openship 0.6.6 → 0.6.8

package/dist/{chunk-5DMWSTOM.js → chunk-5UXHT6ED.js}

@@ -134,41 +134,50 @@ import {
 } from "./chunk-ZWLDLTJP.js";
 import {
   CloudRuntime
-} from "./chunk-OBPKYXQL.js";
+} from "./chunk-MUWVC5R4.js";
 import {
   OPENRESTY_DEFAULT_PATHS
-} from "./chunk-RSR7PFIQ.js";
+} from "./chunk-7PEXM2UI.js";
 import {
   DockerRuntime,
   daemonConnectionFrom,
+  ensureScopedVolumeName,
   isHostPathSource,
   resolveExecExitCode,
-  scopedVolumeName,
   startAttachStream,
   startExecStream
-} from "./chunk-77QDF6UD.js";
+} from "./chunk-3MP6ACKM.js";
 import {
   BareRuntime
-} from "./chunk-LFE5KQ7Y.js";
+} from "./chunk-ENKJ7XIF.js";
 import {
   createExecutor
-} from "./chunk-MLYSEZQB.js";
+} from "./chunk-UAWY6X7V.js";
 import {
   envOps
-} from "./chunk-YMMQRE5J.js";
+} from "./chunk-GNOMEMNI.js";
 import {
   ENVIRONMENT_PROBE_SCRIPT,
   ENVIRONMENT_PROBE_TIMEOUT_MS,
   cacheEnvironment,
   parseEnvironmentProbe,
   profileIsFresh
-} from "./chunk-UVNMQM7W.js";
+} from "./chunk-NPSRGIHV.js";
+import {
+  MAIL_HOST_STATE_DIR
+} from "./chunk-D6HU4VUZ.js";
 import {
   FAMILY_BY_DISTRO,
   isAwsS3Endpoint,
+  isDbImage,
+  normalizeBackupPath,
+  payloadSpec,
   safeErrorMessage,
+  shellQuote,
+  validateBackupPath,
+  validateClearPath,
   withTimeout
-} from "./chunk-UJ6JZM65.js";
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/runtime/image-transfer.ts
 import { Transform } from "stream";
@@ -176,42 +185,6 @@ import { Transform } from "stream";
 // ../../packages/adapters/src/infra/edge-baked-conf.ts
 var LOGS_DIR = OPENRESTY_DEFAULT_PATHS.pidPath.replace(/\/[^/]+$/, "");
 
-// ../../packages/adapters/src/infra/mail-container.ts
-var MAIL_HOST_STATE_DIR = "/var/lib/openship/mail";
-var MAIL_CONTAINER_MOUNTS = [
-  { host: `${MAIL_HOST_STATE_DIR}/vmail`, container: "/var/vmail" },
-  // The Postfix queue. A recreate on an ephemeral layer would drop in-flight and
-  // deferred mail without this — keep it on the host.
-  { host: `${MAIL_HOST_STATE_DIR}/spool`, container: "/var/spool/postfix" },
-  // DKIM private keys. NEVER baked, never regenerated on pull — a fresh selector
-  // breaks DMARC until DNS repropagates.
-  { host: `${MAIL_HOST_STATE_DIR}/dkim`, container: "/var/lib/dkim" },
-  // Mutable daemon config the admin layer edits (sasl_passwd, relayhost maps,
-  // amavis 50-user). Seeded from baked defaults on first boot.
-  { host: `${MAIL_HOST_STATE_DIR}/config/postfix`, container: "/etc/postfix", seed: true },
-  { host: `${MAIL_HOST_STATE_DIR}/config/dovecot`, container: "/etc/dovecot", seed: true },
-  { host: `${MAIL_HOST_STATE_DIR}/config/amavis`, container: "/etc/amavis/conf.d", seed: true },
-  // ClamAV signatures — bind-mounted so a pull doesn't force a multi-hundred-MB
-  // freshclam re-download and delay readiness. `seed: true` because that same mount
-  // HIDES the database baked into the image: with nothing copying it across, clamd
-  // finds an empty database directory and exits (issue #565).
-  { host: `${MAIL_HOST_STATE_DIR}/clamav`, container: "/var/lib/clamav", seed: true },
-  { host: "/etc/letsencrypt", container: "/etc/letsencrypt", readonly: true }
-];
-var MAIL_DB_HOST_DATA_DIR = `${MAIL_HOST_STATE_DIR}/pgdata`;
-var MAIL_DB_CONTAINER_DATA_DIR = "/var/lib/postgresql/data";
-var MAIL_DB_PGDATA = `${MAIL_DB_CONTAINER_DATA_DIR}/pgdata`;
-var MAIL_HOST_PATHS = {
-  saslPasswd: `${MAIL_HOST_STATE_DIR}/config/postfix/sasl_passwd`,
-  senderRelayhost: `${MAIL_HOST_STATE_DIR}/config/postfix/sender_relayhost`,
-  // Per-nexthop TLS policy. Only split ("selected"-scope) relaying writes it: the
-  // relay hop must be `encrypt` so SASL credentials never cross a plaintext
-  // connection, while direct-to-MX delivery for the un-relayed domains stays
-  // opportunistic. A GLOBAL smtp_tls_security_level can't express both.
-  relayTlsPolicy: `${MAIL_HOST_STATE_DIR}/config/postfix/openship_tls_policy`,
-  amavisUserConf: `${MAIL_HOST_STATE_DIR}/config/amavis/50-user`
-};
-
 // ../../packages/adapters/src/system/mail/ensure-container-mail.ts
 var MAIL_DB_IMAGE = process.env.OPENSHIP_MAIL_DB_IMAGE?.trim() || "postgres:16-alpine";
 var ENGINE_ENV_FILE = `${MAIL_HOST_STATE_DIR}/engine.env`;
@@ -342,6 +315,102 @@ function decryptCredential(stored) {
 import { createHash as createHash3 } from "crypto";
 import { Transform as Transform2 } from "stream";
 
+// ../../packages/adapters/src/backup/common/dump-pipeline.ts
+function codecSuffix(codec) {
+  return codec === "zstd" ? ".zst" : codec === "gzip" ? ".gz" : "";
+}
+function preludeBlock(prelude) {
+  return `{
+${prelude}
+} >&2`;
+}
+function compressor(codec) {
+  if (codec === "zstd") return "zstd -c -3";
+  if (codec === "gzip") return "gzip -c";
+  return null;
+}
+function decompressor(codec) {
+  if (codec === "zstd") return "zstd -d -c";
+  if (codec === "gzip") return "gzip -d -c";
+  return null;
+}
+function recordedCodec(value) {
+  return value === "gzip" || value === "none" || value === "zstd" ? value : "zstd";
+}
+async function detectDumpCodec(service, executor) {
+  try {
+    const { stdout, awaitExit } = await executor.execStream(service, [
+      "sh",
+      "-c",
+      "if command -v zstd >/dev/null 2>&1; then echo zstd; elif command -v gzip >/dev/null 2>&1; then echo gzip; else echo none; fi"
+    ]);
+    const chunks = [];
+    stdout.on("data", (c2) => {
+      if (chunks.length < 8) chunks.push(c2);
+    });
+    stdout.on("error", () => {
+    });
+    const exit = await awaitExit;
+    await new Promise((resolve2) => setImmediate(resolve2));
+    if (exit.code !== 0) return "none";
+    const answer = Buffer.concat(chunks).toString("utf8").trim();
+    return answer === "zstd" || answer === "gzip" ? answer : "none";
+  } catch {
+    return "none";
+  }
+}
+function safePipelineFragment(left, right, labels) {
+  return [
+    // Duplicating stdout is harmless to repeat, so a caller may use more than one of
+    // these in a script.
+    "exec 4>&1",
+    // `{ right; } >&4` and not `right >&4`: a right-hand side containing `&&` (the redis
+    // loader is `cat > file && chmod …`) would otherwise attach the redirect to its LAST
+    // command only. Grouping covers the whole side whatever the caller passes.
+    `res=$( { { if ${left}; then echo "d=0" >&3; else echo "d=$?" >&3; fi; } | { if { ${right}; } >&4; then echo "c=0" >&3; else echo "c=$?" >&3; fi; } } 3>&1 )`,
+    // Both default to FAILURE, so a report that never arrived cannot read as success.
+    "d=1; c=1",
+    // Unquoted `$res` word-splits on IFS, which includes the newline separating the two
+    // reports — no `sed`/`awk` (a minimal image may have neither), and order-independent.
+    // The two writes are single sub-PIPE_BUF lines on one pipe, so they cannot interleave.
+    'for kv in $res; do case "$kv" in d=*) d=${kv#d=} ;; c=*) c=${kv#c=} ;; esac; done',
+    // A status we could not parse is a failure, never an implicit success.
