@rebasepro/server 0.22.0 → 0.24.0

package/dist/backup-CN0s50D2.js

@@ -0,0 +1,444 @@
+import { createRequire as __rebaseCreateRequire } from "module";
+import __rebaseProcess from "process";
+globalThis.process ??= __rebaseProcess;
+__rebaseCreateRequire(import.meta.url);
+import { n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
+import "./src-CatHFUym.js";
+import { a as parseEnvBoolean, r as isAlreadyExecutingSkip } from "./cron-scheduler-CYQgco86.js";
+import { r as logger } from "./logger-D-S-hO5e.js";
+import { r as errorHandler, t as ApiError } from "./errors-D6_y86c5.js";
+import { t as S3StorageController } from "./S3StorageController-CAwFRgjV.js";
+import { t as GCSStorageController } from "./GCSStorageController-BSiP1c-f.js";
+import fs from "fs";
+import path from "path";
+import { Hono } from "hono";
+//#region src/backup/backup-common.ts
+/**
+* Storage-generic backup helpers used by the admin backup routes.
+*
+* These live in server (which owns {@link StorageController}) so the
+* admin API can list backups without depending on the Postgres driver —
+* `server` must not import from `server-postgres`. The `pg_dump`-side
+* copies of the tiny pure parsers live in `@rebasepro/server-postgres`;
+* keep the two in sync if the naming scheme ever changes.
+*/
+/** Parse a destination string (`s3://…`, `gs://…`, or a local path). */
+function parseBackupDestination(out) {
+	const s3 = out.match(/^s3:\/\/([^/]+)\/?(.*)$/);
+	if (s3) return {
+		kind: "s3",
+		bucket: s3[1],
+		prefix: s3[2].replace(/\/+$/, "")
+	};
+	const gcs = out.match(/^gs:\/\/([^/]+)\/?(.*)$/);
+	if (gcs) return {
+		kind: "gcs",
+		bucket: gcs[1],
+		prefix: gcs[2].replace(/\/+$/, "")
+	};
+	return {
+		kind: "local",
+		path: out
+	};
+}
+/**
+* Recover the UTC creation time encoded in a `rebase-<db>-<ts>.dump` name.
+* Returns `null` for names that don't match, so foreign objects are ignored.
+*/
+function parseBackupTimestamp(fileName) {
+	const match = (fileName.split("/").pop() ?? fileName).match(/-(\d{8})T(\d{6})Z\.dump$/);
+	if (!match) return null;
+	const [, ymd, hms] = match;
+	const iso = `${ymd.slice(0, 4)}-${ymd.slice(4, 6)}-${ymd.slice(6, 8)}T${hms.slice(0, 2)}:${hms.slice(2, 4)}:${hms.slice(4, 6)}Z`;
+	const date = new Date(iso);
+	return Number.isNaN(date.getTime()) ? null : date;
+}
+/**
+* A backup is two files: the `.dump`, and beside it a `.globals.sql` holding
+* the cluster roles the dump's GRANTs and RLS policies name. Without that
+* sidecar a restore into a fresh cluster stops at the first GRANT to a role
+* that does not exist there. The CLI uploads, restores and prunes the two as
+* a pair. This listing used to know only the `.dump`, so a backup downloaded
+* from Studio arrived without its roles.
+*
+* The suffix mirrors `globalsFileForDump` in `@rebasepro/server-postgres`.
+*/
+var DUMP_SUFFIX = ".dump";
+var GLOBALS_SUFFIX = ".globals.sql";
+function globalsKeyFor(dumpKey) {
+	return dumpKey.slice(0, -5) + GLOBALS_SUFFIX;
+}
+/** The only files the download route will serve. */
+function isBackupFile(key) {
+	return key.endsWith(DUMP_SUFFIX) || key.endsWith(GLOBALS_SUFFIX);
+}
+/**
+* How many pages of an object-storage listing to read before giving up — at
+* the providers' 1,000 keys a page, 100,000 objects, or 50,000 backups.
+*/
+var MAX_LIST_PAGES = 100;
+/**
+* Every key under a prefix, across pages.
+*
+* S3 and GCS answer a listing a page at a time, in ascending key order, and a
+* backup's key is `rebase-<db>-<UTC timestamp>`. Reading one page therefore
+* returned the OLDEST thousand objects: with retention unset and an hourly
+* schedule, the newest backup the panel and `rebase db backups list` showed
+* stopped advancing after about three weeks, which reads as "backups stopped".
+*/
+async function listAllObjectKeys(storage, prefix, bucket) {
+	const keys = [];
+	let pageToken;
+	for (let page = 0; page < MAX_LIST_PAGES; page++) {
+		const result = await storage.listObjects(prefix, {
+			bucket,
+			maxResults: 1e3,
+			pageToken
+		});
+		for (const item of result.items) keys.push(item.fullPath);
+		pageToken = result.nextPageToken;
+		if (!pageToken) return keys;
+	}
+	logger.warn(`[backups] Stopped listing ${bucket}/${prefix} after ${MAX_LIST_PAGES} pages (${keys.length} objects). Set BACKUP_RETENTION_DAYS so old backups are pruned, or give the backups a prefix of their own.`);
+	return keys;
+}
+/**
+* Whether an object key is one the backup routes may serve: a backup file, at
+* the destination's prefix and nowhere else.
+*
+* The local branch has always been held to the backup directory; this branch
+* checked only the suffix, so any `.dump` in the bucket — `uploads/x.dump`, a
+* neighbouring `nightlyish/` prefix — was readable by naming it. A key is taken
+* as written, so a scheme (`s3://other-bucket/…`, which S3StorageController
+* would follow) or a `.`/`..`/empty segment (which a filesystem-backed or
+* S3-compatible store may resolve) is refused rather than interpreted.
+*/
+function isObjectBackupKey(dest, key) {
+	if (!isBackupFile(key) || /^[a-z][a-z0-9+.-]*:\/\//i.test(key)) return false;
+	if (key.split("/").some((segment) => segment === "" || segment === "." || segment === "..")) return false;
+	return dest.prefix === "" || key.startsWith(`${dest.prefix}/`);
+}
+/**
+* List the backups at a destination as {@link BackupInfo}, newest first.
+* One entry per `.dump`, with its `.globals.sql` sidecar attached as
+* `globalsKey` when there is one.
+*/
+async function listBackupObjects(dest, storage) {
+	if (dest.kind === "local") {
+		if (!fs.existsSync(dest.path)) return [];
+		const dir = fs.statSync(dest.path).isDirectory() ? dest.path : path.dirname(dest.path);
+		if (!fs.existsSync(dir)) return [];
+		const files = fs.readdirSync(dir);
+		const present = new Set(files);
+		return files.filter((f) => f.endsWith(DUMP_SUFFIX)).map((f) => {
+			const full = path.join(dir, f);
+			const st = fs.statSync(full);
+			const createdAt = parseBackupTimestamp(f) ?? st.mtime;
+			const globals = globalsKeyFor(f);
+			return {
+				key: full,
+				name: f,
+				sizeBytes: st.size,
+				createdAt: createdAt.toISOString(),
+				destinationKind: "local",
+				...present.has(globals) ? { globalsKey: path.join(dir, globals) } : {}
+			};
+		}).sort(byNewest);
+	}
+	if (!storage) throw new Error(noControllerFor(dest));
+	const keys = await listAllObjectKeys(storage, dest.prefix ? `${dest.prefix}/` : "", dest.bucket);
+	const present = new Set(keys);
+	return keys.filter((key) => key.endsWith(DUMP_SUFFIX)).map((key) => {
+		const createdAt = parseBackupTimestamp(key);
+		const globals = globalsKeyFor(key);
+		return {
+			key,
+			name: key.split("/").pop() || key,
+			createdAt: createdAt ? createdAt.toISOString() : void 0,
+			destinationKind: dest.kind,
+			...present.has(globals) ? { globalsKey: globals } : {}
+		};
+	}).sort(byNewest);
+}
+function noControllerFor(dest) {
+	return `No storage controller for ${dest.kind === "s3" ? "s3" : "gs"}://${dest.bucket}${dest.prefix ? `/${dest.prefix}` : ""}, so its backups cannot be read.`;
+}
+function byNewest(a, b) {
+	const ta = a.createdAt ? Date.parse(a.createdAt) : 0;
+	return (b.createdAt ? Date.parse(b.createdAt) : 0) - ta;
+}
+/**
+* The absolute path of a local backup file, or `null` for anything the download
+* route must not serve: a path outside the backup directory, a file that is not
+* a backup, or one that does not exist.
