backup

Mellon wraps a full Cloudflare D1 SQL export in an AES-256-GCM encrypted archive. The archive includes authenticated schema, record-count, bookmark, and encryption-key-version metadata. It does not include root encryption keys.

Set a strong backup passphrase through the environment. Do not put it on the command line.

12export MELLON_BACKUP_PASSPHRASE='<long unique passphrase>'
mellon backup create --name mellon --out ./mellon-backup.json

The output file is created with mode 0600. Mellon refuses to overwrite an existing backup.

Verify

Verify authentication, the SQL digest, schema metadata, counts, and key versions without printing SQL or secret values:

12MELLON_BACKUP_PASSPHRASE='<passphrase>' \
  mellon backup verify ./mellon-backup.json

Restore drill

Restore always targets a new D1 database. Mellon refuses an existing database name and never changes a Worker binding.

Preview the drill:

12MELLON_BACKUP_PASSPHRASE='<passphrase>' \
  mellon backup restore ./mellon-backup.json --database mellon-restore-drill

Apply after review:

1234MELLON_BACKUP_PASSPHRASE='<passphrase>' \
  mellon backup restore ./mellon-backup.json \
  --database mellon-restore-drill \
  --apply

After import, Mellon compares the restored schema version, record counts, and ciphertext key-version counts with the authenticated backup manifest. The quarantine database remains detached for inspection.

Cloudflare pauses D1 queries while an export or import is running. Mellon continuously polls the operation so Cloudflare does not cancel it.

Mellon uses Cloudflare's official D1 export API and D1 import API.

Ask AI about this page