@camstack/system 1.2.424 → 1.2.425

package/dist/file-host-worker.js

@@ -1,5 +1,5 @@
 require("./chunk-Cek0wNdY.js");
-const require_wal_maintenance = require("./wal-maintenance-BzdCQGjH.js");
+const require_wal_maintenance = require("./wal-maintenance-DJV1rde2.js");
 let node_worker_threads = require("node:worker_threads");
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/file-host-worker.mjs

@@ -1,4 +1,4 @@
-import { C as callControl, E as controlTargetOf, T as callVector, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, c as SqliteSettingsBackend, h as serializeError, o as createVectorIndex, s as vectorProviderOf, w as callData, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-BlqNqaQ3.mjs";
+import { C as callControl, E as controlTargetOf, T as callVector, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, c as SqliteSettingsBackend, h as serializeError, o as createVectorIndex, s as vectorProviderOf, w as callData, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-BtfyfuT5.mjs";
 import { parentPort, threadId, workerData } from "node:worker_threads";
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CiUKtVkX.js");
-const require_jwt_signing_key = require("./jwt-signing-key-nwRpRgf_.js");
+const require_dist = require("./dist-DnALrQF-.js");
+const require_jwt_signing_key = require("./jwt-signing-key-DeqG7LD9.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -22,12 +22,12 @@ require("./builtins/local-auth/index.js");
 const require_builtins_loki_logging_index = require("./builtins/loki-logging/index.js");
 const require_builtins_native_metrics_native_metrics_addon = require("./builtins/native-metrics/native-metrics.addon.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
-const require_wal_maintenance = require("./wal-maintenance-BzdCQGjH.js");
+const require_wal_maintenance = require("./wal-maintenance-DJV1rde2.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
 const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
-const require_constants = require("./constants-BBWZlnpQ.js");
+const require_constants = require("./constants-B5Jd8Zch.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
@@ -35,7 +35,7 @@ const require_custom_action_registry = require("./custom-action-registry-Bf_Ynag
 const require_tls = require("./tls-BgImdxCO.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-mio9dSCT.js");
-const require_restore_archive = require("./restore-archive-DA-aJtg7.js");
+const require_restore_archive = require("./restore-archive-C4UhQOsg.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { $t as looseSchema, Ar as expandCapMethods, Dn as scopesAllowAddon, Gr as readinessKey, Hr as parseJsonObject, Ht as isVoidInput, Jr as scopeKey, Jt as lifecycleJobSchema, K as addonSettingsCapability, Kr as resolveCapMount, Lt as isArrayOutputSchema, M as METHOD_ACCESS_MAP, On as scopesAllowDeviceCap, Or as emitDownForOwnedCaps, Qt as logLevelAtMost, Rt as isCollectionArrayMethod, Tr as createEvent$1, Ur as parseJsonUnknown, Ut as kebabToCamel$1, Vt as isObjectInput, br as asNumber, cn as objectInputDeclaresAddonId, cr as errMsg$1, dr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, fr as DEVICE_STATUS_METHOD, gr as ReadinessTimeoutError, hr as ReadinessRegistry, jt as extractNestedAddonId, k as LOG_LEVEL_RANK, ln as objectInputDeclaresRequiredDeviceId, mn as procedureAuthKey, mr as RUNTIME_DEFAULTS, t as ALL_CAPABILITY_DEFINITIONS, ti as EventCategory$1, ur as DATAPLANE_SECRET_HEADER$1, wn as resolveMethodAuth, xr as asString$1, yr as asJsonObject$1, zn as supportedRuntimes } from "./dist-B-NmfvVC.mjs";
