@camstack/system 1.2.423 → 1.2.425

package/dist/{restore-archive-DjppfrIB.js → restore-archive-C4UhQOsg.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-VIIxVsBW.js");
+const require_dist = require("./dist-DnALrQF-.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");
@@ -3508,6 +3508,11 @@ function isSqlitePath(relPath) {
 	const db = databaseOfSidecar(relPath) ?? relPath;
 	return SQLITE_DATABASE_SUFFIXES.some((suffix) => db.endsWith(suffix));
 }
+/**
+* The databases a run carries when it states none: the minimum (D382). A
+* schedule, a manual run and `createArchive` all fall back to this one value.
+*/
+var DEFAULT_BACKUP_DATABASES = ["settings"];
 /** Path of the manifest file embedded inside every archive. */
 var ARCHIVE_MANIFEST_NAME = ".camstack-backup-manifest.json";
 var DEFAULT_STAT_CACHE_TTL_MS = 6e4;
@@ -3596,6 +3601,8 @@ var SystemBackupService = class {
 		throwIfCancelled(opts.signal);
 		const recipient = opts.encryptTo !== void 0 ? parseBackupPublicKey(opts.encryptTo) : null;
 		const requested = opts.locations ?? DEFAULT_BACKUP_LOCATIONS;
+		const selection = new Set(opts.databases ?? DEFAULT_BACKUP_DATABASES);
+		if (!selection.has("settings")) return this.createSnapshotsOnlyArchive(opts, selection, recipient);
 		const present = [];
 		for (const loc of requested) {
 			const abs = node_path.isAbsolute(loc) ? loc : node_path.join(this.dataDir, loc);
@@ -3613,7 +3620,12 @@ var SystemBackupService = class {
 			else if (!isExcludedFromBackup(node_path.relative(this.dataDir, abs))) walked.push(toArchiveEntry(abs, this.dataDir, stat));
 		}
 		const walkedPaths = new Set(walked.map((e) => e.path));
-		const owned = walked.some((e) => isSqlitePath(e.path)) ? await this.ownedDatabasesInScope(opts.owner, walkedPaths) : /* @__PURE__ */ new Set();
+		const ownedById = walked.some((e) => isSqlitePath(e.path)) ? await this.ownedDatabasesInScope(opts.owner, walkedPaths) : /* @__PURE__ */ new Map();
+		const owned = new Set(ownedById.keys());
+		const selected = /* @__PURE__ */ new Map();
+		const omitted = /* @__PURE__ */ new Set();
+		for (const [rel, databaseId] of ownedById) if (selection.has(databaseId)) selected.set(rel, databaseId);
+		else omitted.add(databaseId);
 		const unowned = /* @__PURE__ */ new Set();
 		for (const e of walked) {
 			const db = databaseOfSidecar(e.path);
@@ -3627,7 +3639,7 @@ var SystemBackupService = class {
 			} });
 			throw new BackupSnapshotRefusedError(`live SQLite database ${databases.join(", ")} has no owner that can snapshot it — a copy of its files would be torn; remove its stale -wal/-shm/-journal if nothing has it open, or leave its location out of the backup`);
 		}
-		const snapshot = owned.size > 0 && opts.owner ? await this.takeOwnerSnapshot(opts.owner, owned, opts.signal) : null;
+		const snapshots = selected.size > 0 && opts.owner ? await this.takeOwnerSnapshots(opts.owner, selected, opts.signal) : [];
 		try {
 			const liveFiles = /* @__PURE__ */ new Set();
 			for (const db of owned) {
@@ -3635,7 +3647,7 @@ var SystemBackupService = class {
 				for (const suffix of SQLITE_SIDECAR_SUFFIXES) liveFiles.add(db + suffix);
 			}
 			const entries = walked.filter((e) => !liveFiles.has(e.path));
-			if (snapshot !== null) entries.push(snapshot.entry);
+			for (const snapshot of snapshots) entries.push(snapshot.entry);
 			const manifest = {
 				archiveVersion: 1,
 				createdAt: Date.now(),
@@ -3644,15 +3656,20 @@ var SystemBackupService = class {
 				entries,
 				totalBytes: entries.reduce((acc, e) => acc + e.sizeBytes, 0),
 				totalFiles: entries.filter((e) => e.kind === "file").length,
-				...snapshot !== null ? { sqliteSnapshots: [snapshot.archived] } : {}
+				...snapshots.length > 0 ? { sqliteSnapshots: snapshots.map((snapshot) => snapshot.archived) } : {},
+				...omitted.size > 0 ? { omittedDatabases: [...omitted].toSorted() } : {}
 			};
-			const carriedSnapshot = snapshot?.archived.snapshotPath ?? null;
+			if (omitted.size > 0) this.logger.info("createArchive: owned databases left out of this run", { meta: {
+				omitted: [...omitted].toSorted(),
+				carried: [...selected.values()]
+			} });
+			const carriedSnapshots = new Set(snapshots.map((snapshot) => snapshot.archived.snapshotPath));
 			return await this.writeArchive({
 				archivePath: opts.archivePath,
 				present,
 				manifest,
 				excluded: (rel) => {
-					if (rel === carriedSnapshot) return false;
+					if (carriedSnapshots.has(rel)) return false;
 					return liveFiles.has(rel) || isExcludedFromBackup(rel);
 				},
 				...opts.signal ? { signal: opts.signal } : {},
@@ -3666,7 +3683,62 @@ var SystemBackupService = class {
 				}
 			});
 		} finally {
-			if (snapshot !== null) await this.removeSnapshot(snapshot.absPath);
+			for (const snapshot of snapshots) await this.removeSnapshot(snapshot.absPath);
+		}
+	}
+	/**
+	* An archive of the selected databases' owner snapshots and the manifest —
+	* no data-root walk, no location, no settings (D852). Refused when the owner
+	* has none of the selected files: an archive of nothing must reach no
+	* destination, because its upload prunes an older archive that has them.