+    `case "$d" in ''|*[!0-9]*) d=1 ;; esac`,
+    `case "$c" in ''|*[!0-9]*) c=1 ;; esac`,
+    `[ "$c" = 0 ] || { echo "openship: ${labels.right} failed with status $c" >&2; exit "$c"; }`,
+    `[ "$d" = 0 ] || { echo "openship: ${labels.left} failed with status $d" >&2; exit "$d"; }`
+  ].join("\n");
+}
+function safePipelineCommand(left, right, labels, prelude) {
+  const script = [
+    ...prelude ? [preludeBlock(prelude)] : [],
+    safePipelineFragment(left, right, labels)
+  ].join("\n");
+  return ["sh", "-c", script];
+}
+function safeDumpCommand(dump, codec, prelude) {
+  const comp = compressor(codec);
+  if (!comp) return ["sh", "-c", prelude ? `${preludeBlock(prelude)}
+${dump}` : dump];
+  return safePipelineCommand(
+    dump,
+    comp,
+    { left: "the dump command", right: `the compressor '${comp}'` },
+    prelude
+  );
+}
+function safeRestoreCommand(codec, load, prelude) {
+  const decomp = decompressor(codec);
+  if (!decomp) return ["sh", "-c", prelude ? `${preludeBlock(prelude)}
+${load}` : load];
+  return safePipelineCommand(
+    decomp,
+    load,
+    { left: `the decompressor '${decomp}'`, right: "the restore command" },
+    prelude
+  );
+}
+
 // ../../packages/adapters/src/backup/common/source-match.ts
 function matchBackupSource(sources, targetSourceId) {
   const wanted = targetSourceId.trim();
@@ -361,40 +430,53 @@ function matchBackupSource(sources, targetSourceId) {
   return null;
 }
 
+// ../../packages/adapters/src/backup/common/artifact-metadata.ts
+var REDACTED_USERINFO_MARKER = "://***@";
+function isRedactedCommand(command) {
+  return command.includes(REDACTED_USERINFO_MARKER);
+}
+
 // ../../packages/adapters/src/backup/volume-transfer.ts
 import { Transform as Transform3 } from "stream";
 
+// ../../packages/adapters/src/backup/common/exec-target.ts
+function canExecInService(service) {
+  return !!service.containerId && service.containerRunning !== false;
+}
+
 // ../../packages/adapters/src/backup/producers/pg-dump.ts
-var POSTGRES_IMAGE_RE = /^(postgres|postgis\/postgis):/i;
 function envOr(service, key, fallback) {
   return service.env[key] ?? fallback;
 }
 var PgDumpProducerImpl = class {
   kind = "pg_dump";
   detects(service) {
-    if (!service.image || !POSTGRES_IMAGE_RE.test(service.image)) return false;
-    const db = service.env.POSTGRES_DB ?? service.env.PGDATABASE;
-    return !!db;
+    if (!isDbImage(service.image, "pg_dump")) return false;
+    return canExecInService(service);
   }
   async *produce(service, executor, _opts) {
     const user = envOr(service, "POSTGRES_USER", "postgres");
-    const db = service.env.POSTGRES_DB ?? service.env.PGDATABASE ?? "postgres";
+    const db = service.env.POSTGRES_DB ?? service.env.PGDATABASE ?? service.env.POSTGRES_USER ?? "postgres";
     const password = service.env.POSTGRES_PASSWORD ?? service.env.PGPASSWORD ?? "";
-    const cmd = [
-      "sh",
-      "-c",
-      `export PGPASSWORD=${shellEscape(password)}; pg_dump -Fc -U ${shellEscape(user)} ${shellEscape(db)} | zstd -c -3`
-    ];
+    const cmd = safeDumpCommand(
+      `pg_dump -Fc -U ${shellQuote(user)} ${shellQuote(db)}`,
+      "none",
+      `export PGPASSWORD=${shellQuote(password)}`
+    );
     const { stdout, awaitExit } = await executor.execStream(service, cmd);
     yield {
-      name: "pg-dump.zst",
+      // These bytes are pg_dump's own container format, which pg_restore reads
+      // directly. `.dump` is what the Postgres docs call it.
+      name: "pg-dump.dump",
       stream: stdout,
       payloadKind: "pg_dump",
       metadata: {
         postgresUser: user,
         postgresDb: db,
         format: "custom",
-        compression: "zstd"
+        // The EXTERNAL codec only. The custom format's internal zlib is pg_restore's
+        // own business, so a `-Fc` artifact records "none".
+        compression: "none"
       }
     };
     const exit = await awaitExit;
@@ -406,17 +488,18 @@ var PgDumpProducerImpl = class {
   }
   async restore(service, executor, artifact, _opts) {
     const user = envOr(service, "POSTGRES_USER", "postgres");
-    const db = artifact.metadata.postgresDb ?? service.env.POSTGRES_DB ?? service.env.PGDATABASE ?? "postgres";
     const password = service.env.POSTGRES_PASSWORD ?? service.env.PGPASSWORD ?? "";
-    const cmd = [
-      "sh",
-      "-c",
-      `export PGPASSWORD=${shellEscape(password)}; zstd -d | pg_restore --clean --if-exists --no-owner -U ${shellEscape(user)} -d ${shellEscape(db)}`
-    ];
+    const codec = recordedCodec(artifact.metadata.compression);
+    const db = artifact.metadata.postgresDb ?? service.env.POSTGRES_DB ?? service.env.PGDATABASE ?? service.env.POSTGRES_USER ?? "postgres";
+    const cmd = safeRestoreCommand(
+      codec,
+      `pg_restore --clean --if-exists --no-owner --no-acl --single-transaction -U ${shellQuote(user)} -d ${shellQuote(db)}`,
+      `export PGPASSWORD=${shellQuote(password)}`
+    );
     const body = await artifact.open();
     const exit = await executor.pipeIntoCommand(service, cmd, body, {
-      timeoutMs: 60 * 60 * 1e3
-      // 1h for large restores
+      // Ceiling from the catalog, so the number is not a per-producer literal.
+      timeoutMs: payloadSpec("pg_dump").restoreTimeoutMs
     });
     if (exit.code !== 0) {
       throw new Error(
@@ -425,17 +508,10 @@ var PgDumpProducerImpl = class {
     }
   }
 };
-function shellEscape(s2) {
-  return `'${s2.replace(/'/g, "'\\''")}'`;
-}
 var PgDumpProducer = new PgDumpProducerImpl();
 registerProducer(PgDumpProducer);
 
 // ../../packages/adapters/src/backup/producers/mysql-dump.ts
-var MYSQL_IMAGE_RE = /^(mysql|mariadb|percona\/percona-server):/i;
-function shellEscape2(s2) {
-  return `'${s2.replace(/'/g, "'\\''")}'`;
-}
 function mysqlCredentials(env) {
   if (env.MYSQL_ROOT_PASSWORD) {
     return { user: "root", password: env.MYSQL_ROOT_PASSWORD };
@@ -445,27 +521,32 @@ function mysqlCredentials(env) {
 var MysqlDumpProducerImpl = class {
   kind = "mysql_dump";
   detects(service) {
-    if (!service.image || !MYSQL_IMAGE_RE.test(service.image)) return false;
+    if (!isDbImage(service.image, "mysql_dump")) return false;
+    if (!canExecInService(service)) return false;
     return !!(service.env.MYSQL_ROOT_PASSWORD ?? service.env.MYSQL_PASSWORD);
   }
   async *produce(service, executor, _opts) {
     const { user, password } = mysqlCredentials(service.env);
     const db = service.env.MYSQL_DATABASE ?? "";
-    const dbArg = db ? `--databases ${shellEscape2(db)}` : "--all-databases";
-    const cmd = [
-      "sh",
-      "-c",
-      `MYSQL_PWD=${shellEscape2(password)} mysqldump --single-transaction --routines --triggers -u ${shellEscape2(user)} ${dbArg} | zstd -c -3`
-    ];
+    const dbArg = db ? `--databases ${shellQuote(db)}` : "--all-databases";
+    const codec = await detectDumpCodec(service, executor);
+    const cmd = safeDumpCommand(
+      `mysqldump --single-transaction --routines --triggers -u ${shellQuote(user)} ${dbArg}`,
+      codec,
+      // `export`, not the `VAR=x cmd` prefix: with a pipeline the prefix form sets
+      // the variable on mysqldump only, and the safe-pipeline wrapper puts the
+      // compressor in the same shell.
+      `export MYSQL_PWD=${shellQuote(password)}`
+    );
     const { stdout, awaitExit } = await executor.execStream(service, cmd);
     yield {
-      name: "mysql-dump.sql.zst",
+      name: `mysql-dump.sql${codecSuffix(codec)}`,
       stream: stdout,
       payloadKind: "mysql_dump",
       metadata: {
         mysqlUser: user,
         mysqlDatabase: db || "(all)",
-        compression: "zstd"
+        compression: codec
       }
     };
     const exit = await awaitExit;
@@ -475,14 +556,16 @@ var MysqlDumpProducerImpl = class {
   }
   async restore(service, executor, artifact, _opts) {
     const { user, password } = mysqlCredentials(service.env);
-    const cmd = [
-      "sh",
-      "-c",
-      `export MYSQL_PWD=${shellEscape2(password)}; zstd -d | mysql -u ${shellEscape2(user)}`
-    ];
+    const codec = recordedCodec(artifact.metadata.compression);
+    const cmd = safeRestoreCommand(
+      codec,
+      `mysql -u ${shellQuote(user)}`,
+      `export MYSQL_PWD=${shellQuote(password)}`
+    );
     const body = await artifact.open();
     const exit = await executor.pipeIntoCommand(service, cmd, body, {
-      timeoutMs: 60 * 60 * 1e3
+      // Ceiling from the catalog, so the number is not a per-producer literal.
+      timeoutMs: payloadSpec("mysql_dump").restoreTimeoutMs
     });
     if (exit.code !== 0) {
       throw new Error(`mysql restore exited ${exit.code}: ${exit.stderr.slice(0, 500)}`);
@@ -493,36 +576,110 @@ var MysqlDumpProducer = new MysqlDumpProducerImpl();
 registerProducer(MysqlDumpProducer);
 
 // ../../packages/adapters/src/backup/producers/redis.ts
-var REDIS_IMAGE_RE = /^redis(\/|:)/i;
+async function probeOutput(res) {
+  const chunks = [];
+  let size = 0;
+  const drained = new Promise((resolve2) => {
+    res.stdout.on("data", (c2) => {
+      if (size < 4096) {
+        chunks.push(Buffer.from(c2));
+        size += c2.byteLength;
+      }
+    });
+    res.stdout.once("end", () => resolve2());
+    res.stdout.once("error", () => resolve2());
+    res.stdout.once("close", () => resolve2());
+  });
+  await withTimeout(drained, PROBE_TIMEOUT_MS, "redis config probe timed out").catch(
+    () => void 0
+  );
+  await res.awaitExit.catch(() => void 0);
+  return Buffer.concat(chunks).toString("utf8");
+}
+var PROBE_TIMEOUT_MS = 3e4;
+var BGSAVE_WAIT_SECONDS = 300;
 var RedisRdbProducerImpl = class {
   kind = "redis_rdb";
   detects(service) {
-    return !!service.image && REDIS_IMAGE_RE.test(service.image);
+    if (!isDbImage(service.image, "redis_rdb")) return false;
+    return canExecInService(service);
   }
   async *produce(service, executor, _opts) {
-    const auth = service.env.REDIS_PASSWORD ? `-a '${service.env.REDIS_PASSWORD.replace(/'/g, "'\\''")}'` : "";
-    const trigger = `
-      LAST=$(redis-cli ${auth} LASTSAVE);
-      redis-cli ${auth} BGSAVE >/dev/null;
-      for i in $(seq 1 60); do
-        CUR=$(redis-cli ${auth} LASTSAVE);
-        if [ "$CUR" != "$LAST" ]; then break; fi
-        sleep 1;
-      done;
-      cat /data/dump.rdb | zstd -c -3
-    `;
-    const { stdout, awaitExit } = await executor.execStream(service, [
-      "sh",
-      "-c",
-      trigger
-    ]);
+    const cli = this.cli(service);
+    const waitSeconds = BGSAVE_WAIT_SECONDS;
+    const codec = await detectDumpCodec(service, executor);
+    const prelude = [
+      // One reader for both LASTSAVE calls, because reading it correctly is not a
+      // one-liner: `redis-cli -a` has printed an auth warning on EVERY invocation since
+      // 4.0, so the capture is two lines and folding it into the timestamp with a bare
+      // `2>&1` would make every password-protected Redis look unreachable. Take the last
+      // all-digits LINE as the reply, and keep the rest as the diagnostic.
