@flui-cloud/cli 0.0.1

package/lib/src/modules/shared/encryption/services/encryption.service.d.ts

@@ -0,0 +1,47 @@
+import { ConfigService } from '@nestjs/config';
+export declare class EncryptionService {
+    private readonly configService;
+    private readonly logger;
+    private readonly algorithm;
+    private readonly encryptionKey;
+    constructor(configService: ConfigService);
+    /**
+     * Resolve encryption key with 3-level fallback:
+     * 1. Env var ENCRYPTION_KEY — K8s production (from Kubernetes Secret)
+     * 2. File ~/.flui/encryption.key — local development (shared CLI/API)
+     * 3. Error if neither is available
+     */
+    private resolveEncryptionKey;
+    /**
+     * Encrypt plaintext string using AES-256-GCM
+     * @param plaintext String to encrypt
+     * @returns Base64 encoded encrypted data (iv + authTag + encrypted)
+     */
+    encrypt(plaintext: string): string;
+    /**
+     * Decrypt encrypted string
+     * @param encryptedData Base64 encoded encrypted data
+     * @returns Decrypted plaintext
+     */
+    decrypt(encryptedData: string): string;
+    generateRandomToken(length?: number): string;
+    /**
+     * Generate a secure K3s token for cluster authentication
+     *
+     * K3s accepts "short token" format: a simple password (minimum 10 characters)
+     * We generate 128 characters using a mix of:
+     * - Lowercase letters (a-z)
+     * - Uppercase letters (A-Z)
+     * - Numbers (0-9)
+     * - Safe special characters (-_@.+:=)
+     *
+     * These characters are safe for use in bash scripts, YAML, and K3s configuration.
+     *
+     * Provides ~778 bits of entropy (practically unbreakable)
+     *
+     * @returns A 128-character secure token
+     */
+    generateK3sToken(): string;
+    hashPassword(password: string): string;
+    compareHash(plaintext: string, hash: string): boolean;
+}

