@remnic/capture-screen 9.24.0

package/dist/chunk-5EJ57MSJ.js

@@ -0,0 +1,2150 @@
+// openclaw-engram: Local-first memory plugin
+
+// src/axtree.ts
+var SECURE_ROLE = "AXSecureTextField";
+function nodeText(node) {
+  const pieces = [];
+  for (const field of [node.value, node.title, node.description, node.label]) {
+    if (typeof field === "string" && field.trim().length > 0) pieces.push(field.trim());
+  }
+  return pieces.join(" ");
+}
+function extractAxText(root, maxNodes) {
+  const lines = [];
+  const stack = [root];
+  let visited = 0;
+  let truncated = false;
+  while (stack.length > 0) {
+    if (visited >= maxNodes) {
+      truncated = true;
+      break;
+    }
+    const node = stack.pop();
+    visited += 1;
+    if (node.offScreen === true) continue;
+    if (node.role === SECURE_ROLE) continue;
+    const text = nodeText(node);
+    if (text.length > 0) lines.push(text);
+    if (Array.isArray(node.children)) {
+      for (let i = node.children.length - 1; i >= 0; i--) stack.push(node.children[i]);
+    }
+  }
+  return { text: lines.join("\n"), nodes: visited, truncated };
+}
+
+// src/simhash.ts
+var MASK64 = (1n << 64n) - 1n;
+var FNV_OFFSET = 14695981039346656037n;
+var FNV_PRIME = 1099511628211n;
+var SHINGLE_SIZE = 2;
+function tokenize(text) {
+  return text.toLowerCase().match(/[\p{L}\p{N}]+/gu) ?? [];
+}
+function shingles(tokens) {
+  if (tokens.length < SHINGLE_SIZE) {
+    return tokens.length > 0 ? [tokens.join(" ")] : [];
+  }
+  const out = [];
+  for (let i = 0; i + SHINGLE_SIZE <= tokens.length; i++) {
+    out.push(tokens.slice(i, i + SHINGLE_SIZE).join(" "));
+  }
+  return out;
+}
+function hash64(s) {
+  let h = FNV_OFFSET;
+  for (let i = 0; i < s.length; i++) {
+    h ^= BigInt(s.charCodeAt(i));
+    h = h * FNV_PRIME & MASK64;
+  }
+  return h;
+}
+function simhash(text) {
+  const grams = shingles(tokenize(text));
+  if (grams.length === 0) return 0n;
+  const votes = new Array(64).fill(0);
+  for (const gram of grams) {
+    const h = hash64(gram);
+    for (let b = 0; b < 64; b++) {
+      votes[b] += h >> BigInt(b) & 1n ? 1 : -1;
+    }
+  }
+  let out = 0n;
+  for (let b = 0; b < 64; b++) {
+    if (votes[b] > 0) out |= 1n << BigInt(b);
+  }
+  return out;
+}
+function hammingDistance(a, b) {
+  let x = (a ^ b) & MASK64;
+  let count = 0;
+  while (x !== 0n) {
+    count += Number(x & 1n);
+    x >>= 1n;
+  }
+  return count;
+}
+function simhashToHex(h) {
+  return (h & MASK64).toString(16).padStart(16, "0");
+}
+function simhashFromHex(hex) {
+  return BigInt(`0x${hex}`) & MASK64;
+}
+
+// src/dedup.ts
+var DedupCache = class _DedupCache {
+  #last = /* @__PURE__ */ new Map();
+  #threshold;
+  #ttlSeconds;
+  constructor(threshold, ttlSeconds) {
+    this.#threshold = threshold;
+    this.#ttlSeconds = ttlSeconds;
+  }
+  static #key(app, windowTitle) {
+    return `${app}\0${windowTitle}`;
+  }
+  /** Seed the last-stored fingerprint for a window (used to prime from the spool). */
+  seed(app, windowTitle, hash, atMs) {
+    this.#last.set(_DedupCache.#key(app, windowTitle), { hash, atMs });
+  }
+  /**
+   * Decide whether a snapshot should be stored, updating the cache when it is.
+   * First snapshot of a window always stores. A negative elapsed (out-of-order
+   * capture) stores defensively rather than dropping data.
+   */
+  shouldStore(app, windowTitle, hash, atMs) {
+    const key = _DedupCache.#key(app, windowTitle);
+    const prev = this.#last.get(key);
+    let store;
+    if (prev === void 0) {
+      store = true;
+    } else {
+      const elapsedSeconds = (atMs - prev.atMs) / 1e3;
+      store = elapsedSeconds < 0 || elapsedSeconds >= this.#ttlSeconds || hammingDistance(hash, prev.hash) > this.#threshold;
+    }
+    if (store) this.#last.set(key, { hash, atMs });
+    return store;
+  }
+};
+
+// src/denylist.ts
+var DEFAULT_DENY_APPS = ["1Password*", "Bitwarden*", "KeePass*"];
+var DEFAULT_DENY_TITLES = [
+  "*incognito*",
+  "*private browsing*",
+  "*inprivate*",
+  "*private window*"
+];
+var DEFAULT_DENY_URLS = [];
+function globToRegExp(glob) {
+  const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
+  return new RegExp(`^${escaped}$`, "i");
+}
+function matchesAnyGlob(patterns, value) {
+  return patterns.some((pattern) => globToRegExp(pattern).test(value));
+}
+function firstMatch(patterns, value, kind) {
+  for (const pattern of patterns) {
+    if (globToRegExp(pattern).test(value)) return `${kind}:${pattern}`;
+  }
+  return null;
+}
+function matchDenyRule(candidate, lists) {
+  const appRule = firstMatch([...DEFAULT_DENY_APPS, ...lists.apps], candidate.app, "app");
+  if (appRule !== null) return appRule;
+  const titleRule = firstMatch([...DEFAULT_DENY_TITLES, ...lists.titles], candidate.windowTitle, "title");
+  if (titleRule !== null) return titleRule;
+  if (typeof candidate.browserUrl === "string" && candidate.browserUrl.length > 0) {
+    const urlRule = firstMatch([...DEFAULT_DENY_URLS, ...lists.urls], candidate.browserUrl, "url");
+    if (urlRule !== null) return urlRule;
+  }
+  return null;
+}
+
+// src/errors.ts
+var CaptureConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CaptureConfigError";
+  }
+};
+var CaptureInputError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CaptureInputError";
+  }
+};
+
+// src/redact.ts
+var REDACTION_PLACEHOLDER = "[REDACTED]";
+var SSN_RE = /\b\d{3}-\d{2}-\d{4}\b/g;
+var CARD_RE = /\b(?:\d[ -]?){13,19}\b/g;
+function luhnValid(digits) {
+  let sum = 0;
+  let double = false;
+  for (let i = digits.length - 1; i >= 0; i--) {
+    let d = digits.charCodeAt(i) - 48;
+    if (double) {
+      d *= 2;
+      if (d > 9) d -= 9;
+    }
+    sum += d;
+    double = !double;
+  }
+  return sum % 10 === 0;
+}
+function redactCards(text) {
+  return text.replace(CARD_RE, (match) => {
+    const digits = match.replace(/[ -]/g, "");
+    if (digits.length < 13 || digits.length > 19 || !luhnValid(digits)) return match;
+    return REDACTION_PLACEHOLDER;
+  });
+}
+function compileRedactionPatterns(sources) {
+  return sources.map((source) => {
+    try {
+      return new RegExp(source, "g");
+    } catch {
+      throw new CaptureConfigError(`redactionPatterns: '${source}' is not a valid regular expression`);
+    }
+  });
+}
+function redactText(text, userPatterns = []) {
+  let out = text.replace(SSN_RE, REDACTION_PLACEHOLDER);
+  out = redactCards(out);
+  for (const pattern of userPatterns) {
+    pattern.lastIndex = 0;
+    out = out.replace(pattern, REDACTION_PLACEHOLDER);
+  }
+  return out;
+}
+
+// src/capture.ts
+import { createHash } from "crypto";
+var DEFAULT_TERMINAL_APPS = [
+  "Terminal",
+  "iTerm2",
+  "iTerm",
+  "Alacritty",
+  "kitty",
+  "WezTerm",
+  "Warp",
+  "Hyper",
+  "Konsole",
+  "gnome-terminal*"
+];
+function isTerminalApp(app, terminalApps, includeDefaults = true) {
+  const patterns = includeDefaults ? [...DEFAULT_TERMINAL_APPS, ...terminalApps] : terminalApps;
+  return matchesAnyGlob(patterns, app);
