@camstack/system 1.2.328 → 1.2.330

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BUejKKBm.js");
+const require_dist = require("../../dist-Bx4zxM9N.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Kn as errMsg, R as addonPagesCapability, _r as EventCategory, qn as BaseAddon } from "../../dist-DWq17vC8.mjs";
+import { Sr as EventCategory, V as addonPagesCapability, Xn as errMsg, Zn as BaseAddon } from "../../dist-Dp043AI0.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BUejKKBm.js");
+const require_dist = require("../../dist-Bx4zxM9N.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { B as addonWidgetsCapability, Kn as errMsg, _r as EventCategory, qn as BaseAddon } from "../../dist-DWq17vC8.mjs";
+import { Sr as EventCategory, U as addonWidgetsCapability, Xn as errMsg, Zn as BaseAddon } from "../../dist-Dp043AI0.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BUejKKBm.js");
+const require_dist = require("../../dist-Bx4zxM9N.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Kn as errMsg, V as alertsCapability, _r as EventCategory, n as AlertSchema, qn as BaseAddon, rr as createEvent } from "../../dist-DWq17vC8.mjs";
+import { Sr as EventCategory, W as alertsCapability, Xn as errMsg, Zn as BaseAddon, n as AlertSchema, sr as createEvent } from "../../dist-Dp043AI0.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/autotrack/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BUejKKBm.js");
+const require_dist = require("../../dist-Bx4zxM9N.js");
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/autotrack/index.mjs

@@ -1,4 +1,4 @@
-import { Kn as errMsg, W as bareAddonId, _ as FIRST_LEVEL_MACRO_CLASSES, _r as EventCategory, lr as isEvent, qn as BaseAddon, rn as ptzAutotrackCapability } from "../../dist-DWq17vC8.mjs";
+import { Sr as EventCategory, Xn as errMsg, Zn as BaseAddon, b as FIRST_LEVEL_MACRO_CLASSES, pr as isEvent, q as bareAddonId, sn as ptzAutotrackCapability } from "../../dist-Dp043AI0.mjs";
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.d.ts

@@ -134,6 +134,13 @@ export declare class BackupOrchestratorAddon extends BaseAddon<Record<string, ne
      * `cleanStagingArea`.
      */
     private runBackupBuild;
+    /**
+     * THIS node's database owner (D693), reached through `database-snapshot`
+     * pinned to the local node: the paths it answers must be on this host,
+     * because this process archives them. No local node id means no pin, and an
+     * unpinned singleton call could be answered by another host — refuse.
+     */
+    private databaseOwner;
     /**
      * Push the staged archive to a single destination via chunked
      * upload, then update the per-location manifest. Applies the

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BUejKKBm.js");
+const require_dist = require("../../dist-Bx4zxM9N.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");
@@ -2874,8 +2874,7 @@ var Tr = Symbol("onEntry"), gs = Symbol("checkFs"), xr = Symbol("checkFs2"), bs
 			return this[O$1](o, t);
 		}
 	}
-};
-var co = (s) => {
+}, co = (s) => {
 	let t = new Te(s), e = s.file, i = node_fs$1.default.statSync(e);
 	new Me(e, {
 		readSize: s.maxReadSize || 16 * 1024 * 1024,
@@ -2895,7 +2894,8 @@ var co = (s) => {
 			}
 		});
 	});
-}, uo = K(co, fo, (s) => new Te(s), (s) => new Xt(s), (s, t) => {
+};
+K(co, fo, (s) => new Te(s), (s) => new Xt(s), (s, t) => {
 	t?.length && Xi(s, t);
 });
 var mo = (s, t) => {
@@ -3016,6 +3016,44 @@ var BackupCancelledError = class extends Error {
 		this.name = "BackupCancelledError";
 	}
 };
+/**
+* Thrown when an archive would carry a live database and its owner could not
+* produce a verified snapshot of it (D693). Nothing was built: a run that
+* "succeeded" without the database — or with a torn copy of it — would push
+* the oldest good archive out of every destination's retention.