package/lib/src/modules/shared/encryption/services/encryption.service.js

@@ -0,0 +1,199 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var EncryptionService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EncryptionService = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const crypto = __importStar(require("node:crypto"));
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const os = __importStar(require("node:os"));
+let EncryptionService = EncryptionService_1 = class EncryptionService {
+    constructor(configService) {
+        this.configService = configService;
+        this.logger = new common_1.Logger(EncryptionService_1.name);
+        this.algorithm = 'aes-256-gcm';
+        this.encryptionKey = this.resolveEncryptionKey();
+    }
+    /**
+     * Resolve encryption key with 3-level fallback:
+     * 1. Env var ENCRYPTION_KEY — K8s production (from Kubernetes Secret)
+     * 2. File ~/.flui/encryption.key — local development (shared CLI/API)
+     * 3. Error if neither is available
+     */
+    resolveEncryptionKey() {
+        // 1. Env var (K8s production or .env)
+        const envKey = this.configService.get('ENCRYPTION_KEY');
+        if (envKey) {
+            const keyBuffer = Buffer.from(envKey, 'hex');
+            if (keyBuffer.length !== 32) {
+                throw new Error('ENCRYPTION_KEY must be 32 bytes (64 hex characters)');
+            }
+            this.logger.debug('Using encryption key from environment');
+            return keyBuffer;
+        }
+        // 2. File ~/.flui/encryption.key (shared with CLI) — read or generate
+        const fluiDir = path.join(os.homedir(), '.flui');
+        const keyFilePath = path.join(fluiDir, 'encryption.key');
+        try {
+            const fileKey = fs.readFileSync(keyFilePath, 'utf-8').trim();
+            const keyBuffer = Buffer.from(fileKey, 'hex');
+            if (keyBuffer.length !== 32) {
+                throw new Error(`encryption.key file must contain 64 hex characters (32 bytes), got ${fileKey.length} chars`);
+            }
+            this.logger.debug('Using encryption key from ~/.flui/encryption.key');
+            return keyBuffer;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT') {
+                throw error; // Re-throw if not "file not found"
+            }
+        }
+        // 3. Auto-generate key file (first install or after deletion)
+        this.logger.log('No encryption key found. Generating new key at ~/.flui/encryption.key');
+        const newKey = crypto.randomBytes(32);
+        if (!fs.existsSync(fluiDir)) {
+            fs.mkdirSync(fluiDir, { recursive: true });
+        }
+        fs.writeFileSync(keyFilePath, newKey.toString('hex'), {
+            encoding: 'utf-8',
+            mode: 0o600,
+        });
+        return newKey;
+    }
+    /**
+     * Encrypt plaintext string using AES-256-GCM
+     * @param plaintext String to encrypt
+     * @returns Base64 encoded encrypted data (iv + authTag + encrypted)
+     */
+    encrypt(plaintext) {
+        try {
+            const iv = crypto.randomBytes(16);
+            const cipher = crypto.createCipheriv(this.algorithm, this.encryptionKey, iv);
+            const encrypted = Buffer.concat([
+                cipher.update(plaintext, 'utf8'),
+                cipher.final(),
+            ]);
+            const authTag = cipher.getAuthTag();
+            // Format: iv (16 bytes) + authTag (16 bytes) + encrypted data
+            const combined = Buffer.concat([iv, authTag, encrypted]);
+            return combined.toString('base64');
+        }
+        catch (error) {
+            this.logger.error('Encryption failed', error.stack);
+            throw new Error('Failed to encrypt data');
+        }
+    }
+    /**
+     * Decrypt encrypted string
+     * @param encryptedData Base64 encoded encrypted data
+     * @returns Decrypted plaintext
+     */
+    decrypt(encryptedData) {
+        try {
+            const buffer = Buffer.from(encryptedData, 'base64');
+            const iv = buffer.subarray(0, 16);
+            const authTag = buffer.subarray(16, 32);
+            const encrypted = buffer.subarray(32);
+            const decipher = crypto.createDecipheriv(this.algorithm, this.encryptionKey, iv);
+            decipher.setAuthTag(authTag);
+            const decrypted = Buffer.concat([
+                decipher.update(encrypted),
+                decipher.final(),
+            ]);
+            return decrypted.toString('utf8');
+        }
+        catch (error) {
+            this.logger.error('Decryption failed', error.stack);
+            throw new Error('Failed to decrypt data');
+        }
+    }
+    generateRandomToken(length = 32) {
+        return crypto.randomBytes(length).toString('hex');
+    }
+    /**
+     * Generate a secure K3s token for cluster authentication
+     *
+     * K3s accepts "short token" format: a simple password (minimum 10 characters)
+     * We generate 128 characters using a mix of:
+     * - Lowercase letters (a-z)
+     * - Uppercase letters (A-Z)
+     * - Numbers (0-9)
+     * - Safe special characters (-_@.+:=)
+     *
+     * These characters are safe for use in bash scripts, YAML, and K3s configuration.
+     *
+     * Provides ~778 bits of entropy (practically unbreakable)
+     *
+     * @returns A 128-character secure token
+     */
+    generateK3sToken() {
+        // Character set: lowercase + uppercase + numbers + safe specials (70 chars total)
+        const charset = 'abcdefghijklmnopqrstuvwxyz' + // 26 chars
+            'ABCDEFGHIJKLMNOPQRSTUVWXYZ' + // 26 chars
+            '0123456789' + // 10 chars
+            '-_@.+:='; // 7 safe special chars (no problematic bash/shell chars)
+        const tokenLength = 128;
+        const randomBytes = crypto.randomBytes(tokenLength);
+        let token = '';
+        for (let i = 0; i < tokenLength; i++) {
+            // Use modulo to map random byte to charset index
+            token += charset[randomBytes[i] % charset.length];
+        }
+        return token;
+    }
+    hashPassword(password) {
+        return crypto.createHash('sha256').update(password).digest('hex');
+    }
+    compareHash(plaintext, hash) {
+        const plaintextHash = this.hashPassword(plaintext);
+        return crypto.timingSafeEqual(Buffer.from(plaintextHash), Buffer.from(hash));
+    }
+};
+exports.EncryptionService = EncryptionService;
+exports.EncryptionService = EncryptionService = EncryptionService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [config_1.ConfigService])
+], EncryptionService);