+	*/
+	async createSnapshotsOnlyArchive(opts, selection, recipient) {
+		if (opts.owner === void 0) throw new BackupSnapshotRefusedError("a snapshots-only archive needs the database owner, and none was given");
+		node_fs.mkdirSync(node_path.dirname(opts.archivePath), { recursive: true });
+		const ownedById = await this.ownedDatabasesInScope(opts.owner, null);
+		const selected = /* @__PURE__ */ new Map();
+		for (const [rel, databaseId] of ownedById) if (selection.has(databaseId)) selected.set(rel, databaseId);
+		if (selected.size === 0) {
+			this.logger.warn("createArchive: the owner has none of the selected databases — no archive built", { meta: {
+				requested: [...selection].toSorted(),
+				archivePath: opts.archivePath
+			} });
+			throw new BackupSnapshotRefusedError(`the owner has none of the selected databases (${[...selection].toSorted().join(", ")})`);
+		}
+		const snapshots = await this.takeOwnerSnapshots(opts.owner, selected, opts.signal);
+		try {
+			const entries = snapshots.map((snapshot) => snapshot.entry);
+			const manifest = {
+				archiveVersion: 1,
+				createdAt: Date.now(),
+				dataDir: this.dataDir,
+				locations: [],
+				entries,
+				totalBytes: entries.reduce((acc, e) => acc + e.sizeBytes, 0),
+				totalFiles: entries.length,
+				sqliteSnapshots: snapshots.map((snapshot) => snapshot.archived)
+			};
+			const carried = snapshots.map((snapshot) => snapshot.archived.snapshotPath);
+			const carriedSet = new Set(carried);
+			const result = await this.writeArchive({
+				archivePath: opts.archivePath,
+				present: [],
+				tarRoots: carried,
+				manifest,
+				excluded: (rel) => rel !== ".camstack-backup-manifest.json" && !carriedSet.has(rel),
+				...opts.signal ? { signal: opts.signal } : {},
+				...opts.onArchiveBytes ? { onArchiveBytes: opts.onArchiveBytes } : {},
+				...opts.encryptTo !== void 0 ? { encryptTo: opts.encryptTo } : {}
+			});
+			return recipient === null ? result : {
+				...result,
+				encryption: {
+					scheme: BACKUP_ENCRYPTION_SCHEME,
+					keyId: recipient.keyId
+				}
+			};
+		} finally {
+			for (const snapshot of snapshots) await this.removeSnapshot(snapshot.absPath);
 		}
 	}
 	/**
@@ -3700,7 +3772,7 @@ var SystemBackupService = class {
 						if (!excludePrefix) return true;
 						return norm !== excludePrefix && !norm.startsWith(`${excludePrefix}/`);
 					}
-				}, [ARCHIVE_MANIFEST_NAME, ...present]);
+				}, [ARCHIVE_MANIFEST_NAME, ...opts.tarRoots ?? present]);
 				const sink = node_fs.createWriteStream(opts.archivePath, { mode: 384 });
 				try {
 					const streamOpts = opts.signal ? { signal: opts.signal } : {};
@@ -3817,12 +3889,13 @@ var SystemBackupService = class {
 		if (node_fs.existsSync(markerPath)) node_fs.rmSync(markerPath, { force: true });
 	}
 	/**
-	* The databases the owner declares, archive-relative, that this walk found.
