@trieb.work/payload-plugin-backup-mongodb 0.1.1

package/dist/core/backupBlobIO.js

@@ -0,0 +1,179 @@
+import { put } from '@vercel/blob';
+/**
+ * Returns the blob pathname (no leading slash) for a trusted Vercel Blob HTTPS URL, or null.
+ * The URL's path component is percent-decoded once so the result matches the literal pathname
+ * stored by Vercel Blob (e.g. blobs whose own pathname contains `%2F` are served from a URL that
+ * double-encodes it to `%252F`).
+ */ export function vercelBlobPathnameFromUrl(urlStr) {
+    try {
+        const u = new URL(urlStr);
+        if (u.protocol !== 'https:') {
+            return null;
+        }
+        if (!u.hostname.endsWith('.blob.vercel-storage.com')) {
+            return null;
+        }
+        const raw = u.pathname.replace(/^\//, '');
+        if (raw.length === 0) {
+            return null;
+        }
+        try {
+            return decodeURIComponent(raw);
+        } catch  {
+            return raw;
+        }
+    } catch  {
+        return null;
+    }
+}
+export function isTrustedBackupBlobReference(urlStr, expectedPathname) {
+    const fromUrl = vercelBlobPathnameFromUrl(urlStr);
+    return Boolean(fromUrl && fromUrl === expectedPathname);
+}
+/** True when the URL points to any Vercel Blob host (public or private). */ function isVercelBlobHost(urlStr) {
+    try {
+        const u = new URL(urlStr);
+        return u.protocol === 'https:' && u.hostname.endsWith('.blob.vercel-storage.com');
+    } catch  {
+        return false;
+    }
+}
+/**
+ * Fetches a Vercel Blob URL with the Bearer token attached when the host belongs to Vercel Blob.
+ * Works transparently for public stores (token is ignored) and private stores (token is required).
+ * Tokens are never sent to non-Vercel hosts.
+ */ async function fetchBackupBlobUrl(url, token) {
+    const init = token && isVercelBlobHost(url) ? {
+        headers: {
+            authorization: `Bearer ${token}`
+        }
+    } : undefined;
+    return fetch(url, init);
+}
+/**
+ * Opens a readable stream for a backup object (public or private). Prefers the `downloadUrl` /
+ * `blobUrl` returned by `list()` because Vercel Blob already encodes the pathname correctly there
+ * (some legacy backups store literal `%2F` sequences inside the pathname, which the SDK's
+ * pathname-to-URL construction would misinterpret).
+ */ export async function streamBackupBlobForDownload(options) {
+    const { blobUrl, downloadUrl, pathname, token } = options;
+    const candidates = [];
+    if (downloadUrl && isTrustedBackupBlobReference(downloadUrl, pathname)) {
+        candidates.push(downloadUrl);
+    }
+    if (blobUrl && isTrustedBackupBlobReference(blobUrl, pathname)) {
+        candidates.push(blobUrl);
+    }
+    for (const target of candidates){
+        try {
+            const res = await fetchBackupBlobUrl(target, token);
+            if (res.ok && res.body) {
+                return {
+                    contentType: res.headers.get('content-type') || 'application/octet-stream',
+                    stream: res.body
+                };
+            }
+        } catch  {
+        /* try next candidate */ }
+    }
+    return null;
+}
+export async function bufferFromWebReadableStream(stream) {
+    const reader = stream.getReader();
+    const chunks = [];
+    while(true){
+        const { done, value } = await reader.read();
+        if (done) {
+            break;
+        }
+        if (value) {
+            chunks.push(Buffer.from(value));
+        }
+    }
+    return Buffer.concat(chunks);
+}
+/**
+ * Read a backup blob using the trusted `downloadUrl` returned by `list()`. The Bearer token is
+ * always attached for Vercel Blob hosts; this works for public blobs (token ignored) and is
+ * required for private blobs.
+ */ export async function readBackupBlobContent(options) {
+    const { downloadUrl, pathname, token } = options;
+    const res = await fetchBackupBlobUrl(downloadUrl, token);
+    if (res.ok) {
+        return Buffer.from(await res.arrayBuffer());
+    }
+    throw new Error(`Failed to read backup blob (${pathname}): HTTP ${res.status}`);
+}
+/**
+ * Flexible read used during restore/preview/transfer where the source store visibility may differ
+ * from the new one. Always tries authenticated access first (correct for private stores and
+ * harmless for public ones). Falls back to anonymous fetch only when the URL is not a Vercel
+ * Blob URL, so tokens never leak to arbitrary hosts.
+ */ export async function readBackupBlobContentFlexible(pathname, downloadUrl, token, _sourceAccessHint) {
+    try {
+        const res = await fetchBackupBlobUrl(downloadUrl, token);
+        if (res.ok) {
+            return Buffer.from(await res.arrayBuffer());
+        }
+    } catch  {
+    /* try anonymous fallback */ }
+    if (!isVercelBlobHost(downloadUrl)) {
+        try {
+            const res = await fetch(downloadUrl);
+            if (res.ok) {
+                return Buffer.from(await res.arrayBuffer());
+            }
+        } catch  {
+        /* fall through to error */ }
+    }
+    throw new Error(`Failed to read backup blob ${pathname}`);
+}
+/**
+ * Uploads a backup blob with the preferred access level and transparently retries the other level
+ * if the Vercel Blob store rejects the preferred one (e.g. legacy public-only stores reject
+ * `access: 'private'`). Returns the effective access level that succeeded so callers can log/track
+ * it; throws the original error if both attempts fail.
+ */ export async function putBackupBlobContent(pathname, body, token, access) {
+    const order = access === 'private' ? [
+        'private',
+        'public'
+    ] : [
+        'public',
+        'private'
+    ];
+    let firstError;
+    for (const attempt of order){
+        try {
+            await put(pathname, body, {
+                access: attempt,
+                addRandomSuffix: false,
+                allowOverwrite: true,
+                ...token ? {
+                    token
+                } : {}
+            });
+            return attempt;
+        } catch (error) {
+            if (firstError === undefined) {
+                firstError = error;
+            }
+            if (!looksLikeAccessModeMismatch(error)) {
+                throw error;
+            }
+        }
+    }
+    throw firstError instanceof Error ? firstError : new Error('Failed to upload backup blob');
+}
+/** Heuristic for Vercel Blob errors that indicate the store rejects the chosen access level. */ function looksLikeAccessModeMismatch(error) {
+    const msg = error instanceof Error ? error.message : typeof error === 'string' ? error : error == null ? '' : (()=>{
+        try {
+            return JSON.stringify(error);
+        } catch  {
+            return 'unknown';
+        }
+    })();
+    const lower = msg.toLowerCase();
+    return lower.includes('access') && (lower.includes('public') || lower.includes('private') || lower.includes('not support') || lower.includes('invalid'));
+}
+
+//# sourceMappingURL=backupBlobIO.js.map

