libre-webui 0.21.3 → 0.22.0

package/backend/dist/cli/migrateSqliteToPostgres.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=migrateSqliteToPostgres.d.ts.map

package/backend/dist/cli/migrateSqliteToPostgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrateSqliteToPostgres.d.ts","sourceRoot":"","sources":["../../src/cli/migrateSqliteToPostgres.ts"],"names":[],"mappings":""}

package/backend/dist/cli/migrateSqliteToPostgres.js

@@ -0,0 +1,113 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ */
+import path from 'node:path';
+import { resolvePostgresRuntimeConfig } from '../persistence/postgresConfig.js';
+import { migrateSQLiteToPostgres, SQLiteToPostgresMigrationError, } from '../persistence/sqliteToPostgresMigration.js';
+import { createSQLiteToTeamStorageMigrationPhase } from '../platform/storage/sqliteToTeamStorageMigration.js';
+import { createStorageKeyringFromEnvironment, resolveLegacyEncryptionKeyForMigration, } from '../platform/storage/storageFactory.js';
+const usage = () => [
+    'Usage: libre-webui migrate-postgres --source <data.sqlite> [--plugins <directory>] --mode <dry-run|apply|validate> [--resume]',
+    'Source checkout: npm run migrate:postgres -- --source <data.sqlite> [--plugins <directory>] --mode <dry-run|apply|validate> [--resume]',
+    '',
+    'DATABASE_URL and PostgreSQL TLS/pool settings are read from the normal Libre environment.',
+    'Stop every Libre app and worker before apply. Credentials and local paths are never printed.',
+].join('\n');
+const parse = (argv) => {
+    let sourcePath = '';
+    let sourcePluginsPath;
+    let mode = 'dry-run';
+    let resume = false;
+    for (let index = 0; index < argv.length; index += 1) {
+        const argument = argv[index];
+        if (argument === '--source') {
+            sourcePath = argv[++index] ?? '';
+        }
+        else if (argument === '--plugins') {
+            sourcePluginsPath = argv[++index] ?? '';
+            if (!sourcePluginsPath)
+                throw new Error('--plugins requires a directory');
+        }
+        else if (argument === '--mode') {
+            const value = argv[++index];
+            if (value !== 'dry-run' && value !== 'apply' && value !== 'validate') {
+                throw new Error('Invalid migration mode');
+            }
+            mode = value;
+        }
+        else if (argument === '--resume') {
+            resume = true;
+        }
+        else if (argument === '--help' || argument === '-h') {
+            process.stdout.write(`${usage()}\n`);
+            process.exit(0);
+        }
+        else {
+            throw new Error('Unknown migration argument');
+        }
+    }
+    if (!sourcePath)
+        throw new Error('--source is required');
+    if (resume && mode !== 'apply') {
+        throw new Error('--resume is valid only with --mode apply');
+    }
+    return { sourcePath, sourcePluginsPath, mode, resume };
+};
+const main = async () => {
+    try {
+        const options = parse(process.argv.slice(2));
+        const postgres = resolvePostgresRuntimeConfig(process.env);
+        const sourceEnv = {
+            ...process.env,
+            DATA_DIR: path.dirname(path.resolve(options.sourcePath)),
+        };
+        const legacyKey = resolveLegacyEncryptionKeyForMigration(sourceEnv);
+        const keyedSourceEnv = { ...sourceEnv, ENCRYPTION_KEY: legacyKey };
+        const keyring = createStorageKeyringFromEnvironment(keyedSourceEnv);
+        const previousEncryptionKey = process.env.ENCRYPTION_KEY;
+        let cipher;
+        try {
+            // The encryption singleton is intentionally loaded only after selecting
+            // the source key. This prevents the maintenance command from generating
+            // or persisting a replacement key in another data directory.
+            process.env.ENCRYPTION_KEY = legacyKey;
+            ({ encryptionService: cipher } =
+                await import('../services/encryptionService.js'));
+        }
+        finally {
+            if (previousEncryptionKey === undefined) {
+                delete process.env.ENCRYPTION_KEY;
+            }
+            else {
+                process.env.ENCRYPTION_KEY = previousEncryptionKey;
+            }
+        }
+        const storagePhase = createSQLiteToTeamStorageMigrationPhase({
+            env: keyedSourceEnv,
+            keyring,
+            cipher,
+        });
+        const report = await migrateSQLiteToPostgres({
+            sourcePath: options.sourcePath,
+            sourcePluginsPath: options.sourcePluginsPath,
+            postgres,
+            mode: options.mode,
+            resume: options.resume,
+            storagePhase,
+        });
+        process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+        if (!report.compatible || report.blockers.length > 0)
+            process.exitCode = 2;
+    }
+    catch (error) {
+        if (error instanceof SQLiteToPostgresMigrationError && error.report) {
+            process.stdout.write(`${JSON.stringify(error.report, null, 2)}\n`);
+        }
+        process.stderr.write(`${error instanceof Error ? error.message : 'SQLite-to-PostgreSQL migration failed'}\n`);
+        process.exitCode = 1;
+    }
+};
+void main();
+//# sourceMappingURL=migrateSqliteToPostgres.js.map