-	* One outside this data root is not in scope. An owner that cannot answer
-	* stops the archive: without the answer, nothing says which file is live.
+	* The databases the owner declares, archive-relative, that this walk found,
+	* with the id of each. One outside this data root is not in scope. An owner
+	* that cannot answer stops the archive: without the answer, nothing says
+	* which file is live.
 	*/
 	async ownedDatabasesInScope(owner, walked) {
-		if (owner === void 0) return /* @__PURE__ */ new Set();
+		if (owner === void 0) return /* @__PURE__ */ new Map();
 		let declared;
 		try {
 			declared = await owner.listDatabases();
@@ -3831,22 +3904,23 @@ var SystemBackupService = class {
 			this.logger.error("createArchive: the database owner did not say what it owns — no archive built", { meta: { error: reason } });
 			throw new BackupSnapshotRefusedError(`the database owner could not be asked: ${reason}`);
 		}
-		const inScope = /* @__PURE__ */ new Set();
-		for (const abs of declared) {
-			const rel = this.archiveRelative(abs);
-			if (rel !== null && walked.has(rel)) inScope.add(rel);
+		const inScope = /* @__PURE__ */ new Map();
+		for (const db of declared) {
+			const rel = this.archiveRelative(db.livePath);
+			if (rel !== null && (walked === null || walked.has(rel))) inScope.set(rel, db.databaseId);
 		}
 		return inScope;
 	}
 	/**
-	* Ask the owner for its snapshot, and place it in this archive. The snapshot
-	* must sit on THIS data root — the call is pinned to this node, so a path
-	* elsewhere means it reached another host, and that file is not ours to
-	* read — beside an owned database in scope, and it must cover EVERY owned
-	* database in scope. Anything else is refused.
+	* Ask the owner for one verified snapshot per SELECTED database, one after
+	* the other, and place each in this archive. A snapshot must sit on THIS data
+	* root — the call is pinned to this node, so a path elsewhere means it
+	* reached another host, and that file is not ours to read — beside the very
+	* database it was asked for. Anything else is refused, and the run builds
+	* nothing: the copies already taken are removed.
 	*
-	* Only ever DELETED here: `<owned db>.backup-snapshot` under this data root,
-	* a name this process derives itself. A path the owner ANSWERS is never
+	* Only ever DELETED here: `<selected db>.backup-snapshot` under this data
+	* root, a name this process derives itself. A path the owner ANSWERS is never
 	* deleted on its word — answering the live database as the snapshot would
 	* otherwise delete the live database. A file at any other path is left to
 	* the owner's own sweep.
@@ -3854,62 +3928,73 @@ var SystemBackupService = class {
 	* A cancel is honoured while the owner is still copying; the copy it may
 	* finish afterwards is removed when that call settles.
 	*/
-	async takeOwnerSnapshot(owner, owned, signal) {
+	async takeOwnerSnapshots(owner, selected, signal) {
 		const removeOwnedSnapshots = async () => {
-			for (const db of owned) await this.removeSnapshot(node_path.join(this.dataDir, db + require_dist.DATABASE_SNAPSHOT_SUFFIX));
+			for (const db of selected.keys()) await this.removeSnapshot(node_path.join(this.dataDir, db + require_dist.DATABASE_SNAPSHOT_SUFFIX));
 		};
+		const taken = [];
+		try {
+			for (const [expectedLive, databaseId] of selected) {
+				throwIfCancelled(signal);
+				taken.push(await this.takeOneSnapshot(owner, databaseId, expectedLive, signal, selected, removeOwnedSnapshots));
+			}
+		} catch (err) {
+			await removeOwnedSnapshots();
+			throw err;
+		}
+		return taken;
+	}
+	async takeOneSnapshot(owner, databaseId, expectedLive, signal, selected, removeOwnedSnapshots) {
 		let result;
 		try {
-			result = await raceAbort(owner.writeSnapshot(), signal, () => {
-				this.logger.info("createArchive: run cancelled while the owner copied — its copy is removed when it lands", { meta: { databases: [...owned] } });
+			result = await raceAbort(owner.writeSnapshot(databaseId), signal, () => {
+				this.logger.info("createArchive: run cancelled while the owner copied — its copy is removed when it lands", { meta: {
+					databases: [...selected.values()],
+					database: databaseId
+				} });
 				return removeOwnedSnapshots();
 			});
 		} catch (err) {
 			if (err instanceof BackupCancelledError) throw err;
 			const reason = err instanceof Error ? err.message : String(err);
 			this.logger.error("createArchive: the owner could not snapshot its live database — no archive built", { meta: {
