@musnows/scriverse 0.6.8 → 0.6.10

package/dist/s3-backup.js

@@ -0,0 +1,654 @@
+import { randomUUID } from "node:crypto";
+import { DeleteObjectsCommand, HeadObjectCommand, ListObjectsV2Command, PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
+import { PLATFORM_AI_WORK_ID } from "./database.js";
+import { AppError } from "./errors.js";
+import { logger, sanitizeError } from "./logger.js";
+const sensitiveResponseKey = /(?:authorization|credential|accesskey|secret|securitytoken|set-cookie)/iu;
+function redactedString(value, secrets) {
+    let result = value;
+    for (const secret of secrets) {
+        if (secret)
+            result = result.replaceAll(secret, "[REDACTED]");
+    }
+    return result.slice(0, 20_000);
+}
+function serializableValue(value, secrets, key = "", depth = 0, seen = new WeakSet()) {
+    if (sensitiveResponseKey.test(key))
+        return "[REDACTED]";
+    if (value === null || value === undefined || typeof value === "number" || typeof value === "boolean")
+        return value;
+    if (typeof value === "string")
+        return redactedString(value, secrets);
+    if (typeof value === "bigint")
+        return value.toString();
+    if (value instanceof Date)
+        return value.toISOString();
+    if (Buffer.isBuffer(value))
+        return { byteLength: value.byteLength };
+    if (typeof value !== "object")
+        return String(value);
+    if (seen.has(value))
+        return "[CIRCULAR]";
+    if (depth >= 6)
+        return "[TRUNCATED]";
+    seen.add(value);
+    if (Array.isArray(value))
+        return value.slice(0, 1_000).map((item) => serializableValue(item, secrets, "", depth + 1, seen));
+    return Object.fromEntries(Object.entries(value)
+        .filter(([entryKey]) => entryKey !== "$response" && entryKey !== "stack")
+        .slice(0, 1_000)
+        .map(([entryKey, entryValue]) => [entryKey, serializableValue(entryValue, secrets, entryKey, depth + 1, seen)]));
+}
+export function s3FailureServerResponse(error, secrets = []) {
+    const result = error instanceof Error
+        ? { name: error.name, message: redactedString(error.message, secrets) }
+        : { message: redactedString(String(error), secrets) };
+    if (!error || typeof error !== "object")
+        return result;
+    const record = error;
+    for (const [key, value] of Object.entries(record)) {
+        if (key === "$response" || key === "stack")
+            continue;
+        result[key] = serializableValue(value, secrets, key);
+    }
+    const response = record.$response;
+    if (response && typeof response === "object") {
+        const responseRecord = response;
+        result.httpResponse = {
+            statusCode: serializableValue(responseRecord.statusCode, secrets, "statusCode"),
+            statusMessage: serializableValue(responseRecord.statusMessage, secrets, "statusMessage"),
+            headers: serializableValue(responseRecord.headers, secrets, "headers")
+        };
+    }
+    return result;
+}
+class AwsS3ObjectClient {
+    client;
+    constructor(connection) {
+        this.client = new S3Client({
+            endpoint: connection.endpoint,
+            region: connection.region,
+            credentials: {
+                accessKeyId: connection.accessKeyId,
+                secretAccessKey: connection.secretAccessKey
+            },
+            forcePathStyle: connection.forcePathStyle,
+            maxAttempts: 3,
+            requestChecksumCalculation: "WHEN_REQUIRED",
+            responseChecksumValidation: "WHEN_REQUIRED"
+        });
+    }
+    async objectExists(bucket, key) {
+        try {
+            await this.client.send(new HeadObjectCommand({ Bucket: bucket, Key: key }));