+*/
+var BackupSnapshotRefusedError = class extends Error {
+	constructor(reason) {
+		super(`settings database snapshot failed — no archive built, nothing uploaded, retention untouched: ${reason}`);
+		this.name = "BackupSnapshotRefusedError";
+	}
+};
+/**
+* Settle with `pending`, or reject with {@link BackupCancelledError} as soon as
+* `signal` fires. A pending call abandoned by the cancel still settles later:
+* `onAbandoned` runs then, to clean up what it produced.
+*/
+function raceAbort(pending, signal, onAbandoned) {
+	if (signal === void 0) return pending;
+	return new Promise((resolve, reject) => {
+		let abandoned = false;
+		const onAbort = () => {
+			abandoned = true;
+			reject(new BackupCancelledError());
+		};
+		if (signal.aborted) onAbort();
+		else signal.addEventListener("abort", onAbort, { once: true });
+		pending.then((value) => {
+			signal.removeEventListener("abort", onAbort);
+			if (abandoned) onAbandoned();
+			else resolve(value);
+		}, (err) => {
+			signal.removeEventListener("abort", onAbort);
+			if (abandoned) onAbandoned();
+			else reject(err);
+		});
+	});
+}
 /** Throw `BackupCancelledError` when the signal has fired. */
 function throwIfCancelled(signal) {
 	if (signal?.aborted) throw new BackupCancelledError();
@@ -3068,11 +3106,48 @@ var EXCLUDED_DIR_NAME = "node_modules";
 * trailing `/`) and backslash separators.
 */
 function isExcludedFromBackup(relPath) {
-	const norm = relPath.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
+	const norm = normalizeArchivePath(relPath);
 	if (norm.length === 0) return false;
-	if (norm.split("/").includes(EXCLUDED_DIR_NAME)) return true;
+	const segments = norm.split("/");
+	if (segments.includes(EXCLUDED_DIR_NAME)) return true;
+	if (segments.some((seg) => seg.endsWith(".backup-snapshot-partial"))) return true;
+	if (norm.endsWith(".backup-snapshot")) return true;
 	return DEFAULT_BACKUP_EXCLUDES.some((prefix) => norm === prefix || norm.startsWith(`${prefix}/`));
 }
+/** `./a/b/` and `a\\b` → `a/b`: the one spelling every archive-path comparison uses. */
+function normalizeArchivePath(relPath) {
+	return relPath.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
+}
+/** The files SQLite keeps beside a database. A live one is never archived. */
+var SQLITE_SIDECAR_SUFFIXES = [
+	"-wal",
+	"-shm",
+	"-journal"
+];
+var SQLITE_DATABASE_SUFFIXES = [
+	".db",
+	".sqlite",
+	".sqlite3"
+];
+/**
+* The database a `-wal` / `-shm` / `-journal` belongs to, or null for any other
+* path. The base must name a database (`.db` / `.sqlite` / `.sqlite3`): a
+* `build-journal` is not a sidecar, and must not stop every backup as a "live
+* database" that does not exist.
