openmates 0.12.0-alpha.24 → 0.12.0-alpha.25

package/dist/{chunk-YQL7OKLK.js → chunk-V7DUGDYQ.js}

@@ -9605,6 +9605,24 @@ function writeChecksums(rootDir) {
   writeFileSync3(join3(rootDir, "checksums.sha256"), `${lines.sort().join("\n")}
 `);
 }
+function verifyChecksums(rootDir) {
+  const checksumsPath = join3(rootDir, "checksums.sha256");
+  if (!existsSync5(checksumsPath)) throw new Error("Backup archive is missing checksums.sha256.");
+  for (const line of readFileSync5(checksumsPath, "utf-8").split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    const match = trimmed.match(/^([a-f0-9]{64}) {2}(.+)$/);
+    if (!match) throw new Error(`Invalid checksum entry: ${trimmed}`);
+    const relative2 = match[2];
+    if (relative2.startsWith("/") || relative2.split(/[\\/]/).includes("..")) {
+      throw new Error(`Unsafe checksum path in backup archive: ${relative2}`);
+    }
+    const filePath = join3(rootDir, relative2);
+    if (!existsSync5(filePath)) throw new Error(`Backup archive is missing checksummed file: ${relative2}`);
+    const actual = createHash5("sha256").update(readFileSync5(filePath)).digest("hex");
+    if (actual !== match[1]) throw new Error(`Backup checksum mismatch for ${relative2}.`);
+  }
+}
 function createServerBackup(installPath, role, options = {}) {
   const plan = planBackup({ role, includeObservability: options.includeObservability });
   const backupDir = roleBackupDir(installPath, role);
@@ -9629,7 +9647,10 @@ function createServerBackup(installPath, role, options = {}) {
       const databaseUser = env.DATABASE_USERNAME || "directus";
       const databaseName = env.DATABASE_NAME || "directus";
       try {
-        const dump = execSync(`docker exec cms-database pg_dump -U ${shellQuote(databaseUser)} ${shellQuote(databaseName)}`, { encoding: "utf-8" });
+        const dump = execSync(
+          `docker exec cms-database pg_dump --clean --if-exists --no-owner --no-privileges -U ${shellQuote(databaseUser)} ${shellQuote(databaseName)}`,
+          { encoding: "utf-8" }
+        );
         writeFileSync3(join3(tempDir, "postgres.sql"), dump);
       } catch (error) {
         throw new Error(`Postgres backup failed. Is cms-database running? ${error instanceof Error ? error.message : String(error)}`);
@@ -9658,6 +9679,7 @@ function restoreServerBackup(installPath, role, file) {
   const env = readEnvMap(installPath);
   try {
     execSync(`tar -xzf ${shellQuote(archivePath)} -C ${shellQuote(tempDir)}`, { stdio: "pipe" });
+    verifyChecksums(tempDir);
     const manifestPath = join3(tempDir, "manifest.json");
     if (!existsSync5(manifestPath)) throw new Error("Backup archive is missing manifest.json.");
     const manifest = JSON.parse(readFileSync5(manifestPath, "utf-8"));
@@ -9668,7 +9690,7 @@ function restoreServerBackup(installPath, role, file) {
     if (role === "core" && existsSync5(postgresDump)) {
       const databaseUser = env.DATABASE_USERNAME || "directus";
       const databaseName = env.DATABASE_NAME || "directus";
-      execSync(`docker exec -i cms-database psql -U ${shellQuote(databaseUser)} ${shellQuote(databaseName)}`, {
+      execSync(`docker exec -i cms-database psql -v ON_ERROR_STOP=1 -U ${shellQuote(databaseUser)} ${shellQuote(databaseName)}`, {
         input: readFileSync5(postgresDump),
         stdio: ["pipe", "pipe", "pipe"]
       });
@@ -9677,6 +9699,10 @@ function restoreServerBackup(installPath, role, file) {
     rmSync3(tempDir, { recursive: true, force: true });
   }
 }
+function restoreStopServices(role) {
+  if (role !== "core") return [];
+  return resolveServiceSelection("core", { exclude: "cms-database" });
+}
 async function promptText(question, defaultValue = "") {
   const rl = createPromptInterface({ input: process.stdin, output: process.stderr });
   try {
@@ -10631,7 +10657,8 @@ WARNING: This will restore ${role} data from ${file}.`);
   }
   const withOverrides = config?.composeProfile === "full";
   const installMode = getInstallMode(installPath, config);
-  let code = await runInteractive("docker", [...composeArgs(installPath, withOverrides, installMode, role), "stop"], installPath);
+  const stopArgs = [...composeArgs(installPath, withOverrides, installMode, role), "stop", ...restoreStopServices(role)];
+  let code = await runInteractive("docker", stopArgs, installPath);
   if (code !== 0) process.exit(code);
   restoreServerBackup(installPath, role, file);
   code = await runInteractive("docker", [...composeArgs(installPath, withOverrides, installMode, role), "up", "-d"], installPath);
@@ -27698,7 +27725,7 @@ Only output the final Markdown table. Do NOT include explanations, notes, or any
         text: "Private local personalization"
       },
       title: {
-        text: "Choose what you care about. Your picks stay in this browser session."
+        text: "What are you interested in?"
       },
       continue: {
         text: "Continue"

package/dist/cli.js

@@ -2,7 +2,7 @@
 import {
   getExtForLang,
   serializeToYaml
-} from "./chunk-YQL7OKLK.js";
+} from "./chunk-V7DUGDYQ.js";
 import "./chunk-AXNRPVLE.js";
 export {
   getExtForLang,

package/dist/index.js

@@ -11,7 +11,7 @@ import {
   getExtForLang,
   normalizeInterestTagIds,
   serializeToYaml
-} from "./chunk-YQL7OKLK.js";
+} from "./chunk-V7DUGDYQ.js";
 import "./chunk-AXNRPVLE.js";
 export {
   ASSISTANT_FEEDBACK_REPORT_TITLE,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmates",
-  "version": "0.12.0-alpha.24",
+  "version": "0.12.0-alpha.25",
   "description": "OpenMates CLI and SDK",
   "type": "module",
   "main": "dist/index.js",