@hawkeyexl/manni 4.3.1 → 4.4.1

package/dist/chunk-MWJLZMBL.js

@@ -0,0 +1,934 @@
+#!/usr/bin/env node
+import {
+  ManifestSet,
+  appendFrontmatterCitation,
+  entryObject,
+  insertStatementBefore,
+  itemLine,
+  mintCitation,
+  removeFrontmatterCitations,
+  removeLine,
+  runAdd,
+  runRemove,
+  runUpdate,
+  shiftedEntries,
+  splice,
+  spliceEntryField,
+  unifiedDiff,
+  withClaimLines
+} from "./chunk-4IUC2MNL.js";
+import {
+  CITATIONS_KEY,
+  CITE_SECTION,
+  DEFAULT_CITE_BASELINE_PATH,
+  GIT_UNAVAILABLE_COMMIT,
+  GIT_UNAVAILABLE_HISTORY,
+  MAX_PAGE_COMMITS,
+  PAGE_HISTORY_UNAVAILABLE,
+  buildSourceIndex,
+  checkCitations,
+  claimDiff,
+  claimHistory,
+  claimWords,
+  classifyCitation,
+  decryptSourcePath,
+  duplicateJoinRefusal,
+  encryptSourcePath,
+  gitClient,
+  historyOf,
+  holdsWords,
+  loadCitationSidecars,
+  loadCiteConfig,
+  noGit,
+  orphanRefusal,
+  parseCiteConfig,
+  readCiteConfigFile,
+  readSource,
+  refineClaim,
+  resolveCiteRun,
+  runCheck,
+  runsHolding,
+  sentencesOf,
+  sharesSentence,
+  sidecarsFor,
+  stripMarkers,
+  twoManifestsRefusal,
+  urlManifestRefusal
+} from "./chunk-PIKOVN6W.js";
+import {
+  renderCheckGithub
+} from "./chunk-7UKO3ASZ.js";
+import {
+  refusalLine,
+  removalLine,
+  renderCheckPretty,
+  renderRemovePretty,
+  renderUpdatePretty,
+  rewriteLine
+} from "./chunk-JXLTXMJ7.js";
+import {
+  blockMatches,
+  claimEnd,
+  claimLine,
+  claimMessageFor,
+  errorSite,
+  findingsFor,
+  isUnitText,
+  markerClaimEnd,
+  markerRunAt,
+  markerUnit,
+  messageFor,
+  misplacedMarkerAt,
+  misplacedMarkers,
+  misplacedMessageFor,
+  movedUnit,
+  noUnitAt,
+  normalizeWhitespace,
+  pre43Span,
+  shortCommit,
+  shortLine,
+  shortPin,
+  shortSrc,
+  spellAt,
+  splitUnit,
+  toValidationResult,
+  unitAt,
+  unitText
+} from "./chunk-SKSDRUUK.js";
+import {
+  renderCheckJson,
+  renderRemoveJson,
+  renderUpdateJson
+} from "./chunk-PCE7QHXJ.js";
+import {
+  CITE_RULES,
+  CiteError,
+  DEFAULT_SEVERITY,
+  FILE_PATTERN,
+  MARKER_JSON,
+  MAX_MARKERS_PER_PAGE,
+  RULE_ID_PREFIX,
+  SRC_PATTERN,
+  anchoredLines,
+  bodyLineOf,
+  citationInputs,
+  detectEol,
+  fenceSpanAt,
+  fencedBlockAfter,
+  fencedBlockAt,
+  fencedBlocks,
+  formatSrc,
+  formatStatement,
+  hashRange,
+  insideFence,
+  isBoundLine,
+  isCiteRule,
+  isTableRow,
+  lineAt,
+  offsetOfLine,
+  ownedMessage,
+  paragraphAfter,
+  parseSrc,
+  parseStatements,
+  pickExtractor,
+  rangeLines,
+  readPage,
+  resolveSeverity,
+  ruleId,
+  sliceLines,
+  sourceRange,
+  spellSource,
+  statementForms,
+  validateEntry
+} from "./chunk-YTURO7SI.js";
+import {
+  reencryptData,
+  reencryptMetadata
+} from "./chunk-QRWGPQKO.js";
+import {
+  ENCRYPTION_KEY_ENV,
+  MAX_RANGE_LINES,
+  MOVE_BUDGET_BYTES,
+  MOVE_WINDOW_LINES,
+  PATH_JOIN,
+  committedKeyWarning,
+  configMarks,
+  externalMetadataJoin,
+  findWindows,
+  hashLines,
+  isIgnoredByGit,
+  isKeyedPin,
+  lineSpec,
+  loadExternalMetadata,
+  normalizeText,
+  parseLines,
+  pinOfLines,
+  resolveEncryptionKey,
+  spellLines,
+  spliceManifestValue,
+  splitLines,
+  toBodyLines,
+  toFileLines,
+  writeEncryptionKey
+} from "./chunk-M3W7J6MU.js";
+import {
+  LEGACY_CONFIG_NAMES,
+  STDIN_TOKEN,
+  assertNonEmpty,
+  classifyRef,
+  extractorByName,
+  gitignoreOptions,
+  resolveTargetSet,
+  supportedExtensions,
+  writeFileAtomic
+} from "./chunk-57NEQRVO.js";
+import {
+  findConfigFile,
+  findFamilyConfigFile,
+  findGitRoot,
+  findPageManifests,
+  generateEncryptionKey,
+  hasPagePlaceholder,
+  isMember,
+  isValidEncryptionKey,
+  pageManifestPath,
+  readConfigFile,
+  readFamilyConfigFile,
+  selectCollections
