@geekmidas/cli 10.0.0-alpha.10 → 10.0.0-alpha.101

package/dist/{backup-provisioner-BrsHwYG0.cjs → backup-provisioner-oDEsPj02.cjs}

@@ -1,8 +1,12 @@
-const require_chunk = require('./chunk-CUT6urMc.cjs');
-const __aws_sdk_client_s3 = require_chunk.__toESM(require("@aws-sdk/client-s3"));
-const __aws_sdk_client_iam = require_chunk.__toESM(require("@aws-sdk/client-iam"));
-
-//#region src/deploy/backup-provisioner.ts
+let _aws_sdk_client_s3 = require("@aws-sdk/client-s3");
+let _aws_sdk_client_iam = require("@aws-sdk/client-iam");
+//#region src/target/dokploy/backup-provisioner.ts
+/**
+* Backup Destination Provisioner
+*
+* Creates AWS resources (S3 bucket, IAM user, access keys) and configures
+* Dokploy backup destinations for database backups.
+*/
 /**
 * Generate a random suffix for unique resource names
 */
@@ -33,8 +37,8 @@ async function createAwsClients(region, profile, endpoint) {
 		};
 	}
 	return {
-		s3: new __aws_sdk_client_s3.S3Client(config),
-		iam: new __aws_sdk_client_iam.IAMClient(config)
+		s3: new _aws_sdk_client_s3.S3Client(config),
+		iam: new _aws_sdk_client_iam.IAMClient(config)
 	};
 }
 /**
@@ -42,7 +46,7 @@ async function createAwsClients(region, profile, endpoint) {
 */
 async function bucketExists(s3, bucketName) {
 	try {
-		await s3.send(new __aws_sdk_client_s3.HeadBucketCommand({ Bucket: bucketName }));
+		await s3.send(new _aws_sdk_client_s3.HeadBucketCommand({ Bucket: bucketName }));
 		return true;
 	} catch (error) {
 		if (error.name === "NotFound") return false;
@@ -55,7 +59,7 @@ async function bucketExists(s3, bucketName) {
 */
 async function userExists(iam, userName) {
 	try {
-		await iam.send(new __aws_sdk_client_iam.GetUserCommand({ UserName: userName }));
+		await iam.send(new _aws_sdk_client_iam.GetUserCommand({ UserName: userName }));
 		return true;
 	} catch (error) {
 		const errorName = error.name;
@@ -81,22 +85,20 @@ async function provisionBackupDestination(options) {
 	const aws = await createAwsClients(config.region, config.profile, awsEndpoint);
 	const sanitizedProject = sanitizeName(projectName);
 	const bucketName = existingState?.bucketName ?? `${sanitizedProject}-${stage}-backups-${randomSuffix()}`;
-	const bucketAlreadyExists = await bucketExists(aws.s3, bucketName);
-	if (!bucketAlreadyExists) {
+	if (!await bucketExists(aws.s3, bucketName)) {
 		logger.log(`   Creating S3 bucket: ${bucketName}`);
 		const createBucketParams = { Bucket: bucketName };
 		if (config.region !== "us-east-1") createBucketParams.CreateBucketConfiguration = { LocationConstraint: config.region };
-		await aws.s3.send(new __aws_sdk_client_s3.CreateBucketCommand(createBucketParams));
-		await aws.s3.send(new __aws_sdk_client_s3.PutBucketVersioningCommand({
+		await aws.s3.send(new _aws_sdk_client_s3.CreateBucketCommand(createBucketParams));
+		await aws.s3.send(new _aws_sdk_client_s3.PutBucketVersioningCommand({
 			Bucket: bucketName,
 			VersioningConfiguration: { Status: "Enabled" }
 		}));
 	} else logger.log(`   Using existing S3 bucket: ${bucketName}`);
 	const iamUserName = existingState?.iamUserName ?? `dokploy-backup-${sanitizedProject}-${stage}`;
-	const iamUserAlreadyExists = await userExists(aws.iam, iamUserName);
-	if (!iamUserAlreadyExists) {
+	if (!await userExists(aws.iam, iamUserName)) {
 		logger.log(`   Creating IAM user: ${iamUserName}`);
-		await aws.iam.send(new __aws_sdk_client_iam.CreateUserCommand({ UserName: iamUserName }));
+		await aws.iam.send(new _aws_sdk_client_iam.CreateUserCommand({ UserName: iamUserName }));
 	} else logger.log(`   Using existing IAM user: ${iamUserName}`);
 	const policyDocument = {
 		Version: "2012-10-17",
@@ -113,7 +115,7 @@ async function provisionBackupDestination(options) {
 		}]
 	};
 	logger.log("   Updating IAM policy");
-	await aws.iam.send(new __aws_sdk_client_iam.PutUserPolicyCommand({
+	await aws.iam.send(new _aws_sdk_client_iam.PutUserPolicyCommand({
 		UserName: iamUserName,
 		PolicyName: "DokployBackupAccess",
 		PolicyDocument: JSON.stringify(policyDocument)
@@ -126,7 +128,7 @@ async function provisionBackupDestination(options) {