+*/
+function resolveLocalBackupFile(dest, key) {
+	const dir = (fs.existsSync(dest.path) ? fs.statSync(dest.path) : null)?.isDirectory() ? dest.path : path.dirname(dest.path);
+	const resolvedDir = path.resolve(dir);
+	const resolved = path.resolve(key);
+	if (!resolved.startsWith(resolvedDir + path.sep) || !isBackupFile(resolved)) return null;
+	return fs.existsSync(resolved) ? resolved : null;
+}
+/** Read a single backup's bytes. Guards against path traversal for local. */
+async function readBackupBytes(dest, key, storage) {
+	if (dest.kind === "local") {
+		const resolved = resolveLocalBackupFile(dest, key);
+		if (!resolved) return null;
+		return {
+			bytes: new Uint8Array(fs.readFileSync(resolved)),
+			name: path.basename(resolved)
+		};
+	}
+	if (!storage) throw new Error(noControllerFor(dest));
+	if (!isObjectBackupKey(dest, key)) return null;
+	const file = await storage.getObject(key, dest.bucket);
+	if (!file) return null;
+	return {
+		bytes: new Uint8Array(await file.arrayBuffer()),
+		name: key.split("/").pop() || key
+	};
+}
+/**
+* A single backup, opened for streaming, with its size. Same guards as
+* {@link readBackupBytes}.
+*
+* What the download route serves. A dump is the size of the database, and
+* reading it whole put all of it on the API process's heap — twice for a local
+* destination (`readFileSync`, then a copy) and on top of the controller's own
+* buffer for object storage — and a file over 2 GiB never downloaded at all:
+* `readFileSync` throws `ERR_FS_FILE_TOO_LARGE` there.
+*
+* A local file is read from disk as the response is written. Object storage
+* still arrives through {@link StorageController.getObject}, which is a
+* buffered `File` by contract; streaming that avoids the second copy.
+*/
+async function openBackupStream(dest, key, storage) {
+	if (dest.kind === "local") {
+		const resolved = resolveLocalBackupFile(dest, key);
+		if (!resolved) return null;
+		const { size } = await fs.promises.stat(resolved);
+		return {
+			stream: fileStream(resolved),
+			size,
+			name: path.basename(resolved)
+		};
+	}
+	if (!storage) throw new Error(noControllerFor(dest));
+	if (!isObjectBackupKey(dest, key)) return null;
+	const file = await storage.getObject(key, dest.bucket);
+	if (!file) return null;
+	return {
+		stream: file.stream(),
+		size: file.size,
+		name: key.split("/").pop() || key
+	};
+}
+/** A file on disk as a web stream, read a chunk at a time as the response is written. */
+function fileStream(filePath) {
+	const file = fs.createReadStream(filePath);
+	const chunks = file[Symbol.asyncIterator]();
+	return new ReadableStream({
+		async pull(controller) {
+			const next = await chunks.next();
+			if (next.done) controller.close();
+			else controller.enqueue(next.value);
+		},
+		cancel() {
+			file.destroy();
+		}
+	});
+}
+//#endregion
+//#region src/backup/backup-storage.ts
+/**
+* The storage controller that reads a backup bucket.
+*
+* A backup destination is its own bucket, named by `BACKUP_DESTINATION`, and
+* the documented backup cron writes to it through a controller it builds from
+* the `S3_*` variables (GCS: application default credentials) — as
+* `rebase db backups list` does. The admin routes have to read it the same way.
+* The app's file storage is not that controller: it is configured for the
+* uploads bucket, it is a local directory in development, and in production
+* without an uploads bucket there is none at all.
+*/
+/** The destination as `BACKUP_DESTINATION` spells it. */
+function describeBackupDestination(dest) {
+	if (dest.kind === "local") return dest.path;
+	return `${dest.kind === "s3" ? "s3" : "gs"}://${dest.bucket}${dest.prefix ? `/${dest.prefix}` : ""}`;
+}
+/**
+* A controller for an object-storage destination's bucket, built from the
+* environment the way the backup cron and `rebase db backups list` build
+* theirs. Throws when an S3 destination has no credentials to read it with.
+*/
+function backupStorageFromEnv(dest, env) {
+	if (dest.kind === "gcs") return new GCSStorageController({
+		type: "gcs",
+		bucket: dest.bucket
+	});
+	if (!env.S3_ACCESS_KEY_ID || !env.S3_SECRET_ACCESS_KEY) throw new Error("S3_ACCESS_KEY_ID and S3_SECRET_ACCESS_KEY are not set in this server's environment. Set the same S3_* variables the backup cron uses.");
+	return new S3StorageController({
+		type: "s3",
+		bucket: dest.bucket,
+		region: env.S3_REGION || "auto",
+		accessKeyId: env.S3_ACCESS_KEY_ID,
+		secretAccessKey: env.S3_SECRET_ACCESS_KEY,
+		endpoint: env.S3_ENDPOINT,
+		forcePathStyle: parseEnvBoolean(env.S3_FORCE_PATH_STYLE)
+	});
+}
+//#endregion
+//#region src/backup/backup-routes.ts
+/** Why a destination could not be read, as the answer says it. */
+function unreadable(dest, err) {
+	const reason = err instanceof Error ? err.message : String(err);
+	return ApiError.serviceUnavailable(`Cannot read the backups at ${describeBackupDestination(dest)}: ${reason}`);
+}
+/**
+* Admin REST routes for the Backups panel.
+*
+* Routes (mounted under `/admin/backups`, admin-guarded by the caller):
+*   GET /            → list available backups, and the scheduled job's last run
+*   GET /download    → download a backup's bytes (?key=…)
+*/
+function createBackupRoutes(config) {
+	const router = new Hono();
+	router.onError(errorHandler);
+	const storageFor = config.storageFor ?? ((dest) => backupStorageFromEnv(dest, process.env));
+	/** The controller for `dest`, or none for a local one. A destination it cannot read is an error, never `[]`. */
+	const storageOf = (dest) => {
+		if (dest.kind === "local") return void 0;
+		try {
+			return storageFor(dest);
+		} catch (err) {
+			throw unreadable(dest, err);
+		}
+	};
+	router.get("/", async (c) => {
+		const schedule = config.getSchedule ? await config.getSchedule() : null;
+		const dest = config.getDestination();
+		if (!dest) return c.json({
+			backups: [],
+			destinationKind: "local",
+			configured: false,
+			schedule
+		});
+		const backups = await listBackupObjects(dest, storageOf(dest)).catch((err) => {
+			throw unreadable(dest, err);
+		});
+		const localDiskOfThisProcess = dest.kind === "local" && config.scheduledElsewhere === true && schedule !== null;
+		return c.json({
+			backups,
+			destinationKind: dest.kind,
+			configured: true,
+			schedule,
+			...localDiskOfThisProcess ? { localDiskOfThisProcess } : {}
+		});
+	});
+	router.get("/download", async (c) => {
+		const dest = config.getDestination();
+		if (!dest) throw ApiError.badRequest("Backups are not configured (set BACKUP_DESTINATION).");
+		const key = c.req.query("key");
+		if (!key) throw ApiError.badRequest("Missing 'key' query parameter.");
+		const result = await openBackupStream(dest, key, storageOf(dest));
+		if (!result) throw ApiError.notFound(`Backup not found: ${key}`);
+		c.header("Content-Type", "application/octet-stream");
+		c.header("Content-Length", String(result.size));
+		c.header("Content-Disposition", `attachment; filename="${result.name}"`);
+		return c.body(result.stream);
+	});
+	return router;
+}
+//#endregion
+//#region src/backup/backup-schedule.ts
+/**
+* The mark `createBackupCron` (in `@rebasepro/server-postgres`) puts on the
+* definition it returns.
+*
+* A registry symbol, so it is the same value across two installed copies of
+* either package, and neither package has to import the other: `server` must
+* not depend on `server-postgres`. The job cannot be recognised any other way —
+* its id is the cron file's name and its display name is configurable.
