@better-forge/backup 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 BetterStatusPage contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,12 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# @better-forge/backup
+
+Backup, restore and verification of a SQLite database and the files around it.
+
+- `createBackupService` writes a consistent snapshot of the database (`VACUUM INTO`, integrity-checked) plus the files the application adds, into one checksummed archive, and verifies, lists, prunes and locks backups. The schedule and the last status are kept as files beside the backups.
+- `createRestore` restores an archive over a stopped application, takes a safety backup first and puts every replaced file back if the restore fails half way. The application supplies the files around the database, its database handle and the checks that may refuse a backup.
+- `createBackupRunner` and `@better-forge/backup/worker` run a backup or a verification on a worker thread.
+- `createBackupRoutes` makes the admin routes (list, create, schedule, download, delete, verify an uploaded file) and `createBackupScheduler` runs backups on the configured schedule.
+- `runBackupCli` and `runRestoreCli` are the command lines of `backup`, `backup --verify` and `restore`; the application keeps its boot (environment, database) in the entry file.
+- `createArchiveFormat` is the archive format on its own; the `magic` bytes identify the archives of one product.
+
+Depends on `@better-forge/audit` (the routes) and `node-cron` (the scheduler); the service itself needs only Node (`node:sqlite`).

package/dist/archive.d.ts

@@ -0,0 +1,17 @@
+export interface ArchiveEntry {
+    name: string;
+    source: string;
+}
+/**
+ * The archive file format: a magic header, then for each file its name, size and SHA-256 followed by its bytes.
+ * Extraction checks every checksum and refuses names that would leave the destination. The `magic` is what identifies
+ * archives of one product, so an application keeps the one its existing archives start with.
+ */
+export declare function createArchiveFormat(options: {
+    magic: string;
+}): {
+    createArchive: (output: string, entries: ArchiveEntry[]) => void;
+    extractArchive: (input: string, destination: string) => string[];
+};
+export type ArchiveFormat = ReturnType<typeof createArchiveFormat>;
+//# sourceMappingURL=archive.d.ts.map

package/dist/archive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive.d.ts","sourceRoot":"","sources":["../src/archive.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,YAAY;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AA6C9D;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE;4BAG7B,MAAM,WAAW,YAAY,EAAE,KAAG,IAAI;4BAsBtC,MAAM,eAAe,MAAM,KAAG,MAAM,EAAE;EA8BtE;AAED,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAA"}

