@omnitron-dev/omnitron 0.1.3 → 0.3.0

package/dist/commands/audit.d.ts

@@ -0,0 +1,65 @@
+/**
+ * `omnitron audit` — who changed this control plane, and what they changed.
+ *
+ * The table has existed since the first migration and nothing wrote to it,
+ * so there was nothing to read and no command to read it with.
+ */
+import { type AuditQuery } from '../services/audit.service.js';
+export interface AuditListOptions {
+    /**
+     * As typed, and checked here. The CLI used to hand over `parseInt`'s
+     * answer, which is NaN for `abc` — sent on to Postgres as `LIMIT NaN` — and
+     * 0 for `0`, which the service's clamp turned into one row.
+     */
+    limit?: string | number;
+    action?: string;
+    resource?: string;
+    /** A kind of actor — `user`, `service`, `system` — or an actor's id. */
+    actor?: string;
+    /** Only entries older than this ISO time. */
+    before?: string;
+}
+/**
+ * A page size as a person typed it, or a refusal that says what one is.
+ *
+ * Whole digits only: `parseInt` also read `5abc` as 5 and `1e3` as 1. Above
+ * the page cap is refused rather than clamped — the service answers at most
+ * `MAX_AUDIT_PAGE` rows, and handing back fewer than were asked without a
+ * word is how `-n 0` came to mean one row.
+ */
+export declare function parseAuditLimit(raw: string | number | undefined): number;
+/**
+ * `--before`, as the ISO instant the service takes.
+ *
+ * A time with no zone is refused rather than guessed: JavaScript reads
+ * `2026-09-22T21:20:37` in the zone of whoever typed it, and the WHEN column
+ * it was copied from is UTC — so the page would start hours away from the
+ * row it was taken from, and look right. A bare date is UTC by the same rule,
+ * and is taken.
+ */
+export declare function parseAuditBefore(raw: string): string;
+/**
+ * The query the options ask for.
+ *
+ * `--actor` names a KIND of actor or an actor's id, and this is what tells
+ * them apart. It was always an id, while the ACTOR column prints the kind for
+ * every row that has none — so `--actor system`, typed from the column, was
+ * compared with `actorId` on the 171 rows whose id is null, and found none.
+ */
+export declare function auditQueryFrom(options: AuditListOptions): AuditQuery & {
+    limit: number;
+};
+/**
+ * A row's time as the table prints it: UTC to the second, and so the same
+ * width on every row.
+ *
+ * It was «3m ago» for a recent row and `toLocaleString()` for an older one —
+ * two formats in one column, the second in this machine's zone and as wide as
+ * its locale made it. And kit sizes a column from its FIRST 100 rows, so with
+ * `-n 200` the older rows' dates were cut to `9/22...` — measured on the
+ * master: 42 cells in 39 of 178 rows, WHEN in 37 and ACTION (`node.bundle...`)
+ * in 5.
+ */
+export declare function formatWhen(iso: string): string;
+export declare function auditListCommand(options?: AuditListOptions): Promise<void>;
+//# sourceMappingURL=audit.d.ts.map

package/dist/commands/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/commands/audit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,EAA+B,KAAK,UAAU,EAAiB,MAAM,8BAA8B,CAAC;AAI3G,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAQD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAUxE;AAOD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAUpD;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,gBAAgB,GAAG,UAAU,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAcxF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG9C;AAwGD,wBAAsB,gBAAgB,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqDpF"}

package/dist/commands/audit.js

@@ -0,0 +1,233 @@
+/**
+ * `omnitron audit` — who changed this control plane, and what they changed.
+ *
+ * The table has existed since the first migration and nothing wrote to it,
+ * so there was nothing to read and no command to read it with.
+ */
+import { log, table, prism } from '@xec-sh/kit';
+import { createDaemonClient } from '../daemon/daemon-client.js';
+import { ACTOR_TYPES, MAX_AUDIT_PAGE } from '../services/audit.service.js';
+import { outcomeOf, outcomeReason } from '../shared/audit-outcome.js';
+import { emitError, emitJson } from './output.js';
+/** What `-n` means when it is not given; the CLI's own default says the same. */
+const DEFAULT_LIMIT = 50;
+/** Input this command refuses before it asks the daemon anything. */
+class AuditUsageError extends Error {
+}
+/**
+ * A page size as a person typed it, or a refusal that says what one is.