+*/
+var BACKUP_CRON_MARK = Symbol.for("rebase.backupCron");
+/** Whether a cron definition is the scheduled backup. */
+function isBackupCronDefinition(definition) {
+	return Reflect.get(definition, BACKUP_CRON_MARK) === true;
+}
+/**
+* How many recent log entries to look through for the last scheduled run. A
+* skip — a slot that found the previous run still going — is logged as a
+* success with nothing done, and must not stand in for the run it skipped; nor
+* may a run someone started by hand, which is not the schedule's.
+*/
+var RECENT_RUNS = 50;
+/** A log entry as the panel reports a run. */
+function outcomeOf(entry) {
+	return {
+		startedAt: entry.startedAt,
+		finishedAt: entry.finishedAt,
+		success: entry.success,
+		...entry.success || !entry.error ? {} : { error: entry.error },
+		manual: entry.manual === true
+	};
+}
+/**
+* The scheduled backup job and its last run, or `null` when the deployment
+* has none — registered or refused.
+*/
+async function readBackupSchedule(source) {
+	const [jobId] = source.jobIdsWhere(isBackupCronDefinition);
+	if (jobId === void 0) {
+		const [refused] = source.rejectedJobsWhere(isBackupCronDefinition);
+		return refused ? {
+			jobId: refused.id,
+			name: refused.name,
+			schedule: refused.schedule,
+			enabled: false,
+			refused: refused.reason
+		} : null;
+	}
+	const job = await source.fetchJob(jobId);
+	if (!job) return null;
+	const disabledInCode = !job.enabled && source.jobIdsWhere((definition) => isBackupCronDefinition(definition) && definition.enabled === false).includes(jobId);
+	let recent;
+	let historyError;
+	try {
+		recent = await source.getJobLogsFromDb(jobId, RECENT_RUNS);
+	} catch (err) {
+		logger.error(`[backups] Could not read the run history of the backup job "${jobId}"`, { error: err });
+		recent = [];
+		historyError = "The backup job's run history could not be read. The server log has the reason.";
+	}
+	const runs = recent.filter((entry) => !isAlreadyExecutingSkip(entry));
+	const lastScheduled = runs.find((entry) => entry.manual !== true);
+	const lastManual = runs.find((entry) => entry.manual === true);
+	const manualSince = lastManual && (!lastScheduled || lastManual.startedAt > lastScheduled.startedAt) ? lastManual : void 0;
+	return {
+		jobId,
+		name: job.name,
+		schedule: job.schedule,
+		enabled: job.enabled,
+		...disabledInCode ? { disabledInCode } : {},
+		...job.nextRunAt ? { nextRunAt: job.nextRunAt } : {},
+		...historyError ? { historyError } : {},
+		...lastScheduled ? { lastRun: outcomeOf(lastScheduled) } : {},
+		...manualSince ? { lastManualRun: outcomeOf(manualSince) } : {}
+	};
+}
+//#endregion
+//#region src/backup/index.ts
+var backup_exports = /* @__PURE__ */ __exportAll({
+	createBackupRoutes: () => createBackupRoutes,
+	listAllObjectKeys: () => listAllObjectKeys,
+	listBackupObjects: () => listBackupObjects,
+	openBackupStream: () => openBackupStream,
+	parseBackupDestination: () => parseBackupDestination,
+	parseBackupTimestamp: () => parseBackupTimestamp,
+	readBackupBytes: () => readBackupBytes,
+	readBackupSchedule: () => readBackupSchedule
+});
+//#endregion
+export { parseBackupTimestamp as a, parseBackupDestination as i, createBackupRoutes as n, readBackupBytes as o, listBackupObjects as r, backup_exports as t };
+
+//# sourceMappingURL=backup-CN0s50D2.js.map

package/dist/backup-CN0s50D2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-CN0s50D2.js","names":[],"sources":["../src/backup/backup-common.ts","../src/backup/backup-storage.ts","../src/backup/backup-routes.ts","../src/backup/backup-schedule.ts","../src/backup/index.ts"],"sourcesContent":["/**\n * Storage-generic backup helpers used by the admin backup routes.\n *\n * These live in server (which owns {@link StorageController}) so the\n * admin API can list backups without depending on the Postgres driver —\n * `server` must not import from `server-postgres`. The `pg_dump`-side\n * copies of the tiny pure parsers live in `@rebasepro/server-postgres`;\n * keep the two in sync if the naming scheme ever changes.\n */\nimport fs from \"fs\";\nimport path from \"path\";\nimport type { BackupInfo, BackupDestinationKind } from \"@rebasepro/types\";\nimport type { StorageController } from \"../storage\";\nimport { logger } from \"../utils/logger\";\n\nexport type BackupDestination =\n    | { kind: \"local\"; path: string }\n    | { kind: \"s3\"; bucket: string; prefix: string }\n    | { kind: \"gcs\"; bucket: string; prefix: string };\n\n/** Parse a destination string (`s3://…`, `gs://…`, or a local path). */\nexport function parseBackupDestination(out: string): BackupDestination {\n    const s3 = out.match(/^s3:\\/\\/([^/]+)\\/?(.*)$/);\n    if (s3) return { kind: \"s3\", bucket: s3[1], prefix: s3[2].replace(/\\/+$/, \"\") };\n    const gcs = out.match(/^gs:\\/\\/([^/]+)\\/?(.*)$/);\n    if (gcs) return { kind: \"gcs\", bucket: gcs[1], prefix: gcs[2].replace(/\\/+$/, \"\") };\n    return { kind: \"local\", path: out };\n}\n\n/**\n * Recover the UTC creation time encoded in a `rebase-<db>-<ts>.dump` name.\n * Returns `null` for names that don't match, so foreign objects are ignored.\n */\nexport function parseBackupTimestamp(fileName: string): Date | null {\n    const base = fileName.split(\"/\").pop() ?? fileName;\n    const match = base.match(/-(\\d{8})T(\\d{6})Z\\.dump$/);\n    if (!match) return null;\n    const [, ymd, hms] = match;\n    const iso =\n        `${ymd.slice(0, 4)}-${ymd.slice(4, 6)}-${ymd.slice(6, 8)}` +\n        `T${hms.slice(0, 2)}:${hms.slice(2, 4)}:${hms.slice(4, 6)}Z`;\n    const date = new Date(iso);\n    return Number.isNaN(date.getTime()) ? null : date;\n}\n\n/**\n * A backup is two files: the `.dump`, and beside it a `.globals.sql` holding\n * the cluster roles the dump's GRANTs and RLS policies name. Without that\n * sidecar a restore into a fresh cluster stops at the first GRANT to a role\n * that does not exist there. The CLI uploads, restores and prunes the two as\n * a pair. This listing used to know only the `.dump`, so a backup downloaded\n * from Studio arrived without its roles.\n *\n * The suffix mirrors `globalsFileForDump` in `@rebasepro/server-postgres`.\n */\nconst DUMP_SUFFIX = \".dump\";\nconst GLOBALS_SUFFIX = \".globals.sql\";\n\nfunction globalsKeyFor(dumpKey: string): string {\n    return dumpKey.slice(0, -DUMP_SUFFIX.length) + GLOBALS_SUFFIX;\n}\n\n/** The only files the download route will serve. */\nfunction isBackupFile(key: string): boolean {\n    return key.endsWith(DUMP_SUFFIX) || key.endsWith(GLOBALS_SUFFIX);\n}\n\n/**\n * How many pages of an object-storage listing to read before giving up — at\n * the providers' 1,000 keys a page, 100,000 objects, or 50,000 backups.