wyrm-mcp 7.3.2 → 7.3.3

package/dist/cloud-backup.js

@@ -1,5 +1,579 @@
-import{createReadStream as D,createWriteStream as z,statSync as H,existsSync as l,copyFileSync as T,unlinkSync as N,readFileSync as W,writeFileSync as G,renameSync as v}from"fs";import{createGzip as q,gunzipSync as Y}from"zlib";import{pipeline as P}from"stream/promises";import{createCipheriv as F,createDecipheriv as J,randomBytes as O,scryptSync as K,createHash as x,createHmac as A}from"crypto";import{join as C}from"path";import{hostname as V,platform as X,arch as Q,cpus as Z}from"os";const tt="3.2.0",et=1,L="aes-256-gcm",E=16,j=32,R=16,B=32,nt=10;function M(s,t){const o=O(E),e=O(j),c=K(t,e,B),n=F(L,c,o),r=Buffer.concat([n.update(s),n.final()]),a=n.getAuthTag();return Buffer.concat([o,e,a,r])}function _(s,t){const o=E+j+R;if(s.length<o)throw new Error("Encrypted data too short \u2014 corrupted or not a Wyrm backup");let e=0;const c=s.subarray(e,e+=E),n=s.subarray(e,e+=j),r=s.subarray(e,e+=R),a=s.subarray(e),i=K(t,n,B),u=J(L,i,c);u.setAuthTag(r);try{return Buffer.concat([u.update(a),u.final()])}catch{throw new Error("Decryption failed \u2014 wrong password or corrupted backup")}}class st{accessKeyId;secretAccessKey;region;endpoint;bucket;host;constructor(t){this.accessKeyId=t.accessKeyId,this.secretAccessKey=t.secretAccessKey,this.region=t.region??"auto",this.endpoint=t.endpoint.replace(/\/$/,""),this.bucket=t.bucket;const o=new URL(this.endpoint);this.host=o.host}async putObject(t,o,e="application/octet-stream"){const c=`/${this.bucket}/${I(t)}`,n={"Content-Type":e,"Content-Length":o.length.toString()},r=this.signRequest("PUT",c,n,o),a=await fetch(`${this.endpoint}${c}`,{method:"PUT",headers:r,body:o});if(!a.ok){const i=await a.text();throw new Error(`S3 PUT failed (${a.status}): ${i}`)}}async getObject(t){const o=`/${this.bucket}/${I(t)}`,e={},c=this.signRequest("GET",o,e),n=await fetch(`${this.endpoint}${o}`,{method:"GET",headers:c});if(!n.ok){const a=await n.text();throw new Error(`S3 GET failed (${n.status}): ${a}`)}const r=await n.arrayBuffer();return Buffer.from(r)}async listObjects(t){const o=[];let e;do{const c=new URLSearchParams({"list-type":"2",prefix:t});e&&c.set("continuation-token",e);const n=`/${this.bucket}?${c.toString()}`,r={},a=this.signRequest("GET",n,r),i=await fetch(`${this.endpoint}${n}`,{method:"GET",headers:a});if(!i.ok){const h=await i.text();throw new Error(`S3 LIST failed (${i.status}): ${h}`)}const u=await i.text();o.push(...ht(u)),u.match(/<IsTruncated>(.*?)<\/IsTruncated>/)?.[1]==="true"?e=u.match(/<NextContinuationToken>(.*?)<\/NextContinuationToken>/)?.[1]:e=void 0}while(e);return o}async deleteObject(t){const o=`/${this.bucket}/${I(t)}`,e={},c=this.signRequest("DELETE",o,e),n=await fetch(`${this.endpoint}${o}`,{method:"DELETE",headers:c});if(!n.ok){const r=await n.text();throw new Error(`S3 DELETE failed (${n.status}): ${r}`)}}signRequest(t,o,e,c){const n=new Date,r=ot(n),a=ct(n),[i,u]=it(o);e.host=this.host,e["x-amz-date"]=a,e["x-amz-content-sha256"]=k(c??Buffer.alloc(0));const d=Object.keys(e).map(w=>w.toLowerCase()).sort(),m=d.map(w=>`${w}:${e[Object.keys(e).find(U=>U.toLowerCase()===w)].trim()}`).join(`
-`)+`
-`,h=d.join(";"),p=[t,i,ut(u),m,h,e["x-amz-content-sha256"]].join(`
-`),f=`${r}/${this.region}/s3/aws4_request`,y=["AWS4-HMAC-SHA256",a,f,k(Buffer.from(p,"utf-8"))].join(`
