@camstack/system 1.2.328 → 1.2.329

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { H as authProviderCapability, L as UserRecordSchema, M as ScopedTokenSchema, Sn as userManagementCapability, qn as BaseAddon, r as ApiKeyRecordSchema } from "../../dist-DWq17vC8.mjs";
+import { B as UserRecordSchema, En as userManagementCapability, F as ScopedTokenSchema, G as authProviderCapability, Zn as BaseAddon, r as ApiKeyRecordSchema } from "../../dist-CV7IqaYq.mjs";
 import * as crypto$2 from "node:crypto";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BUejKKBm.js");
+const require_dist = require("../../dist-CSs0cFDN.js");
 const require_tls = require("../../tls-D_wUeOTD.js");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { _r as EventCategory, qn as BaseAddon, zt as localNetworkCapability } from "../../dist-DWq17vC8.mjs";
+import { Sr as EventCategory, Ut as localNetworkCapability, Zn as BaseAddon } from "../../dist-CV7IqaYq.mjs";
 import { S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, i as writeExtraSans, l as reissueTlsLeaf, n as readTlsAccessStatus, o as validateUploadedTls, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, y as applyLanHttp } from "../../tls-IM-v7JV4.mjs";
 import { mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BUejKKBm.js");
+const require_dist = require("../../dist-CSs0cFDN.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Vt as logDestinationCapability, qn as BaseAddon } from "../../dist-DWq17vC8.mjs";
+import { Gt as logDestinationCapability, Zn as BaseAddon } from "../../dist-CV7IqaYq.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BUejKKBm.js");
+const require_dist = require("../../dist-CSs0cFDN.js");
 const require_proc_stat = require("../../proc-stat-DL-WUOhl.js");
 let node_fs_promises = require("node:fs/promises");
 let node_fs = require("node:fs");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Et as foldSnapshotByFunction, Kn as errMsg, _r as EventCategory, in as reducePoints, on as resolveBucketMs, qn as BaseAddon, qt as metricsProviderCapability, rr as createEvent } from "../../dist-DWq17vC8.mjs";
+import { At as foldSnapshotByFunction, Sr as EventCategory, Xn as errMsg, Zn as BaseAddon, Zt as metricsProviderCapability, cn as reducePoints, sr as createEvent, un as resolveBucketMs } from "../../dist-CV7IqaYq.mjs";
 import { a as parseProcStat, i as nodeProcReader, n as elapsedSecSince, o as parseProcStatusRss, r as lifetimeCpuPercent, t as commandFromCmdline } from "../../proc-stat-CbC55Kqi.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import * as fs from "node:fs";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BUejKKBm.js");
+const require_dist = require("../../dist-CSs0cFDN.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { Kn as errMsg, _r as EventCategory, ar as emitReadiness, fn as scoreRuntimes, qn as BaseAddon, tn as platformProbeCapability, vt as enumerateInferenceDevices } from "../../dist-DWq17vC8.mjs";
+import { Sr as EventCategory, St as enumerateInferenceDevices, Xn as errMsg, Zn as BaseAddon, an as platformProbeCapability, gn as scoreRuntimes, lr as emitReadiness } from "../../dist-CV7IqaYq.mjs";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";
 import * as os from "node:os";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BUejKKBm.js");
+const require_dist = require("../../dist-CSs0cFDN.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { _r as EventCategory, qn as BaseAddon } from "../../dist-DWq17vC8.mjs";
+import { Sr as EventCategory, Zn as BaseAddon } from "../../dist-CV7IqaYq.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BUejKKBm.js");
+const require_dist = require("../../dist-CSs0cFDN.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-Cqs7GkOV.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { G as batteryCapability, Gn as DeviceType, Kn as errMsg, Kt as memoizePinnedFfmpeg, Un as DeviceFeature, W as bareAddonId, _r as EventCategory, a as BatteryStatusSchema, hn as snapshotCapability, qn as BaseAddon, ur as nodePin, ut as deriveBatteryPresence, xn as streamQualityLabel } from "../../dist-DWq17vC8.mjs";
+import { J as batteryCapability, Sr as EventCategory, Tn as streamQualityLabel, Xn as errMsg, Xt as memoizePinnedFfmpeg, Yn as DeviceType, Zn as BaseAddon, a as BatteryStatusSchema, mr as nodePin, mt as deriveBatteryPresence, q as bareAddonId, qn as DeviceFeature, yn as snapshotCapability } from "../../dist-CV7IqaYq.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CZPvteq2.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BUejKKBm.js");
+const require_dist = require("../../dist-CSs0cFDN.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { Tt as filesystemBrowseCapability, qn as BaseAddon, yn as storageProviderCapability } from "../../dist-DWq17vC8.mjs";
+import { Cn as storageProviderCapability, Zn as BaseAddon, kt as filesystemBrowseCapability } from "../../dist-CV7IqaYq.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/sqlite-settings.addon.d.ts