+      `lastsave() {`,
+      `  RAW=$(${cli} LASTSAVE 2>&1 | tr -d '\\r')`,
+      `  TS=$(printf '%s\\n' "$RAW" | grep -E '^[0-9]+$' | tail -n 1)`,
+      `}`,
+      `lastsave`,
+      `[ -n "$TS" ] || {`,
+      `  echo "openship: could not read Redis LASTSAVE, so a captured dump.rdb could not be proven fresh \u2014 refusing to archive a possibly stale one. redis-cli said: $RAW" >&2`,
+      `  exit 91`,
+      `}`,
+      `LAST=$TS`,
+      // Both halves of "did BGSAVE start", because which one answers depends on the
+      // version: Redis 6+ exits non-zero on an error reply, older builds exit 0 and only
+      // print it. An already-RUNNING save is not a failure — it will advance LASTSAVE, so
+      // the wait below covers it — and its reply contains ERR, which is why that arm comes
+      // first.
+      //
+      // `already in progress` and not `in progress`: Redis has a SECOND error with that
+      // phrase — "Can't BGSAVE while AOF log rewriting is in progress" — and it means the
+      // opposite, that no save was started at all. Matching the loose phrase waved it
+      // through and left the wait polling for a timestamp nothing was going to move.
+      `BG=$(${cli} BGSAVE 2>&1 | tr -d '\\r') || BGFAIL=1`,
+      `case "$BG" in`,
+      `  *"already in progress"*) ;;`,
+      `  *ERR*) BGFAIL=1 ;;`,
+      `esac`,
+      `[ -z "$BGFAIL" ] || {`,
+      `  echo "openship: Redis would not start a background save, so /data/dump.rdb is whatever an earlier save left there \u2014 refusing to archive it as this backup. redis-cli said: $BG" >&2`,
+      `  exit 92`,
+      `}`,
+      `i=0; SAVED=0`,
+      `while [ "$i" -lt ${waitSeconds} ]; do`,
+      `  lastsave`,
+      `  [ -n "$TS" ] || {`,
+      `    echo "openship: lost contact with Redis while waiting for BGSAVE to finish. redis-cli said: $RAW" >&2`,
+      `    exit 91`,
+      `  }`,
+      `  if [ "$TS" != "$LAST" ]; then SAVED=1; break; fi`,
+      // Fail on a save Redis has already given up on rather than waiting out the whole
+      // window for a timestamp that is never going to move. Gated on
+      // `rdb_bgsave_in_progress:0` because the status field still reports the PREVIOUS
+      // save's result while a new one runs. A missing `tr`/`grep`/`INFO` leaves this
+      // empty, which matches nothing and falls through to the timeout below — the checks
+      // here only ever ADD a reason to fail, never a reason to pass.
+      `  INFO=$(${cli} INFO persistence 2>/dev/null | tr -d '\\r')`,
+      `  case "$INFO" in *rdb_bgsave_in_progress:0*)`,
+      `    case "$INFO" in *rdb_last_bgsave_status:err*)`,
+      `      echo "openship: Redis reported its background save FAILED (rdb_last_bgsave_status:err) \u2014 usually no free space where /data lives. Nothing fresh was written, so refusing to archive the previous save." >&2`,
+      `      exit 93 ;;`,
+      `    esac ;;`,
+      `  esac`,
+      `  i=$((i+1)); sleep 1`,
+      `done`,
+      `[ "$SAVED" = 1 ] || {`,
+      `  echo "openship: Redis BGSAVE did not finish within ${waitSeconds}s \u2014 LASTSAVE never advanced, so /data/dump.rdb is still the PREVIOUS save. Refusing to archive it as this backup; use a volume payload for a dataset this large, or retry." >&2`,
+      `  exit 94`,
+      `}`
+    ].join("\n");
+    const cmd = safeDumpCommand("cat /data/dump.rdb", codec, prelude);
+    const { stdout, awaitExit } = await executor.execStream(service, cmd);
     yield {
-      name: "redis-dump.rdb.zst",
+      name: `redis-dump.rdb${codecSuffix(codec)}`,
       stream: stdout,
       payloadKind: "redis_rdb",
       metadata: {
         rdbPath: "/data/dump.rdb",
-        compression: "zstd"
+        compression: codec
       }
     };
     const exit = await awaitExit;
@@ -530,15 +687,31 @@ var RedisRdbProducerImpl = class {
       throw new Error(`redis BGSAVE/capture exited ${exit.code}: ${exit.stderr.slice(0, 500)}`);
     }
   }
+  /** `redis-cli` with auth, when a password is discoverable. */
+  cli(service) {
+    const pass = service.env.REDIS_PASSWORD;
+    return pass ? `redis-cli -a ${shellQuote(pass)}` : "redis-cli";
+  }
   async restore(service, executor, artifact, _opts) {
-    const cmd = [
-      "sh",
-      "-c",
-      "zstd -d > /data/dump.rdb && chmod 644 /data/dump.rdb"
-    ];
+    const aofValue = await probeOutput(
+      await executor.execStream(service, [
+        "sh",
+        "-c",
+        `${this.cli(service)} CONFIG GET appendonly 2>/dev/null | tail -n 1`
+      ])
+    );
+    if (aofValue.trim().toLowerCase() === "yes") {
+      throw new Error(
+        `This Redis has AOF persistence enabled (appendonly yes), so at startup it loads its append-only file INSTEAD of dump.rdb \u2014 restoring this RDB artifact would change nothing. Disable appendonly on the service and redeploy before restoring an RDB, or restore from a volume backup, which replaces /data wholesale.`
+      );
+    }
+    await executor.execStream(service, ["sh", "-c", `${this.cli(service)} CONFIG SET save '' >/dev/null 2>&1`]).then((r2) => r2.awaitExit).catch(() => void 0);
+    const codec = recordedCodec(artifact.metadata.compression);
+    const cmd = safeRestoreCommand(codec, "cat > /data/dump.rdb && chmod 644 /data/dump.rdb");
     const body = await artifact.open();
     const exit = await executor.pipeIntoCommand(service, cmd, body, {
-      timeoutMs: 30 * 60 * 1e3
+      // Ceiling from the catalog, so the number is not a per-producer literal.
+      timeoutMs: payloadSpec("redis_rdb").restoreTimeoutMs
     });
     if (exit.code !== 0) {
       throw new Error(`redis restore exited ${exit.code}: ${exit.stderr.slice(0, 500)}`);
@@ -549,20 +722,17 @@ var RedisRdbProducer = new RedisRdbProducerImpl();
 registerProducer(RedisRdbProducer);
 
 // ../../packages/adapters/src/backup/producers/mongo.ts
-var MONGO_IMAGE_RE = /^(mongo|percona\/percona-server-mongodb):/i;
-function shellEscape3(s2) {
-  return `'${s2.replace(/'/g, "'\\''")}'`;
-}
 var MongoDumpProducerImpl = class {
   kind = "mongo_dump";
   detects(service) {
-    return !!service.image && MONGO_IMAGE_RE.test(service.image);
+    if (!isDbImage(service.image, "mongo_dump")) return false;
+    return canExecInService(service);
   }
   authArgs(service) {
     const user = service.env.MONGO_INITDB_ROOT_USERNAME ?? service.env.MONGODB_ROOT_USERNAME ?? "";
     const pass = service.env.MONGO_INITDB_ROOT_PASSWORD ?? service.env.MONGODB_ROOT_PASSWORD ?? "";
     if (!user || !pass) return "";
-    return `-u ${shellEscape3(user)} -p ${shellEscape3(pass)} --authenticationDatabase admin`;
+    return `-u ${shellQuote(user)} -p ${shellQuote(pass)} --authenticationDatabase admin`;
   }
   async *produce(service, executor, _opts) {
     const auth = this.authArgs(service);
@@ -588,7 +758,8 @@ var MongoDumpProducerImpl = class {
     ];
     const body = await artifact.open();
     const exit = await executor.pipeIntoCommand(service, cmd, body, {
-      timeoutMs: 60 * 60 * 1e3
+      // Ceiling from the catalog, so the number is not a per-producer literal.
+      timeoutMs: payloadSpec("mongo_dump").restoreTimeoutMs
     });
     if (exit.code !== 0) {
       throw new Error(`mongorestore exited ${exit.code}: ${exit.stderr.slice(0, 500)}`);
@@ -638,12 +809,18 @@ var CustomCommandProducerImpl = class {
         "Backup has no restoreCommand recorded \u2014 restore is not possible for this artifact. Re-run the backup policy to capture a restorable one."
       );
     }
+    if (isRedactedCommand(restoreCommand)) {
+      throw new Error(
+        "Backup's recorded restoreCommand had its credentials redacted when it was captured, so running it would fail authentication partway through the restore. Re-run the backup policy to capture a restorable artifact (or restore by hand using the command on the policy)."
+      );
+    }
     const body = await artifact.open();
     const exit = await executor.pipeIntoCommand(
       service,
       ["sh", "-c", restoreCommand],
       body,
-      { timeoutMs: 60 * 60 * 1e3 }
+      // Ceiling from the catalog, so the number is not a per-producer literal.
+      { timeoutMs: payloadSpec("custom_command").restoreTimeoutMs }
     );
     if (exit.code !== 0) {
       throw new Error(
@@ -655,6 +832,130 @@ var CustomCommandProducerImpl = class {
 var CustomCommandProducer = new CustomCommandProducerImpl();
 registerProducer(CustomCommandProducer);
 
+// ../../packages/adapters/src/backup/producers/path.ts
+function guardSourcePath(path, serviceName) {
+  const q2 = shellQuote(path);
+  return [
+    `if [ ! -d ${q2} ]; then`,
+    `  echo "openship: ${path} does not exist inside service ${serviceName} (or is not a directory), so there is nothing to archive. Check the path, or point the policy at a volume instead." >&2`,
+    `  exit 66`,
+    `fi`,
+    `if [ -z "$(find ${q2} -mindepth 1 -print -quit 2>/dev/null)" ]; then`,
+    `  echo "openship: ${path} exists inside service ${serviceName} but is empty. Refusing to record an empty archive as a backup \u2014 a directory that should hold data and does not usually means the data lives somewhere else (a volume mounted one level off, or an app that moved its data directory). Fix the path, or remove it from the policy if it is expected to be empty." >&2`,
+    `  exit 67`,
+    `fi`
+  ].join("\n");
+}
+function guardRestorePath(path, codec, clear) {
+  const q2 = shellQuote(path);
+  const tool = codec === "zstd" ? "zstd" : codec === "gzip" ? "gzip" : null;
+  const lines = [];
+  if (tool && clear) {
+    lines.push(
+      `command -v ${tool} >/dev/null 2>&1 || { echo "openship: ${tool} is not available inside this service, so the archive cannot be decompressed. Refusing to clear ${path}: nothing was written and your data is untouched." >&2; exit 90; }`
+    );
+  }
+  lines.push(`mkdir -p ${q2} || exit 91`);
+  if (clear) {
+    lines.push(`find ${q2} -mindepth 1 -maxdepth 1 -exec rm -rf {} + 2>/dev/null || true`);
+  }
+  return lines.join("\n");
+}
+function pathSlug(path) {
+  return path.replace(/^\/+/, "").replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 80) || "root";
+}
+var PathArchiveProducerImpl = class {
+  kind = "path";
+  // No detects() — explicit selection only. See the module doc.