package/dist/core/backupBlobIO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/backupBlobIO.ts"],"sourcesContent":["import { put } from '@vercel/blob'\n\n/** Vercel Blob access for backup archives under `backups/`. */\nexport type BackupBlobAccessLevel = 'private' | 'public'\n\n/**\n * Returns the blob pathname (no leading slash) for a trusted Vercel Blob HTTPS URL, or null.\n * The URL's path component is percent-decoded once so the result matches the literal pathname\n * stored by Vercel Blob (e.g. blobs whose own pathname contains `%2F` are served from a URL that\n * double-encodes it to `%252F`).\n */\nexport function vercelBlobPathnameFromUrl(urlStr: string): null | string {\n  try {\n    const u = new URL(urlStr)\n    if (u.protocol !== 'https:') {return null}\n    if (!u.hostname.endsWith('.blob.vercel-storage.com')) {return null}\n    const raw = u.pathname.replace(/^\\//, '')\n    if (raw.length === 0) {return null}\n    try {\n      return decodeURIComponent(raw)\n    } catch {\n      return raw\n    }\n  } catch {\n    return null\n  }\n}\n\nexport function isTrustedBackupBlobReference(urlStr: string, expectedPathname: string): boolean {\n  const fromUrl = vercelBlobPathnameFromUrl(urlStr)\n  return Boolean(fromUrl && fromUrl === expectedPathname)\n}\n\n/** True when the URL points to any Vercel Blob host (public or private). */\nfunction isVercelBlobHost(urlStr: string): boolean {\n  try {\n    const u = new URL(urlStr)\n    return u.protocol === 'https:' && u.hostname.endsWith('.blob.vercel-storage.com')\n  } catch {\n    return false\n  }\n}\n\n/**\n * Fetches a Vercel Blob URL with the Bearer token attached when the host belongs to Vercel Blob.\n * Works transparently for public stores (token is ignored) and private stores (token is required).\n * Tokens are never sent to non-Vercel hosts.\n */\nasync function fetchBackupBlobUrl(url: string, token: string): Promise<Response> {\n  const init: RequestInit | undefined =\n    token && isVercelBlobHost(url)\n      ? { headers: { authorization: `Bearer ${token}` } }\n      : undefined\n  return fetch(url, init)\n}\n\nexport type BackupBlobDownloadStream = {\n  contentType: string\n  stream: ReadableStream<Uint8Array>\n}\n\n/**\n * Opens a readable stream for a backup object (public or private). Prefers the `downloadUrl` /\n * `blobUrl` returned by `list()` because Vercel Blob already encodes the pathname correctly there\n * (some legacy backups store literal `%2F` sequences inside the pathname, which the SDK's\n * pathname-to-URL construction would misinterpret).\n */\nexport async function streamBackupBlobForDownload(options: {\n  blobUrl?: null | string\n  downloadUrl?: null | string\n  pathname: string\n  preferredAccess: BackupBlobAccessLevel\n  token: string\n}): Promise<BackupBlobDownloadStream | null> {\n  const { blobUrl, downloadUrl, pathname, token } = options\n  const candidates: string[] = []\n  if (downloadUrl && isTrustedBackupBlobReference(downloadUrl, pathname)) {\n    candidates.push(downloadUrl)\n  }\n  if (blobUrl && isTrustedBackupBlobReference(blobUrl, pathname)) {\n    candidates.push(blobUrl)\n  }\n\n  for (const target of candidates) {\n    try {\n      const res = await fetchBackupBlobUrl(target, token)\n      if (res.ok && res.body) {\n        return {\n          contentType: res.headers.get('content-type') || 'application/octet-stream',\n          stream: res.body,\n        }\n      }\n    } catch {\n      /* try next candidate */\n    }\n  }\n\n  return null\n}\n\nexport async function bufferFromWebReadableStream(\n  stream: ReadableStream<Uint8Array>,\n): Promise<Buffer> {\n  const reader = stream.getReader()\n  const chunks: Buffer[] = []\n  while (true) {\n    const { done, value } = await reader.read()\n    if (done) {break}\n    if (value) {chunks.push(Buffer.from(value))}\n  }\n  return Buffer.concat(chunks)\n}\n\n/**\n * Read a backup blob using the trusted `downloadUrl` returned by `list()`. The Bearer token is\n * always attached for Vercel Blob hosts; this works for public blobs (token ignored) and is\n * required for private blobs.\n */\nexport async function readBackupBlobContent(options: {\n  /** Kept for API compatibility — the fetch path is the same for public and private stores. */\n  access: BackupBlobAccessLevel\n  downloadUrl: string\n  pathname: string\n  token: string\n}): Promise<Buffer> {\n  const { downloadUrl, pathname, token } = options\n  const res = await fetchBackupBlobUrl(downloadUrl, token)\n  if (res.ok) {\n    return Buffer.from(await res.arrayBuffer())\n  }\n  throw new Error(`Failed to read backup blob (${pathname}): HTTP ${res.status}`)\n}\n\n/**\n * Flexible read used during restore/preview/transfer where the source store visibility may differ\n * from the new one. Always tries authenticated access first (correct for private stores and\n * harmless for public ones). Falls back to anonymous fetch only when the URL is not a Vercel\n * Blob URL, so tokens never leak to arbitrary hosts.\n */\nexport async function readBackupBlobContentFlexible(\n  pathname: string,\n  downloadUrl: string,\n  token: string,\n  _sourceAccessHint?: BackupBlobAccessLevel,\n): Promise<Buffer> {\n  try {\n    const res = await fetchBackupBlobUrl(downloadUrl, token)\n    if (res.ok) {return Buffer.from(await res.arrayBuffer())}\n  } catch {\n    /* try anonymous fallback */\n  }\n\n  if (!isVercelBlobHost(downloadUrl)) {\n    try {\n      const res = await fetch(downloadUrl)\n      if (res.ok) {return Buffer.from(await res.arrayBuffer())}\n    } catch {\n      /* fall through to error */\n    }\n  }\n\n  throw new Error(`Failed to read backup blob ${pathname}`)\n}\n\n/**\n * Uploads a backup blob with the preferred access level and transparently retries the other level\n * if the Vercel Blob store rejects the preferred one (e.g. legacy public-only stores reject\n * `access: 'private'`). Returns the effective access level that succeeded so callers can log/track\n * it; throws the original error if both attempts fail.