@or3/cloud 0.1.66 → 0.1.68

package/README.md

@@ -47,10 +47,14 @@ Run these from the deployment directory created by `init`:
 ```sh
 npx @or3/cloud doctor
 npx @or3/cloud verify
+npx @or3/cloud verify --read-only
 npx @or3/cloud backup
+npx @or3/cloud backup list
+npx @or3/cloud update --dry-run
 npx @or3/cloud update
 npx @or3/cloud rollback --yes
 npx @or3/cloud recover
+npx @or3/cloud recover --dry-run
 npx @or3/cloud status
 npx @or3/cloud logs --tail 200
 npx @or3/cloud start
@@ -94,15 +98,87 @@ command holds one deployment-wide lease; do not delete `.or3-cloud` lock or
 recovery files by hand.
 Update recovery reads the authenticated pre-update snapshot recorded in
 `backupPath`/`backupId`; restore and rollback recovery use their separate
-`previousBackupPath`/`previousBackupId` snapshot. Recovery restores that snapshot,
-including its data and release assets, before clearing the pending operation.
-Legacy `adopt-source-*` directories are preserved outside managed backup
-retention and are not treated as authenticated restore points.
-Backups from releases before authentication tags existed are also preserved:
-`backup list` and retention skip `backup-*` entries with no `manifest.auth` and
-print a warning. They do not sign, migrate, or delete those archives. An existing
-but invalid tag remains an error; restore, recovery, and export still require
-valid deployment authentication.
+`previousBackupPath`/`previousBackupId` snapshot. Recovery now separates the
+two outcomes explicitly:
+
+- `npx @or3/cloud recover --dry-run` explains the observed source/target, phase,
+  available evidence, the permitted actions, and each action's data-loss
+  boundary without changing anything.
+- `npx @or3/cloud recover --finish` commits an existing live target only when
+  the recorded target-ready milestone is proven (replacement completed, exact
+  image, configuration and assets unchanged since the milestone, authenticated
+  rollback snapshot, deep health). It preserves writes made after replacement.
+- `npx @or3/cloud recover --restore --yes` is the explicit destructive choice;
+  it names the snapshot and discards writes made after it.
+
+Plain `npx @or3/cloud recover` finishes only proven non-destructive work and
+otherwise prints the assessment; it never silently falls back to a restore.
+`recover --finish` is idempotent — repeating it after completion reports the
+recorded outcome without replaying replacement or deleting the rollback point.
+While any incomplete operation is recorded, `start` and `restart` refuse rather
+than resurrect an ambiguous deployment; `stop` remains available, and
+diagnostics, logs, and read-only verification stay usable throughout.
+An update commits its terminal state (target identity, rollback reference,
+receipt, and the absence of a pending operation) in one atomic write **before**
+optional retention and operation-mirror cleanup. If that housekeeping fails,
+the update still reports complete with a maintenance warning, exits 0, and
+never recreates a pending operation or restores old data. A crash during the
+final write is resolved on retry from durable state, not guessed from health.
+The same rule covers restore, rollback, and recovery completion: a cleanup
+failure after a terminal commit is a warning and never reopens the operation.
+
+Once an update has started the target (the point at which it may accept
+writes), a failed health check is **not** restored automatically. The journal is
+preserved and the operator must choose `recover --finish` (when a proven
+target-ready milestone exists) or `recover --restore --yes` (the explicit
+data-loss choice). `recover --restore --yes` works even for a target-ready
+journal, so the advertised escape path is always available.
+
+This release is the compatibility **bridge**: it reads managed state schema 1
+and 2 but writes schema 1. A release explicitly qualified to write schema 2
+sets `or3Cloud.stateSchema` in its package metadata, and only then may migrate a
+settled schema-1 deployment — and only when its source is at or above the
+declared `dashboardUpdateMinimumSourceVersion` bridge. A bridge CLI refuses to
+mutate state written by a newer schema and directs the owner to the compatible
+exact-target CLI. An unknown future schema is refused before any mutation.