package/lib/src/modules/storage/enums/storage-backend-provider.enum.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Provider supportati per Backup Destinations.
+ *
+ * Posizionamento Flui (EU sovereignty):
+ * - Hetzner / Scaleway: provider EU di prima classe, adapter dedicati
+ * - MinIO: self-hosted, sovranità totale dell'utente
+ * - Generic S3: catch-all per qualsiasi endpoint S3-compatibile (AWS S3,
+ *   Wasabi, Backblaze B2, Cloudflare R2, IDrive E2, ecc.)
+ *
+ * I provider US (AWS, Wasabi, B2) si configurano via Generic S3 e funzionano
+ * identicamente — non hanno bisogno di un enum value dedicato perché non
+ * abbiamo override provider-specific lato BE.
+ */
+export declare enum StorageBackendProvider {
+    HETZNER_OBJECT_STORAGE = "hetzner_object_storage",
+    SCALEWAY_OBJECT_STORAGE = "scaleway_object_storage",
+    MINIO = "minio",
+    GENERIC_S3 = "generic_s3"
+}

package/lib/src/modules/storage/enums/storage-backend-provider.enum.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StorageBackendProvider = void 0;
+/**
+ * Provider supportati per Backup Destinations.
+ *
+ * Posizionamento Flui (EU sovereignty):
+ * - Hetzner / Scaleway: provider EU di prima classe, adapter dedicati
+ * - MinIO: self-hosted, sovranità totale dell'utente
+ * - Generic S3: catch-all per qualsiasi endpoint S3-compatibile (AWS S3,
+ *   Wasabi, Backblaze B2, Cloudflare R2, IDrive E2, ecc.)
+ *
+ * I provider US (AWS, Wasabi, B2) si configurano via Generic S3 e funzionano
+ * identicamente — non hanno bisogno di un enum value dedicato perché non
+ * abbiamo override provider-specific lato BE.
+ */
+var StorageBackendProvider;
+(function (StorageBackendProvider) {
+    StorageBackendProvider["HETZNER_OBJECT_STORAGE"] = "hetzner_object_storage";
+    StorageBackendProvider["SCALEWAY_OBJECT_STORAGE"] = "scaleway_object_storage";
+    StorageBackendProvider["MINIO"] = "minio";
+    StorageBackendProvider["GENERIC_S3"] = "generic_s3";
+})(StorageBackendProvider || (exports.StorageBackendProvider = StorageBackendProvider = {}));

package/lib/src/modules/storage/factories/object-storage-provisioner.factory.d.ts

@@ -0,0 +1,11 @@
+import { StorageBackendProvider } from '../enums/storage-backend-provider.enum';
+import { IObjectStorageProvisioner } from '../interfaces/object-storage-provisioner.interface';
+import { ObjectStorageProvisionerRegistration } from '../tokens/object-storage-provisioner-registry.token';
+export declare class ObjectStorageProvisionerFactory {
+    private readonly logger;
+    private readonly registry;
+    constructor(registrations: ObjectStorageProvisionerRegistration | ObjectStorageProvisionerRegistration[] | null);
+    forProvider(provider: StorageBackendProvider): IObjectStorageProvisioner | null;
+    getRegisteredProviders(): StorageBackendProvider[];
+    hasProvisioner(provider: StorageBackendProvider): boolean;
+}

package/lib/src/modules/storage/factories/object-storage-provisioner.factory.js

@@ -0,0 +1,48 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var ObjectStorageProvisionerFactory_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ObjectStorageProvisionerFactory = void 0;
+const common_1 = require("@nestjs/common");
+const object_storage_provisioner_registry_token_1 = require("../tokens/object-storage-provisioner-registry.token");
+let ObjectStorageProvisionerFactory = ObjectStorageProvisionerFactory_1 = class ObjectStorageProvisionerFactory {
+    constructor(registrations) {
+        this.logger = new common_1.Logger(ObjectStorageProvisionerFactory_1.name);
+        this.registry = new Map();
+        let list = [];
+        if (Array.isArray(registrations))
+            list = registrations;
+        else if (registrations)
+            list = [registrations];
+        for (const reg of list) {
+            this.registry.set(reg.provider, reg.provisioner);
+        }
+    }
+    forProvider(provider) {
+        return this.registry.get(provider) ?? null;
+    }
+    getRegisteredProviders() {
+        return Array.from(this.registry.keys());
+    }
+    hasProvisioner(provider) {
+        return this.registry.has(provider);
+    }
+};
+exports.ObjectStorageProvisionerFactory = ObjectStorageProvisionerFactory;
+exports.ObjectStorageProvisionerFactory = ObjectStorageProvisionerFactory = ObjectStorageProvisionerFactory_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Optional)()),
+    __param(0, (0, common_1.Inject)(object_storage_provisioner_registry_token_1.OBJECT_STORAGE_PROVISIONER_REGISTRY)),
+    __metadata("design:paramtypes", [Object])
+], ObjectStorageProvisionerFactory);