-`),$=at(this.secretAccessKey,r,this.region,"s3"),g=rt($,y);return e.Authorization=`AWS4-HMAC-SHA256 Credential=${this.accessKeyId}/${f}, SignedHeaders=${h}, Signature=${g}`,e}}function ot(s){return s.toISOString().replace(/[-:T]/g,"").slice(0,8)}function ct(s){return s.toISOString().replace(/[-:]/g,"").replace(/\.\d{3}/,"")}function k(s){return x("sha256").update(s).digest("hex")}function b(s,t){return A("sha256",s).update(t,"utf-8").digest()}function rt(s,t){return A("sha256",s).update(t,"utf-8").digest("hex")}function at(s,t,o,e){let c=b(`AWS4${s}`,t);return c=b(c,o),c=b(c,e),c=b(c,"aws4_request"),c}function I(s){return s.split("/").map(t=>encodeURIComponent(t)).join("/")}function it(s){const t=s.indexOf("?");return t===-1?[s,""]:[s.slice(0,t),s.slice(t+1)]}function ut(s){return s?s.split("&").map(t=>{const[o,e]=t.split("=");return`${encodeURIComponent(decodeURIComponent(o))}=${encodeURIComponent(decodeURIComponent(e??""))}`}).sort().join("&"):""}function ht(s){const t=[],o=/<Contents>([\s\S]*?)<\/Contents>/g;let e;for(;(e=o.exec(s))!==null;){const c=e[1],n=c.match(/<Key>(.*?)<\/Key>/)?.[1]??"",r=parseInt(c.match(/<Size>(.*?)<\/Size>/)?.[1]??"0",10),a=c.match(/<LastModified>(.*?)<\/LastModified>/)?.[1]??"";t.push({key:n,size:r,lastModified:a})}return t}class wt{config=null;encryptionKey=null;s3=null;constructor(){}configure(t,o){if(!t.endpoint||!t.bucket||!t.accessKeyId||!t.secretAccessKey)throw new Error("Cloud config requires endpoint, bucket, accessKeyId, and secretAccessKey");this.config={...t,region:t.region??"auto"},this.encryptionKey=o??null,this.s3=new st(this.config)}isConfigured(){return this.config!==null&&this.s3!==null}async backup(t){if(this.assertConfigured(),!l(t))throw new Error(`Database not found: ${t}`);const o=H(t),e=this.getMachineId(),c=new Date,n=dt(c),r=`backups/${e}/${n}.wyrm.bak`,a=`backups/${e}/${n}.wyrm.meta.json`;if(this.encryptionKey===null&&process.env.WYRM_ALLOW_PLAINTEXT_BACKUP!=="1")throw new Error("Refusing to upload an unencrypted full-DB backup to cloud storage. Set WYRM_ENCRYPTION_KEY to encrypt the snapshot, or WYRM_ALLOW_PLAINTEXT_BACKUP=1 to override (NOT recommended \u2014 uploads all private rows in cleartext).");const i=C(t,".."),u=C(i,`.wyrm-backup-${Date.now()}.tmp`),d=C(i,`.wyrm-backup-${Date.now()}.gz.tmp`);try{T(t,u);const m=`${t}-wal`,h=`${t}-shm`;l(m)&&T(m,`${u}-wal`),l(h)&&T(h,`${u}-shm`),await P(D(u),q({level:9}),z(d));let p=Buffer.from(W(d));const f=p.length,y=this.encryptionKey!==null;y&&(p=M(p,this.encryptionKey));const $=k(p);await this.s3.putObject(r,p,"application/x-wyrm-backup");const g={version:et,wyrm_version:tt,timestamp:c.toISOString(),db_size:o.size,compressed_size:f,encrypted:y,machine_id:e,checksum:$};return await this.s3.putObject(a,Buffer.from(JSON.stringify(g,null,2),"utf-8"),"application/json"),{key:r,metadata:g}}finally{S(u),S(d),S(`${u}-wal`),S(`${u}-shm`)}}async listBackups(){this.assertConfigured();const o=`backups/${this.getMachineId()}/`,c=(await this.s3.listObjects(o)).filter(r=>r.key.endsWith(".wyrm.meta.json")),n=[];for(const r of c)try{const a=await this.s3.getObject(r.key),i=JSON.parse(a.toString("utf-8"));n.push(i)}catch{}return n.sort((r,a)=>new Date(a.timestamp).getTime()-new Date(r.timestamp).getTime()),n}async listBackupsWithKeys(){this.assertConfigured();const o=`backups/${this.getMachineId()}/`,c=(await this.s3.listObjects(o)).filter(r=>r.key.endsWith(".wyrm.meta.json")),n=[];for(const r of c)try{const a=await this.s3.getObject(r.key),i=JSON.parse(a.toString("utf-8")),u=r.key.replace(/\.wyrm\.meta\.json$/,".wyrm.bak");n.push({key:u,metadata:i})}catch{}return n.sort((r,a)=>new Date(a.metadata.timestamp).getTime()-new Date(r.metadata.timestamp).getTime()),n}async restore(t,o){this.assertConfigured();const e=t.replace(/\.wyrm\.bak$/,".wyrm.meta.json");let c;try{const i=await this.s3.getObject(e);c=JSON.parse(i.toString("utf-8"))}catch{throw new Error(`Backup metadata not found for key: ${t}`)}let n=await this.s3.getObject(t);const r=k(n);if(r!