+
+`npx @or3/cloud status --json` emits a bounded public projection: it never
+serializes credential-reset recovery payloads, raw configuration, or secret
+values. Status reports the digest of the image actually running the `or3`
+service, and it still reports readable state when the managed `.env` is
+unreadable instead of failing through Compose. `logs`, `verify --read-only`, and
+`backup list` are observation-only. Read-only verification reports checks it
+deliberately skips (login/storage probes, SQLite inspection, log scanning) as
+`deferred`; only an actual failed check is nonzero.
+
+`update --dry-run` and the real `update` share one assessment: execution runs the
+same checks under the lease and refuses before any pull or data change when a
+blocker (including an unreadable required asset) is present. `backup prune`
+inventories the store once and revalidates only the entry it is about to delete,
+so large histories are not rehashed quadratically.
+
+With `--json`, `update` and `recover` write exactly one
+`or3-operation-result` object to stdout for every terminal path (success, no-op,
+blocked, or failure) and route all progress to stderr. Post-commit maintenance
+warnings (a failed mirror delete, deferred or failed retention, a failed handoff
+schedule) are persisted into the authoritative receipt, so a reload or the
+dashboard still sees them.
+`backup list` classifies every backup-store entry instead of skipping or
+aborting on the unusual ones: `verified`, `legacy-unsigned` (no
+`manifest.auth`), `legacy-adoption` (`adopt-source-*`), `unsupported` (a newer
+manifest schema), `invalid`, and `unreadable`. Only `verified` entries count as
+authenticated restore points; the rest are preserved and clearly labelled.
+`backup list --json` returns the same classification as one parseable object
+and still exits successfully when a store contains unsupported or damaged
+entries. `backup prune` protects the rollback point, the pending update
+snapshot, and every restore/rollback source; it defers automatic pruning when a
+suspect entry is present and reports a specific blocked result instead of
+deleting anything. `--force --yes` bypasses the suspect-entry deferral but can
+never remove a protected recovery source. Retention never signs, migrates, or
+deletes historical archives, and restore, recovery, and export still require
+valid deployment authentication. To obtain a trusted restore point from a
+store that only contains legacy history, create a new backup of the current
+healthy deployment.
 Backup artifacts are allocated in that journal before archiving, fully
 revalidated before success is reported, and safely removed by `recover` if a
 hard interruption leaves an incomplete artifact. A standalone backup and a

package/assets/Caddyfile

@@ -8,9 +8,10 @@
 		X-Frame-Options "DENY"
 		Referrer-Policy "strict-origin-when-cross-origin"
 		Permissions-Policy "camera=(), microphone=(), geolocation=()"
-		# Nuxt needs same-origin scripts plus inline hydration styles/scripts; the
-		# fixed Cloud profile has no browser-side third-party providers.
-		Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; media-src 'self' blob:; worker-src 'self' blob:; frame-src 'none'; upgrade-insecure-requests"
+		# Nuxt needs same-origin scripts plus inline hydration styles/scripts. The
+		# browser exchanges OpenRouter PKCE authorization codes directly with the
+		# OpenRouter API, so that origin must remain available to connect-src.
+		Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' https://openrouter.ai; media-src 'self' blob:; worker-src 'self' blob:; frame-src 'none'; upgrade-insecure-requests"
 	}
 
 	encode zstd gzip

package/assets/dashboard-operator.mjs

@@ -24,6 +24,13 @@ const expectedWorkflow = '.github/workflows/release-cloud.yml';
 const stableVersion = /^\d+\.\d+\.\d+$/;
 const requestIdPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const activePhases = new Set(['queued', 'running']);
+// Protocol 1 responses are retained verbatim for older app readers; protocol 2
+// is served from the versioned /v2/* routes. The operator accepts updater
+// packages declaring either protocol, so an old protocol-1 operator still
+// rejects a protocol-2 package and forces the documented bridge upgrade.