+            return true;
+        }
+        catch (error) {
+            const candidate = error;
+            if (candidate.$metadata?.httpStatusCode === 404 || candidate.name === "NotFound" || candidate.name === "NoSuchKey")
+                return false;
+            throw error;
+        }
+    }
+    async putObject(input) {
+        await this.client.send(new PutObjectCommand({
+            Bucket: input.bucket,
+            Key: input.key,
+            Body: input.body,
+            ContentLength: input.body.byteLength,
+            ContentType: input.contentType,
+            Metadata: input.metadata
+        }));
+    }
+    async listObjects(bucket, prefix) {
+        const objects = [];
+        let continuationToken;
+        do {
+            const page = await this.client.send(new ListObjectsV2Command({
+                Bucket: bucket,
+                Prefix: prefix,
+                ContinuationToken: continuationToken
+            }));
+            for (const item of page.Contents ?? []) {
+                if (!item.Key)
+                    continue;
+                objects.push({ key: item.Key, lastModified: item.LastModified ?? null });
+            }
+            continuationToken = page.IsTruncated ? page.NextContinuationToken : undefined;
+        } while (continuationToken);
+        return objects;
+    }
+    async deleteObjects(bucket, keys) {
+        for (let offset = 0; offset < keys.length; offset += 1_000) {
+            const batch = keys.slice(offset, offset + 1_000);
+            if (!batch.length)
+                continue;
+            const result = await this.client.send(new DeleteObjectsCommand({
+                Bucket: bucket,
+                Delete: { Objects: batch.map((Key) => ({ Key })), Quiet: true }
+            }));
+            if (result.Errors?.length) {
+                throw new AppError(502, "S3_DELETE_OBJECTS_FAILED", "S3 服务未能删除部分过期数据库备份", {
+                    errors: result.Errors.map((item) => ({ key: item.Key, code: item.Code, message: item.Message }))
+                });
+            }
+        }
+    }
+    close() {
+        this.client.destroy();
+    }
+}
+function requiredString(row, key) {
+    const value = row[key];
+    if (typeof value !== "string")
+        throw new AppError(500, "BACKUP_TARGET_INVALID", `S3 备份配置字段 ${key} 无效`);
+    return value;
+}
+function nullableString(row, key) {
+    const value = row[key];
+    return typeof value === "string" ? value : null;
+}
+function encryptedSecret(row, prefix) {
+    return {
+        encrypted: requiredString(row, `${prefix}_encrypted`),
+        iv: requiredString(row, `${prefix}_iv`),
+        tag: requiredString(row, `${prefix}_tag`)
+    };
+}
+export function normalizeS3BasePath(value = "") {
+    return value.trim().replace(/^\/+|\/+$/gu, "").replace(/\/{2,}/gu, "/");
+}
+export function s3BackupRootPrefix(basePath = "") {
+    const normalized = normalizeS3BasePath(basePath);
+    return normalized ? `${normalized}/scriverse` : "scriverse";
+}
+function normalizedEndpoint(value) {
+    const url = new URL(value);
+    url.pathname = url.pathname.replace(/\/+$/gu, "") || "/";
+    return url.toString().replace(/\/$/u, "");
+}
+export class S3BackupManager {
+    database;
+    vault;
+    store;
+    attachmentStorage;
+    clientFactory;
+    snapshotDatabase;
+    masterKey;
+    requestTimeoutMs;
+    validateEndpoint;
+    now;
+    log;
+    queuedTargetIds = new Set();
+    executionChain = Promise.resolve();
+    schedulerTimer = null;
+    disposed = false;
+    constructor(database, vault, store, attachmentStorage, options = {}) {
+        this.database = database;