-				databases: [...owned],
+				databases: [...selected.values()],
+				database: databaseId,
 				error: reason
 			} });
-			await removeOwnedSnapshots();
-			throw new BackupSnapshotRefusedError(reason);
+			throw new BackupSnapshotRefusedError(`${databaseId}: ${reason}`);
 		}
-		try {
-			const livePath = this.archiveRelative(result.livePath);
-			const snapshotPath = this.archiveRelative(result.snapshotPath);
-			if (livePath === null || snapshotPath === null) {
-				this.logger.warn("createArchive: the owner answered a snapshot outside this data root — not touched, left to its sweep", { meta: {
-					snapshot: result.snapshotPath,
-					dataDir: this.dataDir
-				} });
-				throw new BackupSnapshotRefusedError(`snapshot ${result.snapshotPath} is not under this archive's data root ${this.dataDir}`);
-			}
-			if (snapshotPath !== livePath + ".backup-snapshot") throw new BackupSnapshotRefusedError(`snapshot ${snapshotPath} does not sit beside the database ${livePath} it copies`);
-			const uncovered = [...owned].filter((db) => db !== livePath);
-			if (!owned.has(livePath) || uncovered.length > 0) throw new BackupSnapshotRefusedError(`snapshot copies ${livePath}, but the owned database(s) in this archive are ${[...owned].join(", ")}`);
-			const absPath = node_path.join(this.dataDir, snapshotPath);
-			const stat = await node_fs_promises.stat(absPath);
-			this.logger.info("createArchive: carrying the owner snapshot in place of the live database", { meta: {
-				database: livePath,
-				snapshot: snapshotPath,
-				sizeBytes: stat.size,
-				tables: result.tables.length,
-				copyMs: result.copyMs,
-				verifyMs: result.verifyMs
+		const livePath = this.archiveRelative(result.livePath);
+		const snapshotPath = this.archiveRelative(result.snapshotPath);
+		if (livePath === null || snapshotPath === null) {
+			this.logger.warn("createArchive: the owner answered a snapshot outside this data root — not touched, left to its sweep", { meta: {
+				snapshot: result.snapshotPath,
+				dataDir: this.dataDir
 			} });
-			return {
-				absPath,
-				archived: {
-					...result,
-					livePath,
-					snapshotPath
-				},
-				entry: toArchiveEntry(absPath, this.dataDir, stat)
-			};
-		} catch (err) {
-			await removeOwnedSnapshots();
-			throw err;
+			throw new BackupSnapshotRefusedError(`snapshot ${result.snapshotPath} is not under this archive's data root ${this.dataDir}`);
 		}
+		if (snapshotPath !== livePath + ".backup-snapshot") throw new BackupSnapshotRefusedError(`snapshot ${snapshotPath} does not sit beside the database ${livePath} it copies`);
+		if (livePath !== expectedLive || result.databaseId !== databaseId) throw new BackupSnapshotRefusedError(`snapshot copies ${livePath} (${result.databaseId}), but ${databaseId} (${expectedLive}) was asked for`);
+		const absPath = node_path.join(this.dataDir, snapshotPath);
+		const stat = await node_fs_promises.stat(absPath);
+		this.logger.info("createArchive: carrying the owner snapshot in place of the live database", { meta: {
+			database: livePath,
+			databaseId,
+			snapshot: snapshotPath,
+			sizeBytes: stat.size,
+			tables: result.tables.length,
+			copyMs: result.copyMs,
+			verifyMs: result.verifyMs
+		} });
+		return {
+			absPath,
+			archived: {
+				...result,
+				livePath,
+				snapshotPath
+			},
+			entry: toArchiveEntry(absPath, this.dataDir, stat)
+		};
 	}
 	async removeSnapshot(absPath) {
 		try {
@@ -4089,6 +4174,12 @@ Object.defineProperty(exports, "BackupSnapshotRefusedError", {
 		return BackupSnapshotRefusedError;
 	}
 });
+Object.defineProperty(exports, "DEFAULT_BACKUP_DATABASES", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_BACKUP_DATABASES;
+	}
+});
 Object.defineProperty(exports, "ENCRYPTED_BACKUP_SUFFIX", {
 	enumerable: true,
 	get: function() {

package/dist/{restore-archive-bOMZwY0D.mjs → restore-archive-GevpOHw8.mjs}

@@ -1,4 +1,4 @@
-import { g as DATABASE_SNAPSHOT_SUFFIX } from "./dist-DimotS8e.mjs";
+import { g as DATABASE_SNAPSHOT_SUFFIX } from "./dist-DMWeqeTF.mjs";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";
@@ -3497,6 +3497,11 @@ function isSqlitePath(relPath) {
 	const db = databaseOfSidecar(relPath) ?? relPath;
 	return SQLITE_DATABASE_SUFFIXES.some((suffix) => db.endsWith(suffix));
 }
+/**
+* The databases a run carries when it states none: the minimum (D382). A
+* schedule, a manual run and `createArchive` all fall back to this one value.
