@trieb.work/payload-plugin-backup-mongodb 0.1.5 → 0.2.0

package/dist/core/restoreResult.js

@@ -0,0 +1,45 @@
+export function buildRestoreWarnings(result) {
+    const warnings = [];
+    for (const collection of result.collections){
+        if (collection.kind === 'failed') {
+            warnings.push(`Collection "${collection.name}": ${collection.error}`);
+        }
+    }
+    if (result.media && !result.media.skippedByOption) {
+        for (const failed of result.media.failed){
+            warnings.push(`Media "${failed.name}": ${failed.error}`);
+        }
+        if (result.media.accessFallbackCount > 0) {
+            warnings.push(`${result.media.accessFallbackCount} media file(s) uploaded with a fallback blob access level`);
+        }
+    }
+    return warnings;
+}
+export function formatRestoreSummary(result) {
+    const restored = result.collections.filter((c)=>c.kind === 'restored');
+    const docTotal = restored.reduce((sum, c)=>sum + (c.kind === 'restored' ? c.docCount : 0), 0);
+    const skipped = result.collections.filter((c)=>c.kind === 'skipped');
+    const failedCollections = result.collections.filter((c)=>c.kind === 'failed');
+    const parts = [
+        `Restored ${restored.length} collection${restored.length === 1 ? '' : 's'} (${docTotal} document${docTotal === 1 ? '' : 's'})`
+    ];
+    if (skipped.length > 0) {
+        parts.push(`skipped ${skipped.length} collection${skipped.length === 1 ? '' : 's'} (blacklist or empty)`);
+    }
+    if (result.media?.skippedByOption) {
+        parts.push('archive media not restored (option disabled)');
+    } else if (result.media) {
+        parts.push(`media ${result.media.restored}/${result.media.attempted} file${result.media.attempted === 1 ? '' : 's'}`);
+    }
+    const failedMedia = result.media?.failed.length ?? 0;
+    const errorCount = failedCollections.length + failedMedia;
+    if (errorCount > 0) {
+        parts.push(`${errorCount} error${errorCount === 1 ? '' : 's'} — see warnings`);
+    }
+    return parts.join('; ');
+}
+export function restoreTaskStatus(result) {
+    return buildRestoreWarnings(result).length > 0 ? 'completed_with_warnings' : 'completed';
+}
+
+//# sourceMappingURL=restoreResult.js.map

package/dist/core/restoreResult.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/restoreResult.ts"],"sourcesContent":["export type RestoreArchiveKind = 'json' | 'tar-gzip'\n\nexport type RestoreCollectionOutcome =\n  | { docCount: number; kind: 'restored'; name: string }\n  | { error: string; kind: 'failed'; name: string }\n  | { kind: 'skipped'; name: string; reason: 'blacklist' | 'empty' }\n\nexport type RestoreMediaOutcome = {\n  accessFallbackCount: number\n  attempted: number\n  failed: Array<{ error: string; name: string }>\n  restored: number\n  skippedByOption: boolean\n}\n\n/** Structured outcome of a restore run (returned to endpoints and task progress). */\nexport type RestoreBackupResult = {\n  archiveKind: RestoreArchiveKind\n  collections: RestoreCollectionOutcome[]\n  durationMs: number\n  media: null | RestoreMediaOutcome\n}\n\nexport function buildRestoreWarnings(result: RestoreBackupResult): string[] {\n  const warnings: string[] = []\n\n  for (const collection of result.collections) {\n    if (collection.kind === 'failed') {\n      warnings.push(`Collection \"${collection.name}\": ${collection.error}`)\n    }\n  }\n\n  if (result.media && !result.media.skippedByOption) {\n    for (const failed of result.media.failed) {\n      warnings.push(`Media \"${failed.name}\": ${failed.error}`)\n    }\n    if (result.media.accessFallbackCount > 0) {\n      warnings.push(\n        `${result.media.accessFallbackCount} media file(s) uploaded with a fallback blob access level`,\n      )\n    }\n  }\n\n  return warnings\n}\n\nexport function formatRestoreSummary(result: RestoreBackupResult): string {\n  const restored = result.collections.filter((c) => c.kind === 'restored')\n  const docTotal = restored.reduce((sum, c) => sum + (c.kind === 'restored' ? c.docCount : 0), 0)\n  const skipped = result.collections.filter((c) => c.kind === 'skipped')\n  const failedCollections = result.collections.filter((c) => c.kind === 'failed')\n\n  const parts: string[] = [\n    `Restored ${restored.length} collection${restored.length === 1 ? '' : 's'} (${docTotal} document${docTotal === 1 ? '' : 's'})`,\n  ]\n\n  if (skipped.length > 0) {\n    parts.push(\n      `skipped ${skipped.length} collection${skipped.length === 1 ? '' : 's'} (blacklist or empty)`,\n    )\n  }\n\n  if (result.media?.skippedByOption) {\n    parts.push('archive media not restored (option disabled)')\n  } else if (result.media) {\n    parts.push(\n      `media ${result.media.restored}/${result.media.attempted} file${result.media.attempted === 1 ? '' : 's'}`,\n    )\n  }\n\n  const failedMedia = result.media?.failed.length ?? 0\n  const errorCount = failedCollections.length + failedMedia\n  if (errorCount > 0) {\n    parts.push(`${errorCount} error${errorCount === 1 ? '' : 's'} — see warnings`)\n  }\n\n  return parts.join('; ')\n}\n\nexport function restoreTaskStatus(\n  result: RestoreBackupResult,\n): 'completed' | 'completed_with_warnings' {\n  return buildRestoreWarnings(result).length > 0 ? 'completed_with_warnings' : 'completed'\n}\n"],"names":["buildRestoreWarnings","result","warnings","collection","collections","kind","push","name","error","media","skippedByOption","failed","accessFallbackCount","formatRestoreSummary","restored","filter","c","docTotal","reduce","sum","docCount","skipped","failedCollections","parts","length","attempted","failedMedia","errorCount","join","restoreTaskStatus"],"mappings":"AAuBA,OAAO,SAASA,qBAAqBC,MAA2B;IAC9D,MAAMC,WAAqB,EAAE;IAE7B,KAAK,MAAMC,cAAcF,OAAOG,WAAW,CAAE;QAC3C,IAAID,WAAWE,IAAI,KAAK,UAAU;YAChCH,SAASI,IAAI,CAAC,CAAC,YAAY,EAAEH,WAAWI,IAAI,CAAC,GAAG,EAAEJ,WAAWK,KAAK,EAAE;QACtE;IACF;IAEA,IAAIP,OAAOQ,KAAK,IAAI,CAACR,OAAOQ,KAAK,CAACC,eAAe,EAAE;QACjD,KAAK,MAAMC,UAAUV,OAAOQ,KAAK,CAACE,MAAM,CAAE;YACxCT,SAASI,IAAI,CAAC,CAAC,OAAO,EAAEK,OAAOJ,IAAI,CAAC,GAAG,EAAEI,OAAOH,KAAK,EAAE;QACzD;QACA,IAAIP,OAAOQ,KAAK,CAACG,mBAAmB,GAAG,GAAG;YACxCV,SAASI,IAAI,CACX,GAAGL,OAAOQ,KAAK,CAACG,mBAAmB,CAAC,yDAAyD,CAAC;QAElG;IACF;IAEA,OAAOV;AACT;AAEA,OAAO,SAASW,qBAAqBZ,MAA2B;IAC9D,MAAMa,WAAWb,OAAOG,WAAW,CAACW,MAAM,CAAC,CAACC,IAAMA,EAAEX,IAAI,KAAK;IAC7D,MAAMY,WAAWH,SAASI,MAAM,CAAC,CAACC,KAAKH,IAAMG,MAAOH,CAAAA,EAAEX,IAAI,KAAK,aAAaW,EAAEI,QAAQ,GAAG,CAAA,GAAI;IAC7F,MAAMC,UAAUpB,OAAOG,WAAW,CAACW,MAAM,CAAC,CAACC,IAAMA,EAAEX,IAAI,KAAK;IAC5D,MAAMiB,oBAAoBrB,OAAOG,WAAW,CAACW,MAAM,CAAC,CAACC,IAAMA,EAAEX,IAAI,KAAK;IAEtE,MAAMkB,QAAkB;QACtB,CAAC,SAAS,EAAET,SAASU,MAAM,CAAC,WAAW,EAAEV,SAASU,MAAM,KAAK,IAAI,KAAK,IAAI,EAAE,EAAEP,SAAS,SAAS,EAAEA,aAAa,IAAI,KAAK,IAAI,CAAC,CAAC;KAC/H;IAED,IAAII,QAAQG,MAAM,GAAG,GAAG;QACtBD,MAAMjB,IAAI,CACR,CAAC,QAAQ,EAAEe,QAAQG,MAAM,CAAC,WAAW,EAAEH,QAAQG,MAAM,KAAK,IAAI,KAAK,IAAI,qBAAqB,CAAC;IAEjG;IAEA,IAAIvB,OAAOQ,KAAK,EAAEC,iBAAiB;QACjCa,MAAMjB,IAAI,CAAC;IACb,OAAO,IAAIL,OAAOQ,KAAK,EAAE;QACvBc,MAAMjB,IAAI,CACR,CAAC,MAAM,EAAEL,OAAOQ,KAAK,CAACK,QAAQ,CAAC,CAAC,EAAEb,OAAOQ,KAAK,CAACgB,SAAS,CAAC,KAAK,EAAExB,OAAOQ,KAAK,CAACgB,SAAS,KAAK,IAAI,KAAK,KAAK;IAE7G;IAEA,MAAMC,cAAczB,OAAOQ,KAAK,EAAEE,OAAOa,UAAU;IACnD,MAAMG,aAAaL,kBAAkBE,MAAM,GAAGE;IAC9C,IAAIC,aAAa,GAAG;QAClBJ,MAAMjB,IAAI,CAAC,GAAGqB,WAAW,MAAM,EAAEA,eAAe,IAAI,KAAK,IAAI,eAAe,CAAC;IAC/E;IAEA,OAAOJ,MAAMK,IAAI,CAAC;AACpB;AAEA,OAAO,SAASC,kBACd5B,MAA2B;IAE3B,OAAOD,qBAAqBC,QAAQuB,MAAM,GAAG,IAAI,4BAA4B;AAC/E"}