package/lib/src/modules/storage/factories/storage-backend.factory.d.ts

@@ -0,0 +1,12 @@
+import { StorageBackendProvider } from '../enums/storage-backend-provider.enum';
+import { IBackupStorageBackend } from '../interfaces/backup-storage-backend.interface';
+import { BackupStorageBackendRegistration } from '../tokens/storage-backend-registry.token';
+import { GenericS3Backend } from '../implementations/generic-s3.backend';
+export declare class StorageBackendFactory {
+    private readonly genericS3;
+    private readonly logger;
+    private readonly registry;
+    constructor(registrations: BackupStorageBackendRegistration | BackupStorageBackendRegistration[] | null, genericS3: GenericS3Backend);
+    forProvider(provider: StorageBackendProvider): IBackupStorageBackend;
+    getRegisteredProviders(): StorageBackendProvider[];
+}

package/lib/src/modules/storage/factories/storage-backend.factory.js

@@ -0,0 +1,51 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var StorageBackendFactory_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StorageBackendFactory = void 0;
+const common_1 = require("@nestjs/common");
+const storage_backend_registry_token_1 = require("../tokens/storage-backend-registry.token");
+const generic_s3_backend_1 = require("../implementations/generic-s3.backend");
+let StorageBackendFactory = StorageBackendFactory_1 = class StorageBackendFactory {
+    constructor(registrations, genericS3) {
+        this.genericS3 = genericS3;
+        this.logger = new common_1.Logger(StorageBackendFactory_1.name);
+        this.registry = new Map();
+        let list = [];
+        if (Array.isArray(registrations))
+            list = registrations;
+        else if (registrations)
+            list = [registrations];
+        for (const reg of list) {
+            this.registry.set(reg.provider, reg.backend);
+        }
+    }
+    forProvider(provider) {
+        const registered = this.registry.get(provider);
+        if (registered)
+            return registered;
+        // Fallback to generic S3 for unregistered S3-compatible providers
+        return this.genericS3;
+    }
+    getRegisteredProviders() {
+        return Array.from(this.registry.keys());
+    }
+};
+exports.StorageBackendFactory = StorageBackendFactory;
+exports.StorageBackendFactory = StorageBackendFactory = StorageBackendFactory_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Optional)()),
+    __param(0, (0, common_1.Inject)(storage_backend_registry_token_1.BACKUP_STORAGE_BACKEND_REGISTRY)),
+    __metadata("design:paramtypes", [Object, generic_s3_backend_1.GenericS3Backend])
+], StorageBackendFactory);

package/lib/src/modules/storage/implementations/generic-s3.backend.d.ts

@@ -0,0 +1,23 @@
+import { Logger } from '@nestjs/common';
+import { S3Client } from '@aws-sdk/client-s3';
+import { IBackupStorageBackend, StorageBackendCredentials, HealthResult, UsageResult, ListObjectsResult, VeleroBSLConfig, RcloneRemoteConfig } from '../interfaces/backup-storage-backend.interface';
+import { StorageBackendProvider } from '../enums/storage-backend-provider.enum';
+export declare class GenericS3Backend implements IBackupStorageBackend {
+    protected readonly logger: Logger;
+    readonly provider: StorageBackendProvider;
+    protected buildClient(creds: StorageBackendCredentials): S3Client;
+    testConnection(creds: StorageBackendCredentials): Promise<HealthResult>;
+    ensureBucket(creds: StorageBackendCredentials): Promise<void>;
+    getUsage(creds: StorageBackendCredentials, prefix?: string): Promise<UsageResult>;
+    listObjects(creds: StorageBackendCredentials, prefix: string, continuationToken?: string): Promise<ListObjectsResult>;
+    deleteObjects(creds: StorageBackendCredentials, keys: string[]): Promise<void>;
+    presignDownload(creds: StorageBackendCredentials, key: string, ttlSeconds: number): Promise<string>;
+    toVeleroBSL(creds: StorageBackendCredentials): VeleroBSLConfig;
+    toRcloneRemote(creds: StorageBackendCredentials): RcloneRemoteConfig;
+    protected joinPrefix(...parts: (string | undefined)[]): string;
+    /**
+     * Helper for backends to write a small probe object then delete it,
+     * used by health-check write/delete probe step.
+     */
+    writeAndDeleteProbe(creds: StorageBackendCredentials, keySuffix?: string): Promise<void>;
+}