package/dist/archive.js

@@ -0,0 +1,132 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+const HASH_SIZE = 32;
+function safeName(name) {
+    const normalized = name.replaceAll('\\', '/');
+    if (!normalized || normalized.startsWith('/') || normalized.includes('../') || normalized === '..') {
+        throw new Error(`Unsafe archive path: ${name}`);
+    }
+    return normalized;
+}
+function sha256(file) {
+    const hash = crypto.createHash('sha256');
+    const fd = fs.openSync(file, 'r');
+    const buffer = Buffer.allocUnsafe(1024 * 1024);
+    try {
+        let count = 0;
+        while ((count = fs.readSync(fd, buffer, 0, buffer.length, null)) > 0)
+            hash.update(buffer.subarray(0, count));
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    return hash.digest();
+}
+function copyBytes(input, output, size, hash) {
+    const buffer = Buffer.allocUnsafe(1024 * 1024);
+    let remaining = size;
+    while (remaining > 0) {
+        const count = fs.readSync(input, buffer, 0, Math.min(buffer.length, remaining), null);
+        if (count === 0)
+            throw new Error('Unexpected end of backup archive');
+        const chunk = buffer.subarray(0, count);
+        if (hash)
+            hash.update(chunk);
+        fs.writeSync(output, chunk);
+        remaining -= count;
+    }
+}
+function readExact(fd, size) {
+    const buffer = Buffer.alloc(size);
+    let offset = 0;
+    while (offset < size) {
+        const count = fs.readSync(fd, buffer, offset, size - offset, null);
+        if (!count)
+            throw new Error('Truncated backup archive');
+        offset += count;
+    }
+    return buffer;
+}
+/**
+ * The archive file format: a magic header, then for each file its name, size and SHA-256 followed by its bytes.
+ * Extraction checks every checksum and refuses names that would leave the destination. The `magic` is what identifies
+ * archives of one product, so an application keeps the one its existing archives start with.
+ */
+export function createArchiveFormat(options) {
+    const MAGIC = Buffer.from(options.magic);
+    function createArchive(output, entries) {
+        const fd = fs.openSync(output, 'wx', 0o600);
+        try {
+            fs.writeSync(fd, MAGIC);
+            for (const entry of entries) {
+                const name = Buffer.from(safeName(entry.name), 'utf8');
+                const stat = fs.statSync(entry.source);
+                if (!stat.isFile())
+                    throw new Error(`Archive source is not a file: ${entry.source}`);
+                const header = Buffer.alloc(4 + 8 + HASH_SIZE);
+                header.writeUInt32BE(name.length, 0);
+                header.writeBigUInt64BE(BigInt(stat.size), 4);
+                sha256(entry.source).copy(header, 12);
+                fs.writeSync(fd, header);
+                fs.writeSync(fd, name);
+                const input = fs.openSync(entry.source, 'r');
+                try {
+                    copyBytes(input, fd, stat.size);
+                }
+                finally {
+                    fs.closeSync(input);
+                }
+            }
+            fs.writeSync(fd, Buffer.alloc(4));
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+    }
+    function extractArchive(input, destination) {
+        fs.mkdirSync(destination, { recursive: true, mode: 0o700 });
+        const root = path.resolve(destination);
+        const extracted = [];
+        const fd = fs.openSync(input, 'r');
+        try {
+            if (!readExact(fd, MAGIC.length).equals(MAGIC))
+                throw new Error('Unsupported backup format');
+            for (let index = 0; index < 10000; index++) {
+                const nameLength = readExact(fd, 4).readUInt32BE(0);
+                if (nameLength === 0)
+                    return extracted;
+                if (nameLength > 4096)
+                    throw new Error('Invalid archive entry name');
+                const metadata = readExact(fd, 8 + HASH_SIZE);
+                const sizeBig = metadata.readBigUInt64BE(0);
+                if (sizeBig > BigInt(Number.MAX_SAFE_INTEGER))
+                    throw new Error('Archive entry is too large');
+                const expectedHash = metadata.subarray(8);
+                const name = safeName(readExact(fd, nameLength).toString('utf8'));
+                const target = path.resolve(root, ...name.split('/'));
+                if (target !== root && !target.startsWith(`${root}${path.sep}`))
+                    throw new Error('Archive path escapes destination');
+                fs.mkdirSync(path.dirname(target), { recursive: true });
+                const output = fs.openSync(target, 'wx', 0o600);
+                const hash = crypto.createHash('sha256');
+                try {
+                    copyBytes(fd, output, Number(sizeBig), hash);
+                }
+                finally {
+                    fs.closeSync(output);
+                }
+                if (!crypto.timingSafeEqual(hash.digest(), expectedHash))
+                    throw new Error(`Checksum mismatch: ${name}`);
+                extracted.push(name);
+            }
+            throw new Error('Archive contains too many entries');
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+    }
+    return { createArchive, extractArchive };
+}
+//# sourceMappingURL=archive.js.map