package/backend/dist/cli/migrateSqliteToPostgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrateSqliteToPostgres.js","sourceRoot":"","sources":["../../src/cli/migrateSqliteToPostgres.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,EACL,uBAAuB,EACvB,8BAA8B,GAE/B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,qDAAqD,CAAC;AAC9G,OAAO,EACL,mCAAmC,EACnC,sCAAsC,GACvC,MAAM,uCAAuC,CAAC;AAS/C,MAAM,KAAK,GAAG,GAAW,EAAE,CACzB;IACE,+HAA+H;IAC/H,wIAAwI;IACxI,EAAE;IACF,2FAA2F;IAC3F,8FAA8F;CAC/F,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEf,MAAM,KAAK,GAAG,CAAC,IAAuB,EAAc,EAAE;IACpD,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,iBAAqC,CAAC;IAC1C,IAAI,IAAI,GAAkC,SAAS,CAAC;IACpD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,UAAU,GAAG,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QACnC,CAAC;aAAM,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YACpC,iBAAiB,GAAG,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,iBAAiB;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC5E,CAAC;aAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;YAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;gBACrE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5C,CAAC;YACD,IAAI,GAAG,KAAK,CAAC;QACf,CAAC;aAAM,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;aAAM,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACzD,IAAI,MAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACzD,CAAC,CAAC;AAEF,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;IACrC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,4BAA4B,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG;YAChB,GAAG,OAAO,CAAC,GAAG;YACd,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;SACzD,CAAC;QACF,MAAM,SAAS,GAAG,sCAAsC,CAAC,SAAS,CAAC,CAAC;QACpE,MAAM,cAAc,GAAG,EAAE,GAAG,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,mCAAmC,CAAC,cAAc,CAAC,CAAC;QACpE,MAAM,qBAAqB,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QACzD,IAAI,MAA2E,CAAC;QAChF,IAAI,CAAC;YACH,wEAAwE;YACxE,wEAAwE;YACxE,6DAA6D;YAC7D,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,SAAS,CAAC;YACvC,CAAC,EAAE,iBAAiB,EAAE,MAAM,EAAE;gBAC5B,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC,CAAC;QACtD,CAAC;gBAAS,CAAC;YACT,IAAI,qBAAqB,KAAK,SAAS,EAAE,CAAC;gBACxC,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,qBAAqB,CAAC;YACrD,CAAC;QACH,CAAC;QACD,MAAM,YAAY,GAAG,uCAAuC,CAAC;YAC3D,GAAG,EAAE,cAAc;YACnB,OAAO;YACP,MAAM;SACP,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC;YAC3C,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,QAAQ;YACR,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,YAAY;SACb,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,8BAA8B,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uCAAuC,IAAI,CACxF,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC;AAEF,KAAK,IAAI,EAAE,CAAC"}

package/backend/dist/cli/recoveryBackup.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=recoveryBackup.d.ts.map

package/backend/dist/cli/recoveryBackup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recoveryBackup.d.ts","sourceRoot":"","sources":["../../src/cli/recoveryBackup.ts"],"names":[],"mappings":""}

