@budibase/server 2.7.7-alpha.7 → 2.7.7-alpha.9

package/dist/index.js

@@ -9305,7 +9305,7 @@ function lowerBuiltinRoleID(roleId1, roleId2) {
   }
   return builtinRoleToNumber(roleId1) > builtinRoleToNumber(roleId2) ? roleId2 : roleId1;
 }
-async function getRole(roleId) {
+async function getRole(roleId, opts) {
   if (!roleId) {
     return void 0;
   }
@@ -9321,6 +9321,9 @@ async function getRole(roleId) {
     role = Object.assign(role, dbRole);
     role._id = getExternalRoleID(role._id);
   } catch (err) {
+    if (!isBuiltin(roleId) && (opts == null ? void 0 : opts.defaultPublic)) {
+      return cloneDeep2(BUILTIN_ROLES.PUBLIC);
+    }
     if (Object.keys(role).length === 0) {
       throw err;
     }
@@ -10158,7 +10161,9 @@ var encryption_exports = {};
 __export(encryption_exports, {
   SecretOption: () => SecretOption,
   decrypt: () => decrypt,
+  decryptFile: () => decryptFile,
   encrypt: () => encrypt,
+  encryptFile: () => encryptFile,
   getSecret: () => getSecret
 });
 function getSecret(secretOption) {
@@ -10179,11 +10184,11 @@ function getSecret(secretOption) {
   }
   return secret;
 }
-function stretchString(string, salt) {
-  return import_crypto.default.pbkdf2Sync(string, salt, ITERATIONS, STRETCH_LENGTH, "sha512");
+function stretchString(secret, salt) {
+  return import_crypto.default.pbkdf2Sync(secret, salt, ITERATIONS, STRETCH_LENGTH, "sha512");
 }
 function encrypt(input, secretOption = "api" /* API */) {
-  const salt = import_crypto.default.randomBytes(RANDOM_BYTES);
+  const salt = import_crypto.default.randomBytes(SALT_LENGTH);
   const stretched = stretchString(getSecret(secretOption), salt);
   const cipher = import_crypto.default.createCipheriv(ALGO, stretched, salt);
   const base = cipher.update(input);
@@ -10200,16 +10205,101 @@ function decrypt(input, secretOption = "api" /* API */) {
   const final = decipher.final();
   return Buffer.concat([base, final]).toString();
 }
-var import_crypto, ALGO, SEPARATOR3, ITERATIONS, RANDOM_BYTES, STRETCH_LENGTH, SecretOption;
+async function encryptFile({ dir, filename }, secret) {
+  const outputFileName = `${filename}.enc`;
+  const filePath = (0, import_path.join)(dir, filename);
+  const inputFile = import_fs2.default.createReadStream(filePath);
+  const outputFile = import_fs2.default.createWriteStream((0, import_path.join)(dir, outputFileName));
+  const salt = import_crypto.default.randomBytes(SALT_LENGTH);
+  const iv = import_crypto.default.randomBytes(IV_LENGTH);
+  const stretched = stretchString(secret, salt);
+  const cipher = import_crypto.default.createCipheriv(ALGO, stretched, iv);
+  outputFile.write(salt);
+  outputFile.write(iv);
+  inputFile.pipe(import_zlib.default.createGzip()).pipe(cipher).pipe(outputFile);
+  return new Promise((r) => {
+    outputFile.on("finish", () => {
+      r({
+        filename: outputFileName,
+        dir
+      });
+    });
+  });
+}
+async function getSaltAndIV(path5) {
+  const fileStream = import_fs2.default.createReadStream(path5);
+  const salt = await readBytes(fileStream, SALT_LENGTH);
+  const iv = await readBytes(fileStream, IV_LENGTH);
+  fileStream.close();
+  return { salt, iv };
+}
+async function decryptFile(inputPath, outputPath, secret) {
+  const { salt, iv } = await getSaltAndIV(inputPath);
+  const inputFile = import_fs2.default.createReadStream(inputPath, {
+    start: SALT_LENGTH + IV_LENGTH
+  });
+  const outputFile = import_fs2.default.createWriteStream(outputPath);
+  const stretched = stretchString(secret, salt);
+  const decipher = import_crypto.default.createDecipheriv(ALGO, stretched, iv);
+  const unzip = import_zlib.default.createGunzip();
+  inputFile.pipe(decipher).pipe(unzip).pipe(outputFile);
+  return new Promise((res, rej) => {
+    outputFile.on("finish", () => {
+      outputFile.close();
+      res();
+    });
+    inputFile.on("error", (e) => {
+      outputFile.close();
+      rej(e);
+    });
+    decipher.on("error", (e) => {
+      outputFile.close();
+      rej(e);
+    });
+    unzip.on("error", (e) => {
+      outputFile.close();
+      rej(e);
+    });
+    outputFile.on("error", (e) => {
+      outputFile.close();
+      rej(e);
+    });
+  });
+}
+function readBytes(stream3, length) {
+  return new Promise((resolve3, reject) => {
+    let bytesRead = 0;
+    const data2 = [];
+    stream3.on("readable", () => {
+      let chunk;
+      while ((chunk = stream3.read(length - bytesRead)) !== null) {
+        data2.push(chunk);
+        bytesRead += chunk.length;
+      }
+      resolve3(Buffer.concat(data2));
+    });
+    stream3.on("end", () => {
+      reject(new Error("Insufficient data in the stream."));
+    });
+    stream3.on("error", (error2) => {
+      reject(error2);
+    });
+  });
+}
+var import_crypto, import_fs2, import_zlib, import_path, ALGO, SEPARATOR3, ITERATIONS, STRETCH_LENGTH, SALT_LENGTH, IV_LENGTH, SecretOption;
 var init_encryption = __esm({
   "../backend-core/src/security/encryption.ts"() {
     import_crypto = __toESM(require("crypto"));
+    import_fs2 = __toESM(require("fs"));
+    import_zlib = __toESM(require("zlib"));
     init_environment2();
+    import_path = require("path");
     ALGO = "aes-256-ctr";
     SEPARATOR3 = "-";
     ITERATIONS = 1e4;
-    RANDOM_BYTES = 16;
     STRETCH_LENGTH = 32;
+    SALT_LENGTH = 16;
+    IV_LENGTH = 16;
     SecretOption = /* @__PURE__ */ ((SecretOption2) => {
       SecretOption2["API"] = "api";
       SecretOption2["ENCRYPTION"] = "encryption";
@@ -11120,12 +11210,12 @@ var init_plugin4 = __esm({
 function budibaseTempDir() {
   return bbTmp;
 }
-var import_path, import_os, import_fs2, ObjectStoreBuckets, bbTmp;
+var import_path2, import_os, import_fs3, ObjectStoreBuckets, bbTmp;
 var init_utils8 = __esm({
   "../backend-core/src/objectStore/utils.ts"() {
-    import_path = require("path");
+    import_path2 = require("path");
     import_os = require("os");
-    import_fs2 = __toESM(require("fs"));
+    import_fs3 = __toESM(require("fs"));
     init_environment2();
     ObjectStoreBuckets = {
       BACKUPS: environment_default.BACKUPS_BUCKET_NAME,
@@ -11134,9 +11224,9 @@ var init_utils8 = __esm({
       GLOBAL: environment_default.GLOBAL_BUCKET_NAME,
       PLUGINS: environment_default.PLUGIN_BUCKET_NAME
     };
-    bbTmp = (0, import_path.join)((0, import_os.tmpdir)(), ".budibase");
-    if (!import_fs2.default.existsSync(bbTmp)) {
-      import_fs2.default.mkdirSync(bbTmp);
+    bbTmp = (0, import_path2.join)((0, import_os.tmpdir)(), ".budibase");
+    if (!import_fs3.default.existsSync(bbTmp)) {