package/dist/archive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive.js","sourceRoot":"","sources":["../src/archive.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,MAAM,MAAM,aAAa,CAAA;AAEhC,MAAM,SAAS,GAAG,EAAE,CAAA;AAIpB,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC7C,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACnG,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAA;IACjD,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;IACxC,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;IAC9C,IAAI,CAAC;QACH,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAA;IAC9G,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;IAAC,CAAC;IAC9B,OAAO,IAAI,CAAC,MAAM,EAAE,CAAA;AACtB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,MAAc,EAAE,IAAY,EAAE,IAAkB;IAChF,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;IAC9C,IAAI,SAAS,GAAG,IAAI,CAAA;IACpB,OAAO,SAAS,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,CAAA;QACrF,IAAI,KAAK,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;QACpE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACvC,IAAI,IAAI;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC5B,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAC3B,SAAS,IAAI,KAAK,CAAA;IACpB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,EAAU,EAAE,IAAY;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,OAAO,MAAM,GAAG,IAAI,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAG,MAAM,EAAE,IAAI,CAAC,CAAA;QAClE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACvD,MAAM,IAAI,KAAK,CAAA;IACjB,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA0B;IAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAExC,SAAS,aAAa,CAAC,MAAc,EAAE,OAAuB;QAC5D,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;YACvB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;gBACtD,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;gBACtC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;gBACpF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,CAAA;gBAC9C,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;gBACpC,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;gBAC7C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;gBACrC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;gBACxB,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;gBACtB,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;gBAC5C,IAAI,CAAC;oBAAC,SAAS,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;gBAAC,CAAC;wBAAS,CAAC;oBAAC,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;gBAAC,CAAC;YACzE,CAAC;YACD,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;YACjC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QAClB,CAAC;gBAAS,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QAAC,CAAC;IAChC,CAAC;IAED,SAAS,cAAc,CAAC,KAAa,EAAE,WAAmB;QACxD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QACtC,MAAM,SAAS,GAAa,EAAE,CAAA;QAC9B,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QAClC,IAAI,CAAC;YACH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;YAC5F,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC3C,MAAM,UAAU,GAAG,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;gBACnD,IAAI,UAAU,KAAK,CAAC;oBAAE,OAAO,SAAS,CAAA;gBACtC,IAAI,UAAU,GAAG,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;gBACpE,MAAM,QAAQ,GAAG,SAAS,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,CAAA;gBAC7C,MAAM,OAAO,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;gBAC3C,IAAI,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;gBAC5F,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;gBACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;gBACjE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;gBACrD,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;gBACpH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;gBACvD,MAAM,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;gBAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;gBACxC,IAAI,CAAC;oBAAC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAA;gBAAC,CAAC;wBAAS,CAAC;oBAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;gBAAC,CAAC;gBACrF,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAA;gBACvG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACtB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QACtD,CAAC;gBAAS,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QAAC,CAAC;IAChC,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,CAAA;AAC1C,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,28 @@
+import type { BackupService } from './service.js';
+export interface BackupCliOptions {
+    service: Pick<BackupService, 'createBackup' | 'validateBackup'>;
+    /** The application's database handle: opened for the backup and closed after it. */
+    database: {
+        open: () => void;
+        close: () => void;
+    };
+    /** A backup file name as the usage line shows it (`<name>-backup-timestamp.backup`). */
+    exampleFile: string;
+}
+/**
+ * The command line of `backup`: makes a backup (`--output <dir>` picks where) or, with `--verify <file>` /
+ * `--verify --input <file>`, checks one. Prints JSON; failures set a non-zero exit code.
+ */
+export declare function runBackupCli(argv: string[], options: BackupCliOptions): Promise<void>;
+export interface RestoreCliOptions {
+    restore: (input: string, extra: string) => Promise<unknown>;
+    exampleFile: string;
+    /** The one extra value the restore needs (for example the key the backup was made with). */
+    extra: {
+        flag: string;
+        placeholder: string;
+    };
+}
+/** The command line of `restore`: `--input <file>` and the extra flag are both required. */
+export declare function runRestoreCli(argv: string[], options: RestoreCliOptions): Promise<void>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAYjD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,cAAc,GAAG,gBAAgB,CAAC,CAAA;IAC/D,oFAAoF;IACpF,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,IAAI,CAAA;KAAE,CAAA;IACjD,wFAAwF;IACxF,WAAW,EAAE,MAAM,CAAA;CACpB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB3F;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC3D,WAAW,EAAE,MAAM,CAAA;IACnB,4FAA4F;IAC5F,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAA;CAC7C;AAED,4FAA4F;AAC5F,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAU7F"}