+  async *produce(service, executor, opts) {
+    const requested = opts.paths ?? [];
+    if (requested.length === 0) {
+      throw new Error(
+        `Nothing to back up for service "${service.name}": this policy archives files and folders but names none. Set \`payloadConfig.paths\` to one or more absolute paths inside the service.`
+      );
+    }
+    const paths = [];
+    for (const entry of requested) {
+      const problem = validateBackupPath(entry);
+      if (problem) throw new Error(problem);
+      const normalized = normalizeBackupPath(entry);
+      if (!paths.includes(normalized)) paths.push(normalized);
+    }
+    const codec = opts.compression ?? await detectDumpCodec(service, executor);
+    for (const path of paths) {
+      const { stdout, awaitExit } = await executor.execStream(
+        service,
+        safeDumpCommand(
+          // `-C <dir> .` rather than `tar -c <dir>`: the archive holds the directory's
+          // CONTENTS at relative paths, so it can be extracted into a different
+          // location — which is what makes an artifact captured from /data/app
+          // restorable after the app moved to /srv/app.
+          `tar -c -C ${shellQuote(path)} ${(opts.exclude ?? []).map((p2) => `--exclude=${shellQuote(p2)}`).join(" ")} .`.replace(/\s+/g, " "),
+          codec,
+          guardSourcePath(path, service.name)
+        )
+      );
+      yield {
+        name: `path-${pathSlug(path)}.tar${codecSuffix(codec)}`,
+        stream: stdout,
+        payloadKind: "path",
+        metadata: {
+          // The restore target. Recorded per-artifact rather than read back off the
+          // policy, because a policy is editable and soft-deletable: an artifact has to
+          // carry everything needed to put it back, or it stops being a restore point
+          // the moment somebody edits the schedule.
+          path,
+          compression: codec,
+          // See the module doc: always crash-consistent, and the artifact says so
+          // rather than leaving an operator to assume otherwise.
+          consistency: "crash"
+        }
+      };
+      const exit = await awaitExit;
+      if (exit.code !== 0) {
+        throw new Error(
+          `Archiving ${path} from service "${service.name}" failed (exit ${exit.code}): ${exit.stderr.slice(0, 500)}`
+        );
+      }
+    }
+  }
+  async restore(service, executor, artifact, opts) {
+    const recorded = artifact.metadata.path;
+    if (typeof recorded !== "string" || recorded.trim() === "") {
+      throw new Error(
+        `Artifact ${artifact.key} cannot restore: metadata.path missing. This artifact may have been produced by a different producer.`
+      );
+    }
+    const path = normalizeBackupPath(recorded);
+    const problem = validateBackupPath(path);
+    if (problem) throw new Error(`Artifact ${artifact.key} records an unusable path. ${problem}`);
+    const codec = recordedCodec(artifact.metadata.compression);
+    const wantsClear = opts.clearTarget === true;
+    if (wantsClear) {
+      const unsafe = validateClearPath(path);
+      if (unsafe) throw new Error(unsafe);
+    }
+    const body = await artifact.open();
+    const exit = await executor.pipeIntoCommand(
+      service,
+      safeRestoreCommand(
+        codec,
+        `tar -x -C ${shellQuote(path)}`,
+        guardRestorePath(path, codec, wantsClear)
+      ),
+      body,
+      { timeoutMs: payloadSpec("path").restoreTimeoutMs }
+    );
+    if (exit.code !== 0) {
+      throw new Error(
+        `Restoring ${path} into service "${service.name}" failed (exit ${exit.code}): ${exit.stderr.slice(0, 500)}`
+      );
+    }
+  }
+};
+var PathArchiveProducer = new PathArchiveProducerImpl();
+registerProducer(PathArchiveProducer);
+
 // ../../packages/adapters/src/backup/producers/volume.ts
 var VolumeCopyProducerImpl = class {
   kind = "volume";
@@ -663,16 +964,26 @@ var VolumeCopyProducerImpl = class {
   async *produce(service, executor, opts) {
     const sources = await executor.listSources(service);
     if (sources.length === 0) {
-      return;
+      throw new Error(
+        `Nothing to back up: no volumes or bind mounts found for service "${service.name}". ` + (service.containerId ? `Its live container (${service.containerId.slice(0, 12)}) reports no volume or bind mounts, so there is no persistent data here to capture.` : `No container was resolved for it, so only the service's recorded volumes could be checked and it has none. If this service does hold data, redeploy it so Openship records its volumes, or point the policy at a database payload instead of a volume snapshot.`)
+      );
     }
     const selected = opts.sourceIds && opts.sourceIds.length > 0 ? sources.filter((s2) => opts.sourceIds.includes(s2.id)) : sources.filter((s2) => s2.type !== "tmpfs");
+    if (selected.length === 0) {
+      const available = sources.map((s2) => `${s2.id} (${s2.type})`).join(", ");
+      throw new Error(
+        `Nothing to back up for service "${service.name}": ` + (opts.sourceIds && opts.sourceIds.length > 0 ? `the policy selects ${opts.sourceIds.join(", ")}, none of which is a source on this service. Available: ${available}.` : `its only mounts are tmpfs, which hold no data across a restart. Found: ${available}.`)
+      );
+    }
     for (const source of selected) {
+      const compression = opts.compression ?? "zstd";
       const { stdout, awaitExit } = await executor.streamPath(service, source.id, {
-        compression: "zstd",
-        exclude: opts.exclude
+        compression,
+        exclude: opts.exclude,
+        quiesce: opts.quiesce
       });
       yield {
-        name: `volume-${sanitizeArtifactName(source.id)}.tar.zst`,
+        name: `volume-${sanitizeArtifactName(source.id)}.tar${compression === "zstd" ? ".zst" : compression === "gzip" ? ".gz" : ""}`,
         stream: stdout,
         payloadKind: "volume",
         sizeHint: source.sizeHint,
@@ -681,7 +992,12 @@ var VolumeCopyProducerImpl = class {
           volumeSource: source.source,
           volumeTarget: source.target,
           volumeType: source.type,
-          compression: "zstd"
+          compression,
+          // Recorded so the artifact says what it IS, rather than leaving an operator to
+          // assume. `crash` means the service kept writing while tar walked the tree —
+          // usable for most payloads, and the reason a database deserves a logical dump
+          // instead. `quiesced` means the container was frozen for the copy.
+          consistency: opts.quiesce ? "quiesced" : "crash"
         }
       };
       const exit = await awaitExit;
@@ -701,7 +1017,12 @@ var VolumeCopyProducerImpl = class {
     }
     const stream = await artifact.open();
     await executor.receiveStream(service, volumeId, stream, {
-      compression: artifact.metadata.compression ?? "zstd",
+      // Through the recorded-codec reader rather than a cast: the cast trusted jsonb to
+      // hold one of three strings, and anything else (a typo in a hand-written policy,
+      // a value from a newer build) reached the restore helper as a codec it cannot
+      // build a pipeline for. `recordedCodec` maps the unknown to `zstd` — the only
+      // safe guess, and for the same documented reason.
+      compression: recordedCodec(artifact.metadata.compression),
       clearTarget: opts.clearTarget ?? true,
       signal: opts.signal
     });
@@ -715,10 +1036,116 @@ registerProducer(VolumeCopyProducer);
 
 // ../../packages/adapters/src/backup/executors/docker.ts
 import { PassThrough } from "stream";
+
+// ../../packages/adapters/src/runtime/docker-demux.ts
+var HEADER_BYTES = 8;
+var MAX_FRAME_BYTES = 64 * 1024 * 1024;
+var STREAM_STDIN = 0;
+var STREAM_STDOUT = 1;
+var STREAM_STDERR = 2;
+function gateSink(sink, onBlock, onUnblock, onWriteAfterEnd) {
+  let blocked = false;
+  return {
+    write(chunk) {
+      if (sink.destroyed || sink.writableEnded) return onWriteAfterEnd();
+      if (sink.write(chunk) !== false || blocked) return;
+      blocked = true;
+      onBlock();
+      sink.once("drain", () => {
+        blocked = false;
+        onUnblock();
+      });
+    }
+  };
+}
+function demuxDockerStream(source, stdout, stderr, onError) {
+  const src = source;
+  let blockedSinks = 0;
+  let pausedByUs = false;
+  const onBlock = () => {
+    blockedSinks += 1;
+    if (pausedByUs) return;
+    pausedByUs = true;
+    src.pause();
+  };
+  const onUnblock = () => {
+    blockedSinks -= 1;
+    if (blockedSinks > 0 || !pausedByUs) return;
+    pausedByUs = false;
+    src.resume();
+  };
+  const onWriteAfterEnd = () => fail(
+    new Error(
+      "Docker stream was ended while payload was still arriving: the sink had already closed, so those bytes were dropped. What was written is not a complete artifact."