+*/
+function databaseOfSidecar(relPath) {
+	for (const suffix of SQLITE_SIDECAR_SUFFIXES) {
+		if (!relPath.endsWith(suffix)) continue;
+		const db = relPath.slice(0, -suffix.length);
+		return SQLITE_DATABASE_SUFFIXES.some((dbSuffix) => db.endsWith(dbSuffix)) ? db : null;
+	}
+	return null;
+}
+/** A SQLite database file, or a sidecar of one. */
+function isSqlitePath(relPath) {
+	const db = databaseOfSidecar(relPath) ?? relPath;
+	return SQLITE_DATABASE_SUFFIXES.some((suffix) => db.endsWith(suffix));
+}
 /** Path of the manifest file embedded inside every archive. */
 var ARCHIVE_MANIFEST_NAME = ".camstack-backup-manifest.json";
 var DEFAULT_STAT_CACHE_TTL_MS = 6e4;
@@ -3168,28 +3243,75 @@ var SystemBackupService = class {
 		}
 		if (present.length === 0) throw new Error(`createArchive: no locations from {${requested.join(", ")}} exist under ${this.dataDir}`);
 		node_fs.mkdirSync(node_path.dirname(opts.archivePath), { recursive: true });
-		const entries = [];
+		const walked = [];
 		for (const loc of present) {
 			throwIfCancelled(opts.signal);
 			const abs = node_path.join(this.dataDir, loc);
 			const stat = await node_fs_promises.stat(abs);
-			if (stat.isDirectory()) for (const e of await walkAbs(abs, this.dataDir, this.exclusionPredicate(), opts.signal)) entries.push(e);
-			else entries.push(toArchiveEntry(abs, this.dataDir, stat));
+			if (stat.isDirectory()) for (const e of await walkAbs(abs, this.dataDir, this.exclusionPredicate(), opts.signal)) walked.push(e);
+			else if (!isExcludedFromBackup(node_path.relative(this.dataDir, abs))) walked.push(toArchiveEntry(abs, this.dataDir, stat));
+		}
+		const walkedPaths = new Set(walked.map((e) => e.path));
+		const owned = walked.some((e) => isSqlitePath(e.path)) ? await this.ownedDatabasesInScope(opts.owner, walkedPaths) : /* @__PURE__ */ new Set();
+		const unowned = /* @__PURE__ */ new Set();
+		for (const e of walked) {
+			const db = databaseOfSidecar(e.path);
+			if (db !== null && !owned.has(db)) unowned.add(db);
+		}
+		if (unowned.size > 0) {
+			const databases = [...unowned].sort();
+			this.logger.error("createArchive: a live SQLite database has no owner snapshot — no archive built", { meta: {
+				databases,
+				archivePath: opts.archivePath
+			} });
+			throw new BackupSnapshotRefusedError(`live SQLite database ${databases.join(", ")} has no owner that can snapshot it — a copy of its files would be torn; remove its stale -wal/-shm/-journal if nothing has it open, or leave its location out of the backup`);
 		}
-		const manifest = {
-			archiveVersion: 1,
-			createdAt: Date.now(),
-			dataDir: this.dataDir,
-			locations: present,
-			entries,
-			totalBytes: entries.reduce((acc, e) => acc + e.sizeBytes, 0),
-			totalFiles: entries.filter((e) => e.kind === "file").length
-		};
+		const snapshot = owned.size > 0 && opts.owner ? await this.takeOwnerSnapshot(opts.owner, owned, opts.signal) : null;
+		try {
+			const liveFiles = /* @__PURE__ */ new Set();
+			for (const db of owned) {
+				liveFiles.add(db);
+				for (const suffix of SQLITE_SIDECAR_SUFFIXES) liveFiles.add(db + suffix);
+			}
+			const entries = walked.filter((e) => !liveFiles.has(e.path));
+			if (snapshot !== null) entries.push(snapshot.entry);
+			const manifest = {
+				archiveVersion: 1,
+				createdAt: Date.now(),
+				dataDir: this.dataDir,
+				locations: present,
+				entries,
+				totalBytes: entries.reduce((acc, e) => acc + e.sizeBytes, 0),
+				totalFiles: entries.filter((e) => e.kind === "file").length,
+				...snapshot !== null ? { sqliteSnapshots: [snapshot.archived] } : {}
+			};
+			const carriedSnapshot = snapshot?.archived.snapshotPath ?? null;
+			return await this.writeArchive({
+				archivePath: opts.archivePath,
+				present,
+				manifest,
+				excluded: (rel) => {
+					if (rel === carriedSnapshot) return false;
+					return liveFiles.has(rel) || isExcludedFromBackup(rel);
+				},
+				...opts.signal ? { signal: opts.signal } : {},
+				...opts.onArchiveBytes ? { onArchiveBytes: opts.onArchiveBytes } : {}
+			});
+		} finally {
+			if (snapshot !== null) await this.removeSnapshot(snapshot.absPath);
+		}
+	}
+	/**
+	* Tar `present` (filtered by `excluded`) plus the staged manifest into
+	* `archivePath`.