+} from "./chunk-Q35YIDBV.js";
+import {
+  ToolError
+} from "./chunk-G3T47CFV.js";
+import {
+  __export
+} from "./chunk-2H7UOFLK.js";
+
+// src/cite/index.ts
+var cite_exports = {};
+__export(cite_exports, {
+  CITATIONS_KEY: () => CITATIONS_KEY,
+  CITE_RULES: () => CITE_RULES,
+  CITE_SECTION: () => CITE_SECTION,
+  CiteError: () => CiteError,
+  DEFAULT_CITE_BASELINE_PATH: () => DEFAULT_CITE_BASELINE_PATH,
+  DEFAULT_SEVERITY: () => DEFAULT_SEVERITY,
+  FILE_PATTERN: () => FILE_PATTERN,
+  GIT_UNAVAILABLE_COMMIT: () => GIT_UNAVAILABLE_COMMIT,
+  GIT_UNAVAILABLE_HISTORY: () => GIT_UNAVAILABLE_HISTORY,
+  MARKER_JSON: () => MARKER_JSON,
+  MAX_MARKERS_PER_PAGE: () => MAX_MARKERS_PER_PAGE,
+  MAX_PAGE_COMMITS: () => MAX_PAGE_COMMITS,
+  MAX_RANGE_LINES: () => MAX_RANGE_LINES,
+  MOVE_BUDGET_BYTES: () => MOVE_BUDGET_BYTES,
+  MOVE_WINDOW_LINES: () => MOVE_WINDOW_LINES,
+  ManifestSet: () => ManifestSet,
+  PAGE_HISTORY_UNAVAILABLE: () => PAGE_HISTORY_UNAVAILABLE,
+  RULE_ID_PREFIX: () => RULE_ID_PREFIX,
+  SRC_PATTERN: () => SRC_PATTERN,
+  anchoredLines: () => anchoredLines,
+  appendFrontmatterCitation: () => appendFrontmatterCitation,
+  blockMatches: () => blockMatches,
+  bodyLineOf: () => bodyLineOf,
+  buildSourceIndex: () => buildSourceIndex,
+  checkCitations: () => checkCitations,
+  citationInputs: () => citationInputs,
+  claimDiff: () => claimDiff,
+  claimEnd: () => claimEnd,
+  claimHistory: () => claimHistory,
+  claimLine: () => claimLine,
+  claimMessageFor: () => claimMessageFor,
+  claimWords: () => claimWords,
+  classifyCitation: () => classifyCitation,
+  detectEol: () => detectEol,
+  duplicateJoinRefusal: () => duplicateJoinRefusal,
+  entryObject: () => entryObject,
+  errorSite: () => errorSite,
+  fenceSpanAt: () => fenceSpanAt,
+  fencedBlockAfter: () => fencedBlockAfter,
+  fencedBlockAt: () => fencedBlockAt,
+  fencedBlocks: () => fencedBlocks,
+  findWindows: () => findWindows,
+  findingsFor: () => findingsFor,
+  formatSrc: () => formatSrc,
+  formatStatement: () => formatStatement,
+  gitClient: () => gitClient,
+  hashLines: () => hashLines,
+  hashRange: () => hashRange,
+  historyOf: () => historyOf,
+  holdsWords: () => holdsWords,
+  insertStatementBefore: () => insertStatementBefore,
+  insideFence: () => insideFence,
+  isBoundLine: () => isBoundLine,
+  isCiteRule: () => isCiteRule,
+  isKeyedPin: () => isKeyedPin,
+  isTableRow: () => isTableRow,
+  isUnitText: () => isUnitText,
+  itemLine: () => itemLine,
+  lineAt: () => lineAt,
+  lineSpec: () => lineSpec,
+  loadCitationSidecars: () => loadCitationSidecars,
+  loadCiteConfig: () => loadCiteConfig,
+  markerClaimEnd: () => markerClaimEnd,
+  markerRunAt: () => markerRunAt,
+  markerUnit: () => markerUnit,
+  messageFor: () => messageFor,
+  mintCitation: () => mintCitation,
+  misplacedMarkerAt: () => misplacedMarkerAt,
+  misplacedMarkers: () => misplacedMarkers,
+  misplacedMessageFor: () => misplacedMessageFor,
+  movedUnit: () => movedUnit,
+  noGit: () => noGit,
+  noUnitAt: () => noUnitAt,
+  normalizeText: () => normalizeText,
+  normalizeWhitespace: () => normalizeWhitespace,
+  offsetOfLine: () => offsetOfLine,
+  orphanRefusal: () => orphanRefusal,
+  ownedMessage: () => ownedMessage,
+  paragraphAfter: () => paragraphAfter,
+  parseCiteConfig: () => parseCiteConfig,
+  parseLines: () => parseLines,
+  parseSrc: () => parseSrc,
+  parseStatements: () => parseStatements,
+  pickExtractor: () => pickExtractor,
+  pinOfLines: () => pinOfLines,
+  pre43Span: () => pre43Span,
+  rangeLines: () => rangeLines,
+  readCiteConfigFile: () => readCiteConfigFile,
+  readPage: () => readPage,
+  readSource: () => readSource,