+}
+function contentHash(fields) {
+  const hash = createHash("sha256");
+  const parts = [fields.capturedAtUtc, fields.app, fields.windowTitle, fields.browserUrl ?? "", fields.text, fields.textSource];
+  for (const field of parts) {
+    hash.update(`${Buffer.byteLength(field)}:`).update(field);
+  }
+  return hash.digest("hex");
+}
+var CaptureProcessor = class {
+  #denyApps;
+  #denyTitles;
+  #denyUrls;
+  #terminalApps;
+  #maxNodes;
+  #redaction;
+  #cache;
+  #ocr;
+  constructor(config, ocr) {
+    this.#denyApps = config.denyApps;
+    this.#denyTitles = config.denyTitles;
+    this.#denyUrls = config.denyUrls;
+    this.#terminalApps = [...DEFAULT_TERMINAL_APPS, ...config.terminalApps];
+    this.#maxNodes = config.maxNodes;
+    this.#redaction = compileRedactionPatterns(config.redactionPatterns);
+    this.#cache = new DedupCache(config.simhashThreshold, config.dedupTtlSeconds);
+    this.#ocr = ocr;
+  }
+  /** Seed the dedup cache from prior spool state so restarts don't re-store. */
+  seed(app, windowTitle, simhashHex, capturedAtUtc) {
+    this.#cache.seed(app, windowTitle, BigInt(`0x${simhashHex}`), Date.parse(capturedAtUtc));
+  }
+  process(candidate) {
+    const denyRule = matchDenyRule(
+      { app: candidate.app, windowTitle: candidate.windowTitle, browserUrl: candidate.browserUrl },
+      { apps: this.#denyApps, titles: this.#denyTitles, urls: this.#denyUrls }
+    );
+    if (denyRule !== null) return { action: "denied", rule: denyRule };
+    const extracted = this.#extractText(candidate);
+    if (extracted === null) return { action: "skipped", reason: "ocr-unavailable" };
+    const { source } = extracted;
+    const text = redactText(extracted.text, this.#redaction);
+    const fingerprint = simhash(text);
+    const atMs = Date.parse(candidate.capturedAtUtc);
+    if (!this.#cache.shouldStore(candidate.app, candidate.windowTitle, fingerprint, atMs)) {
+      return { action: "skipped", reason: "dedup" };
+    }
+    const browserUrl = candidate.browserUrl ?? null;
+    return {
+      action: "store",
+      snapshot: {
+        capturedAtUtc: candidate.capturedAtUtc,
+        app: candidate.app,
+        windowTitle: candidate.windowTitle,
+        browserUrl,
+        text,
+        textSource: source,
+        contentHash: contentHash({
+          capturedAtUtc: candidate.capturedAtUtc,
+          app: candidate.app,
+          windowTitle: candidate.windowTitle,
+          browserUrl,
+          text,
+          textSource: source
+        }),
+        simhash: simhashToHex(fingerprint)
+      }
+    };
+  }
+  /** Resolve visible text + its source, or null when OCR was needed but unavailable. */
+  #extractText(candidate) {
+    if (typeof candidate.text === "string") {
+      return { text: candidate.text, source: candidate.textSource ?? "ax" };
+    }
+    const axText = candidate.ax === void 0 ? "" : extractAxText(candidate.ax, this.#maxNodes).text;
+    const needsOcr = isTerminalApp(candidate.app, this.#terminalApps, false) || axText.trim() === "";
+    if (!needsOcr) return { text: axText, source: "ax" };
+    const ocrText = this.#ocr === void 0 ? null : this.#ocr(candidate);
+    if (ocrText !== null && ocrText.trim() !== "") return { text: ocrText, source: "ocr" };
+    return null;
+  }
+};
+function computeStats(snapshots, date, timezone, maxDwellSeconds) {
+  const ordered = [...snapshots].sort((a, b) => {
+    const at = Date.parse(a.capturedAtUtc);
+    const bt = Date.parse(b.capturedAtUtc);
+    if (at !== bt) return at - bt;
+    return a.id - b.id;
+  });
+  const seconds = /* @__PURE__ */ new Map();
+  const counts = /* @__PURE__ */ new Map();
+  let totalSeconds = 0;
+  for (let i = 0; i < ordered.length; i++) {
+    const snap = ordered[i];
+    counts.set(snap.app, (counts.get(snap.app) ?? 0) + 1);
+    if (i + 1 < ordered.length) {
+      const gap = (Date.parse(ordered[i + 1].capturedAtUtc) - Date.parse(snap.capturedAtUtc)) / 1e3;
+      const dwell = Math.max(0, Math.min(gap, maxDwellSeconds));
+      seconds.set(snap.app, (seconds.get(snap.app) ?? 0) + dwell);
+      totalSeconds += dwell;
+    }
+  }
+  const apps = [...counts.keys()].map((app) => ({ app, seconds: seconds.get(app) ?? 0, snapshotCount: counts.get(app) ?? 0 })).sort((a, b) => b.seconds !== a.seconds ? b.seconds - a.seconds : a.app < b.app ? -1 : a.app > b.app ? 1 : 0);
+  return { date, timezone, snapshotCount: ordered.length, totalSeconds, apps };
+}
+
+// src/constants.ts
+var CAPTURE_SCREEN_VERSION = "9.14.0";
+var DEFAULT_HOST = "127.0.0.1";
+var DEFAULT_PORT = 4341;
+var SPOOL_SCHEMA_VERSION = 1;
+var MAX_SNAPSHOTS_LIMIT = 500;
+var DEFAULT_SNAPSHOTS_LIMIT = 100;
+var DEFAULT_SPOOL_RETENTION_DAYS = 14;
+var DEFAULT_SIMHASH_THRESHOLD = 10;
+var DEFAULT_DEDUP_TTL_SECONDS = 60;
+var DEFAULT_SESSION_GAP_SECONDS = 300;
+var DEFAULT_MAX_NODES = 4e3;
+var DEFAULT_MAX_DWELL_SECONDS = 300;
+var DEFAULT_POLL_INTERVAL_MS = 1e3;
+var DEFAULT_SETTLE_MS = 500;
+var DEFAULT_IDLE_FALLBACK_SECONDS = 30;
+
+// src/config.ts
+import { readFileSync } from "fs";
+
+// src/util.ts
+var LOOPBACK_HOSTS = {
+  "127.0.0.1": true,
+  "::1": true,
+  localhost: true,
+  "::ffff:127.0.0.1": true
+};
+function stripIpv6Brackets(host) {
+  const h = host.trim();
+  return h.startsWith("[") && h.endsWith("]") ? h.slice(1, -1) : h;
+}
+function isLoopbackHost(host) {
+  return Object.hasOwn(LOOPBACK_HOSTS, stripIpv6Brackets(host).toLowerCase());
+}
+function formatHostForUrl(host) {
+  const bare = stripIpv6Brackets(host);
+  return bare.includes(":") ? `[${bare}]` : bare;
+}
+function describeValue(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "an array";
+  const t = typeof value;
+  if (t === "string") return `a string`;
+  if (t === "object") return "an object";
+  return `${t} (${String(value)})`;
+}
+function sanitizeError(err) {
+  if (!(err instanceof Error)) return "unknown error";
+  const code = err.code;
+  return typeof code === "string" && code.length > 0 ? `${err.name} (${code})` : err.name;
+}
+
+// src/coerce.ts
+function coerceNumber(value, label, bounds = {}) {
+  let n;
+  if (typeof value === "number") {
+    n = value;
+  } else if (typeof value === "string" && value.trim() !== "") {
+    n = Number(value);
+  } else {
+    throw new CaptureConfigError(`${label}: expected a number, got ${describeValue(value)}`);
+  }
+  if (!Number.isFinite(n)) {
+    throw new CaptureConfigError(`${label}: '${String(value)}' is not a finite number`);
+  }
+  if (bounds.integer && !Number.isInteger(n)) {
+    throw new CaptureConfigError(`${label}: expected an integer, got ${n}`);
+  }
+  if (bounds.min !== void 0 && n < bounds.min) {
+    throw new CaptureConfigError(`${label}: must be >= ${bounds.min}, got ${n}`);
+  }
+  if (bounds.max !== void 0 && n > bounds.max) {
+    throw new CaptureConfigError(`${label}: must be <= ${bounds.max}, got ${n}`);
+  }
+  return n;
+}
+function coerceStringArray(value, label) {