package/backend/dist/cli/recoveryBackup.js

@@ -0,0 +1,251 @@
+#!/usr/bin/env node
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ */
+import path from 'node:path';
+import { createBackupArchive, createTeamBackupArchive, generateBackupKeys, inspectBackupArchive, restoreBackupArchive, restoreTeamBackupArchive, verifyBackupArchive, verifyRestoredBackup, } from '../platform/recovery/index.js';
+import { resolveDataDirectory } from '../utils/dataDirectory.js';
+const usage = `Usage:
+  libre-webui backup keygen --directory PATH
+  libre-webui backup create --output FILE --encryption-key FILE --signing-private-key FILE --offline [--data-dir PATH]
+  libre-webui backup create-team --output FILE --encryption-key FILE --signing-private-key FILE --offline
+  libre-webui backup inspect --archive FILE
+  libre-webui backup verify --archive FILE --signing-public-key FILE [--encryption-key FILE]
+  libre-webui backup restore-preflight --archive FILE --target PATH --signing-public-key FILE --encryption-key FILE
+  libre-webui backup restore-apply --archive FILE --target PATH --signing-public-key FILE --encryption-key FILE
+  libre-webui backup restore-team-preflight --archive FILE --signing-public-key FILE --encryption-key FILE
+  libre-webui backup restore-team-apply --archive FILE --signing-public-key FILE --encryption-key FILE --configuration-output PATH
+  libre-webui backup restore-verify --target PATH
+
+From a source checkout, replace "libre-webui backup" with "npm run recovery:backup --".
+
+All JSON output is metadata-only. Secrets and user content are never printed.`;
+const parse = (argv) => {
+    const [command, ...rest] = argv;
+    if (!command || command.startsWith('-'))
+        throw new Error(usage);
+    const values = new Map();
+    const flags = new Set();
+    for (let index = 0; index < rest.length; index += 1) {
+        const item = rest[index];
+        if (!item.startsWith('--'))
+            throw new Error(`Unexpected argument: ${item}\n${usage}`);
+        if (item === '--offline') {
+            flags.add(item);
+            continue;
+        }
+        const value = rest[index + 1];
+        if (!value || value.startsWith('--'))
+            throw new Error(`Missing value for ${item}.\n${usage}`);
+        if (values.has(item))
+            throw new Error(`Duplicate option: ${item}`);
+        values.set(item, value);
+        index += 1;
+    }
+    return { command, values, flags };
+};
+const required = (parsed, name) => {
+    const value = parsed.values.get(name)?.trim();
+    if (!value)
+        throw new Error(`Missing ${name}.\n${usage}`);
+    return path.resolve(value);
+};
+const assertOnly = (parsed, valueNames, flagNames = []) => {
+    const allowedValues = new Set(valueNames);
+    const allowedFlags = new Set(flagNames);
+    for (const name of parsed.values.keys()) {
+        if (!allowedValues.has(name)) {
+            throw new Error(`Unexpected option for ${parsed.command}: ${name}\n${usage}`);
+        }
+    }
+    for (const name of parsed.flags) {
+        if (!allowedFlags.has(name)) {
+            throw new Error(`Unexpected flag for ${parsed.command}: ${name}\n${usage}`);
+        }
+    }
+};
+const print = (value) => {
+    process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
+};
+const main = async () => {
+    if (process.argv.length === 3 &&
+        ['--help', '-h'].includes(process.argv[2])) {
+        process.stdout.write(`${usage}\n`);
+        return;
+    }
+    const parsed = parse(process.argv.slice(2));
+    switch (parsed.command) {
+        case 'keygen': {
+            assertOnly(parsed, ['--directory']);
+            print(generateBackupKeys(required(parsed, '--directory')));
+            return;
+        }
+        case 'create': {
+            assertOnly(parsed, ['--output', '--encryption-key', '--signing-private-key', '--data-dir'], ['--offline']);
+            const verification = await createBackupArchive({
+                dataDir: parsed.values.has('--data-dir')
+                    ? required(parsed, '--data-dir')
+                    : resolveDataDirectory(),
+                outputPath: required(parsed, '--output'),
+                encryptionKeyPath: required(parsed, '--encryption-key'),
+                signingPrivateKeyPath: required(parsed, '--signing-private-key'),
+                offline: parsed.flags.has('--offline'),
+            });
+            print({
+                created: true,
+                backupId: verification.header.manifest.backupId,
+                createdAt: verification.header.manifest.createdAt,
+                files: verification.header.manifest.files.length,
+                bytes: verification.header.encryption.ciphertextBytes,
+                signatureVerified: verification.signatureVerified,
+                payloadVerified: verification.payloadVerified,
+            });
+            return;
+        }
+        case 'create-team': {
+            assertOnly(parsed, ['--output', '--encryption-key', '--signing-private-key'], ['--offline']);
+            const result = await createTeamBackupArchive({
+                outputPath: required(parsed, '--output'),
+                encryptionKeyPath: required(parsed, '--encryption-key'),
+                signingPrivateKeyPath: required(parsed, '--signing-private-key'),
+                offline: parsed.flags.has('--offline'),
+            });
+            print({
+                created: true,
+                profile: 'team',
+                backupId: result.verification.header.manifest.backupId,
+                createdAt: result.verification.header.manifest.createdAt,
+                files: result.verification.header.manifest.files.length,