package/dist/core/storage/config.d.ts

@@ -0,0 +1,31 @@
+import type { BackupStorageKind } from './types';
+/**
+ * Resolved S3 configuration. Credentials are optional: when omitted, the AWS SDK's default
+ * provider chain is used (env vars `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY`, shared config,
+ * instance/role credentials, …), which is the recommended setup on AWS.
+ */
+export interface BackupS3Config {
+    accessKeyId?: string;
+    bucket: string;
+    /** Custom endpoint for S3-compatible stores (Cloudflare R2, MinIO). Omit for AWS S3. */
+    endpoint?: string;
+    /** Path-style addressing — required for MinIO and some R2 setups. Defaults true when an endpoint is set. */
+    forcePathStyle: boolean;
+    /** Optional key namespace prepended to every object key (for sharing a bucket). No trailing slash. */
+    prefix: string;
+    region: string;
+    secretAccessKey?: string;
+    sessionToken?: string;
+}
+/**
+ * Selected backup target. Precedence: explicit `override` (plugin option) → `BACKUP_STORAGE`
+ * env var → `vercel-blob` (default, so existing deployments are unaffected).
+ */
+export declare function getBackupStorageKind(override?: BackupStorageKind): BackupStorageKind;
+/** True when the S3 target has the minimum configuration (a bucket) to operate. */
+export declare function isS3Configured(): boolean;
+/**
+ * Reads S3 configuration from the environment. Throws a descriptive error when the bucket is
+ * missing so endpoints can surface a clear failure instead of an opaque SDK error.
+ */
+export declare function loadS3Config(): BackupS3Config;

package/dist/core/storage/config.js

@@ -0,0 +1,60 @@
+function env(name) {
+    const v = process.env[name];
+    if (typeof v !== 'string') {
+        return undefined;
+    }
+    const trimmed = v.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+function parseBool(raw, fallback) {
+    if (raw === undefined) {
+        return fallback;
+    }
+    return [
+        '1',
+        'on',
+        'true',
+        'yes'
+    ].includes(raw.toLowerCase());
+}
+/**
+ * Selected backup target. Precedence: explicit `override` (plugin option) → `BACKUP_STORAGE`
+ * env var → `vercel-blob` (default, so existing deployments are unaffected).
+ */ export function getBackupStorageKind(override) {
+    if (override === 's3' || override === 'vercel-blob') {
+        return override;
+    }
+    const raw = env('BACKUP_STORAGE')?.toLowerCase();
+    if (raw === 's3') {
+        return 's3';
+    }
+    return 'vercel-blob';
+}
+/** True when the S3 target has the minimum configuration (a bucket) to operate. */ export function isS3Configured() {
+    return Boolean(env('BACKUP_S3_BUCKET'));
+}
+/**
+ * Reads S3 configuration from the environment. Throws a descriptive error when the bucket is
+ * missing so endpoints can surface a clear failure instead of an opaque SDK error.
+ */ export function loadS3Config() {
+    const bucket = env('BACKUP_S3_BUCKET');
+    if (!bucket) {
+        throw new Error('BACKUP_S3_BUCKET is required when BACKUP_STORAGE=s3');
+    }
+    const endpoint = env('BACKUP_S3_ENDPOINT');
+    const rawPrefix = env('BACKUP_S3_PREFIX') ?? '';
+    const accessKeyId = env('BACKUP_S3_ACCESS_KEY_ID') ?? env('AWS_ACCESS_KEY_ID');
+    const secretAccessKey = env('BACKUP_S3_SECRET_ACCESS_KEY') ?? env('AWS_SECRET_ACCESS_KEY');
+    return {
+        accessKeyId,
+        bucket,
+        endpoint,
+        forcePathStyle: parseBool(env('BACKUP_S3_FORCE_PATH_STYLE'), Boolean(endpoint)),
+        prefix: rawPrefix.replace(/\/+$/, ''),
+        region: env('BACKUP_S3_REGION') ?? env('AWS_REGION') ?? 'us-east-1',
+        secretAccessKey,
+        sessionToken: env('BACKUP_S3_SESSION_TOKEN') ?? env('AWS_SESSION_TOKEN')
+    };
+}
+
+//# sourceMappingURL=config.js.map