package/dist/cli.js

@@ -0,0 +1,54 @@
+import path from 'node:path';
+function argument(argv, name) {
+    const index = argv.indexOf(name);
+    return index >= 0 ? argv[index + 1] : undefined;
+}
+function fail(error) {
+    console.error(error instanceof Error ? error.message : error);
+    process.exitCode = 1;
+}
+/**
+ * The command line of `backup`: makes a backup (`--output <dir>` picks where) or, with `--verify <file>` /
+ * `--verify --input <file>`, checks one. Prints JSON; failures set a non-zero exit code.
+ */
+export async function runBackupCli(argv, options) {
+    try {
+        const verifyMode = argv.includes('--verify');
+        const verify = argument(argv, '--input') ?? argument(argv, '--verify');
+        if (verifyMode) {
+            if (!verify || verify.startsWith('--'))
+                throw new Error(`Usage: backup:verify -- --input <${options.exampleFile}>`);
+            const manifest = options.service.validateBackup(path.resolve(verify));
+            console.log(JSON.stringify({ valid: true, manifest }, null, 2));
+            return;
+        }
+        options.database.open();
+        try {
+            const output = argument(argv, '--output');
+            console.log(JSON.stringify(await options.service.createBackup(output ? path.resolve(output) : undefined), null, 2));
+        }
+        finally {
+            options.database.close();
+        }
+    }
+    catch (error) {
+        fail(error);
+    }
+}
+/** The command line of `restore`: `--input <file>` and the extra flag are both required. */
+export async function runRestoreCli(argv, options) {
+    const input = argument(argv, '--input');
+    const extra = argument(argv, options.extra.flag);
+    if (!input || !extra) {
+        console.error(`Usage: restore --input <${options.exampleFile}> ${options.extra.flag} ${options.extra.placeholder}`);
+        process.exitCode = 1;
+        return;
+    }
+    try {
+        console.log(JSON.stringify(await options.restore(path.resolve(input), extra), null, 2));
+    }
+    catch (error) {
+        fail(error);
+    }
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAA;AAG5B,SAAS,QAAQ,CAAC,IAAc,EAAE,IAAY;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAChC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACjD,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IAC7D,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;AACtB,CAAC;AAUD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAc,EAAE,OAAyB;IAC1E,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;QAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QACtE,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,OAAO,CAAC,WAAW,GAAG,CAAC,CAAA;YACnH,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;YACrE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YAC/D,OAAM;QACR,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;YACzC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QACrH,CAAC;gBAAS,CAAC;YAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAAC,CAAC;AACjC,CAAC;AASD,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,OAA0B;IAC5E,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAChD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,CAAC,KAAK,CAAC,2BAA2B,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;QACnH,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;QACpB,OAAM;IACR,CAAC;IACD,IAAI,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAAC,CAAC;IAC/F,OAAO,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAAC,CAAC;AAC/B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export { createArchiveFormat, type ArchiveEntry, type ArchiveFormat } from './archive.js';
+export { collectFiles, createBackupService, DEFAULT_BACKUP_CONFIG, DEFAULT_BACKUP_STATUS, INTERRUPTED_BACKUP_ERROR, type BackupConfig, type BackupInfo, type BackupManifest, type BackupService, type BackupServiceOptions, type BackupStatus, type ProcessOwner, } from './service.js';
+export { createRestore, replaceFile, type RestoreExtras, type RestoreOptions, type RestoreResult } from './restore.js';
+export { createBackupRunner, spawnBackupWorker, type BackupJob, type BackupWorkerOptions } from './runner.js';
+export { createBackupScheduler, scheduleExpression, type BackupSchedulerOptions } from './scheduler.js';
+export { createBackupRoutes, type BackupRoutesOptions } from './routes.js';
+export { runBackupCli, runRestoreCli, type BackupCliOptions, type RestoreCliOptions } from './cli.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAA;AACzF,OAAO,EACL,YAAY,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,wBAAwB,EACzG,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,KAAK,oBAAoB,EAAE,KAAK,YAAY,EAAE,KAAK,YAAY,GAC7I,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,KAAK,aAAa,EAAE,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAA;AACtH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,KAAK,SAAS,EAAE,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAC7G,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvG,OAAO,EAAE,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAC1E,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,MAAM,UAAU,CAAA"}

package/dist/index.js

@@ -0,0 +1,8 @@
+export { createArchiveFormat } from './archive.js';
+export { collectFiles, createBackupService, DEFAULT_BACKUP_CONFIG, DEFAULT_BACKUP_STATUS, INTERRUPTED_BACKUP_ERROR, } from './service.js';
+export { createRestore, replaceFile } from './restore.js';
+export { createBackupRunner, spawnBackupWorker } from './runner.js';
+export { createBackupScheduler, scheduleExpression } from './scheduler.js';
+export { createBackupRoutes } from './routes.js';
+export { runBackupCli, runRestoreCli } from './cli.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAyC,MAAM,cAAc,CAAA;AACzF,OAAO,EACL,YAAY,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,wBAAwB,GAE1G,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,aAAa,EAAE,WAAW,EAA+D,MAAM,cAAc,CAAA;AACtH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAA4C,MAAM,aAAa,CAAA;AAC7G,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAA+B,MAAM,gBAAgB,CAAA;AACvG,OAAO,EAAE,kBAAkB,EAA4B,MAAM,aAAa,CAAA;AAC1E,OAAO,EAAE,YAAY,EAAE,aAAa,EAAiD,MAAM,UAAU,CAAA"}