+      import_fs3.default.mkdirSync(bbTmp);
     }
   }
 });
@@ -11148,17 +11238,17 @@ function sanitizeKey(input) {
 function sanitizeBucket(input) {
   return input.replace(new RegExp(APP_DEV_PREFIX, "g"), APP_PREFIX);
 }
-var import_aws_sdk, import_stream, import_node_fetch6, import_tar_fs, import_zlib, import_util, import_path2, import_fs3, import_uuid3, sanitize, streamPipeline, STATE, CONTENT_TYPE_MAP, STRING_CONTENT_TYPES, ObjectStore, makeSureBucketExists, upload, streamUpload, retrieve, listAllObjects, getPresignedUrl, retrieveToTmp, retrieveDirectory, deleteFile, deleteFiles, deleteFolder, uploadDirectory, downloadTarballDirect, downloadTarball;
+var import_aws_sdk, import_stream, import_node_fetch6, import_tar_fs, import_zlib2, import_util, import_path3, import_fs4, import_uuid3, sanitize, streamPipeline, STATE, CONTENT_TYPE_MAP, STRING_CONTENT_TYPES, ObjectStore, makeSureBucketExists, upload, streamUpload, retrieve, listAllObjects, getPresignedUrl, retrieveToTmp, retrieveDirectory, deleteFile, deleteFiles, deleteFolder, uploadDirectory, downloadTarballDirect, downloadTarball;
 var init_objectStore = __esm({
   "../backend-core/src/objectStore/objectStore.ts"() {
     import_aws_sdk = __toESM(require("aws-sdk"));
     import_stream = __toESM(require("stream"));
     import_node_fetch6 = __toESM(require("node-fetch"));
     import_tar_fs = __toESM(require("tar-fs"));
-    import_zlib = __toESM(require("zlib"));
+    import_zlib2 = __toESM(require("zlib"));
     import_util = require("util");
-    import_path2 = require("path");
-    import_fs3 = __toESM(require("fs"));
+    import_path3 = require("path");
+    import_fs4 = __toESM(require("fs"));
     init_environment2();
     init_utils8();
     import_uuid3 = require("uuid");
@@ -11237,7 +11327,7 @@ var init_objectStore = __esm({
       metadata
     }) => {
       const extension = filename.split(".").pop();
-      const fileBytes = import_fs3.default.readFileSync(path5);
+      const fileBytes = import_fs4.default.readFileSync(path5);
       const objectStore = ObjectStore(bucketName);
       await makeSureBucketExists(objectStore, bucketName);
       let contentType = type;
@@ -11339,13 +11429,13 @@ var init_objectStore = __esm({
       bucketName = sanitizeBucket(bucketName);
       filepath = sanitizeKey(filepath);
       const data2 = await retrieve(bucketName, filepath);
-      const outputPath = (0, import_path2.join)(budibaseTempDir(), (0, import_uuid3.v4)());
-      import_fs3.default.writeFileSync(outputPath, data2);
+      const outputPath = (0, import_path3.join)(budibaseTempDir(), (0, import_uuid3.v4)());
+      import_fs4.default.writeFileSync(outputPath, data2);
       return outputPath;
     };
     retrieveDirectory = async (bucketName, path5) => {
-      let writePath = (0, import_path2.join)(budibaseTempDir(), (0, import_uuid3.v4)());
-      import_fs3.default.mkdirSync(writePath);
+      let writePath = (0, import_path3.join)(budibaseTempDir(), (0, import_uuid3.v4)());
+      import_fs4.default.mkdirSync(writePath);
       const objects = await listAllObjects(bucketName, path5);
       let fullObjects = await Promise.all(
         objects.map((obj) => retrieve(bucketName, obj.Key))
@@ -11357,9 +11447,9 @@ var init_objectStore = __esm({
         const possiblePath = filename.split("/");
         if (possiblePath.length > 1) {
           const dirs = possiblePath.slice(0, possiblePath.length - 1);
-          import_fs3.default.mkdirSync((0, import_path2.join)(writePath, ...dirs), { recursive: true });
+          import_fs4.default.mkdirSync((0, import_path3.join)(writePath, ...dirs), { recursive: true });
         }
-        import_fs3.default.writeFileSync((0, import_path2.join)(writePath, ...possiblePath), data2);
+        import_fs4.default.writeFileSync((0, import_path3.join)(writePath, ...possiblePath), data2);
       }
       return writePath;
     };
@@ -11413,14 +11503,14 @@ var init_objectStore = __esm({
     uploadDirectory = async (bucketName, localPath, bucketPath) => {
       bucketName = sanitizeBucket(bucketName);
       let uploads = [];
-      const files = import_fs3.default.readdirSync(localPath, { withFileTypes: true });
+      const files = import_fs4.default.readdirSync(localPath, { withFileTypes: true });
       for (let file of files) {
-        const path5 = sanitizeKey((0, import_path2.join)(bucketPath, file.name));
-        const local = (0, import_path2.join)(localPath, file.name);
+        const path5 = sanitizeKey((0, import_path3.join)(bucketPath, file.name));
+        const local = (0, import_path3.join)(localPath, file.name);
         if (file.isDirectory()) {
           uploads.push(uploadDirectory(bucketName, local, path5));
         } else {
-          uploads.push(streamUpload(bucketName, path5, import_fs3.default.createReadStream(local)));
+          uploads.push(streamUpload(bucketName, path5, import_fs4.default.createReadStream(local)));
         }
       }
       await Promise.all(uploads);
@@ -11432,7 +11522,7 @@ var init_objectStore = __esm({
       if (!response2.ok) {
         throw new Error(`unexpected response ${response2.statusText}`);
       }
-      await streamPipeline(response2.body, import_zlib.default.createUnzip(), import_tar_fs.default.extract(path5));
+      await streamPipeline(response2.body, import_zlib2.default.createUnzip(), import_tar_fs.default.extract(path5));
     };
     downloadTarball = async (url, bucketName, path5) => {
       bucketName = sanitizeBucket(bucketName);
@@ -11441,8 +11531,8 @@ var init_objectStore = __esm({
       if (!response2.ok) {
         throw new Error(`unexpected response ${response2.statusText}`);
       }
-      const tmpPath = (0, import_path2.join)(budibaseTempDir(), path5);
-      await streamPipeline(response2.body, import_zlib.default.createUnzip(), import_tar_fs.default.extract(tmpPath));
+      const tmpPath = (0, import_path3.join)(budibaseTempDir(), path5);
+      await streamPipeline(response2.body, import_zlib2.default.createUnzip(), import_tar_fs.default.extract(tmpPath));
       if (!environment_default.isTest() && environment_default.SELF_HOSTED) {
         await uploadDirectory(bucketName, tmpPath, path5);
       }
@@ -12024,16 +12114,16 @@ var init_constants4 = __esm({
 });
 
 // src/utilities/centralPath.ts
-function join3(...args) {
-  return import_path3.default.join(...args);
+function join4(...args) {
+  return import_path4.default.join(...args);
 }
 function resolve(...args) {
-  return import_path3.default.resolve(...args);