 		secretAccessKey = existingState.iamSecretAccessKey;
 	} else {
 		logger.log("   Creating IAM access key");
-		const accessKeyResult = await aws.iam.send(new __aws_sdk_client_iam.CreateAccessKeyCommand({ UserName: iamUserName }));
+		const accessKeyResult = await aws.iam.send(new _aws_sdk_client_iam.CreateAccessKeyCommand({ UserName: iamUserName }));
 		if (!accessKeyResult.AccessKey) throw new Error("Failed to create IAM access key");
 		accessKeyId = accessKeyResult.AccessKey.AccessKeyId;
 		secretAccessKey = accessKeyResult.AccessKey.SecretAccessKey;
@@ -158,7 +160,7 @@ async function provisionBackupDestination(options) {
 		createdAt: existingState?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
 	};
 }
-
 //#endregion
 exports.provisionBackupDestination = provisionBackupDestination;
-//# sourceMappingURL=backup-provisioner-BrsHwYG0.cjs.map
+
+//# sourceMappingURL=backup-provisioner-oDEsPj02.cjs.map

package/dist/backup-provisioner-oDEsPj02.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-provisioner-oDEsPj02.cjs","names":["S3Client","IAMClient","HeadBucketCommand","GetUserCommand","CreateBucketCommand","PutBucketVersioningCommand","CreateUserCommand","PutUserPolicyCommand","CreateAccessKeyCommand"],"sources":["../src/target/dokploy/backup-provisioner.ts"],"sourcesContent":["/**\n * Backup Destination Provisioner\n *\n * Creates AWS resources (S3 bucket, IAM user, access keys) and configures\n * Dokploy backup destinations for database backups.\n */\n\nimport {\n\tCreateAccessKeyCommand,\n\tCreateUserCommand,\n\tGetUserCommand,\n\tIAMClient,\n\ttype IAMClientConfig,\n\tPutUserPolicyCommand,\n} from '@aws-sdk/client-iam';\nimport {\n\ttype BucketLocationConstraint,\n\tCreateBucketCommand,\n\tHeadBucketCommand,\n\tPutBucketVersioningCommand,\n\tS3Client,\n\ttype S3ClientConfig,\n} from '@aws-sdk/client-s3';\nimport type { BackupState } from '../../deploy/state.js';\nimport type { DokployBackupsConfig } from '../../workspace/types.js';\nimport type { DokployApi } from './dokploy-api.js';\n\nexport interface ProvisionBackupOptions {\n\t/** Dokploy API client */\n\tapi: DokployApi;\n\t/** Dokploy project ID */\n\tprojectId: string;\n\t/** Workspace name (used for resource naming) */\n\tprojectName: string;\n\t/** Deploy stage (e.g., 'production', 'staging') */\n\tstage: string;\n\t/** Backup configuration */\n\tconfig: DokployBackupsConfig;\n\t/** Existing backup state (if any) */\n\texistingState?: BackupState;\n\t/** Logger for progress output */\n\tlogger: { log: (msg: string) => void };\n\t/** AWS endpoint override (for testing with LocalStack) */\n\tawsEndpoint?: string;\n}\n\n/**\n * Generate a random suffix for unique resource names\n */\nfunction randomSuffix(): string {\n\treturn Math.random().toString(36).substring(2, 8);\n}\n\n/**\n * Sanitize a name for AWS resources (lowercase alphanumeric and hyphens)\n */\nfunction sanitizeName(name: string): string {\n\treturn name.toLowerCase().replace(/[^a-z0-9-]/g, '-');\n}\n\n/**\n * Create AWS clients with optional profile credentials\n */\nasync function createAwsClients(\n\tregion: string,\n\tprofile?: string,\n\tendpoint?: string,\n): Promise<{ s3: S3Client; iam: IAMClient }> {\n\tconst config: S3ClientConfig & IAMClientConfig = { region };\n\n\tif (profile) {\n\t\tconst { fromIni } = await import('@aws-sdk/credential-providers');\n\t\tconfig.credentials = fromIni({ profile });\n\t}\n\n\t// Support custom endpoint for testing (e.g., LocalStack)\n\tif (endpoint) {\n\t\tconfig.endpoint = endpoint;\n\t\t(config as S3ClientConfig).forcePathStyle = true;\n\t\t// Use test credentials when endpoint is specified\n\t\tconfig.credentials = {\n\t\t\taccessKeyId: 'test',\n\t\t\tsecretAccessKey: 'test',\n\t\t};\n\t}\n\n\treturn {\n\t\ts3: new S3Client(config),\n\t\tiam: new IAMClient(config),\n\t};\n}\n\n/**\n * Check if an S3 bucket exists\n */\nasync function bucketExists(\n\ts3: S3Client,\n\tbucketName: string,\n): Promise<boolean> {\n\ttry {\n\t\tawait s3.send(new HeadBucketCommand({ Bucket: bucketName }));\n\t\treturn true;\n\t} catch (error) {\n\t\tif ((error as { name?: string }).name === 'NotFound') {\n\t\t\treturn false;\n\t\t}\n\t\t// 403 means bucket exists but we don't have access\n\t\tif (\n\t\t\t(error as { $metadata?: { httpStatusCode?: number } }).