@@ -11,6 +11,10 @@ import { SqliteVecVectorIndex } from './vector-index-vec.js';
  * engine only through the door — which is the point, because it is what
  * makes the engine replaceable.
  *
+ * It also serves `database-snapshot` (singleton, internal): the verified copy
+ * of its database that the nightly backup archives in place of the live files
+ * (D693).
+ *
  * It ALSO serves `vector-store` (singleton, internal), from the same database
  * file and the same open handle. That capability first shipped as its own addon
  * and the separation cost two round trips per write — caller → door → engine —

package/dist/builtins/sqlite-storage/sqlite-snapshot-protocol.d.ts

@@ -0,0 +1,49 @@
+import { DatabaseSnapshotTable } from '@camstack/types';
+/** `workerData` of one snapshot thread. The `kind` tells it apart from any other worker. */
+export interface SnapshotWorkerData {
+    readonly kind: 'sqlite-snapshot';
+    /** The live database — opened read-only, through this thread's own connection. */
+    readonly livePath: string;
+    /** Where the copy is written. Lives in a work directory nothing else uses. */
+    readonly copyPath: string;
+    /** Pages per backup step. Every step reads the same pinned transaction. */
+    readonly pagesPerStep: number;
+}
+/** What a copy that passed every check holds. */
+export interface VerifiedCopy {
+    readonly takenAt: number;
+    readonly tables: readonly DatabaseSnapshotTable[];
+    readonly pageCount: number;
+    readonly pageSize: number;
+    readonly copyMs: number;
+    readonly verifyMs: number;
+}
+/**
+ * Why a copy was refused:
+ * - `integrity` — `PRAGMA integrity_check` on the copy answered anything but `ok`;
+ * - `row-count` — a table of the copy holds a different number of rows than the
+ *   pinned source did, or the table sets differ;
+ * - `failed` — the copy could not be taken at all (open, I/O, busy, deadline);
+ * - `no-space` — the live database's disk cannot take the copy and keep its
+ *   reserve, or its free space could not be measured (decided before the
+ *   thread starts, by the snapshotter).
+ */
+export type SnapshotRefusalReason = 'integrity' | 'row-count' | 'failed' | 'no-space';
+export interface SnapshotDone {
+    readonly kind: 'done';
+    readonly copy: VerifiedCopy;
+}
+export interface SnapshotRefused {
+    readonly kind: 'refused';
+    readonly reason: SnapshotRefusalReason;
+    readonly detail: string;
+}
+export type SnapshotWorkerMessage = SnapshotDone | SnapshotRefused;
+/** Thrown inside the worker by a check that refuses the copy. */
+export declare class SnapshotRefusedError extends Error {
+    readonly reason: SnapshotRefusalReason;
+    readonly detail: string;
+    constructor(reason: SnapshotRefusalReason, detail: string);
+}
+export declare function isSnapshotWorkerData(value: unknown): value is SnapshotWorkerData;
+export declare function isSnapshotWorkerMessage(value: unknown): value is SnapshotWorkerMessage;