\n */\nexport async function putBackupBlobContent(\n  pathname: string,\n  body: Buffer | string | Uint8Array,\n  token: string | undefined,\n  access: BackupBlobAccessLevel,\n): Promise<BackupBlobAccessLevel> {\n  const order: BackupBlobAccessLevel[] =\n    access === 'private' ? ['private', 'public'] : ['public', 'private']\n  let firstError: unknown\n  for (const attempt of order) {\n    try {\n      await put(pathname, body, {\n        access: attempt,\n        addRandomSuffix: false,\n        allowOverwrite: true,\n        ...(token ? { token } : {}),\n      })\n      return attempt\n    } catch (error) {\n      if (firstError === undefined) {firstError = error}\n      if (!looksLikeAccessModeMismatch(error)) {throw error}\n    }\n  }\n  throw firstError instanceof Error ? firstError : new Error('Failed to upload backup blob')\n}\n\n/** Heuristic for Vercel Blob errors that indicate the store rejects the chosen access level. */\nfunction looksLikeAccessModeMismatch(error: unknown): boolean {\n  const msg =\n    error instanceof Error\n      ? error.message\n      : typeof error === 'string'\n        ? error\n        : error == null\n          ? ''\n          : (() => {\n              try {\n                return JSON.stringify(error)\n              } catch {\n                return 'unknown'\n              }\n            })()\n  const lower = msg.toLowerCase()\n  return (\n    lower.includes('access') &&\n    (lower.includes('public') ||\n      lower.includes('private') ||\n      lower.includes('not support') ||\n      lower.includes('invalid'))\n  )\n}\n"],"names":["put","vercelBlobPathnameFromUrl","urlStr","u","URL","protocol","hostname","endsWith","raw","pathname","replace","length","decodeURIComponent","isTrustedBackupBlobReference","expectedPathname","fromUrl","Boolean","isVercelBlobHost","fetchBackupBlobUrl","url","token","init","headers","authorization","undefined","fetch","streamBackupBlobForDownload","options","blobUrl","downloadUrl","candidates","push","target","res","ok","body","contentType","get","stream","bufferFromWebReadableStream","reader","getReader","chunks","done","value","read","Buffer","from","concat","readBackupBlobContent","arrayBuffer","Error","status","readBackupBlobContentFlexible","_sourceAccessHint","putBackupBlobContent","access","order","firstError","attempt","addRandomSuffix","allowOverwrite","error","looksLikeAccessModeMismatch","msg","message","JSON","stringify","lower","toLowerCase","includes"],"mappings":"AAAA,SAASA,GAAG,QAAQ,eAAc;AAKlC;;;;;CAKC,GACD,OAAO,SAASC,0BAA0BC,MAAc;IACtD,IAAI;QACF,MAAMC,IAAI,IAAIC,IAAIF;QAClB,IAAIC,EAAEE,QAAQ,KAAK,UAAU;YAAC,OAAO;QAAI;QACzC,IAAI,CAACF,EAAEG,QAAQ,CAACC,QAAQ,CAAC,6BAA6B;YAAC,OAAO;QAAI;QAClE,MAAMC,MAAML,EAAEM,QAAQ,CAACC,OAAO,CAAC,OAAO;QACtC,IAAIF,IAAIG,MAAM,KAAK,GAAG;YAAC,OAAO;QAAI;QAClC,IAAI;YACF,OAAOC,mBAAmBJ;QAC5B,EAAE,OAAM;YACN,OAAOA;QACT;IACF,EAAE,OAAM;QACN,OAAO;IACT;AACF;AAEA,OAAO,SAASK,6BAA6BX,MAAc,EAAEY,gBAAwB;IACnF,MAAMC,UAAUd,0BAA0BC;IAC1C,OAAOc,QAAQD,WAAWA,YAAYD;AACxC;AAEA,0EAA0E,GAC1E,SAASG,iBAAiBf,MAAc;IACtC,IAAI;QACF,MAAMC,IAAI,IAAIC,IAAIF;QAClB,OAAOC,EAAEE,QAAQ,KAAK,YAAYF,EAAEG,QAAQ,CAACC,QAAQ,CAAC;IACxD,EAAE,OAAM;QACN,OAAO;IACT;AACF;AAEA;;;;CAIC,GACD,eAAeW,mBAAmBC,GAAW,EAAEC,KAAa;IAC1D,MAAMC,OACJD,SAASH,iBAAiBE,OACtB;QAAEG,SAAS;YAAEC,eAAe,CAAC,OAAO,EAAEH,OAAO;QAAC;IAAE,IAChDI;IACN,OAAOC,MAAMN,KAAKE;AACpB;AAOA;;;;;CAKC,GACD,OAAO,eAAeK,4BAA4BC,OAMjD;IACC,MAAM,EAAEC,OAAO,EAAEC,WAAW,EAAEpB,QAAQ,EAAEW,KAAK,EAAE,GAAGO;IAClD,MAAMG,aAAuB,EAAE;IAC/B,IAAID,eAAehB,6BAA6BgB,aAAapB,WAAW;QACtEqB,WAAWC,IAAI,CAACF;IAClB;IACA,IAAID,WAAWf,6BAA6Be,SAASnB,WAAW;QAC9DqB,WAAWC,IAAI,CAACH;IAClB;IAEA,KAAK,MAAMI,UAAUF,WAAY;QAC/B,IAAI;YACF,MAAMG,MAAM,MAAMf,mBAAmBc,QAAQZ;YAC7C,IAAIa,IAAIC,EAAE,IAAID,IAAIE,IAAI,EAAE;gBACtB,OAAO;oBACLC,aAAaH,IAAIX,OAAO,CAACe,GAAG,CAAC,mBAAmB;oBAChDC,QAAQL,IAAIE,IAAI;gBAClB;YACF;QACF,EAAE,OAAM;QACN,sBAAsB,GACxB;IACF;IAEA,OAAO;AACT;AAEA,OAAO,eAAeI,4BACpBD,MAAkC;IAElC,MAAME,SAASF,OAAOG,SAAS;IAC/B,MAAMC,SAAmB,EAAE;IAC3B,MAAO,KAAM;QACX,MAAM,EAAEC,IAAI,EAAEC,KAAK,EAAE,GAAG,MAAMJ,OAAOK,IAAI;QACzC,IAAIF,MAAM;YAAC;QAAK;QAChB,IAAIC,OAAO;YAACF,OAAOX,IAAI,CAACe,OAAOC,IAAI,CAACH;QAAO;IAC7C;IACA,OAAOE,OAAOE,MAAM,CAACN;AACvB;AAEA;;;;CAIC,GACD,OAAO,eAAeO,sBAAsBtB,OAM3C;IACC,MAAM,EAAEE,WAAW,EAAEpB,QAAQ,EAAEW,KAAK,EAAE,GAAGO;IACzC,MAAMM,MAAM,MAAMf,mBAAmBW,aAAaT;IAClD,IAAIa,IAAIC,EAAE,EAAE;QACV,OAAOY,OAAOC,IAAI,CAAC,MAAMd,IAAIiB,WAAW;IAC1C;IACA,MAAM,IAAIC,MAAM,CAAC,4BAA4B,EAAE1C,SAAS,QAAQ,EAAEwB,IAAImB,MAAM,EAAE;AAChF;AAEA;;;;;CAKC,GACD,OAAO,eAAeC,8BACpB5C,QAAgB,EAChBoB,WAAmB,EACnBT,KAAa,EACbkC,iBAAyC;IAEzC,IAAI;QACF,MAAMrB,MAAM,MAAMf,mBAAmBW,aAAaT;QAClD,IAAIa,IAAIC,EAAE,EAAE;YAAC,OAAOY,OAAOC,IAAI,CAAC,MAAMd,IAAIiB,WAAW;QAAG;IAC1D,EAAE,OAAM;IACN,0BAA0B,GAC5B;IAEA,IAAI,CAACjC,iBAAiBY,cAAc;QAClC,IAAI;YACF,MAAMI,MAAM,MAAMR,MAAMI;YACxB,IAAII,IAAIC,EAAE,EAAE;gBAAC,OAAOY,OAAOC,IAAI,CAAC,MAAMd,IAAIiB,WAAW;YAAG;QAC1D,EAAE,OAAM;QACN,yBAAyB,GAC3B;IACF;IAEA,MAAM,IAAIC,MAAM,CAAC,2BAA2B,EAAE1C,UAAU;AAC1D;AAEA;;;;;CAKC,GACD,OAAO,eAAe8C,qBACpB9C,QAAgB,EAChB0B,IAAkC,EAClCf,KAAyB,EACzBoC,MAA6B;IAE7B,MAAMC,QACJD,WAAW,YAAY;QAAC;QAAW;KAAS,GAAG;QAAC;QAAU;KAAU;IACtE,IAAIE;IACJ,KAAK,MAAMC,WAAWF,MAAO;QAC3B,IAAI;YACF,MAAMzD,IAAIS,UAAU0B,MAAM;gBACxBqB,QAAQG;gBACRC,iBAAiB;gBACjBC,gBAAgB;gBAChB,GAAIzC,QAAQ;oBAAEA;gBAAM,IAAI,CAAC,CAAC;YAC5B;YACA,OAAOuC;QACT,EAAE,OAAOG,OAAO;YACd,IAAIJ,eAAelC,WAAW;gBAACkC,aAAaI;YAAK;YACjD,IAAI,CAACC,4BAA4BD,QAAQ;gBAAC,MAAMA;YAAK;QACvD;IACF;IACA,MAAMJ,sBAAsBP,QAAQO,aAAa,IAAIP,MAAM;AAC7D;AAEA,8FAA8F,GAC9F,SAASY,4BAA4BD,KAAc;IACjD,MAAME,MACJF,iBAAiBX,QACbW,MAAMG,OAAO,GACb,OAAOH,UAAU,WACfA,QACAA,SAAS,OACP,KACA,AAAC,CAAA;QACC,IAAI;YACF,OAAOI,KAAKC,SAAS,CAACL;QACxB,EAAE,OAAM;YACN,OAAO;QACT;IACF,CAAA;IACV,MAAMM,QAAQJ,IAAIK,WAAW;IAC7B,OACED,MAAME,QAAQ,CAAC,aACdF,CAAAA,MAAME,QAAQ,CAAC,aACdF,MAAME,QAAQ,CAAC,cACfF,MAAME,QAAQ,CAAC,kBACfF,MAAME,QAAQ,CAAC,UAAS;AAE9B"}