+  return import_path4.default.resolve(...args);
 }
-var import_path3;
+var import_path4;
 var init_centralPath = __esm({
   "src/utilities/centralPath.ts"() {
-    import_path3 = __toESM(require("path"));
+    import_path4 = __toESM(require("path"));
   }
 });
 
@@ -12055,14 +12145,14 @@ function parseIntSafe(number) {
     return parseInt(number);
   }
 }
-var import_path4, LOADED2, environment2, environment_default2;
+var import_path5, LOADED2, environment2, environment_default2;
 var init_environment3 = __esm({
   "src/environment.ts"() {
-    import_path4 = require("path");
+    import_path5 = require("path");
     LOADED2 = false;
     if (!LOADED2 && isDev2() && !isTest2()) {
       require("dotenv").config({
-        path: (0, import_path4.join)(__dirname, "..", ".env")
+        path: (0, import_path5.join)(__dirname, "..", ".env")
       });
       LOADED2 = true;
     }
@@ -12146,22 +12236,22 @@ var init_environment3 = __esm({
 });
 
 // src/utilities/fileSystem/filesystem.ts
-var import_fs4, import_path5, import_tar, uuid2, TOP_LEVEL_PATH, init9, checkDevelopmentEnvironment, loadHandlebarsFile, apiFileReturn, streamFile, createTempFolder, extractTarball, findFileRec, deleteFolderFileSystem;
+var import_fs5, import_path6, import_tar, uuid2, TOP_LEVEL_PATH, init9, checkDevelopmentEnvironment, loadHandlebarsFile, apiFileReturn, streamFile, createTempFolder, extractTarball, findFileRec, deleteFolderFileSystem;
 var init_filesystem = __esm({
   "src/utilities/fileSystem/filesystem.ts"() {
-    import_fs4 = __toESM(require("fs"));
+    import_fs5 = __toESM(require("fs"));
     init_budibaseDir();
-    import_path5 = require("path");
+    import_path6 = require("path");
     init_environment3();
     import_tar = __toESM(require("tar"));
     init_environment3();
     uuid2 = require("uuid/v4");
-    TOP_LEVEL_PATH = environment_default2.TOP_LEVEL_PATH || (0, import_path5.resolve)((0, import_path5.join)(__dirname, "..", "..", ".."));
+    TOP_LEVEL_PATH = environment_default2.TOP_LEVEL_PATH || (0, import_path6.resolve)((0, import_path6.join)(__dirname, "..", "..", ".."));
     init9 = () => {
       const tempDir = budibaseTempDir2();
-      if (!import_fs4.default.existsSync(tempDir)) {
+      if (!import_fs5.default.existsSync(tempDir)) {
         try {
-          import_fs4.default.mkdirSync(tempDir);
+          import_fs5.default.mkdirSync(tempDir);
         } catch (err) {
           if (!err || err.code !== "EEXIST") {
             throw err;
@@ -12173,11 +12263,11 @@ var init_filesystem = __esm({
       if (!environment_default2.isDev() || environment_default2.isTest()) {
         return;
       }
-      if (!import_fs4.default.existsSync(budibaseTempDir2())) {
-        import_fs4.default.mkdirSync(budibaseTempDir2());
+      if (!import_fs5.default.existsSync(budibaseTempDir2())) {
+        import_fs5.default.mkdirSync(budibaseTempDir2());
       }
       let error2;
-      if (!import_fs4.default.existsSync((0, import_path5.join)(process.cwd(), ".env"))) {
+      if (!import_fs5.default.existsSync((0, import_path6.join)(process.cwd(), ".env"))) {
         error2 = "Must run via yarn once to generate environment.";
       }
       if (error2) {
@@ -12186,23 +12276,23 @@ var init_filesystem = __esm({
       }
     };
     loadHandlebarsFile = (path5) => {
-      return import_fs4.default.readFileSync(path5, "utf8");
+      return import_fs5.default.readFileSync(path5, "utf8");
     };
     apiFileReturn = (contents) => {
-      const path5 = (0, import_path5.join)(budibaseTempDir2(), uuid2());
-      import_fs4.default.writeFileSync(path5, contents);
-      return import_fs4.default.createReadStream(path5);
+      const path5 = (0, import_path6.join)(budibaseTempDir2(), uuid2());
+      import_fs5.default.writeFileSync(path5, contents);
+      return import_fs5.default.createReadStream(path5);
     };
     streamFile = (path5) => {
-      return import_fs4.default.createReadStream(path5);
+      return import_fs5.default.createReadStream(path5);
     };
     createTempFolder = (item) => {
-      const path5 = (0, import_path5.join)(budibaseTempDir2(), item);
+      const path5 = (0, import_path6.join)(budibaseTempDir2(), item);
       try {
-        if (import_fs4.default.existsSync(path5)) {
-          import_fs4.default.rmSync(path5, { recursive: true, force: true });
+        if (import_fs5.default.existsSync(path5)) {
+          import_fs5.default.rmSync(path5, { recursive: true, force: true });
         }
-        import_fs4.default.mkdirSync(path5);
+        import_fs5.default.mkdirSync(path5);
       } catch (err) {
         throw new Error(`Path cannot be created: ${err.message}`);
       }
@@ -12215,13 +12305,13 @@ var init_filesystem = __esm({
       });
     };
     findFileRec = (startPath, filter2) => {
-      if (!import_fs4.default.existsSync(startPath)) {
+      if (!import_fs5.default.existsSync(startPath)) {
         return;
       }
-      const files = import_fs4.default.readdirSync(startPath);
+      const files = import_fs5.default.readdirSync(startPath);
       for (let i = 0, len = files.length; i < len; i++) {
-        const filename = (0, import_path5.join)(startPath, files[i]);
-        const stat = import_fs4.default.lstatSync(filename);
+        const filename = (0, import_path6.join)(startPath, files[i]);
+        const stat = import_fs5.default.lstatSync(filename);
         if (stat.isDirectory()) {
           return findFileRec(filename, filter2);
         } else if (filename.endsWith(filter2)) {
@@ -12230,10 +12320,10 @@ var init_filesystem = __esm({
       }
     };
     deleteFolderFileSystem = (path5) => {
-      if (!import_fs4.default.existsSync(path5)) {
+      if (!import_fs5.default.existsSync(path5)) {
         return;
       }
-      import_fs4.default.rmSync(path5, { recursive: true, force: true });
+      import_fs5.default.rmSync(path5, { recursive: true, force: true });
     };
   }
 });
@@ -12247,12 +12337,12 @@ async function backupClientLibrary(appId) {
   try {
     tmpManifestPath = await objectStore_exports2.retrieveToTmp(
       ObjectStoreBuckets2.APPS,
-      (0, import_path6.join)(appId, "manifest.json")
+      (0, import_path7.join)(appId, "manifest.json")
     );
   } catch (error2) {
     tmpManifestPath = await objectStore_exports2.retrieveToTmp(
       ObjectStoreBuckets2.APPS,
-      (0, import_path6.join)(
+      (0, import_path7.join)(
         appId,
         "node_modules",
         "budibase",
@@ -12264,17 +12354,17 @@ async function backupClientLibrary(appId) {