$metadata\n\t\t\t\t?.httpStatusCode === 403\n\t\t) {\n\t\t\treturn true;\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n/**\n * Check if an IAM user exists\n */\nasync function userExists(iam: IAMClient, userName: string): Promise<boolean> {\n\ttry {\n\t\tawait iam.send(new GetUserCommand({ UserName: userName }));\n\t\treturn true;\n\t} catch (error) {\n\t\tconst errorName = (error as { name?: string }).name;\n\t\t// AWS returns 'NoSuchEntity', LocalStack returns 'NoSuchEntityException'\n\t\tif (errorName === 'NoSuchEntity' || errorName === 'NoSuchEntityException') {\n\t\t\treturn false;\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n/**\n * Provision backup destination for a deployment.\n *\n * Creates AWS resources (S3 bucket, IAM user) and Dokploy destination if needed.\n * Reuses existing resources from state when possible.\n */\nexport async function provisionBackupDestination(\n\toptions: ProvisionBackupOptions,\n): Promise<BackupState> {\n\tconst {\n\t\tapi,\n\t\tprojectName,\n\t\tstage,\n\t\tconfig,\n\t\texistingState,\n\t\tlogger,\n\t\tawsEndpoint,\n\t} = options;\n\n\t// If we have existing state, verify the Dokploy destination still exists\n\tif (existingState?.destinationId) {\n\t\ttry {\n\t\t\tawait api.getDestination(existingState.destinationId);\n\t\t\tlogger.log('   Using existing backup destination');\n\t\t\treturn existingState;\n\t\t} catch {\n\t\t\tlogger.log('   Existing destination not found, recreating...');\n\t\t}\n\t}\n\n\t// Create AWS clients\n\tconst aws = await createAwsClients(\n\t\tconfig.region,\n\t\tconfig.profile,\n\t\tawsEndpoint,\n\t);\n\tconst sanitizedProject = sanitizeName(projectName);\n\n\t// 1. Create or verify S3 bucket\n\tconst bucketName =\n\t\texistingState?.bucketName ??\n\t\t`${sanitizedProject}-${stage}-backups-${randomSuffix()}`;\n\n\tconst bucketAlreadyExists = await bucketExists(aws.s3, bucketName);\n\tif (!bucketAlreadyExists) {\n\t\tlogger.log(`   Creating S3 bucket: ${bucketName}`);\n\n\t\t// CreateBucket needs LocationConstraint for non-us-east-1 regions\n\t\tconst createBucketParams: {\n\t\t\tBucket: string;\n\t\t\tCreateBucketConfiguration?: {\n\t\t\t\tLocationConstraint: BucketLocationConstraint;\n\t\t\t};\n\t\t} = {\n\t\t\tBucket: bucketName,\n\t\t};\n\t\tif (config.region !== 'us-east-1') {\n\t\t\tcreateBucketParams.CreateBucketConfiguration = {\n\t\t\t\tLocationConstraint: config.region as BucketLocationConstraint,\n\t\t\t};\n\t\t}\n\n\t\tawait aws.s3.send(new CreateBucketCommand(createBucketParams));\n\n\t\t// Enable versioning for backup integrity\n\t\tawait aws.s3.send(\n\t\t\tnew PutBucketVersioningCommand({\n\t\t\t\tBucket: bucketName,\n\t\t\t\tVersioningConfiguration: { Status: 'Enabled' },\n\t\t\t}),\n\t\t);\n\t} else {\n\t\tlogger.log(`   Using existing S3 bucket: ${bucketName}`);\n\t}\n\n\t// 2. Create or verify IAM user\n\tconst iamUserName =\n\t\texistingState?.iamUserName ?? `dokploy-backup-${sanitizedProject}-${stage}`;\n\n\tconst iamUserAlreadyExists = await userExists(aws.iam, iamUserName);\n\tif (!iamUserAlreadyExists) {\n\t\tlogger.log(`   Creating IAM user: ${iamUserName}`);\n\t\tawait aws.iam.send(new CreateUserCommand({ UserName: iamUserName }));\n\t} else {\n\t\tlogger.log(`   Using existing IAM user: ${iamUserName}`);\n\t}\n\n\t// 3. Attach bucket policy to IAM user\n\tconst policyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tEffect: 'Allow',\n\t\t\t\tAction: [\n\t\t\t\t\t's3:GetObject',\n\t\t\t\t\t's3:PutObject',\n\t\t\t\t\t's3:DeleteObject',\n\t\t\t\t\t's3:ListBucket',\n\t\t\t\t\t's3:GetBucketLocation',\n\t\t\t\t],\n\t\t\t\tResource: [\n\t\t\t\t\t`arn:aws:s3:::${bucketName}`,\n\t\t\t\t\t`arn:aws:s3:::${bucketName}/*`,\n\t\t\t\t],\n\t\t\t},\n\t\t],\n\t};\n\n\tlogger.log('   Updating IAM policy');\n\tawait aws.iam.send(\n\t\tnew PutUserPolicyCommand({\n\t\t\tUserName: iamUserName,\n\t\t\tPolicyName: 'DokployBackupAccess',\n\t\t\tPolicyDocument: JSON.stringify(policyDocument),\n\t\t}),\n\t);\n\n\t// 4. Create access key (or reuse existing if state has it and destination needs recreation)\n\tlet accessKeyId: string;\n\tlet secretAccessKey: string;\n\n\tif (existingState?.iamAccessKeyId && existingState?.iamSecretAccessKey) {\n\t\t// Reuse existing credentials\n\t\tlogger.log('   Using existing IAM access key');\n\t\taccessKeyId = existingState.iamAccessKeyId;\n\t\tsecretAccessKey = existingState.iamSecretAccessKey;\n\t} else {\n\t\t// Create new access key\n\t\tlogger.log('   Creating IAM access key');\n\t\tconst accessKeyResult = await aws.iam.send(\n\t\t\tnew CreateAccessKeyCommand({ UserName: iamUserName }),\n\t\t);\n\n\t\tif (!accessKeyResult.AccessKey) {\n\t\t\tthrow new Error('Failed to create IAM access key');\n\t\t}\n\n\t\taccessKeyId = accessKeyResult.AccessKey.AccessKeyId!;\n\t\tsecretAccessKey = accessKeyResult.AccessKey.SecretAccessKey!;\n\t}\n\n\t// 5. Create Dokploy destination\n\tconst destinationName = `${sanitizedProject}-${stage}-s3`;\n\tlogger.log(`   Creating Dokploy destination: ${destinationName}`);\n\n\tconst { destination, created } = await api.findOrCreateDestination(\n\t\tdestinationName,\n\t\t{\n\t\t\taccessKey: accessKeyId,\n\t\t\tsecretAccessKey: secretAccessKey,\n\t\t\tbucket: bucketName,\n\t\t\tregion: config.region,\n\t\t},\n\t);\n\n\tif (created) {\n\t\tlogger.log('   ✓ Dokploy destination created');\n\t} else {\n\t\tlogger.log('   ✓ Using existing Dokploy destination');\n\t}\n\n\t// 6. Test connection\n\ttry {\n\t\tawait api.testDestinationConnection(destination.destinationId);\n\t\tlogger.log('   ✓ Destination connection verified');\n\t} catch (error) {\n\t\tlogger.log(\n\t\t\t`   ⚠ Warning: Could not verify destination connection: ${error}`,\n\t\t);\n\t}\n\n\treturn {\n\t\tbucketName,\n\t\tbucketArn: `arn:aws:s3:::${bucketName}`,\n\t\tiamUserName,\n\t\tiamAccessKeyId: accessKeyId,\n\t\tiamSecretAccessKey: secretAccessKey,\n\t\tdestinationId: destination.destinationId,\n\t\tregion: config.region,\n\t\tcreatedAt: existingState?.createdAt ?? new Date().toISOString(),\n\t};\n}\n"],"mappings":";;;;;;;;;;;;AAiDA,SAAS,eAAuB;CAC/B,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,UAAU,GAAG,CAAC;AACjD;;;;AAKA,SAAS,aAAa,MAAsB;CAC3C,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,eAAe,GAAG;AACrD;;;;AAKA,eAAe,iBACd,QACA,SACA,UAC4C;CAC5C,MAAM,SAA2C,EAAE,OAAO;CAE1D,IAAI,SAAS;EACZ,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,OAAO,cAAc,QAAQ,EAAE,QAAQ,CAAC;CACzC;CAGA,IAAI,UAAU;EACb,OAAO,WAAW;EAClB,OAA2B,iBAAiB;EAE5C,OAAO,cAAc;GACpB,aAAa;GACb,iBAAiB;EAClB;CACD;CAEA,OAAO;EACN,IAAI,IAAIA,mBAAAA,SAAS,MAAM;EACvB,KAAK,IAAIC,oBAAAA,UAAU,MAAM;CAC1B;AACD;;;;AAKA,eAAe,aACd,IACA,YACmB;CACnB,IAAI;EACH,MAAM,GAAG,KAAK,IAAIC,mBAAAA,kBAAkB,EAAE,QAAQ,WAAW,CAAC,CAAC;EAC3D,OAAO;CACR,SAAS,OAAO;EACf,IAAK,MAA4B,SAAS,YACzC,OAAO;EAGR,IACE,MAAsD,WACpD,mBAAmB,KAEtB,OAAO;EAER,MAAM;CACP;AACD;;;;AAKA,eAAe,WAAW,KAAgB,UAAoC;CAC7E,IAAI;EACH,MAAM,IAAI,KAAK,IAAIC,oBAAAA,eAAe,EAAE,UAAU,SAAS,CAAC,CAAC;EACzD,OAAO;CACR,SAAS,OAAO;EACf,MAAM,YAAa,MAA4B;EAE/C,IAAI,cAAc,kBAAkB,cAAc,yBACjD,OAAO;EAER,MAAM;CACP;AACD;;;;;;;AAQA,eAAsB,2BACrB,SACuB;CACvB,MAAM,EACL,KACA,aACA,OACA,QACA,eACA,QACA,gBACG;CAGJ,IAAI,eAAe,eAClB,IAAI;EACH,MAAM,IAAI,eAAe,cAAc,aAAa;EACpD,OAAO,IAAI,sCAAsC;EACjD,OAAO;CACR,QAAQ;EACP,OAAO,IAAI,kDAAkD;CAC9D;CAID,MAAM,MAAM,MAAM,iBACjB,OAAO,QACP,OAAO,SACP,WACD;CACA,MAAM,mBAAmB,aAAa,WAAW;CAGjD,MAAM,aACL,eAAe,cACf,GAAG,iBAAiB,GAAG,MAAM,WAAW,aAAa;CAGtD,IAAI,CAAC,MAD6B,aAAa,IAAI,IAAI,UAAU,GACvC;EACzB,OAAO,IAAI,0BAA0B,YAAY;EAGjD,MAAM,qBAKF,EACH,QAAQ,WACT;EACA,IAAI,OAAO,WAAW,aACrB,mBAAmB,4BAA4B,EAC9C,oBAAoB,OAAO,OAC5B;EAGD,MAAM,IAAI,GAAG,KAAK,IAAIC,mBAAAA,oBAAoB,kBAAkB,CAAC;EAG7D,MAAM,IAAI,GAAG,KACZ,IAAIC,mBAAAA,2BAA2B;GAC9B,QAAQ;GACR,yBAAyB,EAAE,QAAQ,UAAU;EAC9C,CAAC,CACF;CACD,OACC,OAAO,IAAI,gCAAgC,YAAY;CAIxD,MAAM,cACL,eAAe,eAAe,kBAAkB,iBAAiB,GAAG;CAGrE,IAAI,CAAC,MAD8B,WAAW,IAAI,KAAK,WAAW,GACvC;EAC1B,OAAO,IAAI,yBAAyB,aAAa;EACjD,MAAM,IAAI,IAAI,KAAK,IAAIC,oBAAAA,kBAAkB,EAAE,UAAU,YAAY,CAAC,CAAC;CACpE,OACC,OAAO,IAAI,+BAA+B,aAAa;CAIxD,MAAM,iBAAiB;EACtB,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,QAAQ;IACP;IACA;IACA;IACA;IACA;GACD;GACA,UAAU,CACT,gBAAgB,cAChB,gBAAgB,WAAW,GAC5