package/lib/src/modules/storage/implementations/generic-s3.backend.js

@@ -0,0 +1,172 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GenericS3Backend = void 0;
+const common_1 = require("@nestjs/common");
+const client_s3_1 = require("@aws-sdk/client-s3");
+const s3_request_presigner_1 = require("@aws-sdk/s3-request-presigner");
+const storage_backend_provider_enum_1 = require("../enums/storage-backend-provider.enum");
+let GenericS3Backend = class GenericS3Backend {
+    constructor() {
+        this.logger = new common_1.Logger(this.constructor.name);
+        this.provider = storage_backend_provider_enum_1.StorageBackendProvider.GENERIC_S3;
+    }
+    buildClient(creds) {
+        return new client_s3_1.S3Client({
+            endpoint: creds.endpoint,
+            region: creds.region,
+            credentials: {
+                accessKeyId: creds.accessKey,
+                secretAccessKey: creds.secretKey,
+            },
+            forcePathStyle: creds.forcePathStyle ?? true,
+        });
+    }
+    async testConnection(creds) {
+        const start = Date.now();
+        try {
+            const client = this.buildClient(creds);
+            await client.send(new client_s3_1.HeadBucketCommand({ Bucket: creds.bucket }));
+            return { healthy: true, latencyMs: Date.now() - start };
+        }
+        catch (err) {
+            return {
+                healthy: false,
+                latencyMs: Date.now() - start,
+                error: err?.message ?? String(err),
+            };
+        }
+    }
+    async ensureBucket(creds) {
+        const client = this.buildClient(creds);
+        try {
+            await client.send(new client_s3_1.HeadBucketCommand({ Bucket: creds.bucket }));
+            return;
+        }
+        catch (err) {
+            const status = err?.$metadata?.httpStatusCode;
+            if (status !== 404 && status !== 403) {
+                throw err;
+            }
+        }
+        try {
+            await client.send(new client_s3_1.CreateBucketCommand({ Bucket: creds.bucket }));
+        }
+        catch (err) {
+            if (err?.name === 'BucketAlreadyOwnedByYou')
+                return;
+            throw err;
+        }
+    }
+    async getUsage(creds, prefix) {
+        const client = this.buildClient(creds);
+        let bytes = 0;
+        let count = 0;
+        let token = undefined;
+        const fullPrefix = this.joinPrefix(creds.pathPrefix, prefix);
+        do {
+            const out = await client.send(new client_s3_1.ListObjectsV2Command({
+                Bucket: creds.bucket,
+                Prefix: fullPrefix,
+                ContinuationToken: token,
+            }));
+            for (const o of out.Contents ?? []) {
+                bytes += o.Size ?? 0;
+                count += 1;
+            }
+            token = out.IsTruncated ? out.NextContinuationToken : undefined;
+        } while (token);
+        return { bytes, objectCount: count };
+    }
+    async listObjects(creds, prefix, continuationToken) {
+        const client = this.buildClient(creds);
+        const fullPrefix = this.joinPrefix(creds.pathPrefix, prefix);
+        const out = await client.send(new client_s3_1.ListObjectsV2Command({
+            Bucket: creds.bucket,
+            Prefix: fullPrefix,
+            ContinuationToken: continuationToken,
+        }));
+        return {
+            keys: (out.Contents ?? []).map((c) => c.Key).filter(Boolean),
+            continuationToken: out.NextContinuationToken,
+            hasMore: !!out.IsTruncated,
+        };
+    }
+    async deleteObjects(creds, keys) {
+        if (keys.length === 0)
+            return;
+        const client = this.buildClient(creds);
+        const chunks = [];
+        for (let i = 0; i < keys.length; i += 1000) {
+            chunks.push(keys.slice(i, i + 1000));
+        }
+        for (const chunk of chunks) {
+            await client.send(new client_s3_1.DeleteObjectsCommand({
+                Bucket: creds.bucket,
+                Delete: { Objects: chunk.map((Key) => ({ Key })) },
+            }));
+        }
+    }
+    async presignDownload(creds, key, ttlSeconds) {
+        const client = this.buildClient(creds);
+        return (0, s3_request_presigner_1.getSignedUrl)(client, new client_s3_1.GetObjectCommand({ Bucket: creds.bucket, Key: key }), { expiresIn: ttlSeconds });
+    }
+    toVeleroBSL(creds) {
+        return {
+            provider: 'aws',
+            config: {
+                region: creds.region,
+                s3ForcePathStyle: String(creds.forcePathStyle ?? true),
+                s3Url: creds.endpoint,
+            },
+            credentialsKey: 'cloud',
+            bucket: creds.bucket,
+            prefix: creds.pathPrefix,
+        };
+    }
+    toRcloneRemote(creds) {
+        return {
+            type: 's3',
+            provider: 'Other',
+            env: {
+                type: 's3',
+                provider: 'Other',
+                endpoint: creds.endpoint,
+                region: creds.region,
+                access_key_id: creds.accessKey,
+                secret_access_key: creds.secretKey,
+                force_path_style: String(creds.forcePathStyle ?? true),
+            },
+        };
+    }
+    joinPrefix(...parts) {
+        return parts
+            .filter((p) => !!p && p.length > 0)
+            .map((p) => p.replaceAll(/^\/+|\/+$/g, ''))
+            .filter((p) => p.length > 0)
+            .join('/');
+    }
+    /**
+     * Helper for backends to write a small probe object then delete it,
+     * used by health-check write/delete probe step.
+     */
+    async writeAndDeleteProbe(creds, keySuffix = '.flui-health-probe') {
+        const client = this.buildClient(creds);
+        const probeKey = this.joinPrefix(creds.pathPrefix, keySuffix);
+        await client.send(new client_s3_1.PutObjectCommand({
+            Bucket: creds.bucket,
+            Key: probeKey,
+            Body: 'flui-probe',
+        }));
+        await client.send(new client_s3_1.DeleteObjectCommand({ Bucket: creds.bucket, Key: probeKey }));
+    }
+};
+exports.GenericS3Backend = GenericS3Backend;
+exports.GenericS3Backend = GenericS3Backend = __decorate([
+    (0, common_1.Injectable)()
+], GenericS3Backend);

