@camstack/system 1.2.423 → 1.2.425

package/dist/builtins/system-backup/system-backup.service.d.ts

@@ -1,4 +1,4 @@
-import { type ArchiveSqliteSnapshot, type DatabaseSnapshotResult, type IScopedLogger } from "@camstack/types";
+import { type ArchiveSqliteSnapshot, type DatabaseSnapshotWritten, type DataStoreDatabase, type IScopedLogger } from "@camstack/types";
 import { BACKUP_ENCRYPTION_SCHEME } from "./backup-encryption.js";
 /**
 * Thrown when an archive build (or a backup run driving one) is
@@ -58,10 +58,21 @@ export declare function isExcludedFromBackup(relPath: string): boolean;
 * the `database-snapshot` capability, pinned to its own node.
 */
 export interface DatabaseOwner {
-	/** Absolute paths of the databases the owner snapshots. */
-	listDatabases(): Promise<readonly string[]>;
-	writeSnapshot(): Promise<DatabaseSnapshotResult>;
+	/** EVERY database the owner has open: its id, and its absolute path. */
+	listDatabases(): Promise<readonly OwnedDatabase[]>;
+	/** One verified snapshot of ONE database. */
+	writeSnapshot(databaseId: DataStoreDatabase): Promise<DatabaseSnapshotWritten>;
 }
+/** One database file the owner serves. */
+export interface OwnedDatabase {
+	readonly databaseId: DataStoreDatabase;
+	readonly livePath: string;
+}
+/**
+* The databases a run carries when it states none: the minimum (D382). A
+* schedule, a manual run and `createArchive` all fall back to this one value.
+*/
+export declare const DEFAULT_BACKUP_DATABASES: readonly DataStoreDatabase[];
 /** Path of the manifest file embedded inside every archive. */
 export declare const ARCHIVE_MANIFEST_NAME = ".camstack-backup-manifest.json";
 export type ArchiveEntryKind = "file" | "dir" | "symlink";
@@ -94,6 +105,12 @@ export interface ArchiveManifest {
 	* files (D693). Paths are archive-relative.
 	*/
 	sqliteSnapshots?: ArchiveSqliteSnapshot[];
+	/**
+	* Owned databases this run did NOT select: left out of the tar and of
+	* `entries` alike (a live file is never carried anyway). Absent when the
+	* run carried every owned database it found.
+	*/
+	omittedDatabases?: DataStoreDatabase[];
 }
 /** How an archive was encrypted — absent on a plain `.tar.gz`. */
 export interface ArchiveEncryption {
@@ -207,6 +224,12 @@ export declare class SystemBackupService {
 		*/
 		owner?: DatabaseOwner;
 		/**
+		* Which owned databases this run carries as snapshots; the others are left
+		* out and listed in `manifest.omittedDatabases`. Absent = `['settings']`
+		* ({@link DEFAULT_BACKUP_DATABASES}): an unstated ask is the minimum.
+		*/
+		databases?: readonly DataStoreDatabase[];
+		/**
 		* A backup PUBLIC key: the gzip stream is encrypted to it as it is
 		* written, so no plaintext archive ever touches the staging disk. Parsed
 		* before any work — a bad key builds nothing.
@@ -214,6 +237,13 @@ export declare class SystemBackupService {
 		encryptTo?: string;
 	}): Promise<CreateArchiveResult>;
 	/**
+	* An archive of the selected databases' owner snapshots and the manifest —
+	* no data-root walk, no location, no settings (D852). Refused when the owner
+	* has none of the selected files: an archive of nothing must reach no
+	* destination, because its upload prunes an older archive that has them.
+	*/
+	private createSnapshotsOnlyArchive;
+	/**
 	* Tar `present` (filtered by `excluded`) plus the staged manifest into
 	* `archivePath`.
 	*/
@@ -240,20 +270,22 @@ export declare class SystemBackupService {
 	/** Drop the marker after a successful boot-time restore. */
 	clearPendingMarker(): void;
 	/**
-	* The databases the owner declares, archive-relative, that this walk found.
-	* One outside this data root is not in scope. An owner that cannot answer
-	* stops the archive: without the answer, nothing says which file is live.
+	* The databases the owner declares, archive-relative, that this walk found,
+	* with the id of each. One outside this data root is not in scope. An owner
+	* that cannot answer stops the archive: without the answer, nothing says
+	* which file is live.
 	*/
 	private ownedDatabasesInScope;
 	/**
-	* Ask the owner for its snapshot, and place it in this archive. The snapshot
-	* must sit on THIS data root — the call is pinned to this node, so a path
-	* elsewhere means it reached another host, and that file is not ours to
-	* read — beside an owned database in scope, and it must cover EVERY owned
-	* database in scope. Anything else is refused.
+	* Ask the owner for one verified snapshot per SELECTED database, one after
+	* the other, and place each in this archive. A snapshot must sit on THIS data
+	* root — the call is pinned to this node, so a path elsewhere means it
+	* reached another host, and that file is not ours to read — beside the very
+	* database it was asked for. Anything else is refused, and the run builds
+	* nothing: the copies already taken are removed.
 	*
-	* Only ever DELETED here: `<owned db>.backup-snapshot` under this data root,
-	* a name this process derives itself. A path the owner ANSWERS is never
+	* Only ever DELETED here: `<selected db>.backup-snapshot` under this data
+	* root, a name this process derives itself. A path the owner ANSWERS is never
 	* deleted on its word — answering the live database as the snapshot would
 	* otherwise delete the live database. A file at any other path is left to
 	* the owner's own sweep.
@@ -261,7 +293,8 @@ export declare class SystemBackupService {
 	* A cancel is honoured while the owner is still copying; the copy it may
 	* finish afterwards is removed when that call settles.
 	*/
-	private takeOwnerSnapshot;
+	private takeOwnerSnapshots;
+	private takeOneSnapshot;
 	private removeSnapshot;
 	/** `abs` relative to the data root, or null when it lies outside it. */
 	private archiveRelative;