package/dist/core/storage/config.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/core/storage/config.ts"],"sourcesContent":["import type { BackupStorageKind } from './types'\n\n/**\n * Resolved S3 configuration. Credentials are optional: when omitted, the AWS SDK's default\n * provider chain is used (env vars `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY`, shared config,\n * instance/role credentials, …), which is the recommended setup on AWS.\n */\nexport interface BackupS3Config {\n  accessKeyId?: string\n  bucket: string\n  /** Custom endpoint for S3-compatible stores (Cloudflare R2, MinIO). Omit for AWS S3. */\n  endpoint?: string\n  /** Path-style addressing — required for MinIO and some R2 setups. Defaults true when an endpoint is set. */\n  forcePathStyle: boolean\n  /** Optional key namespace prepended to every object key (for sharing a bucket). No trailing slash. */\n  prefix: string\n  region: string\n  secretAccessKey?: string\n  sessionToken?: string\n}\n\nfunction env(name: string): string | undefined {\n  const v = process.env[name]\n  if (typeof v !== 'string') {\n    return undefined\n  }\n  const trimmed = v.trim()\n  return trimmed.length > 0 ? trimmed : undefined\n}\n\nfunction parseBool(raw: string | undefined, fallback: boolean): boolean {\n  if (raw === undefined) {\n    return fallback\n  }\n  return ['1', 'on', 'true', 'yes'].includes(raw.toLowerCase())\n}\n\n/**\n * Selected backup target. Precedence: explicit `override` (plugin option) → `BACKUP_STORAGE`\n * env var → `vercel-blob` (default, so existing deployments are unaffected).\n */\nexport function getBackupStorageKind(override?: BackupStorageKind): BackupStorageKind {\n  if (override === 's3' || override === 'vercel-blob') {\n    return override\n  }\n  const raw = env('BACKUP_STORAGE')?.toLowerCase()\n  if (raw === 's3') {\n    return 's3'\n  }\n  return 'vercel-blob'\n}\n\n/** True when the S3 target has the minimum configuration (a bucket) to operate. */\nexport function isS3Configured(): boolean {\n  return Boolean(env('BACKUP_S3_BUCKET'))\n}\n\n/**\n * Reads S3 configuration from the environment. Throws a descriptive error when the bucket is\n * missing so endpoints can surface a clear failure instead of an opaque SDK error.\n */\nexport function loadS3Config(): BackupS3Config {\n  const bucket = env('BACKUP_S3_BUCKET')\n  if (!bucket) {\n    throw new Error('BACKUP_S3_BUCKET is required when BACKUP_STORAGE=s3')\n  }\n  const endpoint = env('BACKUP_S3_ENDPOINT')\n  const rawPrefix = env('BACKUP_S3_PREFIX') ?? ''\n  const accessKeyId = env('BACKUP_S3_ACCESS_KEY_ID') ?? env('AWS_ACCESS_KEY_ID')\n  const secretAccessKey = env('BACKUP_S3_SECRET_ACCESS_KEY') ?? env('AWS_SECRET_ACCESS_KEY')\n\n  return {\n    accessKeyId,\n    bucket,\n    endpoint,\n    forcePathStyle: parseBool(env('BACKUP_S3_FORCE_PATH_STYLE'), Boolean(endpoint)),\n    prefix: rawPrefix.replace(/\\/+$/, ''),\n    region: env('BACKUP_S3_REGION') ?? env('AWS_REGION') ?? 'us-east-1',\n    secretAccessKey,\n    sessionToken: env('BACKUP_S3_SESSION_TOKEN') ?? env('AWS_SESSION_TOKEN'),\n  }\n}\n"],"names":["env","name","v","process","undefined","trimmed","trim","length","parseBool","raw","fallback","includes","toLowerCase","getBackupStorageKind","override","isS3Configured","Boolean","loadS3Config","bucket","Error","endpoint","rawPrefix","accessKeyId","secretAccessKey","forcePathStyle","prefix","replace","region","sessionToken"],"mappings":"AAqBA,SAASA,IAAIC,IAAY;IACvB,MAAMC,IAAIC,QAAQH,GAAG,CAACC,KAAK;IAC3B,IAAI,OAAOC,MAAM,UAAU;QACzB,OAAOE;IACT;IACA,MAAMC,UAAUH,EAAEI,IAAI;IACtB,OAAOD,QAAQE,MAAM,GAAG,IAAIF,UAAUD;AACxC;AAEA,SAASI,UAAUC,GAAuB,EAAEC,QAAiB;IAC3D,IAAID,QAAQL,WAAW;QACrB,OAAOM;IACT;IACA,OAAO;QAAC;QAAK;QAAM;QAAQ;KAAM,CAACC,QAAQ,CAACF,IAAIG,WAAW;AAC5D;AAEA;;;CAGC,GACD,OAAO,SAASC,qBAAqBC,QAA4B;IAC/D,IAAIA,aAAa,QAAQA,aAAa,eAAe;QACnD,OAAOA;IACT;IACA,MAAML,MAAMT,IAAI,mBAAmBY;IACnC,IAAIH,QAAQ,MAAM;QAChB,OAAO;IACT;IACA,OAAO;AACT;AAEA,iFAAiF,GACjF,OAAO,SAASM;IACd,OAAOC,QAAQhB,IAAI;AACrB;AAEA;;;CAGC,GACD,OAAO,SAASiB;IACd,MAAMC,SAASlB,IAAI;IACnB,IAAI,CAACkB,QAAQ;QACX,MAAM,IAAIC,MAAM;IAClB;IACA,MAAMC,WAAWpB,IAAI;IACrB,MAAMqB,YAAYrB,IAAI,uBAAuB;IAC7C,MAAMsB,cAActB,IAAI,8BAA8BA,IAAI;IAC1D,MAAMuB,kBAAkBvB,IAAI,kCAAkCA,IAAI;IAElE,OAAO;QACLsB;QACAJ;QACAE;QACAI,gBAAgBhB,UAAUR,IAAI,+BAA+BgB,QAAQI;QACrEK,QAAQJ,UAAUK,OAAO,CAAC,QAAQ;QAClCC,QAAQ3B,IAAI,uBAAuBA,IAAI,iBAAiB;QACxDuB;QACAK,cAAc5B,IAAI,8BAA8BA,IAAI;IACtD;AACF"}

package/dist/core/storage/index.d.ts

@@ -0,0 +1,23 @@
+import type { BackupBlobAccessLevel } from '../backupBlobIO';
+import type { BackupStorageAdapter, BackupStorageKind } from './types';
+export type { BackupS3Config } from './config';
+export { getBackupStorageKind, isS3Configured, loadS3Config } from './config';
+export type { BackupStorageAdapter, BackupStorageKind, BackupStorageObject, BackupStorageRef, BackupStorageValidation, } from './types';
+export interface ResolveBackupStorageOptions {
+    /** Vercel Blob access level (ignored for S3). */
+    blobAccess?: BackupBlobAccessLevel;
+    /** Vercel Blob read/write token (ignored for S3). */
+    blobToken?: string;
+    /** Force a target; defaults to {@link getBackupStorageKind} (plugin option / env / vercel-blob). */
+    kind?: BackupStorageKind;
+}
+/**
+ * Builds the backup storage adapter for the active target. Vercel Blob is the default; `s3` is
+ * selected via the `BACKUP_STORAGE` env var (or plugin option) and reads `BACKUP_S3_*` config.
+ */
+export declare function resolveBackupStorage(options?: ResolveBackupStorageOptions): BackupStorageAdapter;
+/**
+ * True when the active target has enough configuration to serve requests. Used by endpoints to
+ * return 503 early: Vercel Blob needs a token; S3 needs a bucket.
+ */
+export declare function isBackupStorageConfigured(blobToken?: string): boolean;

package/dist/core/storage/index.js

@@ -0,0 +1,25 @@
+import { getBackupStorageKind, isS3Configured, loadS3Config } from './config';
+import { S3BackupStorage } from './s3';
+import { VercelBlobStorage } from './vercelBlob';
+export { getBackupStorageKind, isS3Configured, loadS3Config } from './config';
+/**
+ * Builds the backup storage adapter for the active target. Vercel Blob is the default; `s3` is
+ * selected via the `BACKUP_STORAGE` env var (or plugin option) and reads `BACKUP_S3_*` config.
+ */ export function resolveBackupStorage(options = {}) {
+    const kind = getBackupStorageKind(options.kind);
+    if (kind === 's3') {
+        return new S3BackupStorage(loadS3Config());
+    }
+    return new VercelBlobStorage({
+        access: options.blobAccess,
+        token: options.blobToken
+    });
+}
+/**
+ * True when the active target has enough configuration to serve requests. Used by endpoints to
+ * return 503 early: Vercel Blob needs a token; S3 needs a bucket.
+ */ export function isBackupStorageConfigured(blobToken) {
+    return getBackupStorageKind() === 's3' ? isS3Configured() : Boolean(blobToken?.trim());
+}
+
+//# sourceMappingURL=index.js.map

