@aopslabs/aops-server 0.2.23 → 0.2.25

package/scripts/owned-set-snapshot.mjs

@@ -0,0 +1,182 @@
+#!/usr/bin/env node
+/**
+ * One entry point for taking a first-party snapshot of the relations AOPS owns.
+ *
+ * The update flow needs a pre-migration backup and, until now, took it with
+ * pg_dump: a host binary the operator has to install, of a version the server
+ * will accept, before an update may proceed. The operator's decision was to
+ * remove that dependency — "pg_dump bağımlılığı istemiyorum" — and the machinery
+ * for it already exists in this directory. What was missing was a surface the
+ * CLI can call.
+ *
+ * It ships in the server package and is invoked the way `community-host.mjs` and
+ * `container-start.mjs` are: resolved inside the installed package and run with
+ * node. That is the repository's existing shape for "the CLI needs something the
+ * server owns", and following it costs nothing, where moving 1,180 lines into a
+ * published TypeScript package would have cost a port and a weaker type
+ * boundary in the package that already caught one real defect this way.
+ *
+ * The connection URL arrives through AOPS_PG_URL, never argv, for the same
+ * reason the rest of this product does it: argv is visible to every process on
+ * the machine and lands in logs nobody redacts.
+ */
+import { createHash } from 'node:crypto'
+import { existsSync, readFileSync } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { Client } from 'pg'
+
+import { buildDomainProviders, assertCoversOwnedIdentity } from './domain-backup-provider.mjs'
+import { backupOwnedSet } from './owned-set-backup.mjs'
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url))
+
+function parseArgs(argv) {
+  const value = (name) => {
+    const index = argv.indexOf(name)
+    return index >= 0 ? argv[index + 1] : undefined
+  }
+  return {
+    bundleDirectory: value('--bundle-dir'),
+    receiptPath: value('--receipt'),
+    backupSetId: value('--set-id'),
+    policyPath: value('--policy'),
+    inventoryPath: value('--inventory'),
+    migrationsRoot: value('--migrations-root'),
+  }
+}
+
+/**
+ * The migration closure, read from the tree the policy points at.
+ *
+ * Embedding it is what makes a bundle able to rebuild a schema rather than only
+ * refill one. Digested per file so a bundle cannot claim bytes it does not
+ * carry.
+ */
+/**
+ * The closure that goes into the bundle is the one that was APPLIED, not the one
+ * the running package ships.
+ *
+ * Measured on a restored copy of a real 0.3.24 database: the package's closure
+ * carries two agentspace migrations and eight for projectman, while the database
+ * being snapshotted is at one and six. Embedding the package's closure produced a
+ * bundle that claimed the 0.3.24 lineage but carried the migrations that leave
+ * 0.3.24 -- including the one that drops `missions`. A disaster restore from it
+ * would have rebuilt a schema the bundle's own rows do not fit, and the policy
+ * validator refused it (`community_strict_policy_target_invalid`) because the
+ * lineage's applied counts disagreed with the roots rebuilt from those bytes.
+ *
+ * So each root is cut to the count the lineage records, and the journal is cut
+ * with it: `bundleOnlyPolicy` rebuilds the roots from the embedded journal, so a
+ * full journal beside a partial file set describes migrations that are not there.
+ */
+function collectMigrationSetManifest(policy, migrationsRoot, appliedCounts) {
+  if (!Array.isArray(appliedCounts) || appliedCounts.length !== policy.roots.length) {
+    throw new Error(`owned_set_snapshot_applied_counts_shape:${String(appliedCounts?.length)}:${policy.roots.length}`)
+  }
+  return {
+    roots: policy.roots.map((root, rootIndex) => {
+      // Two shapes, and they are not interchangeable. In the shipped package the
+      // staging step copies each root to `migrations/<root.id>`; in a repository
+      // checkout `migrationsDir` is the whole relative path, most of it inside
+      // node_modules. Resolving one as the other silently looks for `sys/` at the
+      // repository root, which is where the first version of this went.
+      const sourceDir = migrationsRoot
+        ? path.resolve(migrationsRoot, root.migrationsDir)
+        : path.join(scriptDir, '..', 'migrations', root.id)
+      const applied = appliedCounts[rootIndex]
+      if (!Number.isInteger(applied) || applied < 0 || applied > root.migrations.length) {