+  if (!Array.isArray(value) || !value.every((item) => typeof item === "string")) {
+    throw new CaptureConfigError(`${label}: expected an array of strings, got ${describeValue(value)}`);
+  }
+  return [...value];
+}
+
+// src/config.ts
+function defaultDaemonConfig() {
+  return {
+    host: DEFAULT_HOST,
+    port: DEFAULT_PORT,
+    spoolRetentionDays: DEFAULT_SPOOL_RETENTION_DAYS,
+    simhashThreshold: DEFAULT_SIMHASH_THRESHOLD,
+    dedupTtlSeconds: DEFAULT_DEDUP_TTL_SECONDS,
+    sessionGapSeconds: DEFAULT_SESSION_GAP_SECONDS,
+    maxNodes: DEFAULT_MAX_NODES,
+    maxDwellSeconds: DEFAULT_MAX_DWELL_SECONDS,
+    pollIntervalMs: DEFAULT_POLL_INTERVAL_MS,
+    settleMs: DEFAULT_SETTLE_MS,
+    idleFallbackSeconds: DEFAULT_IDLE_FALLBACK_SECONDS,
+    denyApps: [],
+    denyTitles: [],
+    denyUrls: [],
+    terminalApps: [],
+    redactionPatterns: []
+  };
+}
+var KNOWN_TOP_KEYS = {
+  host: true,
+  port: true,
+  spoolRetentionDays: true,
+  simhashThreshold: true,
+  dedupTtlSeconds: true,
+  sessionGapSeconds: true,
+  maxNodes: true,
+  maxDwellSeconds: true,
+  pollIntervalMs: true,
+  settleMs: true,
+  idleFallbackSeconds: true,
+  denyApps: true,
+  denyTitles: true,
+  denyUrls: true,
+  terminalApps: true,
+  redactionPatterns: true
+};
+function asObject(value, label) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new CaptureConfigError(`${label}: expected an object, got ${describeValue(value)}`);
+  }
+  return value;
+}
+function requireString(value, label) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new CaptureConfigError(`${label}: expected a non-empty string, got ${describeValue(value)}`);
+  }
+  return value.trim();
+}
+function parseDaemonConfig(raw) {
+  const cfg = defaultDaemonConfig();
+  const obj = asObject(raw, "config");
+  for (const key of Object.keys(obj)) {
+    if (!Object.hasOwn(KNOWN_TOP_KEYS, key)) {
+      console.warn(`remnic-capture-screen: config: ignoring unknown key '${key}'`);
+    }
+  }
+  if (obj.host !== void 0) cfg.host = requireString(obj.host, "host");
+  if (obj.port !== void 0) cfg.port = coerceNumber(obj.port, "port", { integer: true, min: 1, max: 65535 });
+  if (obj.spoolRetentionDays !== void 0) {
+    cfg.spoolRetentionDays = coerceNumber(obj.spoolRetentionDays, "spoolRetentionDays", { integer: true, min: 1 });
+  }
+  if (obj.simhashThreshold !== void 0) {
+    cfg.simhashThreshold = coerceNumber(obj.simhashThreshold, "simhashThreshold", { integer: true, min: 0, max: 64 });
+  }
+  if (obj.dedupTtlSeconds !== void 0) {
+    cfg.dedupTtlSeconds = coerceNumber(obj.dedupTtlSeconds, "dedupTtlSeconds", { min: 0 });
+  }
+  if (obj.sessionGapSeconds !== void 0) {
+    cfg.sessionGapSeconds = coerceNumber(obj.sessionGapSeconds, "sessionGapSeconds", { min: 0 });
+  }
+  if (obj.maxNodes !== void 0) {
+    cfg.maxNodes = coerceNumber(obj.maxNodes, "maxNodes", { integer: true, min: 1 });
+  }
+  if (obj.maxDwellSeconds !== void 0) {
+    cfg.maxDwellSeconds = coerceNumber(obj.maxDwellSeconds, "maxDwellSeconds", { min: 1 });
+  }
+  if (obj.pollIntervalMs !== void 0) {
+    cfg.pollIntervalMs = coerceNumber(obj.pollIntervalMs, "pollIntervalMs", { integer: true, min: 100 });
+  }
+  if (obj.settleMs !== void 0) {
+    cfg.settleMs = coerceNumber(obj.settleMs, "settleMs", { integer: true, min: 0 });
+  }
+  if (obj.idleFallbackSeconds !== void 0) {
+    cfg.idleFallbackSeconds = coerceNumber(obj.idleFallbackSeconds, "idleFallbackSeconds", { min: 1 });
+  }
+  if (obj.denyApps !== void 0) cfg.denyApps = coerceStringArray(obj.denyApps, "denyApps");
+  if (obj.denyTitles !== void 0) cfg.denyTitles = coerceStringArray(obj.denyTitles, "denyTitles");
+  if (obj.denyUrls !== void 0) cfg.denyUrls = coerceStringArray(obj.denyUrls, "denyUrls");
+  if (obj.terminalApps !== void 0) cfg.terminalApps = coerceStringArray(obj.terminalApps, "terminalApps");
+  if (obj.redactionPatterns !== void 0) {
+    cfg.redactionPatterns = coerceStringArray(obj.redactionPatterns, "redactionPatterns");
+  }
+  return cfg;
+}
+function loadDaemonConfig(configPath) {
+  let text;
+  try {
+    text = readFileSync(configPath, "utf8");
+  } catch {
+    throw new CaptureConfigError(`config not found at ${configPath} \u2014 run \`remnic-capture-screen init\` first`);
+  }
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch (err) {
+    throw new CaptureConfigError(`config at ${configPath} is not valid JSON: ${err.message}`);
+  }
+  return parseDaemonConfig(raw);
+}
+function serializeDaemonConfig(cfg) {
+  return `${JSON.stringify(cfg, null, 2)}
+`;
+}
+
+// src/control.ts
+import { mkdirSync, readFileSync as readFileSync2, renameSync, rmSync, writeFileSync } from "fs";
+import { randomBytes } from "crypto";
+import path from "path";
+function writePidFile(pidPath, pid, options = {}) {
+  mkdirSync(path.dirname(pidPath), { recursive: true });
+  const record = {
+    pid,
+    instanceId: options.instanceId ?? null,
+    startedAtIso: options.startedAtIso ?? (/* @__PURE__ */ new Date()).toISOString(),
+    host: options.host ?? null,
+    port: options.port ?? null
+  };
+  const tmp = `${pidPath}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+  writeFileSync(tmp, `${JSON.stringify(record)}
+`, "utf8");
+  renameSync(tmp, pidPath);
+}
+function readPidRecord(pidPath) {
+  let text;
+  try {
+    text = readFileSync2(pidPath, "utf8");
+  } catch {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null) return null;
+  const record = parsed;
+  const pid = typeof record.pid === "number" ? record.pid : Number.NaN;
+  if (!Number.isInteger(pid) || pid <= 0) return null;
+  const port = typeof record.port === "number" && Number.isInteger(record.port) && record.port > 0 ? record.port : null;
+  return {
+    pid,
+    instanceId: typeof record.instanceId === "string" ? record.instanceId : null,
+    startedAtIso: typeof record.startedAtIso === "string" ? record.startedAtIso : "",
+    host: typeof record.host === "string" && record.host !== "" ? record.host : null,
+    port
+  };
+}
+function readPidFile(pidPath) {
+  return readPidRecord(pidPath)?.pid ?? null;
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+function removePidFile(pidPath) {
+  rmSync(pidPath, { force: true });
+}
+function removePidFileIfOwner(pidPath, pid) {
+  const record = readPidRecord(pidPath);
+  if (record && record.pid === pid) rmSync(pidPath, { force: true });
+}
+
+// src/token.ts
+import { Buffer as Buffer2 } from "buffer";
+import { randomBytes as randomBytes2, timingSafeEqual } from "crypto";
+import { chmodSync, existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import path2 from "path";
+function generateToken() {
+  return randomBytes2(32).toString("base64url");
+}
+function loadOrCreateToken(tokenPath) {
+  mkdirSync2(path2.dirname(tokenPath), { recursive: true });
+  if (existsSync(tokenPath)) {
+    chmodSync(tokenPath, 384);
+    const existing = readFileSync3(tokenPath, "utf8").trim();
+    if (existing) return existing;
+  }
+  const token = generateToken();
