1# A backup carries identity.db as SQLite copies it (VACUUM INTO), one2# consistent file, never the live one with its WAL, nor litestream's state;3# a restore brings it back, so passkeys, sessions and tokens work on the4# new forge. Without litestream set up, the backup's copy is the one. The5# private pages are rebuilt, not backed up.6. "$(dirname "$0")/../lib.sh"7user dami8repo --private dami/secret9clone dami dami/secret "$T/w/dami"10at "$T/w/dami" commit "first"11ok push_as dami "$T/w/dami" origin main12build13tok=$(ssh_as dami token ci 2>/dev/null)14db=$FORGE_ROOT/.forge/identity.db15# A reader holds the file open, as the servers do, so the WAL is there.16node -e '17const { DatabaseSync } = require("node:sqlite");18const d = new DatabaseSync(process.argv[1]);19d.prepare("SELECT count(*) FROM tokens").get();20setTimeout(() => {}, 30000);' "$db" 2>/dev/null &21T_PIDS="$T_PIDS $!"22mkdir -p "$FORGE_ROOT/.forge/.identity.db-litestream"2324ok forge backup --dry-run25st=$FORGE_ROOT/.forge/backup/stage26exists "$st/.forge/identity.db"27missing "$st/.forge/identity.db-wal"28missing "$st/.forge/identity.db-shm"29missing "$st/.forge/.identity.db-litestream"30missing "$st/.forge/private"31missing "$FORGE_ROOT/.forge/identity.snapshot.tmp"32eq "$(mode "$st/.forge/identity.db")" 60033ok node "$T_HOME/lib/identity.ts" check "$st/.forge/identity.db"3435r=$T/restored36ok restore_into "$r" --from "$st"37exists "$r/.forge/identity.db"38exists "$r/.forge/private/www/dami/secret/index.html"39export FORGE_ROOT=$r FORGE_WWW=$r/.forge/www40private_server41eq "$(http -s -o /dev/null -w '%{http_code}' -H "Authorization: Bearer $tok" "$PRIV/dami/secret/")" 20042ok ssh_as dami tokens43has "$T_LOG" ' ci$'