   }
   const tmpClientPath = await objectStore_exports2.retrieveToTmp(
     ObjectStoreBuckets2.APPS,
-    (0, import_path6.join)(appId, "budibase-client.js")
+    (0, import_path7.join)(appId, "budibase-client.js")
   );
   const manifestUpload = objectStore_exports2.upload({
     bucket: ObjectStoreBuckets2.APPS,
-    filename: (0, import_path6.join)(appId, "manifest.json.bak"),
+    filename: (0, import_path7.join)(appId, "manifest.json.bak"),
     path: tmpManifestPath,
     type: "application/json"
   });
   const clientUpload = objectStore_exports2.upload({
     bucket: ObjectStoreBuckets2.APPS,
-    filename: (0, import_path6.join)(appId, "budibase-client.js.bak"),
+    filename: (0, import_path7.join)(appId, "budibase-client.js.bak"),
     path: tmpClientPath,
     type: "application/javascript"
   });
@@ -12284,7 +12374,7 @@ async function updateClientLibrary(appId) {
   let manifest, client3;
   if (environment_default2.isDev()) {
     const clientPath = devClientLibPath();
-    manifest = (0, import_path6.join)(import_path6.default.dirname(import_path6.default.dirname(clientPath)), "manifest.json");
+    manifest = (0, import_path7.join)(import_path7.default.dirname(import_path7.default.dirname(clientPath)), "manifest.json");
     client3 = clientPath;
   } else {
     manifest = resolve(TOP_LEVEL_PATH, "client", "manifest.json");
@@ -12292,16 +12382,16 @@ async function updateClientLibrary(appId) {
   }
   const manifestUpload = objectStore_exports2.streamUpload(
     ObjectStoreBuckets2.APPS,
-    (0, import_path6.join)(appId, "manifest.json"),
-    import_fs5.default.createReadStream(manifest),
+    (0, import_path7.join)(appId, "manifest.json"),
+    import_fs6.default.createReadStream(manifest),
     {
       ContentType: "application/json"
     }
   );
   const clientUpload = objectStore_exports2.streamUpload(
     ObjectStoreBuckets2.APPS,
-    (0, import_path6.join)(appId, "budibase-client.js"),
-    import_fs5.default.createReadStream(client3),
+    (0, import_path7.join)(appId, "budibase-client.js"),
+    import_fs6.default.createReadStream(client3),
     {
       ContentType: "application/javascript"
     }
@@ -12311,32 +12401,32 @@ async function updateClientLibrary(appId) {
 async function revertClientLibrary(appId) {
   const tmpManifestPath = await objectStore_exports2.retrieveToTmp(
     ObjectStoreBuckets2.APPS,
-    (0, import_path6.join)(appId, "manifest.json.bak")
+    (0, import_path7.join)(appId, "manifest.json.bak")
   );
   const tmpClientPath = await objectStore_exports2.retrieveToTmp(
     ObjectStoreBuckets2.APPS,
-    (0, import_path6.join)(appId, "budibase-client.js.bak")
+    (0, import_path7.join)(appId, "budibase-client.js.bak")
   );
   const manifestUpload = objectStore_exports2.upload({
     bucket: ObjectStoreBuckets2.APPS,
-    filename: (0, import_path6.join)(appId, "manifest.json"),
+    filename: (0, import_path7.join)(appId, "manifest.json"),
     path: tmpManifestPath,
     type: "application/json"
   });
   const clientUpload = objectStore_exports2.upload({
     bucket: ObjectStoreBuckets2.APPS,
-    filename: (0, import_path6.join)(appId, "budibase-client.js"),
+    filename: (0, import_path7.join)(appId, "budibase-client.js"),
     path: tmpClientPath,
     type: "application/javascript"
   });
   await Promise.all([manifestUpload, clientUpload]);
 }
-var import_path6, import_fs5;
+var import_path7, import_fs6;
 var init_clientLibrary = __esm({
   "src/utilities/fileSystem/clientLibrary.ts"() {
-    import_path6 = __toESM(require("path"));
+    import_path7 = __toESM(require("path"));
     init_constants4();
-    import_fs5 = __toESM(require("fs"));
+    import_fs6 = __toESM(require("fs"));
     init_src2();
     init_centralPath();
     init_environment3();
@@ -12345,18 +12435,18 @@ var init_clientLibrary = __esm({
 });
 
 // src/utilities/fileSystem/app.ts
-var import_fs6, import_path7, NODE_MODULES_PATH, createApp, deleteApp, getComponentLibraryManifest;
+var import_fs7, import_path8, NODE_MODULES_PATH, createApp, deleteApp, getComponentLibraryManifest;
 var init_app7 = __esm({
   "src/utilities/fileSystem/app.ts"() {
     init_budibaseDir();
-    import_fs6 = __toESM(require("fs"));
-    import_path7 = require("path");
+    import_fs7 = __toESM(require("fs"));
+    import_path8 = require("path");
     init_constants4();
     init_clientLibrary();
     init_environment3();
     init_src2();
     init_filesystem();
-    NODE_MODULES_PATH = (0, import_path7.join)(TOP_LEVEL_PATH, "node_modules");
+    NODE_MODULES_PATH = (0, import_path8.join)(TOP_LEVEL_PATH, "node_modules");
     createApp = async (appId) => {
       await updateClientLibrary(appId);
     };
@@ -12368,11 +12458,11 @@ var init_app7 = __esm({
       const filename = "manifest.json";
       if (environment_default2.isDev() || environment_default2.isTest()) {
         const paths = [
-          (0, import_path7.join)(TOP_LEVEL_PATH, "packages/client", filename),
-          (0, import_path7.join)(process.cwd(), "client", filename)
+          (0, import_path8.join)(TOP_LEVEL_PATH, "packages/client", filename),
+          (0, import_path8.join)(process.cwd(), "client", filename)
         ];
         for (let path6 of paths) {
-          if (import_fs6.default.existsSync(path6)) {
+          if (import_fs7.default.existsSync(path6)) {
             delete require.cache[require.resolve(path6)];
             return require(path6);
           }
@@ -12387,14 +12477,14 @@ var init_app7 = __esm({
       let resp;
       let path5;
       try {
-        path5 = (0, import_path7.join)(appId, filename);
+        path5 = (0, import_path8.join)(appId, filename);
         resp = await objectStore_exports2.retrieve(ObjectStoreBuckets2.APPS, path5);
       } catch (error2) {
         console.error(
           `component-manifest-objectstore=failed appId=${appId} path=${path5}`,
           error2
         );
-        path5 = (0, import_path7.join)(appId, "node_modules", library, "package", filename);
+        path5 = (0, import_path8.join)(appId, "node_modules", library, "package", filename);
         resp = await objectStore_exports2.retrieve(ObjectStoreBuckets2.APPS, path5);
       }
       if (typeof resp !== "string") {
@@ -12409,19 +12499,19 @@ var init_app7 = __esm({
 async function getPluginImpl(path5, plugin) {
   var _a2;
   const hash2 = (_a2 = plugin.schema) == null ? void 0 : _a2.hash;
-  if (!import_fs7.default.existsSync(path5)) {
-    import_fs7.default.mkdirSync(path5);