package/dist/builtins/system-config/system-config.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-VIIxVsBW.js");
+const require_dist = require("../../dist-DnALrQF-.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
-const require_constants$8 = require("../../constants-1_7QtPNo.js");
+const require_constants$8 = require("../../constants-B5Jd8Zch.js");
 const require_x509_es = require("../../x509.es-Dzl0BbmG.js");
 const require_src$1 = require("../../src-CnAqG6EF.js");
 let zod = require("zod");

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,7 +1,7 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { $r as transformSecretWrite, Er as defineCustomActions, Fr as isSecretClear, Ir as isSecretMarker, Rr as makeSecretMarker, Tr as customAction, Yr as secretTreeFromSchema, cr as BaseAddon, jr as hydrateSchema, sr as errMsg } from "../../dist-DimotS8e.mjs";
+import { Dr as defineCustomActions, Er as customAction, Ir as isSecretClear, Lr as isSecretMarker, Mr as hydrateSchema, Xr as secretTreeFromSchema, cr as errMsg, ei as transformSecretWrite, lr as BaseAddon, zr as makeSecretMarker } from "../../dist-DMWeqeTF.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
-import { a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, c as MESH_JOIN_TOKEN_MAX_TTL_SEC, d as CLUSTER_SECRET_REF, i as MESH_CA_FIELD, l as SERVER_AUTH_OID, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID, v as hashClusterSecret } from "../../constants-C2dhkIuF.mjs";
+import { a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, c as MESH_JOIN_TOKEN_MAX_TTL_SEC, d as CLUSTER_SECRET_REF, i as MESH_CA_FIELD, l as SERVER_AUTH_OID, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID, v as hashClusterSecret } from "../../constants-CkNLi-XW.mjs";
 import { a as KeyUsagesExtension, c as Pkcs10CertificateRequestGenerator, d as X509Certificate$1, f as X509CertificateGenerator, i as KeyUsageFlags, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, s as Pkcs10CertificateRequest, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "../../x509.es-CAjSsrkk.mjs";
 import { t as require_src } from "../../src-hG4grMU4.mjs";
 import { z } from "zod";

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-VIIxVsBW.js");
+const require_dist = require("../../dist-DnALrQF-.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Xt as logDestinationCapability, cr as BaseAddon } from "../../dist-DimotS8e.mjs";
+import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-DMWeqeTF.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{composition-sources-CgiAeG-2.js → composition-sources-197keifF.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-VIIxVsBW.js");
+const require_dist = require("./dist-DnALrQF-.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-BXDchWFn.mjs → composition-sources-DmzTSy26.mjs}

@@ -1,4 +1,4 @@
-import { er as compositionSourceKey, sr as errMsg } from "./dist-DimotS8e.mjs";
+import { cr as errMsg, tr as compositionSourceKey } from "./dist-DMWeqeTF.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{constants-1_7QtPNo.js → constants-B5Jd8Zch.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-VIIxVsBW.js");
+const require_dist = require("./dist-DnALrQF-.js");
 let node_crypto = require("node:crypto");
 //#region src/kernel/moleculer/cluster-secret.ts
 /**

package/dist/{constants-C2dhkIuF.mjs → constants-CkNLi-XW.mjs}

@@ -1,4 +1,4 @@
-import { xr as buildSecretRef } from "./dist-DimotS8e.mjs";
+import { Sr as buildSecretRef } from "./dist-DMWeqeTF.mjs";
 import { createHash, timingSafeEqual } from "node:crypto";
 //#region src/kernel/moleculer/cluster-secret.ts
 /**