package/dist/restore.d.ts

@@ -0,0 +1,42 @@
+import type { BackupManifest, BackupService } from './service.js';
+export interface RestoreResult {
+    restoredAt: number;
+    safetyBackup: string | null;
+}
+/** Puts `source` at `target` by copying beside it and renaming, so a failure never leaves half a file. */
+export declare function replaceFile(source: string, target: string): void;
+/** The files around the database that a restore replaces, and how to put the old ones back. */
+export interface RestoreExtras {
+    /** Copies what is there now into `rollbackDir`. */
+    save: (rollbackDir: string) => void;
+    /** Replaces what is there with what the backup holds (extracted into `extractedDir`). */
+    apply: (extractedDir: string) => void;
+    /** Puts back what `save` kept (and removes what the failed restore created). */
+    rollback: (rollbackDir: string) => void;
+}
+export interface RestoreOptions<Manifest extends BackupManifest> {
+    service: BackupService<Manifest>;
+    name: string;
+    /** How the application is called in the messages shown to its operator. */
+    displayName: string;
+    databasePath: () => string;
+    /** Throws unless the application is stopped. */
+    assertStopped: () => void;
+    /** The application's own database handle: opened to take the safety backup and to migrate what was restored. */
+    database: {
+        open: () => void;
+        close: () => void;
+        migrate: () => void;
+    };
+    /** Called once the restore is about to replace files; the flags it captures describe what existed before. */
+    extras: () => RestoreExtras;
+}
+/**
+ * Restores a backup over a stopped application. A safety backup of what is there now is taken first, and a failure
+ * half way puts every replaced file back.
+ */
+export declare function createRestore<Manifest extends BackupManifest>(options: RestoreOptions<Manifest>): (input: string, hooks?: {
+    prepare?: () => void;
+    check?: (manifest: Manifest) => void;
+}) => Promise<RestoreResult>;
+//# sourceMappingURL=restore.d.ts.map

package/dist/restore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"restore.d.ts","sourceRoot":"","sources":["../src/restore.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAEjE,MAAM,WAAW,aAAa;IAAG,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AAElF,0GAA0G;AAC1G,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAKhE;AAOD,+FAA+F;AAC/F,MAAM,WAAW,aAAa;IAC5B,mDAAmD;IACnD,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,IAAI,CAAA;IACnC,yFAAyF;IACzF,KAAK,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,IAAI,CAAA;IACrC,gFAAgF;IAChF,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,IAAI,CAAA;CACxC;AAED,MAAM,WAAW,cAAc,CAAC,QAAQ,SAAS,cAAc;IAC7D,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,MAAM,CAAA;IAC1B,gDAAgD;IAChD,aAAa,EAAE,MAAM,IAAI,CAAA;IACzB,gHAAgH;IAChH,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,IAAI,CAAA;KAAE,CAAA;IACtE,6GAA6G;IAC7G,MAAM,EAAE,MAAM,aAAa,CAAA;CAC5B;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,SAAS,cAAc,EAAE,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC,IAQ5F,OAAO,MAAM,EACb,QAAO;IAAE,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,IAAI,CAAA;CAAO,KACzE,OAAO,CAAC,aAAa,CAAC,CAmD1B"}

package/dist/restore.js

@@ -0,0 +1,89 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { DatabaseSync } from 'node:sqlite';
+/** Puts `source` at `target` by copying beside it and renaming, so a failure never leaves half a file. */
+export function replaceFile(source, target) {
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    const incoming = `${target}.restore-incoming`;
+    fs.copyFileSync(source, incoming);
+    fs.renameSync(incoming, target);
+}
+function removeSqliteSidecars(dbPath) {
+    fs.rmSync(`${dbPath}-wal`, { force: true });
+    fs.rmSync(`${dbPath}-shm`, { force: true });
+}
+/**
+ * Restores a backup over a stopped application. A safety backup of what is there now is taken first, and a failure
+ * half way puts every replaced file back.
+ */
+export function createRestore(options) {
+    const { service, database } = options;
+    /**
+     * `prepare` runs before the backup is read (to set up the key it will need); `check` may refuse the backup by
+     * throwing, once its manifest is known.
+     */
+    return async function restoreBackup(input, hooks = {}) {
+        options.assertStopped();
+        hooks.prepare?.();
+        const manifest = service.validateBackup(input);
+        hooks.check?.(manifest);
+        const dbPath = options.databasePath();
+        if (fs.existsSync(dbPath)) {
+            const lockCheck = new DatabaseSync(dbPath);
+            try {
+                lockCheck.exec('PRAGMA busy_timeout=0; BEGIN EXCLUSIVE; ROLLBACK');
+            }
+            catch {
+                lockCheck.close();
+                throw new Error(`Database is in use. Stop ${options.displayName} before restoring.`);
+            }
+            lockCheck.close();
+        }
+        let safetyBackup = null;
+        if (fs.existsSync(dbPath)) {
+            database.open();
+            try {
+                safetyBackup = (await service.createBackup()).filename;
+            }
+            finally {
+                database.close();
+            }
+        }
+        const temp = fs.mkdtempSync(path.join(os.tmpdir(), `${options.name}-restore-`));
+        const rollback = fs.mkdtempSync(path.join(os.tmpdir(), `${options.name}-rollback-`));
+        const hadDatabase = fs.existsSync(dbPath);
+        const extras = options.extras();
+        try {
+            service.extractArchive(input, temp);
+            if (fs.existsSync(dbPath))
+                fs.copyFileSync(dbPath, path.join(rollback, 'database.sqlite'));
+            extras.save(rollback);
+            try {
+                removeSqliteSidecars(dbPath);
+                replaceFile(path.join(temp, 'database.sqlite'), dbPath);
+                extras.apply(temp);
+                database.open();
+                database.migrate();
+                database.close();
+            }
+            catch (error) {
+                database.close();
+                removeSqliteSidecars(dbPath);
+                const oldDb = path.join(rollback, 'database.sqlite');
+                if (fs.existsSync(oldDb))
+                    replaceFile(oldDb, dbPath);
+                else if (!hadDatabase)
+                    fs.rmSync(dbPath, { force: true });
+                extras.rollback(rollback);
+                throw error;
+            }
+            return { restoredAt: Date.now(), safetyBackup };
+        }
+        finally {
+            fs.rmSync(temp, { recursive: true, force: true });
+            fs.rmSync(rollback, { recursive: true, force: true });
+        }
+    };
+}
+//# sourceMappingURL=restore.js.map