+  try {
+    writeFileSync2(tokenPath, `${token}
+`, { mode: 384, flag: "wx" });
+    chmodSync(tokenPath, 384);
+    return token;
+  } catch (err) {
+    if (err.code !== "EEXIST") throw err;
+    chmodSync(tokenPath, 384);
+    const raced = readFileSync3(tokenPath, "utf8").trim();
+    if (raced) return raced;
+    writeFileSync2(tokenPath, `${token}
+`, { mode: 384 });
+    chmodSync(tokenPath, 384);
+    return token;
+  }
+}
+function tokensMatch(expected, presented) {
+  const a = Buffer2.from(expected, "utf8");
+  const b = Buffer2.from(presented, "utf8");
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+function bearerFromHeader(header) {
+  const value = Array.isArray(header) ? header[0] : header;
+  if (!value) return null;
+  const trimmed = value.trim();
+  if (trimmed.slice(0, 6).toLowerCase() !== "bearer") return null;
+  const separator = trimmed.charCodeAt(6);
+  if (separator !== 32 && separator !== 9) return null;
+  const token = trimmed.slice(6).trim();
+  return token || null;
+}
+
+// src/validate.ts
+import { Buffer as Buffer3 } from "buffer";
+var DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+function parseSnapshotDate(value) {
+  if (typeof value !== "string" || !DATE_RE.test(value)) {
+    throw new CaptureInputError(`invalid date '${value ?? ""}' \u2014 expected YYYY-MM-DD`);
+  }
+  const [year, month, day] = value.split("-").map(Number);
+  const dt = new Date(Date.UTC(year, month - 1, day));
+  dt.setUTCFullYear(year);
+  if (dt.getUTCFullYear() !== year || dt.getUTCMonth() !== month - 1 || dt.getUTCDate() !== day) {
+    throw new CaptureInputError(`invalid date '${value}' \u2014 not a real calendar date`);
+  }
+  return value;
+}
+function assertValidTimezone(value) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new CaptureInputError("invalid timezone '' \u2014 expected an IANA timezone");
+  }
+  try {
+    new Intl.DateTimeFormat("en-CA", { timeZone: value });
+  } catch {
+    throw new CaptureInputError(`invalid timezone '${value}' \u2014 not a known IANA timezone`);
+  }
+  return value;
+}
+function parseLimit(value) {
+  if (value === null || value === void 0) return DEFAULT_SNAPSHOTS_LIMIT;
+  const n = Number(value);
+  if (value === "" || !Number.isInteger(n) || n < 1 || n > MAX_SNAPSHOTS_LIMIT) {
+    throw new CaptureInputError(
+      `invalid limit '${value}' \u2014 expected an integer between 1 and ${MAX_SNAPSHOTS_LIMIT}`
+    );
+  }
+  return n;
+}
+function encodeCursor(capturedAtUtc, id) {
+  return Buffer3.from(JSON.stringify([capturedAtUtc, id]), "utf8").toString("base64url");
+}
+function decodeCursor(value) {
+  if (value === null || value === void 0 || value === "") return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(Buffer3.from(value, "base64url").toString("utf8"));
+  } catch {
+    throw new CaptureInputError("invalid cursor \u2014 not a recognized pagination token");
+  }
+  if (Array.isArray(parsed) && parsed.length === 2 && typeof parsed[0] === "string" && typeof parsed[1] === "number" && Number.isInteger(parsed[1]) && parsed[1] >= 0 && /^\d{4}-\d{2}-\d{2}T/.test(parsed[0]) && Number.isFinite(Date.parse(parsed[0])) && new Date(parsed[0]).toISOString() === parsed[0]) {
+    return { capturedAtUtc: parsed[0], id: parsed[1] };
+  }
+  throw new CaptureInputError("invalid cursor \u2014 not a recognized pagination token");
+}
+
+// src/daemon.ts
+import http from "http";
+import { Buffer as Buffer4 } from "buffer";
+function snapshotToWire(snap) {
+  const wire = {
+    capturedAtUtc: snap.capturedAtUtc,
+    app: snap.app,
+    windowTitle: snap.windowTitle,
+    text: snap.text,
+    textSource: snap.textSource,
+    contentHash: snap.contentHash,
+    simhash: snap.simhash
+  };
+  if (snap.browserUrl !== null) wire.browserUrl = snap.browserUrl;
+  return wire;
+}
+function sendJson(res, status, body) {
+  const payload = JSON.stringify(body);
+  res.writeHead(status, {
+    "content-type": "application/json; charset=utf-8",
+    "content-length": Buffer4.byteLength(payload),
+    "cache-control": "no-store"
+  });
+  res.end(payload);
+}
+function handleHealth(deps, res) {
+  const body = {
+    ok: true,
+    version: CAPTURE_SCREEN_VERSION,
+    platform: process.platform,
+    capturing: deps.capturing ?? false,
+    axAvailable: deps.axAvailable ?? false,
+    ocrAvailable: deps.ocrAvailable ?? false,
+    pendingCount: deps.spool.countSnapshots(),
+    instanceId: deps.spool.meta("instance_id"),
+    replayStatus: deps.spool.meta("replay_status"),
+    pid: process.pid
+  };
+  if (deps.helperHint) body.helperHint = deps.helperHint;
+  sendJson(res, 200, body);
+}
+function handleSnapshots(deps, url, res) {
+  const date = parseSnapshotDate(url.searchParams.get("date"));
+  const timezone = assertValidTimezone(url.searchParams.get("timezone"));
+  const limit = parseLimit(url.searchParams.get("limit"));
+  const cursor = url.searchParams.get("cursor");
+  const page = deps.spool.querySnapshots({ date, timezone, cursor, limit });
+  sendJson(res, 200, { snapshots: page.snapshots.map(snapshotToWire), nextCursor: page.nextCursor });
+}
+function handleStats(deps, url, res) {
+  const date = parseSnapshotDate(url.searchParams.get("date"));
+  const timezone = assertValidTimezone(url.searchParams.get("timezone"));
+  const stats = computeStats(deps.spool.daySnapshots(date, timezone), date, timezone, deps.config.maxDwellSeconds);
+  sendJson(res, 200, stats);
+}
+function createRequestHandler(deps) {
+  if (!isLoopbackHost(deps.config.host)) {
+    throw new CaptureConfigError(
+      `refusing to bind non-loopback host '${deps.config.host}': capture-screen serves plain HTTP with no TLS contract; bind a loopback address (127.0.0.1 or ::1) only`
+    );
+  }
+  if (!deps.token) {
+    throw new CaptureConfigError("daemon requires a bearer token");
+  }
+  return (req, res) => {
+    try {
+      const presented = bearerFromHeader(req.headers["authorization"]);
+      if (!presented || !tokensMatch(deps.token, presented)) {
+        res.setHeader("www-authenticate", "Bearer");
+        sendJson(res, 401, { error: "unauthorized" });
+        return;
+      }
+      if (req.method !== "GET") {
+        sendJson(res, 405, { error: "method not allowed" });
+        return;
+      }
+      const url = new URL(req.url ?? "/", "http://localhost");
+      switch (url.pathname) {
+        case "/v1/health":
+          handleHealth(deps, res);
+          return;
+        case "/v1/snapshots":
+          handleSnapshots(deps, url, res);
+          return;
+        case "/v1/stats":
+          handleStats(deps, url, res);
+          return;
+        default:
+          sendJson(res, 404, { error: "not found" });
+      }
+    } catch (err) {
+      if (err instanceof CaptureInputError) {
+        sendJson(res, 400, { error: err.message });
+        return;
+      }
+      sendJson(res, 500, { error: "internal error" });
+    }
+  };
+}
+function startDaemon(deps) {