+const supportedDashboardUpdateProtocols = new Set([1, 2]);
+const currentProtocolVersion = 2;
+const supportedStateSchemas = new Set([1, 2]);
 const maxRegistryBytes = 256 * 1024;
 const maxAttestationBytes = 1024 * 1024;
 const maxProcessOutputBytes = 64 * 1024;
@@ -32,6 +39,7 @@ const operatorHandoffTimeoutMs = 2 * 60 * 1000;
 let updateClaimed = false;
 const checkAttempts = [];
 const startAttempts = [];
+const previewAttempts = [];
 let auditQueue = Promise.resolve();
 
 export function consumeRateLimit(attempts, now, limit, windowMs) {
@@ -239,7 +247,7 @@ async function release(requestedVersion) {
   if (
     metadata?.name !== packageName
     || !stableVersion.test(version)
-    || metadata?.or3Cloud?.dashboardUpdateProtocol !== 1
+    || !supportedDashboardUpdateProtocols.has(metadata?.or3Cloud?.dashboardUpdateProtocol)
     || typeof minimumSourceVersion !== 'string'
     || !stableVersion.test(minimumSourceVersion)
     || typeof operatorImageDigest !== 'string'
@@ -268,7 +276,9 @@ async function release(requestedVersion) {
 async function managedState() {
   try {
     const state = JSON.parse(await readFile(statePath, 'utf8'));
-    if (!state || typeof state !== 'object' || state.schemaVersion !== 1) throw new Error();
+    // Bridge/schema-2 readers observe both formats; a future schema is refused
+    // before any mutation instead of being misread as schema 1.
+    if (!state || typeof state !== 'object' || !supportedStateSchemas.has(state.schemaVersion)) throw new Error();
     return state;
   } catch {
     throw new Error('The managed deployment state is unavailable or invalid.');
@@ -283,7 +293,31 @@ async function assertUpdateReady() {
   return state;
 }
 
-async function status() {
+/**
+ * A completed application commit with an unfinished privileged handoff must
+ * not start another dashboard mutation. Release checks remain available so an
+ * operator can still observe the state and the guidance.
+ */
+async function assertHandoffReady() {
+  const state = await managedState();
+  const handoff = state.lastReceipt?.operatorHandoff;
+  if (handoff === 'pending' || handoff === 'needs-attention') {
+    throw new Error('The previous update finished, but its dashboard operator handoff needs reconciliation. Run `npx @or3/cloud recover --finish` on the host before starting another dashboard update.');
+  }
+}
+
+/** Bounded latest terminal receipt from the CLI, exposed only on protocol 2. */
+async function readLastReceipt() {
+  try {
+    const receipt = JSON.parse(await readFile(join(cloudDirectory, 'last-operation.json'), 'utf8'));
+    if (!receipt || typeof receipt !== 'object' || receipt.schemaVersion !== 1) return undefined;
+    return receipt;
+  } catch {
+    return undefined;
+  }
+}
+
+async function status(includeReceipt = false) {
   const version = await currentVersion();
   const [job, checked] = await Promise.all([readJob(), readReleaseCheck()]);
   return {
@@ -303,10 +337,11 @@ async function status() {
       completedAt: job.completedAt,
       error: job.error,
     } : null,
+    ...(includeReceipt ? { receipt: await readLastReceipt() } : {}),
   };
 }
 
-async function check() {
+async function check(includeReceipt = false) {
   await assertUpdateReady();
   const previous = await readReleaseCheck();
   const checkedAt = new Date().toISOString();
@@ -330,7 +365,7 @@ async function check() {
       updateAvailable: compareVersions(latest.version, current) > 0,
     };
     await writeReleaseCheck({ schemaVersion: 1, checkedAt, lastSuccessful });
-    return await status();
+    return await status(includeReceipt);
   } catch (error) {
     const message = (error instanceof Error ? error.message : String(error)).slice(0, 4096);
     const persisted = await readReleaseCheck().catch(() => previous);
@@ -372,6 +407,8 @@ function runProcess(file, args, options) {
   });
   return new Promise((resolve, reject) => {
     let output = '';
+    let stdout = '';
+    let stderr = '';
     let settled = false;
     const finish = (error, result) => {
       if (settled) return;
@@ -403,10 +440,12 @@ function runProcess(file, args, options) {
         finish(new Error('The updater command returned too much output.'));
       }
     };
+    child.stdout.on('data', (chunk) => { stdout += chunk.toString('utf8'); });
+    child.stderr.on('data', (chunk) => { stderr += chunk.toString('utf8'); });