+  if (!import_fs8.default.existsSync(path5)) {
+    import_fs8.default.mkdirSync(path5);
   }
-  const filename = (0, import_path8.join)(path5, plugin.name);
+  const filename = (0, import_path9.join)(path5, plugin.name);
   const metadataName = `${filename}.bbmetadata`;
-  if (import_fs7.default.existsSync(filename)) {
-    const currentHash = import_fs7.default.readFileSync(metadataName, "utf8");
+  if (import_fs8.default.existsSync(filename)) {
+    const currentHash = import_fs8.default.readFileSync(metadataName, "utf8");
     if (currentHash === hash2) {
       return require(filename);
     } else {
       console.log(`Updating plugin: ${plugin.name}`);
       delete require.cache[require.resolve(filename)];
-      import_fs7.default.unlinkSync(filename);
+      import_fs8.default.unlinkSync(filename);
     }
   }
   const pluginKey = objectStore_exports2.getPluginJSKey(plugin);
@@ -12429,24 +12519,24 @@ async function getPluginImpl(path5, plugin) {
     objectStore_exports2.ObjectStoreBuckets.PLUGINS,
     pluginKey
   );
-  import_fs7.default.writeFileSync(filename, pluginJs);
-  import_fs7.default.writeFileSync(metadataName, hash2);
+  import_fs8.default.writeFileSync(filename, pluginJs);
+  import_fs8.default.writeFileSync(metadataName, hash2);
   return require(filename);
 }
-var import_fs7, import_path8, DATASOURCE_PATH, AUTOMATION_PATH, getPluginMetadata, getDatasourcePlugin, getAutomationPlugin;
+var import_fs8, import_path9, DATASOURCE_PATH, AUTOMATION_PATH, getPluginMetadata, getDatasourcePlugin, getAutomationPlugin;
 var init_plugin5 = __esm({
   "src/utilities/fileSystem/plugin.ts"() {
     init_budibaseDir();
-    import_fs7 = __toESM(require("fs"));
-    import_path8 = require("path");
+    import_fs8 = __toESM(require("fs"));
+    import_path9 = require("path");
     init_src2();
-    DATASOURCE_PATH = (0, import_path8.join)(budibaseTempDir2(), "datasource");
-    AUTOMATION_PATH = (0, import_path8.join)(budibaseTempDir2(), "automation");
+    DATASOURCE_PATH = (0, import_path9.join)(budibaseTempDir2(), "datasource");
+    AUTOMATION_PATH = (0, import_path9.join)(budibaseTempDir2(), "automation");
     getPluginMetadata = async (path5) => {
       let metadata = {};
       try {
-        const pkg2 = import_fs7.default.readFileSync((0, import_path8.join)(path5, "package.json"), "utf8");
-        const schema = import_fs7.default.readFileSync((0, import_path8.join)(path5, "schema.json"), "utf8");
+        const pkg2 = import_fs8.default.readFileSync((0, import_path9.join)(path5, "package.json"), "utf8");
+        const schema = import_fs8.default.readFileSync((0, import_path9.join)(path5, "schema.json"), "utf8");
         metadata.schema = JSON.parse(schema);
         metadata.package = JSON.parse(pkg2);
         if (!metadata.package.name || !metadata.package.version || !metadata.package.description) {
@@ -13714,21 +13804,21 @@ __export(version_exports, {
   getLicenseVersion: () => getLicenseVersion,
   getProVersion: () => getProVersion
 });
-var import_fs8, import_path9, getLicenseVersion, getProVersion;
+var import_fs9, import_path10, getLicenseVersion, getProVersion;
 var init_version2 = __esm({
   "../pro/packages/pro/src/constants/version.ts"() {
     init_src2();
-    import_fs8 = __toESM(require("fs"));
-    import_path9 = __toESM(require("path"));
+    import_fs9 = __toESM(require("fs"));
+    import_path10 = __toESM(require("path"));
     getLicenseVersion = () => {
       if (environment_default.isDev()) {
         const DEV_VER_FILENAME = "dev-version.txt";
-        const verFile = import_path9.default.join(objectStore_exports2.budibaseTempDir(), DEV_VER_FILENAME);
-        if (import_fs8.default.existsSync(verFile)) {
-          return import_fs8.default.readFileSync(verFile, "utf8");
+        const verFile = import_path10.default.join(objectStore_exports2.budibaseTempDir(), DEV_VER_FILENAME);
+        if (import_fs9.default.existsSync(verFile)) {
+          return import_fs9.default.readFileSync(verFile, "utf8");
         } else {
           const devVer = utils_exports2.newid();
-          import_fs8.default.writeFileSync(verFile, devVer);
+          import_fs9.default.writeFileSync(verFile, devVer);
           return devVer;
         }
       } else {
@@ -14174,31 +14264,31 @@ function getOfflineLicense() {
   }
 }
 function getOfflineLicenseFromDisk() {
-  if (import_fs9.default.existsSync(LICENSE_FILE_PATH)) {
-    const token = import_fs9.default.readFileSync(LICENSE_FILE_PATH, { encoding: "utf-8" });
+  if (import_fs10.default.existsSync(LICENSE_FILE_PATH)) {
+    const token = import_fs10.default.readFileSync(LICENSE_FILE_PATH, { encoding: "utf-8" });
     return import_jsonwebtoken.default.verify(token, PUBLIC_KEY, { algorithms: ["RS256"] });
   }
 }
 function writeOfflineLicenseToDisk(signedLicense) {
-  import_fs9.default.writeFileSync(LICENSE_FILE_PATH, signedLicense, { encoding: "utf-8" });
+  import_fs10.default.writeFileSync(LICENSE_FILE_PATH, signedLicense, { encoding: "utf-8" });
 }
 function deleteOfflineLicense() {
-  import_fs9.default.rmSync(LICENSE_FILE_PATH, { force: true });
+  import_fs10.default.rmSync(LICENSE_FILE_PATH, { force: true });
 }
-var import_fs9, import_path10, import_os2, import_jsonwebtoken, SUB_DIRECTORY, DIRECTORY, OFFLINE_LICENSE_FILE, LICENSE_FILE_PATH, PUBLIC_KEY;
+var import_fs10, import_path11, import_os2, import_jsonwebtoken, SUB_DIRECTORY, DIRECTORY, OFFLINE_LICENSE_FILE, LICENSE_FILE_PATH, PUBLIC_KEY;
 var init_offline = __esm({
   "../pro/packages/pro/src/sdk/licensing/licenses/offline.ts"() {
-    import_fs9 = __toESM(require("fs"));
-    import_path10 = require("path");
+    import_fs10 = __toESM(require("fs"));
+    import_path11 = require("path");
     import_os2 = require("os");
     import_jsonwebtoken = __toESM(require("jsonwebtoken"));
     init_src2();
     SUB_DIRECTORY = environment_default.isTest() ? ".budibase-test" : ".budibase";
-    DIRECTORY = (0, import_path10.join)((0, import_os2.tmpdir)(), SUB_DIRECTORY);
+    DIRECTORY = (0, import_path11.join)((0, import_os2.tmpdir)(), SUB_DIRECTORY);
     OFFLINE_LICENSE_FILE = "offline_license.txt";
-    LICENSE_FILE_PATH = (0, import_path10.join)(DIRECTORY, OFFLINE_LICENSE_FILE);
-    if (!import_fs9.default.existsSync(DIRECTORY)) {
-      import_fs9.default.mkdirSync(DIRECTORY);
+    LICENSE_FILE_PATH = (0, import_path11.join)(DIRECTORY, OFFLINE_LICENSE_FILE);
+    if (!import_fs10.default.existsSync(DIRECTORY)) {
+      import_fs10.default.mkdirSync(DIRECTORY);
     }