+        this.vault = vault;
+        this.store = store;
+        this.attachmentStorage = attachmentStorage;
+        this.clientFactory = options.clientFactory ?? ((connection) => new AwsS3ObjectClient(connection));
+        this.snapshotDatabase = options.snapshotDatabase ?? (() => this.database.createSnapshotBuffer());
+        this.masterKey = options.masterKey === undefined
+            ? null
+            : Buffer.isBuffer(options.masterKey) ? Buffer.from(options.masterKey) : Buffer.from(options.masterKey, "utf8");
+        const requestTimeoutMs = Number(options.requestTimeoutMs ?? 30_000);
+        this.requestTimeoutMs = Number.isFinite(requestTimeoutMs) && requestTimeoutMs > 0 ? requestTimeoutMs : 30_000;
+        this.validateEndpoint = options.validateEndpoint;
+        this.now = options.now ?? (() => new Date());
+        this.log = options.logger ?? logger;
+    }
+    listTargets() {
+        return this.database.all("SELECT * FROM s3_backup_targets ORDER BY sort_order, created_at, id").map((row) => this.mapTarget(row));
+    }
+    getTarget(targetId) {
+        return this.mapTarget(this.requireTargetRow(targetId));
+    }
+    createTarget(input) {
+        const targetId = randomUUID();
+        const timestamp = this.now().toISOString();
+        const accessKey = this.vault.encrypt(input.accessKeyId);
+        const secretKey = this.vault.encrypt(input.secretAccessKey);
+        this.database.transaction(() => {
+            const sortOrder = Number(this.database.get("SELECT COALESCE(MAX(sort_order), -1) + 1 AS value FROM s3_backup_targets")?.value ?? 0);
+            this.database.run(`INSERT INTO s3_backup_targets (
+          id, name, endpoint, region, bucket, base_path,
+          access_key_encrypted, access_key_iv, access_key_tag,
+          secret_key_encrypted, secret_key_iv, secret_key_tag,
+          force_path_style, enabled, backup_images, schedule_time, retention_count, sort_order,
+          created_at, updated_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, targetId, input.name.trim(), normalizedEndpoint(input.endpoint), input.region?.trim() || "us-east-1", input.bucket.trim(), normalizeS3BasePath(input.basePath), accessKey.encrypted, accessKey.iv, accessKey.tag, secretKey.encrypted, secretKey.iv, secretKey.tag, input.forcePathStyle === false ? 0 : 1, input.enabled === true ? 1 : 0, input.backupImages === false ? 0 : 1, input.scheduleTime ?? "03:00", input.retentionCount ?? 7, sortOrder, timestamp, timestamp);
+            this.store.audit(PLATFORM_AI_WORK_ID, "platform.backup-target.created", "s3-backup-target", targetId, {
+                ...this.sanitizedInput(input),
+                rootPrefix: s3BackupRootPrefix(input.basePath)
+            });
+        });
+        return this.getTarget(targetId);
+    }
+    updateTarget(targetId, input) {
+        const current = this.requireTargetRow(targetId);
+        const accessKey = input.accessKeyId === undefined ? encryptedSecret(current, "access_key") : this.vault.encrypt(input.accessKeyId);
+        const secretKey = input.secretAccessKey === undefined ? encryptedSecret(current, "secret_key") : this.vault.encrypt(input.secretAccessKey);
+        const timestamp = this.now().toISOString();
+        this.database.transaction(() => {
+            this.database.run(`UPDATE s3_backup_targets SET
+          name = ?, endpoint = ?, region = ?, bucket = ?, base_path = ?,
+          access_key_encrypted = ?, access_key_iv = ?, access_key_tag = ?,
+          secret_key_encrypted = ?, secret_key_iv = ?, secret_key_tag = ?,
+          force_path_style = ?, enabled = ?, backup_images = ?, schedule_time = ?, retention_count = ?, updated_at = ?
