@code-yeongyu/senpi 2026.10.18 → 2026.10.19

package/dist/core/session-manager.js

@@ -15,6 +15,7 @@ import { loadEntriesFromFile, loadEntriesFromFileAsync, parseSessionEntryLine, t
 import { materializeSessionEntries } from "./session-entry-materializer.js";
 import { replaceFileAtomically } from "./session-file-replace.js";
 import { planLoadedTail } from "./session-loaded-tail.js";
+import { SessionWriteGuard } from "./session-move/write-guard.js";
 import { ResidentStringStore } from "./session-resident-store.js";
 import { discardFailedFirstFlush, discardFailedFirstFlushAsync, truncateToLastCompleteLine, } from "./session-write-recovery.js";
 import { hasOtherLiveSessionWriter, registerSessionWriter, reserveSessionWrite, unregisterSessionWriter, } from "./session-write-reservation.js";
@@ -677,6 +678,7 @@ function isConversationEntry(entry) {
 export class SessionManager {
     constructor(cwd, sessionDir, sessionFile, persist, newSessionOptions, preloadedFileEntries) {
         this.sessionId = "";
+        this.writeGuard = new SessionWriteGuard();
         this.flushed = false;
         // Set when an append to the flushed file failed and may have left a partial last line.
         this.tailMayBeTorn = false;
@@ -874,7 +876,7 @@ export class SessionManager {
         // the JSONL is the authority for every entry and this store rewrites what it
         // evicts, so clearing them bounds the directory to one process lifetime.
         this._releaseBlobsDirUnlessShared();
-        if (migrateToCurrentVersion(this.fileEntries)) {
+        if (migrateToCurrentVersion(this.fileEntries) && this.writeGuard.isWritable(this.fileEntries)) {
             this._rewriteFile();
         }
         return true;
@@ -1034,6 +1036,7 @@ export class SessionManager {
     _rewriteFile() {
         if (!this.persist || !this.sessionFile)
             return;
+        this.writeGuard.assertRewritable(this.fileEntries, this.sessionFile);
         reserveSessionWrite(this.sessionFile);
         replaceFileAtomically(this.sessionFile, this._serializedFileEntries());
     }
@@ -1162,6 +1165,7 @@ export class SessionManager {
     _persist(entry) {
         if (!this.persist || !this.sessionFile)
             return;
+        this.writeGuard.assertWritable(this.fileEntries, entry, this.sessionFile);
         reserveSessionWrite(this.sessionFile);
         const persistedEntry = this.residentStore.materialize(entry);
         if (this.flushed) {

package/dist/core/session-move/bundle.d.ts

@@ -0,0 +1,39 @@
+import { type RepositoryIdentity } from "../repository-identity.ts";
+import type { MoveId } from "./ownership.ts";
+export declare const MOVE_BUNDLE_FORMAT = 1;
+export declare const MANIFEST_FILE = "manifest.json";
+export declare const SESSION_BUNDLE_PATH = "files/session.jsonl";
+export interface BundleFile {
+    readonly path: string;
+    readonly sha256: string;
+}
+/**
+ * Optional extra payloads travel next to the session without changing its shape. Phase 1 defines none; a later
+ * whole-folder transfer adds its own kind here, and an importer that does not know a kind refuses the bundle.
+ */
+export interface MovePayload {
+    readonly kind: string;
+    readonly files: readonly BundleFile[];
+}
+export interface MoveManifest {
+    readonly format: typeof MOVE_BUNDLE_FORMAT;
+    readonly moveId: MoveId;
+    readonly sessionId: string;
+    readonly sessionFileName: string;
+    readonly sourceCwd: string;
+    readonly repository: RepositoryIdentity | undefined;
+    readonly session: BundleFile;
+    readonly sidecars: readonly BundleFile[];
+    readonly droppedUserMessages: readonly string[];
+    readonly payloads: readonly MovePayload[];
+}
+export declare class MoveBundleInvalidError extends Error {
+    readonly code = "move_bundle_invalid";
+    constructor(detail: string);
+}
+export declare function sha256File(path: string): string;
+export declare function parsePlainId(value: unknown, what: string): string;
+export declare function parseMoveId(value: unknown): MoveId;
+export declare function readManifest(bundleDir: string): MoveManifest;
+export declare function verifyBundle(bundleDir: string, manifest: MoveManifest): void;
+//# sourceMappingURL=bundle.d.ts.map

package/dist/core/session-move/bundle.js

@@ -0,0 +1,108 @@
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { join, posix, win32 } from "node:path";
+import { parseRepositoryIdentity } from "../repository-identity.js";
+export const MOVE_BUNDLE_FORMAT = 1;
+export const MANIFEST_FILE = "manifest.json";
+export const SESSION_BUNDLE_PATH = "files/session.jsonl";
+export class MoveBundleInvalidError extends Error {
+    constructor(detail) {
+        super(`The moved session could not be verified (${detail}); it was not imported. The original device keeps it.`);
+        this.code = "move_bundle_invalid";
+        this.name = "MoveBundleInvalidError";
+    }
+}
+export function sha256File(path) {
+    return createHash("sha256").update(readFileSync(path)).digest("hex");
+}
+const isString = (value) => typeof value === "string";
+/** Both separators count: a bundle written on one OS is read on another. */
+function leavesBundle(path) {
+    return posix.isAbsolute(path) || win32.isAbsolute(path) || path.split(/[\\/]/).includes("..");
+}
+function parseFile(value) {
+    const file = value;
+    if (typeof file !== "object" || file === null || !isString(file.path) || !isString(file.sha256))
+        throw new MoveBundleInvalidError("a listed file is malformed");
+    if (leavesBundle(file.path))
+        throw new MoveBundleInvalidError(`a listed path leaves the bundle: ${file.path}`);
+    return { path: file.path, sha256: file.sha256 };
+}
+/**
+ * Move ids and session ids become folder and file names (staging folder, ledger record, resident blobs), so they
+ * must be plain ids: a letter or digit first (never `.` or `..`), then letters, digits, `.`, `_`, `-`, at most 128.
+ */
+const PLAIN_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+export function parsePlainId(value, what) {
+    if (typeof value !== "string" || !PLAIN_ID.test(value))
+        throw new MoveBundleInvalidError(`the ${what} is not a plain id: ${JSON.stringify(value)}`);
+    return value;
+}
+export function parseMoveId(value) {
+    return parsePlainId(value, "move id");
+}
+/** The importer joins this name onto its session folder, so it must be a plain session file name and nothing else. */
+const SESSION_FILE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*\.jsonl$/;
+function parseSessionFileName(value) {
+    if (!SESSION_FILE_NAME.test(value) || value.includes(".."))
+        throw new MoveBundleInvalidError(`the session file name is not a plain file name: ${value}`);
+    return value;
+}
+export function readManifest(bundleDir) {
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(join(bundleDir, MANIFEST_FILE), "utf8"));
+    }
+    catch (error) {
+        throw new MoveBundleInvalidError(`manifest unreadable: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const m = raw;
+    if (m.format !== MOVE_BUNDLE_FORMAT)
+        throw new MoveBundleInvalidError(`unknown bundle format ${String(m.format)}`);
+    for (const key of ["moveId", "sessionId", "sessionFileName", "sourceCwd"]) {
+        if (!isString(m[key]))
+            throw new MoveBundleInvalidError(`missing ${key}`);
+    }
+    const payloads = Array.isArray(m.payloads) ? m.payloads : [];
+    if (payloads.length > 0)
+        throw new MoveBundleInvalidError("it carries a payload this version cannot import");
+    const dropped = Array.isArray(m.droppedUserMessages) ? m.droppedUserMessages : [];
+    if (!dropped.every(isString))
+        throw new MoveBundleInvalidError("malformed queued input");
+    return {
+        format: MOVE_BUNDLE_FORMAT,
+        moveId: parseMoveId(m.moveId),
+        sessionId: parsePlainId(m.sessionId, "session id"),
+        sessionFileName: parseSessionFileName(m.sessionFileName),
+        sourceCwd: m.sourceCwd,
+        repository: parseRepositoryIdentity(m.repository),
+        session: parseFile(m.session),
+        sidecars: (Array.isArray(m.sidecars) ? m.sidecars : []).map(parseFile),
+        droppedUserMessages: dropped,
+        payloads: [],
+    };
+}
+export function verifyBundle(bundleDir, manifest) {
+    for (const file of [manifest.session, ...manifest.sidecars]) {
+        let actual;
+        try {
+            actual = sha256File(join(bundleDir, file.path));
+        }
+        catch {
+            throw new MoveBundleInvalidError(`missing ${file.path}`);
+        }
+        if (actual !== file.sha256)
+            throw new MoveBundleInvalidError(`${file.path} changed in transit`);
+    }
+    const header = readFileSync(join(bundleDir, manifest.session.path), "utf8").split("\n", 1)[0] ?? "";
+    let id;
+    try {
+        id = JSON.parse(header).id;
+    }
+    catch {
+        id = undefined;
+    }
+    if (id !== manifest.sessionId)
+        throw new MoveBundleInvalidError("the session file's own id does not match the bundle's session id");
+}
+//# sourceMappingURL=bundle.js.map

package/dist/core/session-move/export.d.ts

@@ -0,0 +1,18 @@
+import { type MoveManifest } from "./bundle.ts";
+import { type MoveId } from "./ownership.ts";
+export interface ExportSessionForMoveOptions {
+    /** A session no live runtime holds: an RPC host releases it first (`release_session` reason `move`). */
+    readonly sessionFile: string;
+    readonly moveId: MoveId;
+    readonly target: string;
+    /** Queued user input the release took out of the session (`dropped.user_messages`), in order. */
+    readonly droppedUserMessages: readonly string[];
+    readonly bundleDir: string;
+}
+/**
+ * Seals the session for the move (a `session_released` entry with reason `move`; from then on this device refuses
+ * writes) and writes a self-verifying bundle: the session file, its extension sidecars and resident blobs, and a
+ * manifest. Running it again for the same move rewrites the same bundle without a second release entry.
+ */
+export declare function exportSessionForMove(options: ExportSessionForMoveOptions): Promise<MoveManifest>;
+//# sourceMappingURL=export.d.ts.map

package/dist/core/session-move/export.js

@@ -0,0 +1,83 @@
+import { copyFileSync, existsSync, mkdirSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { basename, dirname, join, relative } from "node:path";
+import { SessionHeldError } from "../session-hold-errors.js";
+import { liveSessionHolders } from "../session-holders.js";
+import { loadEntriesFromFile, SessionManager } from "../session-manager.js";
+import { readRecordedRepositoryIdentity, readSessionCwd } from "../session-rebind.js";
+import { encodedSessionId } from "../session-sidecar-store.js";
+import { MANIFEST_FILE, MOVE_BUNDLE_FORMAT, parseMoveId, SESSION_BUNDLE_PATH, sha256File, } from "./bundle.js";
+import { headerSessionId, SESSION_RELEASED, SessionMovedAwayError, sessionOwnership, } from "./ownership.js";
+/**
+ * Seals the session for the move (a `session_released` entry with reason `move`; from then on this device refuses
+ * writes) and writes a self-verifying bundle: the session file, its extension sidecars and resident blobs, and a
+ * manifest. Running it again for the same move rewrites the same bundle without a second release entry.
+ */
+export async function exportSessionForMove(options) {
+    const { sessionFile } = options;
+    const moveId = parseMoveId(options.moveId);
+    const entries = loadEntriesFromFile(sessionFile);
+    const sessionId = headerSessionId(entries) ?? "";
+    // A live runtime could still write the transcript, its sidecars or its resident blobs after the seal.
+    const holders = await liveSessionHolders(sessionFile, sessionId);
+    if (holders.length > 0)
+        throw new SessionHeldError(sessionFile, holders);
+    const ownership = sessionOwnership(entries);
+    if (!ownership.writable && !(ownership.state === "moving" && ownership.moveId === moveId)) {
+        throw new SessionMovedAwayError(sessionFile, ownership);
+    }
+    if (ownership.writable) {
+        SessionManager.open(sessionFile).appendCustomEntry(SESSION_RELEASED, {
+            reason: "move",
+            move_id: moveId,
+            session_id: sessionId,
+            target: options.target,
+            released_at: new Date().toISOString(),
+        });
+    }
+    const staging = `${options.bundleDir}.partial-${process.pid}`;
+    rmSync(staging, { recursive: true, force: true });
+    mkdirSync(join(staging, dirname(SESSION_BUNDLE_PATH)), { recursive: true });
+    copyFileSync(sessionFile, join(staging, SESSION_BUNDLE_PATH));
+    const sidecars = copySidecars(dirname(sessionFile), sessionId, staging);
+    const manifest = {
+        format: MOVE_BUNDLE_FORMAT,
+        moveId,
+        sessionId,
+        sessionFileName: basename(sessionFile),
+        sourceCwd: readSessionCwd(sessionFile) ?? "",
+        repository: readRecordedRepositoryIdentity(sessionFile),
+        session: { path: SESSION_BUNDLE_PATH, sha256: sha256File(join(staging, SESSION_BUNDLE_PATH)) },
+        sidecars,
+        droppedUserMessages: [...options.droppedUserMessages],
+        payloads: [],
+    };
+    writeFileSync(join(staging, MANIFEST_FILE), `${JSON.stringify(manifest, null, 1)}\n`);
+    rmSync(options.bundleDir, { recursive: true, force: true });
+    renameSync(staging, options.bundleDir);
+    return manifest;
+}
+function copySidecars(sessionDir, sessionId, staging) {
+    const sources = [];
+    const extensions = join(sessionDir, "extensions");
+    const sidecarName = `${encodedSessionId(sessionId)}.json`;
+    if (existsSync(extensions)) {
+        for (const extension of readdirSync(extensions, { withFileTypes: true })) {
+            const file = join(extensions, extension.name, sidecarName);
+            if (extension.isDirectory() && existsSync(file))
+                sources.push(file);
+        }
+    }
+    sources.push(...filesUnder(join(sessionDir, "resident-blobs", sessionId)));
+    return sources.map((source) => {
+        const path = join("files", relative(sessionDir, source));
+        mkdirSync(dirname(join(staging, path)), { recursive: true });
+        copyFileSync(source, join(staging, path));
+        return { path, sha256: sha256File(join(staging, path)) };
+    });
+}
+function filesUnder(dir) {
+    if (!existsSync(dir))
+        return [];
+    return readdirSync(dir, { withFileTypes: true }).flatMap((entry) => entry.isDirectory() ? filesUnder(join(dir, entry.name)) : [join(dir, entry.name)]);
+}
+//# sourceMappingURL=export.js.map

package/dist/core/session-move/finish.d.ts

@@ -0,0 +1,24 @@
+import type { MoveStatus } from "./move-ledger.ts";
+import { type MoveId } from "./ownership.ts";
+export interface FinishMoveOptions {
+    readonly sessionFile: string;
+    /** The bundle this device kept while the move was open; it holds the input the release took out. */
+    readonly bundleDir: string;
+    /** The move the answer is about; the bundle and the file must be about the same move. */
+    readonly moveId: MoveId;
+    /** The receiver's signed answer. `receiving` changes nothing: the move is still open. */
+    readonly answer: MoveStatus;
+}
+export declare class MoveMismatchError extends Error {
+    readonly code = "move_mismatch";
+    constructor(expected: MoveId, found: string, what: string);
+}
+/**
+ * Closes a move on the sending device from the receiver's answer. `accepted` records `session_moved` (read-only for
+ * good). `declined`/`failed` takes the session back: `session_reclaimed` makes the file writable, the queued input
+ * is re-queued under ids stable per move, then the bundle goes. While the bundle exists the re-queue runs again on
+ * the next call, so a crash between any two steps loses nothing and doubles nothing.
+ */
+export declare function finishMove(options: FinishMoveOptions): Promise<void>;
+export declare function requeueDroppedInput(sessionFile: string, bundleDir: string): Promise<void>;
+//# sourceMappingURL=finish.d.ts.map

package/dist/core/session-move/finish.js

@@ -0,0 +1,81 @@
+import { existsSync, rmSync } from "node:fs";
+import { loadEntriesFromFile, SessionManager } from "../session-manager.js";
+import { readManifest } from "./bundle.js";
+import { headerSessionId, SESSION_MOVED, SESSION_RECLAIMED, sessionOwnership } from "./ownership.js";
+import { requeueInput } from "./requeue.js";
+export class MoveMismatchError extends Error {
+    constructor(expected, found, what) {
+        super(`The answer is about move ${expected}, but ${what} belongs to move ${found}; nothing was changed. Finish each move with its own answer and bundle.`);
+        this.code = "move_mismatch";
+        this.name = "MoveMismatchError";
+    }
+}
+/**
+ * Closes a move on the sending device from the receiver's answer. `accepted` records `session_moved` (read-only for
+ * good). `declined`/`failed` takes the session back: `session_reclaimed` makes the file writable, the queued input
+ * is re-queued under ids stable per move, then the bundle goes. While the bundle exists the re-queue runs again on
+ * the next call, so a crash between any two steps loses nothing and doubles nothing.
+ */
+export async function finishMove(options) {
+    const { sessionFile, bundleDir, moveId, answer } = options;
+    if (existsSync(bundleDir)) {
+        const bundled = readManifest(bundleDir).moveId;
+        if (bundled !== moveId)
+            throw new MoveMismatchError(moveId, bundled, "the kept bundle");
+    }
+    const entries = loadEntriesFromFile(sessionFile);
+    const ownership = sessionOwnership(entries);
+    if (ownership.writable) {
+        if (reclaimed(entries, moveId))
+            await requeueDroppedInput(sessionFile, bundleDir);
+        rmSync(bundleDir, { recursive: true, force: true });
+        return;
+    }
+    if (ownership.moveId !== moveId)
+        throw new MoveMismatchError(moveId, ownership.moveId, "the session file");
+    if (ownership.state === "moved") {
+        rmSync(bundleDir, { recursive: true, force: true });
+        return;
+    }
+    const sessionId = headerSessionId(entries) ?? "";
+    switch (answer.state) {
+        case "receiving":
+            return;
+        case "accepted":
+            SessionManager.open(sessionFile).appendCustomEntry(SESSION_MOVED, {
+                move_id: moveId,
+                session_id: sessionId,
+                target: ownership.target,
+                moved_at: new Date().toISOString(),
+            });
+            break;
+        case "declined":
+        case "failed":
+            SessionManager.open(sessionFile).appendCustomEntry(SESSION_RECLAIMED, {
+                move_id: moveId,
+                session_id: sessionId,
+                reason: answer.state,
+                detail: answer.reason,
+                reclaimed_at: new Date().toISOString(),
+            });
+            await requeueDroppedInput(sessionFile, bundleDir);
+            break;
+        default: {
+            const unreachable = answer;
+            throw new Error(`Unknown move answer ${JSON.stringify(unreachable)}`);
+        }
+    }
+    rmSync(bundleDir, { recursive: true, force: true });
+}
+function reclaimed(entries, moveId) {
+    return entries.some((entry) => entry.type === "custom" &&
+        entry.customType === SESSION_RECLAIMED &&
+        entry.data?.move_id === moveId);
+}
+export async function requeueDroppedInput(sessionFile, bundleDir) {
+    if (!existsSync(bundleDir))
+        return;
+    const manifest = readManifest(bundleDir);
+    await requeueInput(sessionFile, manifest.moveId, manifest.droppedUserMessages);
+}
+//# sourceMappingURL=finish.js.map

package/dist/core/session-move/import.d.ts

@@ -0,0 +1,32 @@
+import { type RepositoryIdentity } from "../repository-identity.ts";
+import { type MoveLedger, type MoveStatus } from "./move-ledger.ts";
+import { type MoveId } from "./ownership.ts";
+export interface ImportMovedSessionOptions {
+    readonly bundleDir: string;
+    readonly targetCwd: string;
+    readonly ledger: MoveLedger;
+    readonly sessionDir?: string;
+    readonly from?: string;
+    readonly readIdentity?: (dir: string) => Promise<RepositoryIdentity | undefined>;
+}
+export declare class MoveRefusedError extends Error {
+    readonly code: "move_repository_mismatch";
+    constructor(targetCwd: string, sourceCwd: string);
+}
+export declare class MoveTargetOccupiedError extends Error {
+    readonly code = "move_target_occupied";
+    constructor(target: string);
+}
+/** The sender's question, answered with the session file as the authority: a committed import is accepted. */
+export declare function answerMoveStatus(ledger: MoveLedger, moveId: MoveId, sessionFile: string | undefined): Promise<MoveStatus>;
+/**
+ * Brings a moved session in. The bundle is verified, the folder must be the same repository (the `--rebind` rule),
+ * and everything is assembled in a staging folder: the session file gains its queued input back and then
+ * `session_moved_in`, so the rename into the session directory, run under the move's ledger lock, is the single
+ * commit point. A read-only copy of the same session already here (it moved away earlier) is replaced; a writable
+ * one is refused. Importing a bundle already imported returns the session without changing it.
+ */
+export declare function importMovedSession(options: ImportMovedSessionOptions): Promise<{
+    readonly sessionFile: string;
+}>;
+//# sourceMappingURL=import.d.ts.map

package/dist/core/session-move/import.js

@@ -0,0 +1,124 @@
+import { copyFileSync, existsSync, mkdirSync, readdirSync, rmSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { normalizePath, resolvePath } from "../../utils/paths.js";
+import { compareRepositoryIdentities, readRepositoryIdentity, } from "../repository-identity.js";
+import { getDefaultSessionDir, loadEntriesFromFile, SessionManager } from "../session-manager.js";
+import { rebindSessionFile } from "../session-rebind.js";
+import { encodedSessionId } from "../session-sidecar-store.js";
+import { MoveBundleInvalidError, readManifest, verifyBundle } from "./bundle.js";
+import { MoveFencedError } from "./move-ledger.js";
+import { headerSessionId, SESSION_MOVED_IN, sessionOwnership } from "./ownership.js";
+import { requeueInput } from "./requeue.js";
+export class MoveRefusedError extends Error {
+    constructor(targetCwd, sourceCwd) {
+        super(`${targetCwd} is not the same repository the session was recorded in (${sourceCwd}). Pick a checkout of the same repository, or copy the session into this folder instead.`);
+        this.name = "MoveRefusedError";
+        this.code = "move_repository_mismatch";
+    }
+}
+export class MoveTargetOccupiedError extends Error {
+    constructor(target) {
+        super(`A session that can still be written already sits at ${target}; the moved session was not imported over it. Close or move that session first, then send it again.`);
+        this.code = "move_target_occupied";
+        this.name = "MoveTargetOccupiedError";
+    }
+}
+const movedInFor = (file, moveId) => loadEntriesFromFile(file).some((entry) => entry.type === "custom" &&
+    entry.customType === SESSION_MOVED_IN &&
+    entry.data?.move_id === moveId);
+/** The sender's question, answered with the session file as the authority: a committed import is accepted. */
+export function answerMoveStatus(ledger, moveId, sessionFile) {
+    const movedIn = sessionFile !== undefined && existsSync(sessionFile) && movedInFor(sessionFile, moveId);
+    return ledger.answerStatus(moveId, { movedIn });
+}
+/**
+ * Brings a moved session in. The bundle is verified, the folder must be the same repository (the `--rebind` rule),
+ * and everything is assembled in a staging folder: the session file gains its queued input back and then
+ * `session_moved_in`, so the rename into the session directory, run under the move's ledger lock, is the single
+ * commit point. A read-only copy of the same session already here (it moved away earlier) is replaced; a writable
+ * one is refused. Importing a bundle already imported returns the session without changing it.
+ */
+export async function importMovedSession(options) {
+    const manifest = readManifest(options.bundleDir);
+    const targetCwd = resolvePath(options.targetCwd);
+    const sessionDir = options.sessionDir ? normalizePath(options.sessionDir) : getDefaultSessionDir(targetCwd);
+    const target = join(sessionDir, manifest.sessionFileName);
+    if (existsSync(target) && movedInFor(target, manifest.moveId)) {
+        // The rename already committed; a crash may have lost the ledger write, and the file is the authority.
+        await options.ledger.commit(manifest.moveId, () => undefined);
+        return { sessionFile: target };
+    }
+    try {
+        verifyBundle(options.bundleDir, manifest);
+    }
+    catch (error) {
+        if (error instanceof MoveBundleInvalidError)
+            await options.ledger.fail(manifest.moveId, "bundle_invalid");
+        throw error;
+    }
+    const read = options.readIdentity ?? readRepositoryIdentity;
+    if (compareRepositoryIdentities(manifest.repository, await read(targetCwd)) !== "same") {
+        await options.ledger.decline(manifest.moveId, "repository");
+        throw new MoveRefusedError(targetCwd, manifest.sourceCwd);
+    }
+    await options.ledger.beginReceive(manifest.moveId);
+    const staging = join(sessionDir, ".move-staging", encodeURIComponent(manifest.moveId));
+    try {
+        const staged = await stage(options.bundleDir, manifest, staging, options.from ?? "");
+        const sessionFile = await options.ledger.commit(manifest.moveId, () => {
+            replacePredecessor(target, manifest.sessionId, sessionDir);
+            return rebindSessionFile(staged, targetCwd, sessionDir);
+        });
+        rmSync(staging, { recursive: true, force: true });
+        return { sessionFile };
+    }
+    catch (error) {
+        if (!(error instanceof MoveFencedError))
+            await options.ledger.fail(manifest.moveId, "import_failed");
+        throw error;
+    }
+}
+/**
+ * Only a read-only copy of the same session may be replaced; its sidecars go too so the moved ones take their place.
+ * It is removed before the rename: if the rename then fails, the move is recorded `import_failed`, the sender takes
+ * the session back, and nothing writable was lost here (the removed copy could not be written).
+ */
+function replacePredecessor(target, sessionId, sessionDir) {
+    if (!existsSync(target))
+        return;
+    const entries = loadEntriesFromFile(target);
+    if (headerSessionId(entries) !== sessionId || sessionOwnership(entries).writable) {
+        throw new MoveTargetOccupiedError(target);
+    }
+    const extensions = join(sessionDir, "extensions");
+    if (existsSync(extensions)) {
+        for (const extension of readdirSync(extensions, { withFileTypes: true })) {
+            if (extension.isDirectory())
+                rmSync(join(extensions, extension.name, `${encodedSessionId(sessionId)}.json`), { force: true });
+        }
+    }
+    rmSync(join(sessionDir, "resident-blobs", sessionId), { recursive: true, force: true });
+    rmSync(target, { force: true });
+}
+async function stage(bundleDir, manifest, staging, from) {
+    const file = join(staging, manifest.sessionFileName);
+    if (!(existsSync(file) && movedInFor(file, manifest.moveId))) {
+        rmSync(staging, { recursive: true, force: true });
+        for (const item of [manifest.session, ...manifest.sidecars]) {
+            const to = item === manifest.session ? file : join(staging, item.path.replace(/^files\//, ""));
+            mkdirSync(dirname(to), { recursive: true });
+            copyFileSync(join(bundleDir, item.path), to);
+        }
+        SessionManager.open(file, staging).appendCustomEntry(SESSION_MOVED_IN, {
+            move_id: manifest.moveId,
+            session_id: manifest.sessionId,
+            from,
+            bundle_sha256: manifest.session.sha256,
+            moved_in_at: new Date().toISOString(),
+        });
+    }
+    // Ids are stable per move, so a staging pass that crashed after some of these replays them instead of doubling.
+    await requeueInput(file, manifest.moveId, manifest.droppedUserMessages);
+    return file;
+}
+//# sourceMappingURL=import.js.map

package/dist/core/session-move/move-ledger.d.ts

@@ -0,0 +1,47 @@
+import type { MoveId } from "./ownership.ts";
+/**
+ * The receiving device's record of every move it was offered. Asking about a move is itself a fence: a move this
+ * device never heard of is recorded as declined BEFORE the answer leaves, so a later import of it is refused and the
+ * sender may safely take its session back. Every writer and the import's final rename share one lock per move.
+ */
+export type DeclineReason = "no_record" | "expired" | "cancelled" | "chunk_without_ready" | "repository";
+export type FailReason = "bundle_invalid" | "import_failed";
+export type MoveRecord = {
+    readonly state: "receiving";
+} | {
+    readonly state: "accepted";
+} | {
+    readonly state: "declined";
+    readonly reason: DeclineReason;
+} | {
+    readonly state: "failed";
+    readonly reason: FailReason;
+};
+export type MoveStatus = MoveRecord;
+export declare class MoveFencedError extends Error {
+    readonly code = "move_fenced";
+    readonly record: MoveRecord;
+    constructor(moveId: MoveId, record: MoveRecord);
+}
+export declare class MoveLedger {
+    readonly dir: string;
+    constructor(dir: string);
+    /** Starts receiving a move; refused once the move was answered with anything but `receiving`. */
+    beginReceive(moveId: MoveId): Promise<void>;
+    /** The signed answer a sender gets; `movedIn` is whether the session file here already records the move. */
+    answerStatus(moveId: MoveId, here: {
+        readonly movedIn: boolean;
+    }): Promise<MoveStatus>;
+    /** Cancel, expiry or a refused chunk: only before the bundle was verified and receiving began, never after. */
+    decline(moveId: MoveId, reason: DeclineReason): Promise<MoveRecord>;
+    /** A verified import that could not finish; it may end a receiving move but never an accepted one. */
+    fail(moveId: MoveId, reason: FailReason): Promise<MoveRecord>;
+    /** Runs the import's commit (the atomic rename) under the move's lock, then records it accepted. */
+    commit<T>(moveId: MoveId, rename: () => T | Promise<T>): Promise<T>;
+    private settle;
+    private path;
+    private read;
+    private write;
+    private locked;
+}
+//# sourceMappingURL=move-ledger.d.ts.map