     PUBLIC_KEY = "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvz3jePLCFBXZ19c8Dpkv\nXtSgOhKFOcvQdo/LV0KJRUzQWDPWuO4ILtBtnqhjtIzZH4CH0qCYBet5L6Qr4CM1\nl2HXiAD1Q2rlHNW9wDaYyKb1F5f+v4RyqCAyzlkwRdksmkLeECTboojNnmRCrE3C\n8suunQP5bEScqEY2kclqzSf8e6xqMzPUg3mL/pNa1iEv7TuLbU9nJfgR36l0WmZY\n94fWnSaT8OSXSqcxsaByf06gfS3HAoTJNc7eqz1Hf9fUORQGPUAnFK8cT3SfdA36\nd/o3ZWE1TTj1zYwlCLN5qRKr3hU8nC3xEYNEbkB9SfTRaOq9Q7P8WmfLkoCPm3pR\nmwIDAQAB\n-----END PUBLIC KEY-----\n";
   }
@@ -15655,13 +15745,13 @@ var init_groups6 = __esm({
 
 // ../pro/packages/pro/src/utilities/fileSystem.ts
 function loadJSFile(directory, name) {
-  return import_fs10.default.readFileSync((0, import_path11.join)(directory, name), "utf8");
+  return import_fs11.default.readFileSync((0, import_path12.join)(directory, name), "utf8");
 }
-var import_fs10, import_path11;
+var import_fs11, import_path12;
 var init_fileSystem2 = __esm({
   "../pro/packages/pro/src/utilities/fileSystem.ts"() {
-    import_fs10 = __toESM(require("fs"));
-    import_path11 = require("path");
+    import_fs11 = __toESM(require("fs"));
+    import_path12 = require("path");
   }
 });
 
@@ -18629,8 +18719,8 @@ async function runBackup(trigger3, tenantId, appId, opts) {
       }
     });
     await updateMetadata2("complete" /* COMPLETE */, { filename, contents });
-    if (import_fs11.default.existsSync(tarPath)) {
-      import_fs11.default.rmSync(tarPath);
+    if (import_fs12.default.existsSync(tarPath)) {
+      import_fs12.default.rmSync(tarPath);
     }
   } catch (err) {
     logging_exports.logAlert("App backup error", err);
@@ -18688,14 +18778,14 @@ async function exportProcessor(job, opts) {
     });
   });
 }
-var import_fs11;
+var import_fs12;
 var init_processing = __esm({
   "../pro/packages/pro/src/sdk/backups/processing.ts"() {
     init_src2();
     init_backup5();
     init_src();
     init_queue4();
-    import_fs11 = __toESM(require("fs"));
+    import_fs12 = __toESM(require("fs"));
   }
 });
 
@@ -19378,15 +19468,15 @@ async function downloadBackup(ctx) {
   const backupId = ctx.params.backupId;
   const { metadata, path: path5 } = await backups_default.downloadAppBackup(backupId);
   ctx.attachment(`backup-${metadata.timestamp}.tar.gz`);
-  ctx.body = import_fs12.default.createReadStream(path5);
+  ctx.body = import_fs13.default.createReadStream(path5);
 }
-var import_fs12;
+var import_fs13;
 var init_backups3 = __esm({
   "../pro/packages/pro/src/api/controllers/apps/backups.ts"() {
     init_src();
     init_sdk2();
     init_src2();
-    import_fs12 = __toESM(require("fs"));
+    import_fs13 = __toESM(require("fs"));
   }
 });
 
@@ -20651,7 +20741,7 @@ var init_currentapp = __esm({
             userId,
             globalId,
             roleId,
-            role: await roles_exports.getRole(roleId)
+            role: await roles_exports.getRole(roleId, { defaultPublic: true })
           };
         }
         return next();
@@ -24946,13 +25036,14 @@ __export(exports_exports, {
   streamExportApp: () => streamExportApp
 });
 function tarFilesToTmp(tmpDir, files) {
-  const exportFile = (0, import_path12.join)(budibaseTempDir2(), `${uuid3()}.tar.gz`);
-  tar3.create(
+  const fileName = `${uuid3()}.tar.gz`;
+  const exportFile = (0, import_path13.join)(budibaseTempDir2(), fileName);
+  import_tar2.default.create(
     {
       sync: true,
       gzip: true,
       file: exportFile,
-      recursive: true,
+      noDirRecurse: false,
       cwd: tmpDir
     },
     files
@@ -24969,7 +25060,7 @@ async function exportDB(dbName, opts = {}) {
   return db_exports.doWithDB(dbName, async (db2) => {
     if (opts == null ? void 0 : opts.exportPath) {
       const path5 = opts == null ? void 0 : opts.exportPath;
-      const writeStream = import_fs13.default.createWriteStream(path5);
+      const writeStream = import_fs14.default.createWriteStream(path5);
       await db2.dump(writeStream, exportOpts);
       return path5;
     } else {
@@ -25002,9 +25093,9 @@ async function exportApp(appId, config) {
       for (let path5 of STATIC_APP_FILES) {
         const contents = await objectStore_exports2.retrieve(
           ObjectStoreBuckets2.APPS,
-          (0, import_path12.join)(appPath, path5)
+          (0, import_path13.join)(appPath, path5)
         );
-        import_fs13.default.writeFileSync((0, import_path12.join)(tmpPath, path5), contents);
+        import_fs14.default.writeFileSync((0, import_path13.join)(tmpPath, path5), contents);
       }
     } else {
       tmpPath = await objectStore_exports2.retrieveDirectory(
@@ -25013,37 +25104,52 @@ async function exportApp(appId, config) {
       );
     }
   }
-  const downloadedPath = (0, import_path12.join)(tmpPath, appPath);
-  if (import_fs13.default.existsSync(downloadedPath)) {
-    const allFiles = import_fs13.default.readdirSync(downloadedPath);
+  const downloadedPath = (0, import_path13.join)(tmpPath, appPath);
+  if (import_fs14.default.existsSync(downloadedPath)) {
+    const allFiles = import_fs14.default.readdirSync(downloadedPath);
     for (let file of allFiles) {
-      const path5 = (0, import_path12.join)(downloadedPath, file);
-      import_fs13.default.renameSync(path5, (0, import_path12.join)(downloadedPath, "..", file));
+      const path5 = (0, import_path13.join)(downloadedPath, file);
+      import_fs14.default.renameSync(path5, (0, import_path13.join)(downloadedPath, "..", file));
     }
-    import_fs13.default.rmdirSync(downloadedPath);
+    import_fs14.default.rmdirSync(downloadedPath);
   }
-  const dbPath = (0, import_path12.join)(tmpPath, DB_EXPORT_FILE);
+  const dbPath = (0, import_path13.join)(tmpPath, DB_EXPORT_FILE);
   await exportDB(appId, {
     filter: defineFilter(config == null ? void 0 : config.excludeRows, config == null ? void 0 : config.excludeLogs),
     exportPath: dbPath
   });
+  if (config == null ? void 0 : config.encryptPassword) {
+    for (let file of import_fs14.default.readdirSync(tmpPath)) {
+      const path5 = (0, import_path13.join)(tmpPath, file);
+      await encryption_exports.encryptFile(
+        { dir: tmpPath, filename: file },
+        config.encryptPassword
+      );
+      import_fs14.default.rmSync(path5);
+    }
+  }
   if (config == null ? void 0 : config.tar) {
-    const tarPath = tarFilesToTmp(tmpPath, import_fs13.default.readdirSync(tmpPath));
-    import_fs13.default.rmSync(tmpPath, { recursive: true, force: true });
+    const tarPath = tarFilesToTmp(tmpPath, import_fs14.default.readdirSync(tmpPath));
+    import_fs14.default.rmSync(tmpPath, { recursive: true, force: true });
