@geekmidas/cli 10.0.0-alpha.11 → 10.0.0-alpha.110

package/dist/backups/runner.mjs

@@ -0,0 +1,506 @@
+import { appendFileSync, mkdirSync, readFileSync, rmdirSync, writeFileSync } from "node:fs";
+import { spawn } from "node:child_process";
+import { createHash, createHmac } from "node:crypto";
+import http from "node:http";
+import { createGzip } from "node:zlib";
+import https from "node:https";
+//#region src/backups/runner.ts
+/**
+* The backups container's program: `pg_dump` each of the stack's databases
+* on schedule and stream it, gzipped, to the stage's backups prefix.
+*
+* It ships alone — copied into an image built `FROM postgres:<major>-alpine`
+* with Node added — so it imports nothing but Node's own modules: S3 is
+* spoken to with a SigV4 signature made here, not the AWS SDK.
+*
+*   node backup.mjs serve    run on schedule, forever (the container's command)
+*   node backup.mjs run      one backup now (`gkm backup:now`)
+*   node backup.mjs health   exit 1 when the last good run is too old
+*
+* Its key may only put objects under the prefix: it never reads, lists or
+* deletes, so nothing here does either. A dump is uploaded in parts as it is
+* made, so no database is ever held on disk or in memory whole.
+*
+* Environment:
+*
+* - `BACKUPS_URL` — `s3://KEY:SECRET@bucket?region=…`, the stage's backups key
+* - `BACKUPS_PREFIX` — `gkm/<project>/<stage>/backups`
+* - `BACKUPS_DATABASES` — `[{"file":"auth-database","name":"auth_database_production"}]`
+* - `BACKUPS_SCHEDULE` — `{"kind":"every","seconds":86400,"offset":7200}`, or
+*   a cron expanded: `{"kind":"cron","minutes":[0],"hours":[0,6,12,18],…}`
+* - `BACKUPS_MAX_GAP_SECONDS` — the longest the schedule goes between runs
+* - `PGHOST`, `PGPORT`, `PGUSER`, `PGPASSWORD` — read by `pg_dump` itself
+* - `OTEL_EXPORTER_OTLP_ENDPOINT`/`_HEADERS` — where each run's result is
+*   also sent as an OTLP log, when the stage's telemetry is on
+*/
+/** Where the runner keeps what its health check reads. */
+const STATE_DIR = process.env.BACKUPS_STATE_DIR ?? "/tmp/gkm-backups";
+/** How long a container may go without a good run before it has had one. */
+const STARTUP_GRACE_SECONDS = 900;
+/** S3's smallest part, but the last; and the size each part is cut at. */
+const PART_BYTES = Number(process.env.BACKUPS_PART_BYTES) || 16777216;
+/** Four years: how far ahead a cron schedule is looked for its next run. */
+const CRON_HORIZON_DAYS = 1464;
+function cronDay(schedule, date) {
+	if (schedule.months && !schedule.months.includes(date.getUTCMonth() + 1)) return false;
+	const dom = schedule.days?.includes(date.getUTCDate());
+	const dow = schedule.weekdays?.includes(date.getUTCDay());
+	if (schedule.days && schedule.weekdays) return Boolean(dom || dow);
+	if (schedule.days) return Boolean(dom);
+	if (schedule.weekdays) return Boolean(dow);
+	return true;
+}
+/**
+* The first time after `after`, to the minute, the schedule runs — the copy
+* of `schedule.ts`'s `nextRun` this file carries, since it ships alone.
+*/
+function nextRun(schedule, after) {
+	const from = Math.floor(after.getTime() / 6e4) * 6e4 + 6e4;
+	if (schedule.kind === "every") {
+		const interval = schedule.seconds * 1e3;
+		const offset = schedule.offset * 1e3;
+		return new Date(offset + Math.ceil((from - offset) / interval) * interval);
+	}
+	const start = new Date(from);
+	const day = Date.UTC(start.getUTCFullYear(), start.getUTCMonth(), start.getUTCDate());
+	for (let i = 0; i < CRON_HORIZON_DAYS; i++) {
+		const date = new Date(day + i * 864e5);
+		if (!cronDay(schedule, date)) continue;
+		for (const hour of schedule.hours) for (const minute of schedule.minutes) {
+			const at = date.getTime() + hour * 36e5 + minute * 6e4;
+			if (at >= from) return new Date(at);
+		}
+	}
+	return null;
+}
+/** One run's folder: `2026-10-10/02-00-00Z`. */
+function runFolder(at) {
+	const iso = at.toISOString();
+	return `${iso.slice(0, 10)}/${iso.slice(11, 19).replace(/:/g, "-")}Z`;
+}
+/** `BACKUPS_URL`, read the way `@geekmidas/storage/s3-url` writes it. */
+function destination(url) {
+	const parsed = new URL(url);
+	if (parsed.protocol !== "s3:" || !parsed.hostname) throw new BackupsEnvInvalid("BACKUPS_URL", "is not an s3:// URL with a bucket");
+	const endpoint = parsed.searchParams.get("endpoint") ?? void 0;
+	return {
+		bucket: parsed.hostname,
+		region: parsed.searchParams.get("region") ?? "us-east-1",
+		...endpoint ? { endpoint } : {},
+		forcePathStyle: parsed.searchParams.get("forcePathStyle") === "true",
+		accessKeyId: decodeURIComponent(parsed.username),
+		secretAccessKey: decodeURIComponent(parsed.password)
+	};
+}
+const sha256 = (data) => createHash("sha256").update(data).digest("hex");
+const hmac = (key, data) => createHmac("sha256", key).update(data).digest();
+/** RFC 3986, as SigV4 wants it: everything but unreserved characters. */
+function encode(value) {
+	return encodeURIComponent(value).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+/** One request to S3, signed with SigV4; the response's status and body. */
+async function s3Send(to, request, now = /* @__PURE__ */ new Date()) {
+	const body = request.body ?? Buffer.alloc(0);
+	const path = request.key.split("/").map(encode).join("/");
+	let url;
+	if (to.endpoint) {
+		const base = to.endpoint.replace(/\/+$/, "");
+		url = to.forcePathStyle ? new URL(`${base}/${to.bucket}/${path}`) : new URL(`${base.replace("://", `://${to.bucket}.`)}/${path}`);
+	} else url = new URL(`https://${to.bucket}.s3.${to.region}.amazonaws.com/${path}`);
+	const query = Object.entries(request.query ?? {}).map(([k, v]) => [encode(k), encode(v)]).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${k}=${v}`).join("&");
+	const amzDate = now.toISOString().replace(/[:-]|\.\d{3}/g, "");
+	const day = amzDate.slice(0, 8);
+	const payload = sha256(body);
+	const headers = {
+		host: url.host,
+		"x-amz-content-sha256": payload,
+		"x-amz-date": amzDate,
+		...Object.fromEntries(Object.entries(request.headers ?? {}).map(([k, v]) => [k.toLowerCase(), v]))
+	};
+	const names = Object.keys(headers).sort();
+	const canonical = [
+		request.method,
+		url.pathname,
+		query,
+		names.map((n) => `${n}:${headers[n].trim()}\n`).join(""),
+		names.join(";"),
+		payload
+	].join("\n");
+	const scope = `${day}/${to.region}/s3/aws4_request`;
+	const toSign = [
+		"AWS4-HMAC-SHA256",
+		amzDate,
+		scope,
+		sha256(canonical)
+	].join("\n");
+	const key = hmac(hmac(hmac(hmac(`AWS4${to.secretAccessKey}`, day), to.region), "s3"), "aws4_request");
+	const signature = createHmac("sha256", key).update(toSign).digest("hex");
+	headers.authorization = `AWS4-HMAC-SHA256 Credential=${to.accessKeyId}/${scope}, SignedHeaders=${names.join(";")}, Signature=${signature}`;
+	headers["content-length"] = String(body.length);
+	const send = url.protocol === "https:" ? https.request : http.request;
+	return new Promise((resolve, reject) => {
+		const req = send(url, {
+			method: request.method,
+			headers,
+			path: `${url.pathname}${query ? `?${query}` : ""}`
+		}, (res) => {
+			const chunks = [];
+			res.on("data", (chunk) => chunks.push(chunk));
+			res.on("end", () => resolve({
+				status: res.statusCode ?? 0,
+				body: Buffer.concat(chunks).toString("utf-8"),
+				headers: Object.fromEntries(Object.entries(res.headers).map(([k, v]) => [k, String(v ?? "")]))
+			}));
+			res.on("error", reject);
+		});
+		req.on("error", reject);
+		req.setTimeout(3e5, () => req.destroy(new RequestTimedOut(request.key)));
+		req.end(body);
+	});
+}
+/** S3 did not answer a request within five minutes. */
+var RequestTimedOut = class extends Error {
+	key;
+	constructor(key) {
+		super(`S3 did not answer within five minutes putting ${key}.`);
+		this.key = key;
+		this.name = "RequestTimedOut";
+	}
+};
+/** A variable the container is started with that is missing or wrong. */
+var BackupsEnvInvalid = class extends Error {
+	variable;
+	reason;
+	constructor(variable, reason) {
+		super(`${variable} ${reason}. It is written by gkm into the stack's backups.env; deploy the stage again.`);
+		this.variable = variable;
+		this.reason = reason;
+		this.name = "BackupsEnvInvalid";
+	}
+};
+/** `pg_dump` exited with an error: the dump is not uploaded. */
+var DumpFailed = class extends Error {
+	database;
+	code;
+	stderr;
+	constructor(database, code, stderr) {
+		super(`pg_dump ${database} exited ${code}: ${stderr.trim().slice(-500)}`);
+		this.database = database;
+		this.code = code;
+		this.stderr = stderr;
+		this.name = "DumpFailed";
+	}
+};
+/** A request S3 refused, or that never got an answer. */
+var UploadFailed = class extends Error {
+	key;
+	status;
+	said;
+	constructor(key, status, said) {
+		super(`S3 answered HTTP ${status} putting ${key}: ${said.replace(/\s+/g, " ").slice(0, 500)}`);
+		this.key = key;
+		this.status = status;
+		this.said = said;
+		this.name = "UploadFailed";
+	}
+};
+/** `s3Send`, again after 1, 4 and 9 seconds when the network or S3 fails. */
+async function sendWithRetry(to, request) {
+	let last;
+	for (let attempt = 0; attempt < 4; attempt++) {
+		if (attempt > 0) await new Promise((r) => setTimeout(r, attempt * attempt * 1e3));
+		try {
+			const res = await s3Send(to, request);
+			if (res.status >= 200 && res.status < 300) return res;
+			last = new UploadFailed(request.key, res.status, res.body);
+			if (res.status < 500) break;
+		} catch (error) {
+			last = error;
+		}
+	}
+	throw last;
+}
+/**
+* Upload a stream to `key`: one PUT when it fits in a part, else a multipart
+* upload — every action of which is `s3:PutObject`, all the key may do. A
+* failed upload is left for the bucket's lifecycle to abort.