+ *
+ * Whole digits only: `parseInt` also read `5abc` as 5 and `1e3` as 1. Above
+ * the page cap is refused rather than clamped — the service answers at most
+ * `MAX_AUDIT_PAGE` rows, and handing back fewer than were asked without a
+ * word is how `-n 0` came to mean one row.
+ */
+export function parseAuditLimit(raw) {
+    if (raw === undefined)
+        return DEFAULT_LIMIT;
+    const text = String(raw).trim();
+    const n = /^\d+$/.test(text) ? Number(text) : Number.NaN;
+    if (!(n >= 1 && n <= MAX_AUDIT_PAGE)) {
+        throw new AuditUsageError(`-n takes a whole number of entries, 1 to ${MAX_AUDIT_PAGE} (the most one page holds; --before pages further) — not "${String(raw)}".`);
+    }
+    return n;
+}
+/** A clock time anywhere in the text. */
+const HAS_TIME = /\d{1,2}:\d{2}/;
+/** A zone at the end: `Z`, `+02`, `+02:00`, `-0500`. */
+const HAS_ZONE = /(?:Z|[+-]\d{2}(?::?\d{2})?)$/i;
+/**
+ * `--before`, as the ISO instant the service takes.
+ *
+ * A time with no zone is refused rather than guessed: JavaScript reads
+ * `2026-09-22T21:20:37` in the zone of whoever typed it, and the WHEN column
+ * it was copied from is UTC — so the page would start hours away from the
+ * row it was taken from, and look right. A bare date is UTC by the same rule,
+ * and is taken.
+ */
+export function parseAuditBefore(raw) {
+    const text = raw.trim();
+    if (HAS_TIME.test(text) && !HAS_ZONE.test(text)) {
+        throw new AuditUsageError(`--before needs a zone — "${text}Z" if you mean UTC, which is what the WHEN column prints.`);
+    }
+    const at = new Date(text);
+    if (Number.isNaN(at.getTime())) {
+        throw new AuditUsageError(`--before takes an ISO time such as 2026-09-22T21:20:37Z — not "${raw}".`);
+    }
+    return at.toISOString();
+}
+/**
+ * The query the options ask for.
+ *
+ * `--actor` names a KIND of actor or an actor's id, and this is what tells
+ * them apart. It was always an id, while the ACTOR column prints the kind for
+ * every row that has none — so `--actor system`, typed from the column, was
+ * compared with `actorId` on the 171 rows whose id is null, and found none.
+ */
+export function auditQueryFrom(options) {
+    const limit = parseAuditLimit(options.limit);
+    const actor = options.actor?.trim();
+    return {
+        limit,
+        ...(options.action ? { action: options.action } : {}),
+        ...(options.resource ? { resourceType: options.resource } : {}),
+        ...(actor
+            ? ACTOR_TYPES.includes(actor)
+                ? { actorType: actor }
+                : { actorId: actor }
+            : {}),
+        ...(options.before ? { before: parseAuditBefore(options.before) } : {}),
+    };
+}
+/**
+ * A row's time as the table prints it: UTC to the second, and so the same
+ * width on every row.
+ *
+ * It was «3m ago» for a recent row and `toLocaleString()` for an older one —
+ * two formats in one column, the second in this machine's zone and as wide as
+ * its locale made it. And kit sizes a column from its FIRST 100 rows, so with
+ * `-n 200` the older rows' dates were cut to `9/22...` — measured on the
+ * master: 42 cells in 39 of 178 rows, WHEN in 37 and ACTION (`node.bundle...`)
+ * in 5.
+ */
+export function formatWhen(iso) {
+    const at = new Date(iso);
+    return Number.isNaN(at.getTime()) ? iso : `${at.toISOString().slice(0, 19)}Z`;
+}
+/** A `details` value the table prints, or `-`. */
+function detail(row, key) {
+    const value = row.details?.[key];
+    // `[object]` is what `scrubDetails` left of a nested value in older rows —
+    // not a release id, and not to be printed as one.