+  reencryptCitationEntries: () => reencryptCitationEntries,
+  reencryptCitations: () => reencryptCitations,
+  refineClaim: () => refineClaim,
+  refusalLine: () => refusalLine,
+  removalLine: () => removalLine,
+  removeFrontmatterCitations: () => removeFrontmatterCitations,
+  removeLine: () => removeLine,
+  renderCheckGithub: () => renderCheckGithub,
+  renderCheckJson: () => renderCheckJson,
+  renderCheckPretty: () => renderCheckPretty,
+  renderRemoveJson: () => renderRemoveJson,
+  renderRemovePretty: () => renderRemovePretty,
+  renderUpdateJson: () => renderUpdateJson,
+  renderUpdatePretty: () => renderUpdatePretty,
+  resolveCiteRun: () => resolveCiteRun,
+  resolveSeverity: () => resolveSeverity,
+  rewriteLine: () => rewriteLine,
+  ruleId: () => ruleId,
+  runAdd: () => runAdd,
+  runCheck: () => runCheck,
+  runRemove: () => runRemove,
+  runUpdate: () => runUpdate,
+  runsHolding: () => runsHolding,
+  sentencesOf: () => sentencesOf,
+  sharesSentence: () => sharesSentence,
+  shiftedEntries: () => shiftedEntries,
+  shortCommit: () => shortCommit,
+  shortLine: () => shortLine,
+  shortPin: () => shortPin,
+  shortSrc: () => shortSrc,
+  sidecarsFor: () => sidecarsFor,
+  sliceLines: () => sliceLines,
+  sourceRange: () => sourceRange,
+  spellAt: () => spellAt,
+  spellLines: () => spellLines,
+  spellSource: () => spellSource,
+  splice: () => splice,
+  spliceEntryField: () => spliceEntryField,
+  splitLines: () => splitLines,
+  splitUnit: () => splitUnit,
+  statementForms: () => statementForms,
+  stripMarkers: () => stripMarkers,
+  toBodyLines: () => toBodyLines,
+  toFileLines: () => toFileLines,
+  toValidationResult: () => toValidationResult,
+  twoManifestsRefusal: () => twoManifestsRefusal,
+  unifiedDiff: () => unifiedDiff,
+  unitAt: () => unitAt,
+  unitText: () => unitText,
+  urlManifestRefusal: () => urlManifestRefusal,
+  validateEntry: () => validateEntry,
+  withClaimLines: () => withClaimLines
+});
+
+// src/cite/core/reencrypt.ts
+var UNDECRYPTABLE = "does not decrypt under the current key";
+var MISSING = "missing (no tracked file matches)";
+var CHANGED = "changed; run `manni cite update --accept` before rotating";
+function whereOf(citation, origin) {
+  const where = { index: origin.index };
+  if (citation.id !== void 0) where.id = citation.id;
+  if (origin.line !== void 0) where.line = origin.line;
+  return where;
+}
+async function pinnedLines(ctx, citation, range, path, key) {
+  const source = await readSource(ctx.root, ctx.index, { ...range, path, encrypted: false });
+  if (source.kind === "missing") return { skip: MISSING };
+  const pin = citation.source.integrity;
+  let joined;
+  try {
+    joined = sliceLines(splitLines(source.text), range);
+  } catch {
+    joined = void 0;
+  }
+  if (joined !== void 0 && hashLines(joined, key) === pin) return { joined };
+  const commit = citation.source["commit-sha"];
+  if (commit !== void 0 && await ctx.git.available()) {
+    const history = await historyOf(ctx.git, commit, path, range, pin, key, void 0);
+    if (history.kind === "original") return { joined: history.lines.join("\n") };
+  }
+  return { skip: CHANGED };
+}
+async function verdictFor(ctx, citation, opts) {
+  const range = sourceRange(citation.source);
+  const underNew = decryptSourcePath(range.path, opts.toKey);
+  if (underNew !== void 0) {
+    const held = await pinnedLines(ctx, citation, range, underNew, opts.toKey);
+    if ("joined" in held) return { kind: "done" };
+  }
+  const path = underNew ?? decryptSourcePath(range.path, opts.fromKey);
+  if (path === void 0) return { kind: "skip", message: UNDECRYPTABLE };
+  const lines = await pinnedLines(ctx, citation, range, path, opts.fromKey);