     return tarPath;
   } else {
     return tmpPath;
   }
 }
-async function streamExportApp(appId, excludeRows) {
+async function streamExportApp({
+  appId,
+  excludeRows,
+  encryptPassword
+}) {
   const tmpPath = await exportApp(appId, {
     excludeRows,
     excludeLogs: true,
-    tar: true
+    tar: true,
+    encryptPassword
   });
   return streamFile(tmpPath);
 }
-var import_fs13, import_path12, uuid3, tar3, MemoryStream2;
+var import_fs14, import_path13, import_tar2, uuid3, MemoryStream2;
 var init_exports2 = __esm({
   "src/sdk/app/backups/exports.ts"() {
     init_src2();
@@ -25052,11 +25158,11 @@ var init_exports2 = __esm({
     init_constants4();
     init_utils9();
     init_constants7();
-    import_fs13 = __toESM(require("fs"));
-    import_path12 = require("path");
+    import_fs14 = __toESM(require("fs"));
+    import_path13 = require("path");
     init_environment3();
+    import_tar2 = __toESM(require("tar"));
     uuid3 = require("uuid/v4");
-    tar3 = require("tar");
     MemoryStream2 = require("memorystream");
   }
 });
@@ -25133,16 +25239,16 @@ async function getTemplateStream(template) {
     throw new Error("Cannot import a non-text based file.");
   }
   if (template.file) {
-    return import_fs14.default.createReadStream(template.file.path);
+    return import_fs15.default.createReadStream(template.file.path);
   } else if (template.key) {
     const [type, name] = template.key.split("/");
     const tmpPath = await downloadTemplate(type, name);
-    return import_fs14.default.createReadStream((0, import_path13.join)(tmpPath, name, "db", "dump.txt"));
+    return import_fs15.default.createReadStream((0, import_path14.join)(tmpPath, name, "db", "dump.txt"));
   }
 }
 function untarFile(file) {
-  const tmpPath = (0, import_path13.join)(budibaseTempDir2(), uuid4());
-  import_fs14.default.mkdirSync(tmpPath);
+  const tmpPath = (0, import_path14.join)(budibaseTempDir2(), uuid4());
+  import_fs15.default.mkdirSync(tmpPath);
   tar4.extract({
     sync: true,
     cwd: tmpPath,
@@ -25150,31 +25256,49 @@ function untarFile(file) {
   });
   return tmpPath;
 }
+async function decryptFiles(path5, password) {
+  try {
+    for (let file of import_fs15.default.readdirSync(path5)) {
+      const inputPath = (0, import_path14.join)(path5, file);
+      const outputPath = inputPath.replace(/\.enc$/, "");
+      await encryption_exports.decryptFile(inputPath, outputPath, password);
+      import_fs15.default.rmSync(inputPath);
+    }
+  } catch (err) {
+    if (err.message === "incorrect header check") {
+      throw new Error("File cannot be imported");
+    }
+    throw err;
+  }
+}
 function getGlobalDBFile(tmpPath) {
-  return import_fs14.default.readFileSync((0, import_path13.join)(tmpPath, GLOBAL_DB_EXPORT_FILE), "utf8");
+  return import_fs15.default.readFileSync((0, import_path14.join)(tmpPath, GLOBAL_DB_EXPORT_FILE), "utf8");
 }
 function getListOfAppsInMulti(tmpPath) {
-  return import_fs14.default.readdirSync(tmpPath).filter((dir) => dir !== GLOBAL_DB_EXPORT_FILE);
+  return import_fs15.default.readdirSync(tmpPath).filter((dir) => dir !== GLOBAL_DB_EXPORT_FILE);
 }
 async function importApp(appId, db2, template) {
   var _a2, _b2;
   let prodAppId = db_exports.getProdAppID(appId);
   let dbStream;
   const isTar = template.file && ((_b2 = (_a2 = template == null ? void 0 : template.file) == null ? void 0 : _a2.type) == null ? void 0 : _b2.endsWith("gzip"));
-  const isDirectory = template.file && import_fs14.default.lstatSync(template.file.path).isDirectory();
+  const isDirectory = template.file && import_fs15.default.lstatSync(template.file.path).isDirectory();
   if (template.file && (isTar || isDirectory)) {
     const tmpPath = isTar ? untarFile(template.file) : template.file.path;
-    const contents = import_fs14.default.readdirSync(tmpPath);
+    if (isTar && template.file.password) {
+      await decryptFiles(tmpPath, template.file.password);
+    }
+    const contents = import_fs15.default.readdirSync(tmpPath);
     if (contents.length) {
       let promises = [];
       let excludedFiles = [GLOBAL_DB_EXPORT_FILE, DB_EXPORT_FILE];
       for (let filename of contents) {
-        const path5 = (0, import_path13.join)(tmpPath, filename);
+        const path5 = (0, import_path14.join)(tmpPath, filename);
         if (excludedFiles.includes(filename)) {
           continue;
         }
-        filename = (0, import_path13.join)(prodAppId, filename);
-        if (import_fs14.default.lstatSync(path5).isDirectory()) {
+        filename = (0, import_path14.join)(prodAppId, filename);
+        if (import_fs15.default.lstatSync(path5).isDirectory()) {
           promises.push(
             objectStore_exports2.uploadDirectory(ObjectStoreBuckets2.APPS, path5, filename)
           );
@@ -25190,7 +25314,7 @@ async function importApp(appId, db2, template) {
       }
       await Promise.all(promises);
     }
-    dbStream = import_fs14.default.createReadStream((0, import_path13.join)(tmpPath, DB_EXPORT_FILE));
+    dbStream = import_fs15.default.createReadStream((0, import_path14.join)(tmpPath, DB_EXPORT_FILE));
   } else {
     dbStream = await getTemplateStream(template);
   }
@@ -25202,7 +25326,7 @@ async function importApp(appId, db2, template) {
   await updateAutomations(prodAppId, db2);
   return ok;
 }
-var import_path13, import_fs14, uuid4, tar4;
+var import_path14, import_fs15, uuid4, tar4;
 var init_imports = __esm({
   "src/sdk/app/backups/imports.ts"() {
     init_src2();
@@ -25211,8 +25335,8 @@ var init_imports = __esm({
     init_constants7();
     init_fileSystem();
     init_constants4();
-    import_path13 = require("path");
-    import_fs14 = __toESM(require("fs"));
+    import_path14 = require("path");
+    import_fs15 = __toESM(require("fs"));
     init_sdk3();
     init_src();
     uuid4 = require("uuid/v4");
@@ -41712,13 +41836,18 @@ var init_query6 = __esm({
 // src/api/controllers/backup.ts
 async function exportAppDump(ctx) {
   const { appId } = ctx.query;
-  const { excludeRows } = ctx.request.body;
+  const { excludeRows, encryptPassword } = ctx.request.body;
   const [app2] = await db_exports.getAppsByIDs([appId]);
   const appName = app2.name;
   ctx.req.setTimeout(0);
-  const backupIdentifier = `${appName}-export-${(/* @__PURE__ */ new Date()).getTime()}.tar.gz`;
+  const extension = encryptPassword ? "enc.tar.gz" : "tar.gz";
+  const backupIdentifier = `${appName}-export-${(/* @__PURE__ */ new Date()).getTime()}.${extension}`;
   ctx.attachment(backupIdentifier);