+         WHERE id = ?`, input.name?.trim() ?? requiredString(current, "name"), input.endpoint === undefined ? requiredString(current, "endpoint") : normalizedEndpoint(input.endpoint), input.region?.trim() ?? requiredString(current, "region"), input.bucket?.trim() ?? requiredString(current, "bucket"), input.basePath === undefined ? requiredString(current, "base_path") : normalizeS3BasePath(input.basePath), accessKey.encrypted, accessKey.iv, accessKey.tag, secretKey.encrypted, secretKey.iv, secretKey.tag, input.forcePathStyle === undefined ? Number(current.force_path_style) : input.forcePathStyle ? 1 : 0, input.enabled === undefined ? Number(current.enabled) : input.enabled ? 1 : 0, input.backupImages === undefined ? Number(current.backup_images) : input.backupImages ? 1 : 0, input.scheduleTime ?? requiredString(current, "schedule_time"), input.retentionCount ?? Number(current.retention_count), timestamp, targetId);
+            this.store.audit(PLATFORM_AI_WORK_ID, "platform.backup-target.updated", "s3-backup-target", targetId, {
+                fields: Object.keys(input).filter((key) => key !== "accessKeyId" && key !== "secretAccessKey"),
+                credentialsUpdated: input.accessKeyId !== undefined || input.secretAccessKey !== undefined
+            });
+        });
+        return this.getTarget(targetId);
+    }
+    deleteTarget(targetId) {
+        const current = this.requireTargetRow(targetId);
+        this.database.transaction(() => {
+            this.database.run("DELETE FROM s3_backup_targets WHERE id = ?", targetId);
+            this.store.audit(PLATFORM_AI_WORK_ID, "platform.backup-target.deleted", "s3-backup-target", targetId, {
+                name: requiredString(current, "name"),
+                endpoint: requiredString(current, "endpoint"),
+                bucket: requiredString(current, "bucket"),
+                basePath: requiredString(current, "base_path")
+            });
+        });
+    }
+    getRun(runId) {
+        const row = this.database.get("SELECT rowid AS sequence, * FROM s3_backup_runs WHERE id = ?", runId);
+        if (!row)
+            throw new AppError(404, "BACKUP_RUN_NOT_FOUND", "S3 备份记录不存在");
+        return this.mapRun(row);
+    }
+    listRuns(options = {}) {
+        const limit = Math.min(100, Math.max(1, options.limit ?? 30));
+        const rows = options.afterSequence === undefined
+            ? this.database.all("SELECT rowid AS sequence, * FROM s3_backup_runs ORDER BY rowid DESC LIMIT ?", limit)
+            : this.database.all("SELECT rowid AS sequence, * FROM s3_backup_runs WHERE rowid > ? ORDER BY rowid LIMIT ?", options.afterSequence, limit);
+        const latestSequence = Number(this.database.get("SELECT COALESCE(MAX(rowid), 0) AS value FROM s3_backup_runs")?.value ?? 0);
+        return { items: rows.map((row) => this.mapRun(row)), latestSequence };
+    }
+    enabledTargetIds() {
+        return this.database.all("SELECT id FROM s3_backup_targets WHERE enabled = 1 ORDER BY sort_order, created_at, id").map((row) => String(row.id));
+    }
+    enqueueTargets(targetIds, trigger) {
+        if (this.disposed)
+            throw new AppError(503, "BACKUP_MANAGER_STOPPED", "S3 备份服务正在停止");
+        const uniqueIds = [...new Set(targetIds)];
+        const targetRows = uniqueIds.map((targetId) => this.requireTargetRow(targetId));
+        const disabledTargetIds = trigger === "manual"
+            ? targetRows.filter((row) => Number(row.enabled) !== 1).map((row) => requiredString(row, "id"))
+            : [];
+        if (disabledTargetIds.length > 0) {
+            throw new AppError(400, "BACKUP_TARGET_DISABLED", "停用的 S3 备份目标不能手动执行", { targetIds: disabledTargetIds });
+        }
+        const acceptedTargetIds = uniqueIds.filter((targetId) => !this.queuedTargetIds.has(targetId));
+        const skippedTargetIds = uniqueIds.filter((targetId) => this.queuedTargetIds.has(targetId));
+        for (const targetId of acceptedTargetIds)
+            this.queuedTargetIds.add(targetId);
+        if (acceptedTargetIds.length) {
+            const execute = async () => {
+                for (const targetId of acceptedTargetIds) {
+                    try {
+                        if (!this.disposed)