+*/
+var DEFAULT_BACKUP_DATABASES = ["settings"];
 /** Path of the manifest file embedded inside every archive. */
 var ARCHIVE_MANIFEST_NAME = ".camstack-backup-manifest.json";
 var DEFAULT_STAT_CACHE_TTL_MS = 6e4;
@@ -3585,6 +3590,8 @@ var SystemBackupService = class {
 		throwIfCancelled(opts.signal);
 		const recipient = opts.encryptTo !== void 0 ? parseBackupPublicKey(opts.encryptTo) : null;
 		const requested = opts.locations ?? DEFAULT_BACKUP_LOCATIONS;
+		const selection = new Set(opts.databases ?? DEFAULT_BACKUP_DATABASES);
+		if (!selection.has("settings")) return this.createSnapshotsOnlyArchive(opts, selection, recipient);
 		const present = [];
 		for (const loc of requested) {
 			const abs = path$1.isAbsolute(loc) ? loc : path$1.join(this.dataDir, loc);
@@ -3602,7 +3609,12 @@ var SystemBackupService = class {
 			else if (!isExcludedFromBackup(path$1.relative(this.dataDir, abs))) walked.push(toArchiveEntry(abs, this.dataDir, stat));
 		}
 		const walkedPaths = new Set(walked.map((e) => e.path));
-		const owned = walked.some((e) => isSqlitePath(e.path)) ? await this.ownedDatabasesInScope(opts.owner, walkedPaths) : /* @__PURE__ */ new Set();
+		const ownedById = walked.some((e) => isSqlitePath(e.path)) ? await this.ownedDatabasesInScope(opts.owner, walkedPaths) : /* @__PURE__ */ new Map();
+		const owned = new Set(ownedById.keys());
+		const selected = /* @__PURE__ */ new Map();
+		const omitted = /* @__PURE__ */ new Set();
+		for (const [rel, databaseId] of ownedById) if (selection.has(databaseId)) selected.set(rel, databaseId);
+		else omitted.add(databaseId);
 		const unowned = /* @__PURE__ */ new Set();
 		for (const e of walked) {
 			const db = databaseOfSidecar(e.path);
@@ -3616,7 +3628,7 @@ var SystemBackupService = class {
 			} });
 			throw new BackupSnapshotRefusedError(`live SQLite database ${databases.join(", ")} has no owner that can snapshot it — a copy of its files would be torn; remove its stale -wal/-shm/-journal if nothing has it open, or leave its location out of the backup`);
 		}
-		const snapshot = owned.size > 0 && opts.owner ? await this.takeOwnerSnapshot(opts.owner, owned, opts.signal) : null;
+		const snapshots = selected.size > 0 && opts.owner ? await this.takeOwnerSnapshots(opts.owner, selected, opts.signal) : [];
 		try {
 			const liveFiles = /* @__PURE__ */ new Set();
 			for (const db of owned) {
@@ -3624,7 +3636,7 @@ var SystemBackupService = class {
 				for (const suffix of SQLITE_SIDECAR_SUFFIXES) liveFiles.add(db + suffix);
 			}
 			const entries = walked.filter((e) => !liveFiles.has(e.path));
-			if (snapshot !== null) entries.push(snapshot.entry);
+			for (const snapshot of snapshots) entries.push(snapshot.entry);
 			const manifest = {
 				archiveVersion: 1,
 				createdAt: Date.now(),
@@ -3633,15 +3645,20 @@ var SystemBackupService = class {
 				entries,
 				totalBytes: entries.reduce((acc, e) => acc + e.sizeBytes, 0),
 				totalFiles: entries.filter((e) => e.kind === "file").length,
-				...snapshot !== null ? { sqliteSnapshots: [snapshot.archived] } : {}
+				...snapshots.length > 0 ? { sqliteSnapshots: snapshots.map((snapshot) => snapshot.archived) } : {},
+				...omitted.size > 0 ? { omittedDatabases: [...omitted].toSorted() } : {}
 			};
-			const carriedSnapshot = snapshot?.archived.snapshotPath ?? null;
+			if (omitted.size > 0) this.logger.info("createArchive: owned databases left out of this run", { meta: {
+				omitted: [...omitted].toSorted(),
+				carried: [...selected.values()]
+			} });
+			const carriedSnapshots = new Set(snapshots.map((snapshot) => snapshot.archived.snapshotPath));
 			return await this.writeArchive({
 				archivePath: opts.archivePath,
 				present,
 				manifest,
 				excluded: (rel) => {
-					if (rel === carriedSnapshot) return false;
+					if (carriedSnapshots.has(rel)) return false;
 					return liveFiles.has(rel) || isExcludedFromBackup(rel);
 				},
 				...opts.signal ? { signal: opts.signal } : {},
@@ -3655,7 +3672,62 @@ var SystemBackupService = class {
 				}
 			});
 		} finally {
-			if (snapshot !== null) await this.removeSnapshot(snapshot.absPath);
+			for (const snapshot of snapshots) await this.removeSnapshot(snapshot.absPath);
+		}
+	}
+	/**
+	* An archive of the selected databases' owner snapshots and the manifest —
+	* no data-root walk, no location, no settings (D852). Refused when the owner
+	* has none of the selected files: an archive of nothing must reach no
+	* destination, because its upload prunes an older archive that has them.