package/dist/core/storage/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/core/storage/index.ts"],"sourcesContent":["import type { BackupBlobAccessLevel } from '../backupBlobIO'\nimport type { BackupStorageAdapter, BackupStorageKind } from './types'\n\nimport { getBackupStorageKind, isS3Configured, loadS3Config } from './config'\nimport { S3BackupStorage } from './s3'\nimport { VercelBlobStorage } from './vercelBlob'\n\nexport type { BackupS3Config } from './config'\nexport { getBackupStorageKind, isS3Configured, loadS3Config } from './config'\nexport type {\n  BackupStorageAdapter,\n  BackupStorageKind,\n  BackupStorageObject,\n  BackupStorageRef,\n  BackupStorageValidation,\n} from './types'\n\nexport interface ResolveBackupStorageOptions {\n  /** Vercel Blob access level (ignored for S3). */\n  blobAccess?: BackupBlobAccessLevel\n  /** Vercel Blob read/write token (ignored for S3). */\n  blobToken?: string\n  /** Force a target; defaults to {@link getBackupStorageKind} (plugin option / env / vercel-blob). */\n  kind?: BackupStorageKind\n}\n\n/**\n * Builds the backup storage adapter for the active target. Vercel Blob is the default; `s3` is\n * selected via the `BACKUP_STORAGE` env var (or plugin option) and reads `BACKUP_S3_*` config.\n */\nexport function resolveBackupStorage(\n  options: ResolveBackupStorageOptions = {},\n): BackupStorageAdapter {\n  const kind = getBackupStorageKind(options.kind)\n  if (kind === 's3') {\n    return new S3BackupStorage(loadS3Config())\n  }\n  return new VercelBlobStorage({ access: options.blobAccess, token: options.blobToken })\n}\n\n/**\n * True when the active target has enough configuration to serve requests. Used by endpoints to\n * return 503 early: Vercel Blob needs a token; S3 needs a bucket.\n */\nexport function isBackupStorageConfigured(blobToken?: string): boolean {\n  return getBackupStorageKind() === 's3' ? isS3Configured() : Boolean(blobToken?.trim())\n}\n"],"names":["getBackupStorageKind","isS3Configured","loadS3Config","S3BackupStorage","VercelBlobStorage","resolveBackupStorage","options","kind","access","blobAccess","token","blobToken","isBackupStorageConfigured","Boolean","trim"],"mappings":"AAGA,SAASA,oBAAoB,EAAEC,cAAc,EAAEC,YAAY,QAAQ,WAAU;AAC7E,SAASC,eAAe,QAAQ,OAAM;AACtC,SAASC,iBAAiB,QAAQ,eAAc;AAGhD,SAASJ,oBAAoB,EAAEC,cAAc,EAAEC,YAAY,QAAQ,WAAU;AAkB7E;;;CAGC,GACD,OAAO,SAASG,qBACdC,UAAuC,CAAC,CAAC;IAEzC,MAAMC,OAAOP,qBAAqBM,QAAQC,IAAI;IAC9C,IAAIA,SAAS,MAAM;QACjB,OAAO,IAAIJ,gBAAgBD;IAC7B;IACA,OAAO,IAAIE,kBAAkB;QAAEI,QAAQF,QAAQG,UAAU;QAAEC,OAAOJ,QAAQK,SAAS;IAAC;AACtF;AAEA;;;CAGC,GACD,OAAO,SAASC,0BAA0BD,SAAkB;IAC1D,OAAOX,2BAA2B,OAAOC,mBAAmBY,QAAQF,WAAWG;AACjF"}

package/dist/core/storage/s3.d.ts

@@ -0,0 +1,35 @@
+import type { BackupS3Config } from './config';
+import type { BackupStorageAdapter, BackupStorageObject, BackupStorageRef, BackupStorageValidation } from './types';
+/**
+ * AWS S3 backup target. The same implementation serves any S3-compatible store (Cloudflare R2,
+ * MinIO, …) — only the `endpoint`/`forcePathStyle` config differs, never the code. The AWS SDK is
+ * loaded lazily via dynamic import so it stays an optional dependency for Vercel-only installs.
+ */
+export declare class S3BackupStorage implements BackupStorageAdapter {
+    private readonly cfg;
+    private clientPromise;
+    private presignerPromise;
+    readonly kind = "s3";
+    constructor(cfg: BackupS3Config);
+    private buildClient;
+    private client;
+    /** Strip the configured key prefix, returning the provider-agnostic `backups/...` pathname. */
+    private fromKey;
+    private presigner;
+    private presignGet;
+    private sdk;
+    /** Prepend the configured key prefix to a provider-agnostic `backups/...` pathname. */
+    private toKey;
+    del(ref: BackupStorageRef): Promise<void>;
+    list(prefix: string): Promise<BackupStorageObject[]>;
+    openDownloadStream(ref: BackupStorageRef): Promise<{
+        contentType: string;
+        stream: ReadableStream<Uint8Array<ArrayBufferLike>>;
+    } | null>;
+    put(pathname: string, body: Buffer | string | Uint8Array): Promise<{
+        pathname: string;
+        url: string;
+    }>;
+    read(ref: BackupStorageRef): Promise<Buffer>;
+    validate(): Promise<BackupStorageValidation>;
+}

package/dist/core/storage/s3.js

@@ -0,0 +1,200 @@
+/** Presigned download URLs are valid this long — long enough to start a restore/download. */ const SIGNED_URL_TTL_SECONDS = 3600;
+function contentTypeFor(pathname) {
+    if (pathname.endsWith('.json')) {
+        return 'application/json';
+    }
+    if (pathname.endsWith('.gz') || pathname.endsWith('.tar.gz')) {
+        return 'application/gzip';
+    }
+    return 'application/octet-stream';
+}
+/**
+ * AWS S3 backup target. The same implementation serves any S3-compatible store (Cloudflare R2,
+ * MinIO, …) — only the `endpoint`/`forcePathStyle` config differs, never the code. The AWS SDK is
+ * loaded lazily via dynamic import so it stays an optional dependency for Vercel-only installs.
+ */ export class S3BackupStorage {
+    cfg;
+    clientPromise = null;
+    presignerPromise = null;
+    kind = 's3';
+    constructor(cfg){
+        this.cfg = cfg;
+    }
+    async buildClient() {
+        const { S3Client } = await this.sdk();
+        const { accessKeyId, secretAccessKey, sessionToken } = this.cfg;
+        return new S3Client({
+            ...this.cfg.endpoint ? {
+                endpoint: this.cfg.endpoint
+            } : {},
+            forcePathStyle: this.cfg.forcePathStyle,
+            region: this.cfg.region,
+            // When keys are absent, fall back to the SDK's default credential provider chain
+            // (env vars, shared config, instance/role credentials).
+            ...accessKeyId && secretAccessKey ? {
+                credentials: {
+                    accessKeyId,
+                    secretAccessKey,
+                    sessionToken
+                }
+            } : {}
+        });
+    }
+    async client() {
+        if (!this.clientPromise) {
+            this.clientPromise = this.buildClient();
+        }
+        return this.clientPromise;
+    }
+    /** Strip the configured key prefix, returning the provider-agnostic `backups/...` pathname. */ fromKey(key) {
+        if (!this.cfg.prefix) {
+            return key;
+        }
+        const lead = `${this.cfg.prefix}/`;
+        return key.startsWith(lead) ? key.slice(lead.length) : key;
+    }
+    async presigner() {
+        if (!this.presignerPromise) {
+            this.presignerPromise = import('@aws-sdk/s3-request-presigner');
+        }
+        return this.presignerPromise;
+    }
+    async presignGet(key) {
+        const { GetObjectCommand } = await this.sdk();
+        const { getSignedUrl } = await this.presigner();
+        const client = await this.client();
+        return getSignedUrl(client, new GetObjectCommand({
+            Bucket: this.cfg.bucket,
+            Key: key
+        }), {
+            expiresIn: SIGNED_URL_TTL_SECONDS
+        });
+    }
+    async sdk() {
+        try {
+            return await import('@aws-sdk/client-s3');
+        } catch  {
+            throw new Error('BACKUP_STORAGE=s3 requires the AWS SDK. Install it with: ' + 'pnpm add @aws-sdk/client-s3 @aws-sdk/lib-storage @aws-sdk/s3-request-presigner');
+        }
+    }
+    /** Prepend the configured key prefix to a provider-agnostic `backups/...` pathname. */ toKey(pathname) {
+        return this.cfg.prefix ? `${this.cfg.prefix}/${pathname}` : pathname;
+    }
+    async del(ref) {
+        const { DeleteObjectCommand } = await this.sdk();
+        const client = await this.client();
+        await client.send(new DeleteObjectCommand({
+            Bucket: this.cfg.bucket,
+            Key: this.toKey(ref.pathname)
+        }));
+    }
+    async list(prefix) {
+        const { ListObjectsV2Command } = await this.sdk();
+        const client = await this.client();
+        const keyPrefix = this.toKey(prefix);
+        const objects = [];
+        let continuationToken;
+        do {
+            const res = await client.send(new ListObjectsV2Command({
+                Bucket: this.cfg.bucket,
+                ContinuationToken: continuationToken,
+                Prefix: keyPrefix
+            }));
+            const pageEntries = [];
+            for (const obj of res.Contents ?? []){
+                if (!obj.Key) {
+                    continue;
+                }
+                pageEntries.push({
+                    key: obj.Key,
+                    pathname: this.fromKey(obj.Key),
+                    size: obj.Size ?? 0,
+                    uploadedAt: obj.LastModified ?? new Date(0)
+                });
+            }
+            const signed = await Promise.all(pageEntries.map(async (entry)=>{
+                const url = await this.presignGet(entry.key);
+                return {
+                    downloadUrl: url,
+                    pathname: entry.pathname,
+                    size: entry.size,
+                    uploadedAt: entry.uploadedAt,
+                    url
+                };
+            }));
+            objects.push(...signed);
+            continuationToken = res.IsTruncated ? res.NextContinuationToken : undefined;
+        }while (continuationToken)
+        return objects;
+    }
+    async openDownloadStream(ref) {
+        const { GetObjectCommand } = await this.sdk();
+        const client = await this.client();
+        try {
+            const res = await client.send(new GetObjectCommand({
+                Bucket: this.cfg.bucket,
+                Key: this.toKey(ref.pathname)
+            }));
+            if (!res.Body) {
+                return null;
+            }
+            const stream = res.Body.transformToWebStream();
+            return {
+                contentType: res.ContentType || contentTypeFor(ref.pathname),
+                stream
+            };
+        } catch  {
+            return null;
+        }
+    }
+    async put(pathname, body) {
+        const { Upload } = await import('@aws-sdk/lib-storage');
+        const client = await this.client();
+        const key = this.toKey(pathname);
+        await new Upload({
+            client,
+            params: {
+                Body: typeof body === 'string' ? Buffer.from(body) : body,
+                Bucket: this.cfg.bucket,
+                ContentType: contentTypeFor(pathname),
+                Key: key
+            }
+        }).done();
+        return {
+            pathname,
+            url: await this.presignGet(key)
+        };
+    }
+    async read(ref) {
+        const { GetObjectCommand } = await this.sdk();
+        const client = await this.client();
+        const res = await client.send(new GetObjectCommand({
+            Bucket: this.cfg.bucket,
+            Key: this.toKey(ref.pathname)
+        }));
+        if (!res.Body) {
+            throw new Error(`Failed to read backup object (${ref.pathname}): empty body`);
+        }
+        const bytes = await res.Body.transformToByteArray();
+        return Buffer.from(bytes);
+    }
+    async validate() {
+        try {
+            const { HeadBucketCommand } = await this.sdk();
+            const client = await this.client();
+            await client.send(new HeadBucketCommand({
+                Bucket: this.cfg.bucket
+            }));
+            return {
+                ok: true
+            };
+        } catch (error) {
+            return {
+                error: error instanceof Error ? error.message : 'S3 bucket not reachable',
+                ok: false
+            };
+        }
+    }
+}
+
+//# sourceMappingURL=s3.js.map