+	*/
+	async writeArchive(opts) {
+		const { present, manifest } = opts;
 		const manifestStagePath = `${opts.archivePath}.${process.pid}.manifest.json`;
 		node_fs.writeFileSync(manifestStagePath, JSON.stringify(manifest, null, 2), "utf-8");
 		this.logger.info("createArchive: tarring", { meta: {
 			archivePath: opts.archivePath,
-			locations: present,
+			locations: [...present],
 			totalFiles: manifest.totalFiles,
 			totalBytes: manifest.totalBytes
 		} });
@@ -3205,8 +3327,8 @@ var SystemBackupService = class {
 					follow: true,
 					portable: true,
 					filter: (entryPath) => {
-						const norm = entryPath.replace(/^\.\//, "").replace(/\/+$/, "");
-						if (isExcludedFromBackup(norm)) return false;
+						const norm = normalizeArchivePath(entryPath);
+						if (opts.excluded(norm)) return false;
 						if (!excludePrefix) return true;
 						return norm !== excludePrefix && !norm.startsWith(`${excludePrefix}/`);
 					}
@@ -3234,7 +3356,7 @@ var SystemBackupService = class {
 		const sizeBytes = node_fs.statSync(opts.archivePath).size;
 		return {
 			archivePath: opts.archivePath,
-			includedLocations: present,
+			includedLocations: [...present],
 			sizeBytes,
 			manifest
 		};
@@ -3287,41 +3409,11 @@ var SystemBackupService = class {
 		});
 	}
 	/**
-	* Extract a previously-created archive over `targetDir`. Used at boot
-	* by the restore hook — never call from a running server (would
-	* corrupt sqlite mid-run).
-	*
-	* `locations` is an optional whitelist: only entries whose path
-	* starts with one of the locations get extracted. Used by the
-	* partial-restore flow where the operator picks a subset of the
-	* archive contents to apply (e.g. "restore my devices but keep
-	* my current TLS certs").
-	*/
-	async extractArchive(opts) {
-		if (!node_fs.existsSync(opts.archivePath)) throw new Error(`extractArchive: ${opts.archivePath} does not exist`);
-		node_fs.mkdirSync(opts.targetDir, { recursive: true });
-		this.logger.info("extractArchive: untarring", { meta: {
-			archivePath: opts.archivePath,
-			targetDir: opts.targetDir,
-			locations: opts.locations
-		} });
-		const allowedPrefixes = opts.locations ? opts.locations.map(normalizeLocation) : null;
-		await uo({
-			file: opts.archivePath,
-			cwd: opts.targetDir,
-			filter: (p) => {
-				if (p === ".camstack-backup-manifest.json" || p === `./.camstack-backup-manifest.json`) return false;
-				if (!allowedPrefixes) return true;
-				const normalized = p.replace(/^\.\//, "");
-				return allowedPrefixes.some((prefix) => entryMatchesLocation(normalized, prefix));
-			}
-		});
-	}
-	/**
 	* Schedule a restore for the next boot by writing a marker file.
-	* `locations` (optional) carries through to the boot-time
-	* extractArchive call so the operator's "restore only X and Y"
-	* choice survives the process restart.
+	* `locations` (optional) carries through to the launcher's boot-time
+	* restore (`server/backend/src/launcher.ts`, the only restore there is)
+	* so the operator's "restore only X and Y" choice survives the process
+	* restart.
 	*/
 	scheduleRestoreMarker(opts) {
 		if (!node_fs.existsSync(opts.archivePath)) throw new Error(`scheduleRestoreMarker: ${opts.archivePath} missing`);
@@ -3354,6 +3446,117 @@ var SystemBackupService = class {
 		const markerPath = this.getRestoreMarkerPath();
 		if (node_fs.existsSync(markerPath)) node_fs.rmSync(markerPath, { force: true });
 	}
+	/**
+	* The databases the owner declares, archive-relative, that this walk found.
+	* One outside this data root is not in scope. An owner that cannot answer
+	* stops the archive: without the answer, nothing says which file is live.
