@cleocode/cleo 2026.4.158 → 2026.5.0

package/dist/cli/commands/backup-inspect.js

@@ -0,0 +1,430 @@
+/**
+ * `cleo backup inspect <bundle>` — manifest-only streaming read.
+ *
+ * Reads `manifest.json` from a `.cleobundle.tar.gz` (or encrypted
+ * `.enc.cleobundle.tar.gz`) without extracting any other files and without
+ * writing anything to disk.
+ *
+ * Spec: T311-backup-portability-spec.md §5.3
+ *
+ * @task T363
+ * @epic T311
+ * @module cli/commands/backup-inspect
+ */
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import zlib from 'node:zlib';
+import { defineCommand } from 'citty';
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/** Magic string that identifies a CLEO encrypted bundle (ASCII "CLEOENC1"). */
+const CLEO_ENC_MAGIC = 'CLEOENC1';
+/** Byte offset of the format-version byte in the encrypted header. */
+const ENC_VERSION_OFFSET = 8;
+/** Supported encrypted-bundle format version. */
+const ENC_VERSION_SUPPORTED = 0x01;
+/** Total fixed overhead of the encrypted bundle header (76 bytes) + auth tag (16 bytes). */
+const ENC_MIN_LENGTH = 8 + 1 + 7 + 32 + 12 + 16;
+// ---------------------------------------------------------------------------
+// Tar parsing helpers
+// ---------------------------------------------------------------------------
+/** Size of a single POSIX tar header block in bytes. */
+const TAR_BLOCK_SIZE = 512;
+/** Byte offset of the filename field in a tar header. */
+const TAR_NAME_OFFSET = 0;
+/** Byte length of the filename field in a tar header. */
+const TAR_NAME_LENGTH = 100;
+/** Byte offset of the file size (octal ASCII) in a tar header. */
+const TAR_SIZE_OFFSET = 124;
+/** Byte length of the file size field in a tar header. */
+const TAR_SIZE_LENGTH = 12;
+/** Byte offset of the type flag in a tar header. */
+const TAR_TYPE_OFFSET = 156;
+/**
+ * Reads `manifest.json` from an already-decompressed tar buffer (i.e., the
+ * raw tar bytes after gunzip). Stops as soon as the entry is found, honoring
+ * the spec requirement that `manifest.json` MUST be the first entry.
+ *
+ * Returns `null` if the entry is not found in the buffer.
+ *
+ * @param tarBuf - Raw (uncompressed) tar bytes.
+ * @returns UTF-8 content of `manifest.json`, or `null` if not found.
+ * @task T363
+ * @epic T311
+ */
+function extractManifestFromTar(tarBuf) {
+    let offset = 0;
+    while (offset + TAR_BLOCK_SIZE <= tarBuf.length) {
+        const header = tarBuf.subarray(offset, offset + TAR_BLOCK_SIZE);
+        // Detect end-of-archive (two consecutive zero-filled 512-byte blocks).
+        if (header.every((b) => b === 0)) {
+            break;
+        }
+        // Read filename (null-terminated within the 100-byte field).
+        const rawName = header.subarray(TAR_NAME_OFFSET, TAR_NAME_OFFSET + TAR_NAME_LENGTH);
+        const nullIdx = rawName.indexOf(0);
+        const entryName = rawName
+            .subarray(0, nullIdx === -1 ? TAR_NAME_LENGTH : nullIdx)
+            .toString('utf8');
+        // Read type flag (regular file = '0' or '\0').
+        const typeFlag = String.fromCharCode(header[TAR_TYPE_OFFSET] ?? 0);
+        const isRegular = typeFlag === '0' || typeFlag === '\0';
+        // Read file size (null-terminated octal ASCII within 12-byte field).