+	*/
+	async createSnapshotsOnlyArchive(opts, selection, recipient) {
+		if (opts.owner === void 0) throw new BackupSnapshotRefusedError("a snapshots-only archive needs the database owner, and none was given");
+		fs$1.mkdirSync(path$1.dirname(opts.archivePath), { recursive: true });
+		const ownedById = await this.ownedDatabasesInScope(opts.owner, null);
+		const selected = /* @__PURE__ */ new Map();
+		for (const [rel, databaseId] of ownedById) if (selection.has(databaseId)) selected.set(rel, databaseId);
+		if (selected.size === 0) {
+			this.logger.warn("createArchive: the owner has none of the selected databases — no archive built", { meta: {
+				requested: [...selection].toSorted(),
+				archivePath: opts.archivePath
+			} });
+			throw new BackupSnapshotRefusedError(`the owner has none of the selected databases (${[...selection].toSorted().join(", ")})`);
+		}
+		const snapshots = await this.takeOwnerSnapshots(opts.owner, selected, opts.signal);
+		try {
+			const entries = snapshots.map((snapshot) => snapshot.entry);
+			const manifest = {
+				archiveVersion: 1,
+				createdAt: Date.now(),
+				dataDir: this.dataDir,
+				locations: [],
+				entries,
+				totalBytes: entries.reduce((acc, e) => acc + e.sizeBytes, 0),
+				totalFiles: entries.length,
+				sqliteSnapshots: snapshots.map((snapshot) => snapshot.archived)
+			};
+			const carried = snapshots.map((snapshot) => snapshot.archived.snapshotPath);
+			const carriedSet = new Set(carried);
+			const result = await this.writeArchive({
+				archivePath: opts.archivePath,
+				present: [],
+				tarRoots: carried,
+				manifest,
+				excluded: (rel) => rel !== ".camstack-backup-manifest.json" && !carriedSet.has(rel),
+				...opts.signal ? { signal: opts.signal } : {},
+				...opts.onArchiveBytes ? { onArchiveBytes: opts.onArchiveBytes } : {},
+				...opts.encryptTo !== void 0 ? { encryptTo: opts.encryptTo } : {}
+			});
+			return recipient === null ? result : {
+				...result,
+				encryption: {
+					scheme: BACKUP_ENCRYPTION_SCHEME,
+					keyId: recipient.keyId
+				}
+			};
+		} finally {
+			for (const snapshot of snapshots) await this.removeSnapshot(snapshot.absPath);
 		}
 	}
 	/**
@@ -3689,7 +3761,7 @@ var SystemBackupService = class {
 						if (!excludePrefix) return true;
 						return norm !== excludePrefix && !norm.startsWith(`${excludePrefix}/`);
 					}
-				}, [ARCHIVE_MANIFEST_NAME, ...present]);
+				}, [ARCHIVE_MANIFEST_NAME, ...opts.tarRoots ?? present]);
 				const sink = fs$1.createWriteStream(opts.archivePath, { mode: 384 });
 				try {
 					const streamOpts = opts.signal ? { signal: opts.signal } : {};
@@ -3806,12 +3878,13 @@ var SystemBackupService = class {
 		if (fs$1.existsSync(markerPath)) fs$1.rmSync(markerPath, { force: true });
 	}
 	/**
-	* The databases the owner declares, archive-relative, that this walk found.
-	* One outside this data root is not in scope. An owner that cannot answer
-	* stops the archive: without the answer, nothing says which file is live.