+	*/
+	async ownedDatabasesInScope(owner, walked) {
+		if (owner === void 0) return /* @__PURE__ */ new Set();
+		let declared;
+		try {
+			declared = await owner.listDatabases();
+		} catch (err) {
+			const reason = err instanceof Error ? err.message : String(err);
+			this.logger.error("createArchive: the database owner did not say what it owns — no archive built", { meta: { error: reason } });
+			throw new BackupSnapshotRefusedError(`the database owner could not be asked: ${reason}`);
+		}
+		const inScope = /* @__PURE__ */ new Set();
+		for (const abs of declared) {
+			const rel = this.archiveRelative(abs);
+			if (rel !== null && walked.has(rel)) inScope.add(rel);
+		}
+		return inScope;
+	}
+	/**
+	* Ask the owner for its snapshot, and place it in this archive. The snapshot
+	* must sit on THIS data root — the call is pinned to this node, so a path
+	* elsewhere means it reached another host, and that file is not ours to
+	* read — beside an owned database in scope, and it must cover EVERY owned
+	* database in scope. Anything else is refused.
+	*
+	* Only ever DELETED here: `<owned db>.backup-snapshot` under this data root,
+	* a name this process derives itself. A path the owner ANSWERS is never
+	* deleted on its word — answering the live database as the snapshot would
+	* otherwise delete the live database. A file at any other path is left to
+	* the owner's own sweep.
+	*
+	* A cancel is honoured while the owner is still copying; the copy it may
+	* finish afterwards is removed when that call settles.
+	*/
+	async takeOwnerSnapshot(owner, owned, signal) {
+		const removeOwnedSnapshots = async () => {
+			for (const db of owned) await this.removeSnapshot(node_path.join(this.dataDir, db + require_dist.DATABASE_SNAPSHOT_SUFFIX));
+		};
+		let result;
+		try {
+			result = await raceAbort(owner.writeSnapshot(), signal, () => {
+				this.logger.info("createArchive: run cancelled while the owner copied — its copy is removed when it lands", { meta: { databases: [...owned] } });
+				return removeOwnedSnapshots();
+			});
+		} catch (err) {
+			if (err instanceof BackupCancelledError) throw err;
+			const reason = err instanceof Error ? err.message : String(err);
+			this.logger.error("createArchive: the owner could not snapshot its live database — no archive built", { meta: {
+				databases: [...owned],
+				error: reason
+			} });
+			await removeOwnedSnapshots();
+			throw new BackupSnapshotRefusedError(reason);
+		}
+		try {
+			const livePath = this.archiveRelative(result.livePath);
+			const snapshotPath = this.archiveRelative(result.snapshotPath);
+			if (livePath === null || snapshotPath === null) {
+				this.logger.warn("createArchive: the owner answered a snapshot outside this data root — not touched, left to its sweep", { meta: {
+					snapshot: result.snapshotPath,
+					dataDir: this.dataDir
+				} });
+				throw new BackupSnapshotRefusedError(`snapshot ${result.snapshotPath} is not under this archive's data root ${this.dataDir}`);
+			}
+			if (snapshotPath !== livePath + ".backup-snapshot") throw new BackupSnapshotRefusedError(`snapshot ${snapshotPath} does not sit beside the database ${livePath} it copies`);
+			const uncovered = [...owned].filter((db) => db !== livePath);
+			if (!owned.has(livePath) || uncovered.length > 0) throw new BackupSnapshotRefusedError(`snapshot copies ${livePath}, but the owned database(s) in this archive are ${[...owned].join(", ")}`);
+			const absPath = node_path.join(this.dataDir, snapshotPath);
+			const stat = await node_fs_promises.stat(absPath);
+			this.logger.info("createArchive: carrying the owner snapshot in place of the live database", { meta: {
+				database: livePath,
+				snapshot: snapshotPath,
+				sizeBytes: stat.size,
+				tables: result.tables.length,
+				copyMs: result.copyMs,
+				verifyMs: result.verifyMs
+			} });
+			return {
+				absPath,
+				archived: {
+					...result,
+					livePath,
+					snapshotPath
+				},
+				entry: toArchiveEntry(absPath, this.dataDir, stat)
+			};
+		} catch (err) {
+			await removeOwnedSnapshots();
+			throw err;
+		}
+	}
+	async removeSnapshot(absPath) {
+		try {
+			await node_fs_promises.rm(absPath, { force: true });
+		} catch (err) {
+			this.logger.warn("createArchive: owner snapshot could not be removed", { meta: {
+				snapshot: absPath,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+		}
+	}
+	/** `abs` relative to the data root, or null when it lies outside it. */
+	archiveRelative(abs) {
+		const rel = node_path.relative(node_path.resolve(this.dataDir), node_path.resolve(abs));
+		if (rel.length === 0 || rel.startsWith("..") || node_path.isAbsolute(rel)) return null;
+		return normalizeArchivePath(rel);
+	}
 	getRestoreMarkerPath() {
 		return node_path.join(this.dataDir, ".pending-restore.json");
 	}
@@ -3420,23 +3623,6 @@ function toArchiveEntry(abs, dataDir, stat) {
 		mtime: stat.mtimeMs
 	};
 }
-/**
-* Strip leading `./` and trailing `/` so location prefix matching is
-* order-of-comparison invariant. Same shape on both sides of the
-* `entry.path.startsWith(prefix)` test in the extract filter.
