@hawkeyexl/manni 1.1.1 → 2.0.1

package/dist/chunk-QLVNSAHR.js

@@ -0,0 +1,4492 @@
+#!/usr/bin/env node
+import {
+  DocmetaError,
+  ENCRYPTION_KEY_ENV,
+  FILE_SCHEMA_KEY,
+  KEYED_PIN_PREFIX,
+  LEGACY_CONFIG_NAMES,
+  META_CONTEXT,
+  PATH_JOIN,
+  STDIN_LABEL,
+  STDIN_TOKEN,
+  ToolError,
+  __export,
+  assertNonEmpty,
+  classifyRef,
+  committedKeyWarning,
+  decryptValue,
+  deepEqual,
+  encryptValue,
+  ensureEncryptionKey,
+  errorMessage,
+  escapePointerSegment,
+  escapeWorkflowCommandMessage,
+  escapeWorkflowCommandProperty,
+  externalMetadataJoin,
+  extractorByName,
+  extractorForExtension,
+  findConfigFile,
+  findFamilyConfigFile,
+  findGitRoot,
+  generateEncryptionKey,
+  gitignoreOptions,
+  integrityOf,
+  isEncryptedValue,
+  isErrorSeverity,
+  isIgnoredByGit,
+  isMember,
+  isValidEncryptionKey,
+  keyedPin,
+  loadExternalMetadata,
+  locateFrontmatter,
+  memberOf,
+  mergeExternalMetadata,
+  orphanEntries,
+  orphanError,
+  orphanJoins,
+  palette,
+  readConfigFile,
+  readFamilyConfigFile,
+  resolveBaselineRequest,
+  resolveEncryptionKey,
+  resolveTargetSet,
+  selectCollections,
+  settleBaseline,
+  supportedExtensions,
+  withValueAt,
+  writeEncryptionKey,
+  writeFileAtomic
+} from "./chunk-PDNSN5UJ.js";
+
+// src/meta/core/reencrypt.ts
+import { extname } from "node:path";
+var CITATIONS_KEY = "citations";
+var NOT_OURS = "does not decrypt under the current key";
+var READ_ONLY = "this format cannot be written";
+function reencryptMetadata(page, opts) {
+  const extractor = page.format !== void 0 ? extractorByName(page.format) : extractorForExtension(extname(page.file));
+  if (!extractor) {
+    throw new DocmetaError(
+      page.format !== void 0 ? `Unknown format "${page.format}" for "${page.file}".` : `Unsupported file type "${extname(page.file)}" for "${page.file}". Supported: ${supportedExtensions().join(", ")}.`
+    );
+  }
+  return reencryptWith(extractor, page, opts);
+}
+function tokensIn(data) {
+  const found = [];
+  const walk = (node, pointer, top) => {
+    if (isEncryptedValue(node)) {
+      found.push({ pointer, top, token: node });
+      return;
+    }
+    if (Array.isArray(node)) {
+      node.forEach((item, i) => {
+        walk(item, `${pointer}/${String(i)}`, top);
+      });
+      return;
+    }
+    if (typeof node === "object" && node !== null && !(node instanceof Date)) {
+      for (const [k, v] of Object.entries(node)) {
+        walk(v, `${pointer}/${escapePointerSegment(k)}`, top);
+      }
+    }
+  };
+  for (const [key, value] of Object.entries(data)) {
+    if (key === CITATIONS_KEY) continue;
+    walk(value, `/${escapePointerSegment(key)}`, key);
+  }
+  return found;
+}
+function reencryptData(data, opts) {
+  const writable = opts.writable ?? true;
+  const rewritten = [];
+  const skipped = [];
+  const found = tokensIn(data);
+  for (const { pointer, token } of found) {
+    const opened = decryptValue(token, opts.fromKey, META_CONTEXT);
+    if (opened.ok) {
+      if (!writable) {
+        skipped.push({ pointer, message: READ_ONLY });
+        continue;
+      }
+      rewritten.push({
+        pointer,
+        from: token,
+        to: encryptValue(opened.value, opts.toKey, META_CONTEXT)
+      });
+      continue;
+    }
+    if (decryptValue(token, opts.toKey, META_CONTEXT).ok) continue;
+    skipped.push({ pointer, message: NOT_OURS });
+  }
+  if (rewritten.length === 0) return { data, rewritten, skipped, keys: [] };
+  let next = data;
+  for (const r of rewritten) next = withValueAt(next, r.pointer, r.to);
+  const done = new Set(rewritten.map((r) => r.pointer));
+  const keys = [...new Set(found.filter((f) => done.has(f.pointer)).map((f) => f.top))];
+  return { data: next, rewritten, skipped, keys };
+}
+function reencryptWith(extractor, page, opts) {
+  const read = (content2) => {
+    try {
+      return extractor.extract(content2, page.file).data;
+    } catch (err) {
+      if (err instanceof DocmetaError) throw err;
+      throw new DocmetaError(`${page.file}: ${errorMessage(err)}`);
+    }
+  };
+  const data = read(page.content);
+  const apply2 = extractor.apply;
+  const plan = reencryptData(data, { ...opts, writable: apply2 !== void 0 });
+  const { rewritten, skipped } = plan;
+  if (rewritten.length === 0 || apply2 === void 0) {
+    return { content: page.content, rewritten: [], skipped };
+  }
+  const patch = {};
+  for (const top of plan.keys) patch[top] = plan.data[top];
+  const content = apply2(page.content, patch, { filePath: page.file });
+  const reread = tokensIn(read(content));
+  for (const r of rewritten) {
+    if (!reread.some((f) => f.pointer === r.pointer && f.token === r.to)) {
+      throw new DocmetaError(
+        `${page.file}: the ${extractor.name} writer did not keep ${r.pointer}; nothing was re-encrypted.`
+      );
+    }
+  }
+  return { content, rewritten, skipped };
+}
+
+// src/cite/index.ts
+var cite_exports = {};
+__export(cite_exports, {
+  CITATIONS_KEY: () => CITATIONS_KEY2,
+  CITE_RULES: () => CITE_RULES,
+  CITE_SECTION: () => CITE_SECTION,
+  CiteError: () => CiteError,
+  DEFAULT_CITE_BASELINE_PATH: () => DEFAULT_CITE_BASELINE_PATH,
+  DEFAULT_SEVERITY: () => DEFAULT_SEVERITY,
+  FILE_PATTERN: () => FILE_PATTERN,
+  GIT_UNAVAILABLE_COMMIT: () => GIT_UNAVAILABLE_COMMIT,
+  GIT_UNAVAILABLE_HISTORY: () => GIT_UNAVAILABLE_HISTORY,
+  MARKER_JSON: () => MARKER_JSON,
+  MAX_MARKERS_PER_PAGE: () => MAX_MARKERS_PER_PAGE,
+  MAX_RANGE_LINES: () => MAX_RANGE_LINES,
+  MOVE_BUDGET_BYTES: () => MOVE_BUDGET_BYTES,
+  MOVE_WINDOW_LINES: () => MOVE_WINDOW_LINES,
+  ManifestSet: () => ManifestSet,
+  RULE_ID_PREFIX: () => RULE_ID_PREFIX,
+  SRC_PATTERN: () => SRC_PATTERN,
+  anchoredLines: () => anchoredLines,
+  appendFrontmatterCitation: () => appendFrontmatterCitation,
+  blockMatches: () => blockMatches,
+  bodyLineOf: () => bodyLineOf,
+  buildSourceIndex: () => buildSourceIndex,
+  checkCitations: () => checkCitations,
+  claimEnd: () => claimEnd,
+  claimLine: () => claimLine,
+  claimMessageFor: () => claimMessageFor,
+  classifyCitation: () => classifyCitation,
+  detectEol: () => detectEol,
+  duplicateJoinRefusal: () => duplicateJoinRefusal,
+  entryObject: () => entryObject,
+  errorSite: () => errorSite,
+  fenceSpanAt: () => fenceSpanAt,
+  fencedBlockAfter: () => fencedBlockAfter,
+  fencedBlockAt: () => fencedBlockAt,
+  fencedBlocks: () => fencedBlocks,
+  findWindows: () => findWindows,
+  findingsFor: () => findingsFor,
+  formatSrc: () => formatSrc,
+  formatStatement: () => formatStatement,
+  gitClient: () => gitClient,
+  hashLines: () => hashLines,
+  hashRange: () => hashRange,
+  historyOf: () => historyOf,
+  insertStatementBefore: () => insertStatementBefore,
+  insideFence: () => insideFence,
+  isCiteRule: () => isCiteRule,
+  isKeyedPin: () => isKeyedPin,
+  itemLine: () => itemLine,
+  lineAt: () => lineAt,
+  lineSpec: () => lineSpec,
+  loadCitationSidecars: () => loadCitationSidecars,
+  loadCiteConfig: () => loadCiteConfig,
+  markerUnit: () => markerUnit,
+  messageFor: () => messageFor,
+  mintCitation: () => mintCitation,
+  noGit: () => noGit,
+  normalizeText: () => normalizeText,
+  normalizeWhitespace: () => normalizeWhitespace,
+  offsetOfLine: () => offsetOfLine,
+  orphanRefusal: () => orphanRefusal,
+  ownedMessage: () => ownedMessage,
+  paragraphAfter: () => paragraphAfter,
+  parseCiteConfig: () => parseCiteConfig,
+  parseLines: () => parseLines,
+  parseSrc: () => parseSrc,
+  parseStatements: () => parseStatements,
+  pickExtractor: () => pickExtractor,
+  pinOfLines: () => pinOfLines,
+  rangeLines: () => rangeLines,
+  readCiteConfigFile: () => readCiteConfigFile,
+  readPage: () => readPage,
+  readSource: () => readSource,
+  reencryptCitationEntries: () => reencryptCitationEntries,
+  reencryptCitations: () => reencryptCitations,
+  renderCheckGithub: () => renderCheckGithub,
+  renderCheckJson: () => renderCheckJson,
+  renderCheckPretty: () => renderCheckPretty,
+  renderUpdateJson: () => renderUpdateJson,
+  renderUpdatePretty: () => renderUpdatePretty,
+  resolveCiteRun: () => resolveCiteRun,
+  resolveSeverity: () => resolveSeverity,
+  rewriteLine: () => rewriteLine,
+  ruleId: () => ruleId,
+  runAdd: () => runAdd,
+  runCheck: () => runCheck,
+  runUpdate: () => runUpdate,
+  shortCommit: () => shortCommit,
+  shortPin: () => shortPin,
+  shortSrc: () => shortSrc,
+  sidecarsFor: () => sidecarsFor,
+  sliceLines: () => sliceLines,
+  sourceRange: () => sourceRange,
+  spellLines: () => spellLines,
+  spellSource: () => spellSource,
+  splice: () => splice,
+  spliceEntryField: () => spliceEntryField,
+  splitLines: () => splitLines,
+  statementForms: () => statementForms,
+  toBodyLines: () => toBodyLines,
+  toFileLines: () => toFileLines,
+  toValidationResult: () => toValidationResult,
+  twoManifestsRefusal: () => twoManifestsRefusal,
+  unifiedDiff: () => unifiedDiff,
+  unitAt: () => unitAt,
+  urlManifestRefusal: () => urlManifestRefusal,
+  validateEntry: () => validateEntry
+});
+
+// src/cite/types.ts
+var CITE_RULES = [
+  "source-moved",
+  "source-moved-ambiguous",
+  "source-changed",
+  "source-never-true",
+  "source-missing",
+  "claim-moved",
+  "claim-moved-ambiguous",
+  "claim-changed",
+  "marker-orphan",
+  "marker-invalid",
+  "marker-repeated",
+  "anchor-invalid",
+  "entry-invalid",
+  "quote-drift"
+];
+
+// src/cite/errors.ts
+var CiteError = class extends ToolError {
+  constructor(message) {
+    super(message);
+    this.name = "CiteError";
+  }
+};
+
+// src/cite/core/severity.ts
+var DEFAULT_SEVERITY = {
+  "source-moved": "warning",
+  "source-moved-ambiguous": "error",
+  "source-changed": "error",
+  "source-never-true": "error",
+  "source-missing": "error",
+  "claim-moved": "notice",
+  "claim-moved-ambiguous": "warning",
+  "claim-changed": "warning",
+  "marker-orphan": "error",
+  "marker-invalid": "error",
+  "marker-repeated": "warning",
+  "anchor-invalid": "error",
+  "entry-invalid": "error",
+  "quote-drift": "error"
+};
+var RULE_ID_PREFIX = "manni:cite";
+function ruleId(rule) {
+  return `${RULE_ID_PREFIX}/${rule}`;
+}
+function isCiteRule(value) {
+  return CITE_RULES.includes(value);
+}
+function resolveSeverity(overrides) {
+  return { ...DEFAULT_SEVERITY, ...overrides ?? {} };
+}
+
+// src/cite/core/range.ts
+var FILE_PATTERN = /^(?:~[A-Za-z0-9_-]{82,}|(?!~)(?:(?!\.\.?(?:\/|$))[^/\\:\r\n\t]+)(?:\/(?:(?!\.\.?(?:\/|$))[^/\\:\r\n\t]+))*)$/;
+var SRC_PATTERN = /^(?:~[A-Za-z0-9_-]{82,}|(?!~)(?:(?!\.\.?(?:\/|:|$))[^/\\:\r\n\t]+)(?:\/(?:(?!\.\.?(?:\/|:|$))[^/\\:\r\n\t]+))*)(?::[1-9][0-9]*(?:-[1-9][0-9]*)?)?$/;
+var RANGE_SPEC = /^([1-9][0-9]*)(?:-([1-9][0-9]*))?$/;
+function parseSrc(src) {
+  if (!SRC_PATTERN.test(src)) {
+    throw new CiteError(
+      `Invalid src "${src}": expected path, path:L, path:L1-L2, or an encrypted source (~ and at least 82 base64url characters) with the same line forms; the path is repo-root-relative, posix, and free of . and .. segments.`
+    );
+  }
+  const colon = src.indexOf(":");
+  const path = colon === -1 ? src : src.slice(0, colon);
+  const range = { path, encrypted: isEncryptedValue(path) };
+  if (colon === -1) return range;
+  const [startText, endText] = src.slice(colon + 1).split("-");
+  const start = Number(startText);
+  const end = endText === void 0 ? start : Number(endText);
+  if (end < start) {
+    throw new CiteError(`Invalid range "${src}": end line ${end} is before start line ${start}.`);
+  }
+  range.start = start;
+  range.end = end;
+  return range;
+}
+function formatSrc(range) {
+  const { path, start, end } = range;
+  if (start === void 0) return path;
+  if (end === void 0 || end === start) return `${path}:${start}`;
+  return `${path}:${start}-${end}`;
+}
+function parseLines(spec) {
+  if (typeof spec === "number") {
+    return Number.isInteger(spec) && spec >= 1 ? { start: spec, end: spec } : void 0;
+  }
+  const m = RANGE_SPEC.exec(spec);
+  const startText = m?.[1];
+  if (startText === void 0) return void 0;
+  const start = Number(startText);
+  const endText = m?.[2];
+  const end = endText === void 0 ? start : Number(endText);
+  return end < start ? void 0 : { start, end };
+}
+function lineSpec(lines) {
+  return lines.start === lines.end ? lines.start : `${String(lines.start)}-${String(lines.end)}`;
+}
+function spellLines(lines) {
+  return String(lineSpec(lines));
+}
+function sourceRange(source) {
+  const range = { path: source.file, encrypted: isEncryptedValue(source.file) };
+  if (source.lines === void 0) return range;
+  const lines = parseLines(source.lines);
+  if (lines !== void 0) {
+    range.start = lines.start;
+    range.end = lines.end;
+  }
+  return range;
+}
+function spellSource(source) {
+  return formatSrc(sourceRange(source));
+}
+function rangeLines(range) {
+  if (range.start === void 0) return void 0;
+  return lineSpec({ start: range.start, end: range.end ?? range.start });
+}
+
+// src/cite/core/hash.ts
+function normalizeText(text) {
+  const body = text.charCodeAt(0) === 65279 ? text.slice(1) : text;
+  return body.replace(/\r\n/g, "\n");
+}
+function splitLines(text) {
+  const parts = normalizeText(text).split("\n");
+  if (parts.length > 0 && parts[parts.length - 1] === "") parts.pop();
+  return parts;
+}
+function sliceLines(lines, range, label) {
+  const start = range?.start;
+  if (start === void 0) return lines.join("\n");
+  const end = range?.end ?? start;
+  if (start > lines.length || end > lines.length) {
+    const first = start > lines.length ? start : end;
+    throw new CiteError(`${label ?? "the source"} has ${lines.length} lines; line ${first} is out of range.`);
+  }
+  return lines.slice(start - 1, end).join("\n");
+}
+function hashRange(text, range, key) {
+  return hashLines(sliceLines(splitLines(text), range), key);
+}
+function hashLines(joined, key) {
+  return key === void 0 ? integrityOf(Buffer.from(joined, "utf8")) : keyedPin(joined, key);
+}
+function isKeyedPin(pin) {
+  return pin.startsWith(KEYED_PIN_PREFIX);
+}
+
+// src/cite/core/spell.ts
+function shortPin(integrity) {
+  const m = /^((?:hmac-)?sha256-)([0-9a-f]{8})/i.exec(integrity);
+  const prefix = m?.[1];
+  const digits = m?.[2];
+  if (prefix === void 0 || digits === void 0) return integrity;
+  return `${prefix}${digits}\u2026`;
+}
+function shortCommit(commit) {
+  return commit.slice(0, 7);
+}
+function shortSrc(src) {
+  if (!src.startsWith("~")) return src;
+  const colon = src.indexOf(":");
+  const token = colon === -1 ? src : src.slice(0, colon);
+  const lines = colon === -1 ? "" : src.slice(colon);
+  return token.length <= 5 ? src : `${token.slice(0, 5)}\u2026${lines}`;
+}
+
+// src/cite/core/sources.ts
+import fg from "fast-glob";
+import { lstat, readFile, realpath } from "node:fs/promises";
+import { join, sep } from "node:path";
+var CONTEXT = "cite-src";
+function encryptSourcePath(path, key) {
+  return encryptValue(path, key, CONTEXT);
+}
+function decryptSourcePath(token, key) {
+  const opened = decryptValue(token, key, CONTEXT);
+  if (!opened.ok || typeof opened.value !== "string") return void 0;
+  const path = opened.value;
+  if (path.includes(":") || path.startsWith("~") || !SRC_PATTERN.test(path)) return void 0;
+  return path;
+}
+function isUnder(real, realRoot) {
+  return real === realRoot || real.startsWith(realRoot.endsWith(sep) ? realRoot : realRoot + sep);
+}
+async function admit(root, realRoot, rel) {
+  const abs = join(root, rel);
+  try {
+    const info = await lstat(abs);
+    if (!info.isFile()) return void 0;
+    const real = await realpath(abs);
+    return isUnder(real, realRoot) ? rel : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function candidates(root, opts) {
+  const client = opts?.gitClient;
+  if (client !== void 0 && await client.available()) {
+    return client.lsFiles();
+  }
+  return fg("**/*", {
+    cwd: root,
+    onlyFiles: true,
+    dot: true,
+    followSymbolicLinks: false,
+    ignore: ["**/.git/**", "**/node_modules/**"]
+  });
+}
+async function buildSourceIndex(root, opts) {
+  const realRoot = await realpath(root);
+  const admitted = await Promise.all(
+    (await candidates(root, opts)).map((rel) => admit(root, realRoot, rel))
+  );
+  const files = Object.freeze(
+    [...new Set(admitted.filter((rel) => rel !== void 0))].sort()
+  );
+  const byPath = new Set(files);
+  return {
+    files: () => files,
+    has: (path) => byPath.has(path)
+  };
+}
+async function readSource(root, index, range, key) {
+  let resolvedPath;
+  if (range.encrypted) {
+    if (key === void 0) return { kind: "missing", reason: "no-key" };
+    const path = decryptSourcePath(range.path, key);
+    if (path === void 0) return { kind: "missing", reason: "undecryptable" };
+    resolvedPath = path;
+  } else {
+    resolvedPath = range.path;
+  }
+  if (!index.has(resolvedPath)) return { kind: "missing", reason: "untracked" };
+  try {
+    const text = await readFile(join(root, resolvedPath), "utf8");
+    return { kind: "ok", resolvedPath, text };
+  } catch {
+    return { kind: "missing", reason: "unreadable" };
+  }
+}
+
+// src/cite/core/statements.ts
+var HTML_COMMENT = { open: "<!--", close: "-->" };
+var JSX_COMMENT = { open: "{/*", close: "*/}" };
+var LINK_REFERENCE = { open: "[comment]: # (", close: ")" };
+var MARKDOWN_FORMS = [HTML_COMMENT, JSX_COMMENT, LINK_REFERENCE];
+var MDX_FORMS = [JSX_COMMENT, HTML_COMMENT, LINK_REFERENCE];
+var COMMENT_FORMS = [{ open: "<!--", close: "-->" }];
+var ASCIIDOC_FORMS = [{ open: "// (", close: ")" }];
+var RST_FORMS = [{ open: ".. (", close: ")" }];
+var ID = /^[a-z0-9][a-z0-9-]*$/;
+var ANY_FENCE = /^(?:[ \t]*(?:`{3,}|~{3,})|-{4,})/;
+var MARKDOWN_FENCE = /^(`{3,}|~{3,})/;
+var ASCIIDOC_FENCE = /^(-{4,})/;
+var SKIP_MARKDOWN_FENCE = /^[ \t]*(`{3,}|~{3,})/;
+var SKIP_ASCIIDOC_FENCE = ASCIIDOC_FENCE;
+var SPAN_FORMATS = /* @__PURE__ */ new Set(["markdown", "mdx", "asciidoc", "rst"]);
+function statementForms(format) {
+  switch (format) {
+    case "markdown":
+      return MARKDOWN_FORMS;
+    case "mdx":
+      return MDX_FORMS;
+    case "html":
+    case "xml":
+      return COMMENT_FORMS;
+    case "asciidoc":
+      return ASCIIDOC_FORMS;
+    case "rst":
+      return RST_FORMS;
+    default:
+      return [];
+  }
+}
+function fenceFor(format) {
+  switch (format) {
+    case "markdown":
+    case "mdx":
+      return MARKDOWN_FENCE;
+    case "asciidoc":
+      return ASCIIDOC_FENCE;
+    default:
+      return void 0;
+  }
+}
+function skipFenceFor(format) {
+  switch (format) {
+    case "markdown":
+    case "mdx":
+      return SKIP_MARKDOWN_FENCE;
+    case "asciidoc":
+      return SKIP_ASCIIDOC_FENCE;
+    default:
+      return void 0;
+  }
+}
+var BACKTICK = 96;
+function backtickRun(text, i) {
+  let n = 0;
+  while (text.charCodeAt(i + n) === BACKTICK) n++;
+  return n;
+}
+function spanRegions(text, lineStart, out) {
+  let i = 0;
+  while (i < text.length) {
+    const n = backtickRun(text, i);
+    if (n === 0) {
+      i++;
+      continue;
+    }
+    let j = i + n;
+    let closer = -1;
+    while (j < text.length) {
+      const m = backtickRun(text, j);
+      if (m === 0) {
+        j++;
+        continue;
+      }
+      if (m === n) {
+        closer = j;
+        break;
+      }
+      j += m;
+    }
+    if (closer === -1) {
+      i += n;
+      continue;
+    }
+    out.push({ start: lineStart + i, end: lineStart + closer + n });
+    i = closer + n;
+  }
+}
+function closesFence(text, open) {
+  const trimmed = text.trim();
+  let n = 0;
+  while (trimmed.charAt(n) === open.char) n++;
+  return n >= open.length && n === trimmed.length;
+}
+function codeRegions(body, format) {
+  const fence = skipFenceFor(format);
+  const spans = SPAN_FORMATS.has(format);
+  const out = [];
+  if (fence === void 0 && !spans) return out;
+  let open;
+  let pos = 0;
+  while (pos < body.length) {
+    const end = lineEnd(body, pos);
+    const text = lineText(body, pos, end);
+    if (open !== void 0) {
+      if (closesFence(text, open)) {
+        out.push({ start: open.start, end });
+        open = void 0;
+      }
+    } else {
+      const opener = fence?.exec(text)?.[1];
+      if (opener !== void 0) {
+        open = { char: opener.charAt(0), length: opener.length, start: pos };
+      } else if (spans) {
+        spanRegions(text, pos, out);
+      }
+    }
+    pos = end + 1;
+  }
+  if (open !== void 0) out.push({ start: open.start, end: body.length });
+  return out;
+}
+function lineEnd(content, pos) {
+  const nl = content.indexOf("\n", pos);
+  return nl === -1 ? content.length : nl;
+}
+function lineText(content, pos, end) {
+  const text = content.slice(pos, end);
+  return text.endsWith("\r") ? text.slice(0, -1) : text;
+}
+function beforeCr(content, end) {
+  return end > 0 && content.charCodeAt(end - 1) === 13 ? end - 1 : end;
+}
+function nextLineStart(content, offset) {
+  if (offset === 0 || content.charCodeAt(offset - 1) === 10) return offset;
+  return lineEnd(content, offset) + 1;
+}
+function payloadOf(payload) {
+  if (payload === "") return { kind: "bad", reason: "empty payload" };
+  if (payload.startsWith("{")) return { kind: "bad", reason: "a JSON payload", json: true };
+  if (ID.test(payload)) return { kind: "ref", id: payload };
+  return { kind: "bad", reason: "payload is not an id" };
+}
+function parseStatements(body, format, from = { offset: 0, line: 1 }) {
+  const out = [];
+  const fileLine = (bodyOffset) => from.line + lineAt(body, bodyOffset) - 1;
+  const code = codeRegions(body, format);
+  const codeEndAt = (at2) => code.find((r) => at2 >= r.start && at2 < r.end)?.end;
+  for (const form of statementForms(format)) {
+    let cursor = 0;
+    for (; ; ) {
+      const at2 = body.indexOf(form.open, cursor);
+      if (at2 === -1) break;
+      const codeEnd = codeEndAt(at2);
+      if (codeEnd !== void 0) {
+        cursor = codeEnd;
+        continue;
+      }
+      const closeAt = body.indexOf(form.close, at2 + form.open.length);
+      if (closeAt === -1) break;
+      const end = closeAt + form.close.length;
+      cursor = end;
+      const inner = body.slice(at2 + form.open.length, closeAt).trim();
+      if (!(inner === "cite" || inner.startsWith("cite") && /\s/.test(inner.charAt(4)))) {
+        continue;
+      }
+      const payload = inner.slice(4).trim();
+      const unit = anchoredLines(body, end, format);
+      const anchorLine = unit === void 0 ? void 0 : from.line + unit.start - 1;
+      const statement = {
+        line: fileLine(at2),
+        payload: payloadOf(payload),
+        raw: inner,
+        start: from.offset + at2,
+        end: from.offset + end
+      };
+      if (anchorLine !== void 0) statement.anchorLine = anchorLine;
+      out.push(statement);
+    }
+  }
+  return out.sort((a, b) => a.start - b.start);
+}
+function detectEol(text) {
+  const nl = text.indexOf("\n");
+  return nl > 0 && text.charCodeAt(nl - 1) === 13 ? "\r\n" : "\n";
+}
+function paragraphAfter(content, offset) {
+  let pos = offset;
+  const firstEnd = lineEnd(content, pos);
+  if (lineText(content, pos, firstEnd).trim() === "") pos = firstEnd + 1;
+  while (pos < content.length) {
+    const end = lineEnd(content, pos);
+    const text = lineText(content, pos, end);
+    if (text.trim() === "") {
+      pos = end + 1;
+      continue;
+    }
+    if (ANY_FENCE.test(text)) return void 0;
+    const start = pos;
+    let last = end;
+    let cursor = end + 1;
+    while (cursor < content.length) {
+      const e = lineEnd(content, cursor);
+      const t = lineText(content, cursor, e);
+      if (t.trim() === "" || ANY_FENCE.test(t)) break;
+      last = e;
+      cursor = e + 1;
+    }
+    return { start, end: beforeCr(content, last), line: lineAt(content, start) };
+  }
+  return void 0;
+}
+function scanFence(content, offset, fence) {
+  let pos = nextLineStart(content, offset);
+  while (pos < content.length) {
+    const end = lineEnd(content, pos);
+    const text = lineText(content, pos, end);
+    const opener = fence.exec(text)?.[1];
+    if (opener === void 0) {
+      pos = end + 1;
+      continue;
+    }
+    const line = lineAt(content, pos);
+    const start = Math.min(end + 1, content.length);
+    let cursor = start;
+    while (cursor < content.length) {
+      const e = lineEnd(content, cursor);
+      if (lineText(content, cursor, e).startsWith(opener)) {
+        return {
+          start,
+          end: cursor,
+          line,
+          text: content.slice(start, cursor),
+          next: e + 1
+        };
+      }
+      cursor = e + 1;
+    }
+    return void 0;
+  }
+  return void 0;
+}
+function fencedBlockAfter(content, offset, format) {
+  const fence = fenceFor(format);
+  if (!fence) return void 0;
+  const block = scanFence(content, offset, fence);
+  if (!block) return void 0;
+  const { start, end, line, text } = block;
+  return { start, end, line, text };
+}
+function fencedBlockAt(content, offset) {
+  const pos = nextLineStart(content, offset);
+  if (!ANY_FENCE.test(lineText(content, pos, lineEnd(content, pos)))) {
+    return void 0;
+  }
+  const block = scanFence(content, pos, MARKDOWN_FENCE) ?? scanFence(content, pos, ASCIIDOC_FENCE);
+  if (!block || block.line !== lineAt(content, pos)) return void 0;
+  const { start, end, line, text } = block;
+  return { start, end, line, text };
+}
+function fencedBlocks(content, bodyOffset, format) {
+  const fence = fenceFor(format);
+  if (!fence) return [];
+  const out = [];
+  let pos = bodyOffset;
+  for (; ; ) {
+    const block = scanFence(content, pos, fence);
+    if (!block) return out;
+    const { start, end, line, text } = block;
+    out.push({ start, end, line, text });
+    pos = block.next;
+  }
+}
+function writtenForm(format) {
+  const form = statementForms(format)[0];
+  if (!form) {
+    throw new CiteError(`No marker syntax for format "${format}".`);
+  }
+  return form;
+}
+function formatStatement(format, payload) {
+  const form = writtenForm(format);
+  const pad = form.open.endsWith("(") ? "" : " ";
+  return `${form.open}${pad}cite ${payload.id}${pad}${form.close}`;
+}
+function nextNonBlankLine(text, offset) {
+  let pos = nextLineStart(text, offset);
+  while (pos < text.length) {
+    const end = lineEnd(text, pos);
+    if (lineText(text, pos, end).trim() !== "") return lineAt(text, pos);
+    pos = end + 1;
+  }
+  return void 0;
+}
+function fenceSpanAt(text, line, format) {
+  const fence = fenceFor(format);
+  if (!fence) return void 0;
+  const block = scanFence(text, offsetOfLine(text, line), fence);
+  if (!block || block.line !== line) return void 0;
+  return { start: line, end: lineAt(text, block.end) };
+}
+function insideFence(text, bodyOffset, line, format) {
+  return fencedBlocks(text, bodyOffset, format).some(
+    (block) => line > block.line && line <= lineAt(text, block.end)
+  );
+}
+function anchoredLines(text, after, format, quote = false) {
+  if (quote) {
+    const block = fencedBlockAfter(text, after, format);
+    return block === void 0 ? void 0 : { start: block.line, end: lineAt(text, block.end) };
+  }
+  const restEnd = lineEnd(text, after);
+  if (text.slice(after, restEnd).trim() !== "") {
+    const line2 = lineAt(text, after);
+    return { start: line2, end: line2 };
+  }
+  const paragraph = paragraphAfter(text, after);
+  if (paragraph !== void 0) {
+    return { start: paragraph.line, end: lineAt(text, paragraph.end) };
+  }
+  const line = nextNonBlankLine(text, after);
+  return line === void 0 ? void 0 : fenceSpanAt(text, line, format);
+}
+function lineAt(content, offset) {
+  const stop = Math.min(offset, content.length);
+  let line = 1;
+  for (let i = 0; i < stop; i++) {
+    if (content.charCodeAt(i) === 10) line++;
+  }
+  return line;
+}
+function offsetOfLine(content, line) {
+  let pos = 0;
+  for (let n = 1; n < line; n++) {
+    const nl = content.indexOf("\n", pos);
+    if (nl === -1) return content.length;
+    pos = nl + 1;
+  }
+  return pos;
+}
+
+// src/cite/core/classify.ts
+var MOVE_WINDOW_LINES = 2e3;
+var MOVE_BUDGET_BYTES = 64 * 1024 * 1024;
+var MAX_RANGE_LINES = 5e3;
+function findWindows(lines, length, pin, key, opts) {
+  const starts = [];
+  const lastStart = lines.length - length + 1;
+  if (length < 1 || lastStart < 1) return { starts, truncated: false };
+  const joined = (start) => lines.slice(start - 1, start - 1 + length).join("\n");
+  const original = opts?.original;
+  if (original !== void 0) {
+    const first = original[0];
+    for (let start = 1; start <= lastStart; start++) {
+      if (lines[start - 1] !== first) continue;
+      let same = true;
+      for (let i = 1; i < length; i++) {
+        if (lines[start - 1 + i] !== original[i]) {
+          same = false;
+          break;
+        }
+      }
+      if (same && hashLines(joined(start), key) === pin) starts.push(start);
+    }
+    return { starts, truncated: false };
+  }
+  const budget = opts?.budget ?? MOVE_BUDGET_BYTES;
+  const around = opts?.around ?? 1;
+  const bandStart = Math.max(1, around - MOVE_WINDOW_LINES);
+  const bandEnd = Math.min(lastStart, around + MOVE_WINDOW_LINES);
+  const order = [];
+  for (let start = bandStart; start <= bandEnd; start++) order.push(start);
+  for (let start = 1; start < bandStart; start++) order.push(start);
+  for (let start = bandEnd + 1; start <= lastStart; start++) order.push(start);
+  let spent = 0;
+  for (const start of order) {
+    const text = joined(start);
+    const bytes = Buffer.byteLength(text, "utf8");
+    if (spent + bytes > budget) return { starts, truncated: true };
+    spent += bytes;
+    if (hashLines(text, key) === pin) starts.push(start);
+  }
+  return { starts, truncated: false };
+}
+async function historyOf(git, commit, path, range, pin, key, budget) {
+  const shown = await git.showFile(commit, path);
+  if ("missing" in shown) {
+    return shown.missing === "commit" ? { kind: "unavailable" } : { kind: "never-true" };
+  }
+  const then = splitLines(shown.text);
+  let joined;
+  try {
+    joined = sliceLines(then, range);
+  } catch {
+    joined = void 0;
+  }
+  if (joined !== void 0 && hashLines(joined, key) === pin) {
+    return { kind: "original", lines: joined.split("\n") };
+  }
+  if (range.start === void 0) return { kind: "never-true" };
+  const length = (range.end ?? range.start) - range.start + 1;
+  const search = { around: range.start };
+  if (budget !== void 0) search.budget = budget;
+  const found = findWindows(then, length, pin, key, search);
+  const [first] = found.starts;
+  if (first !== void 0) {
+    return { kind: "original", lines: then.slice(first - 1, first - 1 + length) };
+  }
+  return found.truncated ? { kind: "unknown" } : { kind: "never-true" };
+}
+async function classifyCitation(entry, opts) {
+  const { citation } = entry;
+  const range = sourceRange(citation.source);
+  const commit = citation.source["commit-sha"];
+  const result = { src: spellSource(citation.source), status: "missing" };
+  if (commit !== void 0) result.commitSha = commit;
+  const source = await readSource(opts.root, opts.index, range, opts.key);
+  if (source.kind === "missing") {
+    result.missingReason = source.reason;
+    return result;
+  }
+  result.resolvedPath = source.resolvedPath;
+  const key = range.encrypted ? opts.key : void 0;
+  const pin = citation.source.integrity;
+  const lines = splitLines(source.text);
+  let here;
+  try {
+    here = hashLines(sliceLines(lines, range), key);
+  } catch {
+    here = void 0;
+  }
+  if (here === pin) {
+    result.status = "current";
+    return result;
+  }
+  let history = { kind: "none" };
+  if (commit !== void 0 && await opts.git.available()) {
+    history = await historyOf(opts.git, commit, source.resolvedPath, range, pin, key, opts.budget);
+  }
+  if (range.start !== void 0) {
+    const start = range.start;
+    const end = range.end ?? start;
+    const search = { around: start };
+    if (history.kind === "original") search.original = history.lines;
+    if (opts.budget !== void 0) search.budget = opts.budget;
+    const found = findWindows(lines, end - start + 1, pin, key, search);
+    if (found.truncated) result.truncatedSearch = true;
+    const spell = (at2) => formatSrc({ ...range, start: at2, end: at2 + (end - start) });
+    const [only] = found.starts;
+    if (found.starts.length === 1 && only !== void 0) {
+      result.status = "moved";
+      result.newSrc = spell(only);
+      result.newLines = String(lineSpec({ start: only, end: only + (end - start) }));
+      return result;
+    }
+    if (found.starts.length > 1) {
+      result.status = "moved-ambiguous";
+      result.candidates = found.starts.map(spell);
+      return result;
+    }
+  }
+  if (history.kind === "never-true") {
+    result.status = "never-true";
+    return result;
+  }
+  result.status = "changed";
+  if (history.kind === "unavailable") result.historyAvailable = false;
+  if (history.kind === "unknown") result.truncatedSearch = true;
+  if (history.kind === "original" && commit !== void 0) {
+    result.historyAvailable = true;
+    result.commitsSince = await opts.git.subjectsSince(commit, source.resolvedPath);
+    result.diff = await opts.git.diffSince(commit, source.resolvedPath);
+  }
+  return result;
+}
+
+// src/cite/core/claims.ts
+function normalizeWhitespace(text) {
+  return text.replace(/\s+/g, " ").trim();
+}
+function normalizeBlock(text) {
+  let out = text.charCodeAt(0) === 65279 ? text.slice(1) : text;
+  out = out.replace(/\r\n/g, "\n");
+  return out.endsWith("\n") ? out.slice(0, -1) : out;
+}
+function blockMatches(blockText, citedJoined) {
+  return normalizeBlock(blockText) === normalizeBlock(citedJoined);
+}
+function toFileLines(lines, bodyLine) {
+  return { start: bodyLine + lines.start - 1, end: bodyLine + lines.end - 1 };
+}
+function toBodyLines(lines, bodyLine) {
+  return { start: lines.start - bodyLine + 1, end: lines.end - bodyLine + 1 };
+}
+function textAt(lines, range) {
+  return lines.slice(range.start - 1, Math.min(range.end, lines.length));
+}
+function pinOfLines(lines, range) {
+  if (range.start < 1 || range.end > lines.length) return void 0;
+  return hashLines(lines.slice(range.start - 1, range.end).join("\n"));
+}
+function claimLine(claim) {
+  const at2 = claim.fileLines === void 0 ? void 0 : parseLines(claim.fileLines);
+  return at2?.start;
+}
+function claimLineNow(claim) {
+  const spec = claim.newFileLines ?? claim.candidateFileLines?.[0] ?? claim.fileLines;
+  const at2 = spec === void 0 ? void 0 : parseLines(spec);
+  return at2?.start;
+}
+function claimLinesNow(claim) {
+  const spec = claim.newFileLines ?? claim.candidateFileLines?.[0] ?? claim.fileLines;
+  return spec === void 0 ? void 0 : parseLines(spec);
+}
+function claimEnd(page, entry, lines) {
+  const { citation, marker } = entry;
+  const claim = citation.claim;
+  if (claim === void 0) return null;
+  const quote = citation.quote === true;
+  const body = page.bodyLine;
+  if (claim.lines !== void 0) {
+    const recorded = parseLines(claim.lines);
+    if (recorded === void 0) return { status: "skipped" };
+    const file = toFileLines(recorded, body);
+    const end = {
+      lines: spellLines(recorded),
+      fileLines: spellLines(file),
+      status: "changed"
+    };
+    if (marker !== void 0) return { ...end, status: "skipped" };
+    if (pinOfLines(lines, file) === claim.integrity) return { ...end, status: "current" };
+    const width = recorded.end - recorded.start + 1;
+    const found = findWindows(lines.slice(body - 1), width, claim.integrity, void 0, {
+      around: recorded.start
+    });
+    const spans = found.starts.map((start) => ({ start, end: start + width - 1 }));
+    const [only] = spans;
+    if (spans.length === 1 && only !== void 0) {
+      return {
+        ...end,
+        status: "moved",
+        newLines: spellLines(only),
+        newFileLines: spellLines(toFileLines(only, body))
+      };
+    }
+    if (spans.length > 1) {
+      return {
+        ...end,
+        status: "moved-ambiguous",
+        candidates: spans.map(spellLines),
+        candidateFileLines: spans.map((span) => spellLines(toFileLines(span, body)))
+      };
+    }
+    return { ...end, text: textAt(lines, file) };
+  }
+  if (marker !== void 0) {
+    const unit = anchoredLines(page.content, marker.end, page.format, quote);
+    if (unit === void 0) return { status: "changed" };
+    const end = { fileLines: spellLines(unit), status: "changed" };
+    if (pinOfLines(lines, unit) === claim.integrity) return { ...end, status: "current" };
+    return { ...end, text: textAt(lines, unit) };
+  }
+  return { status: "changed" };
+}
+function unitAt(page, line, lines) {
+  if (line < page.bodyLine || line > lines.length) return void 0;
+  if ((lines[line - 1] ?? "").trim() === "") return void 0;
+  const block = fenceSpanAt(page.content, line, page.format);
+  if (block !== void 0) {
+    return { lines: block, kind: "block", text: lines.slice(block.start - 1, block.end) };
+  }
+  if (insideFence(page.content, page.bodyOffset, line, page.format)) return void 0;
+  const paragraph = paragraphAfter(page.content, offsetOfLine(page.content, line));
+  if (paragraph === void 0 || paragraph.line !== line) return void 0;
+  const span = { start: line, end: lineAt(page.content, paragraph.end) };
+  return { lines: span, kind: "paragraph", text: lines.slice(span.start - 1, span.end) };
+}
+function markerUnit(page, entry, lines) {
+  const { marker, citation } = entry;
+  if (marker === void 0) return void 0;
+  const span = anchoredLines(page.content, marker.end, page.format, citation.quote === true);
+  if (span === void 0 || span.end > lines.length) return void 0;
+  return {
+    lines: span,
+    kind: citation.quote === true ? "block" : "paragraph",
+    text: lines.slice(span.start - 1, span.end)
+  };
+}
+
+// src/cite/core/git.ts
+import { execFile } from "node:child_process";
+var MAX_BUFFER = 32 * 1024 * 1024;
+var NO_COMMIT = /invalid object name|bad revision|unknown revision|bad object/i;
+var NO_PATH = /does not exist in|exists on disk, but not in|path .* does not exist/i;
+function run2(root, args) {
+  return new Promise((resolve8) => {
+    execFile(
+      "git",
+      ["-c", "core.quotepath=false", ...args],
+      { cwd: root, windowsHide: true, maxBuffer: MAX_BUFFER, encoding: "utf8" },
+      (error, stdout, stderr) => {
+        if (error) {
+          const failure = { ok: false, stderr, message: error.message };
+          if (typeof error.code === "number") failure.code = error.code;
+          resolve8(failure);
+        } else resolve8({ ok: true, stdout });
+      }
+    );
+  });
+}
+function gitClient(root) {
+  const memo = /* @__PURE__ */ new Map();
+  const once = (key, compute) => {
+    const held = memo.get(key);
+    if (held !== void 0) return held;
+    const made = compute();
+    memo.set(key, made);
+    return made;
+  };
+  const available = () => once("available", async () => (await run2(root, ["rev-parse", "--show-toplevel"])).ok);
+  const failed = (verb, outcome) => new CiteError(`git ${verb} failed: ${outcome.stderr.trim() || outcome.message}`);
+  const hasCommit = (commit) => once(`has\0${commit}`, async () => {
+    const out = await run2(root, ["rev-parse", "--verify", "--quiet", "--end-of-options", `${commit}^{commit}`]);
+    if (out.ok) return true;
+    if (out.code === 1) return false;
+    throw failed("rev-parse", out);
+  });
+  return {
+    available,
+    head: () => once("head", async () => {
+      if (!await available()) return null;
+      const out = await run2(root, ["rev-parse", "HEAD"]);
+      return out.ok ? out.stdout.trim() : null;
+    }),
+    lsFiles: () => once("ls-files", async () => {
+      if (!await available()) return [];
+      const out = await run2(root, ["ls-files", "-z"]);
+      if (!out.ok) throw failed("ls-files", out);
+      return out.stdout.split("\0").filter((entry) => entry !== "");
+    }),
+    showFile: (commit, path) => once(`show\0${commit}\0${path}`, async () => {
+      const out = await run2(root, ["show", "--end-of-options", `${commit}:./${path}`]);
+      if (out.ok) return { text: out.stdout };
+      if (NO_COMMIT.test(out.stderr)) return { missing: "commit" };
+      if (NO_PATH.test(out.stderr)) {
+        return await hasCommit(commit) ? { missing: "path" } : { missing: "commit" };
+      }
+      throw failed("show", out);
+    }),
+    subjectsSince: (commit, path) => once(`log\0${commit}\0${path}`, async () => {
+      const out = await run2(root, ["log", "--format=%s", "--end-of-options", `${commit}..HEAD`, "--", path]);
+      if (!out.ok) throw failed("log", out);
+      return out.stdout.split(/\r?\n/).filter((line) => line !== "");
+    }),
+    diffSince: (commit, path) => once(`diff\0${commit}\0${path}`, async () => {
+      const out = await run2(root, ["diff", "--end-of-options", commit, "--", path]);
+      if (!out.ok) throw failed("diff", out);
+      return out.stdout;
+    })
+  };
+}
+var GIT_UNAVAILABLE_HISTORY = "git is not available here, so citations are checked without history: no never-true, no diffs, no commit subjects.";
+var GIT_UNAVAILABLE_COMMIT = "git is not available here, so the citation records no commit.";
+function noGit() {
+  return {
+    available: () => Promise.resolve(false),
+    head: () => Promise.resolve(null),
+    lsFiles: () => Promise.resolve([]),
+    showFile: () => Promise.resolve({ missing: "commit" }),
+    subjectsSince: () => Promise.resolve([]),
+    diffSince: () => Promise.resolve("")
+  };
+}
+
+// src/cite/core/page.ts
+import { extname as extname2 } from "node:path";
+import * as Ajv2020Ns from "ajv/dist/2020.js";
+
+// src/cite/schema/citations.json
+var citations_default = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: "manni:citations:1.0.0-proposal.3",
+  title: "manni citations vocabulary (1.0.0-proposal.3)",
+  description: "What do this page's claims rest on? For each claim, the page lines that make it, the source lines it was written from, and a hash of each. A manni common vocabulary: any drift check can implement it, and other schemas may compose on top of it. A pin is a record of the past, not a copy of the present. It says what the lines were when the sentence was written. The check compares that record with the files as they are now. Recompute it on every run and there is nothing to compare against. `source-of-truth` (manni:stewardship) names the file a page answers to; a citation names the lines a sentence answers to. The page root stays open so sibling tools' keys pass untouched. The `citation-` prefix is reserved, so an unrecognized `citation-*` key is rejected and a typo fails loudly.",
+  type: "object",
+  additionalProperties: true,
+  properties: {
+    citations: {
+      type: "array",
+      minItems: 1,
+      items: {
+        $ref: "#/$defs/citationEntry"
+      },
+      description: "The page's citations, one entry per claim or pin. An empty list is not a declaration; a page with no citations omits the key. Ids are unique within a page, and two entries claiming one id is an error. JSON Schema cannot say that over a list whose members may omit the id. So it is a requirement on implementations, stated here so every tool agrees."
+    }
+  },
+  patternProperties: {
+    "^citation-": false
+  },
+  $defs: {
+    citationEntry: {
+      type: "object",
+      additionalProperties: false,
+      required: [
+        "source"
+      ],
+      description: "One citation: the page text it supports, the source lines it rests on, and how the two are anchored. Both ends share one shape, a line range and a hash.",
+      properties: {
+        id: {
+          type: "string",
+          pattern: "^[a-z0-9][a-z0-9-]*$",
+          description: "A kebab-case name for this citation, unique within the page. A body marker names an entry by it, and findings are reported under it. Optional for an entry anchored by its claim lines or pinned bare. Required when a marker names the entry."
+        },
+        claim: {
+          $ref: "#/$defs/claim"
+        },
+        source: {
+          $ref: "#/$defs/source"
+        },
+        quote: {
+          type: "boolean",
+          default: false,
+          description: "The claim is a fenced block that reproduces the source lines. The pinned claim covers the whole block, fences included. An implementer compares the lines inside the fences with the source under the pin's rule. So a quoted snippet that drifts from its source is a finding even while the pin still holds. Under a marker, the block is the next fence after the marker. Default false."
+        }
+      }
+    },
+    claim: {
+      type: "object",
+      additionalProperties: false,
+      required: [
+        "integrity"
+      ],
+      description: "The page text the citation supports, pinned by lines and a hash. Absent, the entry is a bare pin, or a marker with no drift check on its sentence. Without `lines`, the text pinned is what a body marker naming this entry anchors.",
+      properties: {
+        lines: {
+          $ref: "#/$defs/lines",
+          description: "Lines of the page body. The body starts on the first line after the closing frontmatter fence, or on line 1 with no frontmatter. So editing the frontmatter never moves a claim. Required unless a marker names the entry, and never inside the frontmatter."
+        },
+        integrity: {
+          type: "string",
+          pattern: "^sha256-[0-9a-f]{64}$",
+          description: "`sha256-` and sixty-four lowercase hex digits over the claimed lines, under the rule `source.integrity` states. Always plain, never keyed: the page is public, so there is nothing to hide. With a marker, the lines hashed are the ones the marker anchors."
+        }
+      }
+    },
+    source: {
+      type: "object",
+      additionalProperties: false,
+      required: [
+        "file",
+        "integrity"
+      ],
+      description: "The lines the claim rests on: a file, an optional line range, a pin, and the commit the pin was taken at.",
+      properties: {
+        file: {
+          $ref: "#/$defs/fileRef"
+        },
+        lines: {
+          $ref: "#/$defs/lines",
+          description: "File lines. Absent, the whole file is pinned. The lines stay readable even when `file` is encrypted."
+        },
+        integrity: {
+          type: "string",
+          pattern: "^(?:sha256|hmac-sha256)-[0-9a-f]{64}$",
+          description: "The pin: an algorithm prefix and sixty-four lowercase hex digits over the cited lines under one rule. Decode as UTF-8 and drop one leading byte-order mark. Turn CRLF into LF, split on LF, and discard the empty element a trailing LF leaves. Take lines L1 to L2 inclusive, or every line for a whole file. Join with LF and no trailing LF, and keep trailing whitespace. A plain `file` is pinned `sha256-` over that text. An encrypted `file` is pinned `hmac-sha256-`: the HMAC-SHA256 of that text under a key derived from the encryption key. So a public page carries no verifier a reader could run against a guessed private line. The prefix follows `file`, and any other pairing is an invalid entry."
+        },
+        "commit-sha": {
+          type: "string",
+          pattern: "^[0-9a-f]{7,64}$",
+          description: "The git commit hash the source pin was taken at, as lowercase hex. Seven digits is what git abbreviates to; sixty-four covers a SHA-256 repository. A tool writes the full hash, because an abbreviation that is unique today need not be next year. Without it, a check can still say the lines changed. With it, the check can say since when, and whether the pin was ever true."
+        }
+      }
+    },
+    lines: {
+      oneOf: [
+        {
+          type: "integer",
+          minimum: 1
+        },
+        {
+          type: "string",
+          pattern: "^[1-9][0-9]*-[1-9][0-9]*$"
+        }
+      ],
+      description: 'A line range, 1-based and inclusive: an integer for one line, or `"L1-L2"` for several. `L1 <= L2` is a rule on implementations, since a pattern cannot compare two numbers. There is no line 0 to cite.'
+    },
+    fileRef: {
+      type: "string",
+      pattern: "^(?:~[A-Za-z0-9_-]{82,}|(?!~)(?:(?!\\.\\.?(?:/|$))[^/\\\\:\\r\\n\\t]+)(?:/(?:(?!\\.\\.?(?:/|$))[^/\\\\:\\r\\n\\t]+))*)$",
+      description: "The file: a path relative to the repository root, posix-separated, and free of `.` and `..` segments. Segments may hold spaces and dots but not `/`, `\\`, `:` or a line break. So a URL, a drive letter, a Windows path and an absolute path all fail here. In place of the path, `~` and at least 82 base64url characters is the path encrypted with the family key. Proposal 0045 states the construction. Only a checkout with the key and the files can decrypt the path and read the lines. So a public docs repo can cite a private code repo without publishing its paths. The value carries no encryption mark, because the citation tool encrypts it, and a plain path stays valid."
+    }
+  }
+};
+
+// src/meta/core/external-metadata-write.ts
+import { posix } from "node:path";
+import {
+  LineCounter,
+  isMap,
+  isNode,
+  isPair,
+  isScalar,
+  isSeq,
+  parseDocument,
+  stringify
+} from "yaml";
+function spliceManifestValue(text, options) {
+  const { entry, key, value, file } = options;
+  const join4 = options.join ?? PATH_JOIN;
+  const at2 = (line2) => {
+    const name = file === void 0 ? "Manifest" : `Manifest ${file}`;
+    if (line2 === void 0) return name;
+    return file === void 0 ? `${name} line ${String(line2)}` : `${name}:${String(line2)}`;
+  };
+  if (key === FILE_SCHEMA_KEY) {
+    throw new DocmetaError(
+      `${at2()}: refusing to write "${FILE_SCHEMA_KEY}" for "${entry}"; a manifest never chooses the schema a document is judged by. Use "overrides" in the config.`
+    );
+  }
+  if (value === void 0) {
+    throw new DocmetaError(`${at2()}: refusing to write "${key}" for "${entry}" with no value.`);
+  }
+  const eol = detectEol2(text);
+  const lc = new LineCounter();
+  const doc = parseDocument(text, { lineCounter: lc, uniqueKeys: false });
+  const problem = doc.errors[0];
+  if (problem) {
+    throw new DocmetaError(`${at2()} is not valid YAML: ${problem.message}`);
+  }
+  const keyLine = (node) => {
+    const r = rangeOf(node);
+    return r ? lc.linePos(r[0]).line : void 0;
+  };
+  const same = join4 === PATH_JOIN ? (a, b) => posix.normalize(a) === posix.normalize(b) : (a, b) => a === b;
+  const root = doc.contents;
+  let spelled = entry;
+  let edit;
+  if (root === null || isScalar(root) && root.value === null && emptySource(text, root)) {
+    edit = startManifest(text, entry, key, value, eol);
+  } else if (!isMap(root)) {
+    throw new DocmetaError(
+      `${at2()}: the manifest must be a mapping from document ${join4 === PATH_JOIN ? "path" : `"${join4}"`} to owned keys.`
+    );
+  } else {
+    const style = detectStyle(text, root, eol);
+    const matches = root.items.filter((p) => same(keyString(p.key), entry));
+    const [first, second] = matches;
+    if (first && second) {
+      throw new DocmetaError(
+        `${at2(keyLine(second.key))}: "${keyString(second.key)}" is named twice (first at line ${String(keyLine(first.key) ?? "?")}). Merge the two entries into one.`
+      );
+    }
+    if (first === void 0) {
+      if (root.flow === true && root.items.length > 0) {
+        throw new DocmetaError(
+          `${at2()}: the manifest is a flow mapping ({ \u2026 }), which this writer does not add entries to. Rewrite it in block style.`
+        );
+      }
+      edit = appendEntry(text, root, entry, key, value, style);
+    } else {
+      spelled = keyString(first.key);
+      const where = at2(keyLine(first.key));
+      const v = first.value;
+      if (!isMap(v)) {
+        throw new DocmetaError(`${where}: "${spelled}" must be a mapping of owned keys to values.`);
+      }
+      const hits = v.items.filter((kv) => keyString(kv.key) === key);
+      const [hit, again] = hits;
+      if (hit && again) {
+        throw new DocmetaError(
+          `${at2(keyLine(again.key))}: "${spelled}" sets "${key}" twice (first at line ${String(keyLine(hit.key) ?? "?")}). Remove one.`
+        );
+      }
+      const flowRefusal = () => new DocmetaError(
+        `${where}: "${spelled}" is a flow mapping ({ \u2026 }), which this writer does not add keys to. Rewrite the entry in block style.`
+      );
+      const formRefusal = () => new DocmetaError(
+        `${where}: "${spelled}" writes a key in a form this writer does not edit. Write it as "${key}: \u2026".`
+      );
+      let made;
+      if (v.flow === true) {
+        if (hit) made = replaceFlowValue(text, hit, value);
+        else if (v.items.length === 0) made = fillEmptyEntry(text, first, key, value, style);
+        else throw flowRefusal();
+        if (!made) throw hit ? flowRefusal() : formRefusal();
+      } else {
+        made = hit ? replaceBlockValue(text, hit, value, style) : insertKey(text, v, key, value, style);
+        if (!made) throw formRefusal();
+      }
+      edit = made;
+    }
+  }
+  const out = text.slice(0, edit.start) + edit.insert + text.slice(edit.end);
+  const line = readBack(
+    doc,
+    out,
+    spelled,
+    key,
+    value,
+    (why) => new DocmetaError(
+      `${at2()}: writing "${key}" for "${entry}" did not read back as written, so nothing was written. ${why}`
+    )
+  );
+  return { text: out, line };
+}
+function startManifest(text, entry, key, value, eol) {
+  const style = { step: 2, indentSeq: true, eol };
+  const block = blockLines({ [entry]: { [key]: value } }, 0, style);
+  let insert;
+  if (text === "" || text.endsWith("\n")) insert = block + eol;
+  else insert = eol + block;
+  return { start: text.length, end: text.length, insert };
+}
+function appendEntry(text, root, entry, key, value, style) {
+  const body = { [entry]: { [key]: value } };
+  if (root.flow === true) {
+    const r = rangeOf(root);
+    const start = r ? r[0] : text.length;
+    const end = contentEnd(text, root) ?? start;
+    return { start, end, insert: blockLines(body, colOf(text, start), style) };
+  }
+  const firstKey = rangeOf(root.items[0]?.key);
+  const col = firstKey ? colOf(text, firstKey[0]) : 0;
+  const pos = lineEnd2(text, contentEnd(text, root) ?? text.length);
+  const last = root.items.at(-1);
+  const spaced = root.items.length > 1 && isNode(last?.key) && last.key.spaceBefore === true;
+  return {
+    start: pos,
+    end: pos,
+    insert: style.eol + (spaced ? style.eol : "") + blockLines(body, col, style)
+  };
+}
+function insertKey(text, entryMap, key, value, style) {
+  const firstKey = rangeOf(entryMap.items[0]?.key);
+  const end = contentEnd(text, entryMap);
+  if (!firstKey || end === void 0) return void 0;
+  const pos = lineEnd2(text, end);
+  return {
+    start: pos,
+    end: pos,
+    insert: style.eol + blockLines({ [key]: value }, colOf(text, firstKey[0]), style)
+  };
+}
+function fillEmptyEntry(text, entryPair, key, value, style) {
+  const start = colonEnd(text, entryPair);
+  const keyRange = rangeOf(entryPair.key);
+  const end = contentEnd(text, entryPair.value);
+  if (start === void 0 || !keyRange || end === void 0) return void 0;
+  const col = colOf(text, keyRange[0]) + style.step;
+  return { start, end, insert: style.eol + blockLines({ [key]: value }, col, style) };
+}
+function replaceBlockValue(text, pair, value, style) {
+  const colon = colonEnd(text, pair);
+  const keyRange = rangeOf(pair.key);
+  if (colon === void 0 || !keyRange) return void 0;
+  const keyCol = colOf(text, keyRange[0]);
+  let start = colon;
+  let ownLine = false;
+  let i = colon;
+  while (text.charAt(i) === " " || text.charAt(i) === "	") i++;
+  if (text.charAt(i) === "#") {
+    start = lineEnd2(text, i);
+    ownLine = true;
+  }
+  const old = pair.value;
+  const oldEnd = isScalar(old) && old.value === null && emptySource(text, old) ? start : contentEnd(text, old) ?? start;
+  const end = Math.max(start, oldEnd);
+  let insert = afterColon(value, keyCol, style);
+  if (ownLine && !insert.startsWith(style.eol)) {
+    insert = style.eol + " ".repeat(keyCol + style.step) + insert.trimStart();
+  }
+  return { start, end, insert };
+}
+function replaceFlowValue(text, pair, value) {
+  const r = rangeOf(pair.value);
+  if (!r || emptySource(text, pair.value)) return void 0;
+  const end = contentEnd(text, pair.value) ?? r[1];
+  return { start: r[0], end, insert: flowText(value) };
+}
+function readBack(before, out, spelled, key, value, fail) {
+  const lc = new LineCounter();
+  const after = parseDocument(out, { lineCounter: lc, uniqueKeys: false });
+  const problem = after.errors[0];
+  if (problem) throw fail(`The result is not valid YAML: ${problem.message}`);
+  const was = before.toJS({ maxAliasCount: 100 });
+  const now = after.toJS({ maxAliasCount: 100 });
+  const wasRoot = isRecord(was) ? was : {};
+  const wasEntry = wasRoot[spelled];
+  const expected = {
+    ...wasRoot,
+    [spelled]: { ...isRecord(wasEntry) ? wasEntry : {}, [key]: value }
+  };
+  const nowEntry = isRecord(now) ? now[spelled] : void 0;
+  if (!isRecord(nowEntry) || !deepEqual(nowEntry[key], value)) {
+    throw fail(
+      "The value reads back differently. A Date, an undefined member, or another value YAML cannot hold does not survive the trip."
+    );
+  }
+  if (!deepEqual(now, expected)) {
+    throw fail("Another value in the manifest would have changed.");
+  }
+  const root = after.contents;
+  const pair = isMap(root) ? root.items.find((p) => keyString(p.key) === spelled) : void 0;
+  const entryMap = pair?.value;
+  const kv = isMap(entryMap) ? entryMap.items.find((p) => keyString(p.key) === key) : void 0;
+  const r = rangeOf(kv?.value) ?? rangeOf(kv?.key);
+  if (!r) throw fail("The written value could not be found again.");
+  return lc.linePos(r[0]).line;
+}
+function blockLines(pair, col, style) {
+  const s = stringify(pair, { lineWidth: 0, indent: style.step, indentSeq: style.indentSeq });
+  return indentLines(s.replace(/\n$/, "").split("\n"), col, 0).join(style.eol);
+}
+function afterColon(value, col, style) {
+  const s = stringify({ k: value }, { lineWidth: 0, indent: style.step, indentSeq: style.indentSeq });
+  const lines = s.replace(/\n$/, "").slice("k:".length).split("\n");
+  return indentLines(lines, col, 1).join(style.eol);
+}
+function indentLines(lines, col, from) {
+  const pad = " ".repeat(col);
+  return lines.map((l, i) => i < from || l === "" ? l : pad + l);
+}
+function flowText(value) {
+  const s = stringify(value, { lineWidth: 0, collectionStyle: "flow" }).replace(/\n$/, "");
+  return s.includes("\n") ? JSON.stringify(value) : s;
+}
+function detectEol2(text) {
+  const i = text.indexOf("\n");
+  return i > 0 && text.charAt(i - 1) === "\r" ? "\r\n" : "\n";
+}
+function detectStyle(text, root, eol) {
+  let step = 2;
+  for (const pair of root.items) {
+    const v = pair.value;
+    const entryKey = rangeOf(pair.key);
+    const ownedKey = isMap(v) && v.flow !== true ? rangeOf(v.items[0]?.key) : void 0;
+    if (entryKey && ownedKey) {
+      const d = colOf(text, ownedKey[0]) - colOf(text, entryKey[0]);
+      if (d > 0) {
+        step = d;
+        break;
+      }
+    }
+  }
+  return { step, indentSeq: seqIndented(text, root) ?? true, eol };
+}
+function seqIndented(text, node) {
+  if (isMap(node)) {
+    for (const pair of node.items) {
+      const v = pair.value;
+      if (isSeq(v) && v.flow !== true && v.items.length > 0) {
+        const k = rangeOf(pair.key);
+        const s = rangeOf(v);
+        if (k && s) return colOf(text, s[0]) > colOf(text, k[0]);
+      }
+      const inner = seqIndented(text, v);
+      if (inner !== void 0) return inner;
+    }
+  } else if (isSeq(node)) {
+    for (const item of node.items) {
+      const inner = seqIndented(text, item);
+      if (inner !== void 0) return inner;
+    }
+  }
+  return void 0;
+}
+function contentEnd(text, node) {
+  if (isMap(node) && node.flow !== true) {
+    const last = node.items.at(-1);
+    if (last) return contentEnd(text, last.value) ?? contentEnd(text, last.key);
+  } else if (isSeq(node) && node.flow !== true) {
+    const last = node.items.at(-1);
+    if (last !== void 0) {
+      return isPair(last) ? contentEnd(text, last.value) ?? contentEnd(text, last.key) : contentEnd(text, last);
+    }
+  }
+  const r = rangeOf(node);
+  if (!r) return void 0;
+  let end = r[1];
+  while (end > r[0] && /\s/.test(text.charAt(end - 1))) end--;
+  return end;
+}
+function colonEnd(text, pair) {
+  const r = rangeOf(pair.key);
+  if (!r) return void 0;
+  let i = r[1];
+  while (text.charAt(i) === " " || text.charAt(i) === "	") i++;
+  return text.charAt(i) === ":" ? i + 1 : void 0;
+}
+function lineEnd2(text, i) {
+  const j = text.indexOf("\n", i);
+  if (j < 0) return text.length;
+  return j > 0 && text.charAt(j - 1) === "\r" ? j - 1 : j;
+}
+function colOf(text, offset) {
+  if (offset === 0) return 0;
+  let start = text.lastIndexOf("\n", offset - 1) + 1;
+  if (start === 0 && text.startsWith("\uFEFF")) start = 1;
+  return offset - start;
+}
+function rangeOf(node) {
+  return isNode(node) ? node.range ?? void 0 : void 0;
+}
+function emptySource(text, node) {
+  const r = rangeOf(node);
+  return !r || text.slice(r[0], r[1]).trim() === "";
+}
+function keyString(key) {
+  return isScalar(key) ? String(key.value) : String(key);
+}
+function isRecord(x) {
+  return typeof x === "object" && x !== null && !Array.isArray(x);
+}
+
+// src/cite/core/page.ts
+var MAX_MARKERS_PER_PAGE = 500;
+var ELEMENT_BACKED = /* @__PURE__ */ new Set(["html", "xml"]);
+var MARKER_JSON = "A marker names an entry by id. Write the entry in frontmatter or the sidecar.";
+function ownedMessage(owner) {
+  return `"citations" is owned by manifest ${owner.file} (collection ${owner.collection}); remove it from the document`;
+}
+var Ajv2020 = Ajv2020Ns.default;
+var entryValidator;
+function compileEntryValidator() {
+  if (entryValidator) return entryValidator;
+  const ajv = new Ajv2020({ allErrors: false, strict: false });
+  ajv.addSchema(citations_default);
+  entryValidator = ajv.compile({
+    $ref: `${citations_default.$id}#/$defs/citationEntry`
+  });
+  return entryValidator;
+}
+function validateEntry(entry) {
+  const validate = compileEntryValidator();
+  if (validate(entry)) return void 0;
+  const first = validate.errors?.[0];
+  if (!first) return "invalid entry";
+  return `${first.instancePath} ${first.message ?? "is invalid"}`.trim();
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function toCitation(entry) {
+  const source = isRecord2(entry.source) ? entry.source : {};
+  const citation = {
+    source: {
+      file: String(source.file),
+      integrity: String(source.integrity)
+    }
+  };
+  if (typeof source.lines === "number" || typeof source.lines === "string") {
+    citation.source.lines = source.lines;
+  }
+  if (typeof source["commit-sha"] === "string") {
+    citation.source["commit-sha"] = source["commit-sha"];
+  }
+  if (typeof entry.id === "string") citation.id = entry.id;
+  if (isRecord2(entry.claim)) {
+    const claim = entry.claim;
+    citation.claim = { integrity: String(claim.integrity) };
+    if (typeof claim.lines === "number" || typeof claim.lines === "string") {
+      citation.claim.lines = claim.lines;
+    }
+  }
+  if (typeof entry.quote === "boolean") citation.quote = entry.quote;
+  return citation;
+}
+function finding(rule, message, extra) {
+  const level = DEFAULT_SEVERITY[rule];
+  const out = {
+    rule,
+    ruleId: ruleId(rule),
+    // The caller re-applies the configured severity table; no page-side rule
+    // defaults to `off`, so there is nothing to collapse.
+    severity: level === "off" ? "error" : level,
+    message
+  };
+  if (extra.line !== void 0) out.line = extra.line;
+  if (extra.file !== void 0) out.file = extra.file;
+  if (extra.id !== void 0) out.id = extra.id;
+  if (extra.src !== void 0) out.src = extra.src;
+  if (extra.index !== void 0) out.index = extra.index;
+  return out;
+}
+function named(id, text) {
+  return id === void 0 ? text : `${id}: ${text}`;
+}
+function subjectOf(entry) {
+  const out = {};
+  if (!isRecord2(entry)) return out;
+  if (typeof entry.id === "string") out.id = entry.id;
+  if (isRecord2(entry.source) && typeof entry.source.file === "string") out.src = entry.source.file;
+  return out;
+}
+function pickExtractor(file, format) {
+  if (format !== void 0) {
+    const forced = extractorByName(format);
+    if (!forced?.implemented) {
+      throw new CiteError(
+        `Unknown format "${format}". Supported extensions: ${supportedExtensions().join(", ")}.`
+      );
+    }
+    return forced;
+  }
+  const extension = extname2(file);
+  const byExt = extractorForExtension(extension);
+  if (!byExt) {
+    throw new CiteError(
+      `Unsupported file type "${extension}" for "${file}". Supported: ${supportedExtensions().join(", ")}. Use --as to override.`
+    );
+  }
+  return byExt;
+}
+function byLine(a, b) {
+  return (a.line ?? Number.MAX_SAFE_INTEGER) - (b.line ?? Number.MAX_SAFE_INTEGER);
+}
+function bodyLineOf(content, bodyOffset) {
+  if (bodyOffset <= 0) return 1;
+  const line = lineAt(content, bodyOffset);
+  return content.charCodeAt(bodyOffset - 1) === 10 ? line : line + 1;
+}
+function readPage(file, content, opts) {
+  const extractor = pickExtractor(file, opts?.format);
+  const format = extractor.name;
+  const extracted = extractor.extract(content, file);
+  const data = extracted.data;
+  const bodyOffset = ELEMENT_BACKED.has(format) ? 0 : locateFrontmatter(content)?.closeEnd ?? 0;
+  const bodyLine = bodyLineOf(content, bodyOffset);
+  const findings = [];
+  const citations = [];
+  const byId = /* @__PURE__ */ new Map();
+  const ids = /* @__PURE__ */ new Set();
+  const markedAt = /* @__PURE__ */ new Map();
+  for (const key of Object.keys(data)) {
+    if (!key.startsWith("citation-")) continue;
+    findings.push(
+      finding(
+        "entry-invalid",
+        `"${key}" is not a citations key; the page root reserves the citation- prefix`,
+        { line: extracted.lineFor(`/${key}`) }
+      )
+    );
+  }
+  const injected = opts?.citations;
+  const rawCitations = data.citations;
+  if (opts?.owned !== void 0 && rawCitations !== void 0) {
+    findings.push(
+      finding("entry-invalid", ownedMessage(opts.owned), {
+        line: extracted.lineFor("/citations")
+      })
+    );
+  }
+  if (injected === void 0 && rawCitations !== void 0 && !Array.isArray(rawCitations)) {
+    findings.push(
+      finding("entry-invalid", "citations must be an array of entries", {
+        line: extracted.lineFor("/citations")
+      })
+    );
+  }
+  const inputs = injected !== void 0 ? [...injected] : (Array.isArray(rawCitations) ? rawCitations : []).map((entry, index) => {
+    const origin = { kind: "frontmatter", file };
+    const line = extracted.lineFor(`/citations/${String(index)}`);
+    if (line !== void 0) origin.line = line;
+    return { entry, origin };
+  });
+  inputs.forEach((input, index) => {
+    const origin = { ...input.origin, index };
+    const where = { index };
+    if (origin.line !== void 0) where.line = origin.line;
+    if (origin.kind === "manifest") where.file = origin.file;
+    const entry = input.entry;
+    const error = validateEntry(entry);
+    if (error !== void 0 || !isRecord2(entry)) {
+      findings.push(finding("entry-invalid", error ?? "must be object", { ...where, ...subjectOf(entry) }));
+      return;
+    }
+    const citation = toCitation(entry);
+    const subject = { ...where, src: spellSource(citation.source) };
+    if (citation.id !== void 0) subject.id = citation.id;
+    const bad = ["claim", "source"].find((end) => {
+      const lines = end === "claim" ? citation.claim?.lines : citation.source.lines;
+      return lines !== void 0 && parseLines(lines) === void 0;
+    });
+    if (bad !== void 0) {
+      const lines = bad === "claim" ? citation.claim?.lines : citation.source.lines;
+      findings.push(
+        finding(
+          "entry-invalid",
+          named(citation.id, `${bad}.lines "${String(lines)}" ends before it starts`),
+          subject
+        )
+      );
+      return;
+    }
+    const encrypted = isEncryptedValue(citation.source.file);
+    if (encrypted !== isKeyedPin(citation.source.integrity)) {
+      findings.push(
+        finding(
+          "entry-invalid",
+          named(
+            citation.id,
+            encrypted ? "an encrypted source is pinned with hmac-sha256-, not sha256-." : "a plain source is pinned with sha256-, not hmac-sha256-."
+          ),
+          subject
+        )
+      );
+      return;
+    }
+    const page = { citation, origin };
+    citations.push(page);
+    if (citation.id !== void 0) {
+      if (ids.has(citation.id)) {
+        findings.push(finding("entry-invalid", `duplicate id "${citation.id}"`, subject));
+      } else {
+        ids.add(citation.id);
+        byId.set(citation.id, page);
+      }
+    }
+  });
+  const body = content.slice(bodyOffset);
+  const statements = parseStatements(body, format, {
+    offset: bodyOffset,
+    line: bodyLine
+  });
+  if (statements.length > MAX_MARKERS_PER_PAGE) {
+    findings.push(
+      finding(
+        "marker-invalid",
+        `more than ${String(MAX_MARKERS_PER_PAGE)} markers on one page (${String(statements.length)}); the rest are not read`,
+        { line: statements[MAX_MARKERS_PER_PAGE]?.line }
+      )
+    );
+  }
+  for (const statement of statements.slice(0, MAX_MARKERS_PER_PAGE)) {
+    const { payload } = statement;
+    if (payload.kind === "bad") {
+      findings.push(
+        finding(
+          "marker-invalid",
+          payload.json === true ? MARKER_JSON : `invalid marker: ${payload.reason}`,
+          { line: statement.line }
+        )
+      );
+      continue;
+    }
+    const target = byId.get(payload.id);
+    if (target === void 0) {
+      findings.push(
+        finding("marker-orphan", `no entry has id "${payload.id}"`, {
+          line: statement.line,
+          id: payload.id
+        })
+      );
+      continue;
+    }
+    const first = markedAt.get(target);
+    if (first !== void 0) {
+      findings.push(
+        finding(
+          "marker-repeated",
+          `${payload.id} is named by markers at lines ${String(first)} and ${String(statement.line)}; the first anchors it.`,
+          {
+            line: statement.line,
+            id: payload.id,
+            index: target.origin.index,
+            src: spellSource(target.citation.source)
+          }
+        )
+      );
+      continue;
+    }
+    markedAt.set(target, statement.line);
+    target.marker = statement;
+  }
+  for (const entry of citations) {
+    const { citation, origin, marker } = entry;
+    const subject = { index: origin.index, src: spellSource(citation.source) };
+    if (citation.id !== void 0) subject.id = citation.id;
+    if (origin.line !== void 0) subject.line = origin.line;
+    if (origin.kind === "manifest") subject.file = origin.file;
+    if (citation.claim?.lines !== void 0 && marker !== void 0) {
+      const onPage = { index: origin.index, line: marker.line, src: subject.src };
+      if (citation.id !== void 0) onPage.id = citation.id;
+      findings.push(
+        finding(
+          "anchor-invalid",
+          `${citation.id ?? "the entry"} has claim lines and a marker. Keep one.`,
+          onPage
+        )
+      );
+      continue;
+    }
+    if (citation.quote === true && citation.claim?.lines === void 0 && marker === void 0) {
+      findings.push(
+        finding("anchor-invalid", named(citation.id, "quote needs a claim or a marker."), subject)
+      );
+    }
+  }
+  return {
+    file,
+    format,
+    content,
+    bodyOffset,
+    bodyLine,
+    citations,
+    statements,
+    findings: findings.sort(byLine)
+  };
+}
+
+// src/cite/core/sidecar.ts
+import { isAbsolute, relative, resolve, sep as sep2 } from "node:path";
+var CITATIONS_KEY2 = "citations";
+var toPosix = (path) => path.split(sep2).join("/");
+function reportedPath(abs, base) {
+  const rel = relative(base, abs);
+  return rel === "" ? "." : toPosix(rel);
+}
+function urlManifestRefusal(source, collection) {
+  return `${source}: collection ${collection}: ${CITATIONS_KEY2} cannot come from a URL manifest, because cite writes them.`;
+}
+function twoManifestsRefusal(label, a, b) {
+  return `${label} is in collections ${a} and ${b}, and both keep citations in a manifest.`;
+}
+function ownsCitations(manifest) {
+  return manifest.keys.includes(CITATIONS_KEY2);
+}
+async function loadCitationSidecars(opts) {
+  const toError = opts.toError ?? ((message) => new CiteError(message));
+  const manifests = [];
+  const scoped = [];
+  for (const collection of opts.collections) {
+    const owning = collection.externalMetadata.filter(ownsCitations);
+    if (owning.length === 0) continue;
+    for (const manifest of owning) {
+      if (classifyRef(manifest.file).kind === "url") {
+        throw toError(urlManifestRefusal(opts.configSource, collection.name));
+      }
+      const path = isAbsolute(manifest.file) ? manifest.file : resolve(opts.configDir, manifest.file);
+      manifests.push({
+        collection: collection.name,
+        path,
+        file: reportedPath(path, opts.base),
+        join: externalMetadataJoin(manifest)
+      });
+    }
+    scoped.push({ ...collection, externalMetadata: owning });
+  }
+  if (manifests.length === 0) return null;
+  const index = await loadExternalMetadata(scoped, {
+    configDir: opts.configDir,
+    base: opts.base
+  });
+  if (index === null) return null;
+  return sidecars(index, manifests, scoped, opts);
+}
+function sidecars(index, manifests, collections, opts) {
+  const toError = opts.toError ?? ((message) => new CiteError(message));
+  const { configDir, base } = opts;
+  const forPage = (label, content, format) => {
+    const members = memberOf(collections, configDir, base, label);
+    if (members.length === 0) return { joins: [] };
+    const mine = manifests.filter((m) => members.includes(m.collection));
+    const [owner, second] = mine;
+    if (owner === void 0) return { joins: [] };
+    if (second !== void 0) {
+      throw toError(twoManifestsRefusal(label, owner.collection, second.collection));
+    }
+    const extractor = pickExtractor(label, format);
+    const extracted = extractor.extract(content, label);
+    const merged = mergeExternalMetadata(label, extracted, index, members, base, {
+      encryptionKey: () => opts.key
+    });
+    const out = { owner, joins: merged.joins };
+    if (owner.join === PATH_JOIN) {
+      out.entry = toPosix(relative(configDir, resolve(base, label)));
+    } else {
+      const value = merged.joins.find((j) => j.field === owner.join)?.value;
+      const raw = value ?? extracted.data[owner.join];
+      if (typeof raw === "string" && raw !== "") out.entry = raw;
+      else if (typeof raw === "number" || typeof raw === "boolean") out.entry = String(raw);
+    }
+    const where = merged.locate(`/${CITATIONS_KEY2}`);
+    if (where !== void 0) {
+      const supplied = merged.extracted.data[CITATIONS_KEY2];
+      const list = Array.isArray(supplied) ? supplied : [supplied];
+      out.citations = list.map((entry, i) => {
+        const at2 = merged.locate(`/${CITATIONS_KEY2}/${String(i)}`);
+        const line = (Array.isArray(supplied) ? at2?.line : void 0) ?? where.line;
+        return {
+          entry,
+          origin: {
+            kind: "manifest",
+            file: where.file,
+            ...line === void 0 ? {} : { line }
+          }
+        };
+      });
+    }
+    return out;
+  };
+  return {
+    manifests,
+    configDir,
+    base,
+    forPage,
+    orphans: (loaded, covered) => orphanEntries(index, loaded, base, covered),
+    orphanJoins: (matched, covered) => orphanJoins(index, matched, covered)
+  };
+}
+function orphanRefusal(orphans, toError = (m) => new CiteError(m)) {
+  return toError(orphanError(orphans).message);
+}
+function duplicateJoinRefusal(field, value, file, labels) {
+  return `${String(labels.length)} pages carry ${field} "${value}"; ${file} cannot tell them apart (${labels.join(", ")}).`;
+}
+function sidecarsFor(run3, over = {}) {
+  const declared = run3.configFile?.collections ?? [];
+  if (run3.configDir === void 0 || declared.length === 0) return Promise.resolve(null);
+  return loadCitationSidecars({
+    // Every declared collection, whatever `--collection` or the paths chose.
+    collections: declared,
+    configDir: run3.configDir,
+    base: over.base ?? run3.base,
+    configSource: run3.configSource ?? run3.configPath ?? "the config",
+    ...run3.key === void 0 ? {} : { key: run3.key },
+    ...over.toError === void 0 ? {} : { toError: over.toError }
+  });
+}
+
+// src/cite/core/manifest.ts
+import { readFile as readFile2 } from "node:fs/promises";
+import { posix as posix2 } from "node:path";
+import { LineCounter as LineCounter2, isMap as isMap2, isNode as isNode2, isScalar as isScalar2, isSeq as isSeq2, parseDocument as parseDocument2 } from "yaml";
+
+// src/cite/core/write.ts
+function extractorFor(format) {
+  const extractor = extractorByName(format);
+  if (!extractor) throw new CiteError(`Unknown format "${format}".`);
+  return extractor;
+}
+function readsFencedFrontmatter(extractor, label) {
+  return extractor.extract("---\nprobe: 1\n---\n", label).fenced === true;
+}
+function appendFrontmatterCitation(content, format, citation, filePath) {
+  const label = filePath ?? "the page";
+  const extractor = extractorFor(format);
+  if (!extractor.apply || !readsFencedFrontmatter(extractor, label)) {
+    throw new CiteError(
+      `${label} has no frontmatter to write to; keep its citations in a manifest instead.`
+    );
+  }
+  const extracted = extractor.extract(content, label);
+  if (locateFrontmatter(content)?.flavor === "toml") {
+    throw new CiteError(
+      `${label} has TOML frontmatter; manni cannot add a citations table without re-emitting the whole block, which would drop its comments. Add the entry by hand.`
+    );
+  }
+  const raw = extracted.data.citations ?? [];
+  if (!Array.isArray(raw)) {
+    throw new CiteError(`${label}: \`citations\` is not a list; edit it by hand.`);
+  }
+  const existing = raw;
+  const entry = entryObject(citation);
+  try {
+    return extractor.apply(content, { citations: [...existing, entry] });
+  } catch (e) {
+    if (e instanceof DocmetaError) throw new CiteError(`${label}: ${e.message}`);
+    throw e;
+  }
+}
+function entryObject(citation) {
+  const source = { file: citation.source.file };
+  if (citation.source.lines !== void 0) source.lines = citation.source.lines;
+  source.integrity = citation.source.integrity;
+  if (citation.source["commit-sha"] !== void 0) {
+    source["commit-sha"] = citation.source["commit-sha"];
+  }
+  const entry = {};
+  if (citation.id !== void 0) entry.id = citation.id;
+  if (citation.claim !== void 0) {
+    const claim = {};
+    if (citation.claim.lines !== void 0) claim.lines = citation.claim.lines;
+    claim.integrity = citation.claim.integrity;
+    entry.claim = claim;
+  }
+  entry.source = source;
+  if (citation.quote !== void 0) entry.quote = citation.quote;
+  return entry;
+}
+function needsYamlQuotes(value) {
+  return value === "" || /^[\s!&*?|>'"%@`{}[\],#]/.test(value) || /^-(\s|$)/.test(value) || /:\s|\s#|:$|\s$/.test(value) || /^(?:true|false|null|~|yes|no|on|off|[-+]?(?:\d[\d_]*\.?\d*|\.\d+)(?:e[-+]?\d+)?)$/i.test(value);
+}
+var doubleQuote = (value) => JSON.stringify(value);
+var singleQuote = (value) => `'${value.replace(/'/g, "''")}'`;
+function splitScalarLine(line, field) {
+  const keyed = new RegExp(`^(\\s*(?:-\\s+)?"?${field}"?\\s*:\\s*)(.*)$`).exec(line);
+  const lead = keyed?.[1];
+  const rest = keyed?.[2];
+  if (lead === void 0 || rest === void 0) return void 0;
+  const quote = rest.charAt(0);
+  let end;
+  if (quote === '"' || quote === "'") {
+    end = -1;
+    for (let i = 1; i < rest.length; i++) {
+      const ch = rest.charAt(i);
+      if (quote === '"' && ch === "\\") {
+        i++;
+      } else if (ch === quote) {
+        if (quote === "'" && rest.charAt(i + 1) === "'") {
+          i++;
+          continue;
+        }
+        end = i + 1;
+        break;
+      }
+    }
+    if (end < 0) return void 0;
+  } else {
+    const comment = /\s#/.exec(rest);
+    end = comment ? comment.index : rest.length;
+    while (end > 0 && /\s/.test(rest.charAt(end - 1))) end--;
+  }
+  return { lead, scalar: rest.slice(0, end), trail: rest.slice(end) };
+}
+function spliceEntryField(content, format, index, path, value) {
+  const [which, field] = path;
+  const refuse = () => new CiteError(
+    `Cannot rewrite citations[${String(index)}].${which}.${field} in ${format} frontmatter; edit it by hand.`
+  );
+  const extractor = extractorFor(format);
+  const pointer = `/citations/${String(index)}/${which}/${field}`;
+  const line = extractor.extract(content, "page").lineFor(pointer);
+  if (line === void 0) throw refuse();
+  const start = offsetOfLine(content, line);
+  const nl = content.indexOf("\n", start);
+  let end = nl === -1 ? content.length : nl;
+  if (end > start && content.charAt(end - 1) === "\r") end--;
+  const parts = splitScalarLine(content.slice(start, end), field);
+  if (!parts) throw refuse();
+  const quote = parts.scalar.charAt(0);
+  const spelled = typeof value === "number" ? String(value) : quote === '"' ? doubleQuote(value) : quote === "'" ? singleQuote(value) : needsYamlQuotes(value) ? doubleQuote(value) : value;
+  const out = content.slice(0, start) + parts.lead + spelled + parts.trail + content.slice(end);
+  const check = extractor.extract(out, "page").data.citations;
+  const entry = Array.isArray(check) ? check[index] : void 0;
+  const block = isRecord3(entry) ? entry[which] : void 0;
+  const readBack2 = isRecord3(block) ? block[field] : void 0;
+  if (readBack2 !== value) throw refuse();
+  return out;
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function insertStatementBefore(content, offset, statement) {
+  const start = offsetOfLine(content, lineAt(content, offset));
+  return content.slice(0, start) + statement + detectEol(content) + content.slice(start);
+}
+function unifiedDiff(label, before, after) {
+  const a = splitLines(before);
+  const b = splitLines(after);
+  let head = 0;
+  while (head < a.length && head < b.length && a[head] === b[head]) head++;
+  let tail = 0;
+  while (tail < a.length - head && tail < b.length - head && a[a.length - 1 - tail] === b[b.length - 1 - tail]) tail++;
+  const x = a.slice(head, a.length - tail);
+  const y = b.slice(head, b.length - tail);
+  if (x.length === 0 && y.length === 0) return "";
+  const width = y.length + 1;
+  const lcs = new Uint32Array((x.length + 1) * width);
+  for (let i2 = x.length - 1; i2 >= 0; i2--) {
+    for (let j2 = y.length - 1; j2 >= 0; j2--) {
+      lcs[i2 * width + j2] = x[i2] === y[j2] ? (lcs[(i2 + 1) * width + j2 + 1] ?? 0) + 1 : Math.max(lcs[(i2 + 1) * width + j2] ?? 0, lcs[i2 * width + j2 + 1] ?? 0);
+    }
+  }
+  const edits = a.slice(0, head).map((text) => ({ op: " ", text }));
+  let i = 0;
+  let j = 0;
+  while (i < x.length || j < y.length) {
+    const xi = x[i];
+    const yj = y[j];
+    if (xi !== void 0 && yj !== void 0 && xi === yj) {
+      edits.push({ op: " ", text: xi });
+      i++;
+      j++;
+    } else if (xi !== void 0 && (yj === void 0 || (lcs[(i + 1) * width + j] ?? 0) >= (lcs[i * width + j + 1] ?? 0))) {
+      edits.push({ op: "-", text: xi });
+      i++;
+    } else if (yj !== void 0) {
+      edits.push({ op: "+", text: yj });
+      j++;
+    }
+  }
+  edits.push(...a.slice(a.length - tail).map((text) => ({ op: " ", text })));
+  const CONTEXT2 = 1;
+  const out = [`--- ${label}`, `+++ ${label}`];
+  let pos = 0;
+  while (pos < edits.length) {
+    if (edits[pos]?.op === " ") {
+      pos++;
+      continue;
+    }
+    const from = Math.max(0, pos - CONTEXT2);
+    let to = pos;
+    for (let k = pos; k < edits.length; k++) {
+      if (edits[k]?.op !== " ") to = k;
+      else if (k - to > CONTEXT2 * 2) break;
+    }
+    to = Math.min(edits.length - 1, to + CONTEXT2);
+    let oldStart = 1;
+    let newStart = 1;
+    for (let k = 0; k < from; k++) {
+      const op = edits[k]?.op;
+      if (op !== "+") oldStart++;
+      if (op !== "-") newStart++;
+    }
+    const slice = edits.slice(from, to + 1);
+    const oldCount = slice.filter((e) => e.op !== "+").length;
+    const newCount = slice.filter((e) => e.op !== "-").length;
+    out.push(
+      `@@ -${oldCount === 0 ? oldStart - 1 : oldStart},${oldCount} +${newCount === 0 ? newStart - 1 : newStart},${newCount} @@`,
+      ...slice.map((e) => e.op + e.text)
+    );
+    pos = to + 1;
+  }
+  return out.join("\n") + "\n";
+}
+
+// src/cite/core/manifest.ts
+var ManifestSet = class {
+  held = /* @__PURE__ */ new Map();
+  /** Read a manifest, or hand back the copy this run has already rewritten. */
+  async hold(manifest) {
+    const already = this.held.get(manifest.path);
+    if (already !== void 0) return already;
+    let before;
+    try {
+      before = await readFile2(manifest.path, "utf8");
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      throw new CiteError(`Manifest ${manifest.file} could not be read: ${reason}`);
+    }
+    const fresh = { path: manifest.path, file: manifest.file, before, text: before };
+    this.held.set(manifest.path, fresh);
+    return fresh;
+  }
+  /**
+   * Write one page's whole `citations` list into its entry, and answer where
+   * the entry at `index` now sits. The manifest is not saved: `changed()`
+   * lists what the run would write.
+   */
+  async write(manifest, entry, citations, index) {
+    const held = await this.hold(manifest);
+    const spliced = splice(held.text, {
+      entry,
+      key: CITATIONS_KEY2,
+      value: [...citations],
+      join: manifest.join,
+      file: manifest.file
+    });
+    held.text = spliced.text;
+    return { file: manifest.file, line: itemLine(spliced.text, entry, index, manifest.join) ?? spliced.line };
+  }
+  /** The manifests this run rewrote, with the diff of each. */
+  changed() {
+    return [...this.held.values()].filter((m) => m.text !== m.before).map((m) => ({ ...m, diff: unifiedDiff(m.file, m.before, m.text) }));
+  }
+};
+function splice(text, options) {
+  try {
+    return spliceManifestValue(text, options);
+  } catch (error) {
+    if (error instanceof DocmetaError) throw new CiteError(error.message);
+    throw error;
+  }
+}
+function itemLine(text, entry, index, join4) {
+  const lc = new LineCounter2();
+  const doc = parseDocument2(text, { lineCounter: lc, uniqueKeys: false });
+  if (doc.errors.length > 0) return void 0;
+  const root = doc.contents;
+  if (!isMap2(root)) return void 0;
+  const same = (key) => {
+    const spelled = isScalar2(key) ? String(key.value) : String(key);
+    return join4 === "path" ? posix2.normalize(spelled) === posix2.normalize(entry) : spelled === entry;
+  };
+  const pair = root.items.find((p) => same(p.key));
+  const value = pair?.value;
+  if (!isMap2(value)) return void 0;
+  const kv = value.items.find(
+    (p) => (isScalar2(p.key) ? String(p.key.value) : String(p.key)) === CITATIONS_KEY2
+  );
+  const list = kv?.value;
+  if (!isSeq2(list)) return void 0;
+  const item = list.items[index];
+  const range = isNode2(item) ? item.range : void 0;
+  return range ? lc.linePos(range[0]).line : void 0;
+}
+
+// src/cite/core/adapt.ts
+import { isAbsolute as isAbsolute2 } from "node:path";
+function short(commit) {
+  return commit.slice(0, 7);
+}
+function plural(n, noun) {
+  return `${String(n)} ${noun}${n === 1 ? "" : "s"}`;
+}
+function listOf(values) {
+  if (values.length <= 1) return values.join("");
+  return `${values.slice(0, -1).join(", ")} and ${values[values.length - 1] ?? ""}`;
+}
+function citesEncrypted(src) {
+  try {
+    return parseSrc(src).encrypted;
+  } catch {
+    return false;
+  }
+}
+function missingMessage(source) {
+  if (!citesEncrypted(source.src)) return "missing";
+  switch (source.missingReason) {
+    case "no-key":
+      return "missing (no encryption key is available to decrypt it)";
+    case "undecryptable":
+      return "missing (does not decrypt under the current key)";
+    case "untracked":
+      return "missing (no tracked file matches; wrong --root?)";
+    case "unreadable":
+    case void 0:
+      return "missing";
+  }
+}
+function messageFor(source) {
+  switch (source.status) {
+    case "current":
+      return "current";
+    case "skipped":
+      return "skipped";
+    case "moved":
+      return `moved -> ${source.newSrc ?? "?"}`;
+    case "moved-ambiguous": {
+      const candidates2 = source.candidates ?? [];
+      return `moved, ${plural(candidates2.length, "candidate")} (${candidates2.join(", ")}); widen the range`;
+    }
+    case "changed": {
+      if (source.commitSha === void 0) return "changed";
+      const at2 = short(source.commitSha);
+      if (source.historyAvailable === false) {
+        return `changed (history unavailable: commit ${at2} not found; fetch-depth: 0)`;
+      }
+      if (source.commitsSince === void 0) return `changed since ${at2}`;
+      return `changed since ${at2}, ${plural(source.commitsSince.length, "commit")}`;
+    }
+    case "never-true":
+      return source.commitSha === void 0 ? "never true: the pin does not match at the recorded commit" : `never true: the pin does not match at ${short(source.commitSha)}`;
+    case "missing":
+      return missingMessage(source);
+  }
+}
+function named2(id, text) {
+  return id === void 0 ? text : `${id}: ${text}`;
+}
+function at(spec) {
+  return spec.includes("-") ? `lines ${spec}` : `line ${spec}`;
+}
+function claimMessageFor(result) {
+  const claim = result.claim;
+  const id = result.citation.id;
+  if (claim === null) return "";
+  const where = claim.fileLines ?? (result.markerLine === void 0 ? void 0 : String(result.markerLine));
+  switch (claim.status) {
+    case "moved":
+      return named2(
+        id,
+        `the claim moved from ${at(where ?? "?")} to ${at(claim.newFileLines ?? "?")}.`
+      );
+    case "moved-ambiguous":
+      return named2(
+        id,
+        `the claim at ${at(where ?? "?")} now appears at lines ${listOf(claim.candidateFileLines ?? [])}.`
+      );
+    case "changed":
+      return where === void 0 ? named2(id, "the claim has no lines and no marker names the entry, so its pin anchors nothing.") : named2(id, `the claim at ${at(where)} has changed since it was pinned.`);
+    case "current":
+    case "skipped":
+      return "";
+  }
+}
+function sourceRuleOf(status) {
+  if (status === "skipped" || status === "current") return void 0;
+  return `source-${status}`;
+}
+function claimRuleOf(claim) {
+  const status = claim.status;
+  if (status === "skipped" || status === "current") return void 0;
+  return `claim-${status}`;
+}
+function entrySite(result) {
+  const site = {};
+  if (result.origin.line !== void 0) site.line = result.origin.line;
+  if (result.origin.kind === "manifest") site.file = result.origin.file;
+  return site;
+}
+function anchorSite(result) {
+  if (result.anchorLine !== void 0) return { line: result.anchorLine };
+  return entrySite(result);
+}
+function findingsFor(results, severity) {
+  const out = [];
+  const push = (result, rule, message, site, extra) => {
+    const level = severity[rule];
+    if (level === "off") return;
+    const finding2 = {
+      rule,
+      ruleId: ruleId(rule),
+      severity: level,
+      message,
+      src: result.source.src,
+      index: result.origin.index
+    };
+    if (site.line !== void 0) finding2.line = site.line;
+    if (site.file !== void 0) finding2.file = site.file;
+    if (result.citation.id !== void 0) finding2.id = result.citation.id;
+    if (extra?.newSrc !== void 0) finding2.newSrc = extra.newSrc;
+    out.push(finding2);
+  };
+  for (const result of results) {
+    const claim = result.claim;
+    if (claim !== null) {
+      const rule2 = claimRuleOf(claim);
+      if (rule2 !== void 0) {
+        const site = claimLine(claim) === void 0 && result.markerLine === void 0 ? entrySite(result) : { line: claimLine(claim) ?? result.markerLine };
+        push(result, rule2, claimMessageFor(result), site);
+      }
+    }
+    const rule = sourceRuleOf(result.source.status);
+    if (rule === void 0) continue;
+    const extra = result.source.newSrc === void 0 ? void 0 : { newSrc: result.source.newSrc };
+    push(result, rule, messageFor(result.source), anchorSite(result), extra);
+  }
+  return out;
+}
+function integrityFor(finding2, results) {
+  if (finding2.index === void 0) return void 0;
+  return results.find((r) => r.origin.index === finding2.index)?.citation.source.integrity;
+}
+function errorSite(finding2) {
+  if (finding2.file === void 0) {
+    return finding2.line === void 0 ? {} : { line: finding2.line };
+  }
+  if (finding2.file.startsWith("../") || isAbsolute2(finding2.file)) return {};
+  return {
+    file: finding2.file,
+    ...finding2.line === void 0 ? {} : { line: finding2.line }
+  };
+}
+function toValidationResult(report) {
+  const errors = report.findings.map((finding2) => {
+    const error = {
+      schema: RULE_ID_PREFIX,
+      instancePath: finding2.index === void 0 ? "" : `/citations/${String(finding2.index)}`,
+      message: finding2.message,
+      keyword: finding2.rule,
+      severity: finding2.severity
+    };
+    const subject = finding2.id ?? integrityFor(finding2, report.citations);
+    if (subject !== void 0) error.subject = subject;
+    const site = errorSite(finding2);
+    if (site.file !== void 0) error.file = site.file;
+    if (site.line !== void 0) error.line = site.line;
+    return error;
+  });
+  return {
+    file: report.file,
+    format: report.format,
+    ok: !errors.some(isErrorSeverity),
+    schemas: [RULE_ID_PREFIX],
+    errors
+  };
+}
+
+// src/cite/core/check-page.ts
+function byLine2(a, b) {
+  return (a.line ?? Number.MAX_SAFE_INTEGER) - (b.line ?? Number.MAX_SAFE_INTEGER);
+}
+function relevel(finding2, severity) {
+  const level = severity[finding2.rule];
+  if (level === "off") return void 0;
+  return { ...finding2, severity: level };
+}
+async function citedNow(input, source, entry) {
+  const range = sourceRange(entry.citation.source);
+  const read = await readSource(input.root, input.index, range, input.key);
+  if (read.kind === "missing") return void 0;
+  const at2 = source.status === "moved" && source.newSrc !== void 0 ? parseSrc(source.newSrc) : range;
+  try {
+    return sliceLines(splitLines(read.text), at2);
+  } catch {
+    return void 0;
+  }
+}
+function faithful(blockText, pin, key, now) {
+  return hashLines(splitLines(blockText).join("\n"), key) === pin || now !== void 0 && blockMatches(blockText, now);
+}
+function insideOf(lines, block) {
+  return lines.slice(block.start, block.end - 1).join("\n");
+}
+async function quoteFindings(input, entry, result) {
+  const { citation } = entry;
+  if (citation.quote !== true || result.anchor === null) return [];
+  const id = citation.id;
+  const named3 = (text) => id === void 0 ? text : `${id}: ${text}`;
+  const { page } = input;
+  let block;
+  if (result.anchor === "marker" && entry.marker !== void 0) {
+    block = anchoredLines(page.content, entry.marker.end, page.format, true);
+    if (block === void 0) {
+      return [
+        {
+          rule: "quote-drift",
+          message: "quote: true, but no fenced block follows the marker",
+          ...result.markerLine === void 0 ? {} : { line: result.markerLine }
+        }
+      ];
+    }
+  } else {
+    const at2 = result.claim === null ? void 0 : claimLinesNow(result.claim);
+    if (at2 === void 0) return [];
+    const span = fenceSpanAt(page.content, at2.start, page.format);
+    if (span === void 0 || span.end !== at2.end) {
+      return [
+        {
+          rule: "anchor-invalid",
+          message: named3(
+            `the quote's claim lines ${at2.start === at2.end ? String(at2.start) : `${String(at2.start)}-${String(at2.end)}`} are no longer a fenced block.`
+          ),
+          line: at2.start
+        }
+      ];
+    }
+    block = span;
+  }
+  if (!input.checkSources || result.source.status === "missing") return [];
+  const key = sourceRange(citation.source).encrypted ? input.key : void 0;
+  const now = await citedNow(input, result.source, entry);
+  const inside = insideOf(input.lines, block);
+  if (faithful(inside, citation.source.integrity, key, now)) return [];
+  return [
+    {
+      rule: "quote-drift",
+      message: "quote: true, but the fenced block does not reproduce the cited lines",
+      line: block.start
+    }
+  ];
+}
+function anchorOf(entry, claim, page) {
+  const { citation, marker } = entry;
+  const hasLines = citation.claim?.lines !== void 0;
+  const out = { anchor: null };
+  if (marker !== void 0) out.markerLine = marker.line;
+  if (hasLines && marker !== void 0) return out;
+  if (hasLines) {
+    out.anchor = "claim";
+    const at2 = claim === null ? void 0 : claimLineNow(claim);
+    if (at2 !== void 0) out.anchorLine = at2;
+    return out;
+  }
+  if (marker !== void 0) {
+    out.anchor = "marker";
+    const unit = anchoredLines(page.content, marker.end, page.format, citation.quote === true);
+    out.anchorLine = unit?.start ?? marker.line;
+  }
+  return out;
+}
+async function checkCitations(page, opts) {
+  const readOptions = {};
+  if (page.format !== void 0) readOptions.format = page.format;
+  if (opts.citations !== void 0) readOptions.citations = opts.citations;
+  if (opts.owned !== void 0) readOptions.owned = opts.owned;
+  const read = readPage(page.file, page.content, readOptions);
+  const severity = resolveSeverity(opts.severity);
+  const client = opts.gitClient ?? gitClient(opts.root);
+  const checkSources = opts.checkSources !== false;
+  const lines = splitLines(read.content);
+  const results = [];
+  const findings = [];
+  const notices = [];
+  for (const finding2 of read.findings) {
+    const kept = relevel(finding2, severity);
+    if (kept !== void 0) findings.push(kept);
+  }
+  const index = checkSources ? opts.sourceIndex ?? await buildSourceIndex(opts.root, { gitClient: client }) : void 0;
+  const classifyOpts = index === void 0 ? void 0 : { root: opts.root, index, git: client, ...opts.key === void 0 ? {} : { key: opts.key } };
+  const quoteInput = {
+    page: read,
+    lines,
+    root: opts.root,
+    index: index ?? emptyIndex,
+    checkSources,
+    ...opts.key === void 0 ? {} : { key: opts.key }
+  };
+  for (const entry of read.citations) {
+    const claim = claimEnd(read, entry, lines);
+    const source = classifyOpts === void 0 ? skippedSource(entry) : await classifyCitation(entry, classifyOpts);
+    const result = {
+      citation: entry.citation,
+      origin: entry.origin,
+      ...anchorOf(entry, claim, read),
+      claim,
+      source
+    };
+    results.push(result);
+    for (const found of await quoteFindings(quoteInput, entry, result)) {
+      const level = severity[found.rule];
+      if (level === "off") continue;
+      const finding2 = {
+        rule: found.rule,
+        ruleId: ruleId(found.rule),
+        severity: level,
+        message: found.message,
+        src: source.src,
+        index: entry.origin.index
+      };
+      if (found.line !== void 0) finding2.line = found.line;
+      if (entry.citation.id !== void 0) finding2.id = entry.citation.id;
+      findings.push(finding2);
+    }
+  }
+  findings.push(...findingsFor(results, severity));
+  const wantsHistory = checkSources && read.citations.some(({ citation }) => citation.source["commit-sha"] !== void 0);
+  if (wantsHistory && !await client.available()) notices.push(GIT_UNAVAILABLE_HISTORY);
+  const unavailable = results.find((r) => r.source.historyAvailable === false);
+  if (unavailable?.source.commitSha !== void 0) {
+    notices.push(
+      `commit ${unavailable.source.commitSha.slice(0, 7)} not found in history; use fetch-depth: 0 to enable never-true and diffs`
+    );
+  }
+  if (results.some((r) => r.source.truncatedSearch === true)) {
+    notices.push(
+      `a move search hit its ${String(MOVE_BUDGET_BYTES / (1024 * 1024))} MiB budget before covering the file; a citation may read changed rather than moved`
+    );
+  }
+  return {
+    file: read.file,
+    format: read.format,
+    citations: results,
+    findings: findings.sort(byLine2),
+    notices
+  };
+}
+function skippedSource(entry) {
+  const { source } = entry.citation;
+  const out = { src: spellSource(source), status: "skipped" };
+  if (source["commit-sha"] !== void 0) out.commitSha = source["commit-sha"];
+  return out;
+}
+var emptyIndex = { files: () => [], has: () => false };
+
+// src/cite/core/mint.ts
+var COMMIT_PATTERN = /^[0-9a-f]{7,64}$/;
+async function commitFor(opts) {
+  if (opts.commitSha === false) return void 0;
+  if (typeof opts.commitSha === "string") {
+    if (!COMMIT_PATTERN.test(opts.commitSha)) {
+      throw new CiteError(
+        `Invalid commit-sha "${opts.commitSha}": expected 7 to 64 lowercase hex digits.`
+      );
+    }
+    return opts.commitSha;
+  }
+  const client = opts.gitClient;
+  if (client === void 0 || !await client.available()) return void 0;
+  return await client.head() ?? void 0;
+}
+function refusalFor(reason, path, encrypted) {
+  switch (reason) {
+    case "untracked":
+      return new CiteError(
+        encrypted ? `No tracked file matches ${path} (wrong --root?).` : `Source not found: ${path} is not a tracked file under the root.`
+      );
+    case "no-key":
+      return new CiteError(`${path} is encrypted, and no encryption key is available to decrypt it.`);
+    case "undecryptable":
+      return new CiteError(`${path} does not decrypt under the current key.`);
+    case "unreadable":
+      return new CiteError(`Source not readable: ${path} could not be read.`);
+  }
+}
+async function mintCitation(opts) {
+  const range = parseSrc(opts.src);
+  const { key } = opts;
+  const encrypt = opts.encrypt === true || range.encrypted;
+  if (encrypt && !range.encrypted && key === void 0) {
+    throw new CiteError(
+      `${opts.src} must be encrypted, and no encryption key is available. Run \`manni key set\`, or set ${ENCRYPTION_KEY_ENV}.`
+    );
+  }
+  const index = opts.sourceIndex ?? await buildSourceIndex(opts.root, { gitClient: opts.gitClient });
+  const read = await readSource(opts.root, index, range, key);
+  if (read.kind === "missing") throw refusalFor(read.reason, range.path, range.encrypted);
+  const joined = sliceLines(splitLines(read.text), range, range.path);
+  const pinKey = encrypt ? key : void 0;
+  const file = pinKey !== void 0 && !range.encrypted ? encryptSourcePath(read.resolvedPath, pinKey) : range.path;
+  const lines = rangeLines(range);
+  const commitSha = await commitFor(opts);
+  const source = { file, integrity: hashLines(joined, pinKey) };
+  const ordered = {
+    file: source.file,
+    ...lines === void 0 ? {} : { lines },
+    integrity: source.integrity,
+    ...commitSha === void 0 ? {} : { "commit-sha": commitSha }
+  };
+  return {
+    ...opts.id === void 0 ? {} : { id: opts.id },
+    ...opts.claim === void 0 ? {} : { claim: opts.claim },
+    source: ordered,
+    ...opts.quote === void 0 ? {} : { quote: opts.quote }
+  };
+}
+
+// src/cite/core/config.ts
+import { resolve as resolve2 } from "node:path";
+
+// src/shared/severity.ts
+var SEVERITIES = ["notice", "warning", "error"];
+var SEVERITY_LIST = SEVERITIES.join(" | ");
+function isSeverity(value) {
+  return SEVERITIES.includes(value);
+}
+function meetsSeverity(severity, min) {
+  return SEVERITIES.indexOf(severity) >= SEVERITIES.indexOf(min);
+}
+
+// src/cite/core/config.ts
+var CITE_SECTION = "cite";
+var DEFAULT_CITE_BASELINE_PATH = ".manni-cite-baseline.json";
+var CONFIG_KEYS = [
+  "allowEmpty",
+  "respectGitignore",
+  "root",
+  "baseline",
+  "checkSources",
+  "severity"
+];
+var SALT_KEY = "salt";
+var saltRefusal = (source) => `${source}: "salt" is no longer a cite key. Values are encrypted with a family key: a top-level encryptionKey:, or MANNI_ENCRYPTION_KEY. Run \`manni key set\`.`;
+var SEVERITY_LEVELS = [...[...SEVERITIES].reverse(), "off"];
+function isLevel(value) {
+  return typeof value === "string" && SEVERITY_LEVELS.includes(value);
+}
+var CONFIG_REF = "https://hawkeyexl.github.io/manni/meta/reference/configuration/";
+var MOVED_KEYS = ["paths", "exclude"];
+function assertNoMovedKeys(raw, source) {
+  for (const key of MOVED_KEYS) {
+    if (Object.hasOwn(raw, key)) {
+      throw new CiteError(
+        `${source}: "${key}" is no longer a cite key. Document sets are declared once for every tool, under a top-level collections: list. See ${CONFIG_REF}#collections`
+      );
+    }
+  }
+}
+var CONFIG_FILE = {
+  section: CITE_SECTION,
+  // The citation tool never had a file of its own before the family file.
+  legacyNames: [],
+  toError: (message) => new CiteError(message)
+};
+function rejectUnknownKeys(obj, allowed, where, source) {
+  for (const key of Object.keys(obj)) {
+    if (!allowed.includes(key)) {
+      throw new CiteError(
+        `Unknown key "${key}" under ${where}: in ${source}. Supported keys: ${allowed.join(", ")}.`
+      );
+    }
+  }
+}
+function wrongType(key, expected, source) {
+  return new CiteError(`cite.${key} in ${source} must be ${expected}.`);
+}
+function asBoolean(value, key, source) {
+  if (typeof value !== "boolean") throw wrongType(key, "a boolean", source);
+  return value;
+}
+function asString(value, key, source) {
+  if (typeof value !== "string") throw wrongType(key, "a string", source);
+  return value;
+}
+function isMapping(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseSeverity(value, source) {
+  if (!isMapping(value)) throw wrongType("severity", "a mapping", source);
+  rejectUnknownKeys(value, CITE_RULES, "cite.severity", source);
+  const severity = {};
+  for (const [rule, level] of Object.entries(value)) {
+    if (!isCiteRule(rule)) continue;
+    if (!isLevel(level)) {
+      const got = typeof level === "string" ? `, not "${level}"` : "";
+      throw new CiteError(
+        `cite.severity.${rule} in ${source} must be one of ${SEVERITY_LEVELS.join(", ")}${got}.`
+      );
+    }
+    severity[rule] = level;
+  }
+  return severity;
+}
+function parseCiteConfig(raw, source) {
+  if (raw == null) return {};
+  if (!isMapping(raw)) {
+    throw new CiteError(`cite: in ${source} must be a mapping.`);
+  }
+  assertNoMovedKeys(raw, source);
+  if (Object.hasOwn(raw, SALT_KEY)) throw new CiteError(saltRefusal(source));
+  rejectUnknownKeys(raw, CONFIG_KEYS, "cite", source);
+  const config = {};
+  if (raw.allowEmpty !== void 0)
+    config.allowEmpty = asBoolean(raw.allowEmpty, "allowEmpty", source);
+  if (raw.respectGitignore !== void 0)
+    config.respectGitignore = asBoolean(raw.respectGitignore, "respectGitignore", source);
+  if (raw.root !== void 0) config.root = asString(raw.root, "root", source);
+  if (raw.baseline !== void 0)
+    config.baseline = asString(raw.baseline, "baseline", source);
+  if (raw.checkSources !== void 0)
+    config.checkSources = asBoolean(raw.checkSources, "checkSources", source);
+  if (raw.severity !== void 0) config.severity = parseSeverity(raw.severity, source);
+  return config;
+}
+function readCiteConfigFile(explicitPath, cwd) {
+  return explicitPath ? readConfigFile(explicitPath, cwd, CONFIG_FILE) : findConfigFile(cwd, CONFIG_FILE);
+}
+async function loadCiteConfig(explicitPath, cwd = process.cwd()) {
+  const file = await readCiteConfigFile(explicitPath, cwd);
+  return file === null ? null : toLoaded(file);
+}
+function toLoaded(file) {
+  return {
+    config: parseCiteConfig(file.value, file.source),
+    path: file.path,
+    dir: file.dir,
+    source: file.source,
+    collections: file.collections
+  };
+}
+var STDIN = "-";
+async function resolveCiteRun(opts) {
+  const cwd = resolve2(opts.cwd);
+  const env = opts.env ?? process.env;
+  const wanted = opts.collection ?? [];
+  if (wanted.length > 0 && opts.inputs.some((input) => input !== STDIN)) {
+    throw new CiteError(
+      "--collection selects a configured collection; it cannot be combined with paths."
+    );
+  }
+  const file = opts.noConfig ? null : await readCiteConfigFile(opts.configPath, cwd);
+  const loaded = file === null ? null : toLoaded(file);
+  if (wanted.length > 0 && loaded === null) {
+    throw new CiteError("--collection needs a config file to select from.");
+  }
+  if (loaded) opts.onConfigLoaded?.({ path: loaded.path, dir: loaded.dir });
+  const config = loaded ? loaded.config : null;
+  const collections = loaded ? selectCollections(loaded.collections, wanted, loaded.source, (message) => new CiteError(message)) : [];
+  const fromCollections = opts.inputs.length === 0;
+  const inputs = fromCollections ? collections.flatMap((c) => c.paths) : opts.inputs;
+  const base = fromCollections && inputs.length > 0 && loaded ? loaded.dir : cwd;
+  let root;
+  if (opts.root !== void 0) {
+    root = resolve2(cwd, opts.root);
+  } else if (loaded && config?.root !== void 0) {
+    root = resolve2(loaded.dir, config.root);
+  } else {
+    const gitRoot = findGitRoot(cwd);
+    if (gitRoot !== null) {
+      root = gitRoot;
+    } else {
+      root = cwd;
+      opts.onNotice?.(`No git root found; resolving src: paths from ${cwd}`);
+    }
+  }
+  const { key, source: keySource } = resolveEncryptionKey({
+    env,
+    file,
+    toError: (message) => new CiteError(message)
+  });
+  return {
+    config,
+    inputs,
+    base,
+    collections,
+    fromCollections,
+    ...loaded ? { configDir: loaded.dir, configPath: loaded.path, configSource: loaded.source } : {},
+    root,
+    key,
+    keySource,
+    ...file === null ? {} : { configFile: file }
+  };
+}
+
+// src/cite/commands/check.ts
+import { existsSync } from "node:fs";
+import { readFile as readFile3 } from "node:fs/promises";
+import { resolve as resolve3 } from "node:path";
+function joinHits() {
+  const matched = /* @__PURE__ */ new Map();
+  const seen = /* @__PURE__ */ new Map();
+  return {
+    matched,
+    record(page, label) {
+      for (const join4 of page.joins) {
+        const values = matched.get(join4.field) ?? /* @__PURE__ */ new Set();
+        values.add(join4.value);
+        matched.set(join4.field, values);
+        const id = `${join4.field}\0${join4.value}`;
+        const hit = seen.get(id) ?? { file: join4.file, labels: [] };
+        if (!hit.labels.includes(label)) hit.labels.push(label);
+        seen.set(id, hit);
+        if (hit.labels.length > 1) {
+          throw new CiteError(
+            duplicateJoinRefusal(join4.field, join4.value, join4.file, hit.labels)
+          );
+        }
+      }
+    }
+  };
+}
+function isEnoent(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+async function indexFor(root, client) {
+  try {
+    return await buildSourceIndex(root, { gitClient: client });
+  } catch (error) {
+    if (isEnoent(error)) throw new CiteError(`Root directory not found: ${root}.`);
+    throw error;
+  }
+}
+async function prepareRun(opts, action, verb, requireSources = false) {
+  const cwd = resolve3(opts.cwd ?? process.cwd());
+  const run3 = await resolveCiteRun({
+    cwd,
+    configPath: opts.configPath,
+    noConfig: opts.noConfig,
+    inputs: opts.inputs,
+    collection: opts.collection,
+    root: opts.root,
+    onConfigLoaded: opts.onConfigLoaded,
+    onNotice: opts.onNotice,
+    env: opts.env
+  });
+  const { config, inputs, base } = run3;
+  const checkSources = opts.checkSources ?? config?.checkSources ?? true;
+  if (requireSources && !checkSources) {
+    throw new CiteError(`${verb} needs the sources: drop --no-check-sources (or \`checkSources: false\`).`);
+  }
+  if (inputs.length === 0) {
+    throw new CiteError(
+      `No files to ${verb}. Pass paths/globs, or declare a collection under \`collections:\` in manni.config.yaml.`
+    );
+  }
+  const usingStdin = inputs.includes(STDIN_TOKEN);
+  const forced = opts.as === void 0 ? void 0 : extractorByName(opts.as);
+  if (opts.as !== void 0 && forced?.implemented !== true) {
+    throw new CiteError(
+      `Unknown format "${opts.as}". Supported extensions: ${supportedExtensions().join(", ")}.`
+    );
+  }
+  if (usingStdin && forced === void 0) {
+    throw new CiteError("Reading from stdin (`-`) requires --as <format> to choose an extractor.");
+  }
+  const exts = opts.exts ?? forced?.extensions;
+  const fileInputs = inputs.filter((input) => input !== STDIN_TOKEN);
+  const allowEmpty = opts.allowEmpty ?? config?.allowEmpty;
+  const exclude = [
+    .../* @__PURE__ */ new Set([
+      ...opts.exclude ?? [],
+      ...run3.fromCollections ? run3.collections.flatMap((c) => c.exclude) : []
+    ])
+  ];
+  const { files, gitignoreSkipped } = await resolveTargetSet({
+    inputs: fileInputs,
+    exts,
+    exclude,
+    cwd: base,
+    allowEmpty,
+    ...gitignoreOptions({
+      flag: opts.respectGitignore,
+      configured: config?.respectGitignore,
+      onNotice: opts.onNotice
+    })
+  });
+  assertNonEmpty({ files, inputs: fileInputs, usingStdin, allowEmpty, exclude, exts, gitignoreSkipped, action });
+  const git = opts.gitClient ?? gitClient(run3.root);
+  const pageOptions = {
+    root: run3.root,
+    checkSources,
+    key: run3.key,
+    severity: config?.severity,
+    gitClient: git
+  };
+  if (checkSources) pageOptions.sourceIndex = await indexFor(run3.root, git);
+  const sidecars2 = await sidecarsFor(run3);
+  const setupFor = (label, content) => {
+    const page = sidecars2?.forPage(label, content, forced?.name);
+    if (page?.owner === void 0) return { options: pageOptions };
+    return {
+      sidecar: page,
+      options: {
+        ...pageOptions,
+        owned: { file: page.owner.file, collection: page.owner.collection },
+        ...page.citations === void 0 ? {} : { citations: page.citations }
+      }
+    };
+  };
+  const scopedByFlags = (
+    // The inputs the operator typed, not the collection globs they resolved
+    // to: a corpus run has none of the first and all of the second.
+    opts.inputs.length > 0 || usingStdin || opts.as !== void 0 || opts.exts !== void 0 || opts.exclude !== void 0 && opts.exclude.length > 0 || opts.respectGitignore !== void 0
+  );
+  const covered = (opts.collection?.length ?? 0) > 0 ? run3.collections.map((c) => c.name) : void 0;
+  return {
+    cwd,
+    run: run3,
+    files,
+    gitignoreSkipped,
+    usingStdin,
+    forced,
+    pageOptions,
+    git,
+    sidecars: sidecars2,
+    setupFor,
+    scopedByFlags,
+    ...covered === void 0 ? {} : { covered }
+  };
+}
+function assertNoOrphans(prepared) {
+  const { sidecars: sidecars2 } = prepared;
+  if (sidecars2 === null || prepared.scopedByFlags) return;
+  const orphans = sidecars2.orphans(prepared.files, prepared.covered);
+  if (orphans.length > 0) throw orphanRefusal(orphans);
+}
+function assertNoOrphanJoins(prepared, hits) {
+  const { sidecars: sidecars2 } = prepared;
+  if (sidecars2 === null || prepared.scopedByFlags) return;
+  const orphans = sidecars2.orphanJoins(hits.matched, prepared.covered);
+  if (orphans.length > 0) throw orphanRefusal(orphans);
+}
+function readTarget(run3, file) {
+  return readFile3(resolve3(run3.base, file), "utf8");
+}
+function sayNotices(pages, onNotice, also = []) {
+  const said = /* @__PURE__ */ new Set();
+  for (const notice of [...pages.flatMap((page) => page.notices), ...also]) {
+    if (said.has(notice)) continue;
+    said.add(notice);
+    onNotice?.(notice);
+  }
+}
+async function runCheck(opts) {
+  const prepared = await prepareRun(opts, "checked", "check");
+  const { cwd, run: run3, files, gitignoreSkipped, usingStdin, forced, pageOptions, git } = prepared;
+  assertNoOrphans(prepared);
+  const hits = joinHits();
+  const pages = [];
+  const checkOne = async (label, content) => {
+    const setup = prepared.setupFor(label, content);
+    if (setup.sidecar !== void 0) hits.record(setup.sidecar, label);
+    pages.push(await checkCitations({ file: label, content, format: forced?.name }, setup.options));
+  };
+  if (usingStdin) await checkOne(STDIN_LABEL, opts.stdinContent ?? "");
+  for (const file of files) await checkOne(file, await readTarget(run3, file));
+  assertNoOrphanJoins(prepared, hits);
+  const wantsDiff = opts.showDiff === true && pageOptions.checkSources !== false && !await git.available();
+  sayNotices(pages, opts.onNotice, wantsDiff ? [GIT_UNAVAILABLE_HISTORY] : []);
+  const results = pages.map(toValidationResult);
+  const frame = { cwd, base: run3.configDir ?? cwd, runBase: run3.base };
+  const request = resolveBaselineRequest(opts, run3.config?.baseline, run3.configDir, cwd, {
+    current: DEFAULT_CITE_BASELINE_PATH
+  });
+  if (request !== null && !request.write && !existsSync(request.absPath)) {
+    throw new CiteError(
+      `Baseline "${request.label}" not found. Record one with \`manni cite check --write-baseline\`, or drop --baseline.`
+    );
+  }
+  const { results: reported, baseline } = await settleBaseline(results, request, frame);
+  const failed = reported.filter((r) => !r.ok).length;
+  const count = (keep) => reported.reduce((n, r) => n + r.errors.filter(keep).length, 0);
+  const warnings = count((e) => e.severity === "warning");
+  const notices = count((e) => e.severity === "notice");
+  const summary = {
+    files: reported.length,
+    passed: reported.length - failed,
+    failed,
+    errors: count(isErrorSeverity),
+    // Omitted at zero, as meta's summary has them, so the JSON shape of a
+    // clean run is the one every consumer of `meta validate` already reads.
+    ...warnings > 0 ? { warnings } : {},
+    ...notices > 0 ? { notices } : {},
+    ...gitignoreSkipped > 0 ? { gitignoreSkipped } : {},
+    ...baseline ? { baseline } : {}
+  };
+  return { results: reported, summary, frame, pages, warnings, notices };
+}
+
+// src/cite/commands/add.ts
+import { readFile as readFile4 } from "node:fs/promises";
+import { relative as relative2, resolve as resolve4 } from "node:path";
+var ID2 = /^[a-z0-9][a-z0-9-]*$/;
+var toPosix2 = (path) => path.replace(/\\/g, "/");
+function isEnoent2(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+async function readPageFile(path, label) {
+  try {
+    return await readFile4(path, "utf8");
+  } catch (error) {
+    if (isEnoent2(error)) throw new CiteError(`File not found: "${label}".`);
+    throw error;
+  }
+}
+async function citedText(root, index, src, key) {
+  const range = parseSrc(src);
+  const source = await readSource(root, index, range, key);
+  if (source.kind === "missing") {
+    throw new CiteError(`Source not readable: ${range.path} could not be read.`);
+  }
+  return sliceLines(splitLines(source.text), range, range.path);
+}
+async function runAdd(opts) {
+  const cwd = resolve4(opts.cwd ?? process.cwd());
+  const run3 = await resolveCiteRun({
+    cwd,
+    configPath: opts.configPath,
+    noConfig: opts.noConfig,
+    inputs: [],
+    root: opts.root,
+    onConfigLoaded: opts.onConfigLoaded,
+    onNotice: opts.onNotice,
+    env: opts.env
+  });
+  const { root } = run3;
+  const usingStdin = opts.page === STDIN_TOKEN;
+  if (usingStdin && opts.as === void 0) {
+    throw new CiteError("Reading from stdin (`-`) requires --as <format> to choose an extractor.");
+  }
+  const path = usingStdin ? void 0 : resolve4(cwd, opts.page);
+  const label = path === void 0 ? STDIN_LABEL : toPosix2(relative2(cwd, path));
+  const content = path === void 0 ? opts.stdinContent ?? "" : await readPageFile(path, label);
+  const sidecars2 = await sidecarsFor(run3, { base: cwd });
+  const firstManifest = sidecars2?.manifests[0];
+  if (usingStdin && firstManifest !== void 0) {
+    const keyedBy = firstManifest.join === "path" ? "path" : firstManifest.join;
+    throw new CiteError(
+      `A page read from stdin has no path, and its citations live in ${firstManifest.file}, which is keyed by ${keyedBy}.`
+    );
+  }
+  const sidecar = usingStdin ? void 0 : sidecars2?.forPage(label, content, opts.as);
+  const owner = sidecar?.owner;
+  const page = readPage(label, content, {
+    ...opts.as === void 0 ? {} : { format: opts.as },
+    // The entries already there are the manifest's, so `--id` uniqueness and
+    // the marker checks are measured against them and not against a page
+    // that carries none.
+    ...sidecar?.citations === void 0 ? {} : { citations: sidecar.citations },
+    ...owner === void 0 ? {} : { owned: { file: owner.file, collection: owner.collection } }
+  });
+  const { format } = page;
+  const pageLines = opts.pageLines;
+  const marker = opts.marker === true;
+  const quote = opts.quote === true;
+  const at2 = pageLines === void 0 ? "" : `${label}:${spellLines(pageLines)}`;
+  if (marker && pageLines === void 0) {
+    throw new CiteError(`--marker needs the page lines to anchor: ${label}:L.`);
+  }
+  if (marker && opts.id === void 0) {
+    throw new CiteError("--marker needs --id: the marker names the entry.");
+  }
+  if (quote && pageLines === void 0) {
+    throw new CiteError(`--quote needs the block's lines: ${label}:L1-L2.`);
+  }
+  if (opts.id !== void 0 && !ID2.test(opts.id)) {
+    throw new CiteError(
+      `Invalid id "${opts.id}": use lowercase letters, digits and hyphens, starting with a letter or digit.`
+    );
+  }
+  if (opts.id !== void 0 && page.citations.some((c) => c.citation.id === opts.id)) {
+    throw new CiteError(`${label} already has an entry ${opts.id}.`);
+  }
+  if (marker && opts.id !== void 0) {
+    const already = page.statements.find(
+      (s) => s.payload.kind === "ref" && s.payload.id === opts.id
+    );
+    if (already !== void 0) {
+      throw new CiteError(
+        `${label} already has a marker ${opts.id} at line ${String(already.line)}.`
+      );
+    }
+  }
+  const lines = splitLines(content);
+  if (pageLines !== void 0) {
+    if (pageLines.end > lines.length) {
+      throw new CiteError(`${at2} is past the end of the page (${String(lines.length)} lines).`);
+    }
+    if (pageLines.start < page.bodyLine) {
+      throw new CiteError(`${at2} is in the frontmatter. A claim is body text.`);
+    }
+    if (quote) {
+      const span = fenceSpanAt(content, pageLines.start, format);
+      if (span === void 0 || span.end !== pageLines.end) {
+        throw new CiteError(`${at2} is not a fenced block, so it cannot be a quote.`);
+      }
+    }
+  }
+  const client = opts.gitClient ?? gitClient(root);
+  const sourceIndex = await buildSourceIndex(root, { gitClient: client });
+  let body = content;
+  let markerAt;
+  let claimSpan;
+  let claim;
+  if (marker && pageLines !== void 0) {
+    const statement = formatStatement(format, { kind: "ref", id: opts.id ?? "" });
+    const insertAt = offsetOfLine(content, pageLines.start);
+    body = insertStatementBefore(content, insertAt, statement);
+    markerAt = pageLines.start;
+    const unit = anchoredLines(body, insertAt + statement.length, format, quote);
+    const pin = unit === void 0 ? void 0 : pinOfLines(splitLines(body), unit);
+    if (unit === void 0 || pin === void 0) {
+      throw new CiteError(`${at2} has no paragraph or block for a marker to anchor.`);
+    }
+    claimSpan = unit;
+    claim = { integrity: pin };
+  } else if (pageLines !== void 0) {
+    const pin = pinOfLines(lines, pageLines);
+    if (pin === void 0) {
+      throw new CiteError(`${at2} is past the end of the page (${String(lines.length)} lines).`);
+    }
+    claimSpan = pageLines;
+    claim = { lines: lineSpec(toBodyLines(pageLines, page.bodyLine)), integrity: pin };
+  }
+  const mint = (key, encrypt) => mintCitation({
+    root,
+    src: opts.src,
+    ...opts.id === void 0 ? {} : { id: opts.id },
+    ...claim === void 0 ? {} : { claim },
+    ...quote ? { quote: true } : {},
+    ...opts.commitSha === false ? { commitSha: false } : {},
+    encrypt,
+    ...key === void 0 ? {} : { key },
+    gitClient: client,
+    sourceIndex
+  });
+  const needsKey = opts.encrypt === true && run3.key === void 0;
+  let citation = await mint(run3.key, run3.key !== void 0);
+  if (quote && claimSpan !== void 0) {
+    const cited = await citedText(root, sourceIndex, opts.src, run3.key);
+    const inside = splitLines(body).slice(claimSpan.start, claimSpan.end - 1).join("\n");
+    if (!blockMatches(inside, cited)) {
+      throw new CiteError(`The block at ${at2} does not reproduce ${opts.src}.`);
+    }
+  }
+  if (needsKey) {
+    const { key } = await ensureEncryptionKey({
+      subject: opts.src,
+      cwd,
+      file: run3.configFile ?? null,
+      env: opts.env,
+      confirm: opts.confirm,
+      notice: (message) => {
+        opts.onNotice?.(message);
+      },
+      toError: (message) => new CiteError(message)
+    });
+    citation = await mint(key, true);
+  }
+  const manifests = new ManifestSet();
+  let placed;
+  if (owner !== void 0) {
+    if (sidecar?.entry === void 0) {
+      throw new CiteError(
+        `${label} carries no ${owner.join}: value, so its citations cannot be keyed in ${owner.file}.`
+      );
+    }
+    const existing = (sidecar.citations ?? []).map((input) => input.entry);
+    const list = [...existing, entryObject(citation)];
+    const at3 = await manifests.write(owner, sidecar.entry, list, list.length - 1);
+    const [changed] = manifests.changed();
+    placed = {
+      file: at3.file,
+      line: at3.line,
+      content: changed?.text ?? "",
+      diff: changed?.diff ?? "",
+      written: false
+    };
+  }
+  const after = owner === void 0 ? appendFrontmatterCitation(body, format, citation, label) : body;
+  const shift = bodyLineOf(after, locateFrontmatter(after)?.closeEnd ?? 0) - page.bodyLine;
+  const result = {
+    file: label,
+    citation,
+    placed: owner === void 0 ? "frontmatter" : "manifest",
+    content: after,
+    diff: unifiedDiff(label, content, after),
+    written: false,
+    ...placed === void 0 ? {} : { manifest: placed }
+  };
+  if (markerAt !== void 0) result.markerLine = markerAt + shift;
+  if (claimSpan !== void 0) {
+    result.claimLines = { start: claimSpan.start + shift, end: claimSpan.end + shift };
+  }
+  result.written = path !== void 0 && opts.dryRun !== true && after !== content;
+  if (result.written && path !== void 0) await writeFileAtomic(path, after);
+  if (result.manifest !== void 0 && opts.dryRun !== true) {
+    for (const changed of manifests.changed()) await writeFileAtomic(changed.path, changed.text);
+    result.manifest.written = true;
+  }
+  if (opts.commitSha !== false && !await client.available()) {
+    opts.onNotice?.(GIT_UNAVAILABLE_COMMIT);
+  }
+  return result;
+}
+
+// src/cite/commands/update.ts
+import { resolve as resolve5 } from "node:path";
+function settles(plan) {
+  switch (plan.kind) {
+    case "claim-moved":
+      return "claim-moved";
+    case "source-moved":
+      return "source-moved";
+    case "claim-accepted":
+      return "claim-changed";
+    case "source-accepted":
+      return plan.result.source.status === "never-true" ? "source-never-true" : "source-changed";
+  }
+}
+function apply(content, format, plan) {
+  const index = plan.result.origin.index;
+  switch (plan.kind) {
+    case "claim-moved":
+      return spliceEntryField(content, format, index, ["claim", "lines"], plan.lines);
+    case "source-moved":
+      return spliceEntryField(content, format, index, ["source", "lines"], plan.lines);
+    case "claim-accepted": {
+      let out = spliceEntryField(content, format, index, ["claim", "integrity"], plan.pin);
+      if (plan.lines !== void 0) {
+        out = spliceEntryField(out, format, index, ["claim", "lines"], plan.lines);
+      }
+      return out;
+    }
+    case "source-accepted": {
+      let out = spliceEntryField(
+        content,
+        format,
+        index,
+        ["source", "integrity"],
+        plan.minted.source.integrity
+      );
+      const commit = plan.minted.source["commit-sha"];
+      if (commit !== void 0) {
+        out = spliceEntryField(out, format, index, ["source", "commit-sha"], commit);
+      }
+      return out;
+    }
+  }
+}
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function applyToEntry(entry, plan) {
+  if (!isRecord4(entry)) return false;
+  const end = (name) => isRecord4(entry[name]) ? entry[name] : void 0;
+  switch (plan.kind) {
+    case "claim-moved": {
+      const claim = end("claim");
+      if (claim === void 0) return false;
+      claim.lines = plan.lines;
+      return true;
+    }
+    case "source-moved": {
+      const source = end("source");
+      if (source === void 0) return false;
+      source.lines = plan.lines;
+      return true;
+    }
+    case "claim-accepted": {
+      const claim = end("claim");
+      if (claim === void 0) return false;
+      claim.integrity = plan.pin;
+      if (plan.lines !== void 0) claim.lines = plan.lines;
+      return true;
+    }
+    case "source-accepted": {
+      const source = end("source");
+      if (source === void 0) return false;
+      source.integrity = plan.minted.source.integrity;
+      const commit = plan.minted.source["commit-sha"];
+      if (commit !== void 0) source["commit-sha"] = commit;
+      return true;
+    }
+  }
+}
+function rewriteOf(plan) {
+  const { citation, origin, source } = plan.result;
+  const base = { index: origin.index };
+  if (citation.id !== void 0) base.id = citation.id;
+  if (origin.line !== void 0) base.line = origin.line;
+  switch (plan.kind) {
+    case "claim-moved":
+      return { ...base, end: "claim", reason: "moved", status: "moved", from: plan.from, to: plan.to };
+    case "source-moved":
+      return {
+        ...base,
+        end: "source",
+        reason: "moved",
+        status: "moved",
+        from: source.src,
+        to: plan.to
+      };
+    case "claim-accepted": {
+      const out = {
+        ...base,
+        end: "claim",
+        reason: "accepted",
+        status: "changed",
+        from: citation.claim?.integrity ?? "",
+        to: plan.pin,
+        at: plan.unit.lines.start,
+        text: normalizeWhitespace(plan.unit.text.join("\n"))
+      };
+      return out;
+    }
+    case "source-accepted": {
+      const out = {
+        ...base,
+        end: "source",
+        reason: "accepted",
+        status: source.status === "never-true" ? "never-true" : "changed",
+        from: citation.source.integrity,
+        to: plan.minted.source.integrity,
+        src: source.src
+      };
+      const commit = plan.minted.source["commit-sha"];
+      if (commit !== void 0) out.commitSha = commit;
+      return out;
+    }
+  }
+}
+async function runUpdate(opts) {
+  const prepared = await prepareRun(opts, "updated", "update", true);
+  const { run: run3, files, usingStdin, forced, pageOptions, git } = prepared;
+  assertNoOrphans(prepared);
+  const hits = joinHits();
+  const manifests = new ManifestSet();
+  const only = opts.only !== void 0 && opts.only.length > 0 ? new Set(opts.only) : void 0;
+  const accept = opts.accept === true;
+  const plansFor = async (result, entry, page, lines) => {
+    const out = [];
+    const claim = result.claim;
+    if (claim !== null && claim.status === "moved" && claim.newLines !== void 0) {
+      const at2 = parseLines(claim.newLines);
+      if (at2 !== void 0) {
+        out.push({
+          kind: "claim-moved",
+          result,
+          lines: lineSpec(at2),
+          from: claim.fileLines ?? "",
+          to: claim.newFileLines ?? ""
+        });
+      }
+    }
+    if (result.source.status === "moved" && result.source.newLines !== void 0) {
+      const at2 = parseLines(result.source.newLines);
+      if (at2 !== void 0 && result.source.newSrc !== void 0) {
+        out.push({ kind: "source-moved", result, lines: lineSpec(at2), to: result.source.newSrc });
+      }
+    }
+    if (!accept) return out;
+    if (claim !== null && claim.status === "changed" && entry !== void 0) {
+      const unit = result.anchor === "marker" ? markerUnit(page, entry, lines) : (() => {
+        const at2 = claimLine(claim);
+        return at2 === void 0 ? void 0 : unitAt(page, at2, lines);
+      })();
+      const wantsBlock = entry.citation.quote === true;
+      const pin = unit === void 0 ? void 0 : pinOfLines(lines, unit.lines);
+      if (unit !== void 0 && pin !== void 0 && (!wantsBlock || unit.kind === "block")) {
+        const plan = { kind: "claim-accepted", result, unit, pin };
+        if (entry.citation.claim?.lines !== void 0) {
+          const body = toBodyLines(unit.lines, page.bodyLine);
+          const recorded = parseLines(entry.citation.claim.lines);
+          if (recorded === void 0 || recorded.start !== body.start || recorded.end !== body.end) {
+            plan.lines = lineSpec(body);
+          }
+        }
+        out.push(plan);
+      }
+    }
+    if (result.source.status === "changed" || result.source.status === "never-true") {
+      try {
+        const minted = await mintCitation({
+          root: run3.root,
+          src: result.source.src,
+          ...run3.key === void 0 ? {} : { key: run3.key },
+          ...result.citation.source["commit-sha"] === void 0 ? { commitSha: false } : {},
+          gitClient: git,
+          ...pageOptions.sourceIndex === void 0 ? {} : { sourceIndex: pageOptions.sourceIndex }
+        });
+        out.push({ kind: "source-accepted", result, minted });
+      } catch (error) {
+        if (!(error instanceof CiteError)) throw error;
+      }
+    }
+    return out;
+  };
+  const pages = [];
+  const updateOne = async (label, content, path) => {
+    const setup = prepared.setupFor(label, content);
+    if (setup.sidecar !== void 0) hits.record(setup.sidecar, label);
+    const report = await checkCitations({ file: label, content, format: forced?.name }, setup.options);
+    const { format } = report;
+    const page = readPage(label, content, {
+      ...forced === void 0 ? {} : { format: forced.name },
+      ...setup.options.citations === void 0 ? {} : { citations: setup.options.citations },
+      ...setup.options.owned === void 0 ? {} : { owned: setup.options.owned }
+    });
+    const lines = splitLines(content);
+    const rewritten2 = [];
+    const settled = /* @__PURE__ */ new Set();
+    let after = content;
+    const owner = setup.sidecar?.owner;
+    const entries = setup.sidecar?.citations === void 0 ? void 0 : JSON.parse(JSON.stringify(setup.sidecar.citations.map((c) => c.entry)));
+    let manifestDirty = false;
+    for (const result of report.citations) {
+      if (only !== void 0 && (result.citation.id === void 0 || !only.has(result.citation.id))) {
+        continue;
+      }
+      const entry = page.citations.find((c) => c.origin.index === result.origin.index);
+      for (const plan of await plansFor(result, entry, page, lines)) {
+        if (result.origin.kind === "manifest") {
+          if (entries === void 0 || !applyToEntry(entries[result.origin.index], plan)) continue;
+          manifestDirty = true;
+        } else {
+          after = apply(after, format, plan);
+        }
+        rewritten2.push(rewriteOf(plan));
+        settled.add(`${String(result.origin.index)}\0${settles(plan)}`);
+      }
+    }
+    if (manifestDirty && owner !== void 0 && entries !== void 0) {
+      if (setup.sidecar?.entry === void 0) {
+        throw new CiteError(
+          `${label} carries no ${owner.join}: value, so its citations cannot be keyed in ${owner.file}.`
+        );
+      }
+      await manifests.write(owner, setup.sidecar.entry, entries, 0);
+    }
+    const skipped2 = report.findings.filter(
+      (finding2) => (only === void 0 || finding2.id !== void 0 && only.has(finding2.id)) && !settled.has(`${String(finding2.index ?? -1)}\0${finding2.rule}`)
+    );
+    const diff = after === content ? "" : unifiedDiff(label, content, after);
+    const written = after !== content && path !== void 0 && opts.dryRun !== true;
+    if (written) await writeFileAtomic(path, after);
+    const out = { file: label, rewritten: rewritten2, skipped: skipped2, diff, written };
+    if (path === void 0) out.content = after;
+    pages.push(out);
+    return report;
+  };
+  const reports = [];
+  if (usingStdin) reports.push(await updateOne(STDIN_LABEL, opts.stdinContent ?? ""));
+  for (const file of files) {
+    reports.push(await updateOne(file, await readTarget(run3, file), resolve5(run3.base, file)));
+  }
+  assertNoOrphanJoins(prepared, hits);
+  const changedManifests = manifests.changed();
+  const rewrittenManifests = [];
+  for (const changed of changedManifests) {
+    const write = opts.dryRun !== true;
+    if (write) await writeFileAtomic(changed.path, changed.text);
+    rewrittenManifests.push({ file: changed.file, diff: changed.diff, written: write });
+  }
+  const reminted = pages.some(
+    (page) => page.rewritten.some((r) => r.reason === "accepted" && r.end === "source")
+  );
+  sayNotices(reports, opts.onNotice, reminted && !await git.available() ? [GIT_UNAVAILABLE_COMMIT] : []);
+  const rewritten = pages.reduce((n, page) => n + page.rewritten.length, 0);
+  const skipped = pages.reduce((n, page) => n + page.skipped.length, 0);
+  const undone = pages.some((page) => page.skipped.some((finding2) => finding2.severity === "error"));
+  return {
+    pages,
+    rewritten,
+    skipped,
+    ...rewrittenManifests.length > 0 ? { manifests: rewrittenManifests } : {},
+    exitCode: undone ? 1 : 0
+  };
+}
+
+// src/cite/core/reencrypt.ts
+var UNDECRYPTABLE = "does not decrypt under the current key";
+var MISSING = "missing (no tracked file matches)";
+var CHANGED = "changed; run `manni cite update --accept` before rotating";
+function whereOf(citation, origin) {
+  const where = { index: origin.index };
+  if (citation.id !== void 0) where.id = citation.id;
+  if (origin.line !== void 0) where.line = origin.line;
+  return where;
+}
+async function pinnedLines(ctx, citation, range, path, key) {
+  const source = await readSource(ctx.root, ctx.index, { ...range, path, encrypted: false });
+  if (source.kind === "missing") return { skip: MISSING };
+  const pin = citation.source.integrity;
+  let joined;
+  try {
+    joined = sliceLines(splitLines(source.text), range);
+  } catch {
+    joined = void 0;
+  }
+  if (joined !== void 0 && hashLines(joined, key) === pin) return { joined };
+  const commit = citation.source["commit-sha"];
+  if (commit !== void 0 && await ctx.git.available()) {
+    const history = await historyOf(ctx.git, commit, path, range, pin, key, void 0);
+    if (history.kind === "original") return { joined: history.lines.join("\n") };
+  }
+  return { skip: CHANGED };
+}
+async function verdictFor(ctx, citation, opts) {
+  const range = sourceRange(citation.source);
+  const underNew = decryptSourcePath(range.path, opts.toKey);
+  if (underNew !== void 0) {
+    const held = await pinnedLines(ctx, citation, range, underNew, opts.toKey);
+    if ("joined" in held) return { kind: "done" };
+  }
+  const path = underNew ?? decryptSourcePath(range.path, opts.fromKey);
+  if (path === void 0) return { kind: "skip", message: UNDECRYPTABLE };
+  const lines = await pinnedLines(ctx, citation, range, path, opts.fromKey);
+  if ("skip" in lines) return { kind: "skip", message: lines.skip };
+  const file = underNew === void 0 ? encryptSourcePath(path, opts.toKey) : range.path;
+  return {
+    kind: "write",
+    file,
+    integrity: hashLines(lines.joined, opts.toKey),
+    to: formatSrc({ ...range, path: file })
+  };
+}
+async function contextFor(opts) {
+  const git = opts.gitClient ?? gitClient(opts.root);
+  const index = opts.sourceIndex ?? await buildSourceIndex(opts.root, { gitClient: git });
+  return { root: opts.root, index, git };
+}
+async function reencryptCitations(page, opts) {
+  const read = readPage(page.file, page.content, page.format === void 0 ? void 0 : { format: page.format });
+  const result = { content: page.content, rewritten: [], skipped: [] };
+  const encrypted = read.citations.filter(({ citation }) => sourceRange(citation.source).encrypted);
+  if (encrypted.length === 0) return result;
+  const ctx = await contextFor(opts);
+  let after = page.content;
+  for (const { citation, origin } of encrypted) {
+    const range = sourceRange(citation.source);
+    const where = whereOf(citation, origin);
+    const verdict = await verdictFor(ctx, citation, opts);
+    if (verdict.kind === "done") continue;
+    if (verdict.kind === "skip") {
+      result.skipped.push({ ...where, message: verdict.message });
+      continue;
+    }
+    if (verdict.file !== range.path) {
+      after = spliceEntryField(after, read.format, origin.index, ["source", "file"], verdict.file);
+    }
+    after = spliceEntryField(
+      after,
+      read.format,
+      origin.index,
+      ["source", "integrity"],
+      verdict.integrity
+    );
+    result.rewritten.push({ ...where, from: spellSource(citation.source), to: verdict.to });
+  }
+  result.content = after;
+  return result;
+}
+async function reencryptCitationEntries(page, opts) {
+  const entries = JSON.parse(
+    JSON.stringify(page.citations.map((input) => input.entry))
+  );
+  const out = { entries, changed: false, rewritten: [], skipped: [] };
+  const read = readPage(page.file, page.content, {
+    ...page.format === void 0 ? {} : { format: page.format },
+    citations: page.citations
+  });
+  const encrypted = read.citations.filter(({ citation }) => sourceRange(citation.source).encrypted);
+  if (encrypted.length === 0) return out;
+  const ctx = await contextFor(opts);
+  for (const { citation, origin } of encrypted) {
+    const where = whereOf(citation, origin);
+    const verdict = await verdictFor(ctx, citation, opts);
+    if (verdict.kind === "done") continue;
+    if (verdict.kind === "skip") {
+      out.skipped.push({ ...where, message: verdict.message });
+      continue;
+    }
+    const entry = entries[origin.index];
+    const source = typeof entry === "object" && entry !== null && !Array.isArray(entry) ? entry.source : void 0;
+    if (typeof source !== "object" || source === null || Array.isArray(source)) {
+      out.skipped.push({ ...where, message: UNDECRYPTABLE });
+      continue;
+    }
+    const fields = source;
+    fields.file = verdict.file;
+    fields.integrity = verdict.integrity;
+    out.changed = true;
+    out.rewritten.push({ ...where, from: spellSource(citation.source), to: verdict.to });
+  }
+  return out;
+}
+
+// src/cite/reporters/pretty.ts
+var DIFF_LINE_CAP = 60;
+var plural2 = (n, one, many = `${one}s`) => `${String(n)} ${n === 1 ? one : many}`;
+function severityMark(severity, c) {
+  switch (severity) {
+    case "error":
+      return c.red("\u2717");
+    case "warning":
+      return c.yellow("\u2195");
+    case "notice":
+      return c.dim("\u2139");
+  }
+}
+function splitBaselined(page, result) {
+  if (result === void 0) return { reported: [...page.findings], baselined: [] };
+  const pool = [...result.errors];
+  const out = { reported: [], baselined: [] };
+  for (const finding2 of page.findings) {
+    const instancePath = finding2.index === void 0 ? "" : `/citations/${String(finding2.index)}`;
+    const line = errorSite(finding2).line;
+    const at2 = pool.findIndex(
+      (e) => e.keyword === finding2.rule && e.instancePath === instancePath && e.message === finding2.message && (e.line ?? null) === (line ?? null)
+    );
+    if (at2 === -1) {
+      out.baselined.push(finding2);
+    } else {
+      pool.splice(at2, 1);
+      out.reported.push(finding2);
+    }
+  }
+  return out;
+}
+function resultFor(run3, index) {
+  const page = run3.pages[index];
+  if (page === void 0) return void 0;
+  const aligned = run3.results[index];
+  if (aligned !== void 0 && aligned.file === page.file) return aligned;
+  return run3.results.find((r) => r.file === page.file);
+}
+function belongsTo(finding2, result) {
+  return finding2.index !== void 0 && finding2.index === result.origin.index;
+}
+function labelOf(result) {
+  return result.citation.id ?? "";
+}
+function labelOfFinding(finding2) {
+  if (finding2.id !== void 0) return finding2.id;
+  if (finding2.index !== void 0) return `#${String(finding2.index)}`;
+  return finding2.src ?? "page";
+}
+function citesEncrypted2(src) {
+  try {
+    return parseSrc(src).encrypted;
+  } catch {
+    return false;
+  }
+}
+function claimColumn(result) {
+  const { claim } = result;
+  const where = result.anchor === "marker" && result.markerLine !== void 0 ? `marker :${String(result.markerLine)}` : claim?.fileLines === void 0 ? "" : `:${claim.fileLines}`;
+  if (claim === null) return where;
+  let status;
+  switch (claim.status) {
+    case "moved":
+      status = `moved -> :${claim.newFileLines ?? "?"}`;
+      break;
+    case "moved-ambiguous": {
+      const at2 = (claim.candidateFileLines ?? []).map((lines) => `:${lines}`);
+      status = `moved, ${plural2(at2.length, "candidate")} (${at2.join(", ")})`;
+      break;
+    }
+    default:
+      status = claim.status;
+  }
+  return where === "" ? status : `${where} ${status}`;
+}
+function sourceColumn(result, opts, dim) {
+  const { source } = result;
+  const src = shortSrc(source.src);
+  const revealed = opts.reveal && source.resolvedPath !== void 0 && citesEncrypted2(source.src) ? ` ${dim(`(${source.resolvedPath})`)}` : "";
+  return `${src}${revealed} ${messageFor(source)}`;
+}
+function diffLines(result, dim) {
+  const out = [];
+  for (const subject of result.source.commitsSince ?? []) out.push(dim(`        ${subject}`));
+  const diff = result.source.diff;
+  if (diff === void 0 || diff === "") return out;
+  const lines = diff.split(/\r?\n/);
+  while (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
+  const shown = lines.slice(0, DIFF_LINE_CAP);
+  for (const line of shown) out.push(dim(`        ${line}`));
+  const more = lines.length - shown.length;
+  if (more > 0) out.push(dim(`        \u2026 (${plural2(more, "more line")})`));
+  return out;
+}
+function claimLines(result, dim) {
+  const text = result.claim?.text ?? [];
+  const shown = text.slice(0, DIFF_LINE_CAP);
+  const out = shown.map((line) => dim(`        ${line}`));
+  const more = text.length - shown.length;
+  if (more > 0) out.push(dim(`        \u2026 (${plural2(more, "more line")})`));
+  return out;
+}
+function padTo(text, width, plain) {
+  return width <= plain ? text : text + " ".repeat(width - plain);
+}
+function renderCheckPretty(run3, opts) {
+  const c = palette(opts.color);
+  const lines = [];
+  const quiet = opts.quiet ?? false;
+  const location = (finding2) => {
+    const { file, line } = errorSite(finding2);
+    if (line === void 0) return "";
+    if (file === void 0) return c.dim(`   (line ${String(line)})`);
+    return c.dim(`   (${file}:${String(line)})`);
+  };
+  run3.pages.forEach((page, index) => {
+    const { reported, baselined: baselined2 } = splitBaselined(page, resultFor(run3, index));
+    const errors = reported.filter((f) => f.severity === "error").length;
+    const warned = reported.some((f) => f.severity === "warning");
+    const forgiven = baselined2.length > 0 ? c.dim(`  (${String(baselined2.length)} baselined)`) : "";
+    if (reported.length === 0) {
+      if (quiet) return;
+      lines.push(`${c.green("\u2713")} ${page.file}${forgiven}`);
+    } else {
+      const mark = errors > 0 ? c.red("\u2717") : warned ? c.yellow("\u26A0") : c.dim("\u2139");
+      lines.push(`${mark} ${page.file}${forgiven}`);
+    }
+    const isBaselined = new Set(baselined2);
+    const placed = /* @__PURE__ */ new Set();
+    const rows = [];
+    for (const result of page.citations) {
+      const own = page.findings.filter((f) => belongsTo(f, result) && !placed.has(f));
+      for (const finding2 of own) placed.add(finding2);
+      const live = own.filter((f) => !isBaselined.has(f));
+      if (own.length === 0 && quiet) continue;
+      const worst = live.find((f) => f.severity === "error") ?? live.find((f) => f.severity === "warning") ?? live[0];
+      const mark = worst !== void 0 ? severityMark(worst.severity, c) : own.length > 0 ? c.dim("\xB7") : result.source.status === "skipped" && result.claim === null ? c.dim("\xB7") : c.green("\u2713");
+      const endRules = /* @__PURE__ */ new Set(["claim-", "source-"]);
+      const under = [];
+      for (const finding2 of own) {
+        const isEnd = [...endRules].some((prefix) => finding2.rule.startsWith(prefix));
+        if (isEnd) continue;
+        const text = isBaselined.has(finding2) ? c.dim(`${finding2.message} (baselined)`) : finding2.message;
+        under.push(`      ${severityMark(finding2.severity, c)} ${text}${location(finding2)}`);
+      }
+      if (opts.showDiff) {
+        if (own.some((f) => f.rule === "source-changed")) under.push(...diffLines(result, c.dim));
+        if (own.some((f) => f.rule === "claim-changed")) under.push(...claimLines(result, c.dim));
+      }
+      const forgivenEnd = own.length > 0 && live.length === 0 ? c.dim(" (baselined)") : "";
+      rows.push({
+        mark,
+        label: labelOf(result),
+        claim: claimColumn(result),
+        source: `${sourceColumn(result, opts, c.dim)}${forgivenEnd}`,
+        where: result.origin.kind === "manifest" ? `${result.origin.file}${result.origin.line === void 0 ? "" : `:${String(result.origin.line)}`}` : "",
+        under
+      });
+    }
+    const width = (pick) => rows.reduce((n, row) => Math.max(n, pick(row).length), 0);
+    const labelWidth = width((row) => row.label);
+    const claimWidth = width((row) => row.claim);
+    const anyWhere = rows.some((row) => row.where !== "");
+    const sourceWidth = anyWhere ? width((row) => row.source) : 0;
+    for (const row of rows) {
+      const label = padTo(c.cyan(row.label), labelWidth, row.label.length);
+      const source = padTo(row.source, sourceWidth, row.source.length);
+      const text = `    ${row.mark} ${label}   ${padTo(row.claim, claimWidth, row.claim.length)}   ${source}${row.where === "" ? "" : `   ${c.dim(row.where)}`}`;
+      lines.push(text.replace(/\s+$/, ""));
+      lines.push(...row.under);
+    }
+    for (const finding2 of page.findings) {
+      if (placed.has(finding2)) continue;
+      const label = c.cyan(labelOfFinding(finding2));
+      lines.push(
+        isBaselined.has(finding2) ? `    ${c.dim("\xB7")} ${label}   ${c.dim(`${finding2.message} (baselined)`)}${location(finding2)}` : `    ${severityMark(finding2.severity, c)} ${label}   ${finding2.message}${location(finding2)}`
+      );
+    }
+  });
+  const { summary } = run3;
+  const warnings = summary.warnings ?? 0;
+  const notices = summary.notices ?? 0;
+  const baselined = summary.baseline?.suppressed ?? 0;
+  const findings = summary.errors + warnings + notices + baselined;
+  const parts = [plural2(findings, "finding")];
+  if (warnings > 0) parts.push(`(${plural2(warnings, "warning")})`);
+  if (notices > 0) parts.push(`(${plural2(notices, "notice")})`);
+  if (baselined > 0) parts.push(`(${String(baselined)} baselined)`);
+  const summaryText = `${plural2(summary.files, "file")} checked, ${String(summary.passed)} passed, ${String(summary.failed)} failed, ${parts.join(" ")}`;
+  if (lines.length > 0) lines.push("");
+  lines.push(summary.failed > 0 ? c.red(summaryText) : c.green(summaryText));
+  if (summary.baseline?.written) {
+    lines.push(c.dim(`Baseline written to ${summary.baseline.path}`));
+  }
+  return lines.join("\n");
+}
+function rewriteLine(rewrite) {
+  const word = rewrite.from.includes("-") ? "lines" : "line";
+  const status = rewrite.status === "never-true" ? "never true" : rewrite.status;
+  if (rewrite.reason === "moved") {
+    return rewrite.end === "claim" ? `claim ${word} ${rewrite.from} -> ${rewrite.to} (moved)` : `source ${shortSrc(rewrite.from)} -> ${shortSrc(rewrite.to)} (moved)`;
+  }
+  if (rewrite.end === "claim") {
+    return `claim at line ${String(rewrite.at ?? 0)} re-pinned (${status}; now "${rewrite.text ?? ""}")`;
+  }
+  const at2 = rewrite.commitSha === void 0 ? "" : ` at ${shortCommit(rewrite.commitSha)}`;
+  return `source ${shortSrc(rewrite.src ?? "")} re-pinned${at2} (${status}; ${shortPin(rewrite.from)} -> ${shortPin(rewrite.to)})`;
+}
+function renderUpdatePretty(run3, opts) {
+  const c = palette(opts.color);
+  const lines = [];
+  let files = 0;
+  for (const page of run3.pages) {
+    if (page.rewritten.length > 0) files += 1;
+    if (opts.showDiff && page.diff !== "") {
+      for (const line of page.diff.split(/\r?\n/)) {
+        if (line !== "") lines.push(c.dim(line));
+      }
+    }
+    for (const rewrite of page.rewritten) {
+      const label = rewrite.id ?? `#${String(rewrite.index)}`;
+      lines.push(`${page.file}: ${c.cyan(label)} ${rewriteLine(rewrite)}`);
+    }
+    for (const finding2 of page.skipped) {
+      const mark = severityMark(finding2.severity, c);
+      lines.push(
+        `${page.file}: ${c.cyan(labelOfFinding(finding2))}  ${mark} skipped: ${finding2.message}`
+      );
+    }
+  }
+  if (opts.showDiff) {
+    for (const manifest of run3.manifests ?? []) {
+      for (const line of manifest.diff.split(/\r?\n/)) {
+        if (line !== "") lines.push(c.dim(line));
+      }
+    }
+  }
+  const summary = `${plural2(run3.rewritten, "citation")} rewritten in ${plural2(files, "file")}, ${String(run3.skipped)} skipped`;
+  lines.push(run3.exitCode === 0 ? c.green(summary) : c.red(summary));
+  return lines.join("\n");
+}
+
+// src/cite/reporters/json.ts
+function publicCitation(result) {
+  const origin = {
+    kind: result.origin.kind,
+    file: result.origin.file
+  };
+  if (result.origin.line !== void 0) origin.line = result.origin.line;
+  const source = { src: result.source.src, status: result.source.status };
+  if (result.source.newLines !== void 0) source.newLines = result.source.newLines;
+  if (result.source.newSrc !== void 0) source.newSrc = result.source.newSrc;
+  if (result.source.candidates !== void 0) source.candidates = result.source.candidates;
+  if (result.source.commitSha !== void 0) source.commitSha = result.source.commitSha;
+  if (result.source.historyAvailable !== void 0) {
+    source.historyAvailable = result.source.historyAvailable;
+  }
+  if (result.source.truncatedSearch !== void 0) {
+    source.truncatedSearch = result.source.truncatedSearch;
+  }
+  let claim = null;
+  if (result.claim !== null) {
+    claim = { status: result.claim.status };
+    if (result.claim.lines !== void 0) claim.lines = result.claim.lines;
+    if (result.claim.fileLines !== void 0) claim.fileLines = result.claim.fileLines;
+    if (result.claim.newLines !== void 0) claim.newLines = result.claim.newLines;
+    if (result.claim.candidates !== void 0) claim.candidates = result.claim.candidates;
+  }
+  return {
+    ...result.citation.id === void 0 ? {} : { id: result.citation.id },
+    origin,
+    anchor: result.anchor,
+    claim,
+    source
+  };
+}
+function publicPage(page) {
+  return { ...page, citations: page.citations.map(publicCitation) };
+}
+function renderCheckJson(run3) {
+  return JSON.stringify({ summary: run3.summary, pages: run3.pages.map(publicPage) }, null, 2);
+}
+function renderUpdateJson(run3) {
+  return JSON.stringify(run3, null, 2);
+}
+
+// src/cite/reporters/github.ts
+var NAMES_ITS_SUBJECT = /* @__PURE__ */ new Set([
+  "claim-moved",
+  "claim-moved-ambiguous",
+  "claim-changed",
+  "marker-orphan",
+  "marker-invalid",
+  "marker-repeated",
+  "anchor-invalid"
+]);
+function annotationMessage(finding2) {
+  const subject = finding2.id ?? finding2.src;
+  if (subject === void 0) return finding2.message;
+  if (NAMES_ITS_SUBJECT.has(finding2.rule)) return finding2.message;
+  if (finding2.id !== void 0 && finding2.message.startsWith(finding2.id)) return finding2.message;
+  const where = finding2.id !== void 0 && finding2.src !== void 0 ? ` (${finding2.src})` : "";
+  return `${subject}${where}: ${finding2.message}`;
+}
+function renderCheckGithub(run3) {
+  const lines = [];
+  run3.pages.forEach((page, index) => {
+    const { reported } = splitBaselined(page, resultFor(run3, index));
+    for (const finding2 of reported) {
+      const site = errorSite(finding2);
+      const params = [`file=${escapeWorkflowCommandProperty(site.file ?? page.file)}`];
+      if (site.line !== void 0) params.push(`line=${String(site.line)}`);
+      params.push(`title=${escapeWorkflowCommandProperty(finding2.ruleId)}`);
+      lines.push(
+        `::${finding2.severity} ${params.join(",")}::${escapeWorkflowCommandMessage(annotationMessage(finding2))}`
+      );
+    }
+  });
+  return lines.join("\n");
+}
+
+// src/key/errors.ts
+var KeyError = class extends ToolError {
+  constructor(message) {
+    super(message);
+    this.name = "KeyError";
+  }
+};
+
+// src/key/commands/rotate.ts
+import { existsSync as existsSync2 } from "node:fs";
+import { readFile as readFile5 } from "node:fs/promises";
+import { isAbsolute as isAbsolute3, join as join2, relative as relative3, resolve as resolve6, sep as sep3 } from "node:path";
+import { parse as parseYaml } from "yaml";
+
+// src/key/core/config.ts
+var toKeyError = (message) => new KeyError(message);
+var KEY_CONFIG = {
+  section: "key",
+  // The key never had a file of its own.
+  legacyNames: [],
+  toError: toKeyError
+};
+function readRotateConfig(configPath, cwd) {
+  return configPath === void 0 ? findConfigFile(cwd, KEY_CONFIG) : readConfigFile(configPath, cwd, KEY_CONFIG);
+}
+function readSetConfig(configPath, cwd) {
+  return configPath === void 0 ? findFamilyConfigFile(cwd, toKeyError) : readFamilyConfigFile(configPath, cwd, toKeyError);
+}
+var unfinishedRotation = (source) => `A rotation is unfinished in ${source}. Run \`manni key rotate\` with no --to to finish it.`;
+
+// src/key/commands/rotate.ts
+var BAD_TO = "--to must be at least 32 hex or base64url characters.";
+var NO_STDIN = "key rotate reads and writes files, so it takes no stdin (`-`). Name the files instead.";
+var WITH_PATHS = "--collection selects a configured collection; it cannot be combined with paths.";
+var NEEDS_CONFIG = "--collection needs a config file to select from.";
+var NO_KEY = "No encryption key is available, so nothing can be re-encrypted. Run `manni key set` first.";
+var ENV_NEEDS_TO = "The key comes from MANNI_ENCRYPTION_KEY; pass --to <value>, re-encrypt with it, then update the secret. Nothing is written to config.";
+var NARROWED_NEEDS_TO = "A run over part of the family needs --to, and never writes the key.";
+var NO_FILES = "No files to re-encrypt. Pass paths/globs, or declare a collection under `collections:` in manni.config.yaml.";
+var ANY_CIPHERTEXT = /~[A-Za-z0-9_-]{82,}/;
+function citeSection(file) {
+  if (file === null) return {};
+  const doc = parseYaml(file.text);
+  if (typeof doc !== "object" || doc === null || !("cite" in doc)) return {};
+  return parseCiteConfig(doc.cite, file.source);
+}
+function rootFor(flag, cite, file, cwd) {
+  if (flag !== void 0) return { root: resolve6(cwd, flag), fellBack: false };
+  if (file !== null && cite.root !== void 0) {
+    return { root: resolve6(file.dir, cite.root), fellBack: false };
+  }
+  const gitRoot = findGitRoot(cwd);
+  return gitRoot === null ? { root: cwd, fellBack: true } : { root: gitRoot, fellBack: false };
+}
+function isEnoent3(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+async function indexFor2(root, client) {
+  try {
+    return await buildSourceIndex(root, { gitClient: client });
+  } catch (error) {
+    if (isEnoent3(error)) throw new KeyError(`Root directory not found: ${root}.`);
+    throw error;
+  }
+}
+function encryptedCitations(file, content, format) {
+  const read = readPage(file, content, format === void 0 ? void 0 : { format });
+  const encrypted = read.citations.filter(({ citation }) => sourceRange(citation.source).encrypted);
+  return {
+    any: encrypted.length > 0,
+    withCommit: encrypted.some(({ citation }) => citation.source["commit-sha"] !== void 0)
+  };
+}
+async function rotateManifestCitations(sidecars2, manifests, page, opts) {
+  const none = { rewritten: [], skipped: [], wantsHistory: false };
+  if (sidecars2 === null) return none;
+  const sidecar = sidecars2.forPage(page.file, page.content, page.format);
+  const owner = sidecar.owner;
+  if (owner === void 0 || sidecar.citations === void 0) return none;
+  if (!sidecar.citations.some((input) => ANY_CIPHERTEXT.test(JSON.stringify(input.entry)))) {
+    return none;
+  }
+  const result = await reencryptCitationEntries(
+    { ...page, citations: sidecar.citations },
+    {
+      root: opts.root,
+      fromKey: opts.fromKey,
+      toKey: opts.toKey,
+      gitClient: opts.gitClient,
+      sourceIndex: await opts.sourceIndex()
+    }
+  );
+  if (result.changed && sidecar.entry !== void 0) {
+    await manifests.write(owner, sidecar.entry, result.entries, 0);
+  }
+  return {
+    rewritten: result.rewritten.map((r) => ({ kind: "citation", ...r })),
+    skipped: result.skipped.map((s) => ({ kind: "citation", ...s })),
+    // A pin that no longer holds is re-keyed from the lines at its commit.
+    wantsHistory: sidecar.citations.some(
+      (input) => /"commit-sha"\s*:/.test(JSON.stringify(input.entry))
+    )
+  };
+}
+function reportedPath2(abs, base) {
+  const rel = relative3(base, abs);
+  return rel === "" ? "." : rel.split(sep3).join("/");
+}
+function manifestCollections(collections, opts) {
+  if (opts.fromCollections) return [...collections];
+  const rels = opts.files.map(
+    (rel) => reportedPath2(resolve6(opts.base, rel), opts.configDir)
+  );
+  return collections.filter((c) => rels.some((rel) => isMember(c, rel)));
+}
+function valuesOf(index, entry) {
+  const empty = /* @__PURE__ */ new Map();
+  if (entry.join === PATH_JOIN) {
+    return entry.abs === void 0 ? empty : index.byPath.get(entry.abs) ?? empty;
+  }
+  return index.byField.get(entry.join)?.get(entry.spelled) ?? empty;
+}
+async function planManifests(opts) {
+  const local = opts.collections.map((c) => ({
+    ...c,
+    externalMetadata: c.externalMetadata.filter(
+      (m) => classifyRef(m.file).kind !== "url"
+    )
+  })).filter((c) => c.externalMetadata.length > 0);
+  if (local.length === 0) return [];
+  const index = await loadExternalMetadata(local, {
+    configDir: opts.configDir,
+    base: opts.base
+  });
+  if (index === null) return [];
+  const plans = /* @__PURE__ */ new Map();
+  const located = /* @__PURE__ */ new Map();
+  for (const c of local) {
+    for (const m of c.externalMetadata) {
+      const join4 = externalMetadataJoin(m);
+      const abs = isAbsolute3(m.file) ? m.file : resolve6(opts.configDir, m.file);
+      const file = reportedPath2(abs, opts.base);
+      located.set(`${c.name}\0${file}\0${join4}`, abs);
+      if (plans.has(abs)) continue;
+      plans.set(abs, {
+        manifest: { file, collection: c.name, rewritten: [], skipped: [], written: false },
+        path: abs,
+        text: await readFile5(abs, "utf8"),
+        changed: false
+      });
+    }
+  }
+  for (const entry of index.entries) {
+    const abs = located.get(`${entry.collection}\0${entry.file}\0${entry.join}`);
+    const plan = abs === void 0 ? void 0 : plans.get(abs);
+    if (plan === void 0) continue;
+    const data = {};
+    for (const [key, supplied] of valuesOf(index, entry)) {
+      if (supplied.file === entry.file && supplied.collection === entry.collection) {
+        data[key] = supplied.value;
+      }
+    }
+    const done = reencryptData(data, { fromKey: opts.fromKey, toKey: opts.toKey });
+    for (const r of done.rewritten) {
+      plan.manifest.rewritten.push({ entry: entry.spelled, ...r });
+    }
+    for (const s of done.skipped) {
+      plan.manifest.skipped.push({ entry: entry.spelled, ...s });
+    }
+    for (const key of done.keys) {
+      plan.text = spliceManifestValue(plan.text, {
+        entry: entry.spelled,
+        key,
+        value: done.data[key],
+        join: entry.join,
+        file: plan.manifest.file
+      }).text;
+      plan.changed = true;
+    }
+  }
+  return [...plans.values()].filter(
+    (p) => p.manifest.rewritten.length > 0 || p.manifest.skipped.length > 0
+  );
+}
+async function runKeyRotate(opts) {
+  const cwd = resolve6(opts.cwd ?? process.cwd());
+  const env = opts.env ?? process.env;
+  if (opts.to !== void 0 && !isValidEncryptionKey(opts.to)) throw new KeyError(BAD_TO);
+  if (opts.inputs.includes(STDIN_TOKEN)) throw new KeyError(NO_STDIN);
+  const wanted = opts.collection ?? [];
+  if (wanted.length > 0 && opts.inputs.length > 0) throw new KeyError(WITH_PATHS);
+  const file = await readRotateConfig(opts.configPath, cwd);
+  if (wanted.length > 0 && file === null) throw new KeyError(NEEDS_CONFIG);
+  const { key: current, source: keySource } = resolveEncryptionKey({
+    env,
+    file,
+    toError: toKeyError
+  });
+  if (current === void 0) throw new KeyError(NO_KEY);
+  const narrowed = opts.inputs.length > 0 || wanted.length > 0;
+  const keyFile = keySource === "config" ? file : null;
+  const previous = keyFile?.encryptionKeyPrevious;
+  if (keyFile !== null && previous !== void 0 && (narrowed || opts.to !== void 0 && opts.to !== current)) {
+    throw new KeyError(unfinishedRotation(keyFile.source));
+  }
+  if (keySource === "env" && opts.to === void 0) throw new KeyError(ENV_NEEDS_TO);
+  if (narrowed && opts.to === void 0) throw new KeyError(NARROWED_NEEDS_TO);
+  const fromKey = previous ?? current;
+  const toKey = previous === void 0 ? opts.to ?? generateEncryptionKey() : current;
+  const collections = file === null ? [] : selectCollections(file.collections, wanted, file.source, toKeyError);
+  const fromCollections = opts.inputs.length === 0;
+  const inputs = fromCollections ? collections.flatMap((c) => c.paths) : opts.inputs;
+  if (inputs.length === 0) throw new KeyError(NO_FILES);
+  const base = fromCollections && file !== null ? file.dir : cwd;
+  const forced = opts.as === void 0 ? void 0 : extractorByName(opts.as);
+  if (opts.as !== void 0 && forced?.implemented !== true) {
+    throw new KeyError(
+      `Unknown format "${opts.as}". Supported extensions: ${supportedExtensions().join(", ")}.`
+    );
+  }
+  const format = forced?.name;
+  const exts = opts.exts ?? forced?.extensions;
+  const exclude = [
+    .../* @__PURE__ */ new Set([
+      ...opts.exclude ?? [],
+      ...fromCollections ? collections.flatMap((c) => c.exclude) : []
+    ])
+  ];
+  const { files, gitignoreSkipped } = await resolveTargetSet({
+    inputs,
+    exts,
+    exclude,
+    cwd: base,
+    allowEmpty: opts.allowEmpty,
+    ...gitignoreOptions({ flag: opts.respectGitignore, onNotice: opts.onNotice })
+  });
+  assertNonEmpty({
+    files,
+    inputs,
+    usingStdin: false,
+    allowEmpty: opts.allowEmpty,
+    exclude,
+    exts,
+    gitignoreSkipped,
+    action: "re-encrypted"
+  });
+  const cite = citeSection(file);
+  const { root, fellBack } = rootFor(opts.root, cite, file, cwd);
+  const client = opts.gitClient ?? gitClient(root);
+  let index;
+  const sourceIndex = () => {
+    if (index === void 0) {
+      if (fellBack) opts.onNotice?.(`No git root found; resolving src: paths from ${cwd}`);
+      index = indexFor2(root, client);
+    }
+    return index;
+  };
+  const sidecars2 = file === null ? null : await loadCitationSidecars({
+    collections: file.collections,
+    configDir: file.dir,
+    base,
+    configSource: file.source,
+    key: current,
+    toError: toKeyError
+  });
+  const manifests = new ManifestSet();
+  const planned = [];
+  let wantsHistory = false;
+  for (const rel of files) {
+    const path = resolve6(base, rel);
+    const before = await readFile5(path, "utf8");
+    const page = { file: rel, content: before, ...format === void 0 ? {} : { format } };
+    const sidecarWork = await rotateManifestCitations(sidecars2, manifests, page, {
+      root,
+      fromKey,
+      toKey,
+      gitClient: client,
+      sourceIndex
+    });
+    if (sidecarWork.wantsHistory) wantsHistory = true;
+    if (!ANY_CIPHERTEXT.test(before)) {
+      if (sidecarWork.rewritten.length === 0 && sidecarWork.skipped.length === 0) continue;
+      planned.push({
+        page: { file: rel, rewritten: sidecarWork.rewritten, skipped: sidecarWork.skipped, written: false },
+        path,
+        content: before,
+        changed: false
+      });
+      continue;
+    }
+    const meta = reencryptMetadata(page, { fromKey, toKey });
+    const encrypted = encryptedCitations(rel, meta.content, format);
+    if (encrypted.withCommit) wantsHistory = true;
+    const cited = encrypted.any ? await reencryptCitations(
+      { ...page, content: meta.content },
+      { root, fromKey, toKey, gitClient: client, sourceIndex: await sourceIndex() }
+    ) : { content: meta.content, rewritten: [], skipped: [] };
+    const rewritten = [
+      ...meta.rewritten.map((r) => ({ kind: "metadata", ...r })),
+      ...cited.rewritten.map((r) => ({ kind: "citation", ...r })),
+      ...sidecarWork.rewritten
+    ];
+    const skipped2 = [
+      ...meta.skipped.map((s) => ({ kind: "metadata", ...s })),
+      ...cited.skipped.map((s) => ({ kind: "citation", ...s })),
+      ...sidecarWork.skipped
+    ];
+    if (rewritten.length === 0 && skipped2.length === 0) continue;
+    planned.push({
+      page: { file: rel, rewritten, skipped: skipped2, written: false },
+      path,
+      content: cited.content,
+      changed: cited.content !== before
+    });
+  }
+  if (wantsHistory && !await client.available()) opts.onNotice?.(GIT_UNAVAILABLE_HISTORY);
+  const valueManifests = file === null ? [] : await planManifests({
+    collections: manifestCollections(collections, {
+      fromCollections,
+      files,
+      base,
+      configDir: file.dir
+    }),
+    configDir: file.dir,
+    base,
+    fromKey,
+    toKey
+  });
+  const reencrypted = planned.reduce((n, p) => n + p.page.rewritten.length, 0) + valueManifests.reduce((n, m) => n + m.manifest.rewritten.length, 0);
+  const skipped = planned.reduce((n, p) => n + p.page.skipped.length, 0) + valueManifests.reduce((n, m) => n + m.manifest.skipped.length, 0);
+  const writePage = opts.writePage ?? ((path, content) => writeFileAtomic(path, content));
+  let outcome;
+  if (skipped > 0) {
+    outcome = "skipped";
+  } else if (opts.dryRun === true) {
+    outcome = "dry-run";
+  } else {
+    const writesKey = !narrowed && keyFile !== null;
+    if (!narrowed && keyFile !== null && previous === void 0) {
+      await writeEncryptionKey({ file: keyFile, key: toKey, previous: fromKey, cwd, toError: toKeyError });
+    }
+    for (const p of planned) {
+      if (!p.changed) continue;
+      await writePage(p.path, p.content);
+      p.page.written = true;
+    }
+    for (const changed of manifests.changed()) await writePage(changed.path, changed.text);
+    for (const m of valueManifests) {
+      if (!m.changed) continue;
+      await writePage(m.path, m.text);
+      m.manifest.written = true;
+    }
+    if (!narrowed && keyFile !== null) {
+      await writeEncryptionKey({ file: keyFile, key: toKey, previous: null, cwd, toError: toKeyError });
+    }
+    if (narrowed) outcome = "narrowed";
+    else if (!writesKey) outcome = "env";
+    else outcome = previous === void 0 ? "written" : "finished";
+  }
+  const wrote = outcome !== "skipped" && outcome !== "dry-run";
+  const baseline = file !== null && cite.baseline !== void 0 ? resolve6(file.dir, cite.baseline) : join2(file?.dir ?? cwd, DEFAULT_CITE_BASELINE_PATH);
+  return {
+    pages: planned.map((p) => p.page),
+    manifests: valueManifests.map((m) => m.manifest),
+    reencrypted,
+    skipped,
+    keyWritten: outcome === "written" || outcome === "finished",
+    outcome,
+    ...keyFile === null ? {} : { configSource: keyFile.source },
+    baselineStale: wrote && existsSync2(baseline),
+    exitCode: skipped > 0 ? 1 : 0
+  };
+}
+
+// src/key/commands/set.ts
+import { existsSync as existsSync3 } from "node:fs";
+import { basename, dirname, join as join3, relative as relative4, resolve as resolve7 } from "node:path";
+var BAD_VALUE = "The key must be at least 32 hex or base64url characters. Run `manni key set` with no value to generate one.";
+var ENV_SET = `${ENCRYPTION_KEY_ENV} is set, so a key written to config would never be read. Unset it, or keep the key in the secret.`;
+var alreadyConfigured = (source) => `An encryption key is already configured in ${source}. Run \`manni key rotate\` to replace it and re-encrypt every value.`;
+function refuseBesideLegacy(path, cwd) {
+  const dir = dirname(path);
+  const name = basename(path);
+  for (const legacy of LEGACY_CONFIG_NAMES) {
+    const found = join3(dir, legacy);
+    if (!existsSync3(found)) continue;
+    const source = relative4(cwd, found).replace(/\\/g, "/");
+    throw new KeyError(
+      `${source} is a single-tool config; a ${name} beside it would hide it. Move its keys under meta: in ${name} first.`
+    );
+  }
+}
+async function runKeySet(opts) {
+  const cwd = resolve7(opts.cwd ?? process.cwd());
+  const env = opts.env ?? process.env;
+  if (opts.value !== void 0 && !isValidEncryptionKey(opts.value)) {
+    throw new KeyError(BAD_VALUE);
+  }
+  const fromEnv = env[ENCRYPTION_KEY_ENV];
+  if (fromEnv !== void 0 && fromEnv !== "") throw new KeyError(ENV_SET);
+  const file = await readSetConfig(opts.configPath, cwd);
+  if (file?.encryptionKeyPrevious !== void 0) {
+    throw new KeyError(unfinishedRotation(file.source));
+  }
+  if (file?.encryptionKey !== void 0) {
+    throw new KeyError(alreadyConfigured(file.source));
+  }
+  const generated = opts.value === void 0;
+  const key = opts.value ?? generateEncryptionKey();
+  const dryRun = opts.dryRun === true;
+  const target = await writeEncryptionKey({ file, key, cwd, toError: toKeyError, dryRun: true });
+  if (target.created) refuseBesideLegacy(target.path, cwd);
+  if (isIgnoredByGit(target.path) === false) {
+    opts.onNotice?.(committedKeyWarning(target.source));
+  }
+  if (!dryRun) await writeEncryptionKey({ file, key, cwd, toError: toKeyError });
+  return { path: target.path, source: target.source, created: target.created, generated, dryRun };
+}
+
+export {
+  SEVERITIES,
+  SEVERITY_LIST,
+  isSeverity,
+  meetsSeverity,
+  reencryptMetadata,
+  CiteError,
+  spellSource,
+  runAdd,
+  runCheck,
+  runUpdate,
+  shortPin,
+  shortCommit,
+  shortSrc,
+  renderCheckPretty,
+  renderUpdatePretty,
+  renderCheckGithub,
+  renderCheckJson,
+  renderUpdateJson,
+  cite_exports,
+  KeyError,
+  runKeyRotate,
+  runKeySet
+};
+//# sourceMappingURL=chunk-QLVNSAHR.js.map