+*/
+async function upload(to, key, stream, finished = Promise.resolve()) {
+	let buffered = [];
+	let size = 0;
+	let total = 0;
+	let uploadId;
+	const parts = [];
+	const flush = async (body) => {
+		if (!uploadId) {
+			const created = await sendWithRetry(to, {
+				method: "POST",
+				key,
+				query: { uploads: "" },
+				headers: { "content-type": "application/gzip" }
+			});
+			uploadId = /<UploadId>([^<]+)<\/UploadId>/.exec(created.body)?.[1];
+			if (!uploadId) throw new UploadFailed(key, created.status, created.body);
+		}
+		const part = await sendWithRetry(to, {
+			method: "PUT",
+			key,
+			query: {
+				partNumber: String(parts.length + 1),
+				uploadId
+			},
+			body
+		});
+		parts.push(part.headers.etag ?? "");
+	};
+	for await (const chunk of stream) {
+		buffered.push(chunk);
+		size += chunk.length;
+		total += chunk.length;
+		if (size >= PART_BYTES) {
+			const body = Buffer.concat(buffered);
+			buffered = [];
+			size = 0;
+			await flush(body);
+		}
+	}
+	await finished;
+	const rest = Buffer.concat(buffered);
+	if (!uploadId) {
+		await sendWithRetry(to, {
+			method: "PUT",
+			key,
+			body: rest,
+			headers: { "content-type": "application/gzip" }
+		});
+		return total;
+	}
+	if (rest.length > 0) await flush(rest);
+	const complete = parts.map((etag, i) => `<Part><PartNumber>${i + 1}</PartNumber><ETag>${etag}</ETag></Part>`).join("");
+	const done = await sendWithRetry(to, {
+		method: "POST",
+		key,
+		query: { uploadId },
+		body: Buffer.from(`<CompleteMultipartUpload>${complete}</CompleteMultipartUpload>`),
+		headers: { "content-type": "application/xml" }
+	});
+	if (/<Error>/.test(done.body)) throw new UploadFailed(key, 200, done.body);
+	return total;
+}
+/** Who else is told each line — a test, reading what a run said. */
+const listeners = /* @__PURE__ */ new Set();
+/** Be handed each line the runner logs. Returns what stops it. */
+function onReport(listener) {
+	listeners.add(listener);
+	return () => listeners.delete(listener);
+}
+/** One line of the run's result: JSON on stdout, and OTLP when telemetry is on. */
+async function report(level, message, fields) {
+	const at = /* @__PURE__ */ new Date();
+	const line = {
+		time: at.toISOString(),
+		level,
+		msg: message,
+		...fields
+	};
+	(level === "error" ? process.stderr : process.stdout).write(`${JSON.stringify(line)}\n`);
+	for (const listener of listeners) listener(line);
+	if (process.pid !== 1 && process.platform === "linux") try {
+		appendFileSync(`/proc/1/fd/${level === "error" ? 2 : 1}`, `${JSON.stringify(line)}\n`);
+	} catch {}
+	const endpoint = process.env.OTEL_EXPORTER_OTLP_ENDPOINT;
+	if (!endpoint) return;
+	const headers = { "content-type": "application/json" };
+	for (const pair of (process.env.OTEL_EXPORTER_OTLP_HEADERS ?? "").split(",")) {
+		const at = pair.indexOf("=");
+		if (at > 0) headers[decodeURIComponent(pair.slice(0, at).trim())] = decodeURIComponent(pair.slice(at + 1).trim());
+	}
+	const value = (v) => typeof v === "number" ? { doubleValue: v } : typeof v === "boolean" ? { boolValue: v } : { stringValue: typeof v === "string" ? v : JSON.stringify(v) };
+	const body = JSON.stringify({ resourceLogs: [{
+		resource: { attributes: [{
+			key: "service.name",
+			value: { stringValue: process.env.OTEL_SERVICE_NAME ?? "backups" }
+		}] },
+		scopeLogs: [{
+			scope: { name: "gkm-backups" },
+			logRecords: [{
+				timeUnixNano: `${at.getTime()}000000`,
+				severityText: level.toUpperCase(),
+				severityNumber: level === "error" ? 17 : 9,
+				body: { stringValue: message },
+				attributes: Object.entries(fields).map(([key, v]) => ({
+					key,
+					value: value(v)
+				}))
+			}]
+		}]
+	}] });
+	try {
+		await fetch(`${endpoint.replace(/\/+$/, "")}/v1/logs`, {
+			method: "POST",
+			headers,
+			body,
+			signal: AbortSignal.timeout(1e4)
+		});
+	} catch {}
+}
+/** `pg_dump` of one database, gzipped, as a stream — and how it ended. */
+function dump(database) {
+	const child = spawn("pg_dump", [
+		"--format=plain",
+		"--create",
+		"--clean",
+		"--if-exists",
+		"--dbname",
+		database
+	], { stdio: [
+		"ignore",
+		"pipe",
+		"pipe"
+	] });
+	let stderr = "";
+	child.stderr.on("data", (chunk) => {
+		stderr += chunk.toString();
+	});
+	const gzip = createGzip();
+	child.stdout.pipe(gzip);
+	return {
+		stream: gzip,
+		done: new Promise((resolve, reject) => {
+			child.on("error", reject);
+			child.on("close", (code) => code === 0 ? resolve() : reject(new DumpFailed(database, code, stderr)));
+		})
+	};
+}
+function readEnv(name) {
+	const value = process.env[name];
+	if (!value) throw new BackupsEnvInvalid(name, "is not set");
+	return value;
+}
+/** A lock, so `backup:now` and the schedule never dump at once. */
+async function withLock(run) {
+	mkdirSync(STATE_DIR, { recursive: true });
+	const lock = `${STATE_DIR}/lock`;
+	for (;;) try {
+		mkdirSync(lock);
+		break;
+	} catch {
+		await new Promise((r) => setTimeout(r, 2e3));
+	}
+	try {
+		return await run();
+	} finally {
+		rmdirSync(lock);
+	}
+}
+/** One backup of every database, into one run folder. Resolves whether it all went. */
+async function backupOnce(at = /* @__PURE__ */ new Date()) {
+	return withLock(async () => {
+		const to = destination(readEnv("BACKUPS_URL"));
+		const prefix = readEnv("BACKUPS_PREFIX").replace(/\/+$/, "");
+		const databases = JSON.parse(readEnv("BACKUPS_DATABASES"));
+		let startedAt = at;
+		const last = (() => {
+			try {
+				return readFileSync(`${STATE_DIR}/last-folder`, "utf-8");
+			} catch {
+				return;
+			}
+		})();
+		while (runFolder(startedAt) === last) {
+			await new Promise((r) => setTimeout(r, 1e3 - Date.now() % 1e3 + 5));
+			startedAt = /* @__PURE__ */ new Date();
+		}
+		writeFileSync(`${STATE_DIR}/last-folder`, runFolder(startedAt));
+		const folder = `${prefix}/${runFolder(startedAt)}`;
+		const started = Date.now();
+		const sizes = {};
+		const failed = {};
+		for (const database of databases) {
+			const key = `${folder}/${database.file}.sql.gz`;
+			try {
+				const { stream, done } = dump(database.name);
+				done.catch(() => {});
+				sizes[database.file] = await upload(to, key, stream, done);
+			} catch (error) {
+				failed[database.file] = error instanceof Error ? error.message : String(error);
+			}
+		}
+		const ok = Object.keys(failed).length === 0;
+		const fields = {
+			folder,
+			databases: databases.map((d) => d.file),
+			bytes: sizes,
