {
   assertPurgeBackupFreshness,
   assertImageReleaseLabels,
   assertEnoughFreeSpace,
+  assertDashboardOperatorMounts,
   assertCommandPositionals,
   assertCommandFlags,
   assertBackupMatchesDeployment,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@or3/cloud",
-  "version": "0.1.64",
+  "version": "0.1.66",
   "description": "Install and operate the OR3 Cloud container distribution",
   "type": "module",
   "license": "GPL-3.0",
@@ -18,9 +18,9 @@
   "or3Cloud": {
     "dashboardUpdateProtocol": 1,
     "dashboardUpdateMinimumSourceVersion": "0.1.40",
-    "imageDigest": "sha256:c0899969a8a93c91b68933c898984d927e9af1db2f24d45c065d9a3d47336a28",
-    "operatorImageDigest": "sha256:cbbb6f3cbc51c07a98cace1deb0cca9784b0eaf7cbf727f739b44068d85aac90",
-    "sourceRevision": "e63d5aeae215de841d5e440730367918c2802575"
+    "imageDigest": "sha256:fbe393d371bcd2cfdcdd4e8295cbb61c6ec11bbedccf84b88042ff28b8155fb6",
+    "operatorImageDigest": "sha256:7eda3cab7508094bc51a43bb0c10924a806eb6127160cd6fccbd77a8fda99e7f",
+    "sourceRevision": "79691e3f6b14ac7555aba765aee794263583d503"
   },
   "files": [
     "dist",