     child.stdout.on('data', append);
     child.stderr.on('data', append);
     child.once('error', (error) => finish(error));
-    child.once('close', (code, signal) => finish(undefined, { code, signal, output }));
+    child.once('close', (code, signal) => finish(undefined, { code, signal, output, stdout, stderr }));
     const timer = options.timeoutMs
       ? setTimeout(() => {
           terminate();
@@ -503,7 +542,7 @@ async function verifyInstalledUpdater(installDirectory, expectedRelease, job, pr
     || manifest?.repository?.url !== 'git+https://github.com/Saluana/or3-chat.git'
     || manifest?.repository?.directory !== 'packages/or3-cloud'
     || manifest?.bin?.or3 !== './dist/cli.mjs'
-    || manifest?.or3Cloud?.dashboardUpdateProtocol !== 1
+    || !supportedDashboardUpdateProtocols.has(manifest?.or3Cloud?.dashboardUpdateProtocol)
     || !stableVersion.test(manifest?.or3Cloud?.dashboardUpdateMinimumSourceVersion || '')
     || !/^sha256:[0-9a-f]{64}$/.test(manifest?.or3Cloud?.imageDigest || '')
     || !/^sha256:[0-9a-f]{64}$/.test(manifest?.or3Cloud?.operatorImageDigest || '')
@@ -618,10 +657,134 @@ async function runRecovery(job) {
   });
 }
 
+/**
+ * Runs the exact verified updater in read-only preview mode and returns its
+ * parsed assessment. It only ever invokes the pinned CLI `update --dry-run`;
+ * no caller-provided command, package location, or extra argument is accepted.
+ */
+async function runPreview() {
+  const expectedRelease = await release();
+  return await withVerifiedUpdater(expectedRelease, { id: randomUUID() }, async (updater, installDirectory) => {
+    const previewed = await runProcess(nodeBinary, [updater.cli, 'update', '--to', expectedRelease.version, '--dry-run', '--json'], {
+      cwd: deploymentDirectory,
+      env: updaterEnvironment(installDirectory, { id: 'preview' }, updater.imageDigest),
+      maxOutputBytes: 512 * 1024,
+      timeoutMs: maxUpdateDurationMs,
+    });
+    // Exit 1 means the assessment reported blockers, which is still a valid result.
+    if (previewed.code !== 0 && previewed.code !== 1) {
+      throw new Error(`The update preview could not run: ${processDiagnostic(previewed)}`);
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(previewed.stdout);
+    } catch {
+      throw new Error('The update preview did not return a readable assessment.');
+    }
+    return { version: expectedRelease.version, assessment: parsed };
+  });
+}
+
 function closeAfter(server, code) {
   setTimeout(() => server.close(() => process.exit(code)), 250).unref();
 }
 
+const leasePath = join(cloudDirectory, 'operation-lease');
+
+/**
+ * Acquires the same single-writer deployment lease the CLI uses. Returns a
+ * release function, or undefined when another operation owns the lease.
+ */
+async function acquireDeploymentLease() {
+  await mkdir(dirname(leasePath), { recursive: true, mode: 0o700 });
+  const owner = {
+    schemaVersion: 1,
+    nonce: randomUUID(),
+    command: 'operator-handoff',
+    origin: 'cli',
+    pid: process.pid,
+    acquiredAt: new Date().toISOString(),
+    heartbeatAt: new Date().toISOString(),
+  };
+  try {
+    await mkdir(leasePath, { recursive: false, mode: 0o700 });
+  } catch (error) {
+    if (error && typeof error === 'object' && error.code === 'EEXIST') return undefined;
+    throw error;
+  }
+  try {
+    const ownerPath = join(leasePath, 'owner.json');
+    await writeFile(ownerPath, `${JSON.stringify(owner, null, 2)}\n`, { mode: 0o600 });
+    await chmod(ownerPath, 0o600);
+  } catch (error) {
+    await rm(leasePath, { recursive: true, force: true }).catch(() => undefined);
+    throw error;
+  }
+  return async () => {
+    await rm(leasePath, { recursive: true, force: true }).catch(() => undefined);
+  };
+}
+
+async function atomicWriteJson(path, value) {
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  await writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+  await chmod(temporary, 0o600);
+  await durableRename(temporary, path);
+}
+
+/**
+ * Marks the recorded terminal receipt's operator handoff verified once the
+ * successor operator is running. Runs under the deployment lease, reloads the
+ * authoritative state, and verifies the recorded operation/job identity before
+ * persisting; a concurrent CLI operation is never overwritten. Bounded and
+ * best-effort: a write failure must not roll back the healthy application.