+			durationMs: Date.now() - started,
+			...ok ? {} : { failed }
+		};
+		if (ok) {
+			writeFileSync(`${STATE_DIR}/last-success`, String(Date.now()));
+			await report("info", "backup finished", {
+				ok,
+				...fields
+			});
+		} else await report("error", "backup failed", {
+			ok,
+			...fields
+		});
+		return ok;
+	});
+}
+/** Whether the last good run — or, before one, the start — is recent enough. */
+function healthy(now = Date.now()) {
+	const gap = Number(readEnv("BACKUPS_MAX_GAP_SECONDS"));
+	const read = (file) => {
+		try {
+			return Number(readFileSync(`${STATE_DIR}/${file}`, "utf-8"));
+		} catch {
+			return;
+		}
+	};
+	const since = read("last-success") ?? read("started");
+	if (since === void 0) return false;
+	return now - since <= (2 * gap + STARTUP_GRACE_SECONDS) * 1e3;
+}
+/** Run on schedule, forever. */
+async function serve() {
+	mkdirSync(STATE_DIR, { recursive: true });
+	writeFileSync(`${STATE_DIR}/started`, String(Date.now()));
+	const schedule = JSON.parse(readEnv("BACKUPS_SCHEDULE"));
+	let stopping = false;
+	for (const signal of ["SIGTERM", "SIGINT"]) process.once(signal, () => {
+		stopping = true;
+		process.exit(0);
+	});
+	await report("info", "backups scheduled", { next: nextRun(schedule, /* @__PURE__ */ new Date())?.toISOString() ?? null });
+	while (!stopping) {
+		const next = nextRun(schedule, /* @__PURE__ */ new Date());
+		if (!next) return;
+		while (Date.now() < next.getTime()) await new Promise((r) => setTimeout(r, Math.min(next.getTime() - Date.now(), 36e5)));
+		await backupOnce(next).catch((error) => report("error", "backup failed", {
+			ok: false,
+			error: error instanceof Error ? error.message : String(error)
+		}));
+	}
+}
+/** What `node backup.mjs <command>` runs; resolves with its exit code. */
+async function main(command) {
+	if (command === "serve") {
+		await serve();
+		return 0;
+	}
+	if (command === "run") return await backupOnce() ? 0 : 1;
+	if (command === "health") return healthy() ? 0 : 1;
+	await report("error", "usage: backup.mjs serve | run | health", { command: command ?? null });
+	return 2;
+}
+if (process.argv[1] && /backup\.mjs$|runner\.(?:ts|mjs)$/.test(process.argv[1])) main(process.argv[2]).then((code) => process.exit(code), async (error) => {
+	await report("error", "backup failed", {
+		ok: false,
+		error: error instanceof Error ? error.message : String(error)
+	});
+	process.exit(1);
+});
+//#endregion
+export { backupOnce, destination, healthy, main, nextRun, onReport, runFolder, s3Send, serve, upload };
+
+//# sourceMappingURL=runner.mjs.map

package/dist/backups/runner.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.mjs","names":[],"sources":["../../src/backups/runner.ts"],"sourcesContent":["/**\n * The backups container's program: `pg_dump` each of the stack's databases\n * on schedule and stream it, gzipped, to the stage's backups prefix.\n *\n * It ships alone — copied into an image built `FROM postgres:<major>-alpine`\n * with Node added — so it imports nothing but Node's own modules: S3 is\n * spoken to with a SigV4 signature made here, not the AWS SDK.\n *\n *   node backup.mjs serve    run on schedule, forever (the container's command)\n *   node backup.mjs run      one backup now (`gkm backup:now`)\n *   node backup.mjs health   exit 1 when the last good run is too old\n *\n * Its key may only put objects under the prefix: it never reads, lists or\n * deletes, so nothing here does either. A dump is uploaded in parts as it is\n * made, so no database is ever held on disk or in memory whole.\n *\n * Environment:\n *\n * - `BACKUPS_URL` — `s3://KEY:SECRET@bucket?region=…`, the stage's backups key\n * - `BACKUPS_PREFIX` — `gkm/<project>/<stage>/backups`\n * - `BACKUPS_DATABASES` — `[{\"file\":\"auth-database\",\"name\":\"auth_database_production\"}]`\n * - `BACKUPS_SCHEDULE` — `{\"kind\":\"every\",\"seconds\":86400,\"offset\":7200}`, or\n *   a cron expanded: `{\"kind\":\"cron\",\"minutes\":[0],\"hours\":[0,6,12,18],…}`\n * - `BACKUPS_MAX_GAP_SECONDS` — the longest the schedule goes between runs\n * - `PGHOST`, `PGPORT`, `PGUSER`, `PGPASSWORD` — read by `pg_dump` itself\n * - `OTEL_EXPORTER_OTLP_ENDPOINT`/`_HEADERS` — where each run's result is\n *   also sent as an OTLP log, when the stage's telemetry is on\n */\n\nimport { spawn } from 'node:child_process';\nimport { createHash, createHmac } from 'node:crypto';\nimport {\n\tappendFileSync,\n\tmkdirSync,\n\treadFileSync,\n\trmdirSync,\n\twriteFileSync,\n} from 'node:fs';\nimport http from 'node:http';\nimport https from 'node:https';\nimport { createGzip } from 'node:zlib';\n\n/** Where the runner keeps what its health check reads. */\nconst STATE_DIR = process.env.BACKUPS_STATE_DIR ?? '/tmp/gkm-backups';\n/** How long a container may go without a good run before it has had one. */\nconst STARTUP_GRACE_SECONDS = 15 * 60;\n/** S3's smallest part, but the last; and the size each part is cut at. */\nconst PART_BYTES = Number(process.env.BACKUPS_PART_BYTES) || 16 * 1024 * 1024;\n\nexport interface IntervalSchedule {\n\tkind: 'every';\n\tseconds: number;\n\toffset: number;\n}\n\nexport interface CronSchedule {\n\tkind: 'cron';\n\tminutes: number[];\n\thours: number[];\n\tdays: number[] | null;\n\tmonths: number[] | null;\n\tweekdays: number[] | null;\n}\n\nexport type Schedule = IntervalSchedule | CronSchedule;\n\n/** Four years: how far ahead a cron schedule is looked for its next run. */\nconst CRON_HORIZON_DAYS = 4 * 366;\n\nfunction cronDay(schedule: CronSchedule, date: Date): boolean {\n\tif (schedule.months && !schedule.months.includes(date.getUTCMonth() + 1)) {\n\t\treturn false;\n\t}\n\tconst dom = schedule.days?.includes(date.getUTCDate());\n\tconst dow = schedule.weekdays?.includes(date.getUTCDay());\n\tif (schedule.days && schedule.weekdays) return Boolean(dom || dow);\n\tif (schedule.days) return Boolean(dom);\n\tif (schedule.weekdays) return Boolean(dow);\n\treturn true;\n}\n\n/**\n * The first time after `after`, to the minute, the schedule runs — the copy\n * of `schedule.ts`'s `nextRun` this file carries, since it ships alone.