+                            await this.runTarget(targetId, trigger);
+                    }
+                    catch (error) {
+                        this.log.error("backup.queue.target_failed", { targetId, trigger, error: sanitizeError(error) });
+                    }
+                    finally {
+                        this.queuedTargetIds.delete(targetId);
+                    }
+                }
+            };
+            this.executionChain = this.executionChain.then(execute, execute).catch((error) => {
+                this.log.error("backup.queue.failed", { trigger, error: sanitizeError(error) });
+            });
+        }
+        return { acceptedTargetIds, skippedTargetIds };
+    }
+    enqueueEnabledTargets(trigger) {
+        return this.enqueueTargets(this.enabledTargetIds(), trigger);
+    }
+    enqueueDueTargets(value = this.now()) {
+        const currentTime = `${String(value.getHours()).padStart(2, "0")}:${String(value.getMinutes()).padStart(2, "0")}`;
+        const dateKey = this.localDateKey(value);
+        const dueTargetIds = this.database.all(`SELECT target.id, target.schedule_time,
+        (SELECT run.started_at FROM s3_backup_runs run
+         WHERE run.target_id = target.id AND run.trigger = 'scheduled'
+         ORDER BY run.rowid DESC LIMIT 1) AS last_scheduled_at
+       FROM s3_backup_targets target
+       WHERE target.enabled = 1
+       ORDER BY target.sort_order, target.created_at, target.id`).filter((row) => {
+            if (requiredString(row, "schedule_time") > currentTime)
+                return false;
+            const lastScheduledAt = nullableString(row, "last_scheduled_at");
+            return !lastScheduledAt || this.localDateKey(new Date(lastScheduledAt)) !== dateKey;
+        }).map((row) => requiredString(row, "id"));
+        return this.enqueueTargets(dueTargetIds, "scheduled");
+    }
+    startScheduler() {
+        if (this.schedulerTimer || this.disposed)
+            return;
+        const poll = () => {
+            try {
+                this.enqueueDueTargets();
+            }
+            catch (error) {
+                this.log.error("backup.scheduler.poll_failed", { error: sanitizeError(error) });
+            }
+        };
+        poll();
+        this.schedulerTimer = setInterval(poll, 30_000);
+        this.schedulerTimer.unref();
+    }
+    async waitForIdle() {
+        await this.executionChain;
+    }
+    dispose() {
+        this.disposed = true;
+        if (this.schedulerTimer)
+            clearInterval(this.schedulerTimer);
+        this.schedulerTimer = null;
+    }
+    async runEnabledTargets(trigger) {
+        const targetIds = this.database.all("SELECT id FROM s3_backup_targets WHERE enabled = 1 ORDER BY sort_order, created_at, id").map((row) => String(row.id));
+        const runs = [];
+        for (const targetId of targetIds)
+            runs.push(await this.runTarget(targetId, trigger));
+        return runs;
+    }
+    async runTarget(targetId, trigger) {
+        const targetRow = this.requireTargetRow(targetId);
+        const target = this.runtimeTarget(targetRow);
+        const runId = randomUUID();
+        const started = this.now();
+        const startedAt = started.toISOString();
+        this.database.transaction(() => {
+            this.database.run(`INSERT INTO s3_backup_runs (id, target_id, target_name, trigger, status, started_at)
+         VALUES (?, ?, ?, ?, 'running', ?)`, runId, target.id, target.name, trigger, startedAt);
+            this.database.run("UPDATE s3_backup_targets SET last_started_at = ?, last_error = NULL, updated_at = ? WHERE id = ?", startedAt, startedAt, target.id);
+        });
+        let client = null;
+        let databaseKey = null;
+        let imagesUploaded = 0;
+        let imagesSkipped = 0;
+        let databasesDeleted = 0;
+        try {
+            await this.validateEndpoint?.(target.endpoint);
+            client = this.clientFactory({
+                endpoint: target.endpoint,
+                region: target.region,
+                accessKeyId: target.accessKeyId,
+                secretAccessKey: target.secretAccessKey,
+                forcePathStyle: target.forcePathStyle
+            });