+  return new Promise((resolve, reject) => {
+    let handler;
+    try {
+      handler = createRequestHandler(deps);
+    } catch (err) {
+      reject(err);
+      return;
+    }
+    const server = http.createServer(handler);
+    const onError = (err) => reject(err);
+    server.once("error", onError);
+    server.listen(deps.config.port, deps.config.host, () => {
+      server.removeListener("error", onError);
+      server.on("error", (err) => {
+        process.stderr.write(`capture-screen daemon server error: ${err.code ?? err.name}
+`);
+      });
+      const address = server.address();
+      const port = typeof address === "object" && address ? address.port : deps.config.port;
+      const host = deps.config.host;
+      resolve({
+        server,
+        host,
+        port,
+        url: `http://${formatHostForUrl(host)}:${port}`,
+        close: () => new Promise((res2, rej2) => {
+          server.close((closeErr) => closeErr ? rej2(closeErr) : res2());
+        })
+      });
+    });
+  });
+}
+
+// src/paths.ts
+import os from "os";
+import path3 from "path";
+function expandTilde(p) {
+  if (p === "~") return os.homedir();
+  if (p.startsWith("~/")) return path3.join(os.homedir(), p.slice(2));
+  return p;
+}
+function captureBaseDir(env = process.env) {
+  const override = env.REMNIC_CAPTURE_SCREEN_DIR?.trim();
+  if (override) return expandTilde(override);
+  return path3.join(os.homedir(), ".remnic", "capture-screen");
+}
+function capturePaths(baseDir = captureBaseDir()) {
+  return {
+    baseDir,
+    configPath: path3.join(baseDir, "screen.json"),
+    spoolPath: path3.join(baseDir, "screen.sqlite"),
+    tokenPath: path3.join(baseDir, "token"),
+    pidPath: path3.join(baseDir, "daemon.pid"),
+    logPath: path3.join(baseDir, "daemon.log")
+  };
+}
+
+// src/helper.ts
+import { spawn } from "child_process";
+var MAX_OUTPUT_BYTES = 8 * 1024 * 1024;
+var DEFAULT_TIMEOUT_MS = 15e3;
+function helperPackageName(platform = process.platform, arch = process.arch) {
+  return `@remnic/capture-native-${platform}-${arch}`;
+}
+function installHint(pkg) {
+  return `native capture helper (${pkg}) is not available on this install \u2014 it ships via a tracked follow-up (https://github.com/joshuaswarren/remnic/issues/2139). To enable live screen capture now, build the Swift helper from source (packages/capture-native-darwin-helper) and set REMNIC_CAPTURE_HELPER_BIN to the binary`;
+}
+function isModuleNotFound(err) {
+  const code = err?.code;
+  return code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND";
+}
+async function resolveHelperBinaryPath(env = process.env) {
+  const override = env.REMNIC_CAPTURE_HELPER_BIN?.trim();
+  if (override) return { binaryPath: expandTilde(override), hint: null };
+  const pkg = helperPackageName();
+  try {
+    const mod = await import(pkg);
+    if (mod && typeof mod === "object" && "helperBinaryPath" in mod) {
+      const value = mod.helperBinaryPath;
+      if (typeof value === "string" && value.length > 0) return { binaryPath: value, hint: null };
+    }
+    return { binaryPath: null, hint: `${pkg} is installed but exports no helperBinaryPath` };
+  } catch (err) {
+    if (isModuleNotFound(err)) return { binaryPath: null, hint: installHint(pkg) };
+    return { binaryPath: null, hint: `${pkg} failed to load; reinstall it to enable live capture` };
+  }
+}
+function spawnHelper(binaryPath, args, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(binaryPath, args, { stdio: ["ignore", "pipe", "pipe"] });
+    const chunks = [];
+    let size = 0;
+    let settled = false;
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      child.kill("SIGKILL");
+      reject(new CaptureInputError("native helper timed out"));
+    }, timeoutMs);
+    child.stdout.on("data", (chunk) => {
+      size += chunk.length;
+      if (size > MAX_OUTPUT_BYTES) {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        child.kill("SIGKILL");
+        reject(new CaptureInputError("native helper produced too much output"));
+        return;
+      }
+      chunks.push(chunk);
+    });
+    child.on("error", (err) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      const code = err.code;
+      reject(new CaptureInputError(`native helper failed to spawn (${code ?? err.name})`));
+    });
+    child.on("close", (code) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve({ code, stdout: Buffer.concat(chunks).toString("utf8") });
+    });
+  });
+}
+async function runHelperCommand(binaryPath, args, timeoutMs = DEFAULT_TIMEOUT_MS) {
+  const outcome = await spawnHelper(binaryPath, args, timeoutMs);
+  if (outcome.code !== 0) {
+    throw new CaptureInputError(`native helper exited with status ${outcome.code ?? "unknown"}`);
+  }
+  if (outcome.stdout.trim() === "") {
+    throw new CaptureInputError("native helper produced no output");
+  }
+  try {
+    return JSON.parse(outcome.stdout);
+  } catch {
+    throw new CaptureInputError("native helper produced invalid JSON");
+  }
+}
+var NativeHelper = class {
+  binaryPath;
+  constructor(binaryPath) {
+    this.binaryPath = binaryPath;
+  }
+  /** `<helper> ax-snapshot [--frontmost|--pid N] [--max-nodes N]` -> window + AX tree JSON. */
+  async axSnapshot(opts = {}) {
+    const args = ["ax-snapshot"];
+    if (opts.pid !== void 0) args.push("--pid", String(opts.pid));
+    else args.push("--frontmost");
+    if (opts.maxNodes !== void 0) args.push("--max-nodes", String(opts.maxNodes));
+    const json = await runHelperCommand(this.binaryPath, args);
+    if (json === null || typeof json !== "object" || Array.isArray(json)) {
+      throw new CaptureInputError("native helper ax-snapshot did not return an object");
+    }
+    if (!("app" in json) || !("windowTitle" in json) || !("tree" in json)) {
+      throw new CaptureInputError("native helper ax-snapshot missing app/windowTitle/tree");
+    }
+    const app = json.app;
+    const windowTitle = json.windowTitle;
+    const browserUrl = "browserUrl" in json ? json.browserUrl : void 0;
+    const tree = json.tree;
+    if (typeof app !== "string" || typeof windowTitle !== "string") {
+      throw new CaptureInputError("native helper ax-snapshot app/windowTitle must be strings");
+    }
+    if (tree === null || typeof tree !== "object" || Array.isArray(tree)) {
+      throw new CaptureInputError("native helper ax-snapshot tree must be an object");
+    }
+    const axTree = tree;
+    return {
+      app,
+      windowTitle,
+      ...typeof browserUrl === "string" ? { browserUrl } : {},
+      tree: axTree
+    };
+  }
+  /** `<helper> ocr-window [--frontmost|--window ID]` -> `{ text }` JSON. */
+  async ocrWindow(opts = {}) {
+    const args = ["ocr-window"];
+    if (opts.windowId !== void 0) args.push("--window", opts.windowId);
+    else args.push("--frontmost");
+    const json = await runHelperCommand(this.binaryPath, args);
+    if (json !== null && typeof json === "object" && !Array.isArray(json) && "text" in json) {