package/dist/core/backupBlobTransfer.d.ts

@@ -0,0 +1,29 @@
+import type { Payload } from 'payload';
+import { type BackupBlobAccessLevel } from './backupBlobIO';
+export interface BackupBlobTransferProgress {
+    failed: number;
+    index: number;
+    pathname: string;
+    total: number;
+    transferred: number;
+}
+export interface BackupBlobTransferSummary {
+    failed: number;
+    skipped: number;
+    total: number;
+    transferred: number;
+}
+export interface TransferBackupBlobsOptions {
+    /**
+     * When true, successfully copied blobs are removed from the source store.
+     * Defaults to false so the source remains intact unless the caller opts in.
+     */
+    deleteFromSource?: boolean;
+    onProgress?: (p: BackupBlobTransferProgress) => void;
+    /** When set, prefer this access when reading from the source (token rotation). */
+    sourceAccessHint?: BackupBlobAccessLevel;
+    /** Access level for blobs written to the target store. */
+    targetAccess?: BackupBlobAccessLevel;
+    taskId?: string;
+}
+export declare function transferBackupBlobsToToken(payload: Payload, sourceToken: string, targetToken: string, options?: TransferBackupBlobsOptions): Promise<BackupBlobTransferSummary>;

package/dist/core/backupBlobTransfer.js

@@ -0,0 +1,85 @@
+import { del, list } from '@vercel/blob';
+import { putBackupBlobContent, readBackupBlobContentFlexible } from './backupBlobIO';
+import { updateBackupTask } from './taskProgress';
+function sameToken(a, b) {
+    return a.trim() !== '' && a.trim() === b.trim();
+}
+async function writeTransferProgress(payload, taskId, p) {
+    if (!taskId) {
+        return;
+    }
+    try {
+        await updateBackupTask(payload, taskId, {
+            message: JSON.stringify({
+                failed: p.failed,
+                pathname: p.pathname,
+                total: p.total,
+                transferred: p.transferred
+            }),
+            status: 'running'
+        });
+    } catch (err) {
+        payload.logger.warn({
+            err,
+            taskId
+        }, '[backup-transfer] Could not persist transfer progress');
+    }
+}
+export async function transferBackupBlobsToToken(payload, sourceToken, targetToken, options) {
+    if (sameToken(sourceToken, targetToken)) {
+        return {
+            failed: 0,
+            skipped: 0,
+            total: 0,
+            transferred: 0
+        };
+    }
+    const { blobs } = await list({
+        limit: 1000,
+        prefix: 'backups/',
+        token: sourceToken
+    });
+    const total = blobs.length;
+    let transferred = 0;
+    let failed = 0;
+    const taskId = options?.taskId;
+    const targetAccess = options?.targetAccess ?? 'public';
+    const sourceAccessHint = options?.sourceAccessHint;
+    const deleteFromSource = options?.deleteFromSource === true;
+    for(let index = 0; index < blobs.length; index += 1){
+        const blob = blobs[index];
+        try {
+            const data = await readBackupBlobContentFlexible(blob.pathname, blob.downloadUrl, sourceToken, sourceAccessHint);
+            await putBackupBlobContent(blob.pathname, data, targetToken, targetAccess);
+            if (deleteFromSource) {
+                await del(blob.url, {
+                    token: sourceToken
+                });
+            }
+            transferred += 1;
+        } catch (err) {
+            failed += 1;
+            payload.logger.error({
+                err,
+                pathname: blob.pathname
+            }, '[backup-transfer] Failed to transfer backup blob');
+        }
+        const progress = {
+            failed,
+            index,
+            pathname: blob.pathname,
+            total,
+            transferred
+        };
+        options?.onProgress?.(progress);
+        await writeTransferProgress(payload, taskId, progress);
+    }
+    return {
+        failed,
+        skipped: 0,
+        total: blobs.length,
+        transferred
+    };
+}
+
+//# sourceMappingURL=backupBlobTransfer.js.map

package/dist/core/backupBlobTransfer.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/backupBlobTransfer.ts"],"sourcesContent":["import type { Payload } from 'payload'\n\nimport { del, list } from '@vercel/blob'\n\nimport {\n  type BackupBlobAccessLevel,\n  putBackupBlobContent,\n  readBackupBlobContentFlexible,\n} from './backupBlobIO'\nimport { updateBackupTask } from './taskProgress'\n\nexport interface BackupBlobTransferProgress {\n  failed: number\n  index: number\n  pathname: string\n  total: number\n  transferred: number\n}\n\nexport interface BackupBlobTransferSummary {\n  failed: number\n  skipped: number\n  total: number\n  transferred: number\n}\n\nexport interface TransferBackupBlobsOptions {\n  /**\n   * When true, successfully copied blobs are removed from the source store.\n   * Defaults to false so the source remains intact unless the caller opts in.\n   */\n  deleteFromSource?: boolean\n  onProgress?: (p: BackupBlobTransferProgress) => void\n  /** When set, prefer this access when reading from the source (token rotation). */\n  sourceAccessHint?: BackupBlobAccessLevel\n  /** Access level for blobs written to the target store. */\n  targetAccess?: BackupBlobAccessLevel\n  taskId?: string\n}\n\nfunction sameToken(a: string, b: string): boolean {\n  return a.trim() !== '' && a.trim() === b.trim()\n}\n\nasync function writeTransferProgress(\n  payload: Payload,\n  taskId: string | undefined,\n  p: BackupBlobTransferProgress,\n): Promise<void> {\n  if (!taskId) {\n    return\n  }\n  try {\n    await updateBackupTask(payload, taskId, {\n      message: JSON.stringify({\n        failed: p.failed,\n        pathname: p.pathname,\n        total: p.total,\n        transferred: p.transferred,\n      }),\n      status: 'running',\n    })\n  } catch (err) {\n    payload.logger.warn({ err, taskId }, '[backup-transfer] Could not persist transfer progress')\n  }\n}\n\nexport async function transferBackupBlobsToToken(\n  payload: Payload,\n  sourceToken: string,\n  targetToken: string,\n  options?: TransferBackupBlobsOptions,\n): Promise<BackupBlobTransferSummary> {\n  if (sameToken(sourceToken, targetToken)) {\n    return { failed: 0, skipped: 0, total: 0, transferred: 0 }\n  }\n\n  const { blobs } = await list({\n    limit: 1000,\n    prefix: 'backups/',\n    token: sourceToken,\n  })\n\n  const total = blobs.length\n  let transferred = 0\n  let failed = 0\n  const taskId = options?.taskId\n  const targetAccess: BackupBlobAccessLevel = options?.targetAccess ?? 'public'\n  const sourceAccessHint = options?.sourceAccessHint\n  const deleteFromSource = options?.deleteFromSource === true\n\n  for (let index = 0; index < blobs.length; index += 1) {\n    const blob = blobs[index]\n    try {\n      const data = await readBackupBlobContentFlexible(\n        blob.pathname,\n        blob.downloadUrl,\n        sourceToken,\n        sourceAccessHint,\n      )\n\n      await putBackupBlobContent(blob.pathname, data, targetToken, targetAccess)\n      if (deleteFromSource) {\n        await del(blob.url, { token: sourceToken })\n      }\n      transferred += 1\n    } catch (err) {\n      failed += 1\n      payload.logger.error(\n        { err, pathname: blob.pathname },\n        '[backup-transfer] Failed to transfer backup blob',\n      )\n    }\n\n    const progress: BackupBlobTransferProgress = {\n      failed,\n      index,\n      pathname: blob.pathname,\n      total,\n      transferred,\n    }\n    options?.onProgress?.(progress)\n    await writeTransferProgress(payload, taskId, progress)\n  }\n\n  return {\n    failed,\n    skipped: 0,\n    total: blobs.length,\n    transferred,\n  }\n}\n"],"names":["del","list","putBackupBlobContent","readBackupBlobContentFlexible","updateBackupTask","sameToken","a","b","trim","writeTransferProgress","payload","taskId","p","message","JSON","stringify","failed","pathname","total","transferred","status","err","logger","warn","transferBackupBlobsToToken","sourceToken","targetToken","options","skipped","blobs","limit","prefix","token","length","targetAccess","sourceAccessHint","deleteFromSource","index","blob","data","downloadUrl","url","error","progress","onProgress"],"mappings":"AAEA,SAASA,GAAG,EAAEC,IAAI,QAAQ,eAAc;AAExC,SAEEC,oBAAoB,EACpBC,6BAA6B,QACxB,iBAAgB;AACvB,SAASC,gBAAgB,QAAQ,iBAAgB;AA+BjD,SAASC,UAAUC,CAAS,EAAEC,CAAS;IACrC,OAAOD,EAAEE,IAAI,OAAO,MAAMF,EAAEE,IAAI,OAAOD,EAAEC,IAAI;AAC/C;AAEA,eAAeC,sBACbC,OAAgB,EAChBC,MAA0B,EAC1BC,CAA6B;IAE7B,IAAI,CAACD,QAAQ;QACX;IACF;IACA,IAAI;QACF,MAAMP,iBAAiBM,SAASC,QAAQ;YACtCE,SAASC,KAAKC,SAAS,CAAC;gBACtBC,QAAQJ,EAAEI,MAAM;gBAChBC,UAAUL,EAAEK,QAAQ;gBACpBC,OAAON,EAAEM,KAAK;gBACdC,aAAaP,EAAEO,WAAW;YAC5B;YACAC,QAAQ;QACV;IACF,EAAE,OAAOC,KAAK;QACZX,QAAQY,MAAM,CAACC,IAAI,CAAC;YAAEF;YAAKV;QAAO,GAAG;IACvC;AACF;AAEA,OAAO,eAAea,2BACpBd,OAAgB,EAChBe,WAAmB,EACnBC,WAAmB,EACnBC,OAAoC;IAEpC,IAAItB,UAAUoB,aAAaC,cAAc;QACvC,OAAO;YAAEV,QAAQ;YAAGY,SAAS;YAAGV,OAAO;YAAGC,aAAa;QAAE;IAC3D;IAEA,MAAM,EAAEU,KAAK,EAAE,GAAG,MAAM5B,KAAK;QAC3B6B,OAAO;QACPC,QAAQ;QACRC,OAAOP;IACT;IAEA,MAAMP,QAAQW,MAAMI,MAAM;IAC1B,IAAId,cAAc;IAClB,IAAIH,SAAS;IACb,MAAML,SAASgB,SAAShB;IACxB,MAAMuB,eAAsCP,SAASO,gBAAgB;IACrE,MAAMC,mBAAmBR,SAASQ;IAClC,MAAMC,mBAAmBT,SAASS,qBAAqB;IAEvD,IAAK,IAAIC,QAAQ,GAAGA,QAAQR,MAAMI,MAAM,EAAEI,SAAS,EAAG;QACpD,MAAMC,OAAOT,KAAK,CAACQ,MAAM;QACzB,IAAI;YACF,MAAME,OAAO,MAAMpC,8BACjBmC,KAAKrB,QAAQ,EACbqB,KAAKE,WAAW,EAChBf,aACAU;YAGF,MAAMjC,qBAAqBoC,KAAKrB,QAAQ,EAAEsB,MAAMb,aAAaQ;YAC7D,IAAIE,kBAAkB;gBACpB,MAAMpC,IAAIsC,KAAKG,GAAG,EAAE;oBAAET,OAAOP;gBAAY;YAC3C;YACAN,eAAe;QACjB,EAAE,OAAOE,KAAK;YACZL,UAAU;YACVN,QAAQY,MAAM,CAACoB,KAAK,CAClB;gBAAErB;gBAAKJ,UAAUqB,KAAKrB,QAAQ;YAAC,GAC/B;QAEJ;QAEA,MAAM0B,WAAuC;YAC3C3B;YACAqB;YACApB,UAAUqB,KAAKrB,QAAQ;YACvBC;YACAC;QACF;QACAQ,SAASiB,aAAaD;QACtB,MAAMlC,sBAAsBC,SAASC,QAAQgC;IAC/C;IAEA,OAAO;QACL3B;QACAY,SAAS;QACTV,OAAOW,MAAMI,MAAM;QACnBd;IACF;AACF"}