+    )
+  );
+  const out = gateSink(stdout, onBlock, onUnblock, onWriteAfterEnd);
+  const err = gateSink(stderr, onBlock, onUnblock, onWriteAfterEnd);
+  let carry = null;
+  let failed = false;
+  const fail = (cause) => {
+    if (failed) return;
+    failed = true;
+    carry = null;
+    src.pause();
+    onError?.(cause);
+    stdout.destroy(cause);
+  };
+  src.on("data", (chunk) => {
+    if (failed) return;
+    let buf = carry === null ? chunk : Buffer.concat([carry, chunk]);
+    carry = null;
+    let offset = 0;
+    while (buf.length - offset >= HEADER_BYTES) {
+      const type = buf[offset];
+      const length = buf.readUInt32BE(offset + 4);
+      if (type !== STREAM_STDIN && type !== STREAM_STDOUT && type !== STREAM_STDERR) {
+        fail(
+          new Error(
+            `Docker stream desynchronized: frame type ${type} at offset ${offset} is not stdin/stdout/stderr. Refusing to guess where the payload resumes \u2014 the bytes already read cannot be trusted as a complete artifact.`
+          )
+        );
+        return;
+      }
+      if (length > MAX_FRAME_BYTES) {
+        fail(
+          new Error(
+            `Docker stream desynchronized: frame claims ${length} bytes, over the ${MAX_FRAME_BYTES}-byte sanity ceiling. Treating as a lost frame boundary rather than waiting for input that will never arrive.`
+          )
+        );
+        return;
+      }
+      if (buf.length - offset - HEADER_BYTES < length) break;
+      const payload = buf.subarray(offset + HEADER_BYTES, offset + HEADER_BYTES + length);
+      if (type === STREAM_STDOUT) out.write(payload);
+      else if (type === STREAM_STDERR) err.write(payload);
+      offset += HEADER_BYTES + length;
+    }
+    if (offset < buf.length) {
+      carry = Buffer.from(buf.subarray(offset));
+    }
+  });
+  src.on("error", (cause) => fail(cause));
+  src.on("end", () => {
+    if (failed || carry === null) return;
+    fail(
+      new Error(
+        `Docker stream ended mid-frame with ${carry.length} bytes of an incomplete frame buffered. The payload was cut short, so what was read is not a complete artifact.`
+      )
+    );
+  });
+  return {
+    pending: () => carry !== null || src.readableLength > 0 || blockedSinks > 0
+  };
+}
+
+// ../../packages/adapters/src/backup/executors/docker.ts
 var HELPER_IMAGE = "alpine:3";
+var ARTIFACT_BUFFER_BYTES = 4 * 1024 * 1024;
 var DEFAULT_HELPER_IDLE_MS = 10 * 60 * 1e3;
 var DEFAULT_HELPER_TIMEOUT_MS = 6 * 60 * 60 * 1e3;
 var EXIT_POLL_INTERVAL_MS = 2e3;
+var ATTACH_DRAIN_QUIET_MS = 3e3;
 function createIdleWatchdog(ms, message) {
   let timer;
   let done = false;
@@ -768,9 +1195,6 @@ function destroyQuietly(stream) {
   } catch {
   }
 }
-function shellEscape4(s2) {
-  return `'${s2.replace(/'/g, "'\\''")}'`;
-}
 function compressionFlag(compression) {
   switch (compression) {
     case "gzip":
@@ -800,6 +1224,26 @@ var DockerBackupExecutor = class {
   get dockerode() {
     return this.runtime.docker;
   }
+  /**
+   * Freeze / thaw the target container around a copy — Docker's native cgroup freezer.
+   *
+   * `unpause` is best-effort and deliberately swallows "not paused": the thaw runs from a
+   * `finally`, and a container the daemon already restarted (or that a human unpaused)
+   * must not turn a completed backup into a failed one. `pause` is NOT best-effort — see
+   * streamPath.
+   */
+  async freeze(containerId) {
+    await this.dockerode.getContainer(containerId).pause();
+  }
+  async thaw(containerId, label) {
+    try {
+      await this.dockerode.getContainer(containerId).unpause();
+    } catch (err) {
+      console.error(
+        `[backup] ${label}: could not unpause container ${containerId.slice(0, 12)} after the copy \u2014 the service may still be FROZEN and needs \`docker unpause\`: ${err?.message ?? String(err)}`
+      );
+    }
+  }
   async listSources(service) {
     if (service.containerId) {
       try {
@@ -819,7 +1263,7 @@ var DockerBackupExecutor = class {
     return service.volumes.map((spec, i2) => {
       const parsed = parseVolumeSpec(spec);
       if (!parsed || !parsed.source) return null;
-      const source = parsed.type === "volume" && service.namespaceVolumes ? scopedVolumeName(service.projectSlug, parsed.source) : parsed.source;
+      const source = parsed.type === "volume" && service.namespaceVolumes ? ensureScopedVolumeName(service.projectSlug, parsed.source) : parsed.source;
       return {
         id: `${source}-${i2}`,
         source,
@@ -828,6 +1272,31 @@ var DockerBackupExecutor = class {
       };
     }).filter((x2) => x2 !== null);
   }
+  /**
+   * The container's own `Config.Env`, as `KEY=value` pairs already split.
+   *
+   * This is the credentials source for every service Openship did not deploy
+   * itself — see `BackupExecutor.readContainerEnv`. Returns `{}` rather than
+   * throwing on any failure: it is an ENRICHMENT of the handle's env, so a
+   * container that has gone away, or a daemon that refuses the inspect, must leave
+   * the caller exactly as well off as before it asked.
+   */
+  async readContainerEnv(service) {
+    if (!service.containerId) return {};
+    try {
+      const data = await this.dockerode.getContainer(service.containerId).inspect();
+      const pairs = data.Config?.Env ?? [] ?? [];
+      const env = {};
+      for (const pair of pairs) {
+        const eq = pair.indexOf("=");
+        if (eq <= 0) continue;
+        env[pair.slice(0, eq)] = pair.slice(eq + 1);
+      }
+      return env;
+    } catch {
+      return {};
+    }
+  }
   async execStream(service, cmd, opts) {
     if (!service.containerId) {
       throw new Error(
@@ -843,7 +1312,10 @@ var DockerBackupExecutor = class {
       WorkingDir: opts?.cwd,
       Env: opts?.env ? Object.entries(opts.env).map(([k2, v2]) => `${k2}=${v2}`) : void 0
     });
-    const stream = await exec.start({ stdin: false });
+    const stream = await startExecStream(daemonConnectionFrom(this.dockerode), exec.id, {
+      tty: false,
+      stdin: false
+    });
     return this.attachDemuxed(this.dockerode, exec.id, stream, opts, {
       label: `exec in service ${service.name}`
     });
@@ -858,9 +1330,9 @@ var DockerBackupExecutor = class {
       throw new Error(`Backup source "${sourceId}" is tmpfs \u2014 not backupable`);
     }
     const compression = opts?.compression ?? "zstd";
-    const excludeArgs = (opts?.exclude ?? []).flatMap((p2) => ["--exclude", shellEscape4(p2)]);
+    const excludeArgs = (opts?.exclude ?? []).flatMap((p2) => ["--exclude", shellQuote(p2)]);
     const tarFlags = compressionFlag(compression);
-    const tarCmd = compression === "zstd" ? `tar -c${tarFlags} -C /mnt ${excludeArgs.join(" ")} . | zstd -c -3` : `tar -c${tarFlags} -C /mnt ${excludeArgs.join(" ")} .`;
+    const tarCmd = `tar -c${tarFlags} -C /mnt ${excludeArgs.join(" ")} .`;
     const helperImage = compression === "zstd" ? "alpine:3" : HELPER_IMAGE;
     await this.ensureImage(helperImage);
     const hostConfig = {
@@ -880,14 +1352,52 @@ var DockerBackupExecutor = class {
       // the helper exits. Nothing ever reads these logs.
       LogConfig: { Type: "none", Config: {} }
     };
-    return this.handOffHelper(
+    const quiesceId = opts?.quiesce ? service.containerId : null;
+    if (opts?.quiesce && !quiesceId) {
+      throw new Error(
+        `Cannot quiesce service "${service.name}" for a consistent copy: it has no running container to freeze. Either deploy it, or take the copy without quiesce and accept a crash-consistent archive.`
+      );
+    }
+    if (quiesceId) await this.freeze(quiesceId);
+    const handed = await this.handOffHelper(
       {
         Image: helperImage,
-        Cmd: [
-          "sh",
-          "-c",
-          compression === "zstd" ? `apk add --no-cache zstd >/dev/null 2>&1; ${tarCmd}` : tarCmd
-        ],
+        // Built by the SAME helper the DB producers use, for the same reason: a shell
+        // pipeline exits with its LAST command's status, so `tar -c … | zstd` reported
+        // ZSTD's success and a tar that failed mid-archive — a permissions error, a
+        // vanishing file, ENOSPC in the pipe — came back as exit 0 over a truncated
+        // archive that the run then recorded as a complete backup. Closing that for
+        // `pg_dump | zstd` and leaving it here would have been the same bug with a
+        // different payload, and the volume producer is the DEFAULT one.
+        //
+        // gzip and none need no pipeline at all (busybox tar compresses in-process via
+        // `tarFlags`), so those pass `"none"` and keep tar's own status directly.
+        Cmd: safeDumpCommand(
+          tarCmd,
+          compression === "zstd" ? "zstd" : "none",
+          [
+            // REFUSE an empty mount before doing anything else.
+            //
+            // The daemon CREATES a missing bind directory and a missing named volume
+            // when it honors HostConfig.Binds, so a source that is not on this host
+            // produces a helper that starts fine and a `tar -c` of nothing that exits
+            // 0. That archive is ~350 bytes compressed, so the orchestrator's
+            // zero-byte guard passes and the run is recorded as a successful backup —
+            // a nightly green tick over an external disk that failed to mount, a data
+            // directory that was renamed under a still-running container, or a volume
+            // that `docker system prune --volumes` took.
+            //
+            // An intentionally-empty source fails too, which is the deliberate half of
+            // the trade: an archive of nothing is not a restore point either way, and
+            // the operator has `payloadConfig.sourceIds` to narrow the policy. Silence
+            // is the only outcome that cannot be recovered from.
+            `SRC=${shellQuote(sourceId)}`,
+            `[ -n "$(ls -A /mnt 2>/dev/null)" ] || { echo "openship: backup source $SRC is empty or missing on this host, so this archive would contain nothing. Refusing to record it as a backup. If it is a mount, check that it is mounted; if it is empty on purpose, narrow the policy's sourceIds." >&2; exit 91; }`,
+            // zstd is not in alpine:3, so the helper installs it. Second, so a doomed
+            // capture does not pay the ~20s fetch first.
+            compression === "zstd" ? "apk add --no-cache zstd >/dev/null 2>&1" : null
+          ].filter(Boolean).join("\n")
+        ),
         HostConfig: hostConfig,
         AttachStdout: true,
         AttachStderr: true,
@@ -897,8 +1407,8 @@ var DockerBackupExecutor = class {
         NetworkDisabled: compression !== "zstd"
       },
       async (helper) => {
-        const stream = await helper.attach({
-          stream: true,
+        const stream = await startAttachStream(daemonConnectionFrom(this.dockerode), helper.id, {
+          stdin: false,
           stdout: true,
           stderr: true
         });
@@ -909,7 +1419,22 @@ var DockerBackupExecutor = class {
           label: `Backup of "${sourceId}" on service ${service.name}`
         });
       }
-    );
+    ).catch(async (err) => {
+      if (quiesceId) await this.thaw(quiesceId, `backup of "${sourceId}"`);
+      throw err;
+    });
+    if (!quiesceId) return handed;
+    return {
+      stdout: handed.stdout,
+      // Thaw when the copy is DONE, however it ends. `awaitExit` settles once the helper
+      // has exited and its output has drained, which is precisely the window the freeze has
+      // to cover; unfreezing when `streamPath` returned would thaw before a single byte had
+      // been read. The original promise is handed back so a caller still sees its value or
+      // its rejection.