B;EACD,CACD;CACD;CAEA,OAAO,IAAI,wBAAwB;CACnC,MAAM,IAAI,IAAI,KACb,IAAIC,oBAAAA,qBAAqB;EACxB,UAAU;EACV,YAAY;EACZ,gBAAgB,KAAK,UAAU,cAAc;CAC9C,CAAC,CACF;CAGA,IAAI;CACJ,IAAI;CAEJ,IAAI,eAAe,kBAAkB,eAAe,oBAAoB;EAEvE,OAAO,IAAI,kCAAkC;EAC7C,cAAc,cAAc;EAC5B,kBAAkB,cAAc;CACjC,OAAO;EAEN,OAAO,IAAI,4BAA4B;EACvC,MAAM,kBAAkB,MAAM,IAAI,IAAI,KACrC,IAAIC,oBAAAA,uBAAuB,EAAE,UAAU,YAAY,CAAC,CACrD;EAEA,IAAI,CAAC,gBAAgB,WACpB,MAAM,IAAI,MAAM,iCAAiC;EAGlD,cAAc,gBAAgB,UAAU;EACxC,kBAAkB,gBAAgB,UAAU;CAC7C;CAGA,MAAM,kBAAkB,GAAG,iBAAiB,GAAG,MAAM;CACrD,OAAO,IAAI,oCAAoC,iBAAiB;CAEhE,MAAM,EAAE,aAAa,YAAY,MAAM,IAAI,wBAC1C,iBACA;EACC,WAAW;EACM;EACjB,QAAQ;EACR,QAAQ,OAAO;CAChB,CACD;CAEA,IAAI,SACH,OAAO,IAAI,kCAAkC;MAE7C,OAAO,IAAI,yCAAyC;CAIrD,IAAI;EACH,MAAM,IAAI,0BAA0B,YAAY,aAAa;EAC7D,OAAO,IAAI,sCAAsC;CAClD,SAAS,OAAO;EACf,OAAO,IACN,0DAA0D,OAC3D;CACD;CAEA,OAAO;EACN;EACA,WAAW,gBAAgB;EAC3B;EACA,gBAAgB;EAChB,oBAAoB;EACpB,eAAe,YAAY;EAC3B,QAAQ,OAAO;EACf,WAAW,eAAe,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY;CAC/D;AACD"}

package/dist/backups/runner.cjs

@@ -0,0 +1,519 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../rolldown-runtime-C0BPl7ul.cjs");
+let node_fs = require("node:fs");
+let node_child_process = require("node:child_process");
+let node_crypto = require("node:crypto");
+let node_http = require("node:http");
+node_http = require_rolldown_runtime.__toESM(node_http, 1);
+let node_zlib = require("node:zlib");
+let node_https = require("node:https");
+node_https = require_rolldown_runtime.__toESM(node_https, 1);
+//#region src/backups/runner.ts
+/**
+* The backups container's program: `pg_dump` each of the stack's databases
+* on schedule and stream it, gzipped, to the stage's backups prefix.
+*
+* It ships alone — copied into an image built `FROM postgres:<major>-alpine`
+* with Node added — so it imports nothing but Node's own modules: S3 is
+* spoken to with a SigV4 signature made here, not the AWS SDK.
+*
+*   node backup.mjs serve    run on schedule, forever (the container's command)
+*   node backup.mjs run      one backup now (`gkm backup:now`)
+*   node backup.mjs health   exit 1 when the last good run is too old
+*
+* Its key may only put objects under the prefix: it never reads, lists or
+* deletes, so nothing here does either. A dump is uploaded in parts as it is
+* made, so no database is ever held on disk or in memory whole.
+*
+* Environment:
+*
+* - `BACKUPS_URL` — `s3://KEY:SECRET@bucket?region=…`, the stage's backups key
+* - `BACKUPS_PREFIX` — `gkm/<project>/<stage>/backups`
+* - `BACKUPS_DATABASES` — `[{"file":"auth-database","name":"auth_database_production"}]`
+* - `BACKUPS_SCHEDULE` — `{"kind":"every","seconds":86400,"offset":7200}`, or
+*   a cron expanded: `{"kind":"cron","minutes":[0],"hours":[0,6,12,18],…}`
+* - `BACKUPS_MAX_GAP_SECONDS` — the longest the schedule goes between runs
+* - `PGHOST`, `PGPORT`, `PGUSER`, `PGPASSWORD` — read by `pg_dump` itself
+* - `OTEL_EXPORTER_OTLP_ENDPOINT`/`_HEADERS` — where each run's result is
+*   also sent as an OTLP log, when the stage's telemetry is on
+*/
+/** Where the runner keeps what its health check reads. */
+const STATE_DIR = process.env.BACKUPS_STATE_DIR ?? "/tmp/gkm-backups";
+/** How long a container may go without a good run before it has had one. */
+const STARTUP_GRACE_SECONDS = 900;
+/** S3's smallest part, but the last; and the size each part is cut at. */
+const PART_BYTES = Number(process.env.BACKUPS_PART_BYTES) || 16777216;
+/** Four years: how far ahead a cron schedule is looked for its next run. */
+const CRON_HORIZON_DAYS = 1464;
+function cronDay(schedule, date) {
+	if (schedule.months && !schedule.months.includes(date.getUTCMonth() + 1)) return false;
+	const dom = schedule.days?.includes(date.getUTCDate());
+	const dow = schedule.weekdays?.includes(date.getUTCDay());
+	if (schedule.days && schedule.weekdays) return Boolean(dom || dow);
+	if (schedule.days) return Boolean(dom);
+	if (schedule.weekdays) return Boolean(dow);
+	return true;
+}
+/**
+* The first time after `after`, to the minute, the schedule runs — the copy
+* of `schedule.ts`'s `nextRun` this file carries, since it ships alone.