+    return typeof value === 'string' && value !== '' && value !== '[object]' ? value : '-';
+}
+const plain = (text) => ({ text, shown: text });
+const COLUMNS = [
+    { key: 'when', header: 'WHEN' },
+    { key: 'action', header: 'ACTION' },
+    { key: 'resource', header: 'RESOURCE' },
+    { key: 'actor', header: 'ACTOR' },
+    { key: 'source', header: 'SOURCE' },
+    { key: 'release', header: 'RELEASE' },
+    { key: 'outcome', header: 'OUTCOME' },
+    { key: 'from', header: 'FROM' },
+];
+function cellsOf(row) {
+    const outcome = outcomeOf(row);
+    return {
+        when: plain(formatWhen(row.createdAt)),
+        action: plain(row.action),
+        resource: plain(row.resourceId ? `${row.resourceType}:${row.resourceId}` : row.resourceType),
+        // The id when there is one — `omnitron-local` for the CLI, an account for
+        // the console — and otherwise the kind, which `--actor` also takes.
+        actor: row.actorId ? plain(row.actorId) : { text: row.actorType, shown: prism.dim(row.actorType) },
+        // `boot` and `auto-resume` are the daemon's own starts; `operator` is a
+        // person's. Recorded since the service began writing the row, and never
+        // printed until now.
+        source: plain(detail(row, 'source')),
+        release: plain(detail(row, 'release')),
+        outcome: outcome === 'failed'
+            ? { text: outcome, shown: prism.red(outcome) }
+            : outcome === 'ok'
+                ? { text: outcome, shown: prism.green(outcome) }
+                : outcome === 'partial'
+                    ? { text: outcome, shown: prism.yellow(outcome) }
+                    : { text: '-', shown: prism.dim('-') },
+        from: plain(row.ipAddress ?? '-'),
+    };
+}
+/**
+ * The table, with every column as wide as its widest cell in the WHOLE page.
+ *
+ * Left to itself, kit measures only the first 100 rows (`maxSampleSize` in
+ * its `column-width.ts`) and truncates the rest to fit; a column width stated
+ * here is used as given.
+ */
+function renderTable(rows) {
+    const cells = rows.map(cellsOf);
+    const width = (key, header) => Math.max(header.length, ...cells.map((c) => [...c[key].text].length));
+    table({
+        width: 'auto',
+        data: cells.map((c) => Object.fromEntries(COLUMNS.map(({ key }) => [key, c[key].shown]))),
+        columns: COLUMNS.map(({ key, header }) => ({ key, header, width: width(key, header) })),
+    });
+}
+/** Why each failed row failed, under the table — a column would be as wide as the longest reason. */
+/**
+ * The rows that did not simply succeed, with the reason each gives —
+ * read by `outcomeReason`, the reading the console uses, so both say the
+ * same words. A `partial` row was coloured and then said nothing: which apps
+ * did not come up sat in `notUp`, printed only under `--json`.
+ */
+function renderFailures(rows) {
+    const notOk = rows.filter((r) => {
+        const outcome = outcomeOf(r);
+        return outcome === 'failed' || outcome === 'partial';
+    });
+    if (notOk.length === 0)
+        return;
+    const failed = notOk.filter((r) => outcomeOf(r) === 'failed').length;
+    const partial = notOk.length - failed;
+    log.warn([
+        [failed ? `${failed} failed` : null, partial ? `${partial} partial` : null].filter(Boolean).join(' / ') + ':',
+        ...notOk.map((r) => {
+            const why = outcomeReason(r)?.text ?? '(no reason recorded)';
+            const what = r.resourceId ? `${r.resourceType}:${r.resourceId}` : r.resourceType;
+            return `  ${formatWhen(r.createdAt)}  ${what}  ${outcomeOf(r)}  ${why}`;
+        }),
+    ].join('\n'));
+}
+export async function auditListCommand(options = {}) {
+    // Before a connection is opened: a typo in a flag is answered here, in the
+    // words of the flag, and not by the database.