+        throw new Error(`owned_set_snapshot_applied_count_out_of_range:${root.id}:${String(applied)}`)
+      }
+      const appliedMigrations = root.migrations.slice(0, applied)
+      const appliedTags = new Set(appliedMigrations.map((migration) => migration.tag))
+      const files = []
+      for (const migration of appliedMigrations) {
+        const file = path.join(sourceDir, `${migration.tag}.sql`)
+        const bytes = readFileSync(file)
+        files.push({
+          relativePath: `${migration.tag}.sql`,
+          mode: '0644',
+          byteLength: bytes.length,
+          sha256: createHash('sha256').update(bytes).digest('hex'),
+        })
+      }
+      const journal = path.join(sourceDir, 'meta/_journal.json')
+      if (existsSync(journal)) {
+        // Rewritten rather than copied, and carried as bytes rather than as a
+        // path, because the truncated journal exists nowhere on disk.
+        const source = JSON.parse(readFileSync(journal, 'utf8'))
+        const entries = source.entries.filter((entry) => appliedTags.has(entry.tag))
+        if (entries.length !== appliedMigrations.length) {
+          throw new Error(`owned_set_snapshot_journal_incomplete:${root.id}:${entries.length}:${appliedMigrations.length}`)
+        }
+        const bytes = Buffer.from(`${JSON.stringify({ ...source, entries }, null, 2)}\n`, 'utf8')
+        files.push({
+          relativePath: 'meta/_journal.json',
+          mode: '0644',
+          byteLength: bytes.length,
+          sha256: createHash('sha256').update(bytes).digest('hex'),
+          contents: bytes,
+        })
+      }
+      return { root: root.id, sourceDir, files }
+    }),
+  }
+}
+
+export async function snapshotOwnedSet(options) {
+  const repoUrl = process.env.AOPS_PG_URL
+  if (!repoUrl) throw new Error('owned_set_snapshot_pg_url_absent')
+  for (const required of ['bundleDirectory', 'receiptPath', 'backupSetId']) {
+    if (!options[required]) throw new Error(`owned_set_snapshot_${required}_required`)
+  }
+  const policy = JSON.parse(readFileSync(
+    options.policyPath ?? path.join(scriptDir, 'community-migration-policy-package-v1.json'), 'utf8'))
+  const inventory = JSON.parse(readFileSync(
+    options.inventoryPath ?? path.join(scriptDir, 'community-domain-ownership-v1.json'), 'utf8'))
+
+  const client = new Client({ connectionString: repoUrl })
+  await client.connect()
+  try {
+    // Which lineage this database is at decides which owned set to copy. Read
+    // from the database rather than assumed from the policy's target: an
+    // installation about to be updated is, by definition, not at the target.
+    const { inspectCommunityStrictPgSchema } = await import('@aopslabs/aops-pg-bootstrap')
+    const state = await inspectCommunityStrictPgSchema({ client, policy })
+    const identity = policy.lineages.find((lineage) => lineage.id === state.lineageId)
+    if (!identity) throw new Error(`owned_set_snapshot_lineage_unknown:${state.lineageId}`)
+    if (identity.identityMode !== 'semantic-owned-v1') {
+      // Refused rather than guessed. A legacy-raw lineage carries no owned
+      // relation list, so there is no defensible boundary to copy, and copying
+      // the wrong boundary is worse than not copying.
+      throw new Error(`owned_set_snapshot_not_eligible:${identity.id}:${identity.identityMode}`)
+    }
+    const providerSet = buildDomainProviders(inventory, {
+      ownedRelations: identity.ownedRelations,
+      policyRoots: policy.roots,
+    })
+    assertCoversOwnedIdentity(providerSet, identity.ownedRelations)
+    const summary = await backupOwnedSet({
+      client,
+      providerSet,
+      identity,
+      bundleDirectory: options.bundleDirectory,
+      receiptPath: options.receiptPath,
+      backupSetId: options.backupSetId,
+      migrationSetManifest: collectMigrationSetManifest(policy, options.migrationsRoot, identity.appliedCounts),
+    })
+    return { ...summary, lineageId: identity.id, contract: 'aops.owned-set-snapshot/v1' }
+  } finally {
+    await client.end()
+  }
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  snapshotOwnedSet(parseArgs(process.argv.slice(2)))
+    .then((result) => process.stdout.write(`${JSON.stringify(result, null, 2)}\n`))
+    .catch((error) => {
+      process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`)
+      process.exit(1)
+    })
+}

package/build/client/_app/immutable/entry/start.-ok9xL1X.js

@@ -1 +0,0 @@
-import{l as o,a as r}from"../chunks/DHVET-3z.js";export{o as load_css,r as start};