\n */\nexport function nextRun(schedule: Schedule, after: Date): Date | null {\n\tconst from = Math.floor(after.getTime() / 60_000) * 60_000 + 60_000;\n\tif (schedule.kind === 'every') {\n\t\tconst interval = schedule.seconds * 1000;\n\t\tconst offset = schedule.offset * 1000;\n\t\treturn new Date(offset + Math.ceil((from - offset) / interval) * interval);\n\t}\n\tconst start = new Date(from);\n\tconst day = Date.UTC(\n\t\tstart.getUTCFullYear(),\n\t\tstart.getUTCMonth(),\n\t\tstart.getUTCDate(),\n\t);\n\tfor (let i = 0; i < CRON_HORIZON_DAYS; i++) {\n\t\tconst date = new Date(day + i * 86_400_000);\n\t\tif (!cronDay(schedule, date)) continue;\n\t\tfor (const hour of schedule.hours) {\n\t\t\tfor (const minute of schedule.minutes) {\n\t\t\t\tconst at = date.getTime() + hour * 3_600_000 + minute * 60_000;\n\t\t\t\tif (at >= from) return new Date(at);\n\t\t\t}\n\t\t}\n\t}\n\treturn null;\n}\n\n/** One run's folder: `2026-10-10/02-00-00Z`. */\nexport function runFolder(at: Date): string {\n\tconst iso = at.toISOString();\n\treturn `${iso.slice(0, 10)}/${iso.slice(11, 19).replace(/:/g, '-')}Z`;\n}\n\n// ============================================================================\n// S3, signed here\n// ============================================================================\n\n/** Where and as whom the backups are put. */\nexport interface Destination {\n\tbucket: string;\n\tregion: string;\n\tendpoint?: string;\n\tforcePathStyle: boolean;\n\taccessKeyId: string;\n\tsecretAccessKey: string;\n}\n\n/** `BACKUPS_URL`, read the way `@geekmidas/storage/s3-url` writes it. */\nexport function destination(url: string): Destination {\n\tconst parsed = new URL(url);\n\tif (parsed.protocol !== 's3:' || !parsed.hostname) {\n\t\tthrow new BackupsEnvInvalid(\n\t\t\t'BACKUPS_URL',\n\t\t\t'is not an s3:// URL with a bucket',\n\t\t);\n\t}\n\tconst endpoint = parsed.searchParams.get('endpoint') ?? undefined;\n\treturn {\n\t\tbucket: parsed.hostname,\n\t\tregion: parsed.searchParams.get('region') ?? 'us-east-1',\n\t\t...(endpoint ? { endpoint } : {}),\n\t\tforcePathStyle: parsed.searchParams.get('forcePathStyle') === 'true',\n\t\taccessKeyId: decodeURIComponent(parsed.username),\n\t\tsecretAccessKey: decodeURIComponent(parsed.password),\n\t};\n}\n\nconst sha256 = (data: string | Buffer) =>\n\tcreateHash('sha256').update(data).digest('hex');\nconst hmac = (key: string | Buffer, data: string) =>\n\tcreateHmac('sha256', key).update(data).digest();\n\n/** RFC 3986, as SigV4 wants it: everything but unreserved characters. */\nfunction encode(value: string): string {\n\treturn encodeURIComponent(value).replace(\n\t\t/[!'()*]/g,\n\t\t(c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`,\n\t);\n}\n\ninterface S3Request {\n\tmethod: 'PUT' | 'POST';\n\tkey: string;\n\tquery?: Record<string, string>;\n\tbody?: Buffer;\n\theaders?: Record<string, string>;\n}\n\n/** One request to S3, signed with SigV4; the response's status and body. */\nexport async function s3Send(\n\tto: Destination,\n\trequest: S3Request,\n\tnow: Date = new Date(),\n): Promise<{ status: number; body: string; headers: Record<string, string> }> {\n\tconst body = request.body ?? Buffer.alloc(0);\n\tconst path = request.key.split('/').map(encode).join('/');\n\tlet url: URL;\n\tif (to.endpoint) {\n\t\tconst base = to.endpoint.replace(/\\/+$/, '');\n\t\turl = to.forcePathStyle\n\t\t\t? new URL(`${base}/${to.bucket}/${path}`)\n\t\t\t: new URL(`${base.replace('://', `://${to.bucket}.`)}/${path}`);\n\t} else {\n\t\turl = new URL(`https://${to.bucket}.s3.${to.region}.amazonaws.com/${path}`);\n\t}\n\tconst query = Object.entries(request.query ?? {})\n\t\t.map(([k, v]) => [encode(k), encode(v)] as const)\n\t\t.sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))\n\t\t.map(([k, v]) => `${k}=${v}`)\n\t\t.join('&');\n\n\tconst amzDate = now.toISOString().replace(/[:-]|\\.\\d{3}/g, '');\n\tconst day = amzDate.slice(0, 8);\n\tconst payload = sha256(body);\n\tconst headers: Record<string, string> = {\n\t\thost: url.host,\n\t\t'x-amz-content-sha256': payload,\n\t\t'x-amz-date': amzDate,\n\t\t...Object.fromEntries(\n\t\t\tObject.entries(request.headers ?? {}).map(([k, v]) => [\n\t\t\t\tk.toLowerCase(),\n\t\t\t\tv,\n\t\t\t]),\n\t\t),\n\t};\n\tconst names = Object.keys(headers).sort();\n\tconst canonical = [\n\t\trequest.method,\n\t\turl.pathname,\n\t\tquery,\n\t\tnames.map((n) => `${n}:${headers[n]!.trim()}\\n`).join(''),\n\t\tnames.join(';'),\n\t\tpayload,\n\t].join('\\n');\n\tconst scope = `${day}/${to.region}/s3/aws4_request`;\n\tconst toSign = ['AWS4-HMAC-SHA256', amzDate, scope, sha256(canonical)].join(\n\t\t'\\n',\n\t);\n\tconst key = hmac(\n\t\thmac(hmac(hmac(`AWS4${to.secretAccessKey}`, day), to.region), 's3'),\n\t\t'aws4_request',\n\t);\n\tconst signature = createHmac('sha256', key).update(toSign).digest('hex');\n\theaders.authorization =\n\t\t`AWS4-HMAC-SHA256 Credential=${to.accessKeyId}/${scope}, ` +\n\t\t`SignedHeaders=${names.join(';')}, Signature=${signature}`;\n\theaders['content-length'] = String(body.length);\n\n\t// Looked up when called, not bound at import: a test's HTTP interceptor\n\t// patches the module's own `request`.\n\tconst send = url.protocol === 'https:' ? https.request : http.request;\n\treturn new Promise((resolve, reject) => {\n\t\tconst req = send(\n\t\t\turl,\n\t\t\t{\n\t\t\t\tmethod: request.method,\n\t\t\t\theaders,\n\t\t\t\tpath: `${url.pathname}${query ? `?${query}` : ''}`,\n\t\t\t},\n\t\t\t(res) => {\n\t\t\t\tconst chunks: Buffer[] = [];\n\t\t\t\tres.on('data', (chunk: Buffer) => chunks.push(chunk));\n\t\t\t\tres.on('end', () =>\n\t\t\t\t\tresolve({\n\t\t\t\t\t\tstatus: res.statusCode ?? 0,\n\t\t\t\t\t\tbody: Buffer.concat(chunks).toString('utf-8'),\n\t\t\t\t\t\theaders: Object.fromEntries(\n\t\t\t\t\t\t\tObject.entries(res.headers).map(([k, v]) => [k, String(v ?? '')]),\n\t\t\t\t\t\t),\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\tres.on('error', reject);\n\t\t\t},\n\t\t);\n\t\treq.on('error', reject);\n\t\treq.setTimeout(5 * 60_000, () =>\n\t\t\treq.destroy(new RequestTimedOut(request.key)),\n\t\t);\n\t\treq.end(body);\n\t});\n}\n\n/** S3 did not answer a request within five minutes. */\nclass RequestTimedOut extends Error {\n\tconstructor(readonly key: string) {\n\t\tsuper(`S3 did not answer within five minutes putting ${key}.`);\n\t\tthis.name = 'RequestTimedOut';\n\t}\n}\n\n/** A variable the container is started with that is missing or wrong. */\nclass BackupsEnvInvalid extends Error {\n\tconstructor(\n\t\treadonly variable: string,\n\t\treadonly reason: string,\n\t) {\n\t\tsuper(\n\t\t\t`${variable} ${reason}. It is written by gkm into the stack's backups.env; deploy the stage again.