+                bytes: result.verification.header.encryption.ciphertextBytes,
+                schemaVersion: result.inventory.schemaVersion,
+                blobObjects: result.inventory.s3.objects.length,
+                vectorRecords: result.inventory.vectors.records,
+                signatureVerified: result.verification.signatureVerified,
+                payloadVerified: result.verification.payloadVerified,
+            });
+            return;
+        }
+        case 'inspect': {
+            assertOnly(parsed, ['--archive']);
+            const header = inspectBackupArchive(required(parsed, '--archive'));
+            print({
+                manifest: header.manifest,
+                encryption: {
+                    algorithm: header.encryption.algorithm,
+                    ciphertextBytes: header.encryption.ciphertextBytes,
+                    ciphertextSha256: header.encryption.ciphertextSha256,
+                },
+                signature: {
+                    algorithm: header.signature.algorithm,
+                    signerFingerprint: header.signature.signerFingerprint,
+                },
+            });
+            return;
+        }
+        case 'verify': {
+            assertOnly(parsed, [
+                '--archive',
+                '--signing-public-key',
+                '--encryption-key',
+            ]);
+            const verification = verifyBackupArchive({
+                archivePath: required(parsed, '--archive'),
+                signingPublicKeyPath: required(parsed, '--signing-public-key'),
+                ...(parsed.values.has('--encryption-key')
+                    ? { encryptionKeyPath: required(parsed, '--encryption-key') }
+                    : {}),
+            });
+            print({
+                backupId: verification.header.manifest.backupId,
+                signatureVerified: verification.signatureVerified,
+                ciphertextVerified: verification.ciphertextVerified,
+                payloadVerified: verification.payloadVerified,
+            });
+            return;
+        }
+        case 'restore-preflight':
+        case 'restore-apply': {
+            assertOnly(parsed, [
+                '--archive',
+                '--target',
+                '--signing-public-key',
+                '--encryption-key',
+            ]);
+            const result = await restoreBackupArchive({
+                archivePath: required(parsed, '--archive'),
+                targetDirectory: required(parsed, '--target'),
+                signingPublicKeyPath: required(parsed, '--signing-public-key'),
+                encryptionKeyPath: required(parsed, '--encryption-key'),
+                apply: parsed.command === 'restore-apply',
+            });
+            print({
+                applied: result.applied,
+                targetDirectory: result.targetDirectory,
+                restoreReady: result.inventory.restoreReady,
+                schemaFingerprint: result.inventory.database.schema.fingerprint,
+                blockers: result.inventory.blockers,
+            });
+            return;
+        }
+        case 'restore-team-preflight':
+        case 'restore-team-apply': {
+            assertOnly(parsed, [
+                '--archive',
+                '--signing-public-key',
+                '--encryption-key',
+                ...(parsed.command === 'restore-team-apply'
+                    ? ['--configuration-output']
+                    : []),
+            ]);
+            const result = await restoreTeamBackupArchive({
+                archivePath: required(parsed, '--archive'),
+                signingPublicKeyPath: required(parsed, '--signing-public-key'),
+                encryptionKeyPath: required(parsed, '--encryption-key'),
+                targetEnv: process.env,
+                apply: parsed.command === 'restore-team-apply',
+                ...(parsed.command === 'restore-team-apply'
+                    ? {
+                        configurationOutputDirectory: required(parsed, '--configuration-output'),
+                    }
+                    : {}),
+            });
+            print({
+                applied: result.applied,
+                profile: 'team',
+                backupId: result.verification.header.manifest.backupId,
+                schemaVersion: result.inventory.schemaVersion,
+                blobObjects: result.inventory.s3.objects.length,
+                vectorRecords: result.inventory.vectors.records,
+                signatureVerified: result.verification.signatureVerified,
+                payloadVerified: result.verification.payloadVerified,
+                ...(result.configurationOutputDirectory
+                    ? {
+                        configurationOutputDirectory: result.configurationOutputDirectory,
+                    }
+                    : {}),
+            });
+            return;
+        }
+        case 'restore-verify': {
+            assertOnly(parsed, ['--target']);
+            const inventory = await verifyRestoredBackup(required(parsed, '--target'));
+            print({
+                verified: true,
+                restoreReady: inventory.restoreReady,
+                schemaFingerprint: inventory.database.schema.fingerprint,
+                blockers: inventory.blockers,
+            });
+            return;
+        }
+        default:
+            throw new Error(usage);
+    }
+};
+main().catch(error => {
+    const message = error instanceof Error ? error.message : 'Recovery backup failed.';
+    process.stderr.write(`${message}\n`);
+    process.exitCode = 2;
+});
+//# sourceMappingURL=recoveryBackup.js.map