+*/
+function nextRun(schedule, after) {
+	const from = Math.floor(after.getTime() / 6e4) * 6e4 + 6e4;
+	if (schedule.kind === "every") {
+		const interval = schedule.seconds * 1e3;
+		const offset = schedule.offset * 1e3;
+		return new Date(offset + Math.ceil((from - offset) / interval) * interval);
+	}
+	const start = new Date(from);
+	const day = Date.UTC(start.getUTCFullYear(), start.getUTCMonth(), start.getUTCDate());
+	for (let i = 0; i < CRON_HORIZON_DAYS; i++) {
+		const date = new Date(day + i * 864e5);
+		if (!cronDay(schedule, date)) continue;
+		for (const hour of schedule.hours) for (const minute of schedule.minutes) {
+			const at = date.getTime() + hour * 36e5 + minute * 6e4;
+			if (at >= from) return new Date(at);
+		}
+	}
+	return null;
+}
+/** One run's folder: `2026-10-10/02-00-00Z`. */
+function runFolder(at) {
+	const iso = at.toISOString();
+	return `${iso.slice(0, 10)}/${iso.slice(11, 19).replace(/:/g, "-")}Z`;
+}
+/** `BACKUPS_URL`, read the way `@geekmidas/storage/s3-url` writes it. */
+function destination(url) {
+	const parsed = new URL(url);
+	if (parsed.protocol !== "s3:" || !parsed.hostname) throw new BackupsEnvInvalid("BACKUPS_URL", "is not an s3:// URL with a bucket");
+	const endpoint = parsed.searchParams.get("endpoint") ?? void 0;
+	return {
+		bucket: parsed.hostname,
+		region: parsed.searchParams.get("region") ?? "us-east-1",
+		...endpoint ? { endpoint } : {},
+		forcePathStyle: parsed.searchParams.get("forcePathStyle") === "true",
+		accessKeyId: decodeURIComponent(parsed.username),
+		secretAccessKey: decodeURIComponent(parsed.password)
+	};
+}
+const sha256 = (data) => (0, node_crypto.createHash)("sha256").update(data).digest("hex");
+const hmac = (key, data) => (0, node_crypto.createHmac)("sha256", key).update(data).digest();
+/** RFC 3986, as SigV4 wants it: everything but unreserved characters. */
+function encode(value) {
+	return encodeURIComponent(value).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+/** One request to S3, signed with SigV4; the response's status and body. */
+async function s3Send(to, request, now = /* @__PURE__ */ new Date()) {
+	const body = request.body ?? Buffer.alloc(0);
+	const path = request.key.split("/").map(encode).join("/");
+	let url;
+	if (to.endpoint) {
+		const base = to.endpoint.replace(/\/+$/, "");
+		url = to.forcePathStyle ? new URL(`${base}/${to.bucket}/${path}`) : new URL(`${base.replace("://", `://${to.bucket}.`)}/${path}`);
+	} else url = new URL(`https://${to.bucket}.s3.${to.region}.amazonaws.com/${path}`);
+	const query = Object.entries(request.query ?? {}).map(([k, v]) => [encode(k), encode(v)]).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${k}=${v}`).join("&");
+	const amzDate = now.toISOString().replace(/[:-]|\.\d{3}/g, "");
+	const day = amzDate.slice(0, 8);
+	const payload = sha256(body);
+	const headers = {
+		host: url.host,
+		"x-amz-content-sha256": payload,
+		"x-amz-date": amzDate,
+		...Object.fromEntries(Object.entries(request.headers ?? {}).map(([k, v]) => [k.toLowerCase(), v]))
+	};
+	const names = Object.keys(headers).sort();
+	const canonical = [
+		request.method,
+		url.pathname,
+		query,
+		names.map((n) => `${n}:${headers[n].trim()}\n`).join(""),
+		names.join(";"),
+		payload
+	].join("\n");
+	const scope = `${day}/${to.region}/s3/aws4_request`;
+	const toSign = [
+		"AWS4-HMAC-SHA256",
+		amzDate,
+		scope,
+		sha256(canonical)
+	].join("\n");
+	const key = hmac(hmac(hmac(hmac(`AWS4${to.secretAccessKey}`, day), to.region), "s3"), "aws4_request");
+	const signature = (0, node_crypto.createHmac)("sha256", key).update(toSign).digest("hex");
+	headers.authorization = `AWS4-HMAC-SHA256 Credential=${to.accessKeyId}/${scope}, SignedHeaders=${names.join(";")}, Signature=${signature}`;
+	headers["content-length"] = String(body.length);
+	const send = url.protocol === "https:" ? node_https.default.request : node_http.default.request;
+	return new Promise((resolve, reject) => {
+		const req = send(url, {
+			method: request.method,
+			headers,
+			path: `${url.pathname}${query ? `?${query}` : ""}`
+		}, (res) => {
+			const chunks = [];
+			res.on("data", (chunk) => chunks.push(chunk));
+			res.on("end", () => resolve({
+				status: res.statusCode ?? 0,
+				body: Buffer.concat(chunks).toString("utf-8"),
+				headers: Object.fromEntries(Object.entries(res.headers).map(([k, v]) => [k, String(v ?? "")]))
+			}));
+			res.on("error", reject);
+		});
+		req.on("error", reject);
+		req.setTimeout(3e5, () => req.destroy(new RequestTimedOut(request.key)));
+		req.end(body);
+	});
+}
+/** S3 did not answer a request within five minutes. */
+var RequestTimedOut = class extends Error {
+	key;
+	constructor(key) {
+		super(`S3 did not answer within five minutes putting ${key}.`);
+		this.key = key;
+		this.name = "RequestTimedOut";
+	}
+};
+/** A variable the container is started with that is missing or wrong. */
+var BackupsEnvInvalid = class extends Error {
+	variable;
+	reason;
+	constructor(variable, reason) {
+		super(`${variable} ${reason}. It is written by gkm into the stack's backups.env; deploy the stage again.`);
+		this.variable = variable;
+		this.reason = reason;
+		this.name = "BackupsEnvInvalid";
+	}
+};
+/** `pg_dump` exited with an error: the dump is not uploaded. */
+var DumpFailed = class extends Error {
+	database;
+	code;
+	stderr;
+	constructor(database, code, stderr) {
+		super(`pg_dump ${database} exited ${code}: ${stderr.trim().slice(-500)}`);
+		this.database = database;
+		this.code = code;
+		this.stderr = stderr;
+		this.name = "DumpFailed";
+	}
+};
+/** A request S3 refused, or that never got an answer. */
+var UploadFailed = class extends Error {
+	key;
+	status;
+	said;
+	constructor(key, status, said) {
+		super(`S3 answered HTTP ${status} putting ${key}: ${said.replace(/\s+/g, " ").slice(0, 500)}`);
+		this.key = key;
+		this.status = status;
+		this.said = said;
+		this.name = "UploadFailed";
+	}
+};
+/** `s3Send`, again after 1, 4 and 9 seconds when the network or S3 fails. */
+async function sendWithRetry(to, request) {
+	let last;
+	for (let attempt = 0; attempt < 4; attempt++) {
+		if (attempt > 0) await new Promise((r) => setTimeout(r, attempt * attempt * 1e3));
+		try {
+			const res = await s3Send(to, request);
+			if (res.status >= 200 && res.status < 300) return res;
+			last = new UploadFailed(request.key, res.status, res.body);
+			if (res.status < 500) break;
+		} catch (error) {
+			last = error;
+		}
+	}
+	throw last;
+}
+/**
+* Upload a stream to `key`: one PUT when it fits in a part, else a multipart
+* upload — every action of which is `s3:PutObject`, all the key may do. A
+* failed upload is left for the bucket's lifecycle to abort.