+      awaitExit: handed.awaitExit.finally(
+        () => this.thaw(quiesceId, `backup of "${sourceId}"`)
+      )
+    };
   }
   async receiveStream(service, targetSourceId, body, opts) {
     opts?.signal?.throwIfAborted();
@@ -924,16 +1449,18 @@ var DockerBackupExecutor = class {
     const compression = opts?.compression ?? "zstd";
     const helperImage = compression === "zstd" ? "alpine:3" : HELPER_IMAGE;
     await this.ensureImage(helperImage);
-    const clearCmd = opts?.clearTarget ? `find /mnt -mindepth 1 -delete 2>/dev/null || true; ` : "";
-    const untarCmd = compression === "zstd" ? `${clearCmd}zstd -d -c | tar -x -C /mnt` : `${clearCmd}tar -x${compressionFlag(compression)}f - -C /mnt`;
+    const restoreCodec = compression === "none" ? "none" : compression;
+    const prelude = [
+      compression === "zstd" ? "apk add --no-cache zstd >/dev/null 2>&1 || true" : null,
+      compression === "zstd" ? 'command -v zstd >/dev/null 2>&1 || { echo "openship: zstd is not available in the restore helper and could not be installed (the host may have no egress). Refusing to clear the target: nothing was written and your data is untouched." >&2; exit 90; }' : null,
+      compression === "gzip" ? 'command -v gzip >/dev/null 2>&1 || { echo "openship: gzip is not available in the restore helper. Refusing to clear the target; your data is untouched." >&2; exit 90; }' : null,
+      // Only now, with every tool proven present.
+      opts?.clearTarget ? "find /mnt -mindepth 1 -delete 2>/dev/null || true" : null
+    ].filter(Boolean).join("\n");
     return this.withHelper(
       {
         Image: helperImage,
-        Cmd: [
-          "sh",
-          "-c",
-          compression === "zstd" ? `apk add --no-cache zstd >/dev/null 2>&1; ${untarCmd}` : untarCmd
-        ],
+        Cmd: safeRestoreCommand(restoreCodec, "tar -x -C /mnt", prelude),
         // AutoRemove is OFF deliberately, and this is the fix for the `404 no such
         // container` in #434: with it on, the daemon could reap the helper before
         // /containers/{id}/wait answered, and the exit status was then unknowable.
@@ -1218,47 +1745,69 @@ var DockerBackupExecutor = class {
     const { PassThrough: PassThrough3 } = await import("stream");
     const stdoutSink = new PassThrough3();
     stdoutSink.resume();
+    stdoutSink.on("error", () => {
+    });
     const stderrSink = new PassThrough3();
     stderrSink.on("data", (chunk) => {
       if (stderrChunks.length < 16) stderrChunks.push(chunk);
     });
-    this.dockerode.modem.demuxStream(
-      stream,
-      stdoutSink,
-      stderrSink
-    );
-    const timer = opts?.timeoutMs ? setTimeout(() => {
-      try {
-        stream.end?.();
-      } catch {
-      }
-    }, opts.timeoutMs) : null;
-    return new Promise((resolve2, reject) => {
+    demuxDockerStream(stream, stdoutSink, stderrSink);
+    const stderrTail = () => Buffer.concat(stderrChunks).toString("utf8").slice(0, 16 * 1024);
+    const timeoutMs = opts?.timeoutMs ?? DEFAULT_HELPER_TIMEOUT_MS;
+    let bodyEnded = false;
+    let polling = true;
+    const attachEnded = new Promise((resolve2, reject) => {
       body.on("error", (err) => {
-        if (timer) clearTimeout(timer);
         try {
           stream.end?.();
         } catch {
         }
         reject(err);
       });
+      body.on("end", () => {
+        bodyEnded = true;
+      });
       stream.on("end", async () => {
-        if (timer) clearTimeout(timer);
         try {
-          resolve2({
-            code: await resolveExecExitCode(exec, exec.id),
-            stderr: Buffer.concat(stderrChunks).toString("utf8").slice(0, 16 * 1024)
-          });
+          resolve2({ code: await resolveExecExitCode(exec, exec.id), stderr: stderrTail() });
         } catch (err) {
           reject(err);
         }
       });
-      stream.on("error", (err) => {
-        if (timer) clearTimeout(timer);
-        reject(err);
-      });
+      stream.on("error", (err) => reject(err));
       body.pipe(stream);
     });
+    const polledExit = async () => {
+      while (polling) {
+        await new Promise((r2) => {
+          const t8 = setTimeout(r2, EXIT_POLL_INTERVAL_MS);
+          t8.unref?.();
+        });
+        if (!polling || !bodyEnded) continue;
+        let info;
+        try {
+          info = await exec.inspect();
+        } catch {
+          continue;
+        }
+        if (info.Running === false && typeof info.ExitCode === "number") {
+          return { code: info.ExitCode, stderr: stderrTail() };
+        }
+      }
+      return new Promise(() => {
+      });
+    };
+    try {
+      return await withTimeout(
+        Promise.race([attachEnded, polledExit()]),
+        timeoutMs,
+        `Restore into service ${service.name} exceeded its ${Math.round(timeoutMs / 1e3)}s ceiling and was abandoned. The target may hold partial data.`
+      );
+    } finally {
+      polling = false;
+      destroyQuietly(stream);
+      destroyQuietly(body);
+    }
   }
   async stopService(service) {
     if (!service.containerId) return;
@@ -1297,13 +1846,18 @@ var DockerBackupExecutor = class {
     const label = meta?.label ?? "exec";
     const idleMs = opts?.idleTimeoutMs ?? DEFAULT_HELPER_IDLE_MS;
     const timeoutMs = opts?.timeoutMs ?? DEFAULT_HELPER_TIMEOUT_MS;
-    const stdout = new PassThrough();
+    const stdout = new PassThrough({ highWaterMark: ARTIFACT_BUFFER_BYTES });
     const stderrChunks = [];
     const stderrSink = new PassThrough();
     stderrSink.on("data", (chunk) => {
       if (stderrChunks.length < 16) stderrChunks.push(chunk);
     });
-    docker.modem.demuxStream(stream, stdout, stderrSink);
+    let demuxError = null;
+    let rejectExit = null;
+    demuxDockerStream(stream, stdout, stderrSink, (err) => {
+      demuxError ??= err;
+      rejectExit?.(err);
+    });
     let sinksEnded = false;
     const endSinks = () => {
       if (sinksEnded) return;
@@ -1318,9 +1872,13 @@ var DockerBackupExecutor = class {
       `${label} produced no data for ${Math.round(idleMs / 1e3)}s and was abandoned.`
     );
     stream.on("data", () => watchdog.touch());
+    stdout.on("drain", () => watchdog.touch());
     const awaitExit = (async () => {
       const onEnd = new Promise((resolve2, reject) => {
+        rejectExit = reject;
+        if (demuxError) reject(demuxError);
         stream.on("end", async () => {
+          if (demuxError) return reject(demuxError);
           try {
             resolve2({
               code: await resolveExecExitCode(docker.getExec(execId), execId),
@@ -1340,21 +1898,33 @@ var DockerBackupExecutor = class {
         );
       } catch (err) {
         stdout.destroy(err);
+        destroyQuietly(stream);
         throw err;
       } finally {
         watchdog.dispose();
       }
     })();
+    void awaitExit.catch(() => {
+    });
     return { stdout, awaitExit };
   }
   demuxContainerStream(container, stream, opts) {
-    const stdout = new PassThrough();
+    const stdout = new PassThrough({ highWaterMark: ARTIFACT_BUFFER_BYTES });
     const stderrChunks = [];
     const stderrSink = new PassThrough();
     stderrSink.on("data", (chunk) => {
       if (stderrChunks.length < 16) stderrChunks.push(chunk);
     });
-    container.modem.demuxStream(stream, stdout, stderrSink);
+    let demuxError = null;
+    const demux = demuxDockerStream(
+      stream,
+      stdout,
+      stderrSink,
+      (err) => {
+        demuxError = err;
+      }
+    );
+    let lastProgressAt = Date.now();
     let sinksEnded = false;
     let exited = false;
     const reapIfDone = () => {
@@ -1374,7 +1944,14 @@ var DockerBackupExecutor = class {
       opts.idleTimeoutMs,
       `${opts.label} produced no data for ${Math.round(opts.idleTimeoutMs / 1e3)}s and was abandoned. Nothing was written; the archive is incomplete and was not kept.`
     );
-    stream.on("data", () => watchdog.touch());
+    stream.on("data", () => {
+      lastProgressAt = Date.now();
+      watchdog.touch();
+    });
+    stdout.on("drain", () => {
+      lastProgressAt = Date.now();
+      watchdog.touch();
+    });
     const awaitExit = (async () => {
       try {
         const res = await this.awaitHelperExit(container, watchdog, () => sinksEnded, {
@@ -1383,8 +1960,19 @@ var DockerBackupExecutor = class {
           note: "Nothing was written; the archive is incomplete and was not kept."
