backupdrill 2.0.0 → 2.1.0

package/dist/restore-engine.js

@@ -11,7 +11,7 @@
 import { spawn } from "node:child_process";
 import { Client } from "pg";
 import { resolvePgRestoreBin } from "./pgbin.js";
-import { pgConnectOptions } from "./supabase-ca.js";
+import { pgConnectOptions, dumpUrlFor } from "./supabase-ca.js";
 /** 主机名规范化:剥掉合法的 DNS 根点(db.x.supabase.co. ≡ db.x.supabase.co)。
  * 身份比较不规范化 = 一个尾点就能绕过同源阻断(supabase-ca 对同类早有钉子)。 */
 export function normalizeHost(hostname) {
@@ -254,7 +254,10 @@ export function assertNoHostOverride(connString) {
 }
 export async function restoreDatabaseArtifact(opts) {
     const bin = resolvePgRestoreBin();
-    const { url, env } = credentialSafeDbArgs(opts.connString);
+    // TLS 全链路 verify-full(创始人承诺项):pg_restore 与 pg_dump 同一改写——
+    // Supabase 主机强制 verify-full + 打包根 CA(libpq 的 require 不验证书,
+    // 中间人可拿到连接与数据);沙箱/外部主机原样透传。先改写 SSL 再拆密码。
+    const { url, env } = credentialSafeDbArgs(dumpUrlFor(opts.connString));
     const common = ["--no-owner", "--no-privileges", "--dbname", url, opts.dumpPath];
     const first = await spawnPgRestore(bin, ["--section=pre-data", "--section=data", ...common], env);
     const preData = finalizePass(first.code, first.stderr, classifyBlocks(first.stderr, SCHEMA_EXISTS_ERROR));

package/dist/restore.d.ts

@@ -74,6 +74,12 @@ export declare function runRestore(config: BackupConfig, opts: {
     dryRun?: boolean;
     /** 源身份不可考(v1 快照 + 无配置)时的显式风险认知——没有它一律拒绝写入 */
     acknowledgeUnverifiedSource?: boolean;
+    /**
+     * 跳过 Storage 阶段(既不回传也不本地下载)。用于把恢复拆成可独立重跑的两段
+     * (hosted 检查点重试):DB 阶段传此=true 只恢复库;Storage 阶段单独用
+     * targetSupabaseUrl 跑。不影响 CLI 默认行为。
+     */
+    skipStorage?: boolean;
     snapshot?: string;
     storageDir?: string;
 }): Promise<RestoreResult>;

package/dist/restore.js

@@ -486,7 +486,10 @@ export async function runRestore(config, opts) {
             log.warn("No database target (--database + BACKUPDRILL_TARGET_DATABASE_URL); skipping database restore.");
         }
         // 2a. Storage → 目标项目回传(P0-D:给了目标 Storage 凭据时)
-        if (manifest.storage && storageTarget) {
+        if (opts.skipStorage) {
+            // DB-only 阶段(hosted 检查点重试):既不回传也不本地下载,Storage 单独一段跑
+        }
+        else if (manifest.storage && storageTarget) {
             const summary = await restoreStorage({ s3, bucket: config.storage.bucket, base }, storageTarget, manifest);
             result.storageSummary = summary;
             result.storageFilesWritten = summary.filesUploaded;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backupdrill",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "Open-source CLI to back up a Supabase project — Postgres database and Storage files — to your own S3/R2/B2 bucket, with a checksummed manifest.",
   "type": "module",
   "bin": {