`,\n\t\t);\n\t\tthis.name = 'BackupsEnvInvalid';\n\t}\n}\n\n/** `pg_dump` exited with an error: the dump is not uploaded. */\nclass DumpFailed extends Error {\n\tconstructor(\n\t\treadonly database: string,\n\t\treadonly code: number | null,\n\t\treadonly stderr: string,\n\t) {\n\t\tsuper(`pg_dump ${database} exited ${code}: ${stderr.trim().slice(-500)}`);\n\t\tthis.name = 'DumpFailed';\n\t}\n}\n\n/** A request S3 refused, or that never got an answer. */\nclass UploadFailed extends Error {\n\tconstructor(\n\t\treadonly key: string,\n\t\treadonly status: number,\n\t\treadonly said: string,\n\t) {\n\t\tsuper(\n\t\t\t`S3 answered HTTP ${status} putting ${key}: ${said.replace(/\\s+/g, ' ').slice(0, 500)}`,\n\t\t);\n\t\tthis.name = 'UploadFailed';\n\t}\n}\n\n/** `s3Send`, again after 1, 4 and 9 seconds when the network or S3 fails. */\nasync function sendWithRetry(\n\tto: Destination,\n\trequest: S3Request,\n): Promise<{ status: number; body: string; headers: Record<string, string> }> {\n\tlet last: unknown;\n\tfor (let attempt = 0; attempt < 4; attempt++) {\n\t\tif (attempt > 0) {\n\t\t\tawait new Promise((r) => setTimeout(r, attempt * attempt * 1000));\n\t\t}\n\t\ttry {\n\t\t\tconst res = await s3Send(to, request);\n\t\t\tif (res.status >= 200 && res.status < 300) return res;\n\t\t\tlast = new UploadFailed(request.key, res.status, res.body);\n\t\t\t// A refusal is the key's or the request's; asking again changes nothing.\n\t\t\tif (res.status < 500) break;\n\t\t} catch (error) {\n\t\t\tlast = error;\n\t\t}\n\t}\n\tthrow last;\n}\n\n/**\n * Upload a stream to `key`: one PUT when it fits in a part, else a multipart\n * upload — every action of which is `s3:PutObject`, all the key may do. A\n * failed upload is left for the bucket's lifecycle to abort.\n */\nexport async function upload(\n\tto: Destination,\n\tkey: string,\n\tstream: AsyncIterable<Buffer>,\n\t/**\n\t * How what made the stream ended. Awaited before the last request: a dump\n\t * that failed half way ends its stream early, and must never be put as\n\t * though it were whole.\n\t */\n\tfinished: Promise<void> = Promise.resolve(),\n): Promise<number> {\n\tlet buffered: Buffer[] = [];\n\tlet size = 0;\n\tlet total = 0;\n\tlet uploadId: string | undefined;\n\tconst parts: string[] = [];\n\n\tconst flush = async (body: Buffer) => {\n\t\tif (!uploadId) {\n\t\t\tconst created = await sendWithRetry(to, {\n\t\t\t\tmethod: 'POST',\n\t\t\t\tkey,\n\t\t\t\tquery: { uploads: '' },\n\t\t\t\theaders: { 'content-type': 'application/gzip' },\n\t\t\t});\n\t\t\tuploadId = /<UploadId>([^<]+)<\\/UploadId>/.exec(created.body)?.[1];\n\t\t\tif (!uploadId) throw new UploadFailed(key, created.status, created.body);\n\t\t}\n\t\tconst part = await sendWithRetry(to, {\n\t\t\tmethod: 'PUT',\n\t\t\tkey,\n\t\t\tquery: { partNumber: String(parts.length + 1), uploadId },\n\t\t\tbody,\n\t\t});\n\t\tparts.push(part.headers.etag ?? '');\n\t};\n\n\tfor await (const chunk of stream) {\n\t\tbuffered.push(chunk);\n\t\tsize += chunk.length;\n\t\ttotal += chunk.length;\n\t\tif (size >= PART_BYTES) {\n\t\t\tconst body = Buffer.concat(buffered);\n\t\t\tbuffered = [];\n\t\t\tsize = 0;\n\t\t\tawait flush(body);\n\t\t}\n\t}\n\tawait finished;\n\tconst rest = Buffer.concat(buffered);\n\tif (!uploadId) {\n\t\tawait sendWithRetry(to, {\n\t\t\tmethod: 'PUT',\n\t\t\tkey,\n\t\t\tbody: rest,\n\t\t\theaders: { 'content-type': 'application/gzip' },\n\t\t});\n\t\treturn total;\n\t}\n\tif (rest.length > 0) await flush(rest);\n\tconst complete = parts\n\t\t.map(\n\t\t\t(etag, i) =>\n\t\t\t\t`<Part><PartNumber>${i + 1}</PartNumber><ETag>${etag}</ETag></Part>`,\n\t\t)\n\t\t.join('');\n\tconst done = await sendWithRetry(to, {\n\t\tmethod: 'POST',\n\t\tkey,\n\t\tquery: { uploadId: uploadId! },\n\t\tbody: Buffer.from(\n\t\t\t`<CompleteMultipartUpload>${complete}</CompleteMultipartUpload>`,\n\t\t),\n\t\theaders: { 'content-type': 'application/xml' },\n\t});\n\t// S3 can answer 200 and put an error in the body.\n\tif (/<Error>/.test(done.body)) throw new UploadFailed(key, 200, done.body);\n\treturn total;\n}\n\n// ============================================================================\n// A run\n// ============================================================================\n\nexport interface BackupDatabase {\n\tfile: string;\n\tname: string;\n}\n\n/** Who else is told each line — a test, reading what a run said. */\nconst listeners = new Set<(line: Record<string, unknown>) => void>();\n\n/** Be handed each line the runner logs. Returns what stops it. */\nexport function onReport(\n\tlistener: (line: Record<string, unknown>) => void,\n): () => void {\n\tlisteners.add(listener);\n\treturn () => listeners.delete(listener);\n}\n\n/** One line of the run's result: JSON on stdout, and OTLP when telemetry is on. */\nasync function report(\n\tlevel: 'info' | 'error',\n\tmessage: string,\n\tfields: Record<string, unknown>,\n): Promise<void> {\n\tconst at = new Date();\n\tconst line = { time: at.toISOString(), level, msg: message, ...fields };\n\tconst out = level === 'error' ? process.stderr : process.stdout;\n\tout.write(`${JSON.stringify(line)}\\n`);\n\tfor (const listener of listeners) listener(line);\n\t// A run `docker exec` started (`gkm backup:now`) is in the container's\n\t// log too, beside the scheduled ones: written to the main process's own.\n\tif (process.pid !== 1 && process.platform === 'linux') {\n\t\ttry {\n\t\t\tappendFileSync(\n\t\t\t\t`/proc/1/fd/${level === 'error' ? 2 : 1}`,\n\t\t\t\t`${JSON.stringify(line)}\\n`,\n\t\t\t);\n\t\t} catch {\n\t\t\t// Not in the container, or not allowed: the caller has the line.\n\t\t}\n\t}\n\n\tconst endpoint = process.env.OTEL_EXPORTER_OTLP_ENDPOINT;\n\tif (!endpoint) return;\n\tconst headers: Record<string, string> = {\n\t\t'content-type': 'application/json',\n\t};\n\tfor (const pair of (process.env.OTEL_EXPORTER_OTLP_HEADERS ?? '').split(\n\t\t',',\n\t)) {\n\t\tconst at = pair.indexOf('=');\n\t\tif (at > 0) {\n\t\t\theaders[decodeURIComponent(pair.slice(0, at).trim())] =\n\t\t\t\tdecodeURIComponent(pair.slice(at + 1).trim());\n\t\t}\n\t}\n\tconst value = (v: unknown) =>\n\t\ttypeof v === 'number'\n\t\t\t? { doubleValue: v }\n\t\t\t: typeof v === 'boolean'\n\t\t\t\t? { boolValue: v }\n\t\t\t\t: { stringValue: typeof v === 'string' ? v : JSON.stringify(v) };\n\tconst body = JSON.stringify({\n\t\tresourceLogs: [\n\t\t\t{\n\t\t\t\tresource: {\n\t\t\t\t\tattributes: [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tkey: 'service.name',\n\t\t\t\t\t\t\tvalue: {\n\t\t\t\t\t\t\t\tstringValue: process.env.OTEL_SERVICE_NAME ?? 