         });
         exited = true;
-        setTimeout(endSinks, 3e3);
+        const armEndBackstop = () => {
+          const timer = setTimeout(() => {
+            if (sinksEnded) return;
+            if (Date.now() - lastProgressAt < ATTACH_DRAIN_QUIET_MS || demux.pending()) {
+              return armEndBackstop();
+            }
+            endSinks();
+          }, ATTACH_DRAIN_QUIET_MS);
+          timer.unref?.();
+        };
+        armEndBackstop();
         reapIfDone();
+        if (demuxError) throw demuxError;
         return {
           code: res.StatusCode,
           stderr: Buffer.concat(stderrChunks).toString("utf8").slice(0, 16 * 1024)
@@ -1442,8 +2030,21 @@ var CloudBackupExecutor = class {
     const ws = this.client.workspace(service.containerId);
     const rt = await ws.runtime();
     const fullCmd = this.composeShellCommand(cmd, opts);
-    const stdout = new Readable2({ read() {
-    } });
+    let resumeRead = null;
+    const stdout = new Readable2({
+      read() {
+        const resume = resumeRead;
+        resumeRead = null;
+        resume?.();
+      }
+    });
+    const pushWithBackpressure = async (chunk) => {
+      if (stdout.push(chunk)) return;
+      if (stdout.destroyed) return;
+      await new Promise((resolve2) => {
+        resumeRead = resolve2;
+      });
+    };
     let stderrBuf = "";
     const awaitExit = new Promise((resolve2, reject) => {
       const timer = opts?.timeoutMs ? setTimeout(() => {
@@ -1459,7 +2060,7 @@ var CloudBackupExecutor = class {
           for await (const ev of stream) {
             switch (ev.event) {
               case "stdout":
-                stdout.push(Buffer.from(ev.data, "base64"));
+                await pushWithBackpressure(Buffer.from(ev.data, "base64"));
                 break;
               case "stderr": {
                 const decoded = Buffer.from(ev.data, "base64").toString("utf8");
@@ -1483,6 +2084,10 @@ var CloudBackupExecutor = class {
           if (timer) clearTimeout(timer);
           stdout.destroy(err);
           reject(err);
+        } finally {
+          const resume = resumeRead;
+          resumeRead = null;
+          resume?.();
         }
       };
       void pump();
@@ -1492,9 +2097,9 @@ var CloudBackupExecutor = class {
   /** Bake env + cwd into a shell command since Oblien's ExecRunParams
    *  doesn't carry them. */
   composeShellCommand(cmd, opts) {
-    const envPrefix = opts?.env ? Object.entries(opts.env).map(([k2, v2]) => `${k2}=${shellEscape5(v2)}`).join(" ") + " " : "";
-    const cwdPrefix = opts?.cwd ? `cd ${shellEscape5(opts.cwd)} && ` : "";
-    const quotedCmd = cmd.map((arg) => shellEscape5(arg)).join(" ");
+    const envPrefix = opts?.env ? Object.entries(opts.env).map(([k2, v2]) => `${k2}=${shellQuote(v2)}`).join(" ") + " " : "";
+    const cwdPrefix = opts?.cwd ? `cd ${shellQuote(opts.cwd)} && ` : "";
+    const quotedCmd = cmd.map((arg) => shellQuote(arg)).join(" ");
     return ["sh", "-c", `${cwdPrefix}${envPrefix}${quotedCmd}`];
   }
   async streamPath(service, sourceId, opts) {
@@ -1502,10 +2107,13 @@ var CloudBackupExecutor = class {
     const compression = opts?.compression ?? "zstd";
     const excludeArgs = (opts?.exclude ?? []).flatMap((p2) => [
       "--exclude",
-      shellEscape5(p2)
+      shellQuote(p2)
     ]);
-    const tarCmd = compression === "zstd" ? `tar -c -C ${shellEscape5(path)} ${excludeArgs.join(" ")} . | zstd -c -3` : compression === "gzip" ? `tar -cz -C ${shellEscape5(path)} ${excludeArgs.join(" ")} .` : `tar -c -C ${shellEscape5(path)} ${excludeArgs.join(" ")} .`;
-    return this.execStream(service, ["sh", "-c", tarCmd]);
+    const tarCmd = compression === "gzip" ? `tar -cz -C ${shellQuote(path)} ${excludeArgs.join(" ")} .` : `tar -c -C ${shellQuote(path)} ${excludeArgs.join(" ")} .`;
+    return this.execStream(
+      service,
+      safeDumpCommand(tarCmd, compression === "zstd" ? "zstd" : "none")
+    );
   }
   async receiveStream(service, targetSourceId, body, opts) {
     if (!service.containerId) {
@@ -1542,7 +2150,7 @@ var CloudBackupExecutor = class {
       body,
       dest: tmpPath
     });
-    const wrapped = `${this.composeShellCommand(cmd, opts).slice(2).join(" ")} < ${shellEscape5(tmpPath)}; ec=$?; rm -f ${shellEscape5(tmpPath)}; exit $ec`;
+    const wrapped = `${this.composeShellCommand(cmd, opts).slice(2).join(" ")} < ${shellQuote(tmpPath)}; ec=$?; rm -f ${shellQuote(tmpPath)}; exit $ec`;
     const result = await this.execStream(service, ["sh", "-c", wrapped]);
     result.stdout.resume();
     return result.awaitExit;
@@ -1570,9 +2178,6 @@ var CloudBackupExecutor = class {
     }
   }
 };
-function shellEscape5(s2) {
-  return `'${s2.replace(/'/g, "'\\''")}'`;
-}
 registerExecutor("cloud", (runtime) => {
   if (!(runtime instanceof CloudRuntime)) {
     throw new Error(
@@ -1588,6 +2193,8 @@ import { createWriteStream, promises as fs } from "fs";
 import { randomBytes as randomBytes2 } from "crypto";
 import { tmpdir } from "os";
 import { join } from "path";
+var DEFAULT_RESTORE_TIMEOUT_MS = 6 * 60 * 60 * 1e3;
+var KILL_GRACE_MS = 3e4;
 var BareBackupExecutor = class {
   constructor(runtime) {
     this.runtime = runtime;
@@ -1635,22 +2242,33 @@ var BareBackupExecutor = class {
     const compression = opts?.compression ?? "zstd";
     const excludeArgs = (opts?.exclude ?? []).flatMap((p2) => [
       "--exclude",
-      shellEscape6(p2)
+      shellQuote(p2)
     ]);
     const path = sourceId;
-    const tarCmd = compression === "zstd" ? `tar -c -C ${shellEscape6(path)} ${excludeArgs.join(" ")} . | zstd -c -3` : compression === "gzip" ? `tar -cz -C ${shellEscape6(path)} ${excludeArgs.join(" ")} .` : `tar -c -C ${shellEscape6(path)} ${excludeArgs.join(" ")} .`;
+    const tarCmd = compression === "zstd" ? `tar -c -C ${shellQuote(path)} ${excludeArgs.join(" ")} . | zstd -c -3` : compression === "gzip" ? `tar -cz -C ${shellQuote(path)} ${excludeArgs.join(" ")} .` : `tar -c -C ${shellQuote(path)} ${excludeArgs.join(" ")} .`;
     return this.execStream(service, ["sh", "-c", tarCmd], { timeoutMs: opts?.timeoutMs });
   }
   async receiveStream(service, targetSourceId, body, opts) {
     const compression = opts?.compression ?? "zstd";
-    const decompress = compression === "zstd" ? "zstd -d | " : compression === "gzip" ? "gzip -d | " : "";
-    const clear = opts?.clearTarget ? `rm -rf ${shellEscape6(targetSourceId)}/* ${shellEscape6(targetSourceId)}/.[!.]* 2>/dev/null; ` : "";
-    const cmd = `${clear}mkdir -p ${shellEscape6(targetSourceId)}; ${decompress}tar -x -C ${shellEscape6(targetSourceId)}`;
+    const tool = compression === "zstd" ? "zstd" : compression === "gzip" ? "gzip" : null;
+    const prelude = [
+      `mkdir -p ${shellQuote(targetSourceId)}`,
+      tool ? `command -v ${tool} >/dev/null 2>&1 || { echo "openship: '${tool}' is not installed on this host, so the artifact cannot be decompressed. Refusing to clear the target: nothing was written and your data is untouched." >&2; exit 90; }` : null,
+      // Only now, with the decompressor proven present.
+      opts?.clearTarget ? `rm -rf ${shellQuote(targetSourceId)}/* ${shellQuote(targetSourceId)}/.[!.]* 2>/dev/null || true` : null
+    ].filter(Boolean).join("\n");
+    const cmd = safeRestoreCommand(
+      compression === "none" ? "none" : compression,
+      `tar -x -C ${shellQuote(targetSourceId)}`,
+      prelude
+    );
     let bytesWritten = 0;
     body.on("data", (chunk) => {
       bytesWritten += chunk.byteLength;
     });
-    const exit = await this.pipeIntoCommand(service, ["sh", "-c", cmd], body);
+    const exit = await this.pipeIntoCommand(service, cmd, body, {
+      timeoutMs: opts?.timeoutMs
+    });
     if (exit.code !== 0) {
       throw new Error(
         `receiveStream tar-extract exited ${exit.code}: ${exit.stderr.slice(0, 500)}`
@@ -1665,15 +2283,30 @@ var BareBackupExecutor = class {
     const localFile = join(localDir, "artifact.bin");
     const remoteDir = `/tmp/openship-bare-restore-${id}`;
     const remoteFile = `${remoteDir}/artifact.bin`;
+    const timeoutMs = opts?.timeoutMs ?? DEFAULT_RESTORE_TIMEOUT_MS;
+    const ceiling = () => `Restore into ${service.name} exceeded its ${Math.round(timeoutMs / 1e3)}s ceiling and was abandoned. The target may hold partial data.`;
+    if (exec.execWithInput) {
+      const run = exec.execWithInput(`sh -c ${shellQuote(shellScript(cmd, opts))}`, body);
+      const result = await withTimeout(run, timeoutMs, ceiling()).catch((err) => {
+        body.destroy();
+        throw err;
+      });
+      return { code: result.code, stderr: result.stderr };
+    }
+    const deadline = Date.now() + timeoutMs;
+    const remaining = () => Math.max(1e3, deadline - Date.now());
     await fs.mkdir(localDir, { recursive: true });
     try {
-      await pipeline(body, createWriteStream(localFile));
-      await exec.transferIn(localDir, remoteDir);
-      const wrapped = `${composeShell(cmd, opts).replace(/^sh -c /, "")} < ${shellEscape6(remoteFile)}`;
-      const runner = `sh -c ${shellEscape6(wrapped)}; ec=$?; rm -rf ${shellEscape6(remoteDir)}; exit $ec`;
-      const { stdout, awaitExit } = await this.execStream(service, ["sh", "-c", runner], opts);
+      await withTimeout(pipeline(body, createWriteStream(localFile)), remaining(), ceiling());
+      await withTimeout(exec.transferIn(localDir, remoteDir), remaining(), ceiling());
+      const wrapped = `${shellScript(cmd, opts)} < ${shellQuote(remoteFile)}`;
+      const runner = `sh -c ${shellQuote(wrapped)}; ec=$?; rm -rf ${shellQuote(remoteDir)}; exit $ec`;
+      const { stdout, awaitExit } = await this.execStream(service, ["sh", "-c", runner], {
+        ...opts,
+        timeoutMs: remaining()
+      });
       stdout.resume();
-      return await awaitExit;
+      return await withTimeout(awaitExit, remaining() + KILL_GRACE_MS, ceiling());
     } finally {
       await fs.rm(localDir, { recursive: true, force: true }).catch(() => {
       });
@@ -1690,14 +2323,14 @@ var BareBackupExecutor = class {
     return true;
   }
 };
-function composeShell(cmd, opts) {
-  const envPrefix = opts?.env ? Object.entries(opts.env).map(([k2, v2]) => `${k2}=${shellEscape6(v2)}`).join(" ") + " " : "";
-  const cwdPrefix = opts?.cwd ? `cd ${shellEscape6(opts.cwd)} && ` : "";
-  const inner = cmd.length >= 3 && cmd[0] === "sh" && cmd[1] === "-c" ? cmd.slice(2).join(" ") : cmd.map((a2) => shellEscape6(a2)).join(" ");
-  return `sh -c ${shellEscape6(`${cwdPrefix}${envPrefix}${inner}`)}`;
+function shellScript(cmd, opts) {
+  const envPrefix = opts?.env ? Object.entries(opts.env).map(([k2, v2]) => `${k2}=${shellQuote(v2)}`).join(" ") + " " : "";
+  const cwdPrefix = opts?.cwd ? `cd ${shellQuote(opts.cwd)} && ` : "";
+  const inner = cmd.length >= 3 && cmd[0] === "sh" && cmd[1] === "-c" ? cmd.slice(2).join(" ") : cmd.map((a2) => shellQuote(a2)).join(" ");
+  return `${cwdPrefix}${envPrefix}${inner}`;
 }
-function shellEscape6(s2) {
-  return `'${s2.replace(/'/g, "'\\''")}'`;
+function composeShell(cmd, opts) {
+  return `sh -c ${shellQuote(shellScript(cmd, opts))}`;
 }
 registerExecutor("bare", (runtime) => {
   if (!(runtime instanceof BareRuntime)) {
@@ -1723,11 +2356,19 @@ var LocalDestinationImpl = class {
   kind = "local";
   capabilities = CAPS;
   root;
+  /**
+   * Where artifacts written BEFORE `pathPrefix` moved out of the key builder live, or
+   * null when this destination has no prefix and the two are the same place.