package/dist/core/backupSettings.d.ts

@@ -0,0 +1,35 @@
+import type { Payload } from 'payload';
+export declare const BACKUP_SETTINGS_SLUG = "backup-settings";
+export interface ResolvedCronBackupSettings {
+    /**
+     * Validated access level of the current backup blob store, populated via
+     * `validateBackupBlobToken`. `null` when validation has never run (default token use is still
+     * treated as `public`, dedicated token without validation falls back to heuristic private).
+     */
+    backupBlobAccess: 'private' | 'public' | null;
+    backupBlobReadWriteToken: string;
+    backupsToKeep: number;
+    id: string;
+    includeMediaForCron: boolean;
+    skipMongoCollections: string[];
+}
+export declare function normalizeSkipMongoCollections(raw: unknown): string[];
+export declare function toPayloadSkipRows(names: string[]): {
+    name: string;
+}[];
+export declare function getResolvedCronBackupSettings(payload: Payload): Promise<ResolvedCronBackupSettings>;
+export declare function resolveBackupBlobToken(settings: ResolvedCronBackupSettings): string;
+/**
+ * Vercel Blob `access` for new backup archives. Prefers the detected + persisted access level from
+ * {@link validateBackupBlobToken}; otherwise heuristically treats a dedicated backup token as
+ * `private` and the default env token as `public`.
+ */
+export declare function resolveBackupBlobAccess(settings: ResolvedCronBackupSettings): 'private' | 'public';
+/**
+ * When `pathname` is sent, restore/preview read via token + flexible SDK/fetch (works for public
+ * and private blobs). Returns undefined if pathname is missing or invalid.
+ */
+export declare function resolveBackupArchiveRead(settings: ResolvedCronBackupSettings, pathname: unknown): {
+    pathname: string;
+    token: string;
+} | undefined;

package/dist/core/backupSettings.js

@@ -0,0 +1,95 @@
+export const BACKUP_SETTINGS_SLUG = 'backup-settings';
+function defaultBackupsToKeep() {
+    const n = Number(process.env.BACKUPS_TO_KEEP);
+    return Number.isFinite(n) && n > 0 ? Math.floor(n) : 10;
+}
+export function normalizeSkipMongoCollections(raw) {
+    if (!Array.isArray(raw)) {
+        return [];
+    }
+    const out = [];
+    for (const entry of raw){
+        if (typeof entry === 'string' && entry.length > 0 && entry.length < 512) {
+            out.push(entry);
+            continue;
+        }
+        if (entry && typeof entry === 'object' && 'name' in entry) {
+            const name = entry.name;
+            if (typeof name === 'string' && name.length > 0 && name.length < 512) {
+                out.push(name);
+            }
+        }
+    }
+    return out;
+}
+export function toPayloadSkipRows(names) {
+    return names.map((name)=>({
+            name
+        }));
+}
+export async function getResolvedCronBackupSettings(payload) {
+    const res = await payload.find({
+        collection: BACKUP_SETTINGS_SLUG,
+        depth: 0,
+        limit: 1,
+        overrideAccess: true
+    });
+    const doc = res.docs[0];
+    if (!doc) {
+        return {
+            id: '',
+            backupBlobAccess: null,
+            backupBlobReadWriteToken: '',
+            backupsToKeep: defaultBackupsToKeep(),
+            includeMediaForCron: true,
+            skipMongoCollections: []
+        };
+    }
+    const rawKeep = doc.backupsToKeep;
+    const backupsToKeep = typeof rawKeep === 'number' && Number.isFinite(rawKeep) ? Math.min(365, Math.max(1, Math.floor(rawKeep))) : defaultBackupsToKeep();
+    const rawAccess = typeof doc.backupBlobAccess === 'string' ? doc.backupBlobAccess : null;
+    const backupBlobAccess = rawAccess === 'public' || rawAccess === 'private' ? rawAccess : null;
+    return {
+        id: String(doc.id),
+        backupBlobAccess,
+        backupBlobReadWriteToken: typeof doc.backupBlobReadWriteToken === 'string' ? doc.backupBlobReadWriteToken : '',
+        backupsToKeep,
+        includeMediaForCron: doc.includeMediaForCron === true,
+        skipMongoCollections: normalizeSkipMongoCollections(doc.skipMongoCollections)
+    };
+}
+export function resolveBackupBlobToken(settings) {
+    const fromSettings = settings.backupBlobReadWriteToken.trim();
+    if (fromSettings.length > 0) {
+        return fromSettings;
+    }
+    return process.env.BLOB_READ_WRITE_TOKEN || '';
+}
+/**
+ * Vercel Blob `access` for new backup archives. Prefers the detected + persisted access level from
+ * {@link validateBackupBlobToken}; otherwise heuristically treats a dedicated backup token as
+ * `private` and the default env token as `public`.
+ */ export function resolveBackupBlobAccess(settings) {
+    if (settings.backupBlobAccess === 'public' || settings.backupBlobAccess === 'private') {
+        return settings.backupBlobAccess;
+    }
+    return settings.backupBlobReadWriteToken.trim().length > 0 ? 'private' : 'public';
+}
+/**
+ * When `pathname` is sent, restore/preview read via token + flexible SDK/fetch (works for public
+ * and private blobs). Returns undefined if pathname is missing or invalid.
+ */ export function resolveBackupArchiveRead(settings, pathname) {
+    if (typeof pathname !== 'string' || !pathname.startsWith('backups/')) {
+        return undefined;
+    }
+    const token = resolveBackupBlobToken(settings).trim();
+    if (!token) {
+        return undefined;
+    }
+    return {
+        pathname,
+        token
+    };
+}
+
+//# sourceMappingURL=backupSettings.js.map