package/dist/restore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"restore.js","sourceRoot":"","sources":["../src/restore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAK1C,0GAA0G;AAC1G,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,MAAc;IACxD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACvD,MAAM,QAAQ,GAAG,GAAG,MAAM,mBAAmB,CAAA;IAC7C,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACjC,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;AACjC,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAc;IAC1C,EAAE,CAAC,MAAM,CAAC,GAAG,MAAM,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3C,EAAE,CAAC,MAAM,CAAC,GAAG,MAAM,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AAC7C,CAAC;AA0BD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAkC,OAAiC;IAC9F,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IAErC;;;OAGG;IACH,OAAO,KAAK,UAAU,aAAa,CACjC,KAAa,EACb,QAAwE,EAAE;QAE1E,OAAO,CAAC,aAAa,EAAE,CAAA;QACvB,KAAK,CAAC,OAAO,EAAE,EAAE,CAAA;QACjB,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;QAC9C,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAA;QAEvB,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAA;QACrC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAA;YAC1C,IAAI,CAAC;gBAAC,SAAS,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAA;YAAC,CAAC;YAC1E,MAAM,CAAC;gBAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,CAAC,WAAW,oBAAoB,CAAC,CAAA;YAAC,CAAC;YACjH,SAAS,CAAC,KAAK,EAAE,CAAA;QACnB,CAAC;QAED,IAAI,YAAY,GAAkB,IAAI,CAAA;QACtC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,EAAE,CAAA;YACf,IAAI,CAAC;gBAAC,YAAY,GAAG,CAAC,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAA;YAAC,CAAC;oBAAS,CAAC;gBAAC,QAAQ,CAAC,KAAK,EAAE,CAAA;YAAC,CAAC;QAC7F,CAAC;QAED,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,WAAW,CAAC,CAAC,CAAA;QAC/E,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,YAAY,CAAC,CAAC,CAAA;QACpF,MAAM,WAAW,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAA;QAC/B,IAAI,CAAC;YACH,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;YACnC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAA;YAC1F,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAErB,IAAI,CAAC;gBACH,oBAAoB,CAAC,MAAM,CAAC,CAAA;gBAC5B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC,CAAA;gBACvD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBAClB,QAAQ,CAAC,IAAI,EAAE,CAAA;gBACf,QAAQ,CAAC,OAAO,EAAE,CAAA;gBAClB,QAAQ,CAAC,KAAK,EAAE,CAAA;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,QAAQ,CAAC,KAAK,EAAE,CAAA;gBAChB,oBAAoB,CAAC,MAAM,CAAC,CAAA;gBAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAA;gBACpD,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;oBAAE,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;qBAC/C,IAAI,CAAC,WAAW;oBAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBACzD,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;gBACzB,MAAM,KAAK,CAAA;YACb,CAAC;YACD,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,CAAA;QACjD,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YACjD,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACvD,CAAC;IACH,CAAC,CAAA;AACH,CAAC"}