package/dist/builtins/sqlite-storage/sqlite-snapshot-worker.d.ts

@@ -0,0 +1,33 @@
+import { DatabaseSnapshotTable } from '@camstack/types';
+import { default as Database } from 'better-sqlite3';
+import { SnapshotWorkerData, VerifiedCopy } from './sqlite-snapshot-protocol.js';
+/** The pinned half: when it was taken, what it holds, how long it took. */
+export interface PinnedCopy {
+    readonly takenAt: number;
+    readonly tables: readonly DatabaseSnapshotTable[];
+    readonly copyMs: number;
+}
+/** The checked half. */
+export interface CopyCheck {
+    readonly pageCount: number;
+    readonly pageSize: number;
+    readonly verifyMs: number;
+}
+/**
+ * Copy `source` into `copyPath` from ONE read transaction. `onStep` observes
+ * each backup step (a spec interleaves writes there).
+ */
+export declare function copyPinned(source: Database.Database, copyPath: string, pagesPerStep: number, onStep?: () => void): Promise<PinnedCopy>;
+/**
+ * The answer of `PRAGMA journal_mode = DELETE` must be `delete`. SQLite answers
+ * the mode it is IN, so a switch it could not make comes back as `wal` with no
+ * error — and a copy left in WAL needs sidecars that will not travel with it.
+ */
+export declare function requireRollbackJournal(answer: unknown): void;
+/**
+ * Check a copy against what the pinned source held. Makes the copy one
+ * self-contained file first. Throws {@link SnapshotRefusedError}.
+ */
+export declare function verifyCopy(copyPath: string, expected: readonly DatabaseSnapshotTable[]): CopyCheck;
+/** The whole job: open the live database read-only, copy it pinned, check the copy. */
+export declare function takeVerifiedCopy(data: SnapshotWorkerData): Promise<VerifiedCopy>;