package/backend/dist/cli/recoveryBackup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recoveryBackup.js","sourceRoot":"","sources":["../../src/cli/recoveryBackup.ts"],"names":[],"mappings":";AACA;;;;GAIG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAQjE,MAAM,KAAK,GAAG;;;;;;;;;;;;;;8EAcgE,CAAC;AAE/E,MAAM,KAAK,GAAG,CAAC,IAAc,EAAU,EAAE;IACvC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAChC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;QAC5D,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACzB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChB,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACxB,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,IAAY,EAAU,EAAE;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CACjB,MAAc,EACd,UAA6B,EAC7B,SAAS,GAAsB,EAAE,EAC3B,EAAE;IACR,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,yBAAyB,MAAM,CAAC,OAAO,KAAK,IAAI,KAAK,KAAK,EAAE,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,uBAAuB,MAAM,CAAC,OAAO,KAAK,IAAI,KAAK,KAAK,EAAE,CAC3D,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,KAAK,GAAG,CAAC,KAAc,EAAQ,EAAE;IACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC9D,CAAC,CAAC;AAEF,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;IACrC,IACE,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,EAC3C,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,KAAK,QAAQ,EAAE,CAAC;YACd,UAAU,CAAC,MAAM,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;YACpC,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,KAAK,QAAQ,EAAE,CAAC;YACd,UAAU,CACR,MAAM,EACN,CAAC,UAAU,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,YAAY,CAAC,EACvE,CAAC,WAAW,CAAC,CACd,CAAC;YACF,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC;gBAC7C,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;oBACtC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;oBAChC,CAAC,CAAC,oBAAoB,EAAE;gBAC1B,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;gBACxC,iBAAiB,EAAE,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;gBACvD,qBAAqB,EAAE,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;gBAChE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;aACvC,CAAC,CAAC;YACH,KAAK,CAAC;gBACJ,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ;gBAC/C,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS;gBACjD,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM;gBAChD,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe;gBACrD,iBAAiB,EAAE,YAAY,CAAC,iBAAiB;gBACjD,eAAe,EAAE,YAAY,CAAC,eAAe;aAC9C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,KAAK,aAAa,EAAE,CAAC;YACnB,UAAU,CACR,MAAM,EACN,CAAC,UAAU,EAAE,kBAAkB,EAAE,uBAAuB,CAAC,EACzD,CAAC,WAAW,CAAC,CACd,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC;gBAC3C,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;gBACxC,iBAAiB,EAAE,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;gBACvD,qBAAqB,EAAE,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;gBAChE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;aACvC,CAAC,CAAC;YACH,KAAK,CAAC;gBACJ,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,MAAM;gBACf,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ;gBACtD,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS;gBACxD,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM;gBACvD,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe;gBAC5D,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,aAAa;gBAC7C,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM;gBAC/C,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO;gBAC/C,iBAAiB,EAAE,MAAM,CAAC,YAAY,CAAC,iBAAiB;gBACxD,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,eAAe;aACrD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,KAAK,SAAS,EAAE,CAAC;YACf,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;YAClC,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;YACnE,KAAK,CAAC;gBACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,UAAU,EAAE;oBACV,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS;oBACtC,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,eAAe;oBAClD,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,gBAAgB;iBACrD;gBACD,SAAS,EAAE;oBACT,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,SAAS;oBACrC,iBAAiB,EAAE,MAAM,CAAC,SAAS,CAAC,iBAAiB;iBACtD;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,KAAK,QAAQ,EAAE,CAAC;YACd,UAAU,CAAC,MAAM,EAAE;gBACjB,WAAW;gBACX,sBAAsB;gBACtB,kBAAkB;aACnB,CAAC,CAAC;YACH,MAAM,YAAY,GAAG,mBAAmB,CAAC;gBACvC,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;gBAC1C,oBAAoB,EAAE,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;gBAC9D,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC;oBACvC,CAAC,CAAC,EAAE,iBAAiB,EAAE,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAAE;oBAC7D,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;YACH,KAAK,CAAC;gBACJ,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ;gBAC/C,iBAAiB,EAAE,YAAY,CAAC,iBAAiB;gBACjD,kBAAkB,EAAE,YAAY,CAAC,kBAAkB;gBACnD,eAAe,EAAE,YAAY,CAAC,eAAe;aAC9C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,KAAK,mBAAmB,CAAC;QACzB,KAAK,eAAe,EAAE,CAAC;YACrB,UAAU,CAAC,MAAM,EAAE;gBACjB,WAAW;gBACX,UAAU;gBACV,sBAAsB;gBACtB,kBAAkB;aACnB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC;gBACxC,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;gBAC1C,eAAe,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;gBAC7C,oBAAoB,EAAE,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;gBAC9D,iBAAiB,EAAE,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;gBACvD,KAAK,EAAE,MAAM,CAAC,OAAO,KAAK,eAAe;aAC1C,CAAC,CAAC;YACH,KAAK,CAAC;gBACJ,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,YAAY;gBAC3C,iBAAiB,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW;gBAC/D,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ;aACpC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,KAAK,wBAAwB,CAAC;QAC9B,KAAK,oBAAoB,EAAE,CAAC;YAC1B,UAAU,CAAC,MAAM,EAAE;gBACjB,WAAW;gBACX,sBAAsB;gBACtB,kBAAkB;gBAClB,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,oBAAoB;oBACzC,CAAC,CAAC,CAAC,wBAAwB,CAAC;oBAC5B,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;gBAC5C,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;gBAC1C,oBAAoB,EAAE,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;gBAC9D,iBAAiB,EAAE,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;gBACvD,SAAS,EAAE,OAAO,CAAC,GAAG;gBACtB,KAAK,EAAE,MAAM,CAAC,OAAO,KAAK,oBAAoB;gBAC9C,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,oBAAoB;oBACzC,CAAC,CAAC;wBACE,4BAA4B,EAAE,QAAQ,CACpC,MAAM,EACN,wBAAwB,CACzB;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;YACH,KAAK,CAAC;gBACJ,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,OAAO,EAAE,MAAM;gBACf,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ;gBACtD,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,aAAa;gBAC7C,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM;gBAC/C,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO;gBAC/C,iBAAiB,EAAE,MAAM,CAAC,YAAY,CAAC,iBAAiB;gBACxD,eAAe,EAAE,MAAM,CAAC,YAAY,CAAC,eAAe;gBACpD,GAAG,CAAC,MAAM,CAAC,4BAA4B;oBACrC,CAAC,CAAC;wBACE,4BAA4B,EAAE,MAAM,CAAC,4BAA4B;qBAClE;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,KAAK,gBAAgB,EAAE,CAAC;YACtB,UAAU,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YACjC,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAC1C,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAC7B,CAAC;YACF,KAAK,CAAC;gBACJ,QAAQ,EAAE,IAAI;gBACd,YAAY,EAAE,SAAS,CAAC,YAAY;gBACpC,iBAAiB,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW;gBACxD,QAAQ,EAAE,SAAS,CAAC,QAAQ;aAC7B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD;YACE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC,CAAC;AAEF,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;IACnB,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC;IACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;IACrC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/backend/dist/cli/recoveryInventory.d.ts