package/dist/core/backupSettings.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/backupSettings.ts"],"sourcesContent":["import type { Payload } from 'payload'\n\nexport const BACKUP_SETTINGS_SLUG = 'backup-settings'\n\nexport interface ResolvedCronBackupSettings {\n  /**\n   * Validated access level of the current backup blob store, populated via\n   * `validateBackupBlobToken`. `null` when validation has never run (default token use is still\n   * treated as `public`, dedicated token without validation falls back to heuristic private).\n   */\n  backupBlobAccess: 'private' | 'public' | null\n  backupBlobReadWriteToken: string\n  backupsToKeep: number\n  id: string\n  includeMediaForCron: boolean\n  skipMongoCollections: string[]\n}\n\nfunction defaultBackupsToKeep(): number {\n  const n = Number(process.env.BACKUPS_TO_KEEP)\n  return Number.isFinite(n) && n > 0 ? Math.floor(n) : 10\n}\n\nexport function normalizeSkipMongoCollections(raw: unknown): string[] {\n  if (!Array.isArray(raw)) {return []}\n  const out: string[] = []\n  for (const entry of raw) {\n    if (typeof entry === 'string' && entry.length > 0 && entry.length < 512) {\n      out.push(entry)\n      continue\n    }\n    if (entry && typeof entry === 'object' && 'name' in entry) {\n      const name = (entry as { name?: unknown }).name\n      if (typeof name === 'string' && name.length > 0 && name.length < 512) {out.push(name)}\n    }\n  }\n  return out\n}\n\nexport function toPayloadSkipRows(names: string[]): { name: string }[] {\n  return names.map((name) => ({ name }))\n}\n\nexport async function getResolvedCronBackupSettings(\n  payload: Payload,\n): Promise<ResolvedCronBackupSettings> {\n  const res = await payload.find({\n    collection: BACKUP_SETTINGS_SLUG,\n    depth: 0,\n    limit: 1,\n    overrideAccess: true,\n  })\n  const doc = res.docs[0] as unknown as Record<string, unknown> | undefined\n  if (!doc) {\n    return {\n      id: '',\n      backupBlobAccess: null,\n      backupBlobReadWriteToken: '',\n      backupsToKeep: defaultBackupsToKeep(),\n      includeMediaForCron: true,\n      skipMongoCollections: [],\n    }\n  }\n  const rawKeep = doc.backupsToKeep\n  const backupsToKeep =\n    typeof rawKeep === 'number' && Number.isFinite(rawKeep)\n      ? Math.min(365, Math.max(1, Math.floor(rawKeep)))\n      : defaultBackupsToKeep()\n\n  const rawAccess = typeof doc.backupBlobAccess === 'string' ? doc.backupBlobAccess : null\n  const backupBlobAccess: 'private' | 'public' | null =\n    rawAccess === 'public' || rawAccess === 'private' ? rawAccess : null\n\n  return {\n    id: String(doc.id),\n    backupBlobAccess,\n    backupBlobReadWriteToken:\n      typeof doc.backupBlobReadWriteToken === 'string' ? doc.backupBlobReadWriteToken : '',\n    backupsToKeep,\n    includeMediaForCron: doc.includeMediaForCron === true,\n    skipMongoCollections: normalizeSkipMongoCollections(doc.skipMongoCollections),\n  }\n}\n\nexport function resolveBackupBlobToken(settings: ResolvedCronBackupSettings): string {\n  const fromSettings = settings.backupBlobReadWriteToken.trim()\n  if (fromSettings.length > 0) {return fromSettings}\n  return process.env.BLOB_READ_WRITE_TOKEN || ''\n}\n\n/**\n * Vercel Blob `access` for new backup archives. Prefers the detected + persisted access level from\n * {@link validateBackupBlobToken}; otherwise heuristically treats a dedicated backup token as\n * `private` and the default env token as `public`.\n */\nexport function resolveBackupBlobAccess(\n  settings: ResolvedCronBackupSettings,\n): 'private' | 'public' {\n  if (settings.backupBlobAccess === 'public' || settings.backupBlobAccess === 'private') {\n    return settings.backupBlobAccess\n  }\n  return settings.backupBlobReadWriteToken.trim().length > 0 ? 'private' : 'public'\n}\n\n/**\n * When `pathname` is sent, restore/preview read via token + flexible SDK/fetch (works for public\n * and private blobs). Returns undefined if pathname is missing or invalid.\n */\nexport function resolveBackupArchiveRead(\n  settings: ResolvedCronBackupSettings,\n  pathname: unknown,\n): { pathname: string; token: string } | undefined {\n  if (typeof pathname !== 'string' || !pathname.startsWith('backups/')) {return undefined}\n  const token = resolveBackupBlobToken(settings).trim()\n  if (!token) {return undefined}\n  return { pathname, token }\n}\n"],"names":["BACKUP_SETTINGS_SLUG","defaultBackupsToKeep","n","Number","process","env","BACKUPS_TO_KEEP","isFinite","Math","floor","normalizeSkipMongoCollections","raw","Array","isArray","out","entry","length","push","name","toPayloadSkipRows","names","map","getResolvedCronBackupSettings","payload","res","find","collection","depth","limit","overrideAccess","doc","docs","id","backupBlobAccess","backupBlobReadWriteToken","backupsToKeep","includeMediaForCron","skipMongoCollections","rawKeep","min","max","rawAccess","String","resolveBackupBlobToken","settings","fromSettings","trim","BLOB_READ_WRITE_TOKEN","resolveBackupBlobAccess","resolveBackupArchiveRead","pathname","startsWith","undefined","token"],"mappings":"AAEA,OAAO,MAAMA,uBAAuB,kBAAiB;AAgBrD,SAASC;IACP,MAAMC,IAAIC,OAAOC,QAAQC,GAAG,CAACC,eAAe;IAC5C,OAAOH,OAAOI,QAAQ,CAACL,MAAMA,IAAI,IAAIM,KAAKC,KAAK,CAACP,KAAK;AACvD;AAEA,OAAO,SAASQ,8BAA8BC,GAAY;IACxD,IAAI,CAACC,MAAMC,OAAO,CAACF,MAAM;QAAC,OAAO,EAAE;IAAA;IACnC,MAAMG,MAAgB,EAAE;IACxB,KAAK,MAAMC,SAASJ,IAAK;QACvB,IAAI,OAAOI,UAAU,YAAYA,MAAMC,MAAM,GAAG,KAAKD,MAAMC,MAAM,GAAG,KAAK;YACvEF,IAAIG,IAAI,CAACF;YACT;QACF;QACA,IAAIA,SAAS,OAAOA,UAAU,YAAY,UAAUA,OAAO;YACzD,MAAMG,OAAO,AAACH,MAA6BG,IAAI;YAC/C,IAAI,OAAOA,SAAS,YAAYA,KAAKF,MAAM,GAAG,KAAKE,KAAKF,MAAM,GAAG,KAAK;gBAACF,IAAIG,IAAI,CAACC;YAAK;QACvF;IACF;IACA,OAAOJ;AACT;AAEA,OAAO,SAASK,kBAAkBC,KAAe;IAC/C,OAAOA,MAAMC,GAAG,CAAC,CAACH,OAAU,CAAA;YAAEA;QAAK,CAAA;AACrC;AAEA,OAAO,eAAeI,8BACpBC,OAAgB;IAEhB,MAAMC,MAAM,MAAMD,QAAQE,IAAI,CAAC;QAC7BC,YAAY1B;QACZ2B,OAAO;QACPC,OAAO;QACPC,gBAAgB;IAClB;IACA,MAAMC,MAAMN,IAAIO,IAAI,CAAC,EAAE;IACvB,IAAI,CAACD,KAAK;QACR,OAAO;YACLE,IAAI;YACJC,kBAAkB;YAClBC,0BAA0B;YAC1BC,eAAelC;YACfmC,qBAAqB;YACrBC,sBAAsB,EAAE;QAC1B;IACF;IACA,MAAMC,UAAUR,IAAIK,aAAa;IACjC,MAAMA,gBACJ,OAAOG,YAAY,YAAYnC,OAAOI,QAAQ,CAAC+B,WAC3C9B,KAAK+B,GAAG,CAAC,KAAK/B,KAAKgC,GAAG,CAAC,GAAGhC,KAAKC,KAAK,CAAC6B,aACrCrC;IAEN,MAAMwC,YAAY,OAAOX,IAAIG,gBAAgB,KAAK,WAAWH,IAAIG,gBAAgB,GAAG;IACpF,MAAMA,mBACJQ,cAAc,YAAYA,cAAc,YAAYA,YAAY;IAElE,OAAO;QACLT,IAAIU,OAAOZ,IAAIE,EAAE;QACjBC;QACAC,0BACE,OAAOJ,IAAII,wBAAwB,KAAK,WAAWJ,IAAII,wBAAwB,GAAG;QACpFC;QACAC,qBAAqBN,IAAIM,mBAAmB,KAAK;QACjDC,sBAAsB3B,8BAA8BoB,IAAIO,oBAAoB;IAC9E;AACF;AAEA,OAAO,SAASM,uBAAuBC,QAAoC;IACzE,MAAMC,eAAeD,SAASV,wBAAwB,CAACY,IAAI;IAC3D,IAAID,aAAa7B,MAAM,GAAG,GAAG;QAAC,OAAO6B;IAAY;IACjD,OAAOzC,QAAQC,GAAG,CAAC0C,qBAAqB,IAAI;AAC9C;AAEA;;;;CAIC,GACD,OAAO,SAASC,wBACdJ,QAAoC;IAEpC,IAAIA,SAASX,gBAAgB,KAAK,YAAYW,SAASX,gBAAgB,KAAK,WAAW;QACrF,OAAOW,SAASX,gBAAgB;IAClC;IACA,OAAOW,SAASV,wBAAwB,CAACY,IAAI,GAAG9B,MAAM,GAAG,IAAI,YAAY;AAC3E;AAEA;;;CAGC,GACD,OAAO,SAASiC,yBACdL,QAAoC,EACpCM,QAAiB;IAEjB,IAAI,OAAOA,aAAa,YAAY,CAACA,SAASC,UAAU,CAAC,aAAa;QAAC,OAAOC;IAAS;IACvF,MAAMC,QAAQV,uBAAuBC,UAAUE,IAAI;IACnD,IAAI,CAACO,OAAO;QAAC,OAAOD;IAAS;IAC7B,OAAO;QAAEF;QAAUG;IAAM;AAC3B"}