-import { c as staticJwtSigningKey, i as getProcessJwtSigningKeyState, n as JwtSigningKeyUnavailableError, o as processJwtSigningKey, r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "./jwt-signing-key-CUpweD22.mjs";
+import { $t as looseSchema, Ar as expandCapMethods, Dn as scopesAllowAddon, Gr as readinessKey, Hr as parseJsonObject, Ht as isVoidInput, Jr as scopeKey, Jt as lifecycleJobSchema, K as addonSettingsCapability, Kr as resolveCapMount, Lt as isArrayOutputSchema, M as METHOD_ACCESS_MAP, On as scopesAllowDeviceCap, Or as emitDownForOwnedCaps, Qt as logLevelAtMost, Rt as isCollectionArrayMethod, Tr as createEvent$1, Ur as parseJsonUnknown, Ut as kebabToCamel$1, Vt as isObjectInput, br as asNumber, cn as objectInputDeclaresAddonId, cr as errMsg$1, dr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, fr as DEVICE_STATUS_METHOD, gr as ReadinessTimeoutError, hr as ReadinessRegistry, jt as extractNestedAddonId, k as LOG_LEVEL_RANK, ln as objectInputDeclaresRequiredDeviceId, mn as procedureAuthKey, mr as RUNTIME_DEFAULTS, t as ALL_CAPABILITY_DEFINITIONS, ti as EventCategory$1, ur as DATAPLANE_SECRET_HEADER$1, wn as resolveMethodAuth, xr as asString$1, yr as asJsonObject$1, zn as supportedRuntimes } from "./dist-DMWeqeTF.mjs";
+import { c as staticJwtSigningKey, i as getProcessJwtSigningKeyState, n as JwtSigningKeyUnavailableError, o as processJwtSigningKey, r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "./jwt-signing-key-CCHXAtrs.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -21,12 +21,12 @@ import "./builtins/local-auth/index.mjs";
 import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index.mjs";
 import NativeMetricsAddon, { a as NativeMetricsProvider, n as nodeProcReader, r as parseProcStat } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { c as SqliteSettingsBackend, l as prefixRange } from "./wal-maintenance-BlqNqaQ3.mjs";
+import { c as SqliteSettingsBackend, l as prefixRange } from "./wal-maintenance-BtfyfuT5.mjs";
 import { SqliteSettingsAddon } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-DHhhVjkt.mjs";
+import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-CkNLi-XW.mjs";
 import { A as AGENT_UI_UNLOCK_TTL_MS, B as isMeshAuthMode, C as generateMeshCa, D as loadMeshCa, E as issueMeshLeafFromCsr, F as parseAgentDashboardOrigins, G as setProcessMeshEnforcer, H as requestProcessMeshEnforcement, I as verifyAgentUiUnlockTicket, J as parseCidrList, K as createCidrMatcher, L as MESH_AUTH_MODE_FIELD, M as UnlockTicketJtiStore, N as isAllowedAgentDashboardReturnTo, O as AGENT_DASHBOARD_ORIGINS_FIELD, P as mintAgentUiUnlockTicket, R as getProcessMeshAuthMode, S as exportMeshPrivateKeyPem, SystemConfigAddon, T as issueMeshLeafForNode, U as setProcessMeshAuthMode, V as parseMeshAuthMode, W as setProcessMeshAuthStatusSource, Y as readCidrSetting, _ as getProcessMeshCaState, a as ServiceBroker, b as caFingerprintCompact, c as JoinTokenJtiStore, d as verifyMeshJoinToken, f as getProcessNodeMeshTransport, g as MeshCaKeeper, h as processMeshCrl, i as Errors, j as AGENT_UI_UNLOCK_VERSION, k as AGENT_UI_UNLOCK_DOMAIN, l as mintMeshJoinToken, m as MeshCrl, n as MESH_TLS_PORT_HELLO_FIELD, o as setProcessMeshTlsEnabler, p as setProcessMeshPeerTransportLookup, q as normalizeIp, r as TlsTcpTransporter, s as enrollMeshNode, u as processJoinTokenJtiStore, v as requireProcessMeshCa, w as generateMeshKeyPair, x as createMeshCsrPem, y as caFingerprint, z as getProcessMeshAuthStatus } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