package/dist/builtins/sqlite-storage/sqlite-snapshotter.d.ts

@@ -0,0 +1,98 @@
+import { DatabaseSnapshotResult, IScopedLogger } from '@camstack/types';
+import { SnapshotWorkerData } from './sqlite-snapshot-protocol.js';
+/**
+ * Pages per backup step. Every step reads the same pinned transaction, so the
+ * size only trades yields against per-step overhead: 1024 pages is 4 MiB at the
+ * default page size.
+ */
+export declare const SNAPSHOT_PAGES_PER_STEP = 1024;
+/**
+ * How long the snapshot thread may run before it is terminated. A minute under
+ * the capability's own timeout, so the runner gives up — and says why — before
+ * the caller's call does.
+ */
+export declare const SNAPSHOT_DEADLINE_MS: number;
+/** The least headroom left on the disk AFTER the copy, whatever the database's size. */
+export declare const SNAPSHOT_MIN_RESERVE_BYTES: number;
+/**
+ * Free bytes a snapshot needs before it may start: the copy (at most the
+ * database plus its WAL), then a reserve the size of the database (at least
+ * {@link SNAPSHOT_MIN_RESERVE_BYTES}) for the live writes and the WAL growth
+ * the pinned read causes while the copy runs.
+ */
+export declare function snapshotSpaceNeeded(databaseBytes: number, walBytes: number): number;
+/** The `statfs` fields the space check reads. */
+export interface DiskSpace {
+    readonly bavail: number | bigint;
+    readonly bsize: number | bigint;
+}
+export type StatfsFn = (dir: string) => Promise<DiskSpace>;
+/**
+ * Where the built worker entry lives: `dist/sqlite-snapshot-worker.js` at the
+ * package root, next to `wal-checkpoint-worker.js` (see `wal-checkpointer.ts`
+ * for why it resolves through the package's own `package.json`).
+ */
+export declare function defaultSnapshotWorkerPath(): string;
+/**
+ * The members of a snapshot thread this class uses. Structural, so a spec can
+ * hand in a thread whose `terminate()` never settles — the stall a native call
+ * that never returns would cause.
+ */
+export interface SnapshotWorkerHandle {
+    onMessage(listener: (message: unknown) => void): void;
+    onError(listener: (err: Error) => void): void;
+    onExit(listener: (code: number) => void): void;
+    terminate(): Promise<unknown>;
+}
+export type SnapshotWorkerFactory = (data: SnapshotWorkerData) => SnapshotWorkerHandle;
+export interface SqliteSnapshotterOptions {
+    /** The live database this process owns. */
+    readonly livePath: string;
+    readonly logger: IScopedLogger;
+    readonly pagesPerStep?: number;
+    /** Overrides the built entry — a spec points this at the TypeScript source. */
+    readonly workerPath?: string;
+    /** Extra `execArgv` for the thread — a spec passes a loader here. */
+    readonly workerExecArgv?: readonly string[];
+    /** Overrides {@link SNAPSHOT_DEADLINE_MS}. */
+    readonly deadlineMs?: number;
+    /** Overrides `fs.statfs` — a spec answers the space question here. */
+    readonly statfs?: StatfsFn;
+    /** Overrides the thread itself — a spec hands in one that never terminates. */
+    readonly spawnWorker?: SnapshotWorkerFactory;
+    /** Overrides the directory fsync — a spec makes it fail. */
+    readonly syncDirectory?: (dir: string) => Promise<void>;
+}
+export declare class SqliteSnapshotter {
+    private readonly livePath;
+    private readonly logger;
+    private readonly pagesPerStep;
+    private readonly deadlineMs;
+    private readonly statfs;
+    private readonly spawnWorker;
+    private readonly syncDirectory;
+    private inFlight;
+    /**
+     * Set while a thread the deadline gave up on is still being terminated. A
+     * native SQLite call cannot be interrupted, so `terminate()` may take as long
+     * as that call — or never settle. Until it does, a new snapshot is refused
+     * at once (never joined, never started beside a thread that may still hold
+     * a pinned read), and the work directory stays until nobody writes into it.
+     */
+    private draining;
+    constructor(options: SqliteSnapshotterOptions);
+    /** The database this snapshotter copies, absolute. */
+    get database(): string;
+    /** Write `<db>.backup-snapshot`. Joins a snapshot already running. */
+    write(): Promise<DatabaseSnapshotResult>;
+    /**
+     * Remove a snapshot nobody collected and a work directory a crash left.
+     * Called at boot; {@link write} does the same before it starts.
+     */
+    sweep(): Promise<void>;
+    private refuse;
+    /** Refuses with `no-space` unless the disk can take the copy and keep its reserve. */
+    private checkSpace;
+    private run;
+    private runWorker;
+}

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BUejKKBm.js");
+const require_dist = require("../../dist-CSs0cFDN.js");
 const require_hub_cap_forward = require("../../hub-cap-forward-DmHNjbB0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { D as REDACTED_SECRET, Dn as withLocationMode, F as StorageLocationTypeSchema, Gt as mayWriteToLocation, I as StorageMigrationJobSchema, Jt as modeMayWrite, Lt as legacyModeOf, N as StorageCleanupJobSchema, Ot as gbToBytes, P as StorageLocationModeSchema, St as evictionPolicyOfLocation, Wt as mayReadLocation, X as collectSecretConfigKeys, _n as storageMigrationCapability, _r as EventCategory, dr as parseJsonObject, gn as storageCapability, jt as isLocationEnabled, pn as settingsStoreCapability, qn as BaseAddon, sn as resolveLocationMode, x as LegacyStorageLocationDefaultSchema } from "../../dist-DWq17vC8.mjs";
+import { $ as collectSecretConfigKeys, A as REDACTED_SECRET, Et as evictionPolicyOfLocation, Ft as isLocationEnabled, I as StorageCleanupJobSchema, Jt as mayReadLocation, L as StorageLocationModeSchema, Mt as gbToBytes, Qt as modeMayWrite, R as StorageLocationTypeSchema, Sr as EventCategory, Vt as legacyModeOf, Yt as mayWriteToLocation, Zn as BaseAddon, _n as settingsStoreCapability, bn as storageCapability, dn as resolveLocationMode, hr as parseJsonObject, jn as withLocationMode, w as LegacyStorageLocationDefaultSchema, xn as storageMigrationCapability, z as StorageMigrationJobSchema } from "../../dist-CV7IqaYq.mjs";
 import { t as HUB_CAP_FWD_ACTION } from "../../hub-cap-forward-BdT320dq.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/system-backup/system-backup.service.d.ts