+            const databaseSnapshot = await this.snapshotDatabase();
+            databaseKey = `${target.rootPrefix}/db/scriverse-${this.snapshotTimestamp(started)}-${runId.replaceAll("-", "").slice(0, 8)}.db`;
+            if (!this.masterKey)
+                throw new AppError(500, "BACKUP_MASTER_KEY_UNAVAILABLE", "S3 备份缺少 CredentialVault 恢复密钥");
+            await this.withRequestTimeout(client.putObject({
+                bucket: target.bucket,
+                key: `${target.rootPrefix}/master.key`,
+                body: this.masterKey,
+                contentType: "application/octet-stream"
+            }), "上传 CredentialVault 恢复密钥");
+            await this.withRequestTimeout(client.putObject({
+                bucket: target.bucket,
+                key: databaseKey,
+                body: databaseSnapshot,
+                contentType: "application/vnd.sqlite3"
+            }), "上传数据库快照");
+            if (target.backupImages) {
+                for (const source of this.backupImageSources(target.rootPrefix)) {
+                    if (await this.withRequestTimeout(client.objectExists(target.bucket, source.objectKey), "检查远端图片")) {
+                        imagesSkipped += 1;
+                        continue;
+                    }
+                    const body = await source.read();
+                    await this.withRequestTimeout(client.putObject({
+                        bucket: target.bucket,
+                        key: source.objectKey,
+                        body,
+                        contentType: source.contentType,
+                        metadata: { sha256: source.sha256 }
+                    }), "上传图片");
+                    imagesUploaded += 1;
+                }
+            }
+            databasesDeleted = await this.enforceDatabaseRetention(client, target);
+            const finishedAt = this.now().toISOString();
+            this.database.transaction(() => {
+                this.database.run(`UPDATE s3_backup_runs SET status = 'succeeded', database_key = ?, images_uploaded = ?, images_skipped = ?,
+           databases_deleted = ?, finished_at = ? WHERE id = ?`, databaseKey, imagesUploaded, imagesSkipped, databasesDeleted, finishedAt, runId);
+                this.database.run("UPDATE s3_backup_targets SET last_success_at = ?, last_error = NULL, updated_at = ? WHERE id = ?", finishedAt, finishedAt, target.id);
+                this.store.audit(PLATFORM_AI_WORK_ID, "platform.backup.succeeded", "s3-backup-target", target.id, {
+                    runId,
+                    trigger,
+                    databaseKey,
+                    imagesUploaded,
+                    imagesSkipped,
+                    databasesDeleted
+                });
+            });
+            this.log.info("backup.s3_target.succeeded", {
+                target: this.targetForLog(target),
+                runId,
+                trigger,
+                databaseKey,
+                imagesUploaded,
+                imagesSkipped,
+                databasesDeleted
+            });
+        }
+        catch (error) {
+            const serverResponse = s3FailureServerResponse(error, [target.accessKeyId, target.secretAccessKey]);
+            const errorMessage = typeof serverResponse.message === "string" ? serverResponse.message : "S3 备份失败";
+            const finishedAt = this.now().toISOString();
+            this.database.transaction(() => {
+                this.database.run(`UPDATE s3_backup_runs SET status = 'failed', database_key = ?, images_uploaded = ?, images_skipped = ?,
+           databases_deleted = ?, error_message = ?, server_response_json = ?, finished_at = ? WHERE id = ?`, databaseKey, imagesUploaded, imagesSkipped, databasesDeleted, errorMessage, JSON.stringify(serverResponse), finishedAt, runId);
+                this.database.run("UPDATE s3_backup_targets SET last_failure_at = ?, last_error = ?, updated_at = ? WHERE id = ?", finishedAt, errorMessage, finishedAt, target.id);
+                this.store.audit(PLATFORM_AI_WORK_ID, "platform.backup.failed", "s3-backup-target", target.id, {
+                    runId,
+                    trigger,
+                    databaseKey,
+                    errorMessage
+                });
+            });