@@ -34,7 +34,7 @@ import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as
 import { A as allFamiliesListenHost, C as collectCertIdentity, D as SERVER_AUTH_OID, E as MAX_LEAF_VALIDITY_DAYS, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as evaluateExistingCert, P as readLanHttpState, S as CA_COMMON_NAME, T as LEAF_RENEWAL_WINDOW_DAYS, _ as writeExtraSans, a as validateUploadedTls, b as loadTlsCert, c as registerHttpsListener, d as prepareBootTls, f as UPLOADED_CA_FILE, g as splitPemCertificates, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as reloadHttpsListener, m as readTlsAccessStatus, n as regenerateCertificate, o as clearHttpsListener, p as readExtraSans, r as revertToGeneratedCertificate, s as leafFingerprintOf, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, v as writeTlsMode, w as CA_VALIDITY_DAYS, x as reissueTlsLeaf, y as ensureTlsCert } from "./tls-CaOLZ09W.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { c as BackupKeyFormatError, d as generateBackupKeyPair, l as BackupKeyMismatchError, m as readBackupEncryptionHeader, o as SystemBackupService, r as prepareRestoreArchive, s as BackupDecryptError, t as BackupKeyRequiredError } from "./restore-archive-CFmPVlWQ.mjs";
+import { c as BackupDecryptError, f as generateBackupKeyPair, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-GevpOHw8.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";

package/dist/{jwt-signing-key-CUpweD22.mjs → jwt-signing-key-CCHXAtrs.mjs}

@@ -1,4 +1,4 @@
-import { Sr as buildSecretRef } from "./dist-B-NmfvVC.mjs";
+import { Sr as buildSecretRef } from "./dist-DMWeqeTF.mjs";
 import { randomBytes } from "node:crypto";
 //#region src/auth/jwt-signing-key.ts
 /**

package/dist/{jwt-signing-key-nwRpRgf_.js → jwt-signing-key-DeqG7LD9.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CiUKtVkX.js");
+const require_dist = require("./dist-DnALrQF-.js");
 let node_crypto = require("node:crypto");
 //#region src/auth/jwt-signing-key.ts
 /**

package/dist/{restore-archive-DA-aJtg7.js → restore-archive-C4UhQOsg.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CiUKtVkX.js");
+const require_dist = require("./dist-DnALrQF-.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");
@@ -3508,6 +3508,11 @@ function isSqlitePath(relPath) {
 	const db = databaseOfSidecar(relPath) ?? relPath;
 	return SQLITE_DATABASE_SUFFIXES.some((suffix) => db.endsWith(suffix));
 }
+/**
+* The databases a run carries when it states none: the minimum (D382). A
+* schedule, a manual run and `createArchive` all fall back to this one value.
+*/
+var DEFAULT_BACKUP_DATABASES = ["settings"];
 /** Path of the manifest file embedded inside every archive. */
 var ARCHIVE_MANIFEST_NAME = ".camstack-backup-manifest.json";
 var DEFAULT_STAT_CACHE_TTL_MS = 6e4;
@@ -3596,6 +3601,8 @@ var SystemBackupService = class {
 		throwIfCancelled(opts.signal);
 		const recipient = opts.encryptTo !== void 0 ? parseBackupPublicKey(opts.encryptTo) : null;
 		const requested = opts.locations ?? DEFAULT_BACKUP_LOCATIONS;
+		const selection = new Set(opts.databases ?? DEFAULT_BACKUP_DATABASES);
+		if (!selection.has("settings")) return this.createSnapshotsOnlyArchive(opts, selection, recipient);
 		const present = [];
 		for (const loc of requested) {
 			const abs = node_path.isAbsolute(loc) ? loc : node_path.join(this.dataDir, loc);
@@ -3613,7 +3620,12 @@ var SystemBackupService = class {
 			else if (!isExcludedFromBackup(node_path.relative(this.dataDir, abs))) walked.push(toArchiveEntry(abs, this.dataDir, stat));
 		}