\n */\nconst MAX_LIST_PAGES = 100;\n\n/**\n * Every key under a prefix, across pages.\n *\n * S3 and GCS answer a listing a page at a time, in ascending key order, and a\n * backup's key is `rebase-<db>-<UTC timestamp>`. Reading one page therefore\n * returned the OLDEST thousand objects: with retention unset and an hourly\n * schedule, the newest backup the panel and `rebase db backups list` showed\n * stopped advancing after about three weeks, which reads as \"backups stopped\".\n */\nexport async function listAllObjectKeys(\n    storage: StorageController,\n    prefix: string,\n    bucket: string\n): Promise<string[]> {\n    const keys: string[] = [];\n    let pageToken: string | undefined;\n    for (let page = 0; page < MAX_LIST_PAGES; page++) {\n        const result = await storage.listObjects(prefix, { bucket, maxResults: 1000, pageToken });\n        for (const item of result.items) keys.push(item.fullPath);\n        pageToken = result.nextPageToken;\n        if (!pageToken) return keys;\n    }\n    logger.warn(\n        `[backups] Stopped listing ${bucket}/${prefix} after ${MAX_LIST_PAGES} pages (${keys.length} objects). ` +\n        \"Set BACKUP_RETENTION_DAYS so old backups are pruned, or give the backups a prefix of their own.\"\n    );\n    return keys;\n}\n\n/**\n * Whether an object key is one the backup routes may serve: a backup file, at\n * the destination's prefix and nowhere else.\n *\n * The local branch has always been held to the backup directory; this branch\n * checked only the suffix, so any `.dump` in the bucket — `uploads/x.dump`, a\n * neighbouring `nightlyish/` prefix — was readable by naming it. A key is taken\n * as written, so a scheme (`s3://other-bucket/…`, which S3StorageController\n * would follow) or a `.`/`..`/empty segment (which a filesystem-backed or\n * S3-compatible store may resolve) is refused rather than interpreted.\n */\nfunction isObjectBackupKey(dest: { prefix: string }, key: string): boolean {\n    if (!isBackupFile(key) || /^[a-z][a-z0-9+.-]*:\\/\\//i.test(key)) return false;\n    const segments = key.split(\"/\");\n    if (segments.some((segment) => segment === \"\" || segment === \".\" || segment === \"..\")) return false;\n    return dest.prefix === \"\" || key.startsWith(`${dest.prefix}/`);\n}\n\n/**\n * List the backups at a destination as {@link BackupInfo}, newest first.\n * One entry per `.dump`, with its `.globals.sql` sidecar attached as\n * `globalsKey` when there is one.\n */\nexport async function listBackupObjects(\n    dest: BackupDestination,\n    storage?: StorageController\n): Promise<BackupInfo[]> {\n    if (dest.kind === \"local\") {\n        if (!fs.existsSync(dest.path)) return [];\n        const stat = fs.statSync(dest.path);\n        const dir = stat.isDirectory() ? dest.path : path.dirname(dest.path);\n        if (!fs.existsSync(dir)) return [];\n        const files = fs.readdirSync(dir);\n        const present = new Set(files);\n        return files\n            .filter((f) => f.endsWith(DUMP_SUFFIX))\n            .map((f): BackupInfo => {\n                const full = path.join(dir, f);\n                const st = fs.statSync(full);\n                const createdAt = parseBackupTimestamp(f) ?? st.mtime;\n                const globals = globalsKeyFor(f);\n                return {\n                    key: full,\n                    name: f,\n                    sizeBytes: st.size,\n                    createdAt: createdAt.toISOString(),\n                    destinationKind: \"local\",\n                    ...(present.has(globals) ? { globalsKey: path.join(dir, globals) } : {})\n                };\n            })\n            .sort(byNewest);\n    }\n\n    // An empty list is a claim about the bucket. Without a controller for it\n    // nothing was read, and the panel said \"No backups yet.\" about a bucket\n    // full of them.\n    if (!storage) throw new Error(noControllerFor(dest));\n    const keys = await listAllObjectKeys(storage, dest.prefix ? `${dest.prefix}/` : \"\", dest.bucket);\n    const present = new Set(keys);\n    return keys\n        .filter((key) => key.endsWith(DUMP_SUFFIX))\n        .map((key): BackupInfo => {\n            const createdAt = parseBackupTimestamp(key);\n            const globals = globalsKeyFor(key);\n            return {\n                key,\n                name: key.split(\"/\").pop() || key,\n                createdAt: createdAt ? createdAt.toISOString() : undefined,\n                destinationKind: dest.kind as BackupDestinationKind,\n                ...(present.has(globals) ? { globalsKey: globals } : {})\n            };\n        })\n        .sort(byNewest);\n}\n\nfunction noControllerFor(dest: { kind: \"s3\" | \"gcs\"; bucket: string; prefix: string }): string {\n    const scheme = dest.kind === \"s3\" ? \"s3\" : \"gs\";\n    return `No storage controller for ${scheme}://${dest.bucket}${dest.prefix ? `/${dest.prefix}` : \"\"}, so its backups cannot be read.`;\n}\n\nfunction byNewest(a: BackupInfo, b: BackupInfo): number {\n    const ta = a.createdAt ? Date.parse(a.createdAt) : 0;\n    const tb = b.createdAt ? Date.parse(b.createdAt) : 0;\n    return tb - ta;\n}\n\n/**\n * The absolute path of a local backup file, or `null` for anything the download\n * route must not serve: a path outside the backup directory, a file that is not\n * a backup, or one that does not exist.\n */\nfunction resolveLocalBackupFile(dest: { path: string }, key: string): string | null {\n    const stat = fs.existsSync(dest.path) ? fs.statSync(dest.path) : null;\n    const dir = stat?.isDirectory() ? dest.path : path.dirname(dest.path);\n    const resolvedDir = path.resolve(dir);\n    const resolved = path.resolve(key);\n    // Only allow reads inside the backup directory, and only backup files.\n    if (!resolved.startsWith(resolvedDir + path.sep) || !isBackupFile(resolved)) {\n        return null;\n    }\n    return fs.existsSync(resolved) ? resolved : null;\n}\n\n/** Read a single backup's bytes. Guards against path traversal for local. */\nexport async function readBackupBytes(\n    dest: BackupDestination,\n    key: string,\n    storage?: StorageController\n): Promise<{ bytes: Uint8Array<ArrayBuffer>; name: string } | null> {\n    if (dest.kind === \"local\") {\n        const resolved = resolveLocalBackupFile(dest, key);\n        if (!resolved) return null;\n        return { bytes: new Uint8Array(fs.readFileSync(resolved)), name: path.basename(resolved) };\n    }\n\n    if (!storage) throw new Error(noControllerFor(dest));\n    if (!isObjectBackupKey(dest, key)) return null;\n    const file = await storage.getObject(key, dest.bucket);\n    if (!file) return null;\n    return { bytes: new Uint8Array(await file.arrayBuffer()), name: key.split(\"/\").pop() || key };\n}\n\n/**\n * A single backup, opened for streaming, with its size. Same guards as\n * {@link readBackupBytes}.