package/dist/core/storage/s3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/core/storage/s3.ts"],"sourcesContent":["import type { S3Client } from '@aws-sdk/client-s3'\n\nimport type { BackupS3Config } from './config'\nimport type {\n  BackupStorageAdapter,\n  BackupStorageObject,\n  BackupStorageRef,\n  BackupStorageValidation,\n} from './types'\n\n/** Presigned download URLs are valid this long — long enough to start a restore/download. */\nconst SIGNED_URL_TTL_SECONDS = 3600\n\ntype S3PresignerModule = {\n  getSignedUrl: (\n    client: S3Client,\n    command: unknown,\n    options: { expiresIn: number },\n  ) => Promise<string>\n}\n\nfunction contentTypeFor(pathname: string): string {\n  if (pathname.endsWith('.json')) {\n    return 'application/json'\n  }\n  if (pathname.endsWith('.gz') || pathname.endsWith('.tar.gz')) {\n    return 'application/gzip'\n  }\n  return 'application/octet-stream'\n}\n\n/**\n * AWS S3 backup target. The same implementation serves any S3-compatible store (Cloudflare R2,\n * MinIO, …) — only the `endpoint`/`forcePathStyle` config differs, never the code. The AWS SDK is\n * loaded lazily via dynamic import so it stays an optional dependency for Vercel-only installs.\n */\nexport class S3BackupStorage implements BackupStorageAdapter {\n  private readonly cfg: BackupS3Config\n\n  private clientPromise: null | Promise<S3Client> = null\n  private presignerPromise: null | Promise<S3PresignerModule> = null\n  readonly kind = 's3'\n\n  constructor(cfg: BackupS3Config) {\n    this.cfg = cfg\n  }\n\n  private async buildClient(): Promise<S3Client> {\n    const { S3Client } = await this.sdk()\n    const { accessKeyId, secretAccessKey, sessionToken } = this.cfg\n    return new S3Client({\n      ...(this.cfg.endpoint ? { endpoint: this.cfg.endpoint } : {}),\n      forcePathStyle: this.cfg.forcePathStyle,\n      region: this.cfg.region,\n      // When keys are absent, fall back to the SDK's default credential provider chain\n      // (env vars, shared config, instance/role credentials).\n      ...(accessKeyId && secretAccessKey ?\n        { credentials: { accessKeyId, secretAccessKey, sessionToken } }\n      : {}),\n    })\n  }\n\n  private async client(): Promise<S3Client> {\n    if (!this.clientPromise) {\n      this.clientPromise = this.buildClient()\n    }\n    return this.clientPromise\n  }\n\n  /** Strip the configured key prefix, returning the provider-agnostic `backups/...` pathname. */\n  private fromKey(key: string): string {\n    if (!this.cfg.prefix) {\n      return key\n    }\n    const lead = `${this.cfg.prefix}/`\n    return key.startsWith(lead) ? key.slice(lead.length) : key\n  }\n\n  private async presigner() {\n    if (!this.presignerPromise) {\n      this.presignerPromise = import('@aws-sdk/s3-request-presigner')\n    }\n    return this.presignerPromise\n  }\n\n  private async presignGet(key: string): Promise<string> {\n    const { GetObjectCommand } = await this.sdk()\n    const { getSignedUrl } = await this.presigner()\n    const client = await this.client()\n    return getSignedUrl(client, new GetObjectCommand({ Bucket: this.cfg.bucket, Key: key }), {\n      expiresIn: SIGNED_URL_TTL_SECONDS,\n    })\n  }\n\n  private async sdk() {\n    try {\n      return await import('@aws-sdk/client-s3')\n    } catch {\n      throw new Error(\n        'BACKUP_STORAGE=s3 requires the AWS SDK. Install it with: ' +\n          'pnpm add @aws-sdk/client-s3 @aws-sdk/lib-storage @aws-sdk/s3-request-presigner',\n      )\n    }\n  }\n\n  /** Prepend the configured key prefix to a provider-agnostic `backups/...` pathname. */\n  private toKey(pathname: string): string {\n    return this.cfg.prefix ? `${this.cfg.prefix}/${pathname}` : pathname\n  }\n\n  async del(ref: BackupStorageRef): Promise<void> {\n    const { DeleteObjectCommand } = await this.sdk()\n    const client = await this.client()\n    await client.send(\n      new DeleteObjectCommand({ Bucket: this.cfg.bucket, Key: this.toKey(ref.pathname) }),\n    )\n  }\n\n  async list(prefix: string): Promise<BackupStorageObject[]> {\n    const { ListObjectsV2Command } = await this.sdk()\n    const client = await this.client()\n    const keyPrefix = this.toKey(prefix)\n\n    const objects: BackupStorageObject[] = []\n    let continuationToken: string | undefined\n    do {\n      const res = await client.send(\n        new ListObjectsV2Command({\n          Bucket: this.cfg.bucket,\n          ContinuationToken: continuationToken,\n          Prefix: keyPrefix,\n        }),\n      )\n      const pageEntries: Array<{\n        key: string\n        pathname: string\n        size: number\n        uploadedAt: Date\n      }> = []\n      for (const obj of res.Contents ?? []) {\n        if (!obj.Key) {\n          continue\n        }\n        pageEntries.push({\n          key: obj.Key,\n          pathname: this.fromKey(obj.Key),\n          size: obj.Size ?? 