+    let query;
+    try {
+        query = auditQueryFrom(options);
+    }
+    catch (err) {
+        if (!(err instanceof AuditUsageError))
+            throw err;
+        emitError(err.message);
+        process.exitCode = 1;
+        return;
+    }
+    const client = createDaemonClient();
+    try {
+        const svc = await client.service('OmnitronAudit');
+        const { available } = await svc.available();
+        if (!available) {
+            // A daemon with no omnitron database records nothing, and an empty
+            // list would read as "nothing has happened".
+            if (emitJson({ available: false, entries: [] }))
+                return;
+            log.warn('This daemon has no audit trail — it has no omnitron database to record into.');
+            return;
+        }
+        const rows = await svc.list(query);
+        // `--json` was a global flag this command ignored, and the guard in
+        // `output.ts` said so with exit 2. The rows as the service returned them,
+        // plus the outcome the table prints, so a script filters on the same
+        // answer a person reads.
+        if (emitJson({ available: true, entries: rows.map((r) => ({ ...r, outcome: outcomeOf(r) })) }))
+            return;
+        if (rows.length === 0) {
+            log.info('Nothing recorded yet for that query.');
+            return;
+        }
+        renderTable(rows);
+        renderFailures(rows);
+        if (rows.length === query.limit) {
+            // The exact instant, not the WHEN column's second: two rows can share a
+            // second, and paging from the rounded one would skip the other.
+            log.info(`${rows.length} shown, newest first — older ones: --before ${rows[rows.length - 1].createdAt}`);
+        }
+    }
+    catch (err) {
+        emitError(`Failed: ${err.message}`);
+        process.exitCode = 1;
+    }
+    finally {
+        await client.disconnect();
+    }
+}
+//# sourceMappingURL=audit.js.map

package/dist/commands/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/commands/audit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEhD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,OAAO,EAAE,WAAW,EAAE,cAAc,EAAkC,MAAM,8BAA8B,CAAC;AAC3G,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAiBlD,iFAAiF;AACjF,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB,qEAAqE;AACrE,MAAM,eAAgB,SAAQ,KAAK;CAAG;AAEtC;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,GAAgC;IAC9D,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IACzD,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,eAAe,CACvB,4CAA4C,cAAc,6DAA6D,MAAM,CAAC,GAAG,CAAC,IAAI,CACvI,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,yCAAyC;AACzC,MAAM,QAAQ,GAAG,eAAe,CAAC;AACjC,wDAAwD;AACxD,MAAM,QAAQ,GAAG,+BAA+B,CAAC;AAEjD;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,eAAe,CAAC,4BAA4B,IAAI,2DAA2D,CAAC,CAAC;IACzH,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,eAAe,CAAC,kEAAkE,GAAG,IAAI,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,OAAyB;IACtD,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;IACpC,OAAO;QACL,KAAK;QACL,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,KAAK;YACP,CAAC,CAAE,WAAiC,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAClD,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE;gBACtB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;YACtB,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;AAChF,CAAC;AAED,kDAAkD;AAClD,SAAS,MAAM,CAAC,GAAa,EAAE,GAAW;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACjC,2EAA2E;IAC3E,kDAAkD;IAClD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;AACzF,CAAC;AASD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAQ,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAE9D,MAAM,OAAO,GAAG;IACd,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;IAC/B,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;IACnC,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE;IACvC,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;IACjC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;IACnC,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE;IACrC,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE;IACrC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;CACvB,CAAC;AAIX,SAAS,OAAO,CAAC,GAAa;IAC5B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;QACzB,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;QAC5F,0EAA0E;QAC1E,oEAAoE;QACpE,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;QAClG,wEAAwE;QACxE,wEAAwE;QACxE,qBAAqB;QACrB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACpC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACtC,OAAO,EACL,OAAO,KAAK,QAAQ;YAClB,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;YAC9C,CAAC,CAAC,OAAO,KAAK,IAAI;gBAChB,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;gBAChD,CAAC,CAAC,OAAO,KAAK,SAAS;oBACrB,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;oBACjD,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;QAC9C,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,IAAgB;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,GAAc,EAAE,MAAc,EAAU,EAAE,CACvD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAExE,KAAK,CAAC;QACJ,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzF,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;KACxF,CAAC,CAAC;AACL,CAAC;AAED,qGAAqG;AACrG;;;;;GAKG;AACH,SAAS,cAAc,CAAC,IAAgB;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9B,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC7B,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,SAAS,CAAC;IACvD,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IACrE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;IACtC,GAAG,CAAC,IAAI,CACN;QACE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG;QAC7G,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACjB,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,sBAAsB,CAAC;YAC7D,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YACjF,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QAC1E,CAAC,CAAC;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAO,GAAqB,EAAE;IACnE,2EAA2E;IAC3E,8CAA8C;IAC9C,IAAI,KAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,eAAe,CAAC;YAAE,MAAM,GAAG,CAAC;QACjD,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAwB,eAAe,CAAC,CAAC;QAEzE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC;QAC5C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,mEAAmE;YACnE,6CAA6C;YAC7C,IAAI,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;gBAAE,OAAO;YACxD,GAAG,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAEnC,oEAAoE;QACpE,0EAA0E;QAC1E,qEAAqE;QACrE,yBAAyB;QACzB,IAAI,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAAE,OAAO;QAEvG,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QAED,WAAW,CAAC,IAAI,CAAC,CAAC;QAClB,cAAc,CAAC,IAAI,CAAC,CAAC;QAErB,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAChC,wEAAwE;YACxE,gEAAgE;YAChE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,+CAA+C,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,SAAS,CAAC,WAAY,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC"}

package/dist/commands/backup.d.ts

@@ -5,5 +5,9 @@
  */
 export declare function backupCreateCommand(database?: string): Promise<void>;
 export declare function backupListCommand(): Promise<void>;
+export declare function backupFullCommand(): Promise<void>;
+export declare function backupScheduleCommand(target: string, cron: string): Promise<void>;
+export declare function backupSchedulesCommand(): Promise<void>;
+export declare function backupUnscheduleCommand(target: string): Promise<void>;
 export declare function backupRestoreCommand(id: string): Promise<void>;
 //# sourceMappingURL=backup.d.ts.map

package/dist/commands/backup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../../src/commands/backup.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA2BH,wBAAsB,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAY1E;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CA2BvD;AAED,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQpE"}
+{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../../src/commands/backup.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA0EH,wBAAsB,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB1E;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CA+CvD;AAyDD,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAYvD;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQvF;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CA8C5D;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO3E;AAED,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBpE"}

package/dist/commands/backup.js

@@ -4,37 +4,92 @@
  * omnitron backup restore <id> — Restore from backup
  */
 import { log } from '@xec-sh/kit';
+import { formatBackupSize, formatUtc, resolveBackupId, uniqueIdPrefixLength, } from '../services/backup-pipeline.js';
 import { createDaemonClient } from '../daemon/daemon-client.js';
 async function invokeRpc(method, data) {
     const client = createDaemonClient();
     try {
-        await client.ensureConnected();
-        const netron = client.netron;
-        const peers = netron.getPeers ? netron.getPeers() : [];
-        for (const peer of peers) {
-            try {
-                const svc = await peer.queryInterface('OmnitronBackups');
-                if (svc && typeof svc[method] === 'function') {
-                    return data ? await svc[method](data) : await svc[method]();
-                }
-            }
-            catch {
-                continue;
-            }
+        if (!(await client.isReachable())) {
+            throw new Error('omnitron daemon is not running (start it with `omnitron up`)');
         }
-        throw new Error('OmnitronBackups service not available');
+        const svc = await client.service('OmnitronBackups');
+        return data !== undefined ? await svc[method](data) : await svc[method]();
     }
     finally {
         await client.disconnect();
     }
 }
+/**
+ * Call a method an older daemon does not serve, and learn that without
+ * failing. Netron refuses an unknown method by name ("Unknown member: …");
+ * that one refusal becomes `undefined`, and the command says what it cannot
+ * show. Any other error is still an error.
+ */
+async function invokeOptionalRpc(method, data) {
+    try {
+        return await invokeRpc(method, data);
+    }
+    catch (err) {
+        if (/Unknown member: '[^']+' is not defined/.test(err.message))
+            return undefined;
+        throw err;
+    }
+}
+/** The status the daemon reports beside the index rows, or why there is none. */
+async function readBackupStatus() {
+    try {
+        const status = await invokeOptionalRpc('getBackupStatus');
+        return status ? { status } : { unavailable: 'this daemon does not report it (no getBackupStatus)' };
+    }
+    catch (err) {
+        return { unavailable: err.message };
+    }
+}
+/** A span as an operator reads it: `3 d 15 h`, `5 h 43 min`, `12 min`, `40 s`. */
+function formatAge(ms) {
+    const s = Math.max(0, Math.round(ms / 1000));
+    if (s < 60)
+        return `${s} s`;
+    const min = Math.floor(s / 60);
+    if (min < 60)
+        return `${min} min`;
+    const h = Math.floor(min / 60);
+    if (h < 24)
+        return `${h} h ${min % 60} min`;
+    return `${Math.floor(h / 24)} d ${h % 24} h`;
+}
+/**
+ * One recorded pass, in UTC, with the reason of everything that failed.
+ * `EMPTY` is spelled out: a pass that found nothing did not succeed.
+ */
+function describePass(pass) {
+    if (!pass)
+        return 'none recorded yet';
+    const when = formatUtc(pass.startedAt);
+    if (pass.outcome === 'empty')
+        return `${when}  EMPTY — nothing was found to back up`;
+    const took = Math.max(0, Math.round((Date.parse(pass.finishedAt) - Date.parse(pass.startedAt)) / 1000));
+    const head = `${when}  ${String(pass.outcome).toUpperCase()} — ${pass.ok} of ${pass.total} in ${took} s`;
+    const failures = pass.failures ?? [];
+    return failures.length === 0 ? head : `${head}; failed: ${failures.map((f) => `${f.target} (${f.error})`).join('; ')}`;
+}
 export async function backupCreateCommand(database) {
-    const db = database || 'omnitron';
     try {
-        log.info(`Creating backup for '${db}'...`);
-        const backup = await invokeRpc('createBackup', { database: db, compress: true });
-        const sizeMB = (backup.size / (1024 * 1024)).toFixed(2);
-        log.success(`Backup created: ${backup.filename} (${sizeMB} MB)`);
+        // No target ⇒ back up every database of every running stack (the safe
+        // default for data protection). A specific name backs up just that DB.
+        if (!database) {
+            log.info('Creating backups for all running-stack databases...');
+            const results = await invokeRpc('createAllBackups');
+            if (!results || results.length === 0) {
+                log.warn('No databases found to back up — is a stack running?');
+                return;
+            }
+            printPassResults(results, (r) => qualifiedName(r, r.database), 'database(s)');
+            return;
+        }
+        log.info(`Creating backup for '${database}'...`);
+        const backup = await invokeRpc('createBackup', { database, compress: true });
+        log.success(`Backup created: ${backup.filename} (${formatBackupSize(backup.size)})`);
         log.info(`  ID: ${backup.id}`);
         log.info(`  Database: ${backup.database}`);
     }
@@ -50,19 +105,181 @@ export async function backupListCommand() {
             return;
         }
         log.info(`Found ${backups.length} backup(s):\n`);
-        const header = ['Database', 'Filename', 'Size', 'Created'].map((h) => h.padEnd(25)).join('');
-        log.info(header);
-        log.info('-'.repeat(100));
-        for (const b of backups) {
-            const sizeMB = (b.size / (1024 * 1024)).toFixed(2) + ' MB';
-            const created = new Date(b.createdAt).toLocaleString();
-            log.info([
-                b.database.padEnd(25),
-                b.filename.slice(0, 24).padEnd(25),
-                sizeMB.padEnd(25),
-                created.padEnd(25),
-            ].join(''));
+        // The id is the first column because it is what `backup restore` takes —
+        // the list used to print everything except it. A prefix, as long as it
+        // needs to be to stay unique and never shorter than `backup create`'s
+        // eight characters, so the same token works from either.
+        const idLength = uniqueIdPrefixLength(backups.map((b) => String(b.id)));
+        const rows = backups.map((b) => [
+            String(b.id).slice(0, idLength),
+            // Whose database this is: two stacks can both have a `main`.
+            stackLabel(b),
+            b.database,
+            formatBackupSize(b.size),
+            // UTC, as the filenames are — see `formatUtc`.
+            formatUtc(b.createdAt),
+            b.filename,
+        ]);
+        for (const line of renderTable(['ID', 'Stack', 'Database', 'Size', 'Created (UTC)', 'File'], rows))
+            log.info(line);
+        if (backups.some((b) => stackLabel(b) === '—')) {
+            log.info('(Stack — : taken before backups recorded their stack)');
+        }
+        log.info('\nRestore one with: omnitron backup restore <ID>');
+        // A pass that lost a database leaves a listing that looks complete — the
+        // missing row is the only trace. Say so here, where people look.
+        const { status, unavailable } = await readBackupStatus();
+        if (!status) {
+            log.warn(`Which stacks are backed up, and how each schedule last ran: unknown — ${unavailable}`);
+            return;
         }
+        for (const s of status.schedules ?? []) {
+            if (s.lastPass && s.lastPass.outcome !== 'ok') {
+                log.warn(`Last '${s.target}' pass: ${describePass(s.lastPass)}`);
+            }
+        }
+        reportCoverage(status.stacks);
+    }
+    catch (err) {
+        log.error(`Failed: ${err.message}`);
+    }
+}
+/** `project/stack`, `control-plane`, or `—` for a row from before the stack was recorded. */
+function stackLabel(b) {
+    if (b.project && b.stack)
+        return `${b.project}/${b.stack}`;
+    return b.scope === 'control-plane' ? 'control-plane' : '—';
+}
+/** A database named with its stack when the daemon said which one. */
+function qualifiedName(r, name) {
+    return r.project && r.stack && !r.skipped ? `${r.project}/${r.stack}/${name}` : name;
+}
+/**
+ * Which running stacks this daemon backs up — and, as a warning, which it
+ * does not. «Found 380 backup(s)» and «all hourly» read as «everything is
+ * covered» on the master, while the test stack's databases — on another
+ * machine — were in none of them.
+ */
+function reportCoverage(stacks) {
+    const list = stacks ?? [];
+    if (list.length === 0)
+        return;
+    log.info('\nRunning stacks:');
+    for (const s of list) {
+        const name = `${s.project}/${s.stack}`;
+        if (s.notBackedUp)
+            log.warn(`  ${name}: not backed up — ${s.notBackedUp}`);
+        else if (s.databases?.length)
+            log.info(`  ${name}: backed up — ${s.databases.join(', ')}`);
+        else
+            log.info(`  ${name}: no databases`);
+    }
+}
+/** The per-entry lines of an `all` or `full` pass, and its tally. */
+function printPassResults(results, nameOf, unit) {
+    const skipped = results.filter((r) => r.skipped);
+    const attempted = results.filter((r) => !r.skipped);
+    for (const r of attempted) {
+        if (r.ok)
+            log.success(`  ✓ ${nameOf(r)} — ${formatBackupSize(r.size ?? 0)} [${String(r.id ?? '').slice(0, 8)}]`);
+        else
+            log.error(`  ✗ ${nameOf(r)}: ${r.error}`);
+    }
+    for (const r of skipped)
+        log.warn(`  – ${nameOf(r)}: ${r.error}`);
+    const ok = attempted.filter((r) => r.ok).length;
+    log.info(`Done: ${ok}/${attempted.length} ${unit} backed up`);
+    if (skipped.length > 0)
+        log.warn(`Not backed up: ${skipped.map(nameOf).join(', ')}`);
+}
+/**
+ * Columns as wide as what they hold. The fixed 25 characters are how the
+ * filename was cut at `geo_2026-09-23T08-19-04-` — one character before the
+ * part that identified the backup.
+ */
+function renderTable(header, rows) {
+    const widths = header.map((h, i) => Math.max(h.length, ...rows.map((r) => (r[i] ?? '').length)));
+    const line = (cells) => cells.map((c, i) => (i === cells.length - 1 ? c : c.padEnd(widths[i]))).join('  ');
+    return [line(header), widths.map((w) => '-'.repeat(w)).join('  '), ...rows.map(line)];
+}
+export async function backupFullCommand() {
+    try {
+        log.info('Creating FULL backup (all DBs + control-plane DB + storage + tor keys + daemon-state)...');
+        const results = await invokeRpc('createFullBackup');
+        if (!results || results.length === 0) {
+            log.warn('Nothing to back up — is a stack running?');
+            return;
+        }
+        printPassResults(results, (r) => qualifiedName(r, r.target), 'target(s)');
+    }
+    catch (err) {
+        log.error(`Failed: ${err.message}`);
+    }
+}
+export async function backupScheduleCommand(target, cron) {
+    try {
+        await invokeRpc('setSchedule', { database: target, cron });
+        log.success(`Scheduled backup of '${target}': ${cron}`);
+        log.info(`  (use 'all' to back up every running-stack database)`);
+    }
+    catch (err) {
+        log.error(`Failed: ${err.message}`);
+    }
+}
+export async function backupSchedulesCommand() {
+    try {
+        const { status, unavailable } = await readBackupStatus();
+        if (!status) {
+            // The configuration is all an older daemon can say — printed as it was,
+            // with the gap named rather than left to look like "all is well".
+            const map = await invokeRpc('listSchedules');
+            const entries = Object.entries(map || {});
+            if (entries.length === 0) {
+                log.info('No backup schedules configured');
+                return;
+            }
+            log.info('Backup schedules:');
+            for (const [target, cron] of entries)
+                log.info(`  ${target.padEnd(28)} ${cron}`);
+            log.warn(`When each last ran, and how that went: unknown — ${unavailable}`);
+            return;
+        }
+        const schedules = status.schedules ?? [];
+        if (schedules.length === 0) {
+            log.info('No backup schedules configured');
+            return;
+        }
+        // "all hourly" said what was configured, and nothing about whether it
+        // ran: the master's hourly `all` lost `main` at 06:04Z with no line
+        // saying so. Each schedule now carries its last pass and its outcome.
+        log.info('Backup schedules:');
+        for (const s of schedules) {
+            const how = s.schedule ?? `UNREADABLE — ${s.error ?? 'not armed'}`;
+            log.info(`  ${String(s.target).padEnd(10)} ${String(s.spec).padEnd(12)} ${how}${s.armed ? '' : '  (not armed)'}`);
+            let line = `      last pass  ${describePass(s.lastPass)}`;
+            // Before any pass was recorded, the index still knows when this target
+            // last produced a backup — which is what its next run is measured from.
+            if (!s.lastPass && s.lastBackupAt) {
+                line += ` — newest backup ${formatUtc(s.lastBackupAt)}, ${formatAge(Date.now() - Date.parse(s.lastBackupAt))} ago`;
+            }
+            if (s.lastPass && s.lastPass.outcome !== 'ok')
+                log.warn(line);
+            else
+                log.info(line);
+            if (s.nextRunAt) {
+                log.info(`      next run   ${formatUtc(s.nextRunAt)} (in ${formatAge(Date.parse(s.nextRunAt) - Date.now())})`);
+            }
+        }
+        reportCoverage(status.stacks);
+    }
+    catch (err) {
+        log.error(`Failed: ${err.message}`);
+    }
+}
+export async function backupUnscheduleCommand(target) {
+    try {
+        await invokeRpc('removeSchedule', { database: target });
+        log.success(`Removed backup schedule for '${target}'`);
     }
     catch (err) {
         log.error(`Failed: ${err.message}`);
@@ -70,8 +287,13 @@ export async function backupListCommand() {
 }
 export async function backupRestoreCommand(id) {
     try {
-        log.info(`Restoring backup '${id}'...`);
-        await invokeRpc('restoreBackup', { backupId: id });
+        // Resolved here as well as in the daemon, so the operator sees WHICH
+        // backup a prefix named before anything is overwritten — and the daemon
+        // is then handed the full id, which every daemon version accepts.
+        const backups = await invokeRpc('listBackups');
+        const target = resolveBackupId(backups, id, (b) => `${b.id} (${qualifiedName(b, b.database)}, ${formatUtc(b.createdAt)})`);
+        log.info(`Restoring ${target.id} — ${qualifiedName(target, target.database)}, taken ${formatUtc(target.createdAt)} (${target.filename})...`);
+        await invokeRpc('restoreBackup', { backupId: target.id });
         log.success('Backup restored successfully');
     }
     catch (err) {