\n *\n * What the download route serves. A dump is the size of the database, and\n * reading it whole put all of it on the API process's heap — twice for a local\n * destination (`readFileSync`, then a copy) and on top of the controller's own\n * buffer for object storage — and a file over 2 GiB never downloaded at all:\n * `readFileSync` throws `ERR_FS_FILE_TOO_LARGE` there.\n *\n * A local file is read from disk as the response is written. Object storage\n * still arrives through {@link StorageController.getObject}, which is a\n * buffered `File` by contract; streaming that avoids the second copy.\n */\nexport async function openBackupStream(\n    dest: BackupDestination,\n    key: string,\n    storage?: StorageController\n): Promise<{ stream: ReadableStream<Uint8Array>; size: number; name: string } | null> {\n    if (dest.kind === \"local\") {\n        const resolved = resolveLocalBackupFile(dest, key);\n        if (!resolved) return null;\n        const { size } = await fs.promises.stat(resolved);\n        return { stream: fileStream(resolved), size, name: path.basename(resolved) };\n    }\n\n    if (!storage) throw new Error(noControllerFor(dest));\n    if (!isObjectBackupKey(dest, key)) return null;\n    const file = await storage.getObject(key, dest.bucket);\n    if (!file) return null;\n    return { stream: file.stream(), size: file.size, name: key.split(\"/\").pop() || key };\n}\n\n/** A file on disk as a web stream, read a chunk at a time as the response is written. */\nfunction fileStream(filePath: string): ReadableStream<Uint8Array> {\n    const file = fs.createReadStream(filePath);\n    const chunks: AsyncIterator<Buffer> = file[Symbol.asyncIterator]();\n    return new ReadableStream<Uint8Array>({\n        async pull(controller) {\n            const next = await chunks.next();\n            if (next.done) controller.close();\n            else controller.enqueue(next.value);\n        },\n        cancel() {\n            file.destroy();\n        }\n    });\n}\n","/**\n * The storage controller that reads a backup bucket.\n *\n * A backup destination is its own bucket, named by `BACKUP_DESTINATION`, and\n * the documented backup cron writes to it through a controller it builds from\n * the `S3_*` variables (GCS: application default credentials) — as\n * `rebase db backups list` does. The admin routes have to read it the same way.\n * The app's file storage is not that controller: it is configured for the\n * uploads bucket, it is a local directory in development, and in production\n * without an uploads bucket there is none at all.\n */\nimport { parseEnvBoolean } from \"@rebasepro/types\";\nimport { GCSStorageController } from \"../storage/GCSStorageController\";\nimport { S3StorageController } from \"../storage/S3StorageController\";\nimport type { StorageController } from \"../storage/types\";\nimport type { BackupDestination } from \"./backup-common\";\n\n/** A destination in object storage — `s3://bucket/prefix` or `gs://bucket/prefix`. */\nexport type ObjectBackupDestination = Exclude<BackupDestination, { kind: \"local\" }>;\n\n/** The destination as `BACKUP_DESTINATION` spells it. */\nexport function describeBackupDestination(dest: BackupDestination): string {\n    if (dest.kind === \"local\") return dest.path;\n    const scheme = dest.kind === \"s3\" ? \"s3\" : \"gs\";\n    return `${scheme}://${dest.bucket}${dest.prefix ? `/${dest.prefix}` : \"\"}`;\n}\n\n/**\n * A controller for an object-storage destination's bucket, built from the\n * environment the way the backup cron and `rebase db backups list` build\n * theirs. Throws when an S3 destination has no credentials to read it with.\n */\nexport function backupStorageFromEnv(\n    dest: ObjectBackupDestination,\n    env: Record<string, string | undefined>\n): StorageController {\n    if (dest.kind === \"gcs\") {\n        return new GCSStorageController({ type: \"gcs\", bucket: dest.bucket });\n    }\n    // s3 also covers R2, MinIO and the other S3-compatible stores, through S3_ENDPOINT.\n    if (!env.S3_ACCESS_KEY_ID || !env.S3_SECRET_ACCESS_KEY) {\n        throw new Error(\n            \"S3_ACCESS_KEY_ID and S3_SECRET_ACCESS_KEY are not set in this server's environment. \" +\n            \"Set the same S3_* variables the backup cron uses.\"\n        );\n    }\n    return new S3StorageController({\n        type: \"s3\",\n        bucket: dest.bucket,\n        region: env.S3_REGION || \"auto\",\n        accessKeyId: env.S3_ACCESS_KEY_ID,\n        secretAccessKey: env.S3_SECRET_ACCESS_KEY,\n        endpoint: env.S3_ENDPOINT,\n        // Unset stays unset, so the controller decides from the endpoint.\n        forcePathStyle: parseEnvBoolean(env.S3_FORCE_PATH_STYLE)\n    });\n}\n","import { Hono } from \"hono\";\nimport type { BackupListing, BackupScheduleStatus } from \"@rebasepro/types\";\nimport type { HonoEnv } from \"../api/types\";\nimport { ApiError, errorHandler } from \"../api/errors\";\nimport type { StorageController } from \"../storage/types\";\nimport { BackupDestination, listBackupObjects, openBackupStream } from \"./backup-common\";\nimport { backupStorageFromEnv, describeBackupDestination, type ObjectBackupDestination } from \"./backup-storage\";\n\nexport interface BackupRoutesConfig {\n    /**\n     * Resolve the current backup destination, or `null` when backups are not\n     * configured (`BACKUP_DESTINATION` unset). Read lazily so a restart isn't\n     * required to pick up config.\n     */\n    getDestination: () => BackupDestination | null;\n    /**\n     * The controller that reads an object-storage destination. It has to\n     * address the destination's own bucket — never the app's file storage,\n     * which is another bucket, a local directory, or nothing. Defaults to\n     * {@link backupStorageFromEnv} over `process.env`, which is how the backup\n     * cron builds the one it writes with.\n     */\n    storageFor?: (dest: ObjectBackupDestination) => StorageController;\n    /**\n     * The scheduled backup job and its last run — see `readBackupSchedule`.\n     * Omitted where this process has no cron scheduler; the listing then\n     * answers `schedule: null`.