@poolzin/pool-bot 2026.3.22 → 2026.3.24

package/dist/commands/agents.commands.bind.js

@@ -0,0 +1,280 @@
+import { resolveDefaultAgentId } from "../agents/agent-scope.js";
+import { isRouteBinding, listRouteBindings } from "../config/bindings.js";
+import { writeConfigFile } from "../config/config.js";
+import { logConfigUpdated } from "../config/logging.js";
+import { normalizeAgentId } from "../routing/session-key.js";
+import { defaultRuntime } from "../runtime.js";
+import { applyAgentBindings, describeBinding, parseBindingSpecs, removeAgentBindings, } from "./agents.bindings.js";
+import { requireValidConfig } from "./agents.command-shared.js";
+import { buildAgentSummaries } from "./agents.config.js";
+function resolveAgentId(cfg, agentInput, params) {
+    if (!cfg) {
+        return null;
+    }
+    if (agentInput?.trim()) {
+        return normalizeAgentId(agentInput);
+    }
+    if (params?.fallbackToDefault) {
+        return resolveDefaultAgentId(cfg);
+    }
+    return null;
+}
+function hasAgent(cfg, agentId) {
+    if (!cfg) {
+        return false;
+    }
+    return buildAgentSummaries(cfg).some((summary) => summary.id === agentId);
+}
+function formatBindingOwnerLine(binding) {
+    return `${normalizeAgentId(binding.agentId)} <- ${describeBinding(binding)}`;
+}
+function resolveTargetAgentIdOrExit(params) {
+    const agentId = resolveAgentId(params.cfg, params.agentInput?.trim(), {
+        fallbackToDefault: true,
+    });
+    if (!agentId) {
+        params.runtime.error("Unable to resolve agent id.");
+        params.runtime.exit(1);
+        return null;
+    }
+    if (!hasAgent(params.cfg, agentId)) {
+        params.runtime.error(`Agent "${agentId}" not found.`);
+        params.runtime.exit(1);
+        return null;
+    }
+    return agentId;
+}
+function formatBindingConflicts(conflicts) {
+    return conflicts.map((conflict) => `${describeBinding(conflict.binding)} (agent=${conflict.existingAgentId})`);
+}
+function resolveParsedBindingsOrExit(params) {
+    const specs = (params.bindValues ?? []).map((value) => value.trim()).filter(Boolean);
+    if (specs.length === 0) {
+        params.runtime.error(params.emptyMessage);
+        params.runtime.exit(1);
+        return null;
+    }
+    const parsed = parseBindingSpecs({ agentId: params.agentId, specs, config: params.cfg });
+    if (parsed.errors.length > 0) {
+        params.runtime.error(parsed.errors.join("\n"));
+        params.runtime.exit(1);
+        return null;
+    }
+    return parsed;
+}
+function emitJsonPayload(params) {
+    if (!params.json) {
+        return false;
+    }
+    params.runtime.log(JSON.stringify(params.payload, null, 2));
+    if ((params.conflictCount ?? 0) > 0) {
+        params.runtime.exit(1);
+    }
+    return true;
+}
+async function resolveConfigAndTargetAgentIdOrExit(params) {
+    const cfg = await requireValidConfig(params.runtime);
+    if (!cfg) {
+        return null;
+    }
+    const agentId = resolveTargetAgentIdOrExit({
+        cfg,
+        runtime: params.runtime,
+        agentInput: params.agentInput,
+    });
+    if (!agentId) {
+        return null;
+    }
+    return { cfg, agentId };
+}
+export async function agentsBindingsCommand(opts, runtime = defaultRuntime) {
+    const cfg = await requireValidConfig(runtime);
+    if (!cfg) {
+        return;
+    }
+    const filterAgentId = resolveAgentId(cfg, opts.agent?.trim());
+    if (opts.agent && !filterAgentId) {
+        runtime.error("Agent id is required.");
+        runtime.exit(1);
+        return;
+    }
+    if (filterAgentId && !hasAgent(cfg, filterAgentId)) {
+        runtime.error(`Agent "${filterAgentId}" not found.`);
+        runtime.exit(1);
+        return;
+    }
+    const filtered = listRouteBindings(cfg).filter((binding) => !filterAgentId || normalizeAgentId(binding.agentId) === filterAgentId);
