tom/HealthLog
1
0 Fork 0
mirror of https://github.com/MBombeck/HealthLog.git synced 2026-11-08 12:32:43 +00:00
Code Issues Packages Projects Releases Wiki Activity
6,662 Commits 11 Branches 539 Tags
c2005fd8f1fda06703bd2ca71e584fa8bfa97a68
Commit Graph
700 Commits
Author SHA1 Message Date
dependabot[bot] 2c640683a7 chore(deps): bump undici from 8.10.0 to 8.10.2 (#1018) 
Bumps [undici](https://github.com/nodejs/undici) from 8.10.0 to 8.10.2.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](https://github.com/nodejs/undici/compare/v8.10.0...v8.10.2)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 8.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-20 19:00:31 +02:00
dependabot[bot] fd8431ae47 chore(deps-dev): bump eslint-config-next from 16.2.12 to 16.3.5 (#1015) 
Bumps [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) from 16.2.12 to 16.3.5.
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.5/packages/eslint-config-next)

---
updated-dependencies:
- dependency-name: eslint-config-next
  dependency-version: 16.3.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-20 18:24:50 +02:00
Marc-André Bombeck 4f31b4b025 chore(release): v1.38.25 — readings that never arrived, and an import that said no 2026-09-20 10:53:24 +02:00
Marc-André Bombeck 5188b28ea6 chore(release): v1.38.24 — Insights loads without the assistant, and the database stays current 2026-09-16 18:27:51 +02:00
Marc-André Bombeck bf728ff552 Merge pull request #998 from MBombeck/dependabot/npm_and_yarn/types/node-26.5.1 
chore(deps-dev): bump @types/node from 26.1.1 to 26.5.1
 2026-09-16 15:47:54 +02:00
Marc-André Bombeck c2ec2b76cf Merge pull request #994 from MBombeck/dependabot/npm_and_yarn/sonner-2.0.8 
chore(deps): bump sonner from 2.0.7 to 2.0.8
 2026-09-16 15:47:26 +02:00
dependabot[bot] 34182cbb4f chore(deps-dev): bump @types/node from 26.1.1 to 26.5.1 
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 26.1.1 to 26.5.1.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 26.5.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-16 13:23:10 +00:00
dependabot[bot] 4ac11c71cb chore(deps): bump sonner from 2.0.7 to 2.0.8 
Bumps [sonner](https://github.com/emilkowalski/sonner) from 2.0.7 to 2.0.8.
- [Release notes](https://github.com/emilkowalski/sonner/releases)
- [Commits](https://github.com/emilkowalski/sonner/compare/v2.0.7...v2.0.8)

---
updated-dependencies:
- dependency-name: sonner
  dependency-version: 2.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-16 13:10:36 +00:00
Marc-André Bombeck 629731120a Merge pull request #997 from MBombeck/dependabot/npm_and_yarn/jose-6.2.12 
chore(deps): bump jose from 6.2.10 to 6.2.12
 2026-09-16 15:09:43 +02:00
Marc-André Bombeck c33a88b282 Merge pull request #993 from MBombeck/dependabot/npm_and_yarn/napi-rs/canvas-1.0.9 
chore(deps): bump @napi-rs/canvas from 1.0.7 to 1.0.9
 2026-09-16 15:09:20 +02:00
dependabot[bot] 9db3770ea3 chore(deps): bump @napi-rs/canvas from 1.0.7 to 1.0.9 
Bumps [@napi-rs/canvas](https://github.com/Brooooooklyn/canvas) from 1.0.7 to 1.0.9.
- [Release notes](https://github.com/Brooooooklyn/canvas/releases)
- [Changelog](https://github.com/Brooooooklyn/canvas/blob/main/CHANGELOG.md)
- [Commits](https://github.com/Brooooooklyn/canvas/compare/v1.0.7...v1.0.9)

---
updated-dependencies:
- dependency-name: "@napi-rs/canvas"
  dependency-version: 1.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-16 12:06:47 +00:00
dependabot[bot] fade5d467e chore(deps): bump sax from 1.6.0 to 1.6.1 
Bumps [sax](https://github.com/isaacs/sax-js) from 1.6.0 to 1.6.1.
- [Commits](https://github.com/isaacs/sax-js/compare/v1.6.0...v1.6.1)