+      const text = json.text;
+      if (typeof text === "string") return text;
+    }
+    throw new CaptureInputError("native helper ocr-window did not return a text field");
+  }
+};
+
+// src/live.ts
+async function captureViaHelper(helper, processor, config, capturedAtUtc) {
+  const snap = await helper.axSnapshot({ frontmost: true, maxNodes: config.maxNodes });
+  return captureFromSnapshot(snap, helper, processor, config, capturedAtUtc);
+}
+async function captureFromSnapshot(snap, helper, processor, config, capturedAtUtc) {
+  const axText = extractAxText(snap.tree, config.maxNodes).text;
+  const candidate = {
+    capturedAtUtc,
+    app: snap.app,
+    windowTitle: snap.windowTitle,
+    ...snap.browserUrl != null ? { browserUrl: snap.browserUrl } : {}
+  };
+  const denied = matchDenyRule(
+    { app: snap.app, windowTitle: snap.windowTitle, browserUrl: snap.browserUrl ?? null },
+    { apps: config.denyApps, titles: config.denyTitles, urls: config.denyUrls }
+  ) !== null;
+  if (denied) {
+  } else if (isTerminalApp(snap.app, config.terminalApps) || axText.trim() === "") {
+    try {
+      const ocrText = await helper.ocrWindow({ frontmost: true });
+      if (ocrText.trim() !== "") {
+        candidate.text = ocrText;
+        candidate.textSource = "ocr";
+      }
+    } catch {
+    }
+  } else {
+    candidate.text = axText;
+    candidate.textSource = "ax";
+  }
+  return processor.process(candidate);
+}
+
+// src/replay.ts
+import { lstatSync, readdirSync, readFileSync as readFileSync4 } from "fs";
+import path4 from "path";
+var REPLAY_INSTANT = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d{1,9})?)?(Z|[+-]\d{2}:\d{2})$/;
+function asObject2(value, where) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new CaptureConfigError(`${where}: expected a snapshot object`);
+  }
+  return value;
+}
+function parseTimestamp(value, where) {
+  if (typeof value !== "string" || !REPLAY_INSTANT.test(value) || !Number.isFinite(Date.parse(value))) {
+    throw new CaptureConfigError(`${where}: expected an ISO instant with a Z or numeric offset`);
+  }
+  const [cy, cm, cd] = value.slice(0, 10).split("-").map(Number);
+  const probe = new Date(Date.UTC(cy, cm - 1, cd));
+  probe.setUTCFullYear(cy);
+  if (probe.getUTCFullYear() !== cy || probe.getUTCMonth() !== cm - 1 || probe.getUTCDate() !== cd) {
+    throw new CaptureConfigError(`${where}: '${value}' is not a real calendar date`);
+  }
+  return new Date(value).toISOString();
+}
+function requireString2(value, where) {
+  if (typeof value !== "string") throw new CaptureConfigError(`${where}: expected a string`);
+  return value;
+}
+function parseCandidate(raw, where) {
+  const obj = asObject2(raw, where);
+  const capturedAtUtc = parseTimestamp(obj.capturedAtUtc, `${where}.capturedAtUtc`);
+  const candidate = {
+    capturedAtUtc,
+    app: requireString2(obj.app, `${where}.app`),
+    windowTitle: requireString2(obj.windowTitle, `${where}.windowTitle`)
+  };
+  if (obj.browserUrl !== void 0 && obj.browserUrl !== null) {
+    candidate.browserUrl = requireString2(obj.browserUrl, `${where}.browserUrl`);
+  }
+  if (obj.text !== void 0) candidate.text = requireString2(obj.text, `${where}.text`);
+  if (obj.textSource !== void 0) {
+    if (obj.textSource !== "ax" && obj.textSource !== "ocr") {
+      throw new CaptureConfigError(`${where}.textSource: expected 'ax' or 'ocr'`);
+    }
+    candidate.textSource = obj.textSource;
+  }
+  if (obj.ax !== void 0) candidate.ax = asObject2(obj.ax, `${where}.ax`);
+  if (candidate.text === void 0 && candidate.ax === void 0) {
+    throw new CaptureConfigError(`${where}: a fixture must carry 'text' or 'ax' (one is required)`);
+  }
+  return candidate;
+}
+function listFixtureFiles(dir) {
+  let entries;
+  try {
+    if (lstatSync(dir).isSymbolicLink()) {
+      throw new CaptureConfigError(`replay dir ${dir} is a symlink; refusing to follow it`);
+    }
+    entries = readdirSync(dir).filter((name) => name.endsWith(".json")).sort();
+  } catch (err) {
+    if (err instanceof CaptureConfigError) throw err;
+    throw new CaptureConfigError(`replay dir not found or unreadable: ${dir}`);
+  }
+  if (entries.length === 0) {
+    throw new CaptureConfigError(`replay dir ${dir} contains no *.json fixtures`);
+  }
+  return entries;
+}
+function parseReplayDir(dir) {
+  const entries = listFixtureFiles(dir);
+  const candidates = [];
+  for (const name of entries) {
+    const filePath = path4.join(dir, name);
+    if (lstatSync(filePath).isSymbolicLink()) {
+      throw new CaptureConfigError(`replay fixture ${name} is a symlink; refusing to follow it`);
+    }
+    let raw;
+    try {
+      raw = JSON.parse(readFileSync4(filePath, "utf8"));
+    } catch (err) {
+      throw new CaptureConfigError(`replay fixture ${name} is not valid JSON: ${err.message}`);
+    }
+    const docs = Array.isArray(raw) ? raw : [raw];
+    docs.forEach((doc, i) => candidates.push(parseCandidate(doc, `${name}[${i}]`)));
+  }
+  const indexed = candidates.map((candidate, index) => ({ candidate, index }));
+  indexed.sort((a, b) => {
+    const at = Date.parse(a.candidate.capturedAtUtc);
+    const bt = Date.parse(b.candidate.capturedAtUtc);
+    return at !== bt ? at - bt : a.index - b.index;
+  });
+  return { candidates: indexed.map((entry) => entry.candidate), files: entries.length };
+}
+function seedProcessor(processor, spool) {
+  for (const fp of spool.latestFingerprints()) {
+    processor.seed(fp.app, fp.windowTitle, fp.simhash, fp.capturedAtUtc);
+  }
+}
+function commit(processor, spool, config, candidate, result) {
+  const decision = processor.process(candidate);
+  if (decision.action === "denied") {
+    result.denied += 1;
+  } else if (decision.action === "skipped") {
+    if (decision.reason === "dedup") result.deduped += 1;
+    else result.ocrSkipped += 1;
+  } else {
+    const inserted = spool.insertSnapshot(decision.snapshot, config.sessionGapSeconds);
+    if (inserted.inserted) {
+      result.stored += 1;
+      if (inserted.supersededId !== null) result.superseded += 1;
+    }
+  }
+}
+var REPLAY_COMMIT_BATCH = 25;
+function ingestReplayDir(spool, dir, config, ocr) {
+  const { candidates, files } = parseReplayDir(dir);
+  const processor = new CaptureProcessor(config, ocr);
+  seedProcessor(processor, spool);
+  const result = {
+    files,
+    candidates: candidates.length,
+    stored: 0,
+    denied: 0,
+    deduped: 0,
+    ocrSkipped: 0,
+    superseded: 0,
+    aborted: false
+  };
+  for (const candidate of candidates) commit(processor, spool, config, candidate, result);
+  return result;
+}
+async function ingestReplayDirResponsive(spool, dir, config, options = {}) {
+  const { candidates, files } = parseReplayDir(dir);
+  const processor = new CaptureProcessor(config, options.ocr);
+  seedProcessor(processor, spool);
+  const result = {
+    files,
+    candidates: candidates.length,
+    stored: 0,
+    denied: 0,
+    deduped: 0,