+   */
+  legacyRoot;
   constructor(row) {
     if (!row.endpoint) {
       throw new Error(`LocalDestination "${row.name}" has no endpoint (root path) configured`);
     }
-    this.root = resolve(row.endpoint);
+    const base = resolve(row.endpoint);
+    const prefix = (row.pathPrefix ?? "").replace(/^\/+|\/+$/g, "");
+    this.root = prefix ? resolve(base, prefix) : base;
+    this.legacyRoot = prefix ? base : null;
   }
   resolveKey(key) {
     const normalized = normalize(key);
@@ -1736,6 +2377,38 @@ var LocalDestinationImpl = class {
     }
     return join2(this.root, normalized);
   }
+  /**
+   * The path to READ `key` from, preferring the current layout and falling back to the
+   * pre-prefix one.
+   *
+   * A run captured before this change recorded a key that already CONTAINS the prefix
+   * (the key builder put it there), and its bytes sit at `endpoint/<prefix>/<key…>` —
+   * which is `legacyRoot + key`, not `root + key`. Resolving it against the new root
+   * would look for `endpoint/<prefix>/<prefix>/…` and find nothing, so an existing
+   * restore point would quietly become unrestorable.
+   *
+   * Deliberately an existence check rather than a "does the key already start with the
+   * prefix" string test: the key builder's first literal segment is `openship`, so a
+   * destination whose prefix is also `openship` would make that test ambiguous. The
+   * filesystem is not ambiguous. Reads only — `put` always writes the current layout,
+   * so this shim shrinks to nothing as old runs age out of retention.
+   */
+  async resolveKeyForRead(key) {
+    const current = this.resolveKey(key);
+    if (this.legacyRoot === null) return current;
+    try {
+      await fs2.access(current);
+      return current;
+    } catch {
+      const legacy = join2(this.legacyRoot, normalize(key));
+      try {
+        await fs2.access(legacy);
+        return legacy;
+      } catch {
+        return current;
+      }
+    }
+  }
   async preflight() {
     try {
       await fs2.mkdir(this.root, { recursive: true });
@@ -1782,12 +2455,11 @@ var LocalDestinationImpl = class {
     return { bytesWritten, etag: digest };
   }
   async get(key) {
-    const path = this.resolveKey(key);
-    return createReadStream(path);
+    return createReadStream(await this.resolveKeyForRead(key));
   }
   async head(key) {
     try {
-      const stat = await fs2.stat(this.resolveKey(key));
+      const stat = await fs2.stat(await this.resolveKeyForRead(key));
       return {
         sizeBytes: stat.size,
         uploadedAt: stat.mtime
@@ -1799,7 +2471,7 @@ var LocalDestinationImpl = class {
     }
   }
   async list(prefix, opts) {
-    const root2 = this.resolveKey(prefix);
+    const root2 = await this.resolveKeyForRead(prefix);
     const entries = [];
     const limit = opts?.limit ?? 1e3;
     async function walk(dir, relBase) {
@@ -1832,7 +2504,7 @@ var LocalDestinationImpl = class {
   }
   async delete(key) {
     try {
-      await fs2.unlink(this.resolveKey(key));
+      await fs2.unlink(await this.resolveKeyForRead(key));
     } catch (err) {
       const e2 = err;
       if (e2?.code !== "ENOENT") throw err;
@@ -12563,7 +13235,22 @@ var CAPS2 = /* @__PURE__ */ new Set([
 ]);
 var PRESIGN_TTL_DEFAULT = 60 * 60;
 var MULTIPART_PART_SIZE = 16 * 1024 * 1024;
-var MULTIPART_QUEUE_SIZE = 4;
+var MULTIPART_MEMORY_BUDGET = 64 * 1024 * 1024;
+var MULTIPART_MAX_PARTS = 9e3;
+var UNKNOWN_SIZE_PART_SIZE = 32 * 1024 * 1024;
+function partSizeFor(sizeBytes) {
+  if (!sizeBytes || sizeBytes <= 0) return UNKNOWN_SIZE_PART_SIZE;
+  return Math.max(MULTIPART_PART_SIZE, Math.ceil(sizeBytes / MULTIPART_MAX_PARTS));
+}
+function queueSizeFor(partSize) {
+  return Math.max(1, Math.floor(MULTIPART_MEMORY_BUDGET / partSize));
+}
+function partLimitCeiling(partSize) {
+  return partSize * MULTIPART_MAX_PARTS;
+}
+function gib(bytes) {
+  return Math.round(bytes / (1024 * 1024 * 1024));
+}
 var S3DestinationImpl = class {
   kind = "s3_compatible";
   capabilities = CAPS2;
@@ -12616,6 +13303,7 @@ var S3DestinationImpl = class {
   }
   async put(key, body, opts) {
     const fullKey = this.fullKey(key);
+    const partSize = partSizeFor(opts.size);
     const upload = new Upload({
       client: this.client,
       params: {
@@ -12625,15 +13313,34 @@ var S3DestinationImpl = class {
         ContentType: opts.contentType ?? "application/octet-stream",
         Metadata: opts.metadata
       },
-      partSize: MULTIPART_PART_SIZE,
-      queueSize: MULTIPART_QUEUE_SIZE,
+      // Derived, not fixed — see partSizeFor. An artifact whose size we know never trips
+      // S3's 10,000-part limit; one we don't (a DB dump has no sizeHint) gets
+      // UNKNOWN_SIZE_PART_SIZE, whose ceiling is enforced below rather than discovered
+      // at CompleteMultipartUpload.
+      partSize,
+      queueSize: queueSizeFor(partSize),
       leavePartsOnError: false
     });
+    const ceiling = partLimitCeiling(partSize);
     let bytesWritten = 0;
+    let ceilingError = null;
     upload.on("httpUploadProgress", (progress) => {
       if (typeof progress.loaded === "number") bytesWritten = progress.loaded;
+      if (!ceilingError && bytesWritten > ceiling) {
+        ceilingError = new Error(
+          `Artifact exceeds what one S3 multipart upload can hold at this part size: ${gib(bytesWritten)} GiB transferred, ceiling ${gib(ceiling)} GiB (${MULTIPART_MAX_PARTS} parts \xD7 ${Math.round(partSize / (1024 * 1024))} MiB). Aborted early rather than failing at CompleteMultipartUpload after transferring everything. A source whose size is known scales its part size automatically; a streamed database dump cannot, so this artifact needs to be split or sent to a destination without a part limit.`
+        );
+        void upload.abort().catch(() => {
+        });
+      }
     });
-    const result = await upload.done();
+    let result;
+    try {
+      result = await upload.done();
+    } catch (err) {
+      if (ceilingError) throw ceilingError;
+      throw err;
+    }
     return {
       bytesWritten,
       etag: result.ETag?.replace(/"/g, "") ?? void 0
@@ -12768,6 +13475,7 @@ var CAPS3 = /* @__PURE__ */ new Set([
 ]);
 var UPLOAD_STALL_TIMEOUT_MS = 10 * 60 * 1e3;
 var UPLOAD_STALL_PROBE_MS = 30 * 1e3;
+var UPLOAD_BUFFER_BYTES = 8 * 1024 * 1024;
 var SftpDestinationImpl = class {
   kind;
   capabilities = CAPS3;
@@ -12896,14 +13604,18 @@ var SftpDestinationImpl = class {
     await this.withSftp(async (sftp) => {
       await this.ensureDir(sftp, posix2.dirname(target));
       await new Promise((resolve2, reject) => {
-        const ws = sftp.createWriteStream(tmp);
+        const ws = sftp.createWriteStream(tmp, { highWaterMark: UPLOAD_BUFFER_BYTES });
         let lastProgressAt = Date.now();
         let settled = false;
         let watchdog;
+        const onSettled = [];
         const finish = (err) => {
           if (settled) return;
           settled = true;
           if (watchdog) clearInterval(watchdog);
+          for (const stop of onSettled) stop();
+          const acked = ws.bytesWritten ?? 0;
+          if (acked > bytesWritten) bytesWritten = acked;
           if (err) {
             ws.destroy();
             body.destroy();
@@ -12923,10 +13635,14 @@ var SftpDestinationImpl = class {
         watchdog.unref?.();
         ws.on("error", (err) => finish(err));
         ws.on("close", () => finish());
-        body.on("data", (chunk) => {
-          bytesWritten += chunk.byteLength;
+        const trackProgress = setInterval(() => {
+          const acked = ws.bytesWritten ?? 0;
+          if (acked <= bytesWritten) return;
+          bytesWritten = acked;
           lastProgressAt = Date.now();
-        });
+        }, 1e3);
+        trackProgress.unref?.();
+        onSettled.push(() => clearInterval(trackProgress));
         body.on("error", (err) => finish(err));
         body.pipe(ws);
       });