 		const walkedPaths = new Set(walked.map((e) => e.path));
-		const owned = walked.some((e) => isSqlitePath(e.path)) ? await this.ownedDatabasesInScope(opts.owner, walkedPaths) : /* @__PURE__ */ new Set();
+		const ownedById = walked.some((e) => isSqlitePath(e.path)) ? await this.ownedDatabasesInScope(opts.owner, walkedPaths) : /* @__PURE__ */ new Map();
+		const owned = new Set(ownedById.keys());
+		const selected = /* @__PURE__ */ new Map();
+		const omitted = /* @__PURE__ */ new Set();
+		for (const [rel, databaseId] of ownedById) if (selection.has(databaseId)) selected.set(rel, databaseId);
+		else omitted.add(databaseId);
 		const unowned = /* @__PURE__ */ new Set();
 		for (const e of walked) {
 			const db = databaseOfSidecar(e.path);
@@ -3627,7 +3639,7 @@ var SystemBackupService = class {
 			} });
 			throw new BackupSnapshotRefusedError(`live SQLite database ${databases.join(", ")} has no owner that can snapshot it — a copy of its files would be torn; remove its stale -wal/-shm/-journal if nothing has it open, or leave its location out of the backup`);
 		}
-		const snapshot = owned.size > 0 && opts.owner ? await this.takeOwnerSnapshot(opts.owner, owned, opts.signal) : null;
+		const snapshots = selected.size > 0 && opts.owner ? await this.takeOwnerSnapshots(opts.owner, selected, opts.signal) : [];
 		try {
 			const liveFiles = /* @__PURE__ */ new Set();
 			for (const db of owned) {
@@ -3635,7 +3647,7 @@ var SystemBackupService = class {
 				for (const suffix of SQLITE_SIDECAR_SUFFIXES) liveFiles.add(db + suffix);
 			}
 			const entries = walked.filter((e) => !liveFiles.has(e.path));
-			if (snapshot !== null) entries.push(snapshot.entry);
+			for (const snapshot of snapshots) entries.push(snapshot.entry);
 			const manifest = {
 				archiveVersion: 1,
 				createdAt: Date.now(),
@@ -3644,15 +3656,20 @@ var SystemBackupService = class {
 				entries,
 				totalBytes: entries.reduce((acc, e) => acc + e.sizeBytes, 0),
 				totalFiles: entries.filter((e) => e.kind === "file").length,
-				...snapshot !== null ? { sqliteSnapshots: [snapshot.archived] } : {}
+				...snapshots.length > 0 ? { sqliteSnapshots: snapshots.map((snapshot) => snapshot.archived) } : {},
+				...omitted.size > 0 ? { omittedDatabases: [...omitted].toSorted() } : {}
 			};
-			const carriedSnapshot = snapshot?.archived.snapshotPath ?? null;
+			if (omitted.size > 0) this.logger.info("createArchive: owned databases left out of this run", { meta: {
+				omitted: [...omitted].toSorted(),
+				carried: [...selected.values()]
+			} });
+			const carriedSnapshots = new Set(snapshots.map((snapshot) => snapshot.archived.snapshotPath));
 			return await this.writeArchive({
 				archivePath: opts.archivePath,
 				present,
 				manifest,
 				excluded: (rel) => {
-					if (rel === carriedSnapshot) return false;
+					if (carriedSnapshots.has(rel)) return false;
 					return liveFiles.has(rel) || isExcludedFromBackup(rel);
 				},
 				...opts.signal ? { signal: opts.signal } : {},
@@ -3666,7 +3683,62 @@ var SystemBackupService = class {
 				}
 			});
 		} finally {
-			if (snapshot !== null) await this.removeSnapshot(snapshot.absPath);
+			for (const snapshot of snapshots) await this.removeSnapshot(snapshot.absPath);
+		}
+	}
+	/**
+	* An archive of the selected databases' owner snapshots and the manifest —
+	* no data-root walk, no location, no settings (D852). Refused when the owner
+	* has none of the selected files: an archive of nothing must reach no
+	* destination, because its upload prunes an older archive that has them.