\n     */\n    getSchedule?: () => Promise<BackupScheduleStatus | null>;\n    /**\n     * True when this process does not run the scheduled jobs (the `api` role\n     * of a split deployment). A local destination read here is then this\n     * process's disk, not the one the scheduled backup writes to.\n     */\n    scheduledElsewhere?: boolean;\n}\n\n/** Why a destination could not be read, as the answer says it. */\nfunction unreadable(dest: BackupDestination, err: unknown): ApiError {\n    const reason = err instanceof Error ? err.message : String(err);\n    return ApiError.serviceUnavailable(`Cannot read the backups at ${describeBackupDestination(dest)}: ${reason}`);\n}\n\n/**\n * Admin REST routes for the Backups panel.\n *\n * Routes (mounted under `/admin/backups`, admin-guarded by the caller):\n *   GET /            → list available backups, and the scheduled job's last run\n *   GET /download    → download a backup's bytes (?key=…)\n */\nexport function createBackupRoutes(config: BackupRoutesConfig): Hono<HonoEnv> {\n    const router = new Hono<HonoEnv>();\n    router.onError(errorHandler);\n\n    const storageFor = config.storageFor ?? ((dest: ObjectBackupDestination) => backupStorageFromEnv(dest, process.env));\n    /** The controller for `dest`, or none for a local one. A destination it cannot read is an error, never `[]`. */\n    const storageOf = (dest: BackupDestination): StorageController | undefined => {\n        if (dest.kind === \"local\") return undefined;\n        try {\n            return storageFor(dest);\n        } catch (err) {\n            throw unreadable(dest, err);\n        }\n    };\n\n    router.get(\"/\", async (c) => {\n        // Read whether or not a destination is configured: a backup cron with\n        // no BACKUP_DESTINATION fails every run, and that is exactly what the\n        // panel has to be able to say.\n        const schedule = config.getSchedule ? await config.getSchedule() : null;\n        const dest = config.getDestination();\n        if (!dest) {\n            return c.json({ backups: [], destinationKind: \"local\", configured: false, schedule } satisfies BackupListing);\n        }\n        const backups = await listBackupObjects(dest, storageOf(dest)).catch((err: unknown) => {\n            throw unreadable(dest, err);\n        });\n        // Only where there is a scheduled backup to write elsewhere.\n        const localDiskOfThisProcess = dest.kind === \"local\" && config.scheduledElsewhere === true && schedule !== null;\n        return c.json({\n            backups,\n            destinationKind: dest.kind,\n            configured: true,\n            schedule,\n            ...(localDiskOfThisProcess ? { localDiskOfThisProcess } : {})\n        } satisfies BackupListing);\n    });\n\n    router.get(\"/download\", async (c) => {\n        const dest = config.getDestination();\n        if (!dest) {\n            throw ApiError.badRequest(\"Backups are not configured (set BACKUP_DESTINATION).\");\n        }\n        const key = c.req.query(\"key\");\n        if (!key) {\n            throw ApiError.badRequest(\"Missing 'key' query parameter.\");\n        }\n        // Streamed: a dump is the size of the database. See `openBackupStream`.\n        const result = await openBackupStream(dest, key, storageOf(dest));\n        if (!result) {\n            throw ApiError.notFound(`Backup not found: ${key}`);\n        }\n        c.header(\"Content-Type\", \"application/octet-stream\");\n        c.header(\"Content-Length\", String(result.size));\n        c.header(\"Content-Disposition\", `attachment; filename=\"${result.name}\"`);\n        return c.body(result.stream);\n    });\n\n    return router;\n}\n","/**\n * The scheduled backup job, as the Backups panel reports it.\n *\n * A backup that fails every night has to be visible where the backups are\n * listed. Before this the panel read the destination and nothing else, so a\n * cron that could not run `pg_dump` left an empty list under \"wait for the next\n * scheduled run\" — while each failure sat in `cron_logs`, one panel away.\n */\nimport type {\n    BackupRunOutcome,\n    BackupScheduleStatus,\n    CronJobDefinition,\n    CronJobLogEntry,\n    CronJobStatus,\n    RejectedCronJob\n} from \"@rebasepro/types\";\nimport { isAlreadyExecutingSkip } from \"../cron/cron-scheduler\";\nimport { logger } from \"../utils/logger\";\n\n/**\n * The mark `createBackupCron` (in `@rebasepro/server-postgres`) puts on the\n * definition it returns.\n *\n * A registry symbol, so it is the same value across two installed copies of\n * either package, and neither package has to import the other: `server` must\n * not depend on `server-postgres`. The job cannot be recognised any other way —\n * its id is the cron file's name and its display name is configurable.\n */\nexport const BACKUP_CRON_MARK: unique symbol = Symbol.for(\"rebase.backupCron\");\n\n/** Whether a cron definition is the scheduled backup. */\nexport function isBackupCronDefinition(definition: CronJobDefinition): boolean {\n    return Reflect.get(definition, BACKUP_CRON_MARK) === true;\n}\n\n/** The part of the cron scheduler this reads. */\nexport interface BackupScheduleSource {\n    jobIdsWhere(predicate: (definition: CronJobDefinition) => boolean): string[];\n    rejectedJobsWhere(predicate: (definition: CronJobDefinition) => boolean): RejectedCronJob[];\n    fetchJob(id: string): Promise<CronJobStatus | undefined>;\n    getJobLogsFromDb(id: string, limit?: number): Promise<CronJobLogEntry[]>;\n}\n\n/**\n * How many recent log entries to look through for the last scheduled run. A\n * skip — a slot that found the previous run still going — is logged as a\n * success with nothing done, and must not stand in for the run it skipped; nor\n * may a run someone started by hand, which is not the schedule's.\n */\nconst RECENT_RUNS = 50;\n\n/** A log entry as the panel reports a run. */\nfunction outcomeOf(entry: CronJobLogEntry): BackupRunOutcome {\n    return {\n        startedAt: entry.startedAt,\n        finishedAt: entry.finishedAt,\n        success: entry.success,\n        ...(entry.success || !entry.error ? {} : { error: entry.error }),\n        manual: entry.manual === true\n    };\n}\n\n/**\n * The scheduled backup job and its last run, or `null` when the deployment\n * has none — registered or refused.\n */\nexport async function readBackupSchedule(source: BackupScheduleSource): Promise<BackupScheduleStatus | null> {\n    const [jobId] = source.jobIdsWhere(isBackupCronDefinition);\n    if (jobId === undefined) {\n        // A refused job is not registered, and answered `null` here it read\n        // as \"no backup cron\" under a hint to add the file the project has.