-*/
-function normalizeLocation(loc) {
-	return loc.replace(/^\.\//, "").replace(/\/+$/, "");
-}
-/**
-* Match an archive entry path against a location whitelist prefix.
-* `addons` matches `addons` (file) and `addons/foo/bar.txt` (path
-* inside the dir). The trailing `/` test is what prevents `addons`
-* from spuriously matching `addons-data`.
-*/
-function entryMatchesLocation(entryPath, prefix) {
-	return entryPath === prefix || entryPath.startsWith(`${prefix}/`);
-}
 //#endregion
 //#region ../../node_modules/croner/dist/croner.js
 function T(s) {
@@ -5713,12 +5899,22 @@ var BackupOrchestratorAddon = class extends require_dist.BaseAddon {
 		const archiveId = (0, node_crypto.randomUUID)();
 		const archiveFilename = `${archiveId}.tar.gz`;
 		const cachePath = await this.stagingPath(archiveFilename);
-		const result = await this.systemBackup.createArchive({
-			archivePath: cachePath,
-			...input.locations ? { locations: [...input.locations] } : {},
-			signal,
-			onArchiveBytes: (bytes) => progress.setStagedBytes(bytes)
-		});
+		let result;
+		try {
+			result = await this.systemBackup.createArchive({
+				archivePath: cachePath,
+				...input.locations ? { locations: [...input.locations] } : {},
+				signal,
+				onArchiveBytes: (bytes) => progress.setStagedBytes(bytes),
+				owner: this.databaseOwner()
+			});
+		} catch (err) {
+			if (err instanceof BackupSnapshotRefusedError) for (const dest of targets) {
+				progress.destinationFailed(dest.id);
+				await this.recordDestinationOutcome(dest.id, Date.now(), err.message);
+			}
+			throw err;
+		}
 		progress.setArchiveSize(result.sizeBytes);
 		progress.setPhase("uploading");
 		try {
@@ -5799,6 +5995,25 @@ var BackupOrchestratorAddon = class extends require_dist.BaseAddon {
 		}
 	}
 	/**
+	* THIS node's database owner (D693), reached through `database-snapshot`
+	* pinned to the local node: the paths it answers must be on this host,
+	* because this process archives them. No local node id means no pin, and an
+	* unpinned singleton call could be answered by another host — refuse.
+	*/
+	databaseOwner() {
+		const pin = () => {
+			const localNodeId = this.ctx.kernel.localNodeId;
+			if (localNodeId === void 0 || localNodeId.length === 0) throw new Error("no local node id — the database owner cannot be pinned to this host");
+			return require_dist.nodePin(require_dist.toNodeId(localNodeId));
+		};
+		return {
+			listDatabases: async () => {
+				return (await this.ctx.api.databaseSnapshot.listDatabases.query({}, pin())).databases.map((d) => d.livePath);
+			},
+			writeSnapshot: async () => this.ctx.api.databaseSnapshot.writeSnapshot.mutate({}, pin())
+		};
+	}
+	/**
 	* Push the staged archive to a single destination via chunked
 	* upload, then update the per-location manifest. Applies the
 	* destination's retention policy as part of the same lock-protected