+	*/
+	async createSnapshotsOnlyArchive(opts, selection, recipient) {
+		if (opts.owner === void 0) throw new BackupSnapshotRefusedError("a snapshots-only archive needs the database owner, and none was given");
+		node_fs.mkdirSync(node_path.dirname(opts.archivePath), { recursive: true });
+		const ownedById = await this.ownedDatabasesInScope(opts.owner, null);
+		const selected = /* @__PURE__ */ new Map();
+		for (const [rel, databaseId] of ownedById) if (selection.has(databaseId)) selected.set(rel, databaseId);
+		if (selected.size === 0) {
+			this.logger.warn("createArchive: the owner has none of the selected databases — no archive built", { meta: {
+				requested: [...selection].toSorted(),
+				archivePath: opts.archivePath
+			} });
+			throw new BackupSnapshotRefusedError(`the owner has none of the selected databases (${[...selection].toSorted().join(", ")})`);
+		}
+		const snapshots = await this.takeOwnerSnapshots(opts.owner, selected, opts.signal);
+		try {
+			const entries = snapshots.map((snapshot) => snapshot.entry);
+			const manifest = {
+				archiveVersion: 1,
+				createdAt: Date.now(),
+				dataDir: this.dataDir,
+				locations: [],
+				entries,
+				totalBytes: entries.reduce((acc, e) => acc + e.sizeBytes, 0),
+				totalFiles: entries.length,
+				sqliteSnapshots: snapshots.map((snapshot) => snapshot.archived)
+			};
+			const carried = snapshots.map((snapshot) => snapshot.archived.snapshotPath);
+			const carriedSet = new Set(carried);
+			const result = await this.writeArchive({
+				archivePath: opts.archivePath,
+				present: [],
+				tarRoots: carried,
+				manifest,
+				excluded: (rel) => rel !== ".camstack-backup-manifest.json" && !carriedSet.has(rel),
+				...opts.signal ? { signal: opts.signal } : {},
+				...opts.onArchiveBytes ? { onArchiveBytes: opts.onArchiveBytes } : {},
+				...opts.encryptTo !== void 0 ? { encryptTo: opts.encryptTo } : {}
+			});
+			return recipient === null ? result : {
+				...result,
+				encryption: {
+					scheme: BACKUP_ENCRYPTION_SCHEME,
+					keyId: recipient.keyId
+				}
+			};
+		} finally {
+			for (const snapshot of snapshots) await this.removeSnapshot(snapshot.absPath);
 		}
 	}
 	/**
@@ -3700,7 +3772,7 @@ var SystemBackupService = class {
 						if (!excludePrefix) return true;
 						return norm !== excludePrefix && !norm.startsWith(`${excludePrefix}/`);
 					}
-				}, [ARCHIVE_MANIFEST_NAME, ...present]);
+				}, [ARCHIVE_MANIFEST_NAME, ...opts.tarRoots ?? present]);
 				const sink = node_fs.createWriteStream(opts.archivePath, { mode: 384 });
 				try {
 					const streamOpts = opts.signal ? { signal: opts.signal } : {};
@@ -3817,12 +3889,13 @@ var SystemBackupService = class {
 		if (node_fs.existsSync(markerPath)) node_fs.rmSync(markerPath, { force: true });
 	}
 	/**
-	* The databases the owner declares, archive-relative, that this walk found.
-	* One outside this data root is not in scope. An owner that cannot answer
-	* stops the archive: without the answer, nothing says which file is live.
+	* The databases the owner declares, archive-relative, that this walk found,
+	* with the id of each. One outside this data root is not in scope. An owner
+	* that cannot answer stops the archive: without the answer, nothing says
+	* which file is live.