+            this.log.error("backup.s3_target.failed", {
+                target: this.targetForLog(target),
+                runId,
+                trigger,
+                databaseKey,
+                error: sanitizeError(new Error(errorMessage)),
+                serverResponse
+            });
+        }
+        finally {
+            try {
+                client?.close();
+            }
+            catch (error) {
+                this.log.warn("backup.s3_client.close_failed", {
+                    target: this.targetForLog(target),
+                    runId,
+                    error: sanitizeError(error)
+                });
+            }
+        }
+        return this.getRun(runId);
+    }
+    requireTargetRow(targetId) {
+        const row = this.database.get("SELECT * FROM s3_backup_targets WHERE id = ?", targetId);
+        if (!row)
+            throw new AppError(404, "BACKUP_TARGET_NOT_FOUND", "S3 备份目标不存在");
+        return row;
+    }
+    runtimeTarget(row) {
+        return {
+            ...this.mapTarget(row),
+            accessKeyId: this.vault.decrypt(encryptedSecret(row, "access_key")),
+            secretAccessKey: this.vault.decrypt(encryptedSecret(row, "secret_key"))
+        };
+    }
+    mapRun(row) {
+        let serverResponse = null;
+        const responseJson = nullableString(row, "server_response_json");
+        if (responseJson) {
+            try {
+                const parsed = JSON.parse(responseJson);
+                if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+                    serverResponse = parsed;
+            }
+            catch {
+                serverResponse = { message: "S3 服务返回结果无法解析" };
+            }
+        }
+        const status = requiredString(row, "status");
+        const trigger = requiredString(row, "trigger");
+        if (status !== "running" && status !== "succeeded" && status !== "failed") {
+            throw new AppError(500, "BACKUP_RUN_INVALID", "S3 备份记录状态无效");
+        }
+        if (trigger !== "manual" && trigger !== "scheduled") {
+            throw new AppError(500, "BACKUP_RUN_INVALID", "S3 备份触发类型无效");
+        }
+        return {
+            sequence: Number(row.sequence),
+            id: requiredString(row, "id"),
+            targetId: nullableString(row, "target_id"),
+            targetName: requiredString(row, "target_name"),
+            trigger,
+            status,
+            databaseKey: nullableString(row, "database_key"),
+            imagesUploaded: Number(row.images_uploaded),
+            imagesSkipped: Number(row.images_skipped),
+            databasesDeleted: Number(row.databases_deleted),
+            errorMessage: nullableString(row, "error_message"),
+            serverResponse,
+            startedAt: requiredString(row, "started_at"),
+            finishedAt: nullableString(row, "finished_at")
+        };
+    }
+    backupImageSources(rootPrefix) {
+        const sources = new Map();
+        const addDatabaseImages = (table) => {
+            for (const row of this.database.all(`SELECT mime_type, content, sha256 FROM ${table} ORDER BY sha256`)) {
+                const contentType = requiredString(row, "mime_type");
+                const sha256 = requiredString(row, "sha256");
+                const content = Buffer.from(row.content);
+                const objectKey = `${rootPrefix}/img/${sha256.slice(0, 2)}/${sha256}.${this.imageExtension(contentType)}`;
+                sources.set(objectKey, { objectKey, contentType, sha256, read: async () => content });
+            }
+        };
+        addDatabaseImages("work_covers");
+        addDatabaseImages("user_avatars");
+        for (const row of this.database.all("SELECT DISTINCT storage_key, stored_mime_type, stored_sha256 FROM attachments ORDER BY storage_key")) {
+            const storageKey = requiredString(row, "storage_key");
+            const contentType = requiredString(row, "stored_mime_type");
+            const sha256 = requiredString(row, "stored_sha256");
+            const objectKey = `${rootPrefix}/img/${storageKey}`;
+            if (!sources.has(objectKey)) {
+                sources.set(objectKey, {
+                    objectKey,
+                    contentType,