==c.checksum)throw new Error(`Checksum mismatch \u2014 backup may be corrupted. Expected: ${c.checksum}, Got: ${r}`);if(c.encrypted){if(!this.encryptionKey)throw new Error("Backup is encrypted but no encryption key is configured");n=_(n,this.encryptionKey)}const a=Y(n);if(l(o)){const i=`${o}.bak`;v(o,i)}return G(o,a),{restored:!0,size:a.length}}async pruneBackups(t=nt){this.assertConfigured();const e=`backups/${this.getMachineId()}/`,n=(await this.s3.listObjects(e)).filter(i=>i.key.endsWith(".wyrm.bak")).sort((i,u)=>u.lastModified.localeCompare(i.lastModified));if(n.length<=t)return{deleted:0};const r=n.slice(t);let a=0;for(const i of r){const u=i.key.replace(/\.wyrm\.bak$/,".wyrm.meta.json");try{await this.s3.deleteObject(i.key),a++}catch{}try{await this.s3.deleteObject(u)}catch{}}return{deleted:a}}getMachineId(){const t=[V(),X(),Q(),Z()[0]?.model??"unknown-cpu"].join("|");return x("sha256").update(t).digest("hex").slice(0,16)}assertConfigured(){if(!this.isConfigured())throw new Error("Cloud backup not configured. Call configure() with R2 credentials first.")}}function dt(s){const t=s.getUTCFullYear(),o=String(s.getUTCMonth()+1).padStart(2,"0"),e=String(s.getUTCDate()).padStart(2,"0"),c=String(s.getUTCHours()).padStart(2,"0"),n=String(s.getUTCMinutes()).padStart(2,"0"),r=String(s.getUTCSeconds()).padStart(2,"0");return`${t}-${o}-${e}_${c}${n}${r}`}function S(s){try{l(s)&&N(s)}catch{}}export{wt as WyrmCloudBackup,_ as decryptBuffer,M as encryptBuffer};
+/**
+ * Wyrm Cloud Backup — Encrypted backup/restore to Cloudflare R2
+ *
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
+ * @license Proprietary — (c) 2026 Ghost Protocol (Pvt) Ltd. All rights reserved. See LICENSE.
+ * @module cloud-backup
+ * @version 3.2.0
+ */
+import { createReadStream, createWriteStream, statSync, existsSync, copyFileSync, unlinkSync, readFileSync, writeFileSync, renameSync } from 'fs';
+import { createGzip, gunzipSync } from 'zlib';
+import { pipeline } from 'stream/promises';
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync, createHash, createHmac } from 'crypto';
+import { join } from 'path';
+import { hostname, platform, arch, cpus } from 'os';
+// ==================== CONSTANTS ====================
+const WYRM_VERSION = '3.2.0';
+const BACKUP_FORMAT_VERSION = 1;
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 16;
+const SALT_LENGTH = 32;
+const TAG_LENGTH = 16;
+const KEY_LENGTH = 32;
+const DEFAULT_KEEP_COUNT = 10;
+// ==================== BUFFER ENCRYPTION ====================
+/**
+ * Encrypt a buffer with AES-256-GCM using a password.
+ * Output format: [16-byte IV][32-byte salt][16-byte auth tag][encrypted data]
+ */
+function encryptBuffer(data, password) {
+    const iv = randomBytes(IV_LENGTH);
+    const salt = randomBytes(SALT_LENGTH);
+    const key = scryptSync(password, salt, KEY_LENGTH);
+    const cipher = createCipheriv(ALGORITHM, key, iv);
+    const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    // Header: IV + salt + auth tag + ciphertext
+    return Buffer.concat([iv, salt, tag, encrypted]);
+}
+/**
+ * Decrypt a buffer encrypted by encryptBuffer.
+ * Parses the [IV][salt][tag][data] header, derives key, decrypts.
+ */
+function decryptBuffer(encrypted, password) {
+    const headerSize = IV_LENGTH + SALT_LENGTH + TAG_LENGTH;
+    if (encrypted.length < headerSize) {
+        throw new Error('Encrypted data too short — corrupted or not a Wyrm backup');
+    }
+    let offset = 0;
+    const iv = encrypted.subarray(offset, offset += IV_LENGTH);
+    const salt = encrypted.subarray(offset, offset += SALT_LENGTH);
+    const tag = encrypted.subarray(offset, offset += TAG_LENGTH);
+    const data = encrypted.subarray(offset);
+    const key = scryptSync(password, salt, KEY_LENGTH);
+    const decipher = createDecipheriv(ALGORITHM, key, iv);
+    decipher.setAuthTag(tag);
+    try {
+        return Buffer.concat([decipher.update(data), decipher.final()]);
+    }
+    catch {
+        throw new Error('Decryption failed — wrong password or corrupted backup');
+    }
+}
+// ==================== MINIMAL S3-COMPATIBLE CLIENT ====================
+/**
+ * Minimal S3-compatible client for Cloudflare R2.
+ * Uses AWS Signature V4 signing with Node.js built-ins only — zero dependencies.
+ */
+class S3Client {
+    accessKeyId;
+    secretAccessKey;
+    region;
+    endpoint;
+    bucket;
+    host;
+    constructor(config) {
+        this.accessKeyId = config.accessKeyId;
+        this.secretAccessKey = config.secretAccessKey;
+        this.region = config.region ?? 'auto';
+        this.endpoint = config.endpoint.replace(/\/$/, '');
+        this.bucket = config.bucket;
+        // Extract host from endpoint
+        const url = new URL(this.endpoint);
+        this.host = url.host;
+    }
+    /** PUT an object to the bucket */
+    async putObject(key, body, contentType = 'application/octet-stream') {
+        const path = `/${this.bucket}/${encodeS3Key(key)}`;
+        const headers = {
+            'Content-Type': contentType,
+            'Content-Length': body.length.toString(),
+        };
+        const signed = this.signRequest('PUT', path, headers, body);
+        const res = await fetch(`${this.endpoint}${path}`, {
+            method: 'PUT',
+            headers: signed,
+            body: body,
+        });
+        if (!res.ok) {
+            const text = await res.text();
+            throw new Error(`S3 PUT failed (${res.status}): ${text}`);
+        }
+    }
+    /** GET an object from the bucket */
+    async getObject(key) {
+        const path = `/${this.bucket}/${encodeS3Key(key)}`;
+        const headers = {};
+        const signed = this.signRequest('GET', path, headers);
+        const res = await fetch(`${this.endpoint}${path}`, {
+            method: 'GET',
+            headers: signed,
+        });
+        if (!res.ok) {
+            const text = await res.text();
+            throw new Error(`S3 GET failed (${res.status}): ${text}`);
+        }
+        const arrayBuf = await res.arrayBuffer();
+        return Buffer.from(arrayBuf);
+    }
+    /** LIST objects with a given prefix */
+    async listObjects(prefix) {
+        const results = [];
+        let continuationToken;
+        do {
+            const params = new URLSearchParams({
+                'list-type': '2',
+                prefix,
+            });
+            if (continuationToken) {
+                params.set('continuation-token', continuationToken);
+            }
+            const path = `/${this.bucket}?${params.toString()}`;
+            const headers = {};
+            const signed = this.signRequest('GET', path, headers);
+            const res = await fetch(`${this.endpoint}${path}`, {
+                method: 'GET',
+                headers: signed,
+            });
+            if (!res.ok) {
+                const text = await res.text();
+                throw new Error(`S3 LIST failed (${res.status}): ${text}`);
+            }
+            const xml = await res.text();
+            results.push(...parseListXml(xml));
+            // Check for truncation / pagination
+            const truncatedMatch = xml.match(/<IsTruncated>(.*?)<\/IsTruncated>/);
+            const isTruncated = truncatedMatch?.[1] === 'true';
+            if (isTruncated) {
+                const tokenMatch = xml.match(/<NextContinuationToken>(.*?)<\/NextContinuationToken>/);
+                continuationToken = tokenMatch?.[1];
+            }
+            else {
+                continuationToken = undefined;
+            }
+        } while (continuationToken);
+        return results;
+    }
+    /** DELETE an object from the bucket */
+    async deleteObject(key) {
+        const path = `/${this.bucket}/${encodeS3Key(key)}`;
+        const headers = {};
+        const signed = this.signRequest('DELETE', path, headers);
+        const res = await fetch(`${this.endpoint}${path}`, {
+            method: 'DELETE',
+            headers: signed,
+        });
+        if (!res.ok) {
+            const text = await res.text();
+            throw new Error(`S3 DELETE failed (${res.status}): ${text}`);
+        }
+    }
+    /**
+     * Generate AWS Signature V4 headers.
+     * Implements the full signing flow:
+     *   1. Canonical request
+     *   2. String to sign
+     *   3. Signing key derivation
+     *   4. Authorization header
+     */
+    signRequest(method, path, headers, body) {
+        const now = new Date();
+        const dateStamp = toDateStamp(now); // YYYYMMDD
+        const amzDate = toAmzDate(now); // YYYYMMDD'T'HHMMSS'Z'
+        // Split path and query string
+        const [canonicalUri, queryString] = splitPathQuery(path);
+        // Required headers
+        headers['host'] = this.host;
+        headers['x-amz-date'] = amzDate;
+        headers['x-amz-content-sha256'] = sha256Hex(body ?? Buffer.alloc(0));
+        // 1. Canonical request
+        const signedHeaderKeys = Object.keys(headers)
+            .map(k => k.toLowerCase())
+            .sort();
+        const canonicalHeaders = signedHeaderKeys
+            .map(k => `${k}:${headers[Object.keys(headers).find(h => h.toLowerCase() === k)].trim()}`)
+            .join('\n') + '\n';
+        const signedHeaders = signedHeaderKeys.join(';');
+        const canonicalRequest = [
+            method,
+            canonicalUri,
+            normalizeQueryString(queryString),
+            canonicalHeaders,
+            signedHeaders,
+            headers['x-amz-content-sha256'],
+        ].join('\n');
+        // 2. String to sign
+        const credentialScope = `${dateStamp}/${this.region}/s3/aws4_request`;
+        const stringToSign = [
+            'AWS4-HMAC-SHA256',
+            amzDate,
+            credentialScope,
+            sha256Hex(Buffer.from(canonicalRequest, 'utf-8')),
+        ].join('\n');
+        // 3. Signing key
+        const signingKey = deriveSigningKey(this.secretAccessKey, dateStamp, this.region, 's3');
+        // 4. Signature
+        const signature = hmacHex(signingKey, stringToSign);
+        // 5. Authorization header
+        headers['Authorization'] =
+            `AWS4-HMAC-SHA256 Credential=${this.accessKeyId}/${credentialScope}, ` +
+                `SignedHeaders=${signedHeaders}, Signature=${signature}`;
+        return headers;
+    }
+}
+// ==================== S3 SIGNING HELPERS ====================
+function toDateStamp(date) {
+    return date.toISOString().replace(/[-:T]/g, '').slice(0, 8);
+}
+function toAmzDate(date) {
+    return date.toISOString().replace(/[-:]/g, '').replace(/\.\d{3}/, '');
+}
+function sha256Hex(data) {
+    return createHash('sha256').update(data).digest('hex');
+}
+function hmac(key, data) {
+    return createHmac('sha256', key).update(data, 'utf-8').digest();
+}
+function hmacHex(key, data) {
+    return createHmac('sha256', key).update(data, 'utf-8').digest('hex');
+}
+function deriveSigningKey(secret, dateStamp, region, service) {
+    let key = hmac(`AWS4${secret}`, dateStamp);
+    key = hmac(key, region);
+    key = hmac(key, service);
+    key = hmac(key, 'aws4_request');
+    return key;
+}
+/**
+ * Encode an S3 key — URI-encode each path segment individually,
+ * preserving `/` separators.
+ */
+function encodeS3Key(key) {
+    return key
+        .split('/')
+        .map(segment => encodeURIComponent(segment))
+        .join('/');
+}
+/**
+ * Split a path into canonical URI and query string.
+ * e.g. "/bucket?list-type=2&prefix=x" → ["/bucket", "list-type=2&prefix=x"]
+ */
+function splitPathQuery(path) {
+    const idx = path.indexOf('?');
+    if (idx === -1)
+        return [path, ''];
+    return [path.slice(0, idx), path.slice(idx + 1)];
+}
+/**
+ * Normalize a query string for canonical request:
+ * sort by parameter name, then by value.
+ */
+function normalizeQueryString(qs) {
+    if (!qs)
+        return '';
+    return qs
+        .split('&')
+        .map(pair => {
+        const [k, v] = pair.split('=');
+        return `${encodeURIComponent(decodeURIComponent(k))}=${encodeURIComponent(decodeURIComponent(v ?? ''))}`;
+    })
+        .sort()
+        .join('&');
+}
+/**
+ * Parse the XML response from S3 ListObjectsV2.
+ * Extracts <Key>, <Size>, <LastModified> from each <Contents> block.
+ */
+function parseListXml(xml) {
+    const results = [];
+    const contentsRegex = /<Contents>([\s\S]*?)<\/Contents>/g;
+    let match;
+    while ((match = contentsRegex.exec(xml)) !== null) {
+        const block = match[1];
+        const key = block.match(/<Key>(.*?)<\/Key>/)?.[1] ?? '';
+        const size = parseInt(block.match(/<Size>(.*?)<\/Size>/)?.[1] ?? '0', 10);
+        const lastModified = block.match(/<LastModified>(.*?)<\/LastModified>/)?.[1] ?? '';
+        results.push({ key, size, lastModified });
+    }
+    return results;
+}
+// ==================== WYRM CLOUD BACKUP ====================
+export class WyrmCloudBackup {
+    config = null;
+    encryptionKey = null;
+    s3 = null;
+    constructor() { }
+    /** Configure cloud storage credentials and optional encryption key */
+    configure(config, encryptionKey) {
+        if (!config.endpoint || !config.bucket || !config.accessKeyId || !config.secretAccessKey) {
+            throw new Error('Cloud config requires endpoint, bucket, accessKeyId, and secretAccessKey');
+        }
+        this.config = {
+            ...config,
+            region: config.region ?? 'auto',
+        };
+        this.encryptionKey = encryptionKey ?? null;
+        this.s3 = new S3Client(this.config);
+    }
+    /** Check if cloud backup is configured */
+    isConfigured() {
+        return this.config !== null && this.s3 !== null;
+    }
+    /**
+     * Backup: SQLite DB → gzip → AES-256-GCM encrypt → upload to R2
+     *
+     * Pipeline:
+     *   1. Copy SQLite file to a temp snapshot (safe point-in-time copy)
+     *   2. Gzip compress
+     *   3. If encryption key set: AES-256-GCM encrypt the gzipped blob
+     *   4. Upload encrypted/compressed blob to R2
+     *   5. Upload metadata JSON alongside
+     *   6. Clean up temp files
+     *
+     * Key format: backups/{machine_id}/{YYYY-MM-DD_HHmmss}.wyrm.bak
+     */
+    async backup(dbPath) {
+        this.assertConfigured();
+        if (!existsSync(dbPath)) {
+            throw new Error(`Database not found: ${dbPath}`);
+        }
+        const dbStat = statSync(dbPath);
+        const machineId = this.getMachineId();
+        const now = new Date();
+        const timestamp = formatTimestamp(now);
+        const backupKey = `backups/${machineId}/${timestamp}.wyrm.bak`;
+        const metadataKey = `backups/${machineId}/${timestamp}.wyrm.meta.json`;
+        // [sec 6.3.1] Default-deny plaintext egress: refuse to upload a full-DB
+        // snapshot to cloud storage unless it will be encrypted. Fail fast before
+        // any temp file is written. Override only via an explicit, loud opt-in.
+        if (this.encryptionKey === null && process.env.WYRM_ALLOW_PLAINTEXT_BACKUP !== '1') {
+            throw new Error('Refusing to upload an unencrypted full-DB backup to cloud storage. Set '
+                + 'WYRM_ENCRYPTION_KEY to encrypt the snapshot, or WYRM_ALLOW_PLAINTEXT_BACKUP=1 '
+                + 'to override (NOT recommended — uploads all private rows in cleartext).');
+        }
+        // Temp files in the same directory as the DB to avoid cross-device issues
+        const dbDir = join(dbPath, '..');
+        const tempCopy = join(dbDir, `.wyrm-backup-${Date.now()}.tmp`);
+        const tempGz = join(dbDir, `.wyrm-backup-${Date.now()}.gz.tmp`);
+        try {
+            // 1. Safe snapshot — copy the database file
+            copyFileSync(dbPath, tempCopy);
+            // Also copy WAL/SHM if they exist (for consistency)
+            const walPath = `${dbPath}-wal`;
+            const shmPath = `${dbPath}-shm`;
+            if (existsSync(walPath))
+                copyFileSync(walPath, `${tempCopy}-wal`);
+            if (existsSync(shmPath))
+                copyFileSync(shmPath, `${tempCopy}-shm`);
+            // 2. Gzip compress
+            await pipeline(createReadStream(tempCopy), createGzip({ level: 9 }), createWriteStream(tempGz));
+            let uploadPayload = Buffer.from(readFileSync(tempGz));
+            const compressedSize = uploadPayload.length;
+            // 3. Encrypt if key is set
+            const isEncrypted = this.encryptionKey !== null;
+            if (isEncrypted) {
+                uploadPayload = encryptBuffer(uploadPayload, this.encryptionKey);
+            }
+            // Compute checksum of final payload
+            const checksum = sha256Hex(uploadPayload);
+            // 4. Upload blob
+            await this.s3.putObject(backupKey, uploadPayload, 'application/x-wyrm-backup');
+            // 5. Build and upload metadata
+            const metadata = {
+                version: BACKUP_FORMAT_VERSION,
+                wyrm_version: WYRM_VERSION,
+                timestamp: now.toISOString(),
+                db_size: dbStat.size,
+                compressed_size: compressedSize,
+                encrypted: isEncrypted,
+                machine_id: machineId,
+                checksum,
+            };
+            await this.s3.putObject(metadataKey, Buffer.from(JSON.stringify(metadata, null, 2), 'utf-8'), 'application/json');
+            return { key: backupKey, metadata };
+        }
+        finally {
+            // 6. Clean up temp files
+            safeUnlink(tempCopy);
+            safeUnlink(tempGz);
+            safeUnlink(`${tempCopy}-wal`);
+            safeUnlink(`${tempCopy}-shm`);
+        }
+    }
+    /**
+     * List available backups for this machine, sorted newest-first.
+     * Fetches metadata JSON for each backup.
+     */
+    async listBackups() {
+        this.assertConfigured();
+        const machineId = this.getMachineId();
+        const prefix = `backups/${machineId}/`;
+        const objects = await this.s3.listObjects(prefix);
+        // Find metadata files
+        const metaObjects = objects.filter(o => o.key.endsWith('.wyrm.meta.json'));
+        const metadataList = [];
+        for (const obj of metaObjects) {
+            try {
+                const buf = await this.s3.getObject(obj.key);
+                const meta = JSON.parse(buf.toString('utf-8'));
+                metadataList.push(meta);
+            }
+            catch {
+                // Skip unreadable metadata
+            }
+        }
+        // Sort newest first
+        metadataList.sort((a, b) => new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime());
+        return metadataList;
+    }
+    /**
+     * List backups paired with their storage key (the .wyrm.bak blob key).
+     * Convenience for callers (e.g. the cloud-sync daemon) that need to call
+     * `restore()` without reconstructing the timestamp-format key themselves.
+     */
+    async listBackupsWithKeys() {
+        this.assertConfigured();
+        const machineId = this.getMachineId();
+        const prefix = `backups/${machineId}/`;
+        const objects = await this.s3.listObjects(prefix);
+        const metaObjects = objects.filter(o => o.key.endsWith('.wyrm.meta.json'));
+        const results = [];
+        for (const obj of metaObjects) {
+            try {
+                const buf = await this.s3.getObject(obj.key);
+                const meta = JSON.parse(buf.toString('utf-8'));
+                const blobKey = obj.key.replace(/\.wyrm\.meta\.json$/, '.wyrm.bak');
+                results.push({ key: blobKey, metadata: meta });
+            }
+            catch {
+                // Skip unreadable
+            }
+        }
+        results.sort((a, b) => new Date(b.metadata.timestamp).getTime() - new Date(a.metadata.timestamp).getTime());
+        return results;
+    }
+    /**
+     * Restore: Download from R2 → decrypt → gunzip → write to target path.
+     *
+     * If the target file already exists, it is renamed to `{target}.bak` before overwriting.
+     * Verifies checksum of the downloaded blob against metadata.
+     */
+    async restore(backupKey, targetPath) {
+        this.assertConfigured();
+        // Derive metadata key from backup key
+        const metadataKey = backupKey.replace(/\.wyrm\.bak$/, '.wyrm.meta.json');
+        // Download metadata
+        let metadata;
+        try {
+            const metaBuf = await this.s3.getObject(metadataKey);
+            metadata = JSON.parse(metaBuf.toString('utf-8'));
+        }
+        catch {
+            throw new Error(`Backup metadata not found for key: ${backupKey}`);
+        }
+        // 1. Download encrypted blob
+        let blob = await this.s3.getObject(backupKey);
+        // 5. Verify checksum
+        const actualChecksum = sha256Hex(blob);
+        if (actualChecksum !== metadata.checksum) {
+            throw new Error(`Checksum mismatch — backup may be corrupted. ` +
+                `Expected: ${metadata.checksum}, Got: ${actualChecksum}`);
+        }
+        // 2. Decrypt if encrypted
+        if (metadata.encrypted) {
+            if (!this.encryptionKey) {
+                throw new Error('Backup is encrypted but no encryption key is configured');
+            }
+            blob = decryptBuffer(blob, this.encryptionKey);
+        }
+        // 3. Gunzip decompress
+        const decompressed = gunzipSync(blob);
+        // 4. Write to targetPath (back up existing file first)
+        if (existsSync(targetPath)) {
+            const bakPath = `${targetPath}.bak`;
+            renameSync(targetPath, bakPath);
+        }
+        writeFileSync(targetPath, decompressed);
+        return { restored: true, size: decompressed.length };
+    }
+    /**
+     * Delete old backups, keeping the most recent `keepCount`.
+     * Deletes both the .wyrm.bak blob and its .wyrm.meta.json sidecar.
+     */
+    async pruneBackups(keepCount = DEFAULT_KEEP_COUNT) {
+        this.assertConfigured();
+        const machineId = this.getMachineId();
+        const prefix = `backups/${machineId}/`;
+        const objects = await this.s3.listObjects(prefix);
+        // Pair backup blobs with their metadata by timestamp stem
+        const backupBlobs = objects
+            .filter(o => o.key.endsWith('.wyrm.bak'))
+            .sort((a, b) => b.lastModified.localeCompare(a.lastModified)); // newest first
+        if (backupBlobs.length <= keepCount) {
+            return { deleted: 0 };
+        }
+        const toDelete = backupBlobs.slice(keepCount);
+        let deleted = 0;
+        for (const obj of toDelete) {
+            const metaKey = obj.key.replace(/\.wyrm\.bak$/, '.wyrm.meta.json');
+            try {
+                await this.s3.deleteObject(obj.key);
+                deleted++;
+            }
+            catch {
+                // Best-effort deletion
+            }
+            try {
+                await this.s3.deleteObject(metaKey);
+            }
+            catch {
+                // Metadata may not exist
+            }
+        }
+        return { deleted };
+    }
+    /**
+     * Get a deterministic machine fingerprint for device tracking.
+     * Hash of: hostname + platform + arch + first CPU model.
+     * Stable across reboots, unique per machine.
+     */
+    getMachineId() {
+        const parts = [
+            hostname(),
+            platform(),
+            arch(),
+            cpus()[0]?.model ?? 'unknown-cpu',
+        ].join('|');
+        return createHash('sha256').update(parts).digest('hex').slice(0, 16);
+    }
+    /** Throw if not configured */
+    assertConfigured() {
+        if (!this.isConfigured()) {
+            throw new Error('Cloud backup not configured. Call configure() with R2 credentials first.');
+        }
+    }
+}
+// ==================== HELPERS ====================
+/** Format a Date as YYYY-MM-DD_HHmmss */
+function formatTimestamp(date) {
+    const y = date.getUTCFullYear();
+    const mo = String(date.getUTCMonth() + 1).padStart(2, '0');
+    const d = String(date.getUTCDate()).padStart(2, '0');
+    const h = String(date.getUTCHours()).padStart(2, '0');
+    const mi = String(date.getUTCMinutes()).padStart(2, '0');
+    const s = String(date.getUTCSeconds()).padStart(2, '0');
+    return `${y}-${mo}-${d}_${h}${mi}${s}`;
+}
+/** Unlink a file if it exists, swallowing errors */
+function safeUnlink(path) {
+    try {
+        if (existsSync(path))
+            unlinkSync(path);
+    }
+    catch {
+        // best-effort cleanup
+    }
+}
+// ==================== EXPORTS ====================
+export { encryptBuffer, decryptBuffer };
+//# sourceMappingURL=cloud-backup.js.map