0,\n          uploadedAt: obj.LastModified ?? new Date(0),\n        })\n      }\n      const signed = await Promise.all(\n        pageEntries.map(async (entry) => {\n          const url = await this.presignGet(entry.key)\n          return {\n            downloadUrl: url,\n            pathname: entry.pathname,\n            size: entry.size,\n            uploadedAt: entry.uploadedAt,\n            url,\n          }\n        }),\n      )\n      objects.push(...signed)\n      continuationToken = res.IsTruncated ? res.NextContinuationToken : undefined\n    } while (continuationToken)\n\n    return objects\n  }\n\n  async openDownloadStream(ref: BackupStorageRef) {\n    const { GetObjectCommand } = await this.sdk()\n    const client = await this.client()\n    try {\n      const res = await client.send(\n        new GetObjectCommand({ Bucket: this.cfg.bucket, Key: this.toKey(ref.pathname) }),\n      )\n      if (!res.Body) {\n        return null\n      }\n      const stream = (\n        res.Body as { transformToWebStream: () => ReadableStream<Uint8Array> }\n      ).transformToWebStream()\n      return {\n        contentType: res.ContentType || contentTypeFor(ref.pathname),\n        stream,\n      }\n    } catch {\n      return null\n    }\n  }\n\n  async put(pathname: string, body: Buffer | string | Uint8Array) {\n    const { Upload } = await import('@aws-sdk/lib-storage')\n    const client = await this.client()\n    const key = this.toKey(pathname)\n    await new Upload({\n      client,\n      params: {\n        Body: typeof body === 'string' ? Buffer.from(body) : body,\n        Bucket: this.cfg.bucket,\n        ContentType: contentTypeFor(pathname),\n        Key: key,\n      },\n    }).done()\n    return { pathname, url: await this.presignGet(key) }\n  }\n\n  async read(ref: BackupStorageRef): Promise<Buffer> {\n    const { GetObjectCommand } = await this.sdk()\n    const client = await this.client()\n    const res = await client.send(\n      new GetObjectCommand({ Bucket: this.cfg.bucket, Key: this.toKey(ref.pathname) }),\n    )\n    if (!res.Body) {\n      throw new Error(`Failed to read backup object (${ref.pathname}): empty body`)\n    }\n    const bytes = await (\n      res.Body as { transformToByteArray: () => Promise<Uint8Array> }\n    ).transformToByteArray()\n    return Buffer.from(bytes)\n  }\n\n  async validate(): Promise<BackupStorageValidation> {\n    try {\n      const { HeadBucketCommand } = await this.sdk()\n      const client = await this.client()\n      await client.send(new HeadBucketCommand({ Bucket: this.cfg.bucket }))\n      return { ok: true }\n    } catch (error) {\n      return {\n        error: error instanceof Error ? error.message : 'S3 bucket not reachable',\n        ok: false,\n      }\n    }\n  }\n}\n"],"names":["SIGNED_URL_TTL_SECONDS","contentTypeFor","pathname","endsWith","S3BackupStorage","cfg","clientPromise","presignerPromise","kind","buildClient","S3Client","sdk","accessKeyId","secretAccessKey","sessionToken","endpoint","forcePathStyle","region","credentials","client","fromKey","key","prefix","lead","startsWith","slice","length","presigner","presignGet","GetObjectCommand","getSignedUrl","Bucket","bucket","Key","expiresIn","Error","toKey","del","ref","DeleteObjectCommand","send","list","ListObjectsV2Command","keyPrefix","objects","continuationToken","res","ContinuationToken","Prefix","pageEntries","obj","Contents","push","size","Size","uploadedAt","LastModified","Date","signed","Promise","all","map","entry","url","downloadUrl","IsTruncated","NextContinuationToken","undefined","openDownloadStream","Body","stream","transformToWebStream","contentType","ContentType","put","body","Upload","params","Buffer","from","done","read","bytes","transformToByteArray","validate","HeadBucketCommand","ok","error","message"],"mappings":"AAUA,2FAA2F,GAC3F,MAAMA,yBAAyB;AAU/B,SAASC,eAAeC,QAAgB;IACtC,IAAIA,SAASC,QAAQ,CAAC,UAAU;QAC9B,OAAO;IACT;IACA,IAAID,SAASC,QAAQ,CAAC,UAAUD,SAASC,QAAQ,CAAC,YAAY;QAC5D,OAAO;IACT;IACA,OAAO;AACT;AAEA;;;;CAIC,GACD,OAAO,MAAMC;IACMC,IAAmB;IAE5BC,gBAA0C,KAAI;IAC9CC,mBAAsD,KAAI;IACzDC,OAAO,KAAI;IAEpB,YAAYH,GAAmB,CAAE;QAC/B,IAAI,CAACA,GAAG,GAAGA;IACb;IAEA,MAAcI,cAAiC;QAC7C,MAAM,EAAEC,QAAQ,EAAE,GAAG,MAAM,IAAI,CAACC,GAAG;QACnC,MAAM,EAAEC,WAAW,EAAEC,eAAe,EAAEC,YAAY,EAAE,GAAG,IAAI,CAACT,GAAG;QAC/D,OAAO,IAAIK,SAAS;YAClB,GAAI,IAAI,CAACL,GAAG,CAACU,QAAQ,GAAG;gBAAEA,UAAU,IAAI,CAACV,GAAG,CAACU,QAAQ;YAAC,IAAI,CAAC,CAAC;YAC5DC,gBAAgB,IAAI,CAACX,GAAG,CAACW,cAAc;YACvCC,QAAQ,IAAI,CAACZ,GAAG,CAACY,MAAM;YACvB,iFAAiF;YACjF,wDAAwD;YACxD,GAAIL,eAAeC,kBACjB;gBAAEK,aAAa;oBAAEN;oBAAaC;oBAAiBC;gBAAa;YAAE,IAC9D,CAAC,CAAC;QACN;IACF;IAEA,MAAcK,SAA4B;QACxC,IAAI,CAAC,IAAI,CAACb,aAAa,EAAE;YACvB,IAAI,CAACA,aAAa,GAAG,IAAI,CAACG,WAAW;QACvC;QACA,OAAO,IAAI,CAACH,aAAa;IAC3B;IAEA,6FAA6F,GAC7F,AAAQc,QAAQC,GAAW,EAAU;QACnC,IAAI,CAAC,IAAI,CAAChB,GAAG,CAACiB,MAAM,EAAE;YACpB,OAAOD;QACT;QACA,MAAME,OAAO,GAAG,IAAI,CAAClB,GAAG,CAACiB,MAAM,CAAC,CAAC,CAAC;QAClC,OAAOD,IAAIG,UAAU,CAACD,QAAQF,IAAII,KAAK,CAACF,KAAKG,MAAM,IAAIL;IACzD;IAEA,MAAcM,YAAY;QACxB,IAAI,CAAC,IAAI,CAACpB,gBAAgB,EAAE;YAC1B,IAAI,CAACA,gBAAgB,GAAG,MAAM,CAAC;QACjC;QACA,OAAO,IAAI,CAACA,gBAAgB;IAC9B;IAEA,MAAcqB,WAAWP,GAAW,EAAmB;QACrD,MAAM,EAAEQ,gBAAgB,EAAE,GAAG,MAAM,IAAI,CAAClB,GAAG;QAC3C,MAAM,EAAEmB,YAAY,EAAE,GAAG,MAAM,IAAI,CAACH,SAAS;QAC7C,MAAMR,SAAS,MAAM,IAAI,CAACA,MAAM;QAChC,OAAOW,aAAaX,QAAQ,IAAIU,iBAAiB;YAAEE,QAAQ,IAAI,CAAC1B,GAAG,CAAC2B,MAAM;YAAEC,KAAKZ;QAAI,IAAI;YACvFa,WAAWlC;QACb;IACF;IAEA,MAAcW,MAAM;QAClB,IAAI;YACF,OAAO,MAAM,MAAM,CAAC;QACtB,EAAE,OAAM;YACN,MAAM,IAAIwB,MACR,8DACE;QAEN;IACF;IAEA,qFAAqF,GACrF,AAAQC,MAAMlC,QAAgB,EAAU;QACtC,OAAO,IAAI,CAACG,GAAG,CAACiB,MAAM,GAAG,GAAG,IAAI,CAACjB,GAAG,CAACiB,MAAM,CAAC,CAAC,EAAEpB,UAAU,GAAGA;IAC9D;IAEA,MAAMmC,IAAIC,GAAqB,EAAiB;QAC9C,MAAM,EAAEC,mBAAmB,EAAE,GAAG,MAAM,IAAI,CAAC5B,GAAG;QAC9C,MAAMQ,SAAS,MAAM,IAAI,CAACA,MAAM;QAChC,MAAMA,OAAOqB,IAAI,CACf,IAAID,oBAAoB;YAAER,QAAQ,IAAI,CAAC1B,GAAG,CAAC2B,MAAM;YAAEC,KAAK,IAAI,CAACG,KAAK,CAACE,IAAIpC,QAAQ;QAAE;IAErF;IAEA,MAAMuC,KAAKnB,MAAc,EAAkC;QACzD,MAAM,EAAEoB,oBAAoB,EAAE,GAAG,MAAM,IAAI,CAAC/B,GAAG;QAC/C,MAAMQ,SAAS,MAAM,IAAI,CAACA,MAAM;QAChC,MAAMwB,YAAY,IAAI,CAACP,KAAK,CAACd;QAE7B,MAAMsB,UAAiC,EAAE;QACzC,IAAIC;QACJ,GAAG;YACD,MAAMC,MAAM,MAAM3B,OAAOqB,IAAI,CAC3B,IAAIE,qBAAqB;gBACvBX,QAAQ,IAAI,CAAC1B,GAAG,CAAC2B,MAAM;gBACvBe,mBAAmBF;gBACnBG,QAAQL;YACV;YAEF,MAAMM,cAKD,EAAE;YACP,KAAK,MAAMC,OAAOJ,IAAIK,QAAQ,IAAI,EAAE,CAAE;gBACpC,IAAI,CAACD,IAAIjB,GAAG,EAAE;oBACZ;gBACF;gBACAgB,YAAYG,IAAI,CAAC;oBACf/B,KAAK6B,IAAIjB,GAAG;oBACZ/B,UAAU,IAAI,CAACkB,OAAO,CAAC8B,IAAIjB,GAAG;oBAC9BoB,MAAMH,IAAII,IAAI,IAAI;oBAClBC,YAAYL,IAAIM,YAAY,IAAI,IAAIC,KAAK;gBAC3C;YACF;YACA,MAAMC,SAAS,MAAMC,QAAQC,GAAG,CAC9BX,YAAYY,GAAG,CAAC,OAAOC;gBACrB,MAAMC,MAAM,MAAM,IAAI,CAACnC,UAAU,CAACkC,MAAMzC,GAAG;gBAC3C,OAAO;oBACL2C,aAAaD;oBACb7D,UAAU4D,MAAM5D,QAAQ;oBACxBmD,MAAMS,MAAMT,IAAI;oBAChBE,YAAYO,MAAMP,UAAU;oBAC5BQ;gBACF;YACF;YAEFnB,QAAQQ,IAAI,IAAIM;YAChBb,oBAAoBC,IAAImB,WAAW,GAAGnB,IAAIoB,qBAAqB,GAAGC;QACpE,QAAStB,kBAAkB;QAE3B,OAAOD;IACT;IAEA,MAAMwB,mBAAmB9B,GAAqB,EAAE;QAC9C,MAAM,EAAET,gBAAgB,EAAE,GAAG,MAAM,IAAI,CAAClB,GAAG;QAC3C,MAAMQ,SAAS,MAAM,IAAI,CAACA,MAAM;QAChC,IAAI;YACF,MAAM2B,MAAM,MAAM3B,OAAOqB,IAAI,CAC3B,IAAIX,iBAAiB;gBAAEE,QAAQ,IAAI,CAAC1B,GAAG,CAAC2B,MAAM;gBAAEC,KAAK,IAAI,CAACG,KAAK,CAACE,IAAIpC,QAAQ;YAAE;YAEhF,IAAI,CAAC4C,IAAIuB,IAAI,EAAE;gBACb,OAAO;YACT;YACA,MAAMC,SAAS,AACbxB,IAAIuB,IAAI,CACRE,oBAAoB;YACtB,OAAO;gBACLC,aAAa1B,IAAI2B,WAAW,IAAIxE,eAAeqC,IAAIpC,QAAQ;gBAC3DoE;YACF;QACF,EAAE,OAAM;YACN,OAAO;QACT;IACF;IAEA,MAAMI,IAAIxE,QAAgB,EAAEyE,IAAkC,EAAE;QAC9D,MAAM,EAAEC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC;QAChC,MAAMzD,SAAS,MAAM,IAAI,CAACA,MAAM;QAChC,MAAME,MAAM,IAAI,CAACe,KAAK,CAAClC;QACvB,MAAM,IAAI0E,OAAO;YACfzD;YACA0D,QAAQ;gBACNR,MAAM,OAAOM,SAAS,WAAWG,OAAOC,IAAI,CAACJ,QAAQA;gBACrD5C,QAAQ,IAAI,CAAC1B,GAAG,CAAC2B,MAAM;gBACvByC,aAAaxE,eAAeC;gBAC5B+B,KAAKZ;YACP;QACF,GAAG2D,IAAI;QACP,OAAO;YAAE9E;YAAU6D,KAAK,MAAM,IAAI,CAACnC,UAAU,CAACP;QAAK;IACrD;IAEA,MAAM4D,KAAK3C,GAAqB,EAAmB;QACjD,MAAM,EAAET,gBAAgB,EAAE,GAAG,MAAM,IAAI,CAAClB,GAAG;QAC3C,MAAMQ,SAAS,MAAM,IAAI,CAACA,MAAM;QAChC,MAAM2B,MAAM,MAAM3B,OAAOqB,IAAI,CAC3B,IAAIX,iBAAiB;YAAEE,QAAQ,IAAI,CAAC1B,GAAG,CAAC2B,MAAM;YAAEC,KAAK,IAAI,CAACG,KAAK,CAACE,IAAIpC,QAAQ;QAAE;QAEhF,IAAI,CAAC4C,IAAIuB,IAAI,EAAE;YACb,MAAM,IAAIlC,MAAM,CAAC,8BAA8B,EAAEG,IAAIpC,QAAQ,CAAC,aAAa,CAAC;QAC9E;QACA,MAAMgF,QAAQ,MAAM,AAClBpC,IAAIuB,IAAI,CACRc,oBAAoB;QACtB,OAAOL,OAAOC,IAAI,CAACG;IACrB;IAEA,MAAME,WAA6C;QACjD,IAAI;YACF,MAAM,EAAEC,iBAAiB,EAAE,GAAG,MAAM,IAAI,CAAC1E,GAAG;YAC5C,MAAMQ,SAAS,MAAM,IAAI,CAACA,MAAM;YAChC,MAAMA,OAAOqB,IAAI,CAAC,IAAI6C,kBAAkB;gBAAEtD,QAAQ,IAAI,CAAC1B,GAAG,CAAC2B,MAAM;YAAC;YAClE,OAAO;gBAAEsD,IAAI;YAAK;QACpB,EAAE,OAAOC,OAAO;YACd,OAAO;gBACLA,OAAOA,iBAAiBpD,QAAQoD,MAAMC,OAAO,GAAG;gBAChDF,IAAI;YACN;QACF;IACF;AACF"}