@@ -0,0 +1,2 @@
+import '../env.js';
+//# sourceMappingURL=recoveryInventory.d.ts.map

package/backend/dist/cli/recoveryInventory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recoveryInventory.d.ts","sourceRoot":"","sources":["../../src/cli/recoveryInventory.ts"],"names":[],"mappings":"AAiBA,OAAO,WAAW,CAAC"}

package/backend/dist/cli/recoveryInventory.js

@@ -0,0 +1,109 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import '../env.js';
+import recoveryInventoryService from '../services/recoveryInventoryService.js';
+const usage = `Usage: libre-webui recovery-check [--json] [--data-dir PATH] [--database PATH] [--legacy-plugins-dir PATH]
+
+From a source checkout, use "npm run recovery:check --" instead of "libre-webui recovery-check".
+
+Collect a read-only recovery-readiness inventory. Exit status is 0 when no
+blockers are found, 1 when recovery blockers exist, and 2 for invalid usage or
+an unexpected collection failure. Secret values are never included.`;
+const parseArgs = (args) => {
+    const options = { json: false, legacyPluginsDirectories: [] };
+    for (let index = 0; index < args.length; index += 1) {
+        const argument = args[index];
+        if (argument === '--json') {
+            options.json = true;
+            continue;
+        }
+        if (argument === '--help' || argument === '-h') {
+            process.stdout.write(`${usage}\n`);
+            process.exit(0);
+        }
+        if (argument === '--data-dir' ||
+            argument === '--database' ||
+            argument === '--legacy-plugins-dir') {
+            const value = args[index + 1];
+            if (!value || value.startsWith('-')) {
+                throw new Error(`${argument} requires a path.`);
+            }
+            if (argument === '--data-dir')
+                options.dataDir = value;
+            else if (argument === '--database')
+                options.databasePath = value;
+            else
+                options.legacyPluginsDirectories.push(value);
+            index += 1;
+            continue;
+        }
+        throw new Error(`Unknown option: ${argument}`);
+    }
+    return options;
+};
+const renderText = (inventory) => {
+    const lines = [
+        `Libre WebUI recovery inventory v${inventory.version}`,
+        `Application: ${inventory.application.version}`,
+        `Status: ${inventory.restoreReady ? 'READY' : 'BLOCKED'}`,
+        `Database: ${inventory.database.quickCheck}; ${inventory.database.bytes} bytes; schema ${inventory.database.schema.fingerprint || 'unavailable'}`,
+        `Encryption key: ${inventory.encryption.status}; source ${inventory.encryption.source}; fingerprint ${inventory.encryption.fingerprint || 'unavailable'}`,
+        `Storage: ${inventory.storage.dataDirectory.files} files; ${inventory.storage.dataDirectory.bytes} bytes`,
+        `Plugins: ${inventory.storage.customPlugins.definitions} custom definitions`,
+        `Work: ${inventory.work.tasks} tasks; ${inventory.work.activeRuns} active runs; ${inventory.work.activePreviews} active previews; ${inventory.work.workspaces.length} external workspaces`,
+        `Jobs: ${inventory.jobs.total} media jobs (${inventory.jobs.active} active); ${inventory.jobs.durable.total} durable jobs (${inventory.jobs.durable.running} running)`,
+        `Durable events: ${inventory.jobs.durable.events.total} events across ${inventory.jobs.durable.events.streams} streams; cursor ${inventory.jobs.durable.events.lastCursor}`,
+    ];
+    if (inventory.blockers.length > 0) {
+        lines.push('Blockers:', ...inventory.blockers.map(item => `- ${item}`));
+    }
+    if (inventory.warnings.length > 0) {
+        lines.push('Warnings:', ...inventory.warnings.map(item => `- ${item}`));
+    }
+    lines.push('Exclusions:', ...inventory.exclusions.map(item => `- ${item}`));
+    return `${lines.join('\n')}\n`;
+};
+const main = async () => {
+    let options;
+    try {