+	* The databases the owner declares, archive-relative, that this walk found,
+	* with the id of each. One outside this data root is not in scope. An owner
+	* that cannot answer stops the archive: without the answer, nothing says
+	* which file is live.
 	*/
 	async ownedDatabasesInScope(owner, walked) {
-		if (owner === void 0) return /* @__PURE__ */ new Set();
+		if (owner === void 0) return /* @__PURE__ */ new Map();
 		let declared;
 		try {
 			declared = await owner.listDatabases();
@@ -3820,22 +3893,23 @@ var SystemBackupService = class {
 			this.logger.error("createArchive: the database owner did not say what it owns — no archive built", { meta: { error: reason } });
 			throw new BackupSnapshotRefusedError(`the database owner could not be asked: ${reason}`);
 		}
-		const inScope = /* @__PURE__ */ new Set();
-		for (const abs of declared) {
-			const rel = this.archiveRelative(abs);
-			if (rel !== null && walked.has(rel)) inScope.add(rel);
+		const inScope = /* @__PURE__ */ new Map();
+		for (const db of declared) {
+			const rel = this.archiveRelative(db.livePath);
+			if (rel !== null && (walked === null || walked.has(rel))) inScope.set(rel, db.databaseId);
 		}
 		return inScope;
 	}
 	/**
-	* Ask the owner for its snapshot, and place it in this archive. The snapshot
-	* must sit on THIS data root — the call is pinned to this node, so a path
-	* elsewhere means it reached another host, and that file is not ours to
-	* read — beside an owned database in scope, and it must cover EVERY owned
-	* database in scope. Anything else is refused.
+	* Ask the owner for one verified snapshot per SELECTED database, one after
+	* the other, and place each in this archive. A snapshot must sit on THIS data
+	* root — the call is pinned to this node, so a path elsewhere means it
+	* reached another host, and that file is not ours to read — beside the very
+	* database it was asked for. Anything else is refused, and the run builds
+	* nothing: the copies already taken are removed.
 	*
-	* Only ever DELETED here: `<owned db>.backup-snapshot` under this data root,
-	* a name this process derives itself. A path the owner ANSWERS is never
+	* Only ever DELETED here: `<selected db>.backup-snapshot` under this data
+	* root, a name this process derives itself. A path the owner ANSWERS is never
 	* deleted on its word — answering the live database as the snapshot would
 	* otherwise delete the live database. A file at any other path is left to
 	* the owner's own sweep.
@@ -3843,62 +3917,73 @@ var SystemBackupService = class {
 	* A cancel is honoured while the owner is still copying; the copy it may
 	* finish afterwards is removed when that call settles.
 	*/
-	async takeOwnerSnapshot(owner, owned, signal) {
+	async takeOwnerSnapshots(owner, selected, signal) {
 		const removeOwnedSnapshots = async () => {
-			for (const db of owned) await this.removeSnapshot(path$1.join(this.dataDir, db + DATABASE_SNAPSHOT_SUFFIX));
+			for (const db of selected.keys()) await this.removeSnapshot(path$1.join(this.dataDir, db + DATABASE_SNAPSHOT_SUFFIX));
 		};
+		const taken = [];
+		try {
+			for (const [expectedLive, databaseId] of selected) {
+				throwIfCancelled(signal);
+				taken.push(await this.takeOneSnapshot(owner, databaseId, expectedLive, signal, selected, removeOwnedSnapshots));
+			}
+		} catch (err) {
+			await removeOwnedSnapshots();
+			throw err;
+		}
+		return taken;
+	}
+	async takeOneSnapshot(owner, databaseId, expectedLive, signal, selected, removeOwnedSnapshots) {
 		let result;
 		try {
-			result = await raceAbort(owner.writeSnapshot(), signal, () => {
-				this.logger.info("createArchive: run cancelled while the owner copied — its copy is removed when it lands", { meta: { databases: [...owned] } });
+			result = await raceAbort(owner.writeSnapshot(databaseId), signal, () => {
+				this.logger.info("createArchive: run cancelled while the owner copied — its copy is removed when it lands", { meta: {
+					databases: [...selected.values()],
+					database: databaseId
+				} });
 				return removeOwnedSnapshots();
 			});
 		} catch (err) {
 			if (err instanceof BackupCancelledError) throw err;
 			const reason = err instanceof Error ? err.message : String(err);
 			this.logger.error("createArchive: the owner could not snapshot its live database — no archive built", { meta: {