package/dist/core/storage/types.d.ts

@@ -0,0 +1,60 @@
+import type { BackupBlobAccessLevel } from '../backupBlobIO';
+/** Selectable backup target. Vercel Blob is the historical default; `s3` covers AWS S3 and any
+ * S3-compatible store (Cloudflare R2, MinIO, …) — they share one implementation. */
+export type BackupStorageKind = 's3' | 'vercel-blob';
+/**
+ * Backup archive as seen by the dashboard and the cron/list endpoints. The field names match the
+ * objects Vercel Blob's `list()` returns so existing consumers (UI, restore-by-`url`) keep working;
+ * the S3 adapter synthesizes the same shape (with a presigned `downloadUrl`/`url`).
+ */
+export interface BackupStorageObject {
+    /** Time-limited URL suitable for downloading the object (presigned for S3). */
+    downloadUrl: string;
+    /** Object key without any provider prefix, e.g. `backups/manual---db---host---2-1700.json`. */
+    pathname: string;
+    /** Object size in bytes. */
+    size: number;
+    /** Upload/last-modified time. */
+    uploadedAt: Date | string;
+    /** Stable reference used for download/delete (Vercel blob URL; presigned GET for S3). */
+    url: string;
+}
+/** Result of probing the target's credentials/reachability. */
+export interface BackupStorageValidation {
+    /** Detected Vercel Blob access level, when applicable. */
+    access?: BackupBlobAccessLevel;
+    /** Short description when validation fails. */
+    error?: string;
+    ok: boolean;
+}
+/** A reference good enough to read or delete a single archive across providers. */
+export interface BackupStorageRef {
+    downloadUrl?: null | string;
+    pathname: string;
+    url?: null | string;
+}
+/**
+ * Provider-agnostic operations the plugin performs on backup archives. Implementations live in
+ * `vercelBlob.ts` and `s3.ts`; callers obtain one via {@link resolveBackupStorage}.
+ */
+export interface BackupStorageAdapter {
+    /** Delete a single archive. */
+    del(ref: BackupStorageRef): Promise<void>;
+    readonly kind: BackupStorageKind;
+    /** List archives under a pathname prefix (e.g. `backups/` or `backups/cron-`). */
+    list(prefix: string): Promise<BackupStorageObject[]>;
+    /** Open a readable stream for streaming a download response, or null when not found. */
+    openDownloadStream(ref: BackupStorageRef): Promise<{
+        contentType: string;
+        stream: ReadableStream<Uint8Array>;
+    } | null>;
+    /** Upload an archive at `pathname`. */
+    put(pathname: string, body: Buffer | string | Uint8Array): Promise<{
+        pathname: string;
+        url: string;
+    }>;
+    /** Read the full bytes of an archive. */
+    read(ref: BackupStorageRef): Promise<Buffer>;
+    /** Probe credentials / reachability without persisting anything. */
+    validate(): Promise<BackupStorageValidation>;
+}

package/dist/core/storage/types.js

@@ -0,0 +1,6 @@
+/**
+ * Provider-agnostic operations the plugin performs on backup archives. Implementations live in
+ * `vercelBlob.ts` and `s3.ts`; callers obtain one via {@link resolveBackupStorage}.
+ */ export { };
+
+//# sourceMappingURL=types.js.map

package/dist/core/storage/types.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/core/storage/types.ts"],"sourcesContent":["import type { BackupBlobAccessLevel } from '../backupBlobIO'\n\n/** Selectable backup target. Vercel Blob is the historical default; `s3` covers AWS S3 and any\n * S3-compatible store (Cloudflare R2, MinIO, …) — they share one implementation. */\nexport type BackupStorageKind = 's3' | 'vercel-blob'\n\n/**\n * Backup archive as seen by the dashboard and the cron/list endpoints. The field names match the\n * objects Vercel Blob's `list()` returns so existing consumers (UI, restore-by-`url`) keep working;\n * the S3 adapter synthesizes the same shape (with a presigned `downloadUrl`/`url`).\n */\nexport interface BackupStorageObject {\n  /** Time-limited URL suitable for downloading the object (presigned for S3). */\n  downloadUrl: string\n  /** Object key without any provider prefix, e.g. `backups/manual---db---host---2-1700.json`. */\n  pathname: string\n  /** Object size in bytes. */\n  size: number\n  /** Upload/last-modified time. */\n  uploadedAt: Date | string\n  /** Stable reference used for download/delete (Vercel blob URL; presigned GET for S3). */\n  url: string\n}\n\n/** Result of probing the target's credentials/reachability. */\nexport interface BackupStorageValidation {\n  /** Detected Vercel Blob access level, when applicable. */\n  access?: BackupBlobAccessLevel\n  /** Short description when validation fails. */\n  error?: string\n  ok: boolean\n}\n\n/** A reference good enough to read or delete a single archive across providers. */\nexport interface BackupStorageRef {\n  downloadUrl?: null | string\n  pathname: string\n  url?: null | string\n}\n\n/**\n * Provider-agnostic operations the plugin performs on backup archives. Implementations live in\n * `vercelBlob.ts` and `s3.ts`; callers obtain one via {@link resolveBackupStorage}.\n */\nexport interface BackupStorageAdapter {\n  /** Delete a single archive. */\n  del(ref: BackupStorageRef): Promise<void>\n  readonly kind: BackupStorageKind\n  /** List archives under a pathname prefix (e.g. `backups/` or `backups/cron-`). */\n  list(prefix: string): Promise<BackupStorageObject[]>\n  /** Open a readable stream for streaming a download response, or null when not found. */\n  openDownloadStream(\n    ref: BackupStorageRef,\n  ): Promise<{ contentType: string; stream: ReadableStream<Uint8Array> } | null>\n  /** Upload an archive at `pathname`. */\n  put(\n    pathname: string,\n    body: Buffer | string | Uint8Array,\n  ): Promise<{ pathname: string; url: string }>\n  /** Read the full bytes of an archive. */\n  read(ref: BackupStorageRef): Promise<Buffer>\n  /** Probe credentials / reachability without persisting anything. */\n  validate(): Promise<BackupStorageValidation>\n}\n"],"names":[],"mappings":"AAwCA;;;CAGC,GACD,WAmBC"}

package/dist/core/storage/vercelBlob.d.ts

@@ -0,0 +1,25 @@
+import type { BackupStorageAdapter, BackupStorageObject, BackupStorageRef, BackupStorageValidation } from './types';
+import { type BackupBlobAccessLevel } from '../backupBlobIO';
+/**
+ * Vercel Blob backup target — the historical default. This is a thin wrapper around the existing
+ * `@vercel/blob` helpers so behaviour (and the test seams that mock `@vercel/blob`) is unchanged;
+ * the adapter only generalizes the call shape so S3 can slot in alongside it.
+ */
+export declare class VercelBlobStorage implements BackupStorageAdapter {
+    private readonly access;
+    private readonly token;
+    readonly kind = "vercel-blob";
+    constructor(options: {
+        access?: BackupBlobAccessLevel;
+        token?: string;
+    });
+    del(ref: BackupStorageRef): Promise<void>;
+    list(prefix: string): Promise<BackupStorageObject[]>;
+    openDownloadStream(ref: BackupStorageRef): Promise<import("../backupBlobIO").BackupBlobDownloadStream | null>;
+    put(pathname: string, body: Buffer | string | Uint8Array): Promise<{
+        pathname: string;
+        url: string;
+    }>;
+    read(ref: BackupStorageRef): Promise<Buffer>;
+    validate(): Promise<BackupStorageValidation>;
+}

package/dist/core/storage/vercelBlob.js

@@ -0,0 +1,53 @@
+import { del, list } from '@vercel/blob';
+import { putBackupBlobContent, readBackupBlobContentFlexible, streamBackupBlobForDownload } from '../backupBlobIO';
+import { validateBackupBlobToken } from '../blobTokenValidate';
+/**
+ * Vercel Blob backup target — the historical default. This is a thin wrapper around the existing
+ * `@vercel/blob` helpers so behaviour (and the test seams that mock `@vercel/blob`) is unchanged;
+ * the adapter only generalizes the call shape so S3 can slot in alongside it.
+ */ export class VercelBlobStorage {
+    access;
+    token;
+    kind = 'vercel-blob';
+    constructor(options){
+        this.token = options.token;
+        this.access = options.access ?? 'public';
+    }
+    async del(ref) {
+        await del(ref.url ?? ref.pathname, {
+            token: this.token
+        });
+    }
+    async list(prefix) {
+        const { blobs } = await list({
+            limit: 1000,
+            prefix,
+            token: this.token
+        });
+        return blobs;
+    }
+    async openDownloadStream(ref) {
+        return streamBackupBlobForDownload({
+            blobUrl: ref.url,
+            downloadUrl: ref.downloadUrl,
+            pathname: ref.pathname,
+            preferredAccess: this.access,
+            token: this.token ?? ''
+        });
+    }
+    async put(pathname, body) {
+        await putBackupBlobContent(pathname, body, this.token, this.access);
+        return {
+            pathname,
+            url: ''
+        };
+    }
+    async read(ref) {
+        return readBackupBlobContentFlexible(ref.pathname, ref.downloadUrl ?? ref.url ?? '', this.token ?? '');
+    }
+    async validate() {
+        return validateBackupBlobToken(this.token ?? '');
+    }
+}
+
+//# sourceMappingURL=vercelBlob.js.map