---
updated-dependencies:
- dependency-name: sax
  dependency-version: 1.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-16 12:06:47 +00:00
dependabot[bot] 453c1141a7 chore(deps): bump jose from 6.2.10 to 6.2.12 
Bumps [jose](https://github.com/panva/jose) from 6.2.10 to 6.2.12.
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](https://github.com/panva/jose/compare/v6.2.10...v6.2.12)

---
updated-dependencies:
- dependency-name: jose
  dependency-version: 6.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-16 11:54:00 +00:00
Marc-André Bombeck 6f562c05ca Merge pull request #992 from MBombeck/dependabot/npm_and_yarn/nodemailer-10.0.9 
chore(deps): bump nodemailer from 9.1.1 to 10.0.9
 2026-09-16 13:53:51 +02:00
dependabot[bot] 4b32bad6e9 chore(deps): bump @tanstack/react-virtual from 3.14.5 to 3.14.12 (#991) 
Bumps [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) from 3.14.5 to 3.14.12.
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.12/packages/react-virtual)

---
updated-dependencies:
- dependency-name: "@tanstack/react-virtual"
  dependency-version: 3.14.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-16 11:16:53 +00:00
Marc-André Bombeck 3da671c7c3 chore(deps): drop the separate nodemailer types 
nodemailer 10 is a TypeScript rewrite and ships its own declarations, so
the hand-added @types/nodemailer package now shadows them with the types
of a release two majors old. The email sender keeps its default import
and its Transporter type from the package itself.

The new floor is Node 20; the image and the engines field are on 22.
 2026-09-16 13:08:48 +02:00
dependabot[bot] c46874060d chore(deps): bump nodemailer from 9.1.1 to 10.0.9 
Bumps [nodemailer](https://github.com/nodemailer/nodemailer) from 9.1.1 to 10.0.9.
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodemailer/nodemailer/compare/v9.1.1...v10.0.9)

---
updated-dependencies:
- dependency-name: nodemailer
  dependency-version: 10.0.9
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-16 10:40:05 +00:00
Marc-André Bombeck 6f4e39acf6 chore(release): v1.38.23 — MCP connects from Chrome again, and lab scans can go past six an hour 2026-09-15 23:01:17 +02:00
dependabot[bot] 9af911a2a9 chore(deps): bump lucide-react from 1.34.0 to 1.44.0 
Bumps [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) from 1.34.0 to 1.44.0.
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.44.0/packages/lucide-react)

---
updated-dependencies:
- dependency-name: lucide-react
  dependency-version: 1.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-13 21:24:49 +00:00
dependabot[bot] 59300e809d chore(deps-dev): bump @playwright/test from 1.62.1 to 1.63.0 
Bumps [@playwright/test](https://github.com/microsoft/playwright) from 1.62.1 to 1.63.0.
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](https://github.com/microsoft/playwright/compare/v1.62.1...v1.63.0)

---
updated-dependencies:
- dependency-name: "@playwright/test"
  dependency-version: 1.63.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-13 20:46:57 +00:00
Marc-André Bombeck 7787a5cf5e Merge main into the Prisma 7.10 update 2026-09-13 20:33:18 +02:00
Marc-André Bombeck 36ff3e7cb9 chore(deps): move the Prisma client and the image CLI to 7.10 
The bump raised the CLI to 7.10.0 but left @prisma/client at 7.8.0 and
the migration CLI the image installs under /opt/prisma-cli at 7.8.0, so
the generated client, the one that ships and the one that migrates would
have come from two releases. All three are 7.10.0 now.
 2026-09-13 20:33:17 +02:00
dependabot[bot] a5b5faec83 chore(deps): bump prisma from 7.8.0 to 7.10.0 
Bumps [prisma](https://github.com/prisma/prisma-cli/tree/HEAD/packages/prisma) from 7.8.0 to 7.10.0.
- [Release notes](https://github.com/prisma/prisma-cli/releases)
- [Commits](https://github.com/prisma/prisma-cli/commits/HEAD/packages/prisma)

---
updated-dependencies:
- dependency-name: prisma
  dependency-version: 7.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-13 17:50:31 +00:00
dependabot[bot] 2d92c16729 chore(deps-dev): bump pdfjs-dist from 6.2.108 to 6.3.289 
Bumps [pdfjs-dist](https://github.com/mozilla/pdf.js) from 6.2.108 to 6.3.289.
- [Release notes](https://github.com/mozilla/pdf.js/releases)
- [Commits](https://github.com/mozilla/pdf.js/compare/v6.2.108...v6.3.289)

---
updated-dependencies:
- dependency-name: pdfjs-dist
  dependency-version: 6.3.289
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-13 17:48:39 +00:00
Marc-André Bombeck 9e81369279 Merge pull request #965 from MBombeck/dependabot/npm_and_yarn/vitejs/plugin-react-6.1.1 
chore(deps-dev): bump @vitejs/plugin-react from 6.1.0 to 6.1.1
 2026-09-13 19:42:21 +02:00
Marc-André Bombeck 2207bb1114 chore(release): v1.38.22 — a channel test waits until you save 2026-09-13 18:28:47 +02:00
dependabot[bot] 530d2849bb chore(deps-dev): bump @vitejs/plugin-react from 6.1.0 to 6.1.1 
Bumps [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) from 6.1.0 to 6.1.1.
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.1/packages/plugin-react)

---
updated-dependencies:
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-13 15:53:54 +00:00
Marc-André Bombeck 8c8e03a6eb chore(release): v1.38.21 — channel tests say why they failed, and Gotify gets its format 2026-09-13 15:18:20 +02:00
dependabot[bot] fabdfea6e2 chore(deps): bump @tanstack/react-query from 5.101.4 to 5.102.8 
Bumps [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) from 5.101.4 to 5.102.8.
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.102.8/packages/react-query)

---
updated-dependencies:
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.102.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-13 11:50:05 +00:00
Marc-André Bombeck 0568c76076 chore(release): v1.38.20 — signing in no longer says who has an account here 
Bump the version, the service-worker fallback and the OpenAPI document,
and add the CHANGELOG entry for v1.38.20.
 2026-09-11 16:15:58 +02:00
Marc-André Bombeck 6a4e1f61c8 chore(release): v1.38.19 — the setup says what is true, and the AI has budget left when you ask 
Bump the version, the service-worker fallback and the OpenAPI document,
and add the CHANGELOG entry for v1.38.19.
 2026-09-11 14:36:38 +02:00
Marc-André Bombeck 1abf528925 chore(release): v1.38.18 — the first run asks what you need and switches on exactly that 
Bump the version, the service-worker fallback and the OpenAPI document,
and add the CHANGELOG entry for v1.38.18.
 2026-09-10 23:09:23 +02:00
Marc-André Bombeck 80171436e3 chore(release): v1.38.17 — a private notification target can be listed by the operator 
Bump the version, the service-worker fallback and the OpenAPI document,
and add the CHANGELOG entry for v1.38.17.
 2026-09-10 19:27:49 +02:00
Marc-André Bombeck 29a02d6741 chore(release): v1.38.16 — the API says what it refused, and the admin page says whether last night's copy landed 
Bump the version, the service-worker fallback and the OpenAPI document,
and add the CHANGELOG entry for v1.38.16.
 2026-09-10 15:39:50 +02:00
Marc-André Bombeck 8d418bc6f8 chore(release): v1.38.15 — the rest of #939, one adherence figure, and an API that says when to come back 
Version anchors, the OpenAPI document and the changelog entry. Refs #939.
 2026-09-10 07:45:55 +02:00
Marc-André Bombeck 3d163d3602 chore(release): v1.38.14 — the reported bugs at their class, and a gate that stops crying wolf 
Version anchors, the OpenAPI document and the changelog entry. Refs #943, #944.
 2026-09-10 03:05:20 +02:00
Marc-André Bombeck d464a3efe4 Merge remote-tracking branch 'origin/main' into fix/managed-record-capabilities 
# Conflicts:
#	public/sw.js
 2026-09-09 21:38:11 +02:00
Marc-André Bombeck b8a3890ef4 chore(release): v1.38.12 — the scanner findings are cleared 
Version anchors, the OpenAPI document and the changelog entry for the dependency release.
 2026-09-09 19:19:50 +02:00
Marc-André Bombeck 47953f5b8a chore(deps): clear the seventeen scanner findings 
Trivy flags twelve distinct advisories on the lockfile and the image, none
in this code: next 16.2.11 (two critical, fixed in 16.3.3), sharp 0.35.3
pulled by next (high), nodemailer 9.0.3 (one high, three medium), js-yaml
4.3.1 (high), hono 4.13.3 under the MCP SDK's node server (three medium),
and the vitest mocker and baseline-browser-mapping (medium). Dependabot
lists none of them, which is why they sat.

next moves to 16.3.4 and nodemailer to 9.1.1 as direct pins; vitest to
4.1.11. js-yaml, hono, baseline-browser-mapping and sharp are transitive
and move through pnpm overrides bounded to the vulnerable ranges, so the
copies the scanner names change and nothing else does. Typecheck, lint,
the unit suite and the production build pass locally; the release gate
runs the integration and end-to-end suites on the minor Next bump.
 2026-09-09 18:38:29 +02:00
Marc-André Bombeck 75d3fad04e Merge pull request #935 from MBombeck/dependabot/npm_and_yarn/types/pg-8.23.1 
chore(deps-dev): bump @types/pg from 8.20.0 to 8.23.1
 2026-09-08 21:46:24 +02:00
Marc-André Bombeck 5080624925 Merge pull request #934 from MBombeck/dependabot/npm_and_yarn/axe-core/playwright-4.13.0 
chore(deps-dev): bump @axe-core/playwright from 4.12.1 to 4.13.0
 2026-09-08 21:44:50 +02:00
Marc-André Bombeck 13a9c6576b Merge pull request #932 from MBombeck/dependabot/npm_and_yarn/lefthook-2.1.12 
chore(deps-dev): bump lefthook from 2.1.10 to 2.1.12
 2026-09-08 21:43:15 +02:00
Marc-André Bombeck 7a54aae1ca Merge pull request #931 from MBombeck/dependabot/npm_and_yarn/jose-6.2.10 
chore(deps): bump jose from 6.2.3 to 6.2.10
 2026-09-08 21:41:41 +02:00
Marc-André Bombeck e0cf6c2403 chore(release): v1.38.11 — sign out everywhere means everywhere 
Version anchors, the OpenAPI document, the changelog entry, and the
README sentence that still declared immunization records out of scope
while the vaccination record has shipped since v1.37.3.
 2026-09-08 20:23:30 +02:00
dependabot[bot] 776e36a37f chore(deps-dev): bump @types/pg from 8.20.0 to 8.23.1 
Bumps [@types/pg](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/pg) from 8.20.0 to 8.23.1.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/pg)

---
updated-dependencies:
- dependency-name: "@types/pg"
  dependency-version: 8.23.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-06 15:55:49 +00:00
dependabot[bot] 4feccf3a07 chore(deps-dev): bump @axe-core/playwright from 4.12.1 to 4.13.0 
Bumps [@axe-core/playwright](https://github.com/dequelabs/axe-core-npm) from 4.12.1 to 4.13.0.
- [Release notes](https://github.com/dequelabs/axe-core-npm/releases)
- [Changelog](https://github.com/dequelabs/axe-core-npm/blob/develop/CHANGELOG.md)
- [Commits](https://github.com/dequelabs/axe-core-npm/commits/v4.13.0)

---
updated-dependencies:
- dependency-name: "@axe-core/playwright"
  dependency-version: 4.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-06 15:55:18 +00:00
dependabot[bot] 846e735b58 chore(deps-dev): bump lefthook from 2.1.10 to 2.1.12 
Bumps [lefthook](https://github.com/evilmartians/lefthook) from 2.1.10 to 2.1.12.
- [Release notes](https://github.com/evilmartians/lefthook/releases)
- [Changelog](https://github.com/evilmartians/lefthook/blob/master/CHANGELOG.md)
- [Commits](https://github.com/evilmartians/lefthook/compare/v2.1.10...v2.1.12)

---
updated-dependencies:
- dependency-name: lefthook
  dependency-version: 2.1.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-06 15:53:56 +00:00
dependabot[bot] 0e51a17ab4 chore(deps): bump jose from 6.2.3 to 6.2.10 
Bumps [jose](https://github.com/panva/jose) from 6.2.3 to 6.2.10.
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](https://github.com/panva/jose/compare/v6.2.3...v6.2.10)

---
updated-dependencies:
- dependency-name: jose
  dependency-version: 6.2.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-06 15:53:22 +00:00
Marc-André Bombeck 69fc8bf2e3 chore(release): v1.38.10 — the off-host backup streams, the rotated token sunsets 2026-09-06 16:02:50 +02:00
Marc-André Bombeck 13a9aacf20 fix(backup): stream the nightly off-host upload instead of building it 
The off-host job was said to benefit from the streaming work the weekly
in-database backup got, and it did not. Only the payload builder was
shared: `runOffhostBackup` called `buildFullBackupJson` for the whole
document, `gzipSync` over that whole string, a whole-buffer
`createCipheriv` pass over the result, and handed the finished buffer to
a single `PutObject`. Four full copies of the record alive at once, on
the same arithmetic the weekly pass had already been fixed for.

Configuring an S3 target on a long-lived record therefore restarted the
container. On an account of 445 000 measurements the JSON alone is
242 MB, and against a 1 GB container's 524 MB heap the run died of heap
exhaustion seventeen seconds in — taking every signed-in session with
it, because the job shares the app process.

The write path is a stream end to end now: `streamFullBackupJson`
produces the document a page at a time, gzip and an incremental
AES-256-GCM writer consume it as it arrives, and `@aws-sdk/lib-storage`
puts it up in two 8 MB parts. What the process holds is fixed by the
pipeline's shape rather than by the record. Measured on that same
445 000-measurement account under `--max-old-space-size=450`, with the
heap pre-loaded to what a warm server holds: the old path dies with
`Ineffective mark-compacts near heap limit`, the new one finishes with a
peak 79 MB above its baseline and writes a 9.1 MB object.

The stored envelope gains version 3, which moves the GCM tag from in
front of the ciphertext to the end. That is the only change the stream
required — the tag exists only once the last block is in, so a leading
one means the whole object must exist before its first byte can be sent.
Nothing about the authentication moves: the tag still covers every
ciphertext byte and is verified before a byte of plaintext comes back.
Versions 1 and 2 still read, so every object already in a bucket
restores through the same reader with no flag to tell them apart.

The incremental writer is the crypto module's, split into its byte-level
half so the base64 form the in-database blob uses and the raw form an
object needs are one implementation under two framings. The off-host key
handling is unchanged: a separate `BACKUP_ENCRYPTION_KEY`, 64 hex or
32-byte base64, passed in rather than looked up.

A run that uploaded nothing for anybody is a failed job now, not
`ok: true` with an empty bucket behind it. Wrong credentials, a missing
bucket and an unreachable endpoint all fail every account rather than
one, and the target's own sentence rides out as the cause. A run where
some account got a copy still succeeds; retrying the whole cohort over
one object would re-upload everybody's.

The one ceiling left is structural rather than a memory bound, and it is
counted rather than discovered: a multipart upload carries 10 000 parts,
so an object past 80 GB is refused for that account with a clear message
instead of failing halfway through with an SDK error about part numbers.

`tests/integration/offhost-backup-streaming-memory.test.ts` pins the
budget from both sides — what the streaming uploader holds, and that the
materialising path does not fit the same budget on the same fixture in
the same process, so the number cannot pass by measuring nothing.
 2026-09-05 19:13:11 +02:00