-				databases: [...owned],
+				databases: [...selected.values()],
+				database: databaseId,
 				error: reason
 			} });
-			await removeOwnedSnapshots();
-			throw new BackupSnapshotRefusedError(reason);
+			throw new BackupSnapshotRefusedError(`${databaseId}: ${reason}`);
 		}
-		try {
-			const livePath = this.archiveRelative(result.livePath);
-			const snapshotPath = this.archiveRelative(result.snapshotPath);
-			if (livePath === null || snapshotPath === null) {
-				this.logger.warn("createArchive: the owner answered a snapshot outside this data root — not touched, left to its sweep", { meta: {
-					snapshot: result.snapshotPath,
-					dataDir: this.dataDir
-				} });
-				throw new BackupSnapshotRefusedError(`snapshot ${result.snapshotPath} is not under this archive's data root ${this.dataDir}`);
-			}
-			if (snapshotPath !== livePath + ".backup-snapshot") throw new BackupSnapshotRefusedError(`snapshot ${snapshotPath} does not sit beside the database ${livePath} it copies`);
-			const uncovered = [...owned].filter((db) => db !== livePath);
-			if (!owned.has(livePath) || uncovered.length > 0) throw new BackupSnapshotRefusedError(`snapshot copies ${livePath}, but the owned database(s) in this archive are ${[...owned].join(", ")}`);
-			const absPath = path$1.join(this.dataDir, snapshotPath);
-			const stat = await fsp.stat(absPath);
-			this.logger.info("createArchive: carrying the owner snapshot in place of the live database", { meta: {
-				database: livePath,
-				snapshot: snapshotPath,
-				sizeBytes: stat.size,
-				tables: result.tables.length,
-				copyMs: result.copyMs,
-				verifyMs: result.verifyMs
+		const livePath = this.archiveRelative(result.livePath);
+		const snapshotPath = this.archiveRelative(result.snapshotPath);
+		if (livePath === null || snapshotPath === null) {
+			this.logger.warn("createArchive: the owner answered a snapshot outside this data root — not touched, left to its sweep", { meta: {
+				snapshot: result.snapshotPath,
+				dataDir: this.dataDir
 			} });
-			return {
-				absPath,
-				archived: {
-					...result,
-					livePath,
-					snapshotPath
-				},
-				entry: toArchiveEntry(absPath, this.dataDir, stat)
-			};
-		} catch (err) {
-			await removeOwnedSnapshots();
-			throw err;
+			throw new BackupSnapshotRefusedError(`snapshot ${result.snapshotPath} is not under this archive's data root ${this.dataDir}`);
 		}
+		if (snapshotPath !== livePath + ".backup-snapshot") throw new BackupSnapshotRefusedError(`snapshot ${snapshotPath} does not sit beside the database ${livePath} it copies`);
+		if (livePath !== expectedLive || result.databaseId !== databaseId) throw new BackupSnapshotRefusedError(`snapshot copies ${livePath} (${result.databaseId}), but ${databaseId} (${expectedLive}) was asked for`);
+		const absPath = path$1.join(this.dataDir, snapshotPath);
+		const stat = await fsp.stat(absPath);
+		this.logger.info("createArchive: carrying the owner snapshot in place of the live database", { meta: {
+			database: livePath,
+			databaseId,
+			snapshot: snapshotPath,
+			sizeBytes: stat.size,
+			tables: result.tables.length,
+			copyMs: result.copyMs,
+			verifyMs: result.verifyMs
+		} });
+		return {
+			absPath,
+			archived: {
+				...result,
+				livePath,
+				snapshotPath
+			},
+			entry: toArchiveEntry(absPath, this.dataDir, stat)
+		};
 	}
 	async removeSnapshot(absPath) {
 		try {
@@ -4042,4 +4127,4 @@ async function prepareRestoreArchive(input) {
 	}
 }
 //#endregion
-export { BackupSnapshotRefusedError as a, BackupKeyFormatError as c, generateBackupKeyPair as d, parseBackupPublicKey as f, BackupCancelledError as i, BackupKeyMismatchError as l, readBackupEncryptionHeader as m, precheckRestoreKey as n, SystemBackupService as o, parseBackupSecretKey as p, prepareRestoreArchive as r, BackupDecryptError as s, BackupKeyRequiredError as t, ENCRYPTED_BACKUP_SUFFIX as u };
+export { BackupSnapshotRefusedError as a, BackupDecryptError as c, ENCRYPTED_BACKUP_SUFFIX as d, generateBackupKeyPair as f, readBackupEncryptionHeader as h, BackupCancelledError as i, BackupKeyFormatError as l, parseBackupSecretKey as m, precheckRestoreKey as n, DEFAULT_BACKUP_DATABASES as o, parseBackupPublicKey as p, prepareRestoreArchive as r, SystemBackupService as s, BackupKeyRequiredError as t, BackupKeyMismatchError as u };