package/dist/routes.d.ts

@@ -0,0 +1,23 @@
+import type { FastifyInstance, FastifyRequest } from 'fastify';
+import type { Audit } from '@better-forge/audit';
+import { type BackupInfo, type BackupManifest, type BackupService } from './service.js';
+export interface BackupRoutesOptions<Manifest extends BackupManifest> {
+    service: BackupService<Manifest>;
+    audit: Audit;
+    /** The signed-in caller of a request (the routes sit behind the application's own guards). */
+    identity: (req: FastifyRequest) => {
+        userId: number;
+        email: string;
+    };
+    /** Makes a backup (on a worker thread, in the application). */
+    createBackup: () => Promise<BackupInfo>;
+    /** Verifies a backup file (on a worker thread, in the application). */
+    validateBackup: (input: string) => Promise<Manifest>;
+    /** Called after the schedule changed, to apply it. */
+    restartScheduler: () => void;
+    /** Fields added to the answer of a verification, next to the manifest (e.g. whether a key matches). */
+    describeManifest?: (manifest: Manifest) => Record<string, unknown>;
+}
+/** The admin routes of the backups: list, create, schedule, download, delete and verify an uploaded file. */
+export declare function createBackupRoutes<Manifest extends BackupManifest>(options: BackupRoutesOptions<Manifest>): (app: FastifyInstance) => Promise<void>;
+//# sourceMappingURL=routes.d.ts.map

package/dist/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAM9D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAA4C,KAAK,UAAU,EAAE,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAA;AAMjI,MAAM,WAAW,mBAAmB,CAAC,QAAQ,SAAS,cAAc;IAClE,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;IAChC,KAAK,EAAE,KAAK,CAAA;IACZ,8FAA8F;IAC9F,QAAQ,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IACpE,+DAA+D;IAC/D,YAAY,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAA;IACvC,uEAAuE;IACvE,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACpD,sDAAsD;IACtD,gBAAgB,EAAE,MAAM,IAAI,CAAA;IAC5B,uGAAuG;IACvG,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnE;AAiBD,6GAA6G;AAC7G,wBAAgB,kBAAkB,CAAC,QAAQ,SAAS,cAAc,EAAE,OAAO,EAAE,mBAAmB,CAAC,QAAQ,CAAC,IAIrE,KAAK,eAAe,mBAkExD"}

package/dist/routes.js

@@ -0,0 +1,111 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { pipeline } from 'node:stream/promises';
+import { DEFAULT_BACKUP_CONFIG } from './service.js';
+/** Largest backup file the verification accepts. */
+const MAX_VALIDATION_BYTES = 2 * 1024 * 1024 * 1024;
+function parseConfig(value) {
+    const config = { ...DEFAULT_BACKUP_CONFIG, ...value };
+    if (!['daily', 'weekly'].includes(config.frequency))
+        throw new Error('Invalid frequency');
+    if (!Number.isInteger(config.hour) || config.hour < 0 || config.hour > 23)
+        throw new Error('Hour must be between 0 and 23');
+    if (!Number.isInteger(config.minute) || config.minute < 0 || config.minute > 59)
+        throw new Error('Minute must be between 0 and 59');
+    if (!Number.isInteger(config.weekday) || config.weekday < 0 || config.weekday > 6)
+        throw new Error('Weekday must be between 0 and 6');
+    if (!Number.isInteger(config.retention) || config.retention < 1 || config.retention > 365)
+        throw new Error('Retention must be between 1 and 365');
+    return config;
+}
+const messageOf = (error) => error instanceof Error ? error.message : String(error);
+/** The admin routes of the backups: list, create, schedule, download, delete and verify an uploaded file. */
+export function createBackupRoutes(options) {
+    const { service, audit } = options;
+    const actor = (req) => audit.actor(options.identity(req));
+    return async function backupRoutes(app) {
+        app.get('/', async () => ({ backups: service.listBackups(), config: service.readBackupConfig(), status: service.readBackupStatus() }));
+        app.post('/', async (req, reply) => {
+            try {
+                const result = await options.createBackup();
+                service.applyRetention(service.readBackupConfig().retention);
+                await audit.write(actor(req), 'create', 'backup', result.filename, result.filename);
+                return result;
+            }
+            catch (error) {
+                return reply.code(409).send({ error: messageOf(error) });
+            }
+        });
+        app.put('/config', async (req, reply) => {
+            try {
+                const config = parseConfig(req.body);
+                service.writeBackupConfig(config);
+                service.applyRetention(config.retention);
+                options.restartScheduler();
+                await audit.write(actor(req), 'update', 'backup-config', null, 'Backup schedule', {
+                    enabled: config.enabled,
+                    frequency: config.frequency,
+                    hour: config.hour,
+                    minute: config.minute,
+                    weekday: config.weekday,
+                    retention: config.retention,
+                });
+                return config;
+            }
+            catch (error) {
+                return reply.code(400).send({ error: messageOf(error) });
+            }
+        });
+        app.get('/:filename/download', async (req, reply) => {
+            try {
+                const file = service.backupFile(req.params.filename);
+                if (!fs.existsSync(file))
+                    return reply.code(404).send({ error: 'Backup not found' });
+                await audit.write(actor(req), 'allow', 'backup', req.params.filename, req.params.filename, { access: 'downloaded' });
+                reply.header('Content-Type', 'application/octet-stream');
+                reply.header('Content-Disposition', `attachment; filename="${path.basename(file)}"`);
+                return reply.send(fs.createReadStream(file));
+            }
+            catch (error) {
+                return reply.code(400).send({ error: messageOf(error) });
+            }
+        });
+        app.delete('/:filename', async (req, reply) => {
+            try {
+                if (req.query.confirm !== req.params.filename)
+                    return reply.code(400).send({ error: 'Type the exact backup filename to confirm deletion' });
+                const file = service.backupFile(req.params.filename);
+                if (!fs.existsSync(file))
+                    return reply.code(404).send({ error: 'Backup not found' });
+                fs.rmSync(file);
+                await audit.write(actor(req), 'delete', 'backup', req.params.filename, req.params.filename);
+                return reply.code(204).send();
+            }
+            catch (error) {
+                return reply.code(400).send({ error: messageOf(error) });
+            }
+        });
+        app.post('/validate', async (req, reply) => {
+            const data = await req.file({ limits: { fileSize: MAX_VALIDATION_BYTES } });
+            if (!data)
+                return reply.code(400).send({ error: 'No backup file' });
+            const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'backup-upload-'));
+            const input = path.join(tempDir, 'backup.backup');
+            try {
+                await pipeline(data.file, fs.createWriteStream(input, { mode: 0o600 }));
+                if (data.file.truncated)
+                    throw new Error('Backup file exceeds the 2 GB validation limit');
+                const manifest = await options.validateBackup(input);
+                return { valid: true, manifest, ...options.describeManifest?.(manifest) };
+            }
+            catch (error) {
+                return reply.code(400).send({ error: messageOf(error) });
+            }
+            finally {
+                fs.rmSync(tempDir, { recursive: true, force: true });
+            }
+        });
+    };
+}
+//# sourceMappingURL=routes.js.map