+    ocrSkipped: 0,
+    superseded: 0,
+    aborted: false
+  };
+  for (let i = 0; i < candidates.length; i += REPLAY_COMMIT_BATCH) {
+    if (options.signal?.aborted) {
+      result.aborted = true;
+      break;
+    }
+    for (const candidate of candidates.slice(i, i + REPLAY_COMMIT_BATCH)) {
+      commit(processor, spool, config, candidate, result);
+    }
+    await new Promise((resolve) => setImmediate(resolve));
+  }
+  return result;
+}
+
+// src/daywindow.ts
+var DATE_PATTERN = /^\d{4}-\d{2}-\d{2}$/;
+function isValidDate(date) {
+  if (typeof date !== "string" || !DATE_PATTERN.test(date)) return false;
+  const parsed = /* @__PURE__ */ new Date(`${date}T00:00:00Z`);
+  return Number.isFinite(parsed.getTime()) && parsed.toISOString().slice(0, 10) === date;
+}
+function timezoneOffsetIso(instant, timezone) {
+  const parts = new Intl.DateTimeFormat("en-US", {
+    timeZone: timezone,
+    timeZoneName: "longOffset"
+  }).formatToParts(instant);
+  const name = parts.find((part) => part.type === "timeZoneName")?.value ?? "GMT";
+  const match = name.match(/GMT([+-]\d{2}:\d{2})?/);
+  return match?.[1] ?? "+00:00";
+}
+function shiftIsoDate(date, days) {
+  const parsed = /* @__PURE__ */ new Date(`${date}T00:00:00Z`);
+  parsed.setUTCDate(parsed.getUTCDate() + days);
+  return parsed.toISOString().slice(0, 10);
+}
+function zonedDayStartIso(date, timezone) {
+  const prevDate = shiftIsoDate(date, -1);
+  const probeOffsets = new Set(
+    [
+      `${prevDate}T12:00:00Z`,
+      `${prevDate}T23:00:00Z`,
+      `${date}T00:00:00Z`,
+      `${date}T12:00:00Z`,
+      `${date}T23:00:00Z`
+    ].map((iso) => timezoneOffsetIso(new Date(iso), timezone))
+  );
+  let best = null;
+  for (const offset of probeOffsets) {
+    const candidate = Date.parse(`${date}T00:00:00${offset}`);
+    if (!Number.isFinite(candidate)) continue;
+    if (timezoneOffsetIso(new Date(candidate), timezone) !== offset) continue;
+    if (best === null || candidate < best) best = candidate;
+  }
+  if (best === null) {
+    for (let minute = 1; minute <= 180 && best === null; minute++) {
+      const hh = String(Math.floor(minute / 60)).padStart(2, "0");
+      const mm = String(minute % 60).padStart(2, "0");
+      for (const offset of probeOffsets) {
+        const candidate = Date.parse(`${date}T${hh}:${mm}:00${offset}`);
+        if (!Number.isFinite(candidate)) continue;
+        if (timezoneOffsetIso(new Date(candidate), timezone) !== offset) continue;
+        if (best === null || candidate < best) best = candidate;
+      }
+    }
+  }
+  if (best === null) {
+    const noon = timezoneOffsetIso(/* @__PURE__ */ new Date(`${date}T12:00:00Z`), timezone);
+    best = Date.parse(`${date}T00:00:00${noon}`);
+  }
+  if (best === null || !Number.isFinite(best)) {
+    throw new CaptureInputError(`could not resolve a local day start for '${date}' in '${timezone}'`);
+  }
+  return new Date(best).toISOString();
+}
+function activityDayWindow(date, timezone) {
+  if (!isValidDate(date)) {
+    throw new CaptureInputError(`invalid date '${date}' \u2014 expected a real YYYY-MM-DD day`);
+  }
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: timezone });
+  } catch {
+    throw new CaptureInputError(`invalid timezone '${timezone}' \u2014 not a known IANA timezone`);
+  }
+  return {
+    startUtc: new Date(zonedDayStartIso(date, timezone)).toISOString(),
+    endUtc: new Date(zonedDayStartIso(shiftIsoDate(date, 1), timezone)).toISOString()
+  };
+}
+
+// src/spool.ts
+import { chmodSync as chmodSync2 } from "fs";
+import { DatabaseSync } from "sqlite";
+var SCHEMA_SQL = `
+CREATE TABLE IF NOT EXISTS meta (
+  key TEXT PRIMARY KEY,
+  value TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS snapshots (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  captured_at_utc TEXT NOT NULL,
+  app_name TEXT NOT NULL,
+  window_title TEXT NOT NULL,
+  browser_url TEXT,
+  text TEXT NOT NULL,
+  text_source TEXT NOT NULL,
+  content_hash TEXT NOT NULL UNIQUE,
+  simhash TEXT NOT NULL,
+  superseded_by INTEGER REFERENCES snapshots(id) ON DELETE SET NULL
+);
+CREATE INDEX IF NOT EXISTS idx_snap_keyset ON snapshots(captured_at_utc, id);
+CREATE INDEX IF NOT EXISTS idx_snap_window ON snapshots(app_name, window_title, captured_at_utc);
+`;
+var SELECT_COLUMNS = "id, captured_at_utc AS capturedAtUtc, app_name AS app, window_title AS windowTitle, browser_url AS browserUrl, text, text_source AS textSource, content_hash AS contentHash, simhash, superseded_by AS supersededBy";
+var ISO_INSTANT = /^(\d{4})-(\d{2})-(\d{2})T\d{2}:\d{2}(:\d{2}(\.\d{1,9})?)?(Z|[+-]\d{2}:\d{2})$/;
+function canonicalInstant(value) {
+  const match = typeof value === "string" ? ISO_INSTANT.exec(value) : null;
+  if (!match || !Number.isFinite(Date.parse(value))) {
+    throw new CaptureConfigError(`capturedAtUtc: '${value}' is not a canonical ISO instant (need date, time, and Z or offset)`);
+  }
+  const year = Number(match[1]);
+  const month = Number(match[2]);
+  const day = Number(match[3]);
+  const probe = new Date(Date.UTC(year, month - 1, day));
+  probe.setUTCFullYear(year);
+  if (probe.getUTCFullYear() !== year || probe.getUTCMonth() !== month - 1 || probe.getUTCDate() !== day) {
+    throw new CaptureConfigError(`capturedAtUtc: '${value}' is not a real calendar date`);
+  }
+  return new Date(value).toISOString();
+}
+var Spool = class {
+  #db;
+  #closed = false;
+  constructor(location) {
+    this.#db = new DatabaseSync(location);
+    this.#db.exec("PRAGMA journal_mode = WAL;");
+    this.#db.exec("PRAGMA foreign_keys = ON;");
+    this.#db.exec("PRAGMA busy_timeout = 5000;");
+    this.#db.exec(SCHEMA_SQL);
+    if (location !== ":memory:") {
+      try {
+        chmodSync2(location, 384);
+        for (const suffix of ["-wal", "-shm"]) {
+          try {
+            chmodSync2(`${location}${suffix}`, 384);
+          } catch {
+          }
+        }
+      } catch {
+      }
+    }
+    this.#db.prepare("INSERT OR IGNORE INTO meta(key, value) VALUES (?, ?)").run("schema_version", String(SPOOL_SCHEMA_VERSION));
+    this.#db.prepare("INSERT OR IGNORE INTO meta(key, value) VALUES (?, ?)").run("instance_id", `scr_${Date.now().toString(36)}${Math.random().toString(36).slice(2, 10)}`);
+  }
+  close() {
+    if (this.#closed) return;
+    this.#closed = true;
+    this.#db.close();
+  }
+  meta(key) {
+    const row = this.#db.prepare("SELECT value FROM meta WHERE key = ?").get(key);
+    return row?.value ?? null;
+  }
+  setMeta(key, value) {
+    this.#db.prepare("INSERT INTO meta(key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(key, value);
+  }
+  /**
+   * Insert a snapshot. Idempotent by content_hash (INSERT OR IGNORE): a repeat
+   * returns the existing row's id with `inserted:false` and performs no
+   * supersession. On a genuinely new row, the previous non-superseded snapshot
+   * of the same (app, window) captured within `sessionGapSeconds` is marked
+   * superseded_by this row.