\n        const [refused] = source.rejectedJobsWhere(isBackupCronDefinition);\n        return refused\n            ? { jobId: refused.id, name: refused.name, schedule: refused.schedule, enabled: false, refused: refused.reason }\n            : null;\n    }\n\n    const job = await source.fetchJob(jobId);\n    if (!job) return null;\n    // Off because its own definition says so — the documented cron file\n    // exports `enabled: false` while BACKUP_SCHEDULE is unset — rather than\n    // paused by someone. Resuming that in Cron Jobs would run the placeholder.\n    const disabledInCode = !job.enabled &&\n        source.jobIdsWhere(definition => isBackupCronDefinition(definition) && definition.enabled === false).includes(jobId);\n\n    let recent: CronJobLogEntry[];\n    let historyError: string | undefined;\n    try {\n        recent = await source.getJobLogsFromDb(jobId, RECENT_RUNS);\n    } catch (err) {\n        // Said, not read as \"has not run yet\". The listing itself still\n        // answers: the backups at the destination are worth showing.\n        logger.error(`[backups] Could not read the run history of the backup job \"${jobId}\"`, { error: err });\n        recent = [];\n        historyError = \"The backup job's run history could not be read. The server log has the reason.\";\n    }\n    const runs = recent.filter(entry => !isAlreadyExecutingSkip(entry));\n    // \"Last scheduled backup\" is the schedule's: a later \"Run Now\" that worked\n    // hid a failed nightly, and a failed test run read as a failed nightly.\n    const lastScheduled = runs.find(entry => entry.manual !== true);\n    // A run by hand since then is reported too, as what it is.\n    const lastManual = runs.find(entry => entry.manual === true);\n    const manualSince = lastManual && (!lastScheduled || lastManual.startedAt > lastScheduled.startedAt)\n        ? lastManual\n        : undefined;\n\n    return {\n        jobId,\n        name: job.name,\n        schedule: job.schedule,\n        enabled: job.enabled,\n        ...(disabledInCode ? { disabledInCode } : {}),\n        ...(job.nextRunAt ? { nextRunAt: job.nextRunAt } : {}),\n        ...(historyError ? { historyError } : {}),\n        ...(lastScheduled ? { lastRun: outcomeOf(lastScheduled) } : {}),\n        ...(manualSince ? { lastManualRun: outcomeOf(manualSince) } : {})\n    };\n}\n","/**\n * Storage-generic backup helpers and admin routes for the Backups panel.\n * The `pg_dump`/`pg_restore` machinery lives in `@rebasepro/server-postgres`.\n */\nexport * from \"./backup-common\";\nexport { createBackupRoutes } from \"./backup-routes\";\nexport type { BackupRoutesConfig } from \"./backup-routes\";\nexport { readBackupSchedule, isBackupCronDefinition, BACKUP_CRON_MARK } from \"./backup-schedule\";\nexport type { BackupScheduleSource } from \"./backup-schedule\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,uBAAuB,KAAgC;CACnE,MAAM,KAAK,IAAI,MAAM,yBAAyB;CAC9C,IAAI,IAAI,OAAO;EAAE,MAAM;EAAM,QAAQ,GAAG;EAAI,QAAQ,GAAG,EAAE,CAAC,QAAQ,QAAQ,EAAE;CAAE;CAC9E,MAAM,MAAM,IAAI,MAAM,yBAAyB;CAC/C,IAAI,KAAK,OAAO;EAAE,MAAM;EAAO,QAAQ,IAAI;EAAI,QAAQ,IAAI,EAAE,CAAC,QAAQ,QAAQ,EAAE;CAAE;CAClF,OAAO;EAAE,MAAM;EAAS,MAAM;CAAI;AACtC;;;;;AAMA,SAAgB,qBAAqB,UAA+B;CAEhE,MAAM,SADO,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,SAAA,CACvB,MAAM,0BAA0B;CACnD,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,GAAG,KAAK,OAAO;CACrB,MAAM,MACF,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAA,GACnD,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE;CAC9D,MAAM,OAAO,IAAI,KAAK,GAAG;CACzB,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,IAAI,OAAO;AACjD;;;;;;;;;;;AAYA,IAAM,cAAc;AACpB,IAAM,iBAAiB;AAEvB,SAAS,cAAc,SAAyB;CAC5C,OAAO,QAAQ,MAAM,GAAG,EAAmB,IAAI;AACnD;;AAGA,SAAS,aAAa,KAAsB;CACxC,OAAO,IAAI,SAAS,WAAW,KAAK,IAAI,SAAS,cAAc;AACnE;;;;;AAMA,IAAM,iBAAiB;;;;;;;;;;AAWvB,eAAsB,kBAClB,SACA,QACA,QACiB;CACjB,MAAM,OAAiB,CAAC;CACxB,IAAI;CACJ,KAAK,IAAI,OAAO,GAAG,OAAO,gBAAgB,QAAQ;EAC9C,MAAM,SAAS,MAAM,QAAQ,YAAY,QAAQ;GAAE;GAAQ,YAAY;GAAM;EAAU,CAAC;EACxF,KAAK,MAAM,QAAQ,OAAO,OAAO,KAAK,KAAK,KAAK,QAAQ;EACxD,YAAY,OAAO;EACnB,IAAI,CAAC,WAAW,OAAO;CAC3B;CACA,OAAO,KACH,6BAA6B,OAAO,GAAG,OAAO,SAAS,eAAe,UAAU,KAAK,OAAO,2GAEhG;CACA,OAAO;AACX;;;;;;;;;;;;AAaA,SAAS,kBAAkB,MAA0B,KAAsB;CACvE,IAAI,CAAC,aAAa,GAAG,KAAK,2BAA2B,KAAK,GAAG,GAAG,OAAO;CAEvE,IADiB,IAAI,MAAM,GACvB,CAAA,CAAS,MAAM,YAAY,YAAY,MAAM,YAAY,OAAO,YAAY,IAAI,GAAG,OAAO;CAC9F,OAAO,KAAK,WAAW,MAAM,IAAI,WAAW,GAAG,KAAK,OAAO,EAAE;AACjE;;;;;;AAOA,eAAsB,kBAClB,MACA,SACqB;CACrB,IAAI,KAAK,SAAS,SAAS;EACvB,IAAI,CAAC,GAAG,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC;EAEvC,MAAM,MADO,GAAG,SAAS,KAAK,IAClB,CAAA,CAAK,YAAY,IAAI,KAAK,OAAO,KAAK,QAAQ,KAAK,IAAI;EACnE,IAAI,CAAC,GAAG,WAAW,GAAG,GAAG,OAAO,CAAC;EACjC,MAAM,QAAQ,GAAG,YAAY,GAAG;EAChC,MAAM,UAAU,IAAI,IAAI,KAAK;EAC7B,OAAO,MACF,QAAQ,MAAM,EAAE,SAAS,WAAW,CAAC,CAAC,CACtC,KAAK,MAAkB;GACpB,MAAM,OAAO,KAAK,KAAK,KAAK,CAAC;GAC7B,MAAM,KAAK,GAAG,SAAS,IAAI;GAC3B,MAAM,YAAY,qBAAqB,CAAC,KAAK,GAAG;GAChD,MAAM,UAAU,cAAc,CAAC;GAC/B,OAAO;IACH,KAAK;IACL,MAAM;IACN,WAAW,GAAG;IACd,WAAW,UAAU,YAAY;IACjC,iBAAiB;IACjB,GAAI,QAAQ,IAAI,OAAO,IAAI,EAAE,YAAY,KAAK,KAAK,KAAK,OAAO,EAAE,IAAI,CAAC;GAC1E;EACJ,CAAC,CAAC,CACD,KAAK,QAAQ;CACtB;CAKA,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,gBAAgB,IAAI,CAAC;CACnD,MAAM,OAAO,MAAM,kBAAkB,SAAS,KAAK,SAAS,GAAG,KAAK,OAAO,KAAK,IAAI,KAAK,MAAM;CAC/F,MAAM,UAAU,IAAI,IAAI,IAAI;CAC5B,OAAO,KACF,QAAQ,QAAQ,IAAI,SAAS,WAAW,CAAC,CAAC,CAC1C,KAAK,QAAoB;EACtB,MAAM,YAAY,qBAAqB,GAAG;EAC1C,MAAM,UAAU,cAAc,GAAG;EACjC,OAAO;GACH;GACA,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;GAC9B,WAAW,YAAY,UAAU,YAAY,IAAI,KAAA;GACjD,iBAAiB,KAAK;GACtB,GAAI,QAAQ,IAAI,OAAO,IAAI,EAAE,YAAY,QAAQ,IAAI,CAAC;EAC1D;CACJ,CAAC,CAAC,CACD,KAAK,QAAQ;AACtB;AAEA,SAAS,gBAAgB,MAAsE;CAE3F,OAAO,6BADQ,KAAK,SAAS,OAAO,OAAO,KACA,KAAK,KAAK,SAAS,KAAK,SAAS,IAAI,KAAK,WAAW,GAAG;AACvG;AAEA,SAAS,SAAS,GAAe,GAAuB;CACpD,MAAM,KAAK,EAAE,YAAY,KAAK,MAAM,EAAE,SAAS,IAAI;CAEnD,QADW,EAAE,YAAY,KAAK,MAAM,EAAE,SAAS,IAAI,KACvC;AAChB;;;;;;AAOA,SAAS,uBAAuB,MAAwB,KAA4B;CAEhF,MAAM,OADO,GAAG,WAAW,KAAK,IAAI,IAAI,GAAG,SAAS,KAAK,IAAI,IAAI,KAAA,EAC/C,YAAY,IAAI,KAAK,OAAO,KAAK,QAAQ,KAAK,IAAI;CACpE,MAAM,cAAc,KAAK,QAAQ,GAAG;CACpC,MAAM,WAAW,KAAK,QAAQ,GAAG;CAEjC,IAAI,CAAC,SAAS,WAAW,cAAc,KAAK,GAAG,KAAK,CAAC,aAAa,QAAQ,GACtE,OAAO;CAEX,OAAO,GAAG,WAAW,QAAQ,IAAI,WAAW;AAChD;;AAGA,eAAsB,gBAClB,MACA,KACA,SACgE;CAChE,IAAI,KAAK,SAAS,SAAS;EACvB,MAAM,WAAW,uBAAuB,MAAM,GAAG;EACjD,IAAI,CAAC,UAAU,OAAO;EACtB,OAAO;GAAE,OAAO,IAAI,WAAW,GAAG,aAAa,QAAQ,CAAC;GAAG,MAAM,KAAK,SAAS,QAAQ;EAAE;CAC7F;CAEA,