+ */
+async function markHandoffVerified(jobId) {
+  let release;
+  try {
+    release = await acquireDeploymentLease();
+  } catch (error) {
+    console.error(`Could not acquire the deployment lease to record the operator handoff: ${error instanceof Error ? error.message : String(error)}`);
+    return;
+  }
+  if (!release) {
+    console.error('Could not mark the operator handoff verified: another operation owns the deployment lease. Run `npx @or3/cloud recover --finish` on the host to reconcile.');
+    return;
+  }
+  try {
+    let state;
+    try {
+      state = JSON.parse(await readFile(statePath, 'utf8'));
+    } catch {
+      return;
+    }
+    if (!state || typeof state !== 'object' || state.incompleteOperation) return;
+    const receipt = state.lastReceipt;
+    if (receipt && typeof receipt === 'object') {
+      if (receipt.operatorHandoff !== 'pending' && receipt.operatorHandoff !== 'needs-attention') return;
+      if (receipt.dashboardJobId && jobId && receipt.dashboardJobId !== jobId) return;
+      receipt.operatorHandoff = 'verified';
+      state.updatedAt = new Date().toISOString();
+      await atomicWriteJson(statePath, state);
+    }
+    const receiptPath = join(cloudDirectory, 'last-operation.json');
+    try {
+      const mirror = JSON.parse(await readFile(receiptPath, 'utf8'));
+      if (mirror && typeof mirror === 'object' && mirror.schemaVersion === 1) {
+        if (mirror.dashboardJobId && jobId && mirror.dashboardJobId !== jobId) return;
+        mirror.operatorHandoff = 'verified';
+        await atomicWriteJson(receiptPath, mirror);
+      }
+    } catch {
+      // The authoritative state write is sufficient; the mirror is convenience.
+    }
+  } catch (error) {
+    console.error(`Could not mark the operator handoff verified: ${error instanceof Error ? error.message : String(error)}`);
+  } finally {
+    await release();
+  }
+}
+
 async function completeOperatorHandoff(jobId, project) {
   if (!requestIdPattern.test(jobId || '') || !/^[a-z0-9][a-z0-9_-]*$/i.test(project || '')) {
     throw new Error('The dashboard operator handoff arguments are invalid.');
@@ -669,7 +832,10 @@ async function completeOperatorHandoff(jobId, project) {
             })
           : { code: restarted.code, output: '' };
         lastOutput = `${lastOutput}\n${restarted.output}\n${running.output}`.trim();
-        if (restarted.code === 0 && running.code === 0 && /^[0-9a-f]{12,64}$/i.test(running.output.trim())) return;
+        if (restarted.code === 0 && running.code === 0 && /^[0-9a-f]{12,64}$/i.test(running.output.trim())) {
+          await markHandoffVerified(jobId);
+          return;
+        }
         await delay(2_000);
       }
       throw new Error(`The dashboard operator handoff could not start its successor: ${lastOutput}`);
@@ -809,53 +975,60 @@ async function main() {
   await rm(socketPath, { force: true });
 
   const server = createServer(async (request, response) => {
+    // Protocol 2 is additive: the versioned routes are the same handlers with a
+    // protocolVersion field, while /status, /check, and /start remain byte-for-
+    // byte protocol-1 responses for existing exact-key app validators.