+*/
+async function upload(to, key, stream, finished = Promise.resolve()) {
+	let buffered = [];
+	let size = 0;
+	let total = 0;
+	let uploadId;
+	const parts = [];
+	const flush = async (body) => {
+		if (!uploadId) {
+			const created = await sendWithRetry(to, {
+				method: "POST",
+				key,
+				query: { uploads: "" },
+				headers: { "content-type": "application/gzip" }
+			});
+			uploadId = /<UploadId>([^<]+)<\/UploadId>/.exec(created.body)?.[1];
+			if (!uploadId) throw new UploadFailed(key, created.status, created.body);
+		}
+		const part = await sendWithRetry(to, {
+			method: "PUT",
+			key,
+			query: {
+				partNumber: String(parts.length + 1),
+				uploadId
+			},
+			body
+		});
+		parts.push(part.headers.etag ?? "");
+	};
+	for await (const chunk of stream) {
+		buffered.push(chunk);
+		size += chunk.length;
+		total += chunk.length;
+		if (size >= PART_BYTES) {
+			const body = Buffer.concat(buffered);
+			buffered = [];
+			size = 0;
+			await flush(body);
+		}
+	}
+	await finished;
+	const rest = Buffer.concat(buffered);
+	if (!uploadId) {
+		await sendWithRetry(to, {
+			method: "PUT",
+			key,
+			body: rest,
+			headers: { "content-type": "application/gzip" }
+		});
+		return total;
+	}
+	if (rest.length > 0) await flush(rest);
+	const complete = parts.map((etag, i) => `<Part><PartNumber>${i + 1}</PartNumber><ETag>${etag}</ETag></Part>`).join("");
+	const done = await sendWithRetry(to, {
+		method: "POST",
+		key,
+		query: { uploadId },
+		body: Buffer.from(`<CompleteMultipartUpload>${complete}</CompleteMultipartUpload>`),
+		headers: { "content-type": "application/xml" }
+	});
+	if (/<Error>/.test(done.body)) throw new UploadFailed(key, 200, done.body);
+	return total;
+}
+/** Who else is told each line — a test, reading what a run said. */
+const listeners = /* @__PURE__ */ new Set();
+/** Be handed each line the runner logs. Returns what stops it. */
+function onReport(listener) {
+	listeners.add(listener);
+	return () => listeners.delete(listener);
+}
+/** One line of the run's result: JSON on stdout, and OTLP when telemetry is on. */
+async function report(level, message, fields) {
+	const at = /* @__PURE__ */ new Date();
+	const line = {
+		time: at.toISOString(),
+		level,
+		msg: message,
+		...fields
+	};
+	(level === "error" ? process.stderr : process.stdout).write(`${JSON.stringify(line)}\n`);
+	for (const listener of listeners) listener(line);
+	if (process.pid !== 1 && process.platform === "linux") try {
+		(0, node_fs.appendFileSync)(`/proc/1/fd/${level === "error" ? 2 : 1}`, `${JSON.stringify(line)}\n`);
+	} catch {}
+	const endpoint = process.env.OTEL_EXPORTER_OTLP_ENDPOINT;
+	if (!endpoint) return;
+	const headers = { "content-type": "application/json" };
+	for (const pair of (process.env.OTEL_EXPORTER_OTLP_HEADERS ?? "").split(",")) {
+		const at = pair.indexOf("=");
+		if (at > 0) headers[decodeURIComponent(pair.slice(0, at).trim())] = decodeURIComponent(pair.slice(at + 1).trim());
+	}
+	const value = (v) => typeof v === "number" ? { doubleValue: v } : typeof v === "boolean" ? { boolValue: v } : { stringValue: typeof v === "string" ? v : JSON.stringify(v) };
+	const body = JSON.stringify({ resourceLogs: [{
+		resource: { attributes: [{
+			key: "service.name",
+			value: { stringValue: process.env.OTEL_SERVICE_NAME ?? "backups" }
+		}] },
+		scopeLogs: [{
+			scope: { name: "gkm-backups" },
+			logRecords: [{
+				timeUnixNano: `${at.getTime()}000000`,
+				severityText: level.toUpperCase(),
+				severityNumber: level === "error" ? 17 : 9,
+				body: { stringValue: message },
+				attributes: Object.entries(fields).map(([key, v]) => ({
+					key,
+					value: value(v)
+				}))
+			}]
+		}]
+	}] });
+	try {
+		await fetch(`${endpoint.replace(/\/+$/, "")}/v1/logs`, {
+			method: "POST",
+			headers,
+			body,
+			signal: AbortSignal.timeout(1e4)
+		});
+	} catch {}
+}
+/** `pg_dump` of one database, gzipped, as a stream — and how it ended. */
+function dump(database) {
+	const child = (0, node_child_process.spawn)("pg_dump", [
+		"--format=plain",
+		"--create",
+		"--clean",
+		"--if-exists",
+		"--dbname",
+		database
+	], { stdio: [
+		"ignore",
+		"pipe",
+		"pipe"
+	] });
+	let stderr = "";
+	child.stderr.on("data", (chunk) => {
+		stderr += chunk.toString();
+	});
+	const gzip = (0, node_zlib.createGzip)();
+	child.stdout.pipe(gzip);
+	return {
+		stream: gzip,
+		done: new Promise((resolve, reject) => {
+			child.on("error", reject);
+			child.on("close", (code) => code === 0 ? resolve() : reject(new DumpFailed(database, code, stderr)));
+		})
+	};
+}
+function readEnv(name) {
+	const value = process.env[name];
+	if (!value) throw new BackupsEnvInvalid(name, "is not set");