+  if ("skip" in lines) return { kind: "skip", message: lines.skip };
+  const file = underNew === void 0 ? encryptSourcePath(path, opts.toKey) : range.path;
+  return {
+    kind: "write",
+    file,
+    integrity: hashLines(lines.joined, opts.toKey),
+    to: formatSrc({ ...range, path: file })
+  };
+}
+async function contextFor(opts) {
+  const git = opts.gitClient ?? gitClient(opts.root);
+  const index = opts.sourceIndex ?? await buildSourceIndex(opts.root, { gitClient: git });
+  return { root: opts.root, index, git };
+}
+async function reencryptCitations(page, opts) {
+  const read = readPage(page.file, page.content, page.format === void 0 ? void 0 : { format: page.format });
+  const result = { content: page.content, rewritten: [], skipped: [] };
+  const encrypted = read.citations.filter(({ citation }) => sourceRange(citation.source).encrypted);
+  if (encrypted.length === 0) return result;
+  const ctx = await contextFor(opts);
+  let after = page.content;
+  for (const { citation, origin } of encrypted) {
+    const range = sourceRange(citation.source);
+    const where = whereOf(citation, origin);
+    const verdict = await verdictFor(ctx, citation, opts);
+    if (verdict.kind === "done") continue;
+    if (verdict.kind === "skip") {
+      result.skipped.push({ ...where, message: verdict.message });
+      continue;
+    }
+    if (verdict.file !== range.path) {
+      after = spliceEntryField(after, read.format, origin.index, ["source", "file"], verdict.file);
+    }
+    after = spliceEntryField(
+      after,
+      read.format,
+      origin.index,
+      ["source", "integrity"],
+      verdict.integrity
+    );
+    result.rewritten.push({ ...where, from: spellSource(citation.source), to: verdict.to });
+  }
+  result.content = after;
+  return result;
+}
+async function reencryptCitationEntries(page, opts) {
+  const entries = JSON.parse(
+    JSON.stringify(page.citations.map((input) => input.entry))
+  );
+  const out = { entries, changed: false, rewritten: [], skipped: [] };
+  const read = readPage(page.file, page.content, {
+    ...page.format === void 0 ? {} : { format: page.format },
+    citations: page.citations
+  });
+  const encrypted = read.citations.filter(({ citation }) => sourceRange(citation.source).encrypted);
+  if (encrypted.length === 0) return out;
+  const ctx = await contextFor(opts);
+  for (const { citation, origin } of encrypted) {
+    const where = whereOf(citation, origin);
+    const verdict = await verdictFor(ctx, citation, opts);
+    if (verdict.kind === "done") continue;
+    if (verdict.kind === "skip") {
+      out.skipped.push({ ...where, message: verdict.message });
+      continue;
+    }
+    const entry = entries[origin.index];
+    const source = typeof entry === "object" && entry !== null && !Array.isArray(entry) ? entry.source : void 0;
+    if (typeof source !== "object" || source === null || Array.isArray(source)) {
+      out.skipped.push({ ...where, message: UNDECRYPTABLE });
+      continue;
+    }
+    const fields = source;
+    fields.file = verdict.file;
+    fields.integrity = verdict.integrity;
+    out.changed = true;
+    out.rewritten.push({ ...where, from: spellSource(citation.source), to: verdict.to });
+  }
+  return out;
+}
+
+// src/key/errors.ts
+var KeyError = class extends ToolError {
+  constructor(message) {
+    super(message);
+    this.name = "KeyError";
+  }
+};
+
+// src/key/commands/rotate.ts
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { parse as parseYaml } from "yaml";
+
+// src/key/core/config.ts
+var toKeyError = (message) => new KeyError(message);
+var KEY_CONFIG = {
+  section: "key",
+  // The key never had a file of its own.