 	*/
 	async ownedDatabasesInScope(owner, walked) {
-		if (owner === void 0) return /* @__PURE__ */ new Set();
+		if (owner === void 0) return /* @__PURE__ */ new Map();
 		let declared;
 		try {
 			declared = await owner.listDatabases();
@@ -3831,22 +3904,23 @@ var SystemBackupService = class {
 			this.logger.error("createArchive: the database owner did not say what it owns — no archive built", { meta: { error: reason } });
 			throw new BackupSnapshotRefusedError(`the database owner could not be asked: ${reason}`);
 		}
-		const inScope = /* @__PURE__ */ new Set();
-		for (const abs of declared) {
-			const rel = this.archiveRelative(abs);
-			if (rel !== null && walked.has(rel)) inScope.add(rel);
+		const inScope = /* @__PURE__ */ new Map();
+		for (const db of declared) {
+			const rel = this.archiveRelative(db.livePath);
+			if (rel !== null && (walked === null || walked.has(rel))) inScope.set(rel, db.databaseId);
 		}
 		return inScope;
 	}
 	/**
-	* Ask the owner for its snapshot, and place it in this archive. The snapshot
-	* must sit on THIS data root — the call is pinned to this node, so a path
-	* elsewhere means it reached another host, and that file is not ours to
-	* read — beside an owned database in scope, and it must cover EVERY owned
-	* database in scope. Anything else is refused.
+	* Ask the owner for one verified snapshot per SELECTED database, one after
+	* the other, and place each in this archive. A snapshot must sit on THIS data
+	* root — the call is pinned to this node, so a path elsewhere means it
+	* reached another host, and that file is not ours to read — beside the very
+	* database it was asked for. Anything else is refused, and the run builds
+	* nothing: the copies already taken are removed.
 	*
-	* Only ever DELETED here: `<owned db>.backup-snapshot` under this data root,
-	* a name this process derives itself. A path the owner ANSWERS is never
+	* Only ever DELETED here: `<selected db>.backup-snapshot` under this data
+	* root, a name this process derives itself. A path the owner ANSWERS is never
 	* deleted on its word — answering the live database as the snapshot would
 	* otherwise delete the live database. A file at any other path is left to
 	* the owner's own sweep.
@@ -3854,62 +3928,73 @@ var SystemBackupService = class {
 	* A cancel is honoured while the owner is still copying; the copy it may
 	* finish afterwards is removed when that call settles.
 	*/
-	async takeOwnerSnapshot(owner, owned, signal) {
+	async takeOwnerSnapshots(owner, selected, signal) {
 		const removeOwnedSnapshots = async () => {
-			for (const db of owned) await this.removeSnapshot(node_path.join(this.dataDir, db + require_dist.DATABASE_SNAPSHOT_SUFFIX));
+			for (const db of selected.keys()) await this.removeSnapshot(node_path.join(this.dataDir, db + require_dist.DATABASE_SNAPSHOT_SUFFIX));
 		};
+		const taken = [];
+		try {
+			for (const [expectedLive, databaseId] of selected) {
+				throwIfCancelled(signal);
+				taken.push(await this.takeOneSnapshot(owner, databaseId, expectedLive, signal, selected, removeOwnedSnapshots));
+			}
+		} catch (err) {
+			await removeOwnedSnapshots();
+			throw err;
+		}
+		return taken;
+	}
+	async takeOneSnapshot(owner, databaseId, expectedLive, signal, selected, removeOwnedSnapshots) {
 		let result;
 		try {
-			result = await raceAbort(owner.writeSnapshot(), signal, () => {
-				this.logger.info("createArchive: run cancelled while the owner copied — its copy is removed when it lands", { meta: { databases: [...owned] } });
+			result = await raceAbort(owner.writeSnapshot(databaseId), signal, () => {
+				this.logger.info("createArchive: run cancelled while the owner copied — its copy is removed when it lands", { meta: {
+					databases: [...selected.values()],
+					database: databaseId
+				} });
 				return removeOwnedSnapshots();
 			});
 		} catch (err) {
 			if (err instanceof BackupCancelledError) throw err;