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,gBAAgB,IAAI,CAAC;CACnD,IAAI,CAAC,kBAAkB,MAAM,GAAG,GAAG,OAAO;CAC1C,MAAM,OAAO,MAAM,QAAQ,UAAU,KAAK,KAAK,MAAM;CACrD,IAAI,CAAC,MAAM,OAAO;CAClB,OAAO;EAAE,OAAO,IAAI,WAAW,MAAM,KAAK,YAAY,CAAC;EAAG,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;CAAI;AAChG;;;;;;;;;;;;;;;AAgBA,eAAsB,iBAClB,MACA,KACA,SACkF;CAClF,IAAI,KAAK,SAAS,SAAS;EACvB,MAAM,WAAW,uBAAuB,MAAM,GAAG;EACjD,IAAI,CAAC,UAAU,OAAO;EACtB,MAAM,EAAE,SAAS,MAAM,GAAG,SAAS,KAAK,QAAQ;EAChD,OAAO;GAAE,QAAQ,WAAW,QAAQ;GAAG;GAAM,MAAM,KAAK,SAAS,QAAQ;EAAE;CAC/E;CAEA,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,gBAAgB,IAAI,CAAC;CACnD,IAAI,CAAC,kBAAkB,MAAM,GAAG,GAAG,OAAO;CAC1C,MAAM,OAAO,MAAM,QAAQ,UAAU,KAAK,KAAK,MAAM;CACrD,IAAI,CAAC,MAAM,OAAO;CAClB,OAAO;EAAE,QAAQ,KAAK,OAAO;EAAG,MAAM,KAAK;EAAM,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;CAAI;AACvF;;AAGA,SAAS,WAAW,UAA8C;CAC9D,MAAM,OAAO,GAAG,iBAAiB,QAAQ;CACzC,MAAM,SAAgC,KAAK,OAAO,cAAc,CAAC;CACjE,OAAO,IAAI,eAA2B;EAClC,MAAM,KAAK,YAAY;GACnB,MAAM,OAAO,MAAM,OAAO,KAAK;GAC/B,IAAI,KAAK,MAAM,WAAW,MAAM;QAC3B,WAAW,QAAQ,KAAK,KAAK;EACtC;EACA,SAAS;GACL,KAAK,QAAQ;EACjB;CACJ,CAAC;AACL;;;;;;;;;;;;;;;AC1PA,SAAgB,0BAA0B,MAAiC;CACvE,IAAI,KAAK,SAAS,SAAS,OAAO,KAAK;CAEvC,OAAO,GADQ,KAAK,SAAS,OAAO,OAAO,KAC1B,KAAK,KAAK,SAAS,KAAK,SAAS,IAAI,KAAK,WAAW;AAC1E;;;;;;AAOA,SAAgB,qBACZ,MACA,KACiB;CACjB,IAAI,KAAK,SAAS,OACd,OAAO,IAAI,qBAAqB;EAAE,MAAM;EAAO,QAAQ,KAAK;CAAO,CAAC;CAGxE,IAAI,CAAC,IAAI,oBAAoB,CAAC,IAAI,sBAC9B,MAAM,IAAI,MACN,uIAEJ;CAEJ,OAAO,IAAI,oBAAoB;EAC3B,MAAM;EACN,QAAQ,KAAK;EACb,QAAQ,IAAI,aAAa;EACzB,aAAa,IAAI;EACjB,iBAAiB,IAAI;EACrB,UAAU,IAAI;EAEd,gBAAgB,gBAAgB,IAAI,mBAAmB;CAC3D,CAAC;AACL;;;;AClBA,SAAS,WAAW,MAAyB,KAAwB;CACjE,MAAM,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;CAC9D,OAAO,SAAS,mBAAmB,8BAA8B,0BAA0B,IAAI,EAAE,IAAI,QAAQ;AACjH;;;;;;;;AASA,SAAgB,mBAAmB,QAA2C;CAC1E,MAAM,SAAS,IAAI,KAAc;CACjC,OAAO,QAAQ,YAAY;CAE3B,MAAM,aAAa,OAAO,gBAAgB,SAAkC,qBAAqB,MAAM,QAAQ,GAAG;;CAElH,MAAM,aAAa,SAA2D;EAC1E,IAAI,KAAK,SAAS,SAAS,OAAO,KAAA;EAClC,IAAI;GACA,OAAO,WAAW,IAAI;EAC1B,SAAS,KAAK;GACV,MAAM,WAAW,MAAM,GAAG;EAC9B;CACJ;CAEA,OAAO,IAAI,KAAK,OAAO,MAAM;EAIzB,MAAM,WAAW,OAAO,cAAc,MAAM,OAAO,YAAY,IAAI;EACnE,MAAM,OAAO,OAAO,eAAe;EACnC,IAAI,CAAC,MACD,OAAO,EAAE,KAAK;GAAE,SAAS,CAAC;GAAG,iBAAiB;GAAS,YAAY;GAAO;EAAS,CAAyB;EAEhH,MAAM,UAAU,MAAM,kBAAkB,MAAM,UAAU,IAAI,CAAC,CAAC,CAAC,OAAO,QAAiB;GACnF,MAAM,WAAW,MAAM,GAAG;EAC9B,CAAC;EAED,MAAM,yBAAyB,KAAK,SAAS,WAAW,OAAO,uBAAuB,QAAQ,aAAa;EAC3G,OAAO,EAAE,KAAK;GACV;GACA,iBAAiB,KAAK;GACtB,YAAY;GACZ;GACA,GAAI,yBAAyB,EAAE,uBAAuB,IAAI,CAAC;EAC/D,CAAyB;CAC7B,CAAC;CAED,OAAO,IAAI,aAAa,OAAO,MAAM;EACjC,MAAM,OAAO,OAAO,eAAe;EACnC,IAAI,CAAC,MACD,MAAM,SAAS,WAAW,sDAAsD;EAEpF,MAAM,MAAM,EAAE,IAAI,MAAM,KAAK;EAC7B,IAAI,CAAC,KACD,MAAM,SAAS,WAAW,gCAAgC;EAG9D,MAAM,SAAS,MAAM,iBAAiB,MAAM,KAAK,UAAU,IAAI,CAAC;EAChE,IAAI,CAAC,QACD,MAAM,SAAS,SAAS,qBAAqB,KAAK;EAEtD,EAAE,OAAO,gBAAgB,0BAA0B;EACnD,EAAE,OAAO,kBAAkB,OAAO,OAAO,IAAI,CAAC;EAC9C,EAAE,OAAO,uBAAuB,yBAAyB,OAAO,KAAK,EAAE;EACvE,OAAO,EAAE,KAAK,OAAO,MAAM;CAC/B,CAAC;CAED,OAAO;AACX;;;;;;;;;;;;ACjFA,IAAa,mBAAkC,OAAO,IAAI,mBAAmB;;AAG7E,SAAgB,uBAAuB,YAAwC;CAC3E,OAAO,QAAQ,IAAI,YAAY,gBAAgB,MAAM;AACzD;;;;;;;AAgBA,IAAM,cAAc;;AAGpB,SAAS,UAAU,OAA0C;CACzD,OAAO;EACH,WAAW,MAAM;EACjB,YAAY,MAAM;EAClB,SAAS,MAAM;EACf,GAAI,MAAM,WAAW,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;EAC9D,QAAQ,MAAM,WAAW;CAC7B;AACJ;;;;;AAMA,eAAsB,mBAAmB,QAAoE;CACzG,MAAM,CAAC,SAAS,OAAO,YAAY,sBAAsB;CACzD,IAAI,UAAU,KAAA,GAAW;EAGrB,MAAM,CAAC,WAAW,OAAO,kBAAkB,sBAAsB;EACjE,OAAO,UACD;GAAE,OAAO,QAAQ;GAAI,MAAM,QAAQ;GAAM,UAAU,QAAQ;GAAU,SAAS;GAAO,SAAS,QAAQ;EAAO,IAC7G;CACV;CAEA,MAAM,MAAM,MAAM,OAAO,SAAS,KAAK;CACvC,IAAI,CAAC,KAAK,OAAO;CAIjB,MAAM,iBAAiB,CAAC,IAAI,WACxB,OAAO,aAAY,eAAc,uBAAuB,UAAU,KAAK,WAAW,YAAY,KAAK,CAAC,CAAC,SAAS,KAAK;CAEvH,IAAI;CACJ,IAAI;CACJ,IAAI;EACA,SAAS,MAAM,OAAO,iBAAiB,OAAO,WAAW;CAC7D,SAAS,KAAK;EAGV,OAAO,MAAM,+DAA+D,MAAM,IAAI,EAAE,OAAO,IAAI,CAAC;EACpG,SAAS,CAAC;EACV,eAAe;CACnB;CACA,MAAM,OAAO,OAAO,QAAO,UAAS,CAAC,uBAAuB,KAAK,CAAC;CAGlE,MAAM,gBAAgB,KAAK,MAAK,UAAS,MAAM,WAAW,IAAI;CAE9D,MAAM,aAAa,KAAK,MAAK,UAAS,MAAM,WAAW,IAAI;CAC3D,MAAM,cAAc,eAAe,CAAC,iBAAiB,WAAW,YAAY,cAAc,aACpF,aACA,KAAA;CAEN,OAAO;EACH;EACA,MAAM,IAAI;EACV,UAAU,IAAI;EACd,SAAS,IAAI;EACb,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;EAC3C,GAAI,IAAI,YAAY,EAAE,WAAW,IAAI,UAAU,IAAI,CAAC;EACpD,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;EACvC,GAAI,gBAAgB,EAAE,SAAS,UAAU,aAAa,EAAE,IAAI,CAAC;EAC7D,GAAI,cAAc,EAAE,eAAe,UAAU,WAAW,EAAE,IAAI,CAAC;CACnE;AACJ"}

package/dist/boot/bundle.d.ts

@@ -37,11 +37,30 @@ export interface LoadedBundle {
 export interface LoadedStaticApp {
     /** Public base path, e.g. `/` or `/admin`. */
     path: string;
+    /**
+     * The one hostname this app answers on, lowercase — see
+     * {@link RebaseBundleStatic.host}. Absent means every hostname.
+     */
+    host?: string;
     /** Absolute path to the built assets. */
     dir: string;
     /** Serve `index.html` for unmatched paths under `path`. */
     spa: boolean;
 }
+/**
+ * The order static apps are mounted in, which is also the order they are
+ * matched in: longest path first, and at an equal path the app that names a
+ * hostname before the one that does not.
+ *
+ * Longest first because the "/"-rooted app's catch-all would otherwise claim
+ * every sibling's URLs. Host first at an equal path because `admin.example.com`
+ * at "/" is a more specific claim than "every hostname" at "/" — the host-less
+ * app still answers on every other hostname, it just loses this one.
+ *
+ * The CLI orders `entry.static` the same way when it builds; this does not rely
+ * on that, because a bundle's order is whatever the program that wrote it chose.
+ */
+export declare function compareStaticApps(a: Pick<LoadedStaticApp, "path" | "host">, b: Pick<LoadedStaticApp, "path" | "host">): number;
 /**
  * The file that makes a directory a bundle.
  *

package/dist/boot/driver.d.ts

@@ -76,6 +76,16 @@ export interface BundleSchema {
  * workspace running from source.
  */
 export declare function bundleResolutionRoots(bundleDir: string): string[];
+/**
+ * What to `import()` for a package the bundle may have brought with it: its
+ * entry under the first of `resolveFrom` that has it installed, else the bare
+ * name, which resolves from wherever the runtime itself is installed.
+ */
+export declare function resolveBundlePackage(packageName: string, resolveFrom: string[]): {
+    specifier: string;
+    /** Where the package was found, when it resolved from a `node_modules` tree. */
+    packageDir?: string;
+};
 /**
  * Wrap a `DatabaseAdapter` as a `BackendBootstrapper` carrying a registry id.
  *