'backups',\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t],\n\t\t\t\t},\n\t\t\t\tscopeLogs: [\n\t\t\t\t\t{\n\t\t\t\t\t\tscope: { name: 'gkm-backups' },\n\t\t\t\t\t\tlogRecords: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\ttimeUnixNano: `${at.getTime()}000000`,\n\t\t\t\t\t\t\t\tseverityText: level.toUpperCase(),\n\t\t\t\t\t\t\t\tseverityNumber: level === 'error' ? 17 : 9,\n\t\t\t\t\t\t\t\tbody: { stringValue: message },\n\t\t\t\t\t\t\t\tattributes: Object.entries(fields).map(([key, v]) => ({\n\t\t\t\t\t\t\t\t\tkey,\n\t\t\t\t\t\t\t\t\tvalue: value(v),\n\t\t\t\t\t\t\t\t})),\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t},\n\t\t\t\t],\n\t\t\t},\n\t\t],\n\t});\n\ttry {\n\t\tawait fetch(`${endpoint.replace(/\\/+$/, '')}/v1/logs`, {\n\t\t\tmethod: 'POST',\n\t\t\theaders,\n\t\t\tbody,\n\t\t\tsignal: AbortSignal.timeout(10_000),\n\t\t});\n\t} catch {\n\t\t// Telemetry that cannot be delivered never fails a backup.\n\t}\n}\n\n/** `pg_dump` of one database, gzipped, as a stream — and how it ended. */\nfunction dump(database: string): {\n\tstream: AsyncIterable<Buffer>;\n\tdone: Promise<void>;\n} {\n\tconst child = spawn(\n\t\t'pg_dump',\n\t\t[\n\t\t\t'--format=plain',\n\t\t\t// A restore recreates the database as it was, owners and grants\n\t\t\t// included, over whatever is there.\n\t\t\t'--create',\n\t\t\t'--clean',\n\t\t\t'--if-exists',\n\t\t\t'--dbname',\n\t\t\tdatabase,\n\t\t],\n\t\t{ stdio: ['ignore', 'pipe', 'pipe'] },\n\t);\n\tlet stderr = '';\n\tchild.stderr.on('data', (chunk: Buffer) => {\n\t\tstderr += chunk.toString();\n\t});\n\tconst gzip = createGzip();\n\tchild.stdout.pipe(gzip);\n\tconst done = new Promise<void>((resolve, reject) => {\n\t\tchild.on('error', reject);\n\t\tchild.on('close', (code) =>\n\t\t\tcode === 0 ? resolve() : reject(new DumpFailed(database, code, stderr)),\n\t\t);\n\t});\n\treturn { stream: gzip, done };\n}\n\nfunction readEnv(name: string): string {\n\tconst value = process.env[name];\n\tif (!value) throw new BackupsEnvInvalid(name, 'is not set');\n\treturn value;\n}\n\n/** A lock, so `backup:now` and the schedule never dump at once. */\nasync function withLock<T>(run: () => Promise<T>): Promise<T> {\n\tmkdirSync(STATE_DIR, { recursive: true });\n\tconst lock = `${STATE_DIR}/lock`;\n\tfor (;;) {\n\t\ttry {\n\t\t\tmkdirSync(lock);\n\t\t\tbreak;\n\t\t} catch {\n\t\t\tawait new Promise((r) => setTimeout(r, 2000));\n\t\t}\n\t}\n\ttry {\n\t\treturn await run();\n\t} finally {\n\t\trmdirSync(lock);\n\t}\n}\n\n/** One backup of every database, into one run folder. Resolves whether it all went. */\nexport async function backupOnce(at: Date = new Date()): Promise<boolean> {\n\treturn withLock(async () => {\n\t\tconst to = destination(readEnv('BACKUPS_URL'));\n\t\tconst prefix = readEnv('BACKUPS_PREFIX').replace(/\\/+$/, '');\n\t\tconst databases = JSON.parse(\n\t\t\treadEnv('BACKUPS_DATABASES'),\n\t\t) as BackupDatabase[];\n\t\t// A run's folder is its second: one that would share the last run's\n\t\t// — `backup:now` twice in a second — waits for the next, and is never\n\t\t// written over the other.\n\t\tlet startedAt = at;\n\t\tconst last = (() => {\n\t\t\ttry {\n\t\t\t\treturn readFileSync(`${STATE_DIR}/last-folder`, 'utf-8');\n\t\t\t} catch {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t})();\n\t\twhile (runFolder(startedAt) === last) {\n\t\t\tawait new Promise((r) => setTimeout(r, 1000 - (Date.now() % 1000) + 5));\n\t\t\tstartedAt = new Date();\n\t\t}\n\t\twriteFileSync(`${STATE_DIR}/last-folder`, runFolder(startedAt));\n\t\tconst folder = `${prefix}/${runFolder(startedAt)}`;\n\t\tconst started = Date.now();\n\t\tconst sizes: Record<string, number> = {};\n\t\tconst failed: Record<string, string> = {};\n\n\t\tfor (const database of databases) {\n\t\t\tconst key = `${folder}/${database.file}.sql.gz`;\n\t\t\ttry {\n\t\t\t\tconst { stream, done } = dump(database.name);\n\t\t\t\t// Handled by the upload, which waits for it before its last\n\t\t\t\t// request; never left to reject on its own.\n\t\t\t\tdone.catch(() => {});\n\t\t\t\tsizes[database.file] = await upload(to, key, stream, done);\n\t\t\t} catch (error) {\n\t\t\t\tfailed[database.file] =\n\t\t\t\t\terror instanceof Error ? error.message : String(error);\n\t\t\t}\n\t\t}\n\n\t\tconst ok = Object.keys(failed).length === 0;\n\t\tconst fields = {\n\t\t\tfolder,\n\t\t\tdatabases: databases.map((d) => d.file),\n\t\t\tbytes: sizes,\n\t\t\tdurationMs: Date.now() - started,\n\t\t\t...(ok ? {} : { failed }),\n\t\t};\n\t\tif (ok) {\n\t\t\twriteFileSync(`${STATE_DIR}/last-success`, String(Date.now()));\n\t\t\tawait report('info', 'backup finished', { ok, ...fields });\n\t\t} else {\n\t\t\tawait report('error', 'backup failed', { ok, ...fields });\n\t\t}\n\t\treturn ok;\n\t});\n}\n\n/** Whether the last good run — or, before one, the start — is recent enough. */\nexport function healthy(now = Date.now()): boolean {\n\tconst gap = Number(readEnv('BACKUPS_MAX_GAP_SECONDS'));\n\tconst read = (file: string) => {\n\t\ttry {\n\t\t\treturn Number(readFileSync(`${STATE_DIR}/${file}`, 'utf-8'));\n\t\t} catch {\n\t\t\treturn undefined;\n\t\t}\n\t};\n\tconst since = read('last-success') ?? read('started');\n\tif (since === undefined) return false;\n\treturn now - since <= (2 * gap + STARTUP_GRACE_SECONDS) * 1000;\n}\n\n/** Run on schedule, forever. */\nexport async function serve(): Promise<void> {\n\tmkdirSync(STATE_DIR, { recursive: true });\n\twriteFileSync(`${STATE_DIR}/started`, String(Date.now()));\n\tconst schedule = JSON.parse(readEnv('BACKUPS_SCHEDULE')) as Schedule;\n\tlet stopping = false;\n\tfor (const signal of ['SIGTERM', 'SIGINT'] as const) {\n\t\tprocess.once(signal, () => {\n\t\t\tstopping = true;\n\t\t\tprocess.exit(0);\n\t\t});\n\t}\n\tawait report('info', 'backups scheduled', {\n\t\tnext: nextRun(schedule, new Date())?.toISOString() ?? null,\n\t});\n\twhile (!stopping) {\n\t\tconst next = nextRun(schedule, new Date());\n\t\tif (!next) return;\n\t\t// Woken at least hourly, so a clock that jumps never oversleeps a run.