 			const reason = err instanceof Error ? err.message : String(err);
 			this.logger.error("createArchive: the owner could not snapshot its live database — no archive built", { meta: {
-				databases: [...owned],
+				databases: [...selected.values()],
+				database: databaseId,
 				error: reason
 			} });
-			await removeOwnedSnapshots();
-			throw new BackupSnapshotRefusedError(reason);
+			throw new BackupSnapshotRefusedError(`${databaseId}: ${reason}`);
 		}
-		try {
-			const livePath = this.archiveRelative(result.livePath);
-			const snapshotPath = this.archiveRelative(result.snapshotPath);
-			if (livePath === null || snapshotPath === null) {
-				this.logger.warn("createArchive: the owner answered a snapshot outside this data root — not touched, left to its sweep", { meta: {
-					snapshot: result.snapshotPath,
-					dataDir: this.dataDir
-				} });
-				throw new BackupSnapshotRefusedError(`snapshot ${result.snapshotPath} is not under this archive's data root ${this.dataDir}`);
-			}
-			if (snapshotPath !== livePath + ".backup-snapshot") throw new BackupSnapshotRefusedError(`snapshot ${snapshotPath} does not sit beside the database ${livePath} it copies`);
-			const uncovered = [...owned].filter((db) => db !== livePath);
-			if (!owned.has(livePath) || uncovered.length > 0) throw new BackupSnapshotRefusedError(`snapshot copies ${livePath}, but the owned database(s) in this archive are ${[...owned].join(", ")}`);
-			const absPath = node_path.join(this.dataDir, snapshotPath);
-			const stat = await node_fs_promises.stat(absPath);
-			this.logger.info("createArchive: carrying the owner snapshot in place of the live database", { meta: {
-				database: livePath,
-				snapshot: snapshotPath,
-				sizeBytes: stat.size,
-				tables: result.tables.length,
-				copyMs: result.copyMs,
-				verifyMs: result.verifyMs
+		const livePath = this.archiveRelative(result.livePath);
+		const snapshotPath = this.archiveRelative(result.snapshotPath);
+		if (livePath === null || snapshotPath === null) {
+			this.logger.warn("createArchive: the owner answered a snapshot outside this data root — not touched, left to its sweep", { meta: {
+				snapshot: result.snapshotPath,
+				dataDir: this.dataDir
 			} });
-			return {
-				absPath,
-				archived: {
-					...result,
-					livePath,
-					snapshotPath
-				},
-				entry: toArchiveEntry(absPath, this.dataDir, stat)
-			};
-		} catch (err) {
-			await removeOwnedSnapshots();
-			throw err;
+			throw new BackupSnapshotRefusedError(`snapshot ${result.snapshotPath} is not under this archive's data root ${this.dataDir}`);
 		}
+		if (snapshotPath !== livePath + ".backup-snapshot") throw new BackupSnapshotRefusedError(`snapshot ${snapshotPath} does not sit beside the database ${livePath} it copies`);
+		if (livePath !== expectedLive || result.databaseId !== databaseId) throw new BackupSnapshotRefusedError(`snapshot copies ${livePath} (${result.databaseId}), but ${databaseId} (${expectedLive}) was asked for`);
+		const absPath = node_path.join(this.dataDir, snapshotPath);
+		const stat = await node_fs_promises.stat(absPath);
+		this.logger.info("createArchive: carrying the owner snapshot in place of the live database", { meta: {
+			database: livePath,
+			databaseId,
+			snapshot: snapshotPath,
+			sizeBytes: stat.size,
+			tables: result.tables.length,
+			copyMs: result.copyMs,
+			verifyMs: result.verifyMs
+		} });
+		return {
+			absPath,
+			archived: {
+				...result,
+				livePath,
+				snapshotPath
+			},
+			entry: toArchiveEntry(absPath, this.dataDir, stat)
+		};
 	}
 	async removeSnapshot(absPath) {
 		try {
@@ -4089,6 +4174,12 @@ Object.defineProperty(exports, "BackupSnapshotRefusedError", {
 		return BackupSnapshotRefusedError;
 	}
 });
+Object.defineProperty(exports, "DEFAULT_BACKUP_DATABASES", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_BACKUP_DATABASES;
+	}
+});
 Object.defineProperty(exports, "ENCRYPTED_BACKUP_SUFFIX", {
 	enumerable: true,
 	get: function() {