+    if (opts.json) {
+        runtime.log(JSON.stringify(filtered.map((binding) => ({
+            agentId: normalizeAgentId(binding.agentId),
+            match: binding.match,
+            description: describeBinding(binding),
+        })), null, 2));
+        return;
+    }
+    if (filtered.length === 0) {
+        runtime.log(filterAgentId ? `No routing bindings for agent "${filterAgentId}".` : "No routing bindings.");
+        return;
+    }
+    runtime.log([
+        "Routing bindings:",
+        ...filtered.map((binding) => `- ${formatBindingOwnerLine(binding)}`),
+    ].join("\n"));
+}
+export async function agentsBindCommand(opts, runtime = defaultRuntime) {
+    const resolved = await resolveConfigAndTargetAgentIdOrExit({
+        runtime,
+        agentInput: opts.agent,
+    });
+    if (!resolved) {
+        return;
+    }
+    const { cfg, agentId } = resolved;
+    const parsed = resolveParsedBindingsOrExit({
+        runtime,
+        cfg,
+        agentId,
+        bindValues: opts.bind,
+        emptyMessage: "Provide at least one --bind <channel[:accountId]>.",
+    });
+    if (!parsed) {
+        return;
+    }
+    const result = applyAgentBindings(cfg, parsed.bindings);
+    if (result.added.length > 0 || result.updated.length > 0) {
+        await writeConfigFile(result.config);
+        if (!opts.json) {
+            logConfigUpdated(runtime);
+        }
+    }
+    const payload = {
+        agentId,
+        added: result.added.map(describeBinding),
+        updated: result.updated.map(describeBinding),
+        skipped: result.skipped.map(describeBinding),
+        conflicts: formatBindingConflicts(result.conflicts),
+    };
+    if (emitJsonPayload({ runtime, json: opts.json, payload, conflictCount: result.conflicts.length })) {
+        return;
+    }
+    if (result.added.length > 0) {
+        runtime.log("Added bindings:");
+        for (const binding of result.added) {
+            runtime.log(`- ${describeBinding(binding)}`);
+        }
+    }
+    else if (result.updated.length === 0) {
+        runtime.log("No new bindings added.");
+    }
+    if (result.updated.length > 0) {
+        runtime.log("Updated bindings:");
+        for (const binding of result.updated) {
+            runtime.log(`- ${describeBinding(binding)}`);
+        }
+    }
+    if (result.skipped.length > 0) {
+        runtime.log("Already present:");
+        for (const binding of result.skipped) {
+            runtime.log(`- ${describeBinding(binding)}`);
+        }
+    }
+    if (result.conflicts.length > 0) {
+        runtime.error("Skipped bindings already claimed by another agent:");
+        for (const conflict of result.conflicts) {
+            runtime.error(`- ${describeBinding(conflict.binding)} (agent=${conflict.existingAgentId})`);
+        }
+        runtime.exit(1);
+    }
+}
+export async function agentsUnbindCommand(opts, runtime = defaultRuntime) {
+    const resolved = await resolveConfigAndTargetAgentIdOrExit({
+        runtime,
+        agentInput: opts.agent,
+    });
+    if (!resolved) {
+        return;
+    }
+    const { cfg, agentId } = resolved;
+    if (opts.all && (opts.bind?.length ?? 0) > 0) {
+        runtime.error("Use either --all or --bind, not both.");
+        runtime.exit(1);
+        return;
+    }
+    if (opts.all) {
+        const existing = listRouteBindings(cfg);
+        const removed = existing.filter((binding) => normalizeAgentId(binding.agentId) === agentId);
+        const keptRoutes = existing.filter((binding) => normalizeAgentId(binding.agentId) !== agentId);
+        const nonRoutes = (cfg.bindings ?? []).filter((binding) => !isRouteBinding(binding));
+        if (removed.length === 0) {
+            runtime.log(`No bindings to remove for agent "${agentId}".`);
+            return;
+        }
+        const next = {
+            ...cfg,