package/dist/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,MAAM,SAAS,CAAA;AAExB,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAE/C,OAAO,EAAE,qBAAqB,EAA+E,MAAM,cAAc,CAAA;AAqBjI,oDAAoD;AACpD,MAAM,oBAAoB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAA;AAEnD,SAAS,WAAW,CAAC,KAA4B;IAC/C,MAAM,MAAM,GAAG,EAAE,GAAG,qBAAqB,EAAE,GAAG,KAAK,EAAE,CAAA;IACrD,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;IACzF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAC3H,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACnI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACrI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,GAAG,CAAC,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACjJ,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAE5F,6GAA6G;AAC7G,MAAM,UAAU,kBAAkB,CAAkC,OAAsC;IACxG,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IAClC,MAAM,KAAK,GAAG,CAAC,GAAmB,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IAEzE,OAAO,KAAK,UAAU,YAAY,CAAC,GAAoB;QACrD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAA;QAEtI,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACjC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAA;gBAC3C,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,SAAS,CAAC,CAAA;gBAC5D,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;gBACnF,OAAO,MAAM,CAAA;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAAC,CAAC;QAC9E,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,GAAG,CAAkC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACvE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;gBACpC,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;gBACjC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;gBACxC,OAAO,CAAC,gBAAgB,EAAE,CAAA;gBAC1B,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE;oBAChF,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC5B,CAAC,CAAA;gBACF,OAAO,MAAM,CAAA;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAAC,CAAC;QAC9E,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,GAAG,CAAmC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACpF,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;gBACpD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;gBACpF,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAA;gBACpH,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAA;gBACxD,KAAK,CAAC,MAAM,CAAC,qBAAqB,EAAE,yBAAyB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpF,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAA;YAC9C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAAC,CAAC;QAC9E,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,MAAM,CAAsE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACjH,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,GAAG,CAAC,MAAM,CAAC,QAAQ;oBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC,CAAA;gBAC3I,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;gBACpD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;gBACpF,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBACf,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;gBAC3F,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;YAC/B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAAC,CAAC;QAC9E,CAAC,CAAC,CAAA;QAEF,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACzC,MAAM,IAAI,GAAG,MAAO,GAAuC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAA;YAChH,IAAI,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAA;YACnE,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAA;YACxE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAA;YACjD,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;gBACvE,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;gBACzF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;gBACpD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAA;YAC3E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAAC,CAAC;oBACpE,CAAC;gBAAC,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YAAC,CAAC;QAClE,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC"}