\n\t\twhile (Date.now() < next.getTime()) {\n\t\t\tawait new Promise((r) =>\n\t\t\t\tsetTimeout(r, Math.min(next.getTime() - Date.now(), 3_600_000)),\n\t\t\t);\n\t\t}\n\t\tawait backupOnce(next).catch((error: unknown) =>\n\t\t\treport('error', 'backup failed', {\n\t\t\t\tok: false,\n\t\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\t}),\n\t\t);\n\t}\n}\n\n/** What `node backup.mjs <command>` runs; resolves with its exit code. */\nexport async function main(command: string | undefined): Promise<number> {\n\tif (command === 'serve') {\n\t\tawait serve();\n\t\treturn 0;\n\t}\n\tif (command === 'run') return (await backupOnce()) ? 0 : 1;\n\tif (command === 'health') return healthy() ? 0 : 1;\n\tawait report('error', 'usage: backup.mjs serve | run | health', {\n\t\tcommand: command ?? null,\n\t});\n\treturn 2;\n}\n\n// Run as a program, not when imported by a test.\nif (\n\tprocess.argv[1] &&\n\t/backup\\.mjs$|runner\\.(?:ts|mjs)$/.test(process.argv[1])\n) {\n\tmain(process.argv[2]).then(\n\t\t(code) => process.exit(code),\n\t\tasync (error: unknown) => {\n\t\t\tawait report('error', 'backup failed', {\n\t\t\t\tok: false,\n\t\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\t});\n\t\t\tprocess.exit(1);\n\t\t},\n\t);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2CA,MAAM,YAAY,QAAQ,IAAI,qBAAqB;;AAEnD,MAAM,wBAAwB;;AAE9B,MAAM,aAAa,OAAO,QAAQ,IAAI,kBAAkB,KAAK;;AAoB7D,MAAM,oBAAoB;AAE1B,SAAS,QAAQ,UAAwB,MAAqB;CAC7D,IAAI,SAAS,UAAU,CAAC,SAAS,OAAO,SAAS,KAAK,YAAY,IAAI,CAAC,GACtE,OAAO;CAER,MAAM,MAAM,SAAS,MAAM,SAAS,KAAK,WAAW,CAAC;CACrD,MAAM,MAAM,SAAS,UAAU,SAAS,KAAK,UAAU,CAAC;CACxD,IAAI,SAAS,QAAQ,SAAS,UAAU,OAAO,QAAQ,OAAO,GAAG;CACjE,IAAI,SAAS,MAAM,OAAO,QAAQ,GAAG;CACrC,IAAI,SAAS,UAAU,OAAO,QAAQ,GAAG;CACzC,OAAO;AACR;;;;;AAMA,SAAgB,QAAQ,UAAoB,OAA0B;CACrE,MAAM,OAAO,KAAK,MAAM,MAAM,QAAQ,IAAI,GAAM,IAAI,MAAS;CAC7D,IAAI,SAAS,SAAS,SAAS;EAC9B,MAAM,WAAW,SAAS,UAAU;EACpC,MAAM,SAAS,SAAS,SAAS;EACjC,OAAO,IAAI,KAAK,SAAS,KAAK,MAAM,OAAO,UAAU,QAAQ,IAAI,QAAQ;CAC1E;CACA,MAAM,QAAQ,IAAI,KAAK,IAAI;CAC3B,MAAM,MAAM,KAAK,IAChB,MAAM,eAAe,GACrB,MAAM,YAAY,GAClB,MAAM,WAAW,CAClB;CACA,KAAK,IAAI,IAAI,GAAG,IAAI,mBAAmB,KAAK;EAC3C,MAAM,OAAO,IAAI,KAAK,MAAM,IAAI,KAAU;EAC1C,IAAI,CAAC,QAAQ,UAAU,IAAI,GAAG;EAC9B,KAAK,MAAM,QAAQ,SAAS,OAC3B,KAAK,MAAM,UAAU,SAAS,SAAS;GACtC,MAAM,KAAK,KAAK,QAAQ,IAAI,OAAO,OAAY,SAAS;GACxD,IAAI,MAAM,MAAM,OAAO,IAAI,KAAK,EAAE;EACnC;CAEF;CACA,OAAO;AACR;;AAGA,SAAgB,UAAU,IAAkB;CAC3C,MAAM,MAAM,GAAG,YAAY;CAC3B,OAAO,GAAG,IAAI,MAAM,GAAG,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,MAAM,GAAG,EAAE;AACpE;;AAiBA,SAAgB,YAAY,KAA0B;CACrD,MAAM,SAAS,IAAI,IAAI,GAAG;CAC1B,IAAI,OAAO,aAAa,SAAS,CAAC,OAAO,UACxC,MAAM,IAAI,kBACT,eACA,mCACD;CAED,MAAM,WAAW,OAAO,aAAa,IAAI,UAAU,KAAK,KAAA;CACxD,OAAO;EACN,QAAQ,OAAO;EACf,QAAQ,OAAO,aAAa,IAAI,QAAQ,KAAK;EAC7C,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;EAC/B,gBAAgB,OAAO,aAAa,IAAI,gBAAgB,MAAM;EAC9D,aAAa,mBAAmB,OAAO,QAAQ;EAC/C,iBAAiB,mBAAmB,OAAO,QAAQ;CACpD;AACD;AAEA,MAAM,UAAU,SACf,WAAW,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK;AAC/C,MAAM,QAAQ,KAAsB,SACnC,WAAW,UAAU,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO;;AAG/C,SAAS,OAAO,OAAuB;CACtC,OAAO,mBAAmB,KAAK,CAAC,CAAC,QAChC,aACC,MAAM,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,YAAY,GACrD;AACD;;AAWA,eAAsB,OACrB,IACA,SACA,sBAAY,IAAI,KAAK,GACwD;CAC7E,MAAM,OAAO,QAAQ,QAAQ,OAAO,MAAM,CAAC;CAC3C,MAAM,OAAO,QAAQ,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,GAAG;CACxD,IAAI;CACJ,IAAI,GAAG,UAAU;EAChB,MAAM,OAAO,GAAG,SAAS,QAAQ,QAAQ,EAAE;EAC3C,MAAM,GAAG,iBACN,IAAI,IAAI,GAAG,KAAK,GAAG,GAAG,OAAO,GAAG,MAAM,IACtC,IAAI,IAAI,GAAG,KAAK,QAAQ,OAAO,MAAM,GAAG,OAAO,EAAE,EAAE,GAAG,MAAM;CAChE,OACC,MAAM,IAAI,IAAI,WAAW,GAAG,OAAO,MAAM,GAAG,OAAO,iBAAiB,MAAM;CAE3E,MAAM,QAAQ,OAAO,QAAQ,QAAQ,SAAS,CAAC,CAAC,CAAC,CAC/C,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAU,CAAC,CAChD,MAAM,CAAC,IAAI,CAAC,OAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAE,CAAC,CAChD,KAAK,CAAC,GAAG,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,CAC5B,KAAK,GAAG;CAEV,MAAM,UAAU,IAAI,YAAY,CAAC,CAAC,QAAQ,iBAAiB,EAAE;CAC7D,MAAM,MAAM,QAAQ,MAAM,GAAG,CAAC;CAC9B,MAAM,UAAU,OAAO,IAAI;CAC3B,MAAM,UAAkC;EACvC,MAAM,IAAI;EACV,wBAAwB;EACxB,cAAc;EACd,GAAG,OAAO,YACT,OAAO,QAAQ,QAAQ,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,OAAO,CACrD,EAAE,YAAY,GACd,CACD,CAAC,CACF;CACD;CACA,MAAM,QAAQ,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK;CACxC,MAAM,YAAY;EACjB,QAAQ;EACR,IAAI;EACJ;EACA,MAAM,KAAK,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAE,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE;EACxD,MAAM,KAAK,GAAG;EACd;CACD,CAAC,CAAC,KAAK,IAAI;CACX,MAAM,QAAQ,GAAG,IAAI,GAAG,GAAG,OAAO;CAClC,MAAM,SAAS;EAAC;EAAoB;EAAS;EAAO,OAAO,SAAS;CAAC,CAAC,CAAC,KACtE,IACD;CACA,MAAM,MAAM,KACX,KAAK,KAAK,KAAK,OAAO,GAAG,mBAAmB,GAAG,GAAG,GAAG,MAAM,GAAG,IAAI,GAClE,cACD;CACA,MAAM,YAAY,WAAW,UAAU,GAAG,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,OAAO,KAAK;CACvE,QAAQ,gBACP,+BAA+B,GAAG,YAAY,GAAG,MAAM,kBACtC,MAAM,KAAK,GAAG,EAAE,cAAc;CAChD,QAAQ,oBAAoB,OAAO,KAAK,MAAM;CAI9C,MAAM,OAAO,IAAI,aAAa,WAAW,MAAM,UAAU,KAAK;CAC9D,OAAO,IAAI,SAAS,SAAS,WAAW;EACvC,MAAM,MAAM,KACX,KACA;GACC,QAAQ,QAAQ;GAChB;GACA,MAAM,GAAG,IAAI,WAAW,QAAQ,IAAI,UAAU;EAC/C,IACC,QAAQ;GACR,MAAM,SAAmB,CAAC;GAC1B,IAAI,GAAG,SAAS,UAAkB,OAAO,KAAK,KAAK,CAAC;GACpD,IAAI,GAAG,aACN,QAAQ;IACP,QAAQ,IAAI,cAAc;IAC1B,MAAM,OAAO,OAAO,MAAM,CAAC,CAAC,SAAS,OAAO;IAC5C,SAAS,OAAO,YACf,OAAO,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,GAAG,OAAO,KAAK,EAAE,CAAC,CAAC,CACjE;GACD,CAAC,CACF;GACA,IAAI,GAAG,SAAS,MAAM;EACvB,CACD;EACA,IAAI,GAAG,SAAS,MAAM;EACtB,IAAI,WAAW,WACd,IAAI,QAAQ,IAAI,gBAAgB,QAAQ,GAAG,CAAC,CAC7C;EACA,IAAI,IAAI,IAAI;CACb,CAAC;AACF;;AAGA,IAAM,kBAAN,cAA8B,MAAM;CACd;CAArB,YAAY,KAAsB;EACjC,MAAM,iDAAiD,IAAI,EAAE;EADzC,KAAA,MAAA;EAEpB,KAAK,OAAO;CACb;AACD;;AAGA,IAAM,oBAAN,cAAgC,MAAM;CAE3B;CACA;CAFV,YACC,UACA,QACC;EACD,MACC,GAAG,SAAS,GAAG,OAAO,6EACvB;EALS,KAAA,WAAA;EACA,KAAA,SAAA;EAKT,KAAK,OAAO;CACb;AACD;;AAGA,IAAM,aAAN,cAAyB,MAAM;CAEpB;CACA;CACA;CAHV,YACC,UACA,MACA,QACC;EACD,MAAM,WAAW,SAAS,UAAU,KAAK,IAAI,OAAO,KAAK,CAAC,CAAC,MAAM,IAAI,GAAG;EAJ/D,KAAA,WAAA;EACA,KAAA,OAAA;EACA,KAAA,SAAA;EAGT,KAAK,OAAO;CACb;AACD;;AAGA,IAAM,eAAN,cAA2B,MAAM;CAEtB;CACA;CACA;CAHV,YACC,KACA,QACA,MACC;EACD,MACC,oBAAoB,OAAO,WAAW,IAAI,IAAI,KAAK,QAAQ,QAAQ,GAAG,CAAC,CAAC,MAAM,GAAG,GAAG,GACrF;EANS,KAAA,MAAA;EACA,KAAA,SAAA;EACA,KAAA,OAAA;EAKT,KAAK,OAAO;CACb;AACD;;AAGA,eAAe,cACd,IACA,SAC6E;CAC7E,IAAI;CACJ,KAAK,IAAI,UAAU,GAAG,UAAU,GAAG,WAAW;EAC7C,IAAI,UAAU,GACb,MAAM,IAAI,SAAS,MAAM,WAAW,GAAG,UAAU,UAAU,GAAI,CAAC;EAEjE,IAAI;GACH,MAAM,MAAM,MAAM,OAAO,IAAI,OAAO;GACpC,IAAI,IAAI,UAAU,OAAO,IAAI,SAAS,KAAK,OAAO;GAClD,OAAO,IAAI,aAAa,QAAQ,KAAK,IAAI,QAAQ,IAAI,IAAI;GAEzD,IAAI,IAAI,SAAS,KAAK;EACvB,SAAS,OAAO;GACf,OAAO;EACR;CACD;CACA,MAAM;AACP;;;;;;AAOA,eAAsB,OACrB,IACA,KACA,QAMA,WAA0B,QAAQ,QAAQ,GACxB;CAClB,IAAI,WAAqB,CAAC;CAC1B,IAAI,OAAO;CACX,IAAI,QAAQ;CACZ,IAAI;CACJ,MAAM,QAAkB,CAAC;CAEzB,MAAM,QAAQ,OAAO,SAAiB;EACrC,IAAI,CAAC,UAAU;GACd,MAAM,UAAU,MAAM,cAAc,IAAI;IACvC,QAAQ;IACR;IACA,OAAO,EAAE,SAAS,GAAG;IACrB,SAAS,EAAE,gBAAgB,mBAAmB;GAC/C,CAAC;GACD,WAAW,gCAAgC,KAAK,QAAQ,IAAI,CAAC,GAAG;GAChE,IAAI,CAAC,UAAU,MAAM,IAAI,aAAa,KAAK,QAAQ,QAAQ,QAAQ,IAAI;EACxE;EACA,MAAM,OAAO,MAAM,cAAc,IAAI;GACpC,QAAQ;GACR;GACA,OAAO;IAAE,YAAY,OAAO,MAAM,SAAS,CAAC;IAAG;GAAS;GACxD;EACD,CAAC;EACD,MAAM,KAAK,KAAK,QAAQ,QAAQ,EAAE;CACnC;CAEA,WAAW,MAAM,SAAS,QAAQ;EACjC,SAAS,KAAK,KAAK;EACnB,QAAQ,MAAM;EACd,SAAS,MAAM;EACf,IAAI,QAAQ,YAAY;GACvB,MAAM,OAAO,OAAO,OAAO,QAAQ;GACnC,WAAW,CAAC;GACZ,OAAO;GACP,MAAM,MAAM,IAAI;EACjB;CACD;CACA,MAAM;CACN,MAAM,OAAO,OAAO,OAAO,QAAQ;CACnC,IAAI,CAAC,UAAU;EACd,MAAM,cAAc,IAAI;GACvB,QAAQ;GACR;GACA,MAAM;GACN,SAAS,EAAE,gBAAgB,mBAAmB;EAC/C,CAAC;EACD,OAAO;CACR;CACA,IAAI,KAAK,SAAS,GAAG,MAAM,MAAM,IAAI;CACrC,MAAM,WAAW,MACf,KACC,MAAM,MACN,qBAAqB,IAAI,EAAE,qBAAqB,KAAK,eACvD,CAAC,CACA,KAAK,EAAE;CACT,MAAM,OAAO,MAAM,cAAc,IAAI;EACpC,QAAQ;EACR;EACA,OAAO,EAAY,SAAU;EAC7B,MAAM,OAAO,KACZ,4BAA4B,SAAS,2BACtC;EACA,SAAS,EAAE,gBAAgB,kBAAkB;CAC9C,CAAC;CAED,IAAI,UAAU,KAAK,KAAK,IAAI,GAAG,MAAM,IAAI,aAAa,KAAK,KAAK,KAAK,IAAI;CACzE,OAAO;AACR;;AAYA,MAAM,4BAAY,IAAI,IAA6C;;AAGnE,SAAgB,SACf,UACa;CACb,UAAU,IAAI,QAAQ;CACtB,aAAa,UAAU,OAAO,QAAQ;AACvC;;AAGA,eAAe,OACd,OACA,SACA,QACgB;CAChB,MAAM,qBAAK,IAAI,KAAK;CACpB,MAAM,OAAO;EAAE,MAAM,GAAG,YAAY;EAAG;EAAO,KAAK;EAAS,GAAG;CAAO;CAEtE,CADY,UAAU,UAAU,QAAQ,SAAS,QAAQ,OAAA,CACrD,MAAM,GAAG,KAAK,UAAU,IAAI,EAAE,GAAG;CACrC,KAAK,MAAM,YAAY,WAAW,SAAS,IAAI;CAG/C,IAAI,QAAQ,QAAQ,KAAK,QAAQ,aAAa,SAC7C,IAAI;EACH,eACC,cAAc,UAAU,UAAU,IAAI,KACtC,GAAG,KAAK,UAAU,IAAI,EAAE,GACzB;CACD,QAAQ,CAER;CAGD,MAAM,WAAW,QAAQ,IAAI;CAC7B,IAAI,CAAC,UAAU;CACf,MAAM,UAAkC,EACvC,gBAAgB,mBACjB;CACA,KAAK,MAAM,SAAS,QAAQ,IAAI,8BAA8B,GAAA,CAAI,MACjE,GACD,GAAG;EACF,MAAM,KAAK,KAAK,QAAQ,GAAG;EAC3B,IAAI,KAAK,GACR,QAAQ,mBAAmB,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,KAClD,mBAAmB,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;CAE/C;CACA,MAAM,SAAS,MACd,OAAO,MAAM,WACV,EAAE,aAAa,EAAE,IACjB,OAAO,MAAM,YACZ,EAAE,WAAW,EAAE,IACf,EAAE,aAAa,OAAO,MAAM,WAAW,IAAI,KAAK,UAAU,CAAC,EAAE;CAClE,MAAM,OAAO,KAAK,UAAU,EAC3B,cAAc,CACb;EACC,UAAU,EACT,YAAY,CACX;GACC,KAAK;GACL,OAAO,EACN,aAAa,QAAQ,IAAI,qBAAqB,UAC/C;EACD,CACD,EACD;EACA,WAAW,CACV;GACC,OAAO,EAAE,MAAM,cAAc;GAC7B,YAAY,CACX;IACC,cAAc,GAAG,GAAG,QAAQ,EAAE;IAC9B,cAAc,MAAM,YAAY;IAChC,gBAAgB,UAAU,UAAU,KAAK;IACzC,MAAM,EAAE,aAAa,QAAQ;IAC7B,YAAY,OAAO,QAAQ,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ;KACrD;KACA,OAAO,MAAM,CAAC;IACf,EAAE;GACH,CACD;EACD,CACD;CACD,CACD,EACD,CAAC;CACD,IAAI;EACH,MAAM,MAAM,GAAG,SAAS,QAAQ,QAAQ,EAAE,EAAE,WAAW;GACtD,QAAQ;GACR;GACA;GACA,QAAQ,YAAY,QAAQ,GAAM;EACnC,CAAC;CACF,QAAQ,CAER;AACD;;AAGA,SAAS,KAAK,UAGZ;CACD,MAAM,QAAQ,MACb,WACA;EACC;EAGA;EACA;EACA;EACA;EACA;CACD,GACA,EAAE,OAAO;EAAC;EAAU;EAAQ;CAAM,EAAE,CACrC;CACA,IAAI,SAAS;CACb,MAAM,OAAO,GAAG,SAAS,UAAkB;EAC1C,UAAU,MAAM,SAAS;CAC1B,CAAC;CACD,MAAM,OAAO,WAAW;CACxB,MAAM,OAAO,KAAK,IAAI;CAOtB,OAAO;EAAE,QAAQ;EAAM,MAAA,IANN,SAAe,SAAS,WAAW;GACnD,MAAM,GAAG,SAAS,MAAM;GACxB,MAAM,GAAG,UAAU,SAClB,SAAS,IAAI,QAAQ,IAAI,OAAO,IAAI,WAAW,UAAU,MAAM,MAAM,CAAC,CACvE;EACD,CAC0B;CAAE;AAC7B;AAEA,SAAS,QAAQ,MAAsB;CACtC,MAAM,QAAQ,QAAQ,IAAI;CAC1B,IAAI,CAAC,OAAO,MAAM,IAAI,kBAAkB,MAAM,YAAY;CAC1D,OAAO;AACR;;AAGA,eAAe,SAAY,KAAmC;CAC7D,UAAU,WAAW,EAAE,WAAW,KAAK,CAAC;CACxC,MAAM,OAAO,GAAG,UAAU;CAC1B,SACC,IAAI;EACH,UAAU,IAAI;EACd;CACD,QAAQ;EACP,MAAM,IAAI,SAAS,MAAM,WAAW,GAAG,GAAI,CAAC;CAC7C;CAED,IAAI;EACH,OAAO,MAAM,IAAI;CAClB,UAAU;EACT,UAAU,IAAI;CACf;AACD;;AAGA,eAAsB,WAAW,qBAAW,IAAI,KAAK,GAAqB;CACzE,OAAO,SAAS,YAAY;EAC3B,MAAM,KAAK,YAAY,QAAQ,aAAa,CAAC;EAC7C,MAAM,SAAS,QAAQ,gBAAgB,CAAC,CAAC,QAAQ,QAAQ,EAAE;EAC3D,MAAM,YAAY,KAAK,MACtB,QAAQ,mBAAmB,CAC5B;EAIA,IAAI,YAAY;EAChB,MAAM,cAAc;GACnB,IAAI;IACH,OAAO,aAAa,GAAG,UAAU,eAAe,OAAO;GACxD,QAAQ;IACP;GACD;EACD,EAAA,CAAG;EACH,OAAO,UAAU,SAAS,MAAM,MAAM;GACrC,MAAM,IAAI,SAAS,MAAM,WAAW,GAAG,MAAQ,KAAK,IAAI,IAAI,MAAQ,CAAC,CAAC;GACtE,4BAAY,IAAI,KAAK;EACtB;EACA,cAAc,GAAG,UAAU,eAAe,UAAU,SAAS,CAAC;EAC9D,MAAM,SAAS,GAAG,OAAO,GAAG,UAAU,SAAS;EAC/C,MAAM,UAAU,KAAK,IAAI;EACzB,MAAM,QAAgC,CAAC;EACvC,MAAM,SAAiC,CAAC;EAExC,KAAK,MAAM,YAAY,WAAW;GACjC,MAAM,MAAM,GAAG,OAAO,GAAG,SAAS,KAAK;GACvC,IAAI;IACH,MAAM,EAAE,QAAQ,SAAS,KAAK,SAAS,IAAI;IAG3C,KAAK,YAAY,CAAC,CAAC;IACnB,MAAM,SAAS,QAAQ,MAAM,OAAO,IAAI,KAAK,QAAQ,IAAI;GAC1D,SAAS,OAAO;IACf,OAAO,SAAS,QACf,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GACvD;EACD;EAEA,MAAM,KAAK,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW;EAC1C,MAAM,SAAS;GACd;GACA,WAAW,UAAU,KAAK,MAAM,EAAE,IAAI;GACtC,OAAO;GACP,YAAY,KAAK,IAAI,IAAI;GACzB,GAAI,KAAK,CAAC,IAAI,EAAE,OAAO;EACxB;EACA,IAAI,IAAI;GACP,cAAc,GAAG,UAAU,gBAAgB,OAAO,KAAK,IAAI,CAAC,CAAC;GAC7D,MAAM,OAAO,QAAQ,mBAAmB;IAAE;IAAI,GAAG;GAAO,CAAC;EAC1D,OACC,MAAM,OAAO,SAAS,iBAAiB;GAAE;GAAI,GAAG;EAAO,CAAC;EAEzD,OAAO;CACR,CAAC;AACF;;AAGA,SAAgB,QAAQ,MAAM,KAAK,IAAI,GAAY;CAClD,MAAM,MAAM,OAAO,QAAQ,yBAAyB,CAAC;CACrD,MAAM,QAAQ,SAAiB;EAC9B,IAAI;GACH,OAAO,OAAO,aAAa,GAAG,UAAU,GAAG,QAAQ,OAAO,CAAC;EAC5D,QAAQ;GACP;EACD;CACD;CACA,MAAM,QAAQ,KAAK,cAAc,KAAK,KAAK,SAAS;CACpD,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,OAAO,MAAM,UAAU,IAAI,MAAM,yBAAyB;AAC3D;;AAGA,eAAsB,QAAuB;CAC5C,UAAU,WAAW,EAAE,WAAW,KAAK,CAAC;CACxC,cAAc,GAAG,UAAU,WAAW,OAAO,KAAK,IAAI,CAAC,CAAC;CACxD,MAAM,WAAW,KAAK,MAAM,QAAQ,kBAAkB,CAAC;CACvD,IAAI,WAAW;CACf,KAAK,MAAM,UAAU,CAAC,WAAW,QAAQ,GACxC,QAAQ,KAAK,cAAc;EAC1B,WAAW;EACX,QAAQ,KAAK,CAAC;CACf,CAAC;CAEF,MAAM,OAAO,QAAQ,qBAAqB,EACzC,MAAM,QAAQ,0BAAU,IAAI,KAAK,CAAC,CAAC,EAAE,YAAY,KAAK,KACvD,CAAC;CACD,OAAO,CAAC,UAAU;EACjB,MAAM,OAAO,QAAQ,0BAAU,IAAI,KAAK,CAAC;EACzC,IAAI,CAAC,MAAM;EAEX,OAAO,KAAK,IAAI,IAAI,KAAK,QAAQ,GAChC,MAAM,IAAI,SAAS,MAClB,WAAW,GAAG,KAAK,IAAI,KAAK,QAAQ,IAAI,KAAK,IAAI,GAAG,IAAS,CAAC,CAC/D;EAED,MAAM,WAAW,IAAI,CAAC,CAAC,OAAO,UAC7B,OAAO,SAAS,iBAAiB;GAChC,IAAI;GACJ,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAC7D,CAAC,CACF;CACD;AACD;;AAGA,eAAsB,KAAK,SAA8C;CACxE,IAAI,YAAY,SAAS;EACxB,MAAM,MAAM;EACZ,OAAO;CACR;CACA,IAAI,YAAY,OAAO,OAAQ,MAAM,WAAW,IAAK,IAAI;CACzD,IAAI,YAAY,UAAU,OAAO,QAAQ,IAAI,IAAI;CACjD,MAAM,OAAO,SAAS,0CAA0C,EAC/D,SAAS,WAAW,KACrB,CAAC;CACD,OAAO;AACR;AAGA,IACC,QAAQ,KAAK,MACb,mCAAmC,KAAK,QAAQ,KAAK,EAAE,GAEvD,KAAK,QAAQ,KAAK,EAAE,CAAC,CAAC,MACpB,SAAS,QAAQ,KAAK,IAAI,GAC3B,OAAO,UAAmB;CACzB,MAAM,OAAO,SAAS,iBAAiB;EACtC,IAAI;EACJ,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;CAC7D,CAAC;CACD,QAAQ,KAAK,CAAC;AACf,CACD"}