+    const isV2 = ['/v2/status', '/v2/check', '/v2/start', '/v2/preview'].includes(request.url);
+    const route = isV2 ? request.url.slice(3) : request.url;
+    const reply = (statusCode, payload) => send(response, statusCode, isV2 ? { protocolVersion: currentProtocolVersion, ...payload } : payload);
     try {
-      if (request.method === 'GET' && request.url === '/status') return send(response, 200, await status());
-      if (request.method === 'POST' && request.url === '/check') {
+      if (request.method === 'GET' && route === '/status') return reply(200, await status(isV2));
+      if (request.method === 'POST' && route === '/check') {
         if (!consumeRateLimit(checkAttempts, Date.now(), 30, 60_000)) {
           await audit('check_rate_limited');
-          return send(response, 429, { message: 'Release checks are temporarily rate limited.' });
+          return reply(429, { message: 'Release checks are temporarily rate limited.' });
         }
-        const checked = await check();
+        const checked = await check(isV2);
         await audit('release_checked', { latestVersion: checked.latestVersion, updateAvailable: checked.updateAvailable });
-        return send(response, 200, checked);
+        return reply(200, checked);
       }
-      if (request.method === 'POST' && request.url === '/start') {
+      if (request.method === 'POST' && route === '/start') {
         if (!consumeRateLimit(startAttempts, Date.now(), 6, 60_000)) {
           await audit('start_rate_limited');
-          return send(response, 429, { message: 'Update starts are temporarily rate limited.' });
+          return reply(429, { message: 'Update starts are temporarily rate limited.' });
         }
         const input = await body(request);
         if (!validStartInput(input)) {
           await audit('start_rejected_invalid');
-          return send(response, 400, { message: 'A valid update request is required.' });
+          return reply(400, { message: 'A valid update request is required.' });
         }
         if (updateClaimed) {
           await audit('start_rejected_busy', { requestId: input.requestId, targetVersion: input.targetVersion });
-          return send(response, 409, { message: 'An update is already starting or running.' });
+          return reply(409, { message: 'An update is already starting or running.' });
         }
         updateClaimed = true;
         try {
-          const checked = await check();
+          await assertHandoffReady();
+          const checked = await check(isV2);
           if (!checked.updateAvailable) {
             updateClaimed = false;
             await audit('start_rejected_no_update', { requestId: input.requestId, targetVersion: input.targetVersion });
-            return send(response, 409, { message: 'No newer supported release is available.' });
+            return reply(409, { message: 'No newer supported release is available.' });
           }
           if (input.targetVersion !== checked.latestVersion) {
             updateClaimed = false;
             await audit('start_rejected_stale_target', { requestId: input.requestId, targetVersion: input.targetVersion });
-            return send(response, 409, { message: 'The requested version is no longer the verified latest release. Check again.' });
+            return reply(409, { message: 'The requested version is no longer the verified latest release. Check again.' });
           }
           const previous = await readJob();
           if (previous && activePhases.has(previous.phase)) {
             updateClaimed = false;
             if (previous.id === input.requestId) {
               await audit('start_replayed', { jobId: previous.id, targetVersion: previous.targetVersion });
-              return send(response, 202, { ...checked, job: previous });
+              return reply(202, { ...checked, job: previous });
             }
             await audit('start_rejected_busy', { requestId: input.requestId, targetVersion: input.targetVersion });
-            return send(response, 409, { message: 'An update is already running.' });
+            return reply(409, { message: 'An update is already running.' });
           }
           const job = {
             id: input.requestId,
@@ -865,7 +1038,7 @@ async function main() {
           };
           await writeJob(job);
           await audit('update_accepted', { jobId: job.id, targetVersion: job.targetVersion });
-          send(response, 202, { ...checked, job });
+          reply(202, { ...checked, job });
           queueMicrotask(async () => {
             try {
               job.phase = 'running';
@@ -882,9 +1055,22 @@ async function main() {
           throw error;
         }
       }
-      send(response, 404, { message: 'Not found.' });
+      if (request.method === 'POST' && route === '/preview') {
+        if (!consumeRateLimit(previewAttempts, Date.now(), 10, 60_000)) {
+          await audit('preview_rate_limited');
+          return reply(429, { message: 'Update previews are temporarily rate limited.' });
+        }
+        if (updateClaimed) {
+          return reply(409, { message: 'An update is already starting or running.' });
+        }
+        const checked = await check(isV2);
+        const preview = await runPreview();
+        await audit('update_previewed', { latestVersion: checked.latestVersion });
+        return reply(200, { ...checked, preview });
+      }
+      reply(404, { message: 'Not found.' });
     } catch (error) {
-      send(response, 503, { message: error instanceof Error ? error.message : 'The update operator is unavailable.' });
+      reply(503, { message: error instanceof Error ? error.message : 'The update operator is unavailable.' });
     }
   });