+            bindings: [...keptRoutes, ...nonRoutes].length > 0 ? [...keptRoutes, ...nonRoutes] : undefined,
+        };
+        await writeConfigFile(next);
+        if (!opts.json) {
+            logConfigUpdated(runtime);
+        }
+        const payload = {
+            agentId,
+            removed: removed.map(describeBinding),
+            missing: [],
+            conflicts: [],
+        };
+        if (emitJsonPayload({ runtime, json: opts.json, payload })) {
+            return;
+        }
+        runtime.log(`Removed ${removed.length} binding(s) for "${agentId}".`);
+        return;
+    }
+    const parsed = resolveParsedBindingsOrExit({
+        runtime,
+        cfg,
+        agentId,
+        bindValues: opts.bind,
+        emptyMessage: "Provide at least one --bind <channel[:accountId]> or use --all.",
+    });
+    if (!parsed) {
+        return;
+    }
+    const result = removeAgentBindings(cfg, parsed.bindings);
+    if (result.removed.length > 0) {
+        await writeConfigFile(result.config);
+        if (!opts.json) {
+            logConfigUpdated(runtime);
+        }
+    }
+    const payload = {
+        agentId,
+        removed: result.removed.map(describeBinding),
+        missing: result.missing.map(describeBinding),
+        conflicts: formatBindingConflicts(result.conflicts),
+    };
+    if (emitJsonPayload({ runtime, json: opts.json, payload, conflictCount: result.conflicts.length })) {
+        return;
+    }
+    if (result.removed.length > 0) {
+        runtime.log("Removed bindings:");
+        for (const binding of result.removed) {
+            runtime.log(`- ${describeBinding(binding)}`);
+        }
+    }
+    else {
+        runtime.log("No bindings removed.");
+    }
+    if (result.missing.length > 0) {
+        runtime.log("Not found:");
+        for (const binding of result.missing) {
+            runtime.log(`- ${describeBinding(binding)}`);
+        }
+    }
+    if (result.conflicts.length > 0) {
+        runtime.error("Bindings are owned by another agent:");
+        for (const conflict of result.conflicts) {
+            runtime.error(`- ${describeBinding(conflict.binding)} (agent=${conflict.existingAgentId})`);
+        }
+        runtime.exit(1);
+    }
+}

package/dist/commands/backup-shared.js

@@ -0,0 +1,186 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { readConfigFileSnapshot, resolveConfigPath, resolveOAuthDir, resolveStateDir, } from "../config/config.js";
+import { formatSessionArchiveTimestamp } from "../config/sessions/artifacts.js";
+import { pathExists, shortenHomePath } from "../utils.js";
+import { buildCleanupPlan, isPathWithin } from "./cleanup-utils.js";
+function backupAssetPriority(kind) {
+    switch (kind) {
+        case "state":
+            return 0;
+        case "config":
+            return 1;
+        case "credentials":
+            return 2;
+        case "workspace":
+            return 3;
+    }
+}
+export function buildBackupArchiveRoot(nowMs = Date.now()) {
+    return `${formatSessionArchiveTimestamp(nowMs)}-openclaw-backup`;
+}
+export function buildBackupArchiveBasename(nowMs = Date.now()) {
+    return `${buildBackupArchiveRoot(nowMs)}.tar.gz`;
+}
+export function encodeAbsolutePathForBackupArchive(sourcePath) {
+    const normalized = sourcePath.replaceAll("\\", "/");
+    const windowsMatch = normalized.match(/^([A-Za-z]):\/(.*)$/);
+    if (windowsMatch) {
+        const drive = windowsMatch[1]?.toUpperCase() ?? "UNKNOWN";
+        const rest = windowsMatch[2] ?? "";
+        return path.posix.join("windows", drive, rest);
+    }
+    if (normalized.startsWith("/")) {
+        return path.posix.join("posix", normalized.slice(1));
+    }
+    return path.posix.join("relative", normalized);
+}
+export function buildBackupArchivePath(archiveRoot, sourcePath) {
+    return path.posix.join(archiveRoot, "payload", encodeAbsolutePathForBackupArchive(sourcePath));
+}
+function compareCandidates(left, right) {
+    const depthDelta = left.canonicalPath.length - right.canonicalPath.length;
+    if (depthDelta !== 0) {
+        return depthDelta;
+    }
+    const priorityDelta = backupAssetPriority(left.kind) - backupAssetPriority(right.kind);
+    if (priorityDelta !== 0) {
+        return priorityDelta;
+    }
+    return left.canonicalPath.localeCompare(right.canonicalPath);
+}
+async function canonicalizeExistingPath(targetPath) {
+    try {
+        return await fs.realpath(targetPath);
+    }
+    catch {
+        return path.resolve(targetPath);
+    }
+}
+export async function resolveBackupPlanFromDisk(params = {}) {
+    const includeWorkspace = params.includeWorkspace ?? true;
+    const onlyConfig = params.onlyConfig ?? false;
+    const stateDir = resolveStateDir();
+    const configPath = resolveConfigPath();
+    const oauthDir = resolveOAuthDir();
+    const archiveRoot = buildBackupArchiveRoot(params.nowMs);
+    if (onlyConfig) {
+        const resolvedConfigPath = path.resolve(configPath);
+        if (!(await pathExists(resolvedConfigPath))) {
+            return {
+                stateDir,
+                configPath,
+                oauthDir,
+                workspaceDirs: [],
+                included: [],
+                skipped: [
+                    {
+                        kind: "config",
+                        sourcePath: resolvedConfigPath,
+                        displayPath: shortenHomePath(resolvedConfigPath),
+                        reason: "missing",
+                    },
+                ],
+            };
+        }
+        const canonicalConfigPath = await canonicalizeExistingPath(resolvedConfigPath);
+        return {
+            stateDir,
+            configPath,
+            oauthDir,
+            workspaceDirs: [],
+            included: [
+                {
+                    kind: "config",
+                    sourcePath: canonicalConfigPath,
+                    displayPath: shortenHomePath(canonicalConfigPath),
+                    archivePath: buildBackupArchivePath(archiveRoot, canonicalConfigPath),
+                },
+            ],
+            skipped: [],
+        };
+    }
+    const configSnapshot = await readConfigFileSnapshot();
+    if (includeWorkspace && configSnapshot.exists && !configSnapshot.valid) {
+        throw new Error(`Config invalid at ${shortenHomePath(configSnapshot.path)}. OpenClaw cannot reliably discover custom workspaces for backup. Fix the config or rerun with --no-include-workspace for a partial backup.`);
+    }
+    const cleanupPlan = buildCleanupPlan({
+        cfg: configSnapshot.config,
+        stateDir,
+        configPath,
+        oauthDir,
+    });
+    const workspaceDirs = includeWorkspace ? cleanupPlan.workspaceDirs : [];
+    const rawCandidates = [
+        { kind: "state", sourcePath: path.resolve(stateDir) },
+        ...(cleanupPlan.configInsideState
+            ? []
+            : [{ kind: "config", sourcePath: path.resolve(configPath) }]),
+        ...(cleanupPlan.oauthInsideState
+            ? []
+            : [{ kind: "credentials", sourcePath: path.resolve(oauthDir) }]),
+        ...(includeWorkspace
+            ? workspaceDirs.map((workspaceDir) => ({
+                kind: "workspace",
+                sourcePath: path.resolve(workspaceDir),
+            }))
+            : []),
+    ];
+    const candidates = await Promise.all(rawCandidates.map(async (candidate) => {
+        const exists = await pathExists(candidate.sourcePath);
+        return {
+            ...candidate,
+            exists,
+            canonicalPath: exists
+                ? await canonicalizeExistingPath(candidate.sourcePath)
+                : path.resolve(candidate.sourcePath),
+        };
+    }));
+    const uniqueCandidates = [];
+    const seenCanonicalPaths = new Set();
+    for (const candidate of [...candidates].toSorted(compareCandidates)) {
+        if (seenCanonicalPaths.has(candidate.canonicalPath)) {
+            continue;
+        }
+        seenCanonicalPaths.add(candidate.canonicalPath);
+        uniqueCandidates.push(candidate);
+    }
+    const included = [];
+    const skipped = [];
+    for (const candidate of uniqueCandidates) {
+        if (!candidate.exists) {
+            skipped.push({
+                kind: candidate.kind,
+                sourcePath: candidate.sourcePath,
+                displayPath: shortenHomePath(candidate.sourcePath),
+                reason: "missing",
+            });
+            continue;
+        }
+        const coveredBy = included.find((asset) => isPathWithin(candidate.canonicalPath, asset.sourcePath));
+        if (coveredBy) {
+            skipped.push({
+                kind: candidate.kind,
+                sourcePath: candidate.canonicalPath,
+                displayPath: shortenHomePath(candidate.canonicalPath),
+                reason: "covered",
+                coveredBy: coveredBy.displayPath,
+            });
+            continue;
+        }
+        included.push({
+            kind: candidate.kind,
+            sourcePath: candidate.canonicalPath,
+            displayPath: shortenHomePath(candidate.canonicalPath),
+            archivePath: buildBackupArchivePath(archiveRoot, candidate.canonicalPath),
+        });
+    }
+    return {
+        stateDir,
+        configPath,
+        oauthDir,
+        workspaceDirs: workspaceDirs.map((entry) => path.resolve(entry)),
+        included,
+        skipped,
+    };
+}

package/dist/commands/backup-verify.js

@@ -0,0 +1,236 @@
+import path from "node:path";
+import * as tar from "tar";
+import { resolveUserPath } from "../utils.js";
+const WINDOWS_ABSOLUTE_ARCHIVE_PATH_RE = /^[A-Za-z]:[\\/]/;
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stripTrailingSlashes(value) {
+    return value.replace(/\/+$/u, "");
+}
+function normalizeArchivePath(entryPath, label) {
+    const trimmed = stripTrailingSlashes(entryPath.trim());
+    if (!trimmed) {
+        throw new Error(`${label} is empty.`);
+    }
+    if (trimmed.startsWith("/") || WINDOWS_ABSOLUTE_ARCHIVE_PATH_RE.test(trimmed)) {
+        throw new Error(`${label} must be relative: ${entryPath}`);
+    }
+    if (trimmed.includes("\\")) {
+        throw new Error(`${label} must use forward slashes: ${entryPath}`);
+    }
+    if (trimmed.split("/").some((segment) => segment === "." || segment === "..")) {
+        throw new Error(`${label} contains path traversal segments: ${entryPath}`);
+    }
+    const normalized = stripTrailingSlashes(path.posix.normalize(trimmed));
+    if (!normalized || normalized === "." || normalized === ".." || normalized.startsWith("../")) {
+        throw new Error(`${label} resolves outside the archive root: ${entryPath}`);
+    }
+    return normalized;
+}
+function normalizeArchiveRoot(rootName) {
+    const normalized = normalizeArchivePath(rootName, "Backup manifest archiveRoot");
+    if (normalized.includes("/")) {
+        throw new Error(`Backup manifest archiveRoot must be a single path segment: ${rootName}`);
+    }
+    return normalized;
+}
+function isArchivePathWithin(child, parent) {
+    const relative = path.posix.relative(parent, child);
+    return relative === "" || (!relative.startsWith("../") && relative !== "..");
+}
+function parseManifest(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`Backup manifest is not valid JSON: ${String(err)}`, { cause: err });
+    }
+    if (!isRecord(parsed)) {
+        throw new Error("Backup manifest must be an object.");
+    }
+    if (parsed.schemaVersion !== 1) {
+        throw new Error(`Unsupported backup manifest schemaVersion: ${String(parsed.schemaVersion)}`);
+    }
+    if (typeof parsed.archiveRoot !== "string" || !parsed.archiveRoot.trim()) {
+        throw new Error("Backup manifest is missing archiveRoot.");
+    }
+    if (typeof parsed.createdAt !== "string" || !parsed.createdAt.trim()) {
+        throw new Error("Backup manifest is missing createdAt.");
+    }
+    if (!Array.isArray(parsed.assets)) {
+        throw new Error("Backup manifest is missing assets.");
+    }
+    const assets = [];
+    for (const asset of parsed.assets) {
+        if (!isRecord(asset)) {
+            throw new Error("Backup manifest contains a non-object asset.");
+        }
+        if (typeof asset.kind !== "string" || !asset.kind.trim()) {
+            throw new Error("Backup manifest asset is missing kind.");
+        }
+        if (typeof asset.sourcePath !== "string" || !asset.sourcePath.trim()) {
+            throw new Error("Backup manifest asset is missing sourcePath.");
+        }
+        if (typeof asset.archivePath !== "string" || !asset.archivePath.trim()) {
+            throw new Error("Backup manifest asset is missing archivePath.");
+        }
+        assets.push({
+            kind: asset.kind,
+            sourcePath: asset.sourcePath,
+            archivePath: asset.archivePath,
+        });
+    }
+    return {
+        schemaVersion: 1,
+        archiveRoot: parsed.archiveRoot,
+        createdAt: parsed.createdAt,
+        runtimeVersion: typeof parsed.runtimeVersion === "string" && parsed.runtimeVersion.trim()
+            ? parsed.runtimeVersion
+            : "unknown",
+        platform: typeof parsed.platform === "string" ? parsed.platform : "unknown",
+        nodeVersion: typeof parsed.nodeVersion === "string" ? parsed.nodeVersion : "unknown",
+        options: isRecord(parsed.options)
+            ? { includeWorkspace: parsed.options.includeWorkspace }
+            : undefined,
+        paths: isRecord(parsed.paths)
+            ? {
+                stateDir: typeof parsed.paths.stateDir === "string" ? parsed.paths.stateDir : undefined,
+                configPath: typeof parsed.paths.configPath === "string" ? parsed.paths.configPath : undefined,
+                oauthDir: typeof parsed.paths.oauthDir === "string" ? parsed.paths.oauthDir : undefined,
+                workspaceDirs: Array.isArray(parsed.paths.workspaceDirs)
+                    ? parsed.paths.workspaceDirs.filter((entry) => typeof entry === "string")
+                    : undefined,
+            }
+            : undefined,
+        assets,
+        skipped: Array.isArray(parsed.skipped) ? parsed.skipped : undefined,
+    };
+}
+async function listArchiveEntries(archivePath) {
+    const entries = [];
+    await tar.t({
+        file: archivePath,
+        gzip: true,
+        onentry: (entry) => {
+            entries.push(entry.path);
+        },
+    });
+    return entries;
+}
+async function extractManifest(params) {
+    let manifestContentPromise;
+    await tar.t({
+        file: params.archivePath,
+        gzip: true,
+        onentry: (entry) => {
+            if (entry.path !== params.manifestEntryPath) {
+                entry.resume();
+                return;
+            }
+            manifestContentPromise = new Promise((resolve, reject) => {
+                const chunks = [];
+                entry.on("data", (chunk) => {
+                    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+                });
+                entry.on("error", reject);
+                entry.on("end", () => {
+                    resolve(Buffer.concat(chunks).toString("utf8"));
+                });
+            });
+        },
+    });
+    if (!manifestContentPromise) {
+        throw new Error(`Archive is missing manifest entry: ${params.manifestEntryPath}`);
+    }
+    return await manifestContentPromise;
+}
+function isRootManifestEntry(entryPath) {
+    const parts = entryPath.split("/");
+    return parts.length === 2 && parts[0] !== "" && parts[1] === "manifest.json";
+}
+function verifyManifestAgainstEntries(manifest, entries) {
+    const archiveRoot = normalizeArchiveRoot(manifest.archiveRoot);
+    const manifestEntryPath = path.posix.join(archiveRoot, "manifest.json");
+    const normalizedEntries = [...entries];
+    const normalizedEntrySet = new Set(normalizedEntries);
+    if (!normalizedEntrySet.has(manifestEntryPath)) {
+        throw new Error(`Archive is missing manifest entry: ${manifestEntryPath}`);
+    }
+    for (const entry of normalizedEntries) {
+        if (!isArchivePathWithin(entry, archiveRoot)) {
+            throw new Error(`Archive entry is outside the declared archive root: ${entry}`);
+        }
+    }
+    const payloadRoot = path.posix.join(archiveRoot, "payload");
+    for (const asset of manifest.assets) {
+        const assetArchivePath = normalizeArchivePath(asset.archivePath, "Backup manifest asset path");
+        if (!isArchivePathWithin(assetArchivePath, payloadRoot)) {
+            throw new Error(`Manifest asset path is outside payload root: ${asset.archivePath}`);
+        }
+        const exact = normalizedEntrySet.has(assetArchivePath);
+        const nested = normalizedEntries.some((entry) => entry !== assetArchivePath && isArchivePathWithin(entry, assetArchivePath));
+        if (!exact && !nested) {
+            throw new Error(`Archive is missing payload for manifest asset: ${assetArchivePath}`);
+        }
+    }
+}
+function formatResult(result) {
+    return [
+        `Backup archive OK: ${result.archivePath}`,
+        `Archive root: ${result.archiveRoot}`,
+        `Created at: ${result.createdAt}`,
+        `Runtime version: ${result.runtimeVersion}`,
+        `Assets verified: ${result.assetCount}`,
+        `Archive entries scanned: ${result.entryCount}`,
+    ].join("\n");
+}
+function findDuplicateNormalizedEntryPath(entries) {
+    const seen = new Set();
+    for (const entry of entries) {
+        if (seen.has(entry.normalized)) {
+            return entry.normalized;
+        }
+        seen.add(entry.normalized);
+    }
+    return undefined;
+}
+export async function backupVerifyCommand(runtime, opts) {
+    const archivePath = resolveUserPath(opts.archive);
+    const rawEntries = await listArchiveEntries(archivePath);
+    if (rawEntries.length === 0) {
+        throw new Error("Backup archive is empty.");
+    }
+    const entries = rawEntries.map((entry) => ({
+        raw: entry,
+        normalized: normalizeArchivePath(entry, "Archive entry"),
+    }));
+    const normalizedEntrySet = new Set(entries.map((entry) => entry.normalized));
+    const manifestMatches = entries.filter((entry) => isRootManifestEntry(entry.normalized));
+    if (manifestMatches.length !== 1) {
+        throw new Error(`Expected exactly one backup manifest entry, found ${manifestMatches.length}.`);
+    }
+    const duplicateEntryPath = findDuplicateNormalizedEntryPath(entries);
+    if (duplicateEntryPath) {
+        throw new Error(`Archive contains duplicate entry path: ${duplicateEntryPath}`);
+    }
+    const manifestEntryPath = manifestMatches[0]?.raw;
+    if (!manifestEntryPath) {
+        throw new Error("Backup archive manifest entry could not be resolved.");
+    }
+    const manifestRaw = await extractManifest({ archivePath, manifestEntryPath });
+    const manifest = parseManifest(manifestRaw);
+    verifyManifestAgainstEntries(manifest, normalizedEntrySet);
+    const result = {
+        ok: true,
+        archivePath,
+        archiveRoot: manifest.archiveRoot,
+        createdAt: manifest.createdAt,
+        runtimeVersion: manifest.runtimeVersion,
+        assetCount: manifest.assets.length,
+        entryCount: rawEntries.length,
+    };
+    runtime.log(opts.json ? JSON.stringify(result, null, 2) : formatResult(result));
+    return result;
+}