package/dist/core/backupSourcePreview.d.ts

@@ -0,0 +1,10 @@
+import type { Payload } from 'payload';
+import type { RestorePreviewGroup } from './restorePreview';
+export type BackupSourcePreviewResponse = {
+    groups: RestorePreviewGroup[];
+    /** Media docs with a filename (blob path candidates for tar backup). */
+    mediaBlobCandidates: number;
+};
+export declare function getBackupSourcePreviewForManual(payload: Payload, options?: {
+    preferredLocales?: string[];
+}): Promise<BackupSourcePreviewResponse>;

package/dist/core/backupSourcePreview.js

@@ -0,0 +1,33 @@
+import { getDb } from './db';
+import { buildCollectionPreviewGroups } from './restorePreview';
+export async function getBackupSourcePreviewForManual(payload, options = {}) {
+    const db = getDb(payload);
+    const cols = await db.listCollections().toArray();
+    const counts = {};
+    for (const { name } of cols){
+        counts[name] = await db.collection(name).countDocuments({});
+    }
+    const groups = buildCollectionPreviewGroups(payload, counts, {
+        includeEmptyCollections: true,
+        preferredLocales: options.preferredLocales,
+        sortLikeAdminNav: true
+    });
+    let mediaBlobCandidates = 0;
+    if ((counts['media'] ?? 0) > 0) {
+        mediaBlobCandidates = await db.collection('media').countDocuments({
+            filename: {
+                $exists: true,
+                $nin: [
+                    null,
+                    ''
+                ]
+            }
+        });
+    }
+    return {
+        groups,
+        mediaBlobCandidates
+    };
+}
+
+//# sourceMappingURL=backupSourcePreview.js.map

package/dist/core/backupSourcePreview.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/backupSourcePreview.ts"],"sourcesContent":["import type { Payload } from 'payload'\n\nimport type { RestorePreviewGroup } from './restorePreview'\n\nimport { getDb } from './db'\nimport { buildCollectionPreviewGroups } from './restorePreview'\n\nexport type BackupSourcePreviewResponse = {\n  groups: RestorePreviewGroup[]\n  /** Media docs with a filename (blob path candidates for tar backup). */\n  mediaBlobCandidates: number\n}\n\nexport async function getBackupSourcePreviewForManual(\n  payload: Payload,\n  options: { preferredLocales?: string[] } = {},\n): Promise<BackupSourcePreviewResponse> {\n  const db = getDb(payload)\n  const cols = await db.listCollections().toArray()\n  const counts: Record<string, number> = {}\n  for (const { name } of cols) {\n    counts[name] = await db.collection(name).countDocuments({})\n  }\n\n  const groups = buildCollectionPreviewGroups(payload, counts, {\n    includeEmptyCollections: true,\n    preferredLocales: options.preferredLocales,\n    sortLikeAdminNav: true,\n  })\n\n  let mediaBlobCandidates = 0\n  if ((counts['media'] ?? 0) > 0) {\n    mediaBlobCandidates = await db.collection('media').countDocuments({\n      filename: { $exists: true, $nin: [null, ''] },\n    })\n  }\n\n  return { groups, mediaBlobCandidates }\n}\n"],"names":["getDb","buildCollectionPreviewGroups","getBackupSourcePreviewForManual","payload","options","db","cols","listCollections","toArray","counts","name","collection","countDocuments","groups","includeEmptyCollections","preferredLocales","sortLikeAdminNav","mediaBlobCandidates","filename","$exists","$nin"],"mappings":"AAIA,SAASA,KAAK,QAAQ,OAAM;AAC5B,SAASC,4BAA4B,QAAQ,mBAAkB;AAQ/D,OAAO,eAAeC,gCACpBC,OAAgB,EAChBC,UAA2C,CAAC,CAAC;IAE7C,MAAMC,KAAKL,MAAMG;IACjB,MAAMG,OAAO,MAAMD,GAAGE,eAAe,GAAGC,OAAO;IAC/C,MAAMC,SAAiC,CAAC;IACxC,KAAK,MAAM,EAAEC,IAAI,EAAE,IAAIJ,KAAM;QAC3BG,MAAM,CAACC,KAAK,GAAG,MAAML,GAAGM,UAAU,CAACD,MAAME,cAAc,CAAC,CAAC;IAC3D;IAEA,MAAMC,SAASZ,6BAA6BE,SAASM,QAAQ;QAC3DK,yBAAyB;QACzBC,kBAAkBX,QAAQW,gBAAgB;QAC1CC,kBAAkB;IACpB;IAEA,IAAIC,sBAAsB;IAC1B,IAAI,AAACR,CAAAA,MAAM,CAAC,QAAQ,IAAI,CAAA,IAAK,GAAG;QAC9BQ,sBAAsB,MAAMZ,GAAGM,UAAU,CAAC,SAASC,cAAc,CAAC;YAChEM,UAAU;gBAAEC,SAAS;gBAAMC,MAAM;oBAAC;oBAAM;iBAAG;YAAC;QAC9C;IACF;IAEA,OAAO;QAAEP;QAAQI;IAAoB;AACvC"}

package/dist/core/blobTokenValidate.d.ts

@@ -0,0 +1,14 @@
+import type { BackupBlobAccessLevel } from './backupBlobIO';
+export interface BackupBlobTokenValidation {
+    /** Detected access level the store accepts (set when ok). */
+    access?: BackupBlobAccessLevel;
+    /** Short error description when validation fails. */
+    error?: string;
+    ok: boolean;
+}
+/**
+ * Probes a Vercel Blob read/write token by uploading a tiny file and deleting it afterwards. Tries
+ * `private` first and falls back to `public` so the caller sees which access modes the store
+ * accepts. Non-access errors (auth, network, quota…) are reported as invalid.
+ */
+export declare function validateBackupBlobToken(token: string): Promise<BackupBlobTokenValidation>;