+        options = parseArgs(process.argv.slice(2));
+    }
+    catch (error) {
+        process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n\n${usage}\n`);
+        process.exitCode = 2;
+        return;
+    }
+    try {
+        const inventory = await recoveryInventoryService.collect({
+            ...(options.dataDir ? { dataDir: options.dataDir } : {}),
+            ...(options.databasePath ? { databasePath: options.databasePath } : {}),
+            ...(options.legacyPluginsDirectories.length > 0
+                ? { legacyPluginsDirectories: options.legacyPluginsDirectories }
+                : {}),
+        });
+        process.stdout.write(options.json
+            ? `${JSON.stringify(inventory, null, 2)}\n`
+            : renderText(inventory));
+        process.exitCode = inventory.restoreReady ? 0 : 1;
+    }
+    catch {
+        process.stderr.write('Recovery inventory collection failed.\n');
+        process.exitCode = 2;
+    }
+};
+void main();
+//# sourceMappingURL=recoveryInventory.js.map

package/backend/dist/cli/recoveryInventory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recoveryInventory.js","sourceRoot":"","sources":["../../src/cli/recoveryInventory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,WAAW,CAAC;AACnB,OAAO,wBAAwB,MAAM,yCAAyC,CAAC;AAS/E,MAAM,KAAK,GAAG;;;;;;oEAMsD,CAAC;AAErE,MAAM,SAAS,GAAG,CAAC,IAAc,EAAc,EAAE;IAC/C,MAAM,OAAO,GAAe,EAAE,IAAI,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,CAAC;IAC1E,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IACE,QAAQ,KAAK,YAAY;YACzB,QAAQ,KAAK,YAAY;YACzB,QAAQ,KAAK,sBAAsB,EACnC,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,mBAAmB,CAAC,CAAC;YAClD,CAAC;YACD,IAAI,QAAQ,KAAK,YAAY;gBAAE,OAAO,CAAC,OAAO,GAAG,KAAK,CAAC;iBAClD,IAAI,QAAQ,KAAK,YAAY;gBAAE,OAAO,CAAC,YAAY,GAAG,KAAK,CAAC;;gBAC5D,OAAO,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClD,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CACjB,SAAuE,EAC/D,EAAE;IACV,MAAM,KAAK,GAAG;QACZ,mCAAmC,SAAS,CAAC,OAAO,EAAE;QACtD,gBAAgB,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE;QAC/C,WAAW,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE;QACzD,aAAa,SAAS,CAAC,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC,QAAQ,CAAC,KAAK,kBAAkB,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,IAAI,aAAa,EAAE;QACjJ,mBAAmB,SAAS,CAAC,UAAU,CAAC,MAAM,YAAY,SAAS,CAAC,UAAU,CAAC,MAAM,iBAAiB,SAAS,CAAC,UAAU,CAAC,WAAW,IAAI,aAAa,EAAE;QACzJ,YAAY,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,WAAW,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,QAAQ;QACzG,YAAY,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,qBAAqB;QAC5E,SAAS,SAAS,CAAC,IAAI,CAAC,KAAK,WAAW,SAAS,CAAC,IAAI,CAAC,UAAU,iBAAiB,SAAS,CAAC,IAAI,CAAC,cAAc,qBAAqB,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,sBAAsB;QAC1L,SAAS,SAAS,CAAC,IAAI,CAAC,KAAK,gBAAgB,SAAS,CAAC,IAAI,CAAC,MAAM,aAAa,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,kBAAkB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,WAAW;QACtK,mBAAmB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,kBAAkB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,oBAAoB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE;KAC5K,CAAC;IACF,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5E,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC,CAAC;AAEF,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;IACrC,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAC1E,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC;YACvD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,OAAO,CAAC,wBAAwB,CAAC,MAAM,GAAG,CAAC;gBAC7C,CAAC,CAAC,EAAE,wBAAwB,EAAE,OAAO,CAAC,wBAAwB,EAAE;gBAChE,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,OAAO,CAAC,IAAI;YACV,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;YAC3C,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAC1B,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAChE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC;AAEF,KAAK,IAAI,EAAE,CAAC"}