@@ -1,4 +1,4 @@
-import { IScopedLogger } from '@camstack/types';
+import { ArchiveSqliteSnapshot, DatabaseSnapshotResult, IScopedLogger } from '@camstack/types';
 /**
  * Thrown when an archive build (or a backup run driving one) is
  * stopped via its `AbortSignal`. Callers use `instanceof` to tell a
@@ -8,6 +8,15 @@ import { IScopedLogger } from '@camstack/types';
 export declare class BackupCancelledError extends Error {
     constructor(message?: string);
 }
+/**
+ * Thrown when an archive would carry a live database and its owner could not
+ * produce a verified snapshot of it (D693). Nothing was built: a run that
+ * "succeeded" without the database — or with a torn copy of it — would push
+ * the oldest good archive out of every destination's retention.
+ */
+export declare class BackupSnapshotRefusedError extends Error {
+    constructor(reason: string);
+}
 /**
  * Default set of paths considered part of a "system backup". Includes
  * everything that isn't pure backend code — config, sqlite, addons
@@ -42,6 +51,16 @@ export declare const DEFAULT_BACKUP_EXCLUDES: readonly ["addons-data/backup-orch
  * trailing `/`) and backslash separators.
  */
 export declare function isExcludedFromBackup(relPath: string): boolean;
+/**
+ * The OWNER of the live databases in a data root (D693): it says which files
+ * it snapshots, and writes the snapshot. `backup-orchestrator` answers it with
+ * the `database-snapshot` capability, pinned to its own node.
+ */
+export interface DatabaseOwner {
+    /** Absolute paths of the databases the owner snapshots. */
+    listDatabases(): Promise<readonly string[]>;
+    writeSnapshot(): Promise<DatabaseSnapshotResult>;
+}
 /** Path of the manifest file embedded inside every archive. */
 export declare const ARCHIVE_MANIFEST_NAME = ".camstack-backup-manifest.json";
 export type ArchiveEntryKind = 'file' | 'dir' | 'symlink';
@@ -69,6 +88,11 @@ export interface ArchiveManifest {
     /** Sum of file `sizeBytes` (uncompressed). */
     totalBytes: number;
     totalFiles: number;
+    /**
+     * Live databases carried as their owner's verified snapshot instead of as
+     * files (D693). Paths are archive-relative.
+     */
+    sqliteSnapshots?: ArchiveSqliteSnapshot[];
 }
 export interface CreateArchiveResult {
     archivePath: string;
@@ -159,33 +183,37 @@ export declare class SystemBackupService {
         locations?: readonly string[];
         signal?: AbortSignal;
         onArchiveBytes?: (bytesWritten: number) => void;
+        /**
+         * The OWNER of the data root's live databases (D693). Asked only when the
+         * walk finds a SQLite file: which databases it owns (authoritative — a
+         * cleanly closed database has no sidecar and is just as owned), then for
+         * one verified snapshot. Each owned database in scope is archived as that
+         * snapshot in place of its `.db` / `-wal` / `-shm` / `-journal`, and the
+         * snapshot is deleted once the archive is built.
+         *
+         * Nothing is built — {@link BackupSnapshotRefusedError} — when the owner
+         * fails, or when a live database (one with a sidecar) has no owner: an
+         * archive without the settings database must never reach a destination,
+         * because its upload prunes an older archive that HAS it.
+         */
+        owner?: DatabaseOwner;
     }): Promise<CreateArchiveResult>;
+    /**
+     * Tar `present` (filtered by `excluded`) plus the staged manifest into
+     * `archivePath`.
+     */
+    private writeArchive;
     /**
      * without extracting payload files. Streams the tar.gz, parses the
      * one entry we care about, then aborts.
      */
     readArchiveManifest(archivePath: string): Promise<ArchiveManifest | null>;
-    /**
-     * Extract a previously-created archive over `targetDir`. Used at boot
-     * by the restore hook — never call from a running server (would
-     * corrupt sqlite mid-run).
-     *