+	return value;
+}
+/** A lock, so `backup:now` and the schedule never dump at once. */
+async function withLock(run) {
+	(0, node_fs.mkdirSync)(STATE_DIR, { recursive: true });
+	const lock = `${STATE_DIR}/lock`;
+	for (;;) try {
+		(0, node_fs.mkdirSync)(lock);
+		break;
+	} catch {
+		await new Promise((r) => setTimeout(r, 2e3));
+	}
+	try {
+		return await run();
+	} finally {
+		(0, node_fs.rmdirSync)(lock);
+	}
+}
+/** One backup of every database, into one run folder. Resolves whether it all went. */
+async function backupOnce(at = /* @__PURE__ */ new Date()) {
+	return withLock(async () => {
+		const to = destination(readEnv("BACKUPS_URL"));
+		const prefix = readEnv("BACKUPS_PREFIX").replace(/\/+$/, "");
+		const databases = JSON.parse(readEnv("BACKUPS_DATABASES"));
+		let startedAt = at;
+		const last = (() => {
+			try {
+				return (0, node_fs.readFileSync)(`${STATE_DIR}/last-folder`, "utf-8");
+			} catch {
+				return;
+			}
+		})();
+		while (runFolder(startedAt) === last) {
+			await new Promise((r) => setTimeout(r, 1e3 - Date.now() % 1e3 + 5));
+			startedAt = /* @__PURE__ */ new Date();
+		}
+		(0, node_fs.writeFileSync)(`${STATE_DIR}/last-folder`, runFolder(startedAt));
+		const folder = `${prefix}/${runFolder(startedAt)}`;
+		const started = Date.now();
+		const sizes = {};
+		const failed = {};
+		for (const database of databases) {
+			const key = `${folder}/${database.file}.sql.gz`;
+			try {
+				const { stream, done } = dump(database.name);
+				done.catch(() => {});
+				sizes[database.file] = await upload(to, key, stream, done);
+			} catch (error) {
+				failed[database.file] = error instanceof Error ? error.message : String(error);
+			}
+		}
+		const ok = Object.keys(failed).length === 0;
+		const fields = {
+			folder,
+			databases: databases.map((d) => d.file),
+			bytes: sizes,
+			durationMs: Date.now() - started,
+			...ok ? {} : { failed }
+		};
+		if (ok) {
+			(0, node_fs.writeFileSync)(`${STATE_DIR}/last-success`, String(Date.now()));
+			await report("info", "backup finished", {
+				ok,
+				...fields
+			});
+		} else await report("error", "backup failed", {
+			ok,
+			...fields
+		});
+		return ok;
+	});
+}
+/** Whether the last good run — or, before one, the start — is recent enough. */
+function healthy(now = Date.now()) {
+	const gap = Number(readEnv("BACKUPS_MAX_GAP_SECONDS"));
+	const read = (file) => {
+		try {
+			return Number((0, node_fs.readFileSync)(`${STATE_DIR}/${file}`, "utf-8"));
+		} catch {
+			return;
+		}
+	};
+	const since = read("last-success") ?? read("started");
+	if (since === void 0) return false;
+	return now - since <= (2 * gap + STARTUP_GRACE_SECONDS) * 1e3;
+}
+/** Run on schedule, forever. */
+async function serve() {
+	(0, node_fs.mkdirSync)(STATE_DIR, { recursive: true });
+	(0, node_fs.writeFileSync)(`${STATE_DIR}/started`, String(Date.now()));
+	const schedule = JSON.parse(readEnv("BACKUPS_SCHEDULE"));
+	let stopping = false;
+	for (const signal of ["SIGTERM", "SIGINT"]) process.once(signal, () => {
+		stopping = true;
+		process.exit(0);
+	});
+	await report("info", "backups scheduled", { next: nextRun(schedule, /* @__PURE__ */ new Date())?.toISOString() ?? null });
+	while (!stopping) {
+		const next = nextRun(schedule, /* @__PURE__ */ new Date());
+		if (!next) return;
+		while (Date.now() < next.getTime()) await new Promise((r) => setTimeout(r, Math.min(next.getTime() - Date.now(), 36e5)));
+		await backupOnce(next).catch((error) => report("error", "backup failed", {
+			ok: false,
+			error: error instanceof Error ? error.message : String(error)
+		}));
+	}
+}
+/** What `node backup.mjs <command>` runs; resolves with its exit code. */
+async function main(command) {
+	if (command === "serve") {
+		await serve();
+		return 0;
+	}
+	if (command === "run") return await backupOnce() ? 0 : 1;
+	if (command === "health") return healthy() ? 0 : 1;
+	await report("error", "usage: backup.mjs serve | run | health", { command: command ?? null });
+	return 2;
+}
+if (process.argv[1] && /backup\.mjs$|runner\.(?:ts|mjs)$/.test(process.argv[1])) main(process.argv[2]).then((code) => process.exit(code), async (error) => {
+	await report("error", "backup failed", {
+		ok: false,
+		error: error instanceof Error ? error.message : String(error)
+	});
+	process.exit(1);
+});
+//#endregion
+exports.backupOnce = backupOnce;
+exports.destination = destination;
+exports.healthy = healthy;
+exports.main = main;
+exports.nextRun = nextRun;
+exports.onReport = onReport;
+exports.runFolder = runFolder;
+exports.s3Send = s3Send;
+exports.serve = serve;
+exports.upload = upload;
+
+//# sourceMappingURL=runner.cjs.map