+  legacyNames: [],
+  toError: toKeyError
+};
+function readRotateConfig(configPath, cwd) {
+  return configPath === void 0 ? findConfigFile(cwd, KEY_CONFIG) : readConfigFile(configPath, cwd, KEY_CONFIG);
+}
+function readSetConfig(configPath, cwd) {
+  return configPath === void 0 ? findFamilyConfigFile(cwd, toKeyError) : readFamilyConfigFile(configPath, cwd, toKeyError);
+}
+var unfinishedRotation = (source) => `A rotation is unfinished in ${source}. Run \`manni key rotate\` with no --to to finish it.`;
+
+// src/key/commands/rotate.ts
+var BAD_TO = "--to must be at least 32 hex or base64url characters.";
+var NO_STDIN = "key rotate reads and writes files, so it takes no stdin (`-`). Name the files instead.";
+var WITH_PATHS = "--collection selects a configured collection; it cannot be combined with paths.";
+var NEEDS_CONFIG = "--collection needs a config file to select from.";
+var NO_KEY = "No encryption key is available, so nothing can be re-encrypted. Run `manni key set` first.";
+var ENV_NEEDS_TO = "The key comes from MANNI_ENCRYPTION_KEY; pass --to <value>, re-encrypt with it, then update the secret. Nothing is written to config.";
+var NARROWED_NEEDS_TO = "A run over part of the family needs --to, and never writes the key.";
+var NO_FILES = "No files to re-encrypt. Pass paths/globs, or declare a collection under `collections:` in manni.config.yaml.";
+var ANY_CIPHERTEXT = /~[A-Za-z0-9_-]{82,}/;
+function citeSection(file) {
+  if (file === null) return {};
+  const doc = parseYaml(file.text);
+  if (typeof doc !== "object" || doc === null || !("cite" in doc)) return {};
+  return parseCiteConfig(doc.cite, file.source);
+}
+function rootFor(flag, cite, file, cwd) {
+  if (flag !== void 0) return { root: resolve(cwd, flag), fellBack: false };
+  if (file !== null && cite.root !== void 0) {
+    return { root: resolve(file.dir, cite.root), fellBack: false };
+  }
+  const gitRoot = findGitRoot(cwd);
+  return gitRoot === null ? { root: cwd, fellBack: true } : { root: gitRoot, fellBack: false };
+}
+function isEnoent(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+async function indexFor(root, client) {
+  try {
+    return await buildSourceIndex(root, { gitClient: client });
+  } catch (error) {
+    if (isEnoent(error)) throw new KeyError(`Root directory not found: ${root}.`);
+    throw error;
+  }
+}
+function encryptedCitations(file, content, format) {
+  const read = readPage(file, content, format === void 0 ? void 0 : { format });
+  const encrypted = read.citations.filter(({ citation }) => sourceRange(citation.source).encrypted);
+  return {
+    any: encrypted.length > 0,
+    withCommit: encrypted.some(({ citation }) => citation.source["commit-sha"] !== void 0)
+  };
+}
+async function rotateManifestCitations(sidecars, manifests, page, opts) {
+  const none = { rewritten: [], skipped: [], wantsHistory: false };
+  if (sidecars === null) return none;
+  const sidecar = await sidecars.forPage(page.file, page.content, page.format);
+  const owner = sidecar.owner;
+  if (owner === void 0 || sidecar.citations === void 0) return none;
+  if (!sidecar.citations.some((input) => ANY_CIPHERTEXT.test(JSON.stringify(input.entry)))) {
+    return none;
+  }
+  const result = await reencryptCitationEntries(
+    { ...page, citations: sidecar.citations },
+    {
+      root: opts.root,
+      fromKey: opts.fromKey,
+      toKey: opts.toKey,
+      gitClient: opts.gitClient,
+      sourceIndex: await opts.sourceIndex()
+    }
+  );
+  if (result.changed && sidecar.entry !== void 0) {
+    await manifests.write(owner, sidecar.entry, result.entries, 0);
+  }
+  return {
+    rewritten: result.rewritten.map((r) => ({ kind: "citation", ...r })),
+    skipped: result.skipped.map((s) => ({ kind: "citation", ...s })),
+    // A pin that no longer holds is re-keyed from the lines at its commit.
+    wantsHistory: sidecar.citations.some(
+      (input) => /"commit-sha"\s*:/.test(JSON.stringify(input.entry))
+    )
+  };
+}
+function reportedPath(abs, base) {
+  const rel = relative(base, abs);
+  return rel === "" ? "." : rel.split(sep).join("/");
+}
+function manifestCollections(collections, opts) {
+  if (opts.fromCollections) return [...collections];
+  const rels = opts.files.map(
+    (rel) => reportedPath(resolve(opts.base, rel), opts.configDir)
+  );
+  return collections.filter((c) => rels.some((rel) => isMember(c, rel)));
+}
+function valuesOf(index, entry) {
+  const empty = /* @__PURE__ */ new Map();
+  if (entry.join === PATH_JOIN) {
+    return entry.abs === void 0 ? empty : index.byPath.get(entry.abs) ?? empty;