package/lib/src/modules/storage/interfaces/backup-storage-backend.interface.d.ts

@@ -0,0 +1,48 @@
+import { StorageBackendProvider } from '../enums/storage-backend-provider.enum';
+export interface StorageBackendCredentials {
+    provider: StorageBackendProvider;
+    endpoint: string;
+    region: string;
+    bucket: string;
+    accessKey: string;
+    secretKey: string;
+    forcePathStyle?: boolean;
+    pathPrefix?: string;
+}
+export interface HealthResult {
+    healthy: boolean;
+    latencyMs?: number;
+    error?: string;
+}
+export interface UsageResult {
+    bytes: number;
+    objectCount: number;
+}
+export interface ListObjectsResult {
+    keys: string[];
+    continuationToken?: string;
+    hasMore: boolean;
+}
+export interface VeleroBSLConfig {
+    provider: 'aws';
+    config: Record<string, string>;
+    credentialsKey: string;
+    bucket: string;
+    prefix?: string;
+}
+export interface RcloneRemoteConfig {
+    type: 's3';
+    provider: string;
+    env: Record<string, string>;
+}
+export interface IBackupStorageBackend {
+    readonly provider: StorageBackendProvider;
+    testConnection(creds: StorageBackendCredentials): Promise<HealthResult>;
+    ensureBucket(creds: StorageBackendCredentials): Promise<void>;
+    getUsage(creds: StorageBackendCredentials, prefix?: string): Promise<UsageResult>;
+    listObjects(creds: StorageBackendCredentials, prefix: string, continuationToken?: string): Promise<ListObjectsResult>;
+    deleteObjects(creds: StorageBackendCredentials, keys: string[]): Promise<void>;
+    presignDownload(creds: StorageBackendCredentials, key: string, ttlSeconds: number): Promise<string>;
+    toVeleroBSL(creds: StorageBackendCredentials): VeleroBSLConfig;
+    toRcloneRemote(creds: StorageBackendCredentials): RcloneRemoteConfig;
+}

package/lib/src/modules/storage/interfaces/backup-storage-backend.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });