celerp 1.2.4__tar.gz → 1.2.5__tar.gz

{celerp-1.2.4 → celerp-1.2.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: celerp
-Version: 1.2.4
+Version: 1.2.5
 Summary: Free, self-hosted ERP for small businesses
 License: Business Source License 1.1
         

{celerp-1.2.4 → celerp-1.2.5}/celerp/cli.py

@@ -430,8 +430,9 @@ def main() -> None:
 @click.option("--api-port", default=None, type=int, help="API server port (default 8000).")
 @click.option("--ui-port", default=None, type=int, help="UI server port (default 8080).")
 @click.option("--cloud-token", default=None, help="Celerp Cloud token (optional).")
-@click.option("--force", is_flag=True, help="Overwrite existing config.")
-def init(db_url, api_port, ui_port, cloud_token, force):
+@click.option("--force", is_flag=True, help="Reconfigure: WIPES the database and all attached files.")
+@click.option("--yes", "-y", "assume_yes", is_flag=True, help="Skip the --force wipe confirmation (non-interactive use).")
+def init(db_url, api_port, ui_port, cloud_token, force, assume_yes):
     """Initialize Celerp: write config and run database migrations."""
     config_path = _config_path()
 
@@ -441,6 +442,21 @@ def init(db_url, api_port, ui_port, cloud_token, force):
         return
 
     if force:
+        # --force is destructive: it drops the database AND removes attached files.
+        # init can run under sudo, so warn (with full paths) and confirm before wiping.
+        from celerp.config import settings
+        _purge_dirs = [
+            settings.data_dir / "static" / "attachments",
+            settings.data_dir / "ai_uploads",
+        ]
+        click.echo("⚠  `init --force` permanently WIPES this instance:")
+        click.echo(f"     - database: {db_url or _DEFAULT_DB_URL}")
+        for _d in _purge_dirs:
+            click.echo(f"     - files:    {_d.resolve()}")
+        click.echo("   Make sure you have a backup.")
+        if not assume_yes and not click.confirm("Continue?", default=False):
+            click.echo("Aborted.")
+            return
         _stop_servers()
 
     enabled_modules: list[str] = []
@@ -469,6 +485,13 @@ def init(db_url, api_port, ui_port, cloud_token, force):
             )
             sys.exit(1)
         click.echo("  ✓ Database ready (fresh)")
+        # Wipe attached files too, so a forced re-init is a truly fresh instance and no
+        # orphaned files remain. Recreated automatically on next boot.
+        import shutil
+        for _d in _purge_dirs:
+            if _d.exists():
+                shutil.rmtree(_d, ignore_errors=True)
+                click.echo(f"  ✓ Removed {_d.resolve()}")
     else:
         # Test DB connection — auto-provision if running as root
         click.echo("Connecting to database...")
@@ -549,7 +572,7 @@ def init(db_url, api_port, ui_port, cloud_token, force):
     from celerp.gateway.state import build_handoff_url as _handoff
     if _settings.star_cta_enabled:
         click.echo(
-            "New and independent - founding supporters are how other teams find us.\n"
+            "New and independent - early stargazers are how other teams find us.\n"
             f"  Back us early: {_handoff('/github', medium='cli')}\n"
         )
 

{celerp-1.2.4 → celerp-1.2.5}/celerp/events/engine.py

@@ -49,6 +49,12 @@ async def _check_period_lock(session, company_id, data: dict) -> None:
 
 
 async def emit_event(session, **kwargs) -> LedgerEntry:
+    # A backup represents a clean point in time: while one is building, pause writes
+    # (reads, which never emit, are unaffected) so nothing changes mid-backup.
+    from celerp.services.backup_state import is_active as _backup_active
+    if _backup_active():
+        raise HTTPException(status_code=503, detail="Backup in progress, try again shortly.")
+
     schema = EVENT_SCHEMA_MAP.get(kwargs["event_type"])
     if schema is None:
         raise ValueError(f"Unknown event_type: {kwargs['event_type']}")

{celerp-1.2.4 → celerp-1.2.5}/celerp/middleware.py

@@ -73,10 +73,13 @@ class MaxBodySizeMiddleware:
             await self.app(scope, receive, send)
             return
 
-        # Bulk file/cert import legitimately uploads a large ZIP (many small files);
-        # exempt it from the body cap. It's bounded instead by the WS tunnel frame
-        # size and the per-file 50 MB limit in store_upload().
-        if scope.get("path", "").endswith(("/items/files/bulk", "/items/attachments/bulk")):
+        # Bulk file/cert import and backup restore legitimately upload large archives;
+        # exempt them from the body cap. Bulk imports are bounded by the WS tunnel frame
+        # size and the per-file 50 MB limit in store_upload(); a .celerp-backup restore is
+        # a trusted whole-instance archive (DB + files) that is inherently large.
+        if scope.get("path", "").endswith(
+            ("/items/files/bulk", "/items/attachments/bulk", "/backup/import", "/backup/import-bootstrap")
+        ):
             await self.app(scope, receive, send)
             return
 

{celerp-1.2.4 → celerp-1.2.5}/celerp/routers/health.py

@@ -131,22 +131,19 @@ async def backup_status() -> dict:
     """Return backup scheduler state: last results and next scheduled run times."""
     from celerp.config import settings
     from celerp.services import backup_scheduler
+    from celerp.services.backup_state import is_active
     db = backup_scheduler.last_db_result()
-    fl = backup_scheduler.last_file_result()
     next_db = backup_scheduler.next_db_run_utc()
-    next_fl = backup_scheduler.next_file_run_utc()
     running = bool(backup_scheduler._db_task and not backup_scheduler._db_task.done())
     return {
         "running": running,
+        "active": is_active(),
         "gateway_token_set": bool(settings.gateway_token),
         "enc_ok": bool(settings.backup_encryption_key),
         "enc_key": settings.backup_encryption_key or "",
         "db": {"ok": db.ok, "error": db.error, "size_bytes": db.size_bytes,
                "last_run": db.last_run.isoformat() if db.last_run else None},
-        "file": {"ok": fl.ok, "error": fl.error, "size_bytes": fl.size_bytes,
-                 "last_run": fl.last_run.isoformat() if fl.last_run else None},
         "next_db_utc": next_db.isoformat() if next_db else None,
-        "next_file_utc": next_fl.isoformat() if next_fl else None,
     }
 
 

{celerp-1.2.4 → celerp-1.2.5}/celerp/routers/stars.py

@@ -53,7 +53,8 @@ async def dismiss(
 @router.get("/badge/verify-url")
 async def badge_verify_url(return_url: str, _user=Depends(get_current_user)) -> dict:
     """The relay verify-start URL to open in the browser. ``return_url`` is where the
-    relay redirects back with the credential (the install's own page)."""
+    relay redirects back with the credential (the install's own page). Claiming a badge
+    lists the founder on the public wall - there is no separate opt-in."""
     from urllib.parse import urlencode
 
     iid = ensure_instance_id()
@@ -66,8 +67,11 @@ async def get_badge(
     user=Depends(get_current_user),
     session: AsyncSession = Depends(get_session),
 ) -> dict:
-    """The current user's supporter badge, or null."""
-    return {"badge": _badge.to_dict(await _badge.get(session, user.id))}
+    """The current user's supporter badge (or null) + the public founders wall URL."""
+    return {
+        "badge": _badge.to_dict(await _badge.get(session, user.id)),
+        "wall_url": f"{relay_http_url()}/github/founders",
+    }
 
 
 @router.post("/badge")

{celerp-1.2.4 → celerp-1.2.5}/celerp/services/backup.py

@@ -1,30 +1,26 @@
 # Copyright (c) 2026 Noah Severs
 # SPDX-License-Identifier: BUSL-1.1
 
-"""Cloud backup service — pg_dump → AES-256-GCM encrypt → upload to relay.
+"""Backup primitives — pg_dump/pg_restore and AES-256-GCM encrypt/decrypt.
 
 Encryption:
   - Key: 32-byte random, base64-encoded, stored in config.toml [cloud] section
   - Nonce: 12-byte random, prepended to ciphertext
   - Wire format: nonce (12 bytes) + ciphertext (variable) + tag (16 bytes, appended by GCM)
 
-Upload:
-  - Encrypted blob is uploaded to the relay REST API via POST /backup/upload
-  - Auth: X-Session-Token + X-Instance-ID headers (from live gateway session)
+These primitives are shared by the local export/import path and the content-addressed
+cloud snapshot client (``backup_repo``).
 """
 
 from __future__ import annotations
 
 import base64
-import io
-import os
 import subprocess
 import sys
 from dataclasses import dataclass, field
 from pathlib import Path
 
 from celerp.config import settings
-from celerp.gateway.state import get_session_token, relay_http_url, relay_session_headers
 
 _NONCE_BYTES = 12
 
@@ -173,49 +169,6 @@ def decrypt(blob: bytes, key: bytes) -> bytes:
     return aesgcm.decrypt(nonce, ciphertext, associated_data=None)
 
 
-async def upload_to_relay(
-    blob: bytes,
-    backup_type: str = "database",
-    label: str | None = None,
-) -> dict:
-    """Upload encrypted blob to relay REST API. Returns response dict."""
-    import httpx
-    url = f"{relay_http_url()}/backup/upload"
-    params: dict[str, str] = {"backup_type": backup_type}
-    if label:
-        params["label"] = label
-
-    async with httpx.AsyncClient(timeout=120) as client:
-        response = await client.post(
-            url,
-            headers=relay_session_headers(),
-            params=params,
-            files={"file": ("backup.bin", io.BytesIO(blob), "application/octet-stream")},
-        )
-    if response.status_code != 200:
-        raise RuntimeError(
-            f"Relay upload failed with HTTP {response.status_code}: {response.text[:200]}"
-        )
-    return response.json()
-
-
-async def download_from_relay(backup_id: str) -> bytes:
-    """Download encrypted backup blob from relay via presigned URL."""
-    import httpx
-    url = f"{relay_http_url()}/backup/{backup_id}"
-    async with httpx.AsyncClient(timeout=30) as client:
-        response = await client.get(url, headers=relay_session_headers())
-    if response.status_code != 200:
-        raise RuntimeError(f"Failed to get download URL: HTTP {response.status_code}")
-
-    presigned_url = response.json()["url"]
-    async with httpx.AsyncClient(timeout=120) as client:
-        dl = await client.get(presigned_url)
-    if dl.status_code != 200:
-        raise RuntimeError(f"Download failed: HTTP {dl.status_code}")
-    return dl.content
-
-
 def restore_database(dump_bytes: bytes, database_url: str) -> None:
     """Run pg_restore from dump bytes into database_url.
 
@@ -239,47 +192,3 @@ def restore_database(dump_bytes: bytes, database_url: str) -> None:
         # pg_restore returns non-zero for warnings too; only raise on real errors
         if "ERROR" in stderr.upper():
             raise RuntimeError(f"pg_restore failed (exit {result.returncode}): {stderr}")
-
-
-async def run_backup(label: str | None = None) -> BackupResult:
-    """Orchestrate a full DB backup: dump → encrypt → upload to relay.
-
-    Returns BackupResult. Never raises — errors are captured in result.error.
-    """
-    if not settings.backup_encryption_key:
-        return BackupResult(ok=False, size_bytes=0, error="BACKUP_ENCRYPTION_KEY is not configured")
-
-    if not get_session_token():
-        return BackupResult(ok=False, size_bytes=0, error="Relay not connected - skipping backup")
-
-    try:
-        key = _parse_key(settings.backup_encryption_key)
-        dump = dump_database(settings.database_url)
-        blob = encrypt(dump, key)
-        await upload_to_relay(blob, backup_type="database", label=label)
-        return BackupResult(ok=True, size_bytes=len(blob))
-    except Exception as exc:
-        return BackupResult(ok=False, size_bytes=0, error=str(exc))
-
-
-async def run_restore(backup_id: str) -> BackupResult:
-    """Download, decrypt, and restore a database backup.
-
-    Creates a safety backup first. Returns BackupResult.
-    """
-    if not settings.backup_encryption_key:
-        return BackupResult(ok=False, size_bytes=0, error="BACKUP_ENCRYPTION_KEY is not configured")
-
-    try:
-        # Safety backup first
-        safety = await run_backup(label="pre-restore-safety")
-        if not safety.ok:
-            return BackupResult(ok=False, size_bytes=0, error=f"Safety backup failed: {safety.error}")
-
-        key = _parse_key(settings.backup_encryption_key)
-        encrypted = await download_from_relay(backup_id)
-        dump = decrypt(encrypted, key)
-        restore_database(dump, settings.database_url)
-        return BackupResult(ok=True, size_bytes=len(dump))
-    except Exception as exc:
-        return BackupResult(ok=False, size_bytes=0, error=str(exc))

{celerp-1.2.4 → celerp-1.2.5}/celerp/services/backup_export.py

@@ -1,11 +1,10 @@
 # Copyright (c) 2026 Noah Severs
 # SPDX-License-Identifier: BUSL-1.1
 
-"""Export full backup as .celerp-backup (unencrypted tar.gz).
+"""Export a full local backup as .celerp-backup (unencrypted tar.gz).
 
-Two sources:
-  - export_full(): local pg_dump + attachments + meta.json
-  - export_from_cloud(backup_id): download encrypted → decrypt → repackage
+``export_full()`` bundles a local pg_dump + attachments + meta.json. Cloud snapshots
+are rebuilt into the same format by ``backup_repo.reassemble_snapshot``.
 """
 
 from __future__ import annotations
@@ -135,25 +134,3 @@ async def export_full() -> Path:
         [settings.data_dir / "static" / "attachments", settings.data_dir / "ai_uploads"],
         meta,
     )
-
-
-async def export_from_cloud(backup_id: str) -> Path:
-    """Download encrypted backup from relay, decrypt, repackage as .celerp-backup.
-
-    The decrypted blob is itself a complete .celerp-backup (built by
-    export_full when the cloud backup was first uploaded), so it already
-    carries the original meta.json with enabled_modules. We pass it through
-    unchanged — the import side reads meta.json directly.
-    """
-    from celerp.config import settings
-    from celerp.services.backup import _parse_key, decrypt, download_from_relay
-
-    key = _parse_key(settings.backup_encryption_key)
-    encrypted = await download_from_relay(backup_id)
-    decrypted = decrypt(encrypted, key)
-
-    # Write decrypted blob as .celerp-backup
-    tmp = tempfile.NamedTemporaryFile(suffix=".celerp-backup", delete=False)
-    tmp.write(decrypted)
-    tmp.close()
-    return Path(tmp.name)

{celerp-1.2.4 → celerp-1.2.5}/celerp/services/backup_import.py

@@ -194,11 +194,11 @@ async def _safety_backup(label: str):
     Module-level helper so tests can stub it cleanly.
     """
     from celerp.config import settings
-    from celerp.services.backup import run_backup
+    from celerp.services.backup import BackupResult
     if not settings.backup_encryption_key:
-        from celerp.services.backup import BackupResult
         return BackupResult(ok=True, size_bytes=0)
-    return await run_backup(label=label)
+    from celerp.services.backup_repo import run_snapshot
+    return await run_snapshot(label=label)
 
 
 async def _read_modules_from_restored_db() -> list[str]:

celerp-1.2.5/celerp/services/backup_repo.py

@@ -0,0 +1,241 @@
+# Copyright (c) 2026 Noah Severs
+# SPDX-License-Identifier: BUSL-1.1
+
+"""Content-addressed cloud snapshot client.
+
+One cloud backup path for both database and files. Every member of a backup (the
+pg_dump and each attachment/upload file) is a content-addressed *blob* keyed by the
+SHA-256 of its plaintext, encrypted client-side and stored once on the relay. A
+*snapshot* is a small manifest referencing the blobs needed to rebuild a
+``.celerp-backup``. Unchanged files share a hash and are never re-uploaded, so a
+daily backup sends only what changed.
+
+Restore downloads the manifest, fetches its blobs, reassembles a ``.celerp-backup``
+and feeds the canonical ``run_import`` engine — the same importer as a local restore.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import hashlib
+import io
+import json
+import logging
+import tarfile
+import tempfile
+from pathlib import Path
+
+import httpx
+
+from celerp.config import settings
+from celerp.gateway.state import get_session_token, relay_http_url, relay_session_headers
+from celerp.services.backup import BackupResult, _parse_key, decrypt, dump_database, encrypt
+
+log = logging.getLogger(__name__)
+
+_CHUNK = 1024 * 1024  # 1 MiB read window for streaming hashes
+# Each AES-256-GCM blob carries a 12-byte nonce + 16-byte tag over the plaintext.
+_ENC_OVERHEAD = 28
+
+
+def _attachment_dirs() -> list[Path]:
+    return [settings.data_dir / "static" / "attachments", settings.data_dir / "ai_uploads"]
+
+
+def _members() -> list[tuple[str, Path]]:
+    """(arcname, path) for every backed-up file, arcname relative to the dir's parent
+    so it round-trips through the same ``.celerp-backup`` layout as a local export."""
+    out: list[tuple[str, Path]] = []
+    for d in _attachment_dirs():
+        if not d.exists():
+            continue
+        for p in sorted(d.rglob("*")):
+            if p.is_file():
+                try:
+                    rel = str(p.relative_to(d.parent))
+                except ValueError:
+                    rel = p.name
+                out.append((rel, p))
+    return out
+
+
+def _hash_file(path: Path) -> tuple[str, int]:
+    h = hashlib.sha256()
+    size = 0
+    with path.open("rb") as fh:
+        while chunk := fh.read(_CHUNK):
+            h.update(chunk)
+            size += len(chunk)
+    return h.hexdigest(), size
+
+
+async def _build_meta() -> dict:
+    from celerp.services.backup_export import _pg_version, _read_company_enabled_modules, _version
+    import datetime as _dt
+
+    from celerp.config import read_config
+    cfg = read_config()
+    return {
+        "celerp_version": _version(),
+        "pg_version": _pg_version(),
+        "created_at": _dt.datetime.now(_dt.timezone.utc).isoformat(),
+        "company_name": cfg.get("company", {}).get("name", "unknown"),
+        "enabled_modules": await _read_company_enabled_modules(),
+    }
+
+
+# ── Relay API ─────────────────────────────────────────────────────────────────
+
+def _relay() -> httpx.AsyncClient:
+    return httpx.AsyncClient(
+        base_url=relay_http_url(), headers=relay_session_headers(), timeout=60
+    )
+
+
+async def _missing(client: httpx.AsyncClient, hashes: set[str]) -> set[str]:
+    r = await client.post("/repo/missing", json={"hashes": sorted(hashes)})
+    r.raise_for_status()
+    return set(r.json()["missing"])
+
+
+async def _put_blob(client: httpx.AsyncClient, blob_hash: str, plaintext: bytes, key: bytes) -> int:
+    """Encrypt and upload one blob via a presigned PUT. Returns stored (encrypted) size."""
+    r = await client.post(f"/repo/blob/{blob_hash}/upload-url")
+    r.raise_for_status()
+    encrypted = await asyncio.to_thread(encrypt, plaintext, key)
+    async with httpx.AsyncClient(timeout=300) as s3:
+        put = await s3.put(r.json()["url"], content=encrypted)
+        put.raise_for_status()
+    return len(encrypted)
+
+
+async def _get_blob(client: httpx.AsyncClient, blob_hash: str, key: bytes) -> bytes:
+    """Download, decrypt and integrity-check one blob against its content hash."""
+    r = await client.get(f"/repo/blob/{blob_hash}/download-url")
+    r.raise_for_status()
+    async with httpx.AsyncClient(timeout=300) as s3:
+        dl = await s3.get(r.json()["url"])
+        dl.raise_for_status()
+    plaintext = await asyncio.to_thread(decrypt, dl.content, key)
+    if hashlib.sha256(plaintext).hexdigest() != blob_hash:
+        raise RuntimeError(f"Blob {blob_hash[:12]} failed integrity check")
+    return plaintext
+
+
+# ── Public API ────────────────────────────────────────────────────────────────
+
+async def run_snapshot(label: str | None = None) -> BackupResult:
+    """Back up the database + files as a deduplicated snapshot. Never raises."""
+    if not settings.backup_encryption_key:
+        return BackupResult(ok=False, size_bytes=0, error="BACKUP_ENCRYPTION_KEY is not configured")
+    if not get_session_token():
+        return BackupResult(ok=False, size_bytes=0, error="Relay not connected - skipping backup")
+
+    try:
+        from celerp.services.backup_state import writes_paused
+
+        key = _parse_key(settings.backup_encryption_key)
+
+        # Pause writes for the clean point; blocking work runs off the event loop so
+        # reads stay served throughout.
+        with writes_paused():
+            # Hash every member first (streamed) so we only ever upload what's missing.
+            dump = await asyncio.to_thread(dump_database, settings.database_url)
+            db_hash = hashlib.sha256(dump).hexdigest()
+            files = []  # manifest entries
+            by_hash: dict[str, tuple[str, Path] | None] = {db_hash: None}  # None ⇒ db dump
+            for arcname, path in _members():
+                fhash, size = await asyncio.to_thread(_hash_file, path)
+                files.append({"path": arcname, "hash": fhash, "size": size})
+                by_hash.setdefault(fhash, (arcname, path))
+
+            manifest = {"meta": await _build_meta(), "db_dump": db_hash, "files": files}
+            manifest_bytes = json.dumps(manifest, indent=2).encode()
+            manifest_hash = hashlib.sha256(manifest_bytes).hexdigest()
+
+            referenced = set(by_hash) | {manifest_hash}
+            uploaded = 0
+            async with _relay() as client:
+                missing = await _missing(client, referenced)
+                sizes: dict[str, int] = {}
+                for h in missing:
+                    if h == manifest_hash:
+                        plaintext = manifest_bytes
+                    elif h == db_hash:
+                        plaintext = dump
+                    else:
+                        plaintext = await asyncio.to_thread(by_hash[h][1].read_bytes)  # type: ignore[index]
+                    sizes[h] = await _put_blob(client, h, plaintext, key)
+                    uploaded += sizes[h]
+
+                # size matters only for newly-uploaded blobs (quota); the relay keeps
+                # the stored size for blobs it already has, so 1 is a harmless placeholder.
+                blobs = [{"hash": h, "size": sizes.get(h, 1)} for h in referenced]
+                r = await client.post(
+                    "/repo/snapshot",
+                    json={"manifest_hash": manifest_hash, "blobs": blobs, "label": label},
+                )
+                r.raise_for_status()
+
+        log.info("Snapshot committed: %d blobs referenced, %d bytes uploaded", len(referenced), uploaded)
+        return BackupResult(ok=True, size_bytes=uploaded)
+    except Exception as exc:  # never raise — surfaced in result
+        return BackupResult(ok=False, size_bytes=0, error=str(exc))
+
+
+async def list_snapshots() -> dict:
+    """Return the relay's snapshot list payload (items + totals). Raises on error."""
+    async with _relay() as client:
+        r = await client.get("/repo/snapshots")
+        r.raise_for_status()
+        return r.json()
+
+
+async def reassemble_snapshot(snapshot_id: str) -> Path:
+    """Download a snapshot and rebuild it as a ``.celerp-backup`` temp file."""
+    key = _parse_key(settings.backup_encryption_key)
+    async with _relay() as client:
+        r = await client.get("/repo/snapshots")
+        r.raise_for_status()
+        snap = next((s for s in r.json()["items"] if s["id"] == snapshot_id), None)
+        if snap is None:
+            raise RuntimeError(f"Snapshot {snapshot_id} not found")
+
+        manifest = json.loads(await _get_blob(client, snap["manifest_hash"], key))
+
+        tmp = tempfile.NamedTemporaryFile(suffix=".celerp-backup", delete=False)
+        tmp.close()
+        with tarfile.open(tmp.name, "w:gz") as tar:
+            dump = await _get_blob(client, manifest["db_dump"], key)
+            info = tarfile.TarInfo(name="database.dump")
+            info.size = len(dump)
+            tar.addfile(info, io.BytesIO(dump))
+
+            meta_bytes = json.dumps(manifest["meta"], indent=2).encode()
+            info = tarfile.TarInfo(name="meta.json")
+            info.size = len(meta_bytes)
+            tar.addfile(info, io.BytesIO(meta_bytes))
+
+            for entry in manifest["files"]:
+                data = await _get_blob(client, entry["hash"], key)
+                info = tarfile.TarInfo(name=entry["path"])
+                info.size = len(data)
+                tar.addfile(info, io.BytesIO(data))
+
+    return Path(tmp.name)
+
+
+async def restore_snapshot(snapshot_id: str) -> BackupResult:
+    """Reassemble a cloud snapshot and restore it through the canonical importer."""
+    if not settings.backup_encryption_key:
+        return BackupResult(ok=False, size_bytes=0, error="BACKUP_ENCRYPTION_KEY is not configured")
+    try:
+        from celerp.services.backup_import import run_import
+        path = await reassemble_snapshot(snapshot_id)
+        try:
+            await run_import(path)
+        finally:
+            path.unlink(missing_ok=True)
+        return BackupResult(ok=True, size_bytes=0)
+    except Exception as exc:
+        return BackupResult(ok=False, size_bytes=0, error=str(exc))