+  }
+  return index.byField.get(entry.join)?.get(entry.spelled) ?? empty;
+}
+async function planManifests(opts) {
+  const local = opts.collections.map((c) => ({
+    ...c,
+    externalMetadata: c.externalMetadata.filter(
+      (m) => classifyRef(m.file).kind !== "url"
+    )
+  })).filter((c) => c.externalMetadata.length > 0);
+  if (local.length === 0) return [];
+  const pages = new Set(opts.pages);
+  if (opts.whole) {
+    for (const c of local) {
+      for (const m of c.externalMetadata) {
+        if (!hasPagePlaceholder(m.file)) continue;
+        for (const found of findPageManifests(m.file, opts.configDir, (rel) => isMember(c, rel))) {
+          for (const entry of found.entries) pages.add(entry.pageAbs);
+        }
+      }
+    }
+  }
+  const index = await loadExternalMetadata(local, {
+    configDir: opts.configDir,
+    base: opts.base,
+    pages: [...pages]
+  });
+  if (index === null) return [];
+  const plans = /* @__PURE__ */ new Map();
+  const located = /* @__PURE__ */ new Map();
+  const locate = (collection, abs, join3) => {
+    located.set(`${collection}\0${reportedPath(abs, opts.base)}\0${join3}`, { abs, collection });
+  };
+  for (const c of local) {
+    for (const m of c.externalMetadata) {
+      const join3 = externalMetadataJoin(m);
+      if (!hasPagePlaceholder(m.file)) {
+        locate(c.name, isAbsolute(m.file) ? m.file : resolve(opts.configDir, m.file), join3);
+        continue;
+      }
+      for (const page of pages) {
+        const resolved = pageManifestPath(m.file, opts.configDir, page);
+        if (!("outside" in resolved)) locate(c.name, resolved.abs, join3);
+      }
+    }
+  }
+  const planFor = async (key) => {
+    const where = located.get(key);
+    if (where === void 0) return void 0;
+    const known = plans.get(where.abs);
+    if (known !== void 0) return known;
+    const plan = {
+      manifest: {
+        file: reportedPath(where.abs, opts.base),
+        collection: where.collection,
+        rewritten: [],
+        skipped: [],
+        written: false
+      },
+      path: where.abs,
+      text: await readFile(where.abs, "utf8"),
+      changed: false
+    };
+    plans.set(where.abs, plan);
+    return plan;
+  };
+  for (const entry of index.entries) {
+    const plan = await planFor(`${entry.collection}\0${entry.file}\0${entry.join}`);
+    if (plan === void 0) continue;
+    const data = {};
+    for (const [key, supplied] of valuesOf(index, entry)) {
+      if (supplied.file === entry.file && supplied.collection === entry.collection) {
+        data[key] = supplied.value;
+      }
+    }
+    const done = reencryptData(data, { fromKey: opts.fromKey, toKey: opts.toKey });
+    for (const r of done.rewritten) {
+      plan.manifest.rewritten.push({ entry: entry.spelled, ...r });
+    }
+    for (const s of done.skipped) {
+      plan.manifest.skipped.push({ entry: entry.spelled, ...s });
+    }
+    for (const key of done.keys) {
+      plan.text = spliceManifestValue(plan.text, {
+        entry: entry.spelled,
+        key,
+        value: done.data[key],
+        join: entry.join,
+        file: plan.manifest.file
+      }).text;
+      plan.changed = true;
+    }
+  }
+  return [...plans.values()].filter(
+    (p) => p.manifest.rewritten.length > 0 || p.manifest.skipped.length > 0
+  );
+}
+async function runKeyRotate(opts) {
+  const cwd = resolve(opts.cwd ?? process.cwd());
+  const env = opts.env ?? process.env;
+  if (opts.to !== void 0 && !isValidEncryptionKey(opts.to)) throw new KeyError(BAD_TO);
+  if (opts.inputs.includes(STDIN_TOKEN)) throw new KeyError(NO_STDIN);
+  const wanted = opts.collection ?? [];
+  if (wanted.length > 0 && opts.inputs.length > 0) throw new KeyError(WITH_PATHS);
+  const file = await readRotateConfig(opts.configPath, cwd);
+  if (wanted.length > 0 && file === null) throw new KeyError(NEEDS_CONFIG);
+  const { key: current, source: keySource } = resolveEncryptionKey({
+    env,
+    file,
+    toError: toKeyError
+  });
+  if (current === void 0) throw new KeyError(NO_KEY);
+  const narrowed = opts.inputs.length > 0 || wanted.length > 0;
+  const keyFile = keySource === "config" ? file : null;
+  const previous = keyFile?.encryptionKeyPrevious;
+  if (keyFile !== null && previous !== void 0 && (narrowed || opts.to !== void 0 && opts.to !== current)) {
+    throw new KeyError(unfinishedRotation(keyFile.source));
+  }
+  if (keySource === "env" && opts.to === void 0) throw new KeyError(ENV_NEEDS_TO);
+  if (narrowed && opts.to === void 0) throw new KeyError(NARROWED_NEEDS_TO);
+  const fromKey = previous ?? current;