+                    sha256,
+                    read: () => this.attachmentStorage.read(storageKey)
+                });
+            }
+        }
+        return [...sources.values()];
+    }
+    async enforceDatabaseRetention(client, target) {
+        const prefix = `${target.rootPrefix}/db/`;
+        const snapshotNamePattern = /^scriverse-\d{8}T\d{9}Z-[0-9a-f]{8}\.db$/u;
+        const backups = (await this.withRequestTimeout(client.listObjects(target.bucket, prefix), "列出数据库快照"))
+            .filter((item) => item.key.startsWith(prefix) && snapshotNamePattern.test(item.key.slice(prefix.length)))
+            .sort((left, right) => {
+            const timestampDelta = (left.lastModified?.getTime() ?? 0) - (right.lastModified?.getTime() ?? 0);
+            return timestampDelta || left.key.localeCompare(right.key, "en");
+        });
+        const excessCount = Math.max(0, backups.length - target.retentionCount);
+        const keys = backups.slice(0, excessCount).map((item) => item.key);
+        if (keys.length)
+            await this.withRequestTimeout(client.deleteObjects(target.bucket, keys), "清理过期数据库快照");
+        return keys.length;
+    }
+    async withRequestTimeout(operation, action) {
+        let timer = null;
+        const timeout = new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new AppError(504, "S3_REQUEST_TIMEOUT", `${action}超时`)), this.requestTimeoutMs);
+        });
+        try {
+            return await Promise.race([operation, timeout]);
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
+    imageExtension(contentType) {
+        if (contentType === "image/jpeg")
+            return "jpg";
+        if (contentType === "image/png")
+            return "png";
+        if (contentType === "image/webp")
+            return "webp";
+        if (contentType === "image/gif")
+            return "gif";
+        throw new AppError(500, "BACKUP_IMAGE_TYPE_INVALID", "待备份图片的类型无效");
+    }
+    snapshotTimestamp(value) {
+        return value.toISOString().replace(/[-:.]/gu, "");
+    }
+    localDateKey(value) {
+        return `${value.getFullYear()}-${String(value.getMonth() + 1).padStart(2, "0")}-${String(value.getDate()).padStart(2, "0")}`;
+    }
+    targetForLog(target) {
+        const { accessKeyId: _accessKeyId, secretAccessKey: _secretAccessKey, ...safeTarget } = target;
+        return safeTarget;
+    }
+    mapTarget(row) {
+        const basePath = requiredString(row, "base_path");
+        return {
+            id: requiredString(row, "id"),
+            name: requiredString(row, "name"),
+            endpoint: requiredString(row, "endpoint"),
+            region: requiredString(row, "region"),
+            bucket: requiredString(row, "bucket"),
+            basePath,
+            rootPrefix: s3BackupRootPrefix(basePath),
+            forcePathStyle: Number(row.force_path_style) === 1,
+            enabled: Number(row.enabled) === 1,
+            backupImages: Number(row.backup_images) === 1,
+            scheduleTime: requiredString(row, "schedule_time"),
+            retentionCount: Number(row.retention_count),
+            sortOrder: Number(row.sort_order),
+            credentialsConfigured: true,
+            lastStartedAt: nullableString(row, "last_started_at"),
+            lastSuccessAt: nullableString(row, "last_success_at"),
+            lastFailureAt: nullableString(row, "last_failure_at"),
+            lastError: nullableString(row, "last_error"),
+            createdAt: requiredString(row, "created_at"),
+            updatedAt: requiredString(row, "updated_at")
+        };
+    }
+    sanitizedInput(input) {
+        return {
+            name: input.name.trim(),
+            endpoint: normalizedEndpoint(input.endpoint),
+            region: input.region?.trim() || "us-east-1",
+            bucket: input.bucket.trim(),
+            basePath: normalizeS3BasePath(input.basePath),
+            forcePathStyle: input.forcePathStyle !== false,
+            enabled: input.enabled === true,
+            backupImages: input.backupImages !== false,
+            scheduleTime: input.scheduleTime ?? "03:00",
+            retentionCount: input.retentionCount ?? 7
+        };
+    }
+}
+//# sourceMappingURL=s3-backup.js.map