+   */
+  insertSnapshot(input, sessionGapSeconds) {
+    if (typeof input.text !== "string") throw new CaptureConfigError("snapshot.text: expected a string");
+    if (input.textSource !== "ax" && input.textSource !== "ocr") {
+      throw new CaptureConfigError("snapshot.textSource: expected 'ax' or 'ocr'");
+    }
+    if (typeof input.contentHash !== "string" || input.contentHash === "") {
+      throw new CaptureConfigError("snapshot.contentHash: expected a non-empty string");
+    }
+    if (typeof input.simhash !== "string" || input.simhash === "") {
+      throw new CaptureConfigError("snapshot.simhash: expected a non-empty string");
+    }
+    const capturedAtUtc = canonicalInstant(input.capturedAtUtc);
+    const browserUrl = input.browserUrl ?? null;
+    const db = this.#db;
+    db.exec("BEGIN");
+    try {
+      const result = db.prepare(
+        "INSERT OR IGNORE INTO snapshots(captured_at_utc, app_name, window_title, browser_url, text, text_source, content_hash, simhash) VALUES (?,?,?,?,?,?,?,?)"
+      ).run(capturedAtUtc, input.app, input.windowTitle, browserUrl, input.text, input.textSource, input.contentHash, input.simhash);
+      if (Number(result.changes) === 0) {
+        const existing = db.prepare("SELECT id FROM snapshots WHERE content_hash = ?").get(input.contentHash);
+        db.exec("COMMIT");
+        return { id: existing?.id ?? 0, inserted: false, supersededId: null };
+      }
+      const id = Number(result.lastInsertRowid);
+      const supersededId = this.#supersede(id, input.app, input.windowTitle, capturedAtUtc, sessionGapSeconds);
+      db.exec("COMMIT");
+      return { id, inserted: true, supersededId };
+    } catch (err) {
+      db.exec("ROLLBACK");
+      throw err;
+    }
+  }
+  /** Link the prior in-session snapshot of the same window to `newId`. */
+  #supersede(newId, app, windowTitle, capturedAtUtc, sessionGapSeconds) {
+    const prior = this.#db.prepare(
+      "SELECT id, captured_at_utc AS capturedAtUtc FROM snapshots WHERE app_name = ? AND window_title = ? AND superseded_by IS NULL AND id <> ? AND captured_at_utc <= ? ORDER BY captured_at_utc DESC, id DESC LIMIT 1"
+    ).get(app, windowTitle, newId, capturedAtUtc);
+    if (prior === void 0) return null;
+    const gapSeconds = (Date.parse(capturedAtUtc) - Date.parse(prior.capturedAtUtc)) / 1e3;
+    if (gapSeconds < 0 || gapSeconds > sessionGapSeconds) return null;
+    this.#db.prepare("UPDATE snapshots SET superseded_by = ? WHERE id = ?").run(newId, prior.id);
+    return prior.id;
+  }
+  getSnapshot(id) {
+    const row = this.#db.prepare(`SELECT ${SELECT_COLUMNS} FROM snapshots WHERE id = ?`).get(id);
+    return row ? { ...row } : null;
+  }
+  countSnapshots() {
+    return this.#db.prepare("SELECT COUNT(*) AS n FROM snapshots").get().n;
+  }
+  /**
+   * Snapshots whose capture instant falls in the half-open [start, end) UTC
+   * window of the requested local day, paged by the stable (captured_at_utc, id)
+   * keyset. The id tiebreak keeps pagination correct across snapshots that
+   * share a capture instant.
+   */
+  querySnapshots(opts) {
+    const { startUtc, endUtc } = activityDayWindow(opts.date, opts.timezone);
+    const cursor = decodeCursor(opts.cursor ?? null);
+    const afterAt = cursor ? cursor.capturedAtUtc : "";
+    const afterId = cursor ? cursor.id : 0;
+    const rows = this.#db.prepare(
+      `SELECT ${SELECT_COLUMNS} FROM snapshots WHERE superseded_by IS NULL AND captured_at_utc >= ? AND captured_at_utc < ? AND (captured_at_utc > ? OR (captured_at_utc = ? AND id > ?)) ORDER BY captured_at_utc ASC, id ASC LIMIT ?`
+    ).all(startUtc, endUtc, afterAt, afterAt, afterId, opts.limit + 1);
+    const hasMore = rows.length > opts.limit;
+    const page = hasMore ? rows.slice(0, opts.limit) : rows;
+    const last = page[page.length - 1];
+    return {
+      snapshots: page.map((row) => ({ ...row })),
+      nextCursor: hasMore && last ? encodeCursor(last.capturedAtUtc, last.id) : null
+    };
+  }
+  /** All snapshots in a local day's window, ordered — the basis for /v1/stats. */
+  daySnapshots(date, timezone) {
+    const { startUtc, endUtc } = activityDayWindow(date, timezone);
+    const rows = this.#db.prepare(
+      `SELECT ${SELECT_COLUMNS} FROM snapshots WHERE superseded_by IS NULL AND captured_at_utc >= ? AND captured_at_utc < ? ORDER BY captured_at_utc ASC, id ASC`
+    ).all(startUtc, endUtc);
+    return rows.map((row) => ({ ...row }));
+  }
+  /** Latest non-superseded fingerprint per (app, window) — primes the dedup cache. */
+  latestFingerprints() {
+    const rows = this.#db.prepare(
+      "SELECT app_name AS app, window_title AS windowTitle, simhash, captured_at_utc AS capturedAtUtc FROM snapshots s WHERE superseded_by IS NULL AND id = (SELECT MAX(id) FROM snapshots t WHERE t.app_name = s.app_name AND t.window_title = s.window_title)"
+    ).all();
+    return rows;
+  }
+  /** Retention janitor: drop snapshots older than `days` (cutoff from `nowMs`). Returns rows removed. */
+  pruneOlderThan(days, nowMs = Date.now()) {
+    const cutoff = new Date(nowMs - days * 864e5).toISOString();
+    const result = this.#db.prepare("DELETE FROM snapshots WHERE captured_at_utc < ?").run(cutoff);
+    return Number(result.changes);
+  }
+};
+
+// src/cli.ts
+import { spawn as spawn2 } from "child_process";
+import { chmodSync as chmodSync3, existsSync as existsSync2, lstatSync as lstatSync2, mkdirSync as mkdirSync3, openSync, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { setTimeout as delay } from "timers/promises";
+import { dirname } from "path";
+
+// src/scheduler.ts
+var systemClock = {
+  now: () => Date.now(),