+  const toKey = previous === void 0 ? opts.to ?? generateEncryptionKey() : current;
+  const collections = file === null ? [] : selectCollections(file.collections, wanted, file.source, toKeyError);
+  const fromCollections = opts.inputs.length === 0;
+  const inputs = fromCollections ? collections.flatMap((c) => c.paths) : opts.inputs;
+  if (inputs.length === 0) throw new KeyError(NO_FILES);
+  const base = fromCollections && file !== null ? file.dir : cwd;
+  const forced = opts.as === void 0 ? void 0 : extractorByName(opts.as);
+  if (opts.as !== void 0 && forced === void 0) {
+    throw new KeyError(
+      `Unknown format "${opts.as}". Supported extensions: ${supportedExtensions().join(", ")}.`
+    );
+  }
+  const format = forced?.name;
+  const exts = opts.exts ?? forced?.extensions;
+  const exclude = [
+    .../* @__PURE__ */ new Set([
+      ...opts.exclude ?? [],
+      ...fromCollections ? collections.flatMap((c) => c.exclude) : []
+    ])
+  ];
+  const { files, gitignoreSkipped } = await resolveTargetSet({
+    inputs,
+    exts,
+    exclude,
+    cwd: base,
+    allowEmpty: opts.allowEmpty,
+    ...gitignoreOptions({ flag: opts.respectGitignore, onNotice: opts.onNotice })
+  });
+  assertNonEmpty({
+    files,
+    inputs,
+    usingStdin: false,
+    allowEmpty: opts.allowEmpty,
+    exclude,
+    exts,
+    gitignoreSkipped,
+    action: "re-encrypted"
+  });
+  const cite = citeSection(file);
+  const { root, fellBack } = rootFor(opts.root, cite, file, cwd);
+  const client = opts.gitClient ?? gitClient(root);
+  let index;
+  const sourceIndex = () => {
+    if (index === void 0) {
+      if (fellBack) opts.onNotice?.(`No git root found; resolving src: paths from ${cwd}`);
+      index = indexFor(root, client);
+    }
+    return index;
+  };
+  const sidecars = file === null ? null : await loadCitationSidecars({
+    collections: file.collections,
+    configDir: file.dir,
+    base,
+    configSource: file.source,
+    key: current,
+    toError: toKeyError,
+    // A keyless manifest (proposal 0068) keeps what a page's schemas mark.
+    marks: () => configMarks(file.path, file.dir),
+    // A `{page}` manifest (0058) is read for exactly the pages rotated.
+    pages: files.map((rel) => resolve(base, rel))
+  });
+  const manifests = new ManifestSet();
+  const planned = [];
+  let wantsHistory = false;
+  for (const rel of files) {
+    const path = resolve(base, rel);
+    const before = await readFile(path, "utf8");
+    const page = { file: rel, content: before, ...format === void 0 ? {} : { format } };
+    const sidecarWork = await rotateManifestCitations(sidecars, manifests, page, {
+      root,
+      fromKey,
+      toKey,
+      gitClient: client,
+      sourceIndex
+    });
+    if (sidecarWork.wantsHistory) wantsHistory = true;
+    if (!ANY_CIPHERTEXT.test(before)) {
+      if (sidecarWork.rewritten.length === 0 && sidecarWork.skipped.length === 0) continue;
+      planned.push({
+        page: { file: rel, rewritten: sidecarWork.rewritten, skipped: sidecarWork.skipped, written: false },
+        path,
+        content: before,
+        changed: false
+      });
+      continue;
+    }
+    const meta = reencryptMetadata(page, { fromKey, toKey });
+    const encrypted = encryptedCitations(rel, meta.content, format);
+    if (encrypted.withCommit) wantsHistory = true;
+    const cited = encrypted.any ? await reencryptCitations(
+      { ...page, content: meta.content },
+      { root, fromKey, toKey, gitClient: client, sourceIndex: await sourceIndex() }
+    ) : { content: meta.content, rewritten: [], skipped: [] };
+    const rewritten = [
+      ...meta.rewritten.map((r) => ({ kind: "metadata", ...r })),
+      ...cited.rewritten.map((r) => ({ kind: "citation", ...r })),
+      ...sidecarWork.rewritten
+    ];
+    const skipped2 = [
+      ...meta.skipped.map((s) => ({ kind: "metadata", ...s })),
+      ...cited.skipped.map((s) => ({ kind: "citation", ...s })),
+      ...sidecarWork.skipped
+    ];
+    if (rewritten.length === 0 && skipped2.length === 0) continue;
+    planned.push({
+      page: { file: rel, rewritten, skipped: skipped2, written: false },
+      path,
+      content: cited.content,
+      changed: cited.content !== before
+    });
+  }
+  if (wantsHistory && !await client.available()) opts.onNotice?.(GIT_UNAVAILABLE_HISTORY);
+  const valueManifests = file === null ? [] : await planManifests({
+    collections: manifestCollections(collections, {
+      fromCollections,
+      files,
+      base,
+      configDir: file.dir
+    }),
+    configDir: file.dir,
+    base,
+    fromKey,
+    toKey,
+    pages: files.map((rel) => resolve(base, rel)),
+    whole: !narrowed
+  });
+  const reencrypted = planned.reduce((n, p) => n + p.page.rewritten.length, 0) + valueManifests.reduce((n, m) => n + m.manifest.rewritten.length, 0);
+  const skipped = planned.reduce((n, p) => n + p.page.skipped.length, 0) + valueManifests.reduce((n, m) => n + m.manifest.skipped.length, 0);
+  const writePage = opts.writePage ?? ((path, content) => writeFileAtomic(path, content));
+  let outcome;
+  if (skipped > 0) {
+    outcome = "skipped";
+  } else if (opts.dryRun === true) {
+    outcome = "dry-run";
+  } else {
+    const writesKey = !narrowed && keyFile !== null;
+    if (!narrowed && keyFile !== null && previous === void 0) {
+      await writeEncryptionKey({ file: keyFile, key: toKey, previous: fromKey, cwd, toError: toKeyError });
+    }
+    for (const p of planned) {
+      if (!p.changed) continue;
+      await writePage(p.path, p.content);
+      p.page.written = true;
+    }
+    for (const changed of manifests.changed()) await writePage(changed.path, changed.text);
+    for (const m of valueManifests) {
+      if (!m.changed) continue;
+      await writePage(m.path, m.text);
+      m.manifest.written = true;
+    }
+    if (!narrowed && keyFile !== null) {
+      await writeEncryptionKey({ file: keyFile, key: toKey, previous: null, cwd, toError: toKeyError });
+    }
+    if (narrowed) outcome = "narrowed";
+    else if (!writesKey) outcome = "env";
+    else outcome = previous === void 0 ? "written" : "finished";
+  }
+  const wrote = outcome !== "skipped" && outcome !== "dry-run";
+  const baseline = file !== null && cite.baseline !== void 0 ? resolve(file.dir, cite.baseline) : join(file?.dir ?? cwd, DEFAULT_CITE_BASELINE_PATH);
+  return {
+    pages: planned.map((p) => p.page),
+    manifests: valueManifests.map((m) => m.manifest),
+    reencrypted,
+    skipped,
+    keyWritten: outcome === "written" || outcome === "finished",
+    outcome,
+    ...keyFile === null ? {} : { configSource: keyFile.source },
+    baselineStale: wrote && existsSync(baseline),
+    exitCode: skipped > 0 ? 1 : 0
+  };
+}
+
+// src/key/commands/set.ts
+import { existsSync as existsSync2 } from "node:fs";
+import { basename, dirname, join as join2, relative as relative2, resolve as resolve2 } from "node:path";
+var BAD_VALUE = "The key must be at least 32 hex or base64url characters. Run `manni key set` with no value to generate one.";
+var ENV_SET = `${ENCRYPTION_KEY_ENV} is set, so a key written to config would never be read. Unset it, or keep the key in the secret.`;
+var alreadyConfigured = (source) => `An encryption key is already configured in ${source}. Run \`manni key rotate\` to replace it and re-encrypt every value.`;
+function refuseBesideLegacy(path, cwd) {
+  const dir = dirname(path);
+  const name = basename(path);
+  for (const legacy of LEGACY_CONFIG_NAMES) {
+    const found = join2(dir, legacy);
+    if (!existsSync2(found)) continue;
+    const source = relative2(cwd, found).replace(/\\/g, "/");
+    throw new KeyError(
+      `${source} is a single-tool config; a ${name} beside it would hide it. Move its keys under meta: in ${name} first.`
+    );
+  }
+}
+async function runKeySet(opts) {
+  const cwd = resolve2(opts.cwd ?? process.cwd());
+  const env = opts.env ?? process.env;
+  if (opts.value !== void 0 && !isValidEncryptionKey(opts.value)) {
+    throw new KeyError(BAD_VALUE);
+  }
+  const fromEnv = env[ENCRYPTION_KEY_ENV];
+  if (fromEnv !== void 0 && fromEnv !== "") throw new KeyError(ENV_SET);
+  const file = await readSetConfig(opts.configPath, cwd);
+  if (file?.encryptionKeyPrevious !== void 0) {
+    throw new KeyError(unfinishedRotation(file.source));
+  }
+  if (file?.encryptionKey !== void 0) {
+    throw new KeyError(alreadyConfigured(file.source));
+  }
+  const generated = opts.value === void 0;
+  const key = opts.value ?? generateEncryptionKey();
+  const dryRun = opts.dryRun === true;
+  const target = await writeEncryptionKey({ file, key, cwd, toError: toKeyError, dryRun: true });
+  if (target.created) refuseBesideLegacy(target.path, cwd);
+  if (isIgnoredByGit(target.path) === false) {
+    opts.onNotice?.(committedKeyWarning(target.source));
+  }
+  if (!dryRun) await writeEncryptionKey({ file, key, cwd, toError: toKeyError });
+  return { path: target.path, source: target.source, created: target.created, generated, dryRun };
+}
+
+export {
+  cite_exports,
+  KeyError,
+  runKeyRotate,
+  runKeySet
+};
+//# sourceMappingURL=chunk-MWJLZMBL.js.map