package/backend/dist/db.d.ts

@@ -1,4 +1,31 @@
 import Database from 'better-sqlite3';
+import { getSchemaCompatibilityState } from './persistence/sqliteMigrations.js';
+export type { SchemaCompatibilityState } from './persistence/sqliteMigrations.js';
+export { getSchemaCompatibilityState };
+/**
+ * Cheap identity of an existing database for preflight caching: the inode
+ * pair detects a replaced or restored file, and the schema cookie changes
+ * exactly when a migration (or any DDL) runs. Ordinary row writes change
+ * neither, so a healthy instance keeps one stable identity between upgrades.
+ * The cookie is read through a readonly connection so a version still
+ * sitting in the WAL is observed the same way on both sides of the marker.
+ */
+export interface SQLitePreflightIdentity {
+    dev: number;
+    ino: number;
+    schemaCookie: number;
+}
+export declare function readSQLitePreflightIdentity(databasePath: string): SQLitePreflightIdentity | null;
+export declare function readPreflightVerificationMarker(dataDir: string): SQLitePreflightIdentity | null;
+/** Delete the marker file to force a full preflight on the next start. */
+export declare function writePreflightVerificationMarker(dataDir: string, identity: SQLitePreflightIdentity): void;
+export declare function preflightIdentityMatchesMarker(identity: SQLitePreflightIdentity | null, marker: SQLitePreflightIdentity | null): boolean;
+/**
+ * Validate an existing database before importing stateful application
+ * singletons. This reads bounded integrity and schema metadata only; missing
+ * database files remain a supported fresh-install state.
+ */
+export declare function preflightExistingSQLiteDatabase(databasePath: string, scratchRoot?: string, inspect?: (database: Database.Database) => void): void;
 /**
  * Initialize and return the SQLite database connection
  */

package/backend/dist/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../src/db.ts"],"names":[],"mappings":"AAiBA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AA0BtC;;GAEG;AACH,wBAAgB,WAAW,IAAI,QAAQ,CAAC,QAAQ,CA0D/C;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAO1D;AAyxBD;;GAEG;AACH,wBAAgB,aAAa,IAAI,IAAI,CAMpC;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAa/C;eAGc,WAAW"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../src/db.ts"],"names":[],"mappings":"AAiBA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAKtC,OAAO,EACL,2BAA2B,EAM5B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,2BAA2B,EAAE,CAAC;AAWvC;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,2BAA2B,CACzC,YAAY,EAAE,MAAM,GACnB,uBAAuB,GAAG,IAAI,CAoBhC;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,GACd,uBAAuB,GAAG,IAAI,CA0BhC;AAED,0EAA0E;AAC1E,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,uBAAuB,GAChC,IAAI,CAwBN;AAED,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,uBAAuB,GAAG,IAAI,EACxC,MAAM,EAAE,uBAAuB,GAAG,IAAI,GACrC,OAAO,CAQT;AASD;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,YAAY,EAAE,MAAM,EACpB,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,KAAK,IAAI,GAC9C,IAAI,CA6HN;AAiBD;;GAEG;AACH,wBAAgB,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAyF/C;AA0DD;;GAEG;AACH,wBAAgB,eAAe,IAAI,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAO1D;AAm2BD;;GAEG;AACH,wBAAgB,aAAa,IAAI,IAAI,CAMpC;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAa/C;eAGc,WAAW"}