+        const rawSize = header
+            .subarray(TAR_SIZE_OFFSET, TAR_SIZE_OFFSET + TAR_SIZE_LENGTH)
+            .toString('utf8')
+            .replace(/\0/g, '')
+            .trim();
+        const fileSize = parseInt(rawSize, 8);
+        offset += TAR_BLOCK_SIZE;
+        const normalizedName = entryName.replace(/^\.\//, '');
+        if (isRegular && normalizedName === 'manifest.json') {
+            if (offset + fileSize > tarBuf.length) {
+                return null;
+            }
+            return tarBuf.subarray(offset, offset + fileSize).toString('utf8');
+        }
+        // Advance past file data (rounded up to 512-byte boundary).
+        if (!Number.isNaN(fileSize) && fileSize > 0) {
+            offset += Math.ceil(fileSize / TAR_BLOCK_SIZE) * TAR_BLOCK_SIZE;
+        }
+    }
+    return null;
+}
+// ---------------------------------------------------------------------------
+// Integrity helpers
+// ---------------------------------------------------------------------------
+/**
+ * Verifies `manifest.json` content against its embedded `integrity.manifestHash`.
+ *
+ * Per spec §4.2 Layer 2: the hash is SHA-256 of the manifest JSON with
+ * `manifestHash` set to `""`, then hex-encoded.
+ *
+ * @param raw - Raw manifest.json UTF-8 string as extracted from the bundle.
+ * @param manifest - Parsed manifest object.
+ * @returns `true` if the hash matches; `false` if tampered or field absent.
+ * @task T363
+ * @epic T311
+ */
+function verifyManifestHash(raw, manifest) {
+    const integrity = manifest['integrity'];
+    if (!integrity || typeof integrity['manifestHash'] !== 'string') {
+        return false;
+    }
+    const expectedHash = integrity['manifestHash'];
+    // Re-parse the raw JSON, zero out manifestHash, serialize, and hash.
+    let obj;
+    try {
+        obj = JSON.parse(raw);
+    }
+    catch {
+        return false;
+    }
+    const intObj = obj['integrity'];
+    intObj['manifestHash'] = '';
+    const forHashing = JSON.stringify(obj);
+    const computed = crypto.createHash('sha256').update(forHashing).digest('hex');
+    return computed === expectedHash;
+}
+// ---------------------------------------------------------------------------
+// Formatting helpers
+// ---------------------------------------------------------------------------
+/**
+ * Formats a byte count into a human-readable string (B, KB, MB).
+ *
+ * @param bytes - Raw byte count.
+ * @returns Formatted string such as `"5.0 MB"` or `"512 B"`.
+ * @task T363
+ * @epic T311
+ */
+function fmtBytes(bytes) {
+    if (bytes >= 1024 * 1024) {
+        return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+    }
+    if (bytes >= 1024) {
+        return `${(bytes / 1024).toFixed(1)} KB`;
+    }
+    return `${bytes} B`;
+}
+/**
+ * Renders the structured inspect report to stdout as required by spec §5.3.
+ *
+ * @param bundlePath - Path to the bundle file (for display).
+ * @param bundleSize - Total byte size of the bundle file on disk.
+ * @param encrypted - Whether the bundle is encrypted.
+ * @param manifest - Parsed manifest object.
+ * @param integrityOk - Result of the manifest hash check.
+ * @task T363
+ * @epic T311
+ */
+function printInspectReport(bundlePath, bundleSize, encrypted, manifest, integrityOk) {
+    const backup = (manifest['backup'] ?? {});
+    const databases = (manifest['databases'] ?? []);
+    const jsonFiles = (manifest['json'] ?? []);
+    const manifestVersion = manifest['manifestVersion'] ?? 'unknown';
+    const scope = backup['scope'] ?? 'unknown';
+    const createdAt = backup['createdAt'] ?? 'unknown';
+    const createdBy = backup['createdBy'] ?? 'unknown';
+    const machineFingerprint = backup['machineFingerprint'] ?? 'unknown';
+    const projectName = backup['projectName'] ?? '';
+    const projectFingerprint = backup['projectFingerprint'] ?? null;
+    // Determine if source machine matches current machine (best-effort via
+    // env vars; we cannot access machine-key here without DB access).
+    const machineSame = false; // Conservative: we do not read machine-key in inspect.
+    const lines = [
+        `Bundle:         ${bundlePath} (${fmtBytes(bundleSize)})`,
+        `Format:         CLEO Backup Bundle v${manifestVersion}`,
+        `Scope:          ${scope}`,
+        `Created:        ${createdAt} by ${createdBy}`,
+        `Encrypted:      ${encrypted ? 'yes' : 'no'}`,
+        `Source machine: ${machineFingerprint} (${machineSame ? 'same' : 'different'} as this machine)`,
+    ];
+    if (projectName) {
+        lines.push(`Project:        ${projectName}${projectFingerprint ? ` (${projectFingerprint})` : ''}`);
+    }
+    if (databases.length > 0) {
+        lines.push('');
+        lines.push('Databases:');
+        for (const db of databases) {
+            const filename = db['filename'] ?? '';
+            const basename = path.basename(filename);
+            const size = db['size'] ?? 0;
+            const schemaVersion = db['schemaVersion'] ?? 'unknown';
+            const rowCounts = db['rowCounts'] ?? {};
+            const rowSummary = Object.entries(rowCounts)
+                .map(([tbl, count]) => `${tbl}: ${count}`)
+                .join(', ');
+            const rowPart = rowSummary ? `   ${rowSummary}` : '';
+            lines.push(`  ${basename.padEnd(20)} ${fmtBytes(size).padEnd(10)} schema: ${schemaVersion}${rowPart}`);
+        }
+    }
+    if (jsonFiles.length > 0) {
+        lines.push('');
+        lines.push('JSON files:');
+        for (const jf of jsonFiles) {
+            const filename = jf['filename'] ?? '';
+            const basename = path.basename(filename);
+            const size = jf['size'] ?? 0;
+            lines.push(`  ${basename.padEnd(30)} ${fmtBytes(size)}`);
+        }
+    }
+    lines.push('');
+    lines.push(`Manifest integrity: [${integrityOk ? 'OK' : 'TAMPERED'}]`);
+    console.log(lines.join('\n'));
+}
+// ---------------------------------------------------------------------------
+// Encrypted-bundle detect
+// ---------------------------------------------------------------------------
+/**
+ * Tests whether the file at `filePath` starts with the CLEO encrypted bundle
+ * magic bytes ("CLEOENC1"). Reads only 8 bytes.
+ *
+ * @param filePath - Absolute path to the bundle file.
+ * @returns `true` if the file is an encrypted CLEO bundle.
+ * @task T363
+ * @epic T311
+ */
+function detectEncryption(filePath) {
+    const header = Buffer.alloc(8);
+    const fd = fs.openSync(filePath, 'r');
+    try {
+        fs.readSync(fd, header, 0, 8, 0);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    return header.toString('utf8') === CLEO_ENC_MAGIC;
+}
+// ---------------------------------------------------------------------------
+// Main action
+// ---------------------------------------------------------------------------
+/**
+ * Action handler for `cleo backup inspect <bundle>`.
+ *
+ * Reads `manifest.json` from the bundle (decrypting if
+ * `CLEO_BACKUP_PASSPHRASE` is set), verifies the manifest hash, and prints
+ * a structured report to stdout. Never writes anything to disk.
+ *
+ * Exit codes:
+ * - `0` — success (including encrypted-only report when no passphrase given)
+ * - `4` — bundle file not found
+ * - `71` — manifest not found inside tarball
+ * - `70` — decryption failed (wrong passphrase)
+ *
+ * @param bundlePath - Path to the `.cleobundle.tar.gz` or
+ *   `.enc.cleobundle.tar.gz` file.
+ * @task T363
+ * @epic T311
+ */
+async function inspectAction(bundlePath) {
+    const resolved = path.resolve(bundlePath);
+    if (!fs.existsSync(resolved)) {
+        console.error(JSON.stringify({
+            success: false,
+            error: { code: 4, message: `Bundle not found: ${bundlePath}` },
+        }));
+        process.exitCode = 4;
+        return;
+    }
+    const encrypted = detectEncryption(resolved);
+    if (encrypted) {
+        const passphrase = process.env['CLEO_BACKUP_PASSPHRASE'];
+        if (!passphrase) {
+            // Spec §5.3 step 1: report encryption status, exit 0.
+            console.log([
+                `Bundle:    ${bundlePath}`,
+                'Encrypted: yes',
+                '',
+                'Bundle is encrypted. Set the CLEO_BACKUP_PASSPHRASE environment variable',
+                'to decrypt and inspect the manifest contents.',
+                '',
+                'Example:',
+                `  CLEO_BACKUP_PASSPHRASE=<passphrase> cleo backup inspect ${bundlePath}`,
+            ].join('\n'));
+            process.exitCode = 0;
+            return;
+        }
+        // Decrypt to a tmp file, then inspect the plain tarball.
+        const { decryptBundle } = await import('@cleocode/core/internal');
+        const encrypted_buf = fs.readFileSync(resolved);
+        // Validate header version byte before attempting decryption.
+        if (encrypted_buf.length < ENC_MIN_LENGTH) {
+            console.error(JSON.stringify({
+                success: false,
+                error: { code: 70, message: 'Encrypted bundle payload too short' },
+            }));
+            process.exitCode = 70;
+            return;
+        }
+        const versionByte = encrypted_buf[ENC_VERSION_OFFSET];
+        if (versionByte !== ENC_VERSION_SUPPORTED) {
+            console.error(JSON.stringify({
+                success: false,
+                error: {
+                    code: 70,
+                    message: `Unsupported encrypted bundle version ${versionByte ?? 'undefined'}; expected ${ENC_VERSION_SUPPORTED}`,
+                },
+            }));
+            process.exitCode = 70;
+            return;
+        }
+        let decryptedBuf;
+        try {
+            decryptedBuf = decryptBundle(encrypted_buf, passphrase);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error(JSON.stringify({
+                success: false,
+                error: { code: 70, message: `Decryption failed: ${msg}` },
+            }));
+            process.exitCode = 70;
+            return;
+        }
+        // Write decrypted tarball to a tmpfile, inspect it, then clean up.
+        const tmpPath = path.join(os.tmpdir(), `cleo-inspect-${process.pid}-${Date.now()}.tar.gz`);
+        try {
+            fs.writeFileSync(tmpPath, decryptedBuf);
+            await inspectTarball(tmpPath, resolved, encrypted);
+        }
+        finally {
+            try {
+                fs.unlinkSync(tmpPath);
+            }
+            catch {
+                // ignore cleanup errors
+            }
+        }
+        return;
+    }
+    // Unencrypted bundle — inspect directly.
+    await inspectTarball(resolved, resolved, false);
+}
+/**
+ * Reads `manifest.json` from a (possibly decrypted) tar.gz file and prints
+ * the formatted inspect report.
+ *
+ * @param tarPath - Absolute path to the `.tar.gz` file to read.
+ * @param displayPath - Path shown in the report (original bundle path).
+ * @param encrypted - Whether the original bundle was encrypted.
+ * @task T363
+ * @epic T311
+ */
+async function inspectTarball(tarPath, displayPath, encrypted) {
+    // Decompress the gz stream into a Buffer, then parse the tar manually.
+    const compressedBuf = fs.readFileSync(tarPath);
+    let tarBuf;
+    try {
+        tarBuf = zlib.gunzipSync(compressedBuf);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(JSON.stringify({
+            success: false,
+            error: { code: 71, message: `Failed to decompress bundle: ${msg}` },
+        }));
+        process.exitCode = 71;
+        return;
+    }
+    const manifestContent = extractManifestFromTar(tarBuf);
+    if (!manifestContent) {
+        console.error(JSON.stringify({
+            success: false,
+            error: { code: 74, message: 'manifest.json not found in bundle' },
+        }));
+        process.exitCode = 74;
+        return;
+    }
+    let manifest;
+    try {
+        manifest = JSON.parse(manifestContent);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(JSON.stringify({
+            success: false,
+            error: { code: 71, message: `Failed to parse manifest.json: ${msg}` },
+        }));
+        process.exitCode = 71;
+        return;
+    }
+    const integrityOk = verifyManifestHash(manifestContent, manifest);
+    const stat = fs.statSync(displayPath);
+    printInspectReport(displayPath, stat.size, encrypted, manifest, integrityOk);
+    process.exitCode = 0;
+}
+// ---------------------------------------------------------------------------
+// Export
+// ---------------------------------------------------------------------------
+/**
+ * `cleo backup inspect <bundle>` subcommand definition for citty.
+ *
+ * Stream-reads `manifest.json` from a `.cleobundle.tar.gz` (or encrypted
+ * `.enc.cleobundle.tar.gz`) and prints a structured report without extracting
+ * or modifying anything on disk.
+ *
+ * Imported by `backup.ts` and mounted under `subCommands.inspect`.
+ *
+ * @task T363
+ * @epic T311
+ */
+export const backupInspectSubCommand = defineCommand({
+    meta: {
+        name: 'inspect',
+        description: 'Show bundle manifest without extracting or modifying anything',
+    },
+    args: {
+        bundle: {
+            type: 'positional',
+            description: 'Path to the .cleobundle.tar.gz file',
+            required: true,
+        },
+    },
+    async run({ args }) {
+        await inspectAction(args.bundle);
+    },
+});
+//# sourceMappingURL=backup-inspect.js.map

package/dist/cli/commands/backup-inspect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-inspect.js","sourceRoot":"","sources":["../../../src/cli/commands/backup-inspect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAEtC,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,+EAA+E;AAC/E,MAAM,cAAc,GAAG,UAAU,CAAC;AAElC,sEAAsE;AACtE,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B,iDAAiD;AACjD,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAEnC,4FAA4F;AAC5F,MAAM,cAAc,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEhD,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,wDAAwD;AACxD,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,yDAAyD;AACzD,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B,yDAAyD;AACzD,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B,kEAAkE;AAClE,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B,0DAA0D;AAC1D,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,oDAAoD;AACpD,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B;;;;;;;;;;;GAWG;AACH,SAAS,sBAAsB,CAAC,MAAc;IAC5C,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,OAAO,MAAM,GAAG,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CAAC,CAAC;QAEhE,uEAAuE;QACvE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjC,MAAM;QACR,CAAC;QAED,6DAA6D;QAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,eAAe,GAAG,eAAe,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,OAAO;aACtB,QAAQ,CAAC,CAAC,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC;aACvD,QAAQ,CAAC,MAAM,CAAC,CAAC;QAEpB,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,IAAI,CAAC;QAExD,qEAAqE;QACrE,MAAM,OAAO,GAAG,MAAM;aACnB,QAAQ,CAAC,eAAe,EAAE,eAAe,GAAG,eAAe,CAAC;aAC5D,QAAQ,CAAC,MAAM,CAAC;aAChB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;aAClB,IAAI,EAAE,CAAC;QACV,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAEtC,MAAM,IAAI,cAAc,CAAC;QAEzB,MAAM,cAAc,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAEtD,IAAI,SAAS,IAAI,cAAc,KAAK,eAAe,EAAE,CAAC;YACpD,IAAI,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrE,CAAC;QAED,4DAA4D;QAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC,GAAG,cAAc,CAAC;QAClE,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,SAAS,kBAAkB,CAAC,GAAW,EAAE,QAAiC;IACxE,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAwC,CAAC;IAC/E,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,CAAC,cAAc,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,YAAY,GAAG,SAAS,CAAC,cAAc,CAAW,CAAC;IAEzD,qEAAqE;IACrE,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAA4B,CAAC;IAC3D,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;IAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE9E,OAAO,QAAQ,KAAK,YAAY,CAAC;AACnC,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,KAAK,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;QACzB,OAAO,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IACpD,CAAC;IACD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,OAAO,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,KAAK,IAAI,CAAC;AACtB,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,kBAAkB,CACzB,UAAkB,EAClB,UAAkB,EAClB,SAAkB,EAClB,QAAiC,EACjC,WAAoB;IAEpB,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;IACrE,MAAM,SAAS,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAmC,CAAC;IAClF,MAAM,SAAS,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAmC,CAAC;IAC7E,MAAM,eAAe,GAAI,QAAQ,CAAC,iBAAiB,CAAwB,IAAI,SAAS,CAAC;IACzF,MAAM,KAAK,GAAI,MAAM,CAAC,OAAO,CAAwB,IAAI,SAAS,CAAC;IACnE,MAAM,SAAS,GAAI,MAAM,CAAC,WAAW,CAAwB,IAAI,SAAS,CAAC;IAC3E,MAAM,SAAS,GAAI,MAAM,CAAC,WAAW,CAAwB,IAAI,SAAS,CAAC;IAC3E,MAAM,kBAAkB,GAAI,MAAM,CAAC,oBAAoB,CAAwB,IAAI,SAAS,CAAC;IAC7F,MAAM,WAAW,GAAI,MAAM,CAAC,aAAa,CAAwB,IAAI,EAAE,CAAC;IACxE,MAAM,kBAAkB,GAAI,MAAM,CAAC,oBAAoB,CAA+B,IAAI,IAAI,CAAC;IAE/F,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,uDAAuD;IAElF,MAAM,KAAK,GAAa;QACtB,mBAAmB,UAAU,KAAK,QAAQ,CAAC,UAAU,CAAC,GAAG;QACzD,uCAAuC,eAAe,EAAE;QACxD,mBAAmB,KAAK,EAAE;QAC1B,mBAAmB,SAAS,OAAO,SAAS,EAAE;QAC9C,mBAAmB,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QAC7C,mBAAmB,kBAAkB,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,mBAAmB;KAChG,CAAC;IAEF,IAAI,WAAW,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CACR,mBAAmB,WAAW,GAAG,kBAAkB,CAAC,CAAC,CAAC,KAAK,kBAAkB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACxF,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzB,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAI,EAAE,CAAC,UAAU,CAAwB,IAAI,EAAE,CAAC;YAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACzC,MAAM,IAAI,GAAI,EAAE,CAAC,MAAM,CAAwB,IAAI,CAAC,CAAC;YACrD,MAAM,aAAa,GAAI,EAAE,CAAC,eAAe,CAAwB,IAAI,SAAS,CAAC;YAC/E,MAAM,SAAS,GAAI,EAAE,CAAC,WAAW,CAAwC,IAAI,EAAE,CAAC;YAChF,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;iBACzC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,KAAK,EAAE,CAAC;iBACzC,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,KAAK,CAAC,IAAI,CACR,KAAK,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,aAAa,GAAG,OAAO,EAAE,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1B,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAI,EAAE,CAAC,UAAU,CAAwB,IAAI,EAAE,CAAC;YAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACzC,MAAM,IAAI,GAAI,EAAE,CAAC,MAAM,CAAwB,IAAI,CAAC,CAAC;YACrD,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,wBAAwB,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC;IAEvE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC;QACH,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACnC,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,cAAc,CAAC;AACpD,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,aAAa,CAAC,UAAkB;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAE1C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;YACb,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,qBAAqB,UAAU,EAAE,EAAE;SAC/D,CAAC,CACH,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAE7C,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,sDAAsD;YACtD,OAAO,CAAC,GAAG,CACT;gBACE,cAAc,UAAU,EAAE;gBAC1B,gBAAgB;gBAChB,EAAE;gBACF,0EAA0E;gBAC1E,+CAA+C;gBAC/C,EAAE;gBACF,UAAU;gBACV,6DAA6D,UAAU,EAAE;aAC1E,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,yDAAyD;QACzD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAClE,MAAM,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAEhD,6DAA6D;QAC7D,IAAI,aAAa,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;YAC1C,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;gBACb,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE;aACnE,CAAC,CACH,CAAC;YACF,OAAO,CAAC,QAAQ,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,WAAW,GAAG,aAAa,CAAC,kBAAkB,CAAC,CAAC;QACtD,IAAI,WAAW,KAAK,qBAAqB,EAAE,CAAC;YAC1C,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;gBACb,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,EAAE;oBACR,OAAO,EAAE,wCAAwC,WAAW,IAAI,WAAW,cAAc,qBAAqB,EAAE;iBACjH;aACF,CAAC,CACH,CAAC;YACF,OAAO,CAAC,QAAQ,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC;YACH,YAAY,GAAG,aAAa,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;gBACb,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,sBAAsB,GAAG,EAAE,EAAE;aAC1D,CAAC,CACH,CAAC;YACF,OAAO,CAAC,QAAQ,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,mEAAmE;QACnE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC3F,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YACxC,MAAM,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QACrD,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;QACH,CAAC;QACD,OAAO;IACT,CAAC;IAED,yCAAyC;IACzC,MAAM,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,cAAc,CAC3B,OAAe,EACf,WAAmB,EACnB,SAAkB;IAElB,uEAAuE;IACvE,MAAM,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;YACb,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,gCAAgC,GAAG,EAAE,EAAE;SACpE,CAAC,CACH,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IAED,MAAM,eAAe,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;YACb,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,mCAAmC,EAAE;SAClE,CAAC,CACH,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IAED,IAAI,QAAiC,CAAC;IACtC,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAA4B,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;YACb,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,kCAAkC,GAAG,EAAE,EAAE;SACtE,CAAC,CACH,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,kBAAkB,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IAElE,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtC,kBAAkB,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC7E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,aAAa,CAAC;IACnD,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,+DAA+D;KAC7E;IACD,IAAI,EAAE;QACJ,MAAM,EAAE;YACN,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,qCAAqC;YAClD,QAAQ,EAAE,IAAI;SACf;KACF;IACD,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;QAChB,MAAM,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;CACF,CAAC,CAAC"}

package/dist/cli/commands/backup.d.ts

@@ -0,0 +1,23 @@
+/**
+ * CLI backup command — add, list, export, import, and inspect backups.
+ *
+ * @task T4454
+ * @task T4903
+ * @task T306 — added --global flag to backup add; --scope filter to backup list (epic T299)
+ * @task T359 — added `cleo backup export` subcommand (epic T311)
+ * @task T361 — added `cleo backup import` subcommand with A/B restore and conflict report (epic T311)
+ * @task T363 — added `backup inspect` subcommand (epic T311)
+ */
+/**
+ * Root backup command group — add, list, export, import, and inspect backups.
+ *
+ * The `create` key duplicates `add` to preserve backward-compatible alias behaviour.
+ * The `bak` key provides the top-level alias.
+ *
+ * Default action (no subcommand): snapshot all CLEO data files.
+ *
+ * @task T4454
+ * @task T4903
+ */
+export declare const backupCommand: import("citty").CommandDef<import("citty").ArgsDef>;
+//# sourceMappingURL=backup.d.ts.map

package/dist/cli/commands/backup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/backup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AA2eH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,qDAoBxB,CAAC"}