package/dist/core/blobTokenValidate.js

@@ -0,0 +1,75 @@
+import { del, put } from '@vercel/blob';
+const PROBE_PATH_PREFIX = 'backups/.backup-mongodb-probe-';
+function looksLikeAccessModeRejection(error) {
+    const msg = error instanceof Error ? error.message : typeof error === 'string' ? error : error == null ? '' : (()=>{
+        try {
+            return JSON.stringify(error);
+        } catch  {
+            return 'unknown';
+        }
+    })();
+    const lower = msg.toLowerCase();
+    if (!lower.includes('access')) {
+        return false;
+    }
+    return lower.includes('public') || lower.includes('private') || lower.includes('not support') || lower.includes('invalid');
+}
+/**
+ * Probes a Vercel Blob read/write token by uploading a tiny file and deleting it afterwards. Tries
+ * `private` first and falls back to `public` so the caller sees which access modes the store
+ * accepts. Non-access errors (auth, network, quota…) are reported as invalid.
+ */ export async function validateBackupBlobToken(token) {
+    const trimmed = token.trim();
+    if (!trimmed) {
+        return {
+            error: 'Token is empty',
+            ok: false
+        };
+    }
+    const probePath = `${PROBE_PATH_PREFIX}${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}.txt`;
+    const probeBody = 'backup-mongodb-plugin-probe';
+    let firstError;
+    for (const access of [
+        'private',
+        'public'
+    ]){
+        let uploadedUrl;
+        try {
+            const result = await put(probePath, probeBody, {
+                access,
+                addRandomSuffix: false,
+                token: trimmed
+            });
+            uploadedUrl = result?.url;
+            return {
+                access,
+                ok: true
+            };
+        } catch (error) {
+            if (firstError === undefined) {
+                firstError = error;
+            }
+            if (!looksLikeAccessModeRejection(error)) {
+                return {
+                    error: error instanceof Error ? error.message : 'Token rejected',
+                    ok: false
+                };
+            }
+        } finally{
+            if (uploadedUrl) {
+                try {
+                    await del(uploadedUrl, {
+                        token: trimmed
+                    });
+                } catch  {
+                /* best-effort cleanup */ }
+            }
+        }
+    }
+    return {
+        error: firstError instanceof Error ? firstError.message : 'Token rejected for both public and private access',
+        ok: false
+    };
+}
+
+//# sourceMappingURL=blobTokenValidate.js.map

package/dist/core/blobTokenValidate.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/blobTokenValidate.ts"],"sourcesContent":["import { del, put } from '@vercel/blob'\n\nimport type { BackupBlobAccessLevel } from './backupBlobIO'\n\nexport interface BackupBlobTokenValidation {\n  /** Detected access level the store accepts (set when ok). */\n  access?: BackupBlobAccessLevel\n  /** Short error description when validation fails. */\n  error?: string\n  ok: boolean\n}\n\nconst PROBE_PATH_PREFIX = 'backups/.backup-mongodb-probe-'\n\nfunction looksLikeAccessModeRejection(error: unknown): boolean {\n  const msg =\n    error instanceof Error\n      ? error.message\n      : typeof error === 'string'\n        ? error\n        : error == null\n          ? ''\n          : (() => {\n              try {\n                return JSON.stringify(error)\n              } catch {\n                return 'unknown'\n              }\n            })()\n  const lower = msg.toLowerCase()\n  if (!lower.includes('access')) {\n    return false\n  }\n  return (\n    lower.includes('public') ||\n    lower.includes('private') ||\n    lower.includes('not support') ||\n    lower.includes('invalid')\n  )\n}\n\n/**\n * Probes a Vercel Blob read/write token by uploading a tiny file and deleting it afterwards. Tries\n * `private` first and falls back to `public` so the caller sees which access modes the store\n * accepts. Non-access errors (auth, network, quota…) are reported as invalid.\n */\nexport async function validateBackupBlobToken(token: string): Promise<BackupBlobTokenValidation> {\n  const trimmed = token.trim()\n  if (!trimmed) {\n    return { error: 'Token is empty', ok: false }\n  }\n\n  const probePath = `${PROBE_PATH_PREFIX}${Date.now().toString(36)}-${Math.random()\n    .toString(36)\n    .slice(2, 10)}.txt`\n  const probeBody = 'backup-mongodb-plugin-probe'\n\n  let firstError: unknown\n  for (const access of ['private', 'public'] as const) {\n    let uploadedUrl: string | undefined\n    try {\n      const result = await put(probePath, probeBody, {\n        access,\n        addRandomSuffix: false,\n        token: trimmed,\n      })\n      uploadedUrl = result?.url\n      return { access, ok: true }\n    } catch (error) {\n      if (firstError === undefined) {\n        firstError = error\n      }\n      if (!looksLikeAccessModeRejection(error)) {\n        return { error: error instanceof Error ? error.message : 'Token rejected', ok: false }\n      }\n    } finally {\n      if (uploadedUrl) {\n        try {\n          await del(uploadedUrl, { token: trimmed })\n        } catch {\n          /* best-effort cleanup */\n        }\n      }\n    }\n  }\n\n  return {\n    error:\n      firstError instanceof Error\n        ? firstError.message\n        : 'Token rejected for both public and private access',\n    ok: false,\n  }\n}\n"],"names":["del","put","PROBE_PATH_PREFIX","looksLikeAccessModeRejection","error","msg","Error","message","JSON","stringify","lower","toLowerCase","includes","validateBackupBlobToken","token","trimmed","trim","ok","probePath","Date","now","toString","Math","random","slice","probeBody","firstError","access","uploadedUrl","result","addRandomSuffix","url","undefined"],"mappings":"AAAA,SAASA,GAAG,EAAEC,GAAG,QAAQ,eAAc;AAYvC,MAAMC,oBAAoB;AAE1B,SAASC,6BAA6BC,KAAc;IAClD,MAAMC,MACJD,iBAAiBE,QACbF,MAAMG,OAAO,GACb,OAAOH,UAAU,WACfA,QACAA,SAAS,OACP,KACA,AAAC,CAAA;QACC,IAAI;YACF,OAAOI,KAAKC,SAAS,CAACL;QACxB,EAAE,OAAM;YACN,OAAO;QACT;IACF,CAAA;IACV,MAAMM,QAAQL,IAAIM,WAAW;IAC7B,IAAI,CAACD,MAAME,QAAQ,CAAC,WAAW;QAC7B,OAAO;IACT;IACA,OACEF,MAAME,QAAQ,CAAC,aACfF,MAAME,QAAQ,CAAC,cACfF,MAAME,QAAQ,CAAC,kBACfF,MAAME,QAAQ,CAAC;AAEnB;AAEA;;;;CAIC,GACD,OAAO,eAAeC,wBAAwBC,KAAa;IACzD,MAAMC,UAAUD,MAAME,IAAI;IAC1B,IAAI,CAACD,SAAS;QACZ,OAAO;YAAEX,OAAO;YAAkBa,IAAI;QAAM;IAC9C;IAEA,MAAMC,YAAY,GAAGhB,oBAAoBiB,KAAKC,GAAG,GAAGC,QAAQ,CAAC,IAAI,CAAC,EAAEC,KAAKC,MAAM,GAC5EF,QAAQ,CAAC,IACTG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC;IACrB,MAAMC,YAAY;IAElB,IAAIC;IACJ,KAAK,MAAMC,UAAU;QAAC;QAAW;KAAS,CAAW;QACnD,IAAIC;QACJ,IAAI;YACF,MAAMC,SAAS,MAAM5B,IAAIiB,WAAWO,WAAW;gBAC7CE;gBACAG,iBAAiB;gBACjBhB,OAAOC;YACT;YACAa,cAAcC,QAAQE;YACtB,OAAO;gBAAEJ;gBAAQV,IAAI;YAAK;QAC5B,EAAE,OAAOb,OAAO;YACd,IAAIsB,eAAeM,WAAW;gBAC5BN,aAAatB;YACf;YACA,IAAI,CAACD,6BAA6BC,QAAQ;gBACxC,OAAO;oBAAEA,OAAOA,iBAAiBE,QAAQF,MAAMG,OAAO,GAAG;oBAAkBU,IAAI;gBAAM;YACvF;QACF,SAAU;YACR,IAAIW,aAAa;gBACf,IAAI;oBACF,MAAM5B,IAAI4B,aAAa;wBAAEd,OAAOC;oBAAQ;gBAC1C,EAAE,OAAM;gBACN,uBAAuB,GACzB;YACF;QACF;IACF;IAEA,OAAO;QACLX,OACEsB,sBAAsBpB,QAClBoB,WAAWnB,OAAO,GAClB;QACNU,IAAI;IACN;AACF"}