-  ctx.body = await sdk_default.backups.streamExportApp(appId, excludeRows);
+  ctx.body = await sdk_default.backups.streamExportApp({
+    appId,
+    excludeRows,
+    encryptPassword
+  });
   await context_exports.doInAppContext(appId, async () => {
     const appDb = context_exports.getAppDB();
     const app3 = await appDb.get(DocumentType2.APP_METADATA);
@@ -43174,18 +43303,18 @@ async function npmUpload(url, name, headers = {}) {
   }
   try {
     await extractTarball(tarballPluginFile, path5);
-    deleteFolderFileSystem((0, import_path14.join)(path5, "package"));
+    deleteFolderFileSystem((0, import_path15.join)(path5, "package"));
   } catch (err) {
     throw new Error(err);
   }
   return await getPluginMetadata(path5);
 }
-var import_node_fetch20, import_path14;
+var import_node_fetch20, import_path15;
 var init_npm = __esm({
   "src/api/controllers/plugin/npm.ts"() {
     init_fileSystem();
     import_node_fetch20 = __toESM(require("node-fetch"));
-    import_path14 = require("path");
+    import_path15 = require("path");
     init_utils28();
   }
 });
@@ -43393,7 +43522,7 @@ async function prepareUpload({ s3Key, bucket, metadata, file }) {
     key: response2.Key
   };
 }
-var import_string_templates10, import_aws_sdk4, import_fs15, uuid5, send2, toggleBetaUiFeature, serveBuilder, uploadFile, deleteObjects, serveApp, serveBuilderPreview, serveClientLibrary, getSignedUploadURL;
+var import_string_templates10, import_aws_sdk4, import_fs16, uuid5, send2, toggleBetaUiFeature, serveBuilder, uploadFile, deleteObjects, serveApp, serveBuilderPreview, serveClientLibrary, getSignedUploadURL;
 var init_static = __esm({
   "src/api/controllers/static/index.ts"() {
     init_centralPath();
@@ -43404,7 +43533,7 @@ var init_static = __esm({
     init_utils9();
     init_src2();
     import_aws_sdk4 = __toESM(require("aws-sdk"));
-    import_fs15 = __toESM(require("fs"));
+    import_fs16 = __toESM(require("fs"));
     init_sdk3();
     init_src4();
     require("svelte/register");
@@ -43419,9 +43548,9 @@ var init_static = __esm({
         };
         return;
       }
-      let builderPath = join3(TOP_LEVEL_PATH, "new_design_ui");
-      if (!import_fs15.default.existsSync(builderPath)) {
-        import_fs15.default.mkdirSync(builderPath);
+      let builderPath = join4(TOP_LEVEL_PATH, "new_design_ui");
+      if (!import_fs16.default.existsSync(builderPath)) {
+        import_fs16.default.mkdirSync(builderPath);
       }
       await objectStore_exports2.downloadTarballDirect(
         "https://cdn.budi.live/beta:design_ui/new_ui.tar.gz",
@@ -43433,7 +43562,7 @@ var init_static = __esm({
       };
     };
     serveBuilder = async function(ctx) {
-      const builderPath = join3(TOP_LEVEL_PATH, "builder");
+      const builderPath = join4(TOP_LEVEL_PATH, "builder");
       await send2(ctx, ctx.file, { root: builderPath });
     };
     uploadFile = async function(ctx) {
@@ -43522,7 +43651,7 @@ var init_static = __esm({
     };
     serveClientLibrary = async function(ctx) {
       return send2(ctx, "budibase-client.js", {
-        root: join3(NODE_MODULES_PATH, "@budibase", "client", "dist")
+        root: join4(NODE_MODULES_PATH, "@budibase", "client", "dist")
       });
     };
     getSignedUploadURL = async function(ctx) {
@@ -44842,13 +44971,13 @@ var init_routes = __esm({
 });
 
 // src/api/index.ts
-var import_router35, import_zlib2, compress, router35;
+var import_router35, import_zlib3, compress, router35;
 var init_api8 = __esm({
   "src/api/index.ts"() {
     import_router35 = __toESM(require("@koa/router"));
     init_src2();
     init_currentapp();
-    import_zlib2 = __toESM(require("zlib"));
+    import_zlib3 = __toESM(require("zlib"));
     init_routes();
     init_src4();
     init_public();
@@ -44861,10 +44990,10 @@ var init_api8 = __esm({
       compress({
         threshold: 2048,
         gzip: {
-          flush: import_zlib2.default.constants.Z_SYNC_FLUSH
+          flush: import_zlib3.default.constants.Z_SYNC_FLUSH
         },
         deflate: {
-          flush: import_zlib2.default.constants.Z_SYNC_FLUSH
+          flush: import_zlib3.default.constants.Z_SYNC_FLUSH
         },
         br: false
       })
@@ -44910,7 +45039,7 @@ var init_automations8 = __esm({
 
 // src/watch.ts
 function watch() {
-  const watchPath = import_path15.default.join(environment_default2.PLUGINS_DIR, "./**/*.tar.gz");
+  const watchPath = import_path16.default.join(environment_default2.PLUGINS_DIR, "./**/*.tar.gz");
   import_chokidar.default.watch(watchPath, {
     ignored: "**/node_modules",
     awaitWriteFinish: {
@@ -44920,7 +45049,7 @@ function watch() {
     usePolling: true,
     interval: 250
   }).on("all", async (event, path5) => {
-    if (!(path5 == null ? void 0 : path5.endsWith(".tar.gz")) || !import_fs16.default.existsSync(path5)) {
+    if (!(path5 == null ? void 0 : path5.endsWith(".tar.gz")) || !import_fs17.default.existsSync(path5)) {
       return;
     }
     await tenancy.doInTenant(constants_exports.DEFAULT_TENANT_ID, async () => {
@@ -44936,13 +45065,13 @@ function watch() {
     });
   });
 }
-var import_path15, import_chokidar, import_fs16;
+var import_path16, import_chokidar, import_fs17;
 var init_watch = __esm({
   "src/watch.ts"() {
-    import_path15 = __toESM(require("path"));
+    import_path16 = __toESM(require("path"));
     init_environment3();
     import_chokidar = __toESM(require("chokidar"));
-    import_fs16 = __toESM(require("fs"));
+    import_fs17 = __toESM(require("fs"));
     init_src2();
     init_plugins5();
   }
@@ -44998,7 +45127,7 @@ async function startup(app2, server2) {
       shutdown9(server2);
     }
   }
-  if (environment_default2.SELF_HOSTED && !environment_default2.MULTI_TENANCY && environment_default2.PLUGINS_DIR && import_fs17.default.existsSync(environment_default2.PLUGINS_DIR)) {
+  if (environment_default2.SELF_HOSTED && !environment_default2.MULTI_TENANCY && environment_default2.PLUGINS_DIR && import_fs18.default.existsSync(environment_default2.PLUGINS_DIR)) {
     watch();
   }
   await installation_exports.checkInstallVersion();
@@ -45033,14 +45162,14 @@ async function startup(app2, server2) {
     }
   }
 }
-var import_fs17, STARTUP_RAN;
+var import_fs18, STARTUP_RAN;
 var init_startup = __esm({
   "src/startup.ts"() {
     init_environment3();
     init_redis4();
     init_workerRequests();
     init_src2();
-    import_fs17 = __toESM(require("fs"));
+    import_fs18 = __toESM(require("fs"));
     init_watch();
     init_automations8();
     init_fileSystem();