-     * `locations` is an optional whitelist: only entries whose path
-     * starts with one of the locations get extracted. Used by the
-     * partial-restore flow where the operator picks a subset of the
-     * archive contents to apply (e.g. "restore my devices but keep
-     * my current TLS certs").
-     */
-    extractArchive(opts: {
-        archivePath: string;
-        targetDir: string;
-        locations?: readonly string[];
-    }): Promise<void>;
     /**
      * Schedule a restore for the next boot by writing a marker file.
-     * `locations` (optional) carries through to the boot-time
-     * extractArchive call so the operator's "restore only X and Y"
-     * choice survives the process restart.
+     * `locations` (optional) carries through to the launcher's boot-time
+     * restore (`server/backend/src/launcher.ts`, the only restore there is)
+     * so the operator's "restore only X and Y" choice survives the process
+     * restart.
      */
     scheduleRestoreMarker(opts: {
         archivePath: string;
@@ -196,6 +224,32 @@ export declare class SystemBackupService {
     readPendingMarker(): RestoreMarker | null;
     /** Drop the marker after a successful boot-time restore. */
     clearPendingMarker(): void;
+    /**
+     * The databases the owner declares, archive-relative, that this walk found.
+     * One outside this data root is not in scope. An owner that cannot answer
+     * stops the archive: without the answer, nothing says which file is live.
+     */
+    private ownedDatabasesInScope;
+    /**
+     * Ask the owner for its snapshot, and place it in this archive. The snapshot
+     * must sit on THIS data root — the call is pinned to this node, so a path
+     * elsewhere means it reached another host, and that file is not ours to
+     * read — beside an owned database in scope, and it must cover EVERY owned
+     * database in scope. Anything else is refused.
+     *
+     * Only ever DELETED here: `<owned db>.backup-snapshot` under this data root,
+     * a name this process derives itself. A path the owner ANSWERS is never
+     * deleted on its word — answering the live database as the snapshot would
+     * otherwise delete the live database. A file at any other path is left to
+     * the owner's own sweep.
+     *
+     * A cancel is honoured while the owner is still copying; the copy it may
+     * finish afterwards is removed when that call settles.
+     */
+    private takeOwnerSnapshot;
+    private removeSnapshot;
+    /** `abs` relative to the data root, or null when it lies outside it. */
+    private archiveRelative;
     private getRestoreMarkerPath;
     /**
      * Absolute-path form of {@link isExcludedFromBackup}, anchored on

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BUejKKBm.js");
+const require_dist = require("../../dist-CSs0cFDN.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { Kn as errMsg, qn as BaseAddon, sr as hydrateSchema } from "../../dist-DWq17vC8.mjs";
+import { Xn as errMsg, Zn as BaseAddon, dr as hydrateSchema } from "../../dist-CV7IqaYq.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BUejKKBm.js");
+const require_dist = require("../../dist-CSs0cFDN.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Vt as logDestinationCapability, qn as BaseAddon } from "../../dist-DWq17vC8.mjs";
+import { Gt as logDestinationCapability, Zn as BaseAddon } from "../../dist-CV7IqaYq.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{composition-sources-GkgXF6B9.js → composition-sources-B7hfTiPS.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-BUejKKBm.js");
+const require_dist = require("./dist-CSs0cFDN.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-I8Rx7woY.mjs → composition-sources-BHPqf6So.mjs}

@@ -1,4 +1,4 @@
-import { Kn as errMsg, Rn as compositionSourceKey } from "./dist-DWq17vC8.mjs";
+import { Hn as compositionSourceKey, Xn as errMsg } from "./dist-CV7IqaYq.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation