@askdkc/kiokuko 0.1.17 → 0.1.19

package/dist/commands/import.js

@@ -1,74 +1,369 @@
 import { createHash } from 'node:crypto';
-import { readFile } from 'node:fs/promises';
-import { withImmediateTransaction } from '../db/transaction.js';
+import { constants } from 'node:fs';
+import { lstat, open } from 'node:fs/promises';
+import { TextDecoder } from 'node:util';
+import { withDeferredReadTransaction, withImmediateTransaction } from '../db/transaction.js';
 import { KiokukoError } from '../errors.js';
-import { findSecret } from '../memory/secrets.js';
+import { findSecretInValue } from '../memory/secrets.js';
+import { readEntry } from '../memory/entries.js';
 import { insertEntryRevisionInTransaction } from '../memory/revisions.js';
 import { syncEntrySearchProjection } from '../memory/structured-memory.js';
-import { canonicalContentHash, canonicalJson, requireWorkspace, validateRecordInput, } from '../serialization/validate.js';
+import { isWellFormedUnicode } from '../serialization/boundary-json.js';
+import { canonicalEntryRevisionContentHash, canonicalJson, requireWorkspace, validateRecordInput, } from '../serialization/validate.js';
+import { parseStrictJson } from '../setup/strict-json.js';
+export const WORKSPACE_ARCHIVE_MAX_BYTES = 64 * 1024 * 1024;
+export const WORKSPACE_ARCHIVE_MAX_LINES = 10_000;
+export const WORKSPACE_ARCHIVE_MAX_LINE_BYTES = 512 * 1024;
 const RELATIONS = new Set(['supports', 'contradicts', 'derived_from', 'related_to']);
 const AUDIT_OPERATIONS = new Set(['record', 'promote', 'supersede', 'link', 'import', 'purge']);
+const HASH_PATTERN = /^[0-9a-f]{64}$/u;
+const TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u;
+const RECORD_FIELDS = {
+    checksum: ['type', 'sha256'],
+    manifest: ['type', 'apiVersion', 'workspace', 'format', 'version', 'counts'],
+    entry: [
+        'type', 'id', 'workspace', 'kind', 'status', 'title', 'body', 'summary',
+        'scope_json', 'provenance_json', 'trust_level', 'confidence', 'content_hash',
+        'revision', 'superseded_by', 'created_by', 'created_at', 'updated_at', 'verified_at',
+    ],
+    tag: ['type', 'entry_id', 'tag'],
+    link: ['type', 'from_entry_id', 'to_entry_id', 'relation', 'created_at', 'created_by'],
+    audit: ['type', 'event_id', 'entry_id', 'workspace', 'operation', 'actor', 'details_json', 'created_at'],
+};
+const COUNT_FIELDS = ['entries', 'tags', 'links', 'audit'];
+const STRICT_JSON_OPTIONS = {
+    allowTrailingComma: false,
+    disallowComments: true,
+    allowEmptyContent: false,
+};
+function archiveChanged() {
+    return new KiokukoError('CONFLICT', 'Import input changed while it was being read');
+}
+function isSameArchiveFileState(left, right) {
+    return left.isFile()
+        && right.isFile()
+        && left.dev === right.dev
+        && left.ino === right.ino
+        && left.mode === right.mode
+        && left.nlink === right.nlink
+        && left.uid === right.uid
+        && left.gid === right.gid
+        && left.rdev === right.rdev
+        && left.size === right.size
+        && left.mtimeNs === right.mtimeNs
+        && left.ctimeNs === right.ctimeNs;
+}
+function assertBindableArchiveFile(state) {
+    if (!state.isFile())
+        throw new KiokukoError('VALIDATION_ERROR', 'Import input must be a regular file');
+    if (state.ino === 0n) {
+        throw new KiokukoError('SECURITY_REJECTION', 'Import input does not expose a stable file identity');
+    }
+}
+function archiveOpenFlags() {
+    if (process.platform === 'win32')
+        return constants.O_RDONLY;
+    if (!Number.isSafeInteger(constants.O_NOFOLLOW) || constants.O_NOFOLLOW <= 0
+        || !Number.isSafeInteger(constants.O_NONBLOCK) || constants.O_NONBLOCK <= 0) {
+        throw new KiokukoError('SECURITY_REJECTION', 'This platform cannot safely open an import archive');
+    }
+    return constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK;
+}
+async function readBoundedArchive(filePath, dependencies) {
+    const planned = await lstat(filePath, { bigint: true });
+    assertBindableArchiveFile(planned);
+    if (planned.size > BigInt(WORKSPACE_ARCHIVE_MAX_BYTES)) {
+        throw new KiokukoError('VALIDATION_ERROR', `Workspace archive exceeds the ${WORKSPACE_ARCHIVE_MAX_BYTES}-byte maximum`);
+    }
+    await dependencies.afterInputPlanned?.(filePath);
+    const handle = await open(filePath, archiveOpenFlags());
+    let result;
+    let operationError;
+    try {
+        const initial = await handle.stat({ bigint: true });
+        assertBindableArchiveFile(initial);
+        if (!isSameArchiveFileState(planned, initial))
+            throw archiveChanged();
+        await dependencies.afterInputBound?.(filePath);
+        if (initial.size > BigInt(WORKSPACE_ARCHIVE_MAX_BYTES)) {
+            throw new KiokukoError('VALIDATION_ERROR', `Workspace archive exceeds the ${WORKSPACE_ARCHIVE_MAX_BYTES}-byte maximum`);
+        }
+        const expectedSize = Number(initial.size);
+        const buffer = Buffer.alloc(expectedSize);
+        let offset = 0;
+        while (offset < expectedSize) {
+            const { bytesRead } = await handle.read(buffer, offset, expectedSize - offset, offset);
+            if (bytesRead === 0)
+                throw archiveChanged();
+            offset += bytesRead;
+        }
+        const extra = Buffer.allocUnsafe(1);
+        const { bytesRead: extraBytesRead } = await handle.read(extra, 0, 1, expectedSize);
+        if (extraBytesRead !== 0)
+            throw archiveChanged();
+        await dependencies.afterInputRead?.(filePath);
+        const final = await handle.stat({ bigint: true });
+        if (!isSameArchiveFileState(initial, final))
+            throw archiveChanged();
+        const finalPath = await lstat(filePath, { bigint: true });
+        if (!isSameArchiveFileState(final, finalPath))
+            throw archiveChanged();
+        result = buffer;
+    }
+    catch (error) {
+        operationError = error;
+    }
+    try {
+        await handle.close();
+    }
+    catch (closeError) {
+        if (operationError !== undefined) {
+            throw new AggregateError([operationError, closeError], 'Import read failed and the input file could not be closed');
+        }
+        throw closeError;
+    }
+    if (operationError !== undefined)
+        throw operationError;
+    if (result === undefined)
+        throw new KiokukoError('INTEGRITY_ERROR', 'Import read produced no result');
+    return result;
+}
+export function validateWorkspaceArchiveByteLayout(bytes) {
+    if (bytes.byteLength > WORKSPACE_ARCHIVE_MAX_BYTES) {
+        throw new KiokukoError('VALIDATION_ERROR', `Workspace archive exceeds the ${WORKSPACE_ARCHIVE_MAX_BYTES}-byte maximum`);
+    }
+    let lineBytes = 0;
+    let lines = 0;
+    for (const byte of bytes) {
+        if (byte === 0x0a) {
+            lines += 1;
+            lineBytes = 0;
+        }
+        else {
+            lineBytes += 1;
+            if (lineBytes > WORKSPACE_ARCHIVE_MAX_LINE_BYTES) {
+                throw new KiokukoError('VALIDATION_ERROR', `Workspace archive line exceeds the ${WORKSPACE_ARCHIVE_MAX_LINE_BYTES}-byte maximum`);
+            }
+        }
+        if (lines > WORKSPACE_ARCHIVE_MAX_LINES) {
+            throw new KiokukoError('VALIDATION_ERROR', `Workspace archive exceeds the ${WORKSPACE_ARCHIVE_MAX_LINES}-line maximum`);
+        }
+    }
+    if (lineBytes > 0)
+        lines += 1;
+    if (lines > WORKSPACE_ARCHIVE_MAX_LINES) {
+        throw new KiokukoError('VALIDATION_ERROR', `Workspace archive exceeds the ${WORKSPACE_ARCHIVE_MAX_LINES}-line maximum`);
+    }
+}
 function objectValue(value, label) {
     if (typeof value !== 'object' || value === null || Array.isArray(value)) {
         throw new KiokukoError('VALIDATION_ERROR', `${label} must be a JSON object`);
     }
     return value;
 }
+function exactFields(value, fields, label) {
+    const actual = Object.keys(value);
+    const allowed = new Set(fields);
+    if (actual.length !== fields.length || actual.some((field) => !allowed.has(field))) {
+        throw new KiokukoError('VALIDATION_ERROR', `${label} has invalid fields`);
+    }
+}
+function rejectSecretValue(value) {
+    const finding = findSecretInValue(value);
+    if (finding !== undefined) {
+        throw new KiokukoError('SECURITY_REJECTION', 'Import contains secret-like content', { kind: finding.kind });
+    }
+}
 function stringValue(value, label, allowEmpty = false) {
     if (typeof value !== 'string' || (!allowEmpty && value.length === 0)) {
         throw new KiokukoError('VALIDATION_ERROR', `${label} must be a ${allowEmpty ? '' : 'non-empty '}string`);
     }
+    if (!isWellFormedUnicode(value)) {
+        throw new KiokukoError('VALIDATION_ERROR', `${label} must contain well-formed Unicode`);
+    }
     return value;
 }
+function inputPathValue(value) {
+    const filePath = stringValue(value, 'input');
+    if (/\p{Cc}/u.test(filePath)) {
+        throw new KiokukoError('VALIDATION_ERROR', 'input must not contain control characters');
+    }
+    return filePath;
+}
 function nullableString(value, label) {
-    if (value === null || value === undefined)
+    if (value === null)
         return null;
     return stringValue(value, label, true);
 }
 function parsedJsonObject(value, label) {
-    if (typeof value === 'object' && value !== null && !Array.isArray(value))
-        return value;
-    const parsed = JSON.parse(stringValue(value, label));
-    return objectValue(parsed, label);
+    const text = stringValue(value, label);
+    const parsed = parseStrictJson(text, STRICT_JSON_OPTIONS, `${label} must contain valid JSON`);
+    const object = objectValue(parsed, label);
+    rejectSecretValue(object);
+    if (canonicalJson(object) !== text) {
+        throw new KiokukoError('VALIDATION_ERROR', `${label} must use canonical JSON encoding`);
+    }
+    return object;
 }
-function parseJson(text) {
-    try {
-        return objectValue(JSON.parse(text), 'JSON line');
+function numberValue(value, label) {
+    if (typeof value !== 'number' || !Number.isFinite(value)) {
+        throw new KiokukoError('VALIDATION_ERROR', `${label} must be a finite number`);
     }
-    catch (error) {
-        if (error instanceof KiokukoError)
-            throw error;
-        throw new KiokukoError('VALIDATION_ERROR', 'Import contains invalid JSON');
+    return value;
+}
+function integerValue(value, label, minimum = 0) {
+    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < minimum) {
+        throw new KiokukoError('VALIDATION_ERROR', `${label} must be an integer greater than or equal to ${minimum}`);
+    }
+    return value;
+}
+function timestampValue(value, label) {
+    const timestamp = stringValue(value, label);
+    const parsed = Date.parse(timestamp);
+    if (!TIMESTAMP_PATTERN.test(timestamp) || !Number.isFinite(parsed) || new Date(parsed).toISOString() !== timestamp) {
+        throw new KiokukoError('VALIDATION_ERROR', `${label} must be a canonical ISO-8601 UTC timestamp`);
+    }
+    return timestamp;
+}
+function hashValue(value, label) {
+    const hash = stringValue(value, label);
+    if (!HASH_PATTERN.test(hash))
+        throw new KiokukoError('VALIDATION_ERROR', `${label} must be a lowercase SHA-256 hash`);
+    return hash;
+}
+function parseJsonLine(text, label) {
+    const parsed = parseStrictJson(text, STRICT_JSON_OPTIONS, `${label} contains invalid JSON`);
+    const object = objectValue(parsed, label);
+    if (canonicalJson(object) !== text) {
+        throw new KiokukoError('VALIDATION_ERROR', `${label} must use canonical JSON encoding`);
     }
+    return object;
+}
+function validateEntryRecord(record, workspace) {
+    if (record.type !== 'entry')
+        throw new KiokukoError('VALIDATION_ERROR', 'Entry record type is invalid');
+    stringValue(record.id, 'entry.id');
+    if (stringValue(record.workspace, 'entry.workspace') !== workspace) {
+        throw new KiokukoError('VALIDATION_ERROR', 'Entry workspace does not match manifest workspace');
+    }
+    stringValue(record.kind, 'entry.kind');
+    stringValue(record.status, 'entry.status');
+    stringValue(record.title, 'entry.title');
+    stringValue(record.body, 'entry.body', true);
+    nullableString(record.summary, 'entry.summary');
+    parsedJsonObject(record.scope_json, 'entry.scope_json');
+    parsedJsonObject(record.provenance_json, 'entry.provenance_json');
+    stringValue(record.trust_level, 'entry.trust_level');
+    numberValue(record.confidence, 'entry.confidence');
+    hashValue(record.content_hash, 'entry.content_hash');
+    if (integerValue(record.revision, 'entry.revision', 1) !== 1) {
+        throw new KiokukoError('VALIDATION_ERROR', 'Workspace archive v2 can import only revision 1 snapshots; higher revisions require a history-preserving archive format');
+    }
+    nullableString(record.superseded_by, 'entry.superseded_by');
+    stringValue(record.created_by, 'entry.created_by');
+    timestampValue(record.created_at, 'entry.created_at');
+    timestampValue(record.updated_at, 'entry.updated_at');
+    if (record.verified_at !== null)
+        timestampValue(record.verified_at, 'entry.verified_at');
+}
+function validateTagRecord(record) {
+    if (record.type !== 'tag')
+        throw new KiokukoError('VALIDATION_ERROR', 'Tag record type is invalid');
+    stringValue(record.entry_id, 'tag.entry_id');
+    stringValue(record.tag, 'tag.tag');
+}
+function validateLinkRecord(record) {
+    if (record.type !== 'link')
+        throw new KiokukoError('VALIDATION_ERROR', 'Link record type is invalid');
+    stringValue(record.from_entry_id, 'link.from_entry_id');
+    stringValue(record.to_entry_id, 'link.to_entry_id');
+    stringValue(record.relation, 'link.relation');
+    timestampValue(record.created_at, 'link.created_at');
+    stringValue(record.created_by, 'link.created_by');
+}
+function validateAuditRecord(record, workspace) {
+    if (record.type !== 'audit')
+        throw new KiokukoError('VALIDATION_ERROR', 'Audit record type is invalid');
+    stringValue(record.event_id, 'audit.event_id');
+    nullableString(record.entry_id, 'audit.entry_id');
+    if (stringValue(record.workspace, 'audit.workspace') !== workspace) {
+        throw new KiokukoError('VALIDATION_ERROR', 'Audit workspace does not match manifest workspace');
+    }
+    stringValue(record.operation, 'audit.operation');
+    stringValue(record.actor, 'audit.actor');
+    parsedJsonObject(record.details_json, 'audit.details_json');
+    timestampValue(record.created_at, 'audit.created_at');
 }
 function parseImport(text) {
-    const lines = text.split('\n');
-    while (lines.at(-1) === '')
-        lines.pop();
-    if (lines.length < 2)
-        throw new KiokukoError('VALIDATION_ERROR', 'Import file is empty or missing manifest');
-    const checksumLine = parseJson(lines[0]);
-    if (checksumLine.type !== 'checksum' || typeof checksumLine.sha256 !== 'string') {
+    if (!text.endsWith('\n'))
+        throw new KiokukoError('VALIDATION_ERROR', 'Import must end with exactly one newline');
+    const lines = text.slice(0, -1).split('\n');
+    if (lines.length < 2 || lines.some((line) => line.length === 0)) {
+        throw new KiokukoError('VALIDATION_ERROR', 'Import file is empty, truncated, or contains blank lines');
+    }
+    const checksumLine = parseJsonLine(lines[0], 'Import checksum line');
+    exactFields(checksumLine, RECORD_FIELDS.checksum, 'Import checksum line');
+    if (checksumLine.type !== 'checksum') {
         throw new KiokukoError('VALIDATION_ERROR', 'Import checksum line is invalid');
     }
+    const checksum = hashValue(checksumLine.sha256, 'Import checksum');
     const payload = `${lines.slice(1).join('\n')}\n`;
     const actual = createHash('sha256').update(payload, 'utf8').digest('hex');
-    if (actual !== checksumLine.sha256)
+    if (actual !== checksum)
         throw new KiokukoError('INTEGRITY_ERROR', 'Import checksum mismatch');
-    const payloadLines = lines.slice(1).map(parseJson);
-    const manifest = payloadLines.find((line) => line.type === 'manifest');
-    if (!manifest || typeof manifest.workspace !== 'string')
-        throw new KiokukoError('VALIDATION_ERROR', 'Import manifest is invalid');
-    if (manifest.format !== 'kiokuko-jsonl' || manifest.apiVersion !== '1') {
+    const payloadLines = lines.slice(1).map((line, index) => parseJsonLine(line, `Import payload line ${index + 1}`));
+    const manifest = payloadLines[0];
+    exactFields(manifest, RECORD_FIELDS.manifest, 'Import manifest');
+    if (manifest.format !== 'kiokuko-jsonl' || manifest.apiVersion !== '1' || manifest.version !== 2) {
         throw new KiokukoError('VALIDATION_ERROR', 'Unsupported import format');
     }
-    const entries = payloadLines.filter((line) => line.type === 'entry');
-    const tags = payloadLines.filter((line) => line.type === 'tag');
-    const links = payloadLines.filter((line) => line.type === 'link');
-    const audit = payloadLines.filter((line) => line.type === 'audit');
-    const counts = objectValue(manifest.counts ?? {}, 'manifest.counts');
+    if (manifest.type !== 'manifest')
+        throw new KiokukoError('VALIDATION_ERROR', 'Import manifest is invalid');
+    rejectSecretValue(manifest);
+    const workspace = requireWorkspace(manifest.workspace);
+    const counts = objectValue(manifest.counts, 'manifest.counts');
+    exactFields(counts, COUNT_FIELDS, 'manifest.counts');
+    for (const field of COUNT_FIELDS)
+        integerValue(counts[field], `manifest.counts.${field}`);
+    const entries = [];
+    const tags = [];
+    const links = [];
+    const audit = [];
+    for (const line of payloadLines.slice(1)) {
+        if (line.type === 'manifest' || line.type === 'checksum') {
+            throw new KiokukoError('INTEGRITY_ERROR', `Import contains a duplicate ${String(line.type)} record`);
+        }
+        switch (line.type) {
+            case 'entry':
+                exactFields(line, RECORD_FIELDS.entry, 'Import entry record');
+                validateEntryRecord(line, workspace);
+                rejectSecretValue(line);
+                entries.push(line);
+                break;
+            case 'tag':
+                exactFields(line, RECORD_FIELDS.tag, 'Import tag record');
+                validateTagRecord(line);
+                rejectSecretValue(line);
+                tags.push(line);
+                break;
+            case 'link':
+                exactFields(line, RECORD_FIELDS.link, 'Import link record');
+                validateLinkRecord(line);
+                rejectSecretValue(line);
+                links.push(line);
+                break;
+            case 'audit':
+                exactFields(line, RECORD_FIELDS.audit, 'Import audit record');
+                validateAuditRecord(line, workspace);
+                rejectSecretValue(line);
+                audit.push(line);
+                break;
+            default:
+                throw new KiokukoError('VALIDATION_ERROR', `Import contains unsupported record type ${String(line.type)}`);
+        }
+    }
     for (const [key, actualCount] of Object.entries({ entries, tags, links, audit })) {
-        if (counts[key] !== undefined && counts[key] !== actualCount.length) {
+        if (counts[key] !== actualCount.length) {
             throw new KiokukoError('INTEGRITY_ERROR', `Import ${key} count does not match manifest`);
         }
     }
@@ -84,15 +379,15 @@ function importedEntry(raw, workspace) {
     const scope = parsedJsonObject(raw.scope_json, 'entry.scope_json');
     const provenance = parsedJsonObject(raw.provenance_json, 'entry.provenance_json');
     const trustLevel = stringValue(raw.trust_level, 'entry.trust_level');
-    const confidence = Number(raw.confidence);
-    const tags = Array.isArray(raw.tags) ? raw.tags : [];
+    const confidence = numberValue(raw.confidence, 'entry.confidence');
+    const persistedTags = Array.isArray(raw.tags) ? raw.tags : [];
     const createdBy = stringValue(raw.created_by, 'entry.created_by');
     const supersededBy = nullableString(raw.superseded_by, 'entry.superseded_by');
-    const createdAt = stringValue(raw.created_at, 'entry.created_at');
-    const updatedAt = stringValue(raw.updated_at, 'entry.updated_at');
-    const verifiedAt = nullableString(raw.verified_at, 'entry.verified_at');
-    const revision = Number(raw.revision);
-    const contentHash = stringValue(raw.content_hash, 'entry.content_hash');
+    const createdAt = timestampValue(raw.created_at, 'entry.created_at');
+    const updatedAt = timestampValue(raw.updated_at, 'entry.updated_at');
+    const verifiedAt = raw.verified_at === null ? null : timestampValue(raw.verified_at, 'entry.verified_at');
+    const revision = integerValue(raw.revision, 'entry.revision', 1);
+    const contentHash = hashValue(raw.content_hash, 'entry.content_hash');
     const validated = validateRecordInput({
         workspace,
         kind,
@@ -104,14 +399,26 @@ function importedEntry(raw, workspace) {
         provenance,
         trustLevel,
         confidence,
-        tags,
+        tags: persistedTags,
         createdBy,
     });
-    if (status === 'superseded' && !supersededBy)
-        throw new KiokukoError('VALIDATION_ERROR', 'Superseded entry needs superseded_by');
-    if (!Number.isInteger(revision) || revision < 1)
-        throw new KiokukoError('VALIDATION_ERROR', 'entry.revision must be a positive integer');
-    const expectedHash = canonicalContentHash({
+    if ((status === 'superseded') !== (supersededBy !== null)) {
+        throw new KiokukoError('VALIDATION_ERROR', 'entry.status and entry.superseded_by are inconsistent');
+    }
+    if (status === 'candidate' && verifiedAt !== null) {
+        throw new KiokukoError('VALIDATION_ERROR', 'Candidate entries cannot have entry.verified_at');
+    }
+    if (status === 'verified' && verifiedAt === null) {
+        throw new KiokukoError('VALIDATION_ERROR', 'Verified entries require entry.verified_at');
+    }
+    if (createdAt > updatedAt
+        || verifiedAt !== null && (verifiedAt < createdAt || verifiedAt > updatedAt)) {
+        throw new KiokukoError('VALIDATION_ERROR', 'Entry lifecycle timestamps are inconsistent');
+    }
+    if (revision !== 1) {
+        throw new KiokukoError('VALIDATION_ERROR', 'Workspace archive v2 can import only revision 1 snapshots; higher revisions require a history-preserving archive format');
+    }
+    const hashInput = {
         kind: validated.kind,
         title: validated.title,
         body: validated.body,
@@ -119,19 +426,15 @@ function importedEntry(raw, workspace) {
         scope: validated.scope,
         provenance: validated.provenance,
         tags: validated.tags,
-    });
-    if (expectedHash !== contentHash)
+    };
+    const expectedHash = canonicalEntryRevisionContentHash(hashInput);
+    if (expectedHash !== contentHash) {
         throw new KiokukoError('INTEGRITY_ERROR', `Content hash mismatch for entry ${id}`);
-    const secretFinding = findSecret(canonicalJson({
-        title: validated.title,
-        body: validated.body,
-        summary: validated.summary,
-        scope: validated.scope,
-        provenance: validated.provenance,
-        tags: validated.tags,
-    }));
-    if (secretFinding)
-        throw new KiokukoError('SECURITY_REJECTION', 'Import contains secret-like content', { kind: secretFinding.kind });
+    }
+    if (persistedTags.length !== validated.tags.length
+        || persistedTags.some((tag, index) => tag !== validated.tags[index])) {
+        throw new KiokukoError('VALIDATION_ERROR', `Tags for entry ${id} are not in canonical archive order`);
+    }
     return {
         id,
         workspace,
@@ -140,8 +443,8 @@ function importedEntry(raw, workspace) {
         title: validated.title,
         body: validated.body,
         summary: validated.summary,
-        scopeJson: canonicalJson(validated.scope),
-        provenanceJson: canonicalJson(validated.provenance),
+        scope: validated.scope,
+        provenance: validated.provenance,
         trustLevel: validated.trustLevel,
         confidence: validated.confidence,
         contentHash,
@@ -154,13 +457,44 @@ function importedEntry(raw, workspace) {
         tags: validated.tags,
     };
 }
+function validateSupersessionGraph(entries) {
+    const replacements = new Map(entries.map((entry) => [entry.id, entry.supersededBy]));
+    const state = new Map();
+    for (const entry of entries) {
+        if (state.get(entry.id) === 'complete')
+            continue;
+        const path = [];
+        let current = entry.id;
+        while (current !== null) {
+            if (!replacements.has(current)) {
+                throw new KiokukoError('VALIDATION_ERROR', `Supersession references unknown entry ${current}`);
+            }
+            const currentState = state.get(current);
+            if (currentState === 'visiting')
+                throw new KiokukoError('VALIDATION_ERROR', 'Import contains a supersession cycle');
+            if (currentState === 'complete')
+                break;
+            state.set(current, 'visiting');
+            path.push(current);
+            current = replacements.get(current) ?? null;
+        }
+        for (const visited of path)
+            state.set(visited, 'complete');
+    }
+}
 function validateRelatedLines(document, entryIds) {
+    const seenTags = new Set();
     for (const tag of document.tags) {
         const entryId = stringValue(tag.entry_id, 'tag.entry_id');
-        stringValue(tag.tag, 'tag.tag');
+        const value = stringValue(tag.tag, 'tag.tag');
         if (!entryIds.has(entryId))
             throw new KiokukoError('VALIDATION_ERROR', `Tag references unknown entry ${entryId}`);
+        const identity = `${entryId}\u0000${value}`;
+        if (seenTags.has(identity))
+            throw new KiokukoError('VALIDATION_ERROR', 'Import contains a duplicate tag record');
+        seenTags.add(identity);
     }
+    const seenLinks = new Set();
     for (const link of document.links) {
         const from = stringValue(link.from_entry_id, 'link.from_entry_id');
         const to = stringValue(link.to_entry_id, 'link.to_entry_id');
@@ -168,7 +502,12 @@ function validateRelatedLines(document, entryIds) {
         if (!entryIds.has(from) || !entryIds.has(to) || !RELATIONS.has(relation)) {
             throw new KiokukoError('VALIDATION_ERROR', 'Import contains an invalid link');
         }
+        const identity = `${from}\u0000${to}\u0000${relation}`;
+        if (seenLinks.has(identity))
+            throw new KiokukoError('VALIDATION_ERROR', 'Import contains a duplicate link record');
+        seenLinks.add(identity);
     }
+    const seenAuditEvents = new Set();
     for (const event of document.audit) {
         const entryId = nullableString(event.entry_id, 'audit.entry_id');
         const operation = stringValue(event.operation, 'audit.operation');
@@ -176,25 +515,157 @@ function validateRelatedLines(document, entryIds) {
             throw new KiokukoError('VALIDATION_ERROR', `Audit references unknown entry ${entryId}`);
         if (!AUDIT_OPERATIONS.has(operation))
             throw new KiokukoError('VALIDATION_ERROR', `Unsupported audit operation ${operation}`);
-        stringValue(event.event_id, 'audit.event_id');
+        const eventId = stringValue(event.event_id, 'audit.event_id');
+        if (seenAuditEvents.has(eventId))
+            throw new KiokukoError('VALIDATION_ERROR', 'Import contains a duplicate audit event');
+        seenAuditEvents.add(eventId);
         stringValue(event.workspace, 'audit.workspace');
         stringValue(event.actor, 'audit.actor');
         stringValue(event.details_json, 'audit.details_json', true);
         stringValue(event.created_at, 'audit.created_at');
     }
 }
-function existingEntry(database, id) {
-    return database.prepare(`
-    SELECT e.id, r.content_hash
-      FROM entries AS e
-      JOIN entry_revisions AS r ON r.entry_id = e.id AND r.revision = e.current_revision
-     WHERE e.id = ?
-  `).get(id);
+function sameStringArray(left, right) {
+    return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function entryMatchesArchive(existing, imported) {
+    return existing.id === imported.id
+        && existing.workspace === imported.workspace
+        && existing.kind === imported.kind
+        && existing.status === imported.status
+        && existing.title === imported.title
+        && existing.body === imported.body
+        && existing.summary === imported.summary
+        && canonicalJson(existing.scope) === canonicalJson(imported.scope)
+        && canonicalJson(existing.provenance) === canonicalJson(imported.provenance)
+        && existing.trustLevel === imported.trustLevel
+        && existing.confidence === imported.confidence
+        && existing.contentHash === imported.contentHash
+        && existing.revision === imported.revision
+        && existing.supersededBy === imported.supersededBy
+        && existing.createdBy === imported.createdBy
+        && existing.createdAt === imported.createdAt
+        && existing.updatedAt === imported.updatedAt
+        && existing.verifiedAt === imported.verifiedAt
+        && sameStringArray(existing.tags, imported.tags);
+}
+function planEntryImport(database, entries, workspace) {
+    const newEntries = [];
+    const duplicateIds = new Set();
+    if (database === undefined) {
+        return { newEntries: [...entries], duplicates: 0 };
+    }
+    for (const entry of entries) {
+        const owner = database.prepare('SELECT workspace FROM entries WHERE id = ?').get(entry.id);
+        if (owner !== undefined) {
+            if (typeof owner.workspace !== 'string')
+                throw new KiokukoError('INTEGRITY_ERROR', 'Stored entry workspace is invalid');
+            if (owner.workspace !== workspace) {
+                throw new KiokukoError('CONFLICT', `Entry ID ${entry.id} already belongs to another workspace`);
+            }
+            const existing = readEntry(database, { workspace, entryId: entry.id });
+            if (existing.contentHash !== entry.contentHash) {
+                throw new KiokukoError('CONFLICT', `Entry ID ${entry.id} already contains different content`);
+            }
+            duplicateIds.add(entry.id);
+            continue;
+        }
+        const hashMatch = database.prepare(`
+      SELECT entry_id
+        FROM entry_revisions
+       WHERE workspace = ? AND content_hash = ?
+    `).get(workspace, entry.contentHash);
+        if (hashMatch !== undefined) {
+            if (typeof hashMatch.entry_id !== 'string') {
+                throw new KiokukoError('INTEGRITY_ERROR', 'Stored content identity is invalid');
+            }
+            if (hashMatch.entry_id === entry.id) {
+                throw new KiokukoError('INTEGRITY_ERROR', 'Stored revision has no owning entry');
+            }
+            throw new KiokukoError('CONFLICT', 'Archive content already belongs to a different entry ID');
+        }
+        newEntries.push(entry);
+    }
+    for (const entry of entries) {
+        if (!duplicateIds.has(entry.id))
+            continue;
+        const existing = readEntry(database, { workspace, entryId: entry.id });
+        if (!entryMatchesArchive(existing, entry)) {
+            throw new KiokukoError('CONFLICT', `Entry ${entry.id} already exists with different archive metadata`);
+        }
+    }
+    return { newEntries, duplicates: duplicateIds.size };
+}
+function planRelatedImport(database, document, workspace) {
+    const links = [];
+    for (const link of document.links) {
+        const planned = {
+            from: stringValue(link.from_entry_id, 'link.from_entry_id'),
+            to: stringValue(link.to_entry_id, 'link.to_entry_id'),
+            relation: stringValue(link.relation, 'link.relation'),
+            createdAt: timestampValue(link.created_at, 'link.created_at'),
+            createdBy: stringValue(link.created_by, 'link.created_by'),
+        };
+        const existing = database?.prepare(`
+      SELECT created_at, created_by
+        FROM entry_links
+       WHERE from_entry_id = ? AND to_entry_id = ? AND relation = ?
+    `).get(planned.from, planned.to, planned.relation);
+        if (existing !== undefined) {
+            if (existing.created_at !== planned.createdAt || existing.created_by !== planned.createdBy) {
+                throw new KiokukoError('CONFLICT', 'Existing link has different archive metadata');
+            }
+            continue;
+        }
+        links.push(planned);
+    }
+    const audit = [];
+    for (const event of document.audit) {
+        const planned = {
+            eventId: stringValue(event.event_id, 'audit.event_id'),
+            entryId: nullableString(event.entry_id, 'audit.entry_id'),
+            operation: stringValue(event.operation, 'audit.operation'),
+            actor: stringValue(event.actor, 'audit.actor'),
+            detailsJson: stringValue(event.details_json, 'audit.details_json'),
+            createdAt: timestampValue(event.created_at, 'audit.created_at'),
+        };
+        const existing = database?.prepare(`
+      SELECT entry_id, workspace, operation, actor, details_json, created_at
+        FROM audit_events
+       WHERE event_id = ?
+    `).get(planned.eventId);
+        if (existing !== undefined) {
+            if (existing.entry_id !== planned.entryId
+                || existing.workspace !== workspace
+                || existing.operation !== planned.operation
+                || existing.actor !== planned.actor
+                || existing.details_json !== planned.detailsJson
+                || existing.created_at !== planned.createdAt) {
+                throw new KiokukoError('CONFLICT', `Audit event ${planned.eventId} already contains different metadata`);
+            }
+            continue;
+        }
+        audit.push(planned);
+    }
+    return { links, audit };
 }
-export async function importWorkspace(database, options) {
-    const parsed = parseImport(await readFile(options.input, 'utf8'));
+export async function importWorkspace(database, options, dependencies = {}) {
+    const archiveBytes = await readBoundedArchive(inputPathValue(options.input), dependencies);
+    validateWorkspaceArchiveByteLayout(archiveBytes);
+    if (archiveBytes[0] === 0xEF && archiveBytes[1] === 0xBB && archiveBytes[2] === 0xBF) {
+        throw new KiokukoError('VALIDATION_ERROR', 'Import must not begin with a UTF-8 BOM');
+    }
+    let archiveText;
+    try {
+        archiveText = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(archiveBytes);
+    }
+    catch {
+        throw new KiokukoError('VALIDATION_ERROR', 'Import is not valid UTF-8');
+    }
+    const parsed = parseImport(archiveText);
     const sourceWorkspace = requireWorkspace(parsed.manifest.workspace);
-    const workspace = requireWorkspace(options.workspace ?? sourceWorkspace);
+    const workspace = requireWorkspace(options.workspace === undefined ? sourceWorkspace : stringValue(options.workspace, 'workspace'));
+    rejectSecretValue(workspace);
     const tagsByEntry = new Map();
     for (const tag of parsed.tags) {
         const entryId = stringValue(tag.entry_id, 'tag.entry_id');
@@ -206,40 +677,33 @@ export async function importWorkspace(database, options) {
     const sourceIds = new Set(entries.map((entry) => entry.id));
     if (sourceIds.size !== entries.length)
         throw new KiokukoError('VALIDATION_ERROR', 'Import contains duplicate entry IDs');
+    if (new Set(entries.map((entry) => entry.contentHash)).size !== entries.length) {
+        throw new KiokukoError('VALIDATION_ERROR', 'Import contains duplicate entry content');
+    }
+    validateSupersessionGraph(entries);
     validateRelatedLines(parsed, sourceIds);
     if (database === undefined && !options.dryRun)
         throw new KiokukoError('DATABASE_ERROR', 'Database is required for a non-dry import');
-    const idMap = new Map();
-    const newEntries = [];
-    let duplicates = 0;
-    for (const entry of entries) {
-        if (!database) {
-            idMap.set(entry.id, entry.id);
-            newEntries.push(entry);
-            continue;
-        }
-        const byId = existingEntry(database, entry.id);
-        if (byId) {
-            if (byId.content_hash !== entry.contentHash)
-                throw new KiokukoError('CONFLICT', `Entry ID ${entry.id} already contains different content`);
-            idMap.set(entry.id, entry.id);
-            duplicates += 1;
-            continue;
-        }
-        const byHash = database.prepare('SELECT entry_id AS id FROM entry_revisions WHERE workspace = ? AND content_hash = ? LIMIT 1').get(workspace, entry.contentHash);
-        if (byHash) {
-            idMap.set(entry.id, byHash.id);
-            duplicates += 1;
-            continue;
-        }
-        idMap.set(entry.id, entry.id);
-        newEntries.push(entry);
-    }
     if (options.dryRun) {
-        return { count: entries.length, imported: newEntries.length, duplicates, dryRun: true, workspace };
+        const preflight = () => {
+            const entryPlan = planEntryImport(database, entries, workspace);
+            planRelatedImport(database, parsed, workspace);
+            return entryPlan;
+        };
+        const plan = database === undefined ? preflight() : withDeferredReadTransaction(database, preflight);
+        return {
+            count: entries.length,
+            imported: plan.newEntries.length,
+            duplicates: plan.duplicates,
+            dryRun: true,
+            workspace,
+        };
     }
     const db = database;
-    withImmediateTransaction(db, () => {
+    const result = withImmediateTransaction(db, () => {
+        const plan = planEntryImport(db, entries, workspace);
+        const related = planRelatedImport(db, parsed, workspace);
+        const { newEntries } = plan;
         const insertEntry = db.prepare(`
       INSERT INTO entries (
         id, workspace, status, trust_level, confidence, current_revision,
@@ -247,7 +711,7 @@ export async function importWorkspace(database, options) {
       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     `);
         for (const entry of newEntries) {
-            insertEntry.run(entry.id, workspace, entry.status, entry.trustLevel, entry.confidence, 1, entry.supersededBy === null ? null : idMap.get(entry.supersededBy) ?? entry.supersededBy, entry.createdBy, entry.createdAt, entry.updatedAt, entry.verifiedAt);
+            insertEntry.run(entry.id, workspace, 'candidate', entry.trustLevel, entry.confidence, 1, null, entry.createdBy, entry.createdAt, entry.updatedAt, null);
             insertEntryRevisionInTransaction(db, {
                 entryId: entry.id,
                 workspace,
@@ -256,8 +720,8 @@ export async function importWorkspace(database, options) {
                 title: entry.title,
                 body: entry.body,
                 summary: entry.summary,
-                scope: JSON.parse(entry.scopeJson),
-                provenance: JSON.parse(entry.provenanceJson),
+                scope: entry.scope,
+                provenance: entry.provenance,
                 tags: entry.tags,
                 contentHash: entry.contentHash,
                 createdBy: entry.createdBy,
@@ -269,24 +733,39 @@ export async function importWorkspace(database, options) {
                 body: entry.body,
                 summary: entry.summary,
                 tags: entry.tags,
-                scope: JSON.parse(entry.scopeJson),
+                scope: entry.scope,
             });
         }
+        const applyLifecycle = db.prepare(`
+      UPDATE entries
+         SET status = ?, superseded_by = ?, verified_at = ?
+       WHERE id = ? AND workspace = ? AND current_revision = 1
+    `);
+        for (const entry of newEntries) {
+            applyLifecycle.run(entry.status, entry.supersededBy, entry.verifiedAt, entry.id, workspace);
+        }
         const insertLink = db.prepare(`
-      INSERT OR IGNORE INTO entry_links (from_entry_id, to_entry_id, relation, created_at, created_by)
+      INSERT INTO entry_links (from_entry_id, to_entry_id, relation, created_at, created_by)
       VALUES (?, ?, ?, ?, ?)
     `);
-        for (const link of parsed.links) {
-            insertLink.run(idMap.get(String(link.from_entry_id)) ?? String(link.from_entry_id), idMap.get(String(link.to_entry_id)) ?? String(link.to_entry_id), String(link.relation), String(link.created_at), String(link.created_by));
+        for (const link of related.links) {
+            insertLink.run(link.from, link.to, link.relation, link.createdAt, link.createdBy);
         }
         const insertAudit = db.prepare(`
-      INSERT OR IGNORE INTO audit_events (event_id, entry_id, workspace, operation, actor, details_json, created_at)
+      INSERT INTO audit_events (event_id, entry_id, workspace, operation, actor, details_json, created_at)
       VALUES (?, ?, ?, ?, ?, ?, ?)
     `);
-        for (const event of parsed.audit) {
-            insertAudit.run(String(event.event_id), event.entry_id === null || event.entry_id === undefined ? null : idMap.get(String(event.entry_id)) ?? String(event.entry_id), workspace, String(event.operation), String(event.actor), String(event.details_json), String(event.created_at));
+        for (const event of related.audit) {
+            insertAudit.run(event.eventId, event.entryId, workspace, event.operation, event.actor, event.detailsJson, event.createdAt);
         }
+        return plan;
     });
-    return { count: entries.length, imported: newEntries.length, duplicates, dryRun: false, workspace };
+    return {
+        count: entries.length,
+        imported: result.newEntries.length,
+        duplicates: result.duplicates,
+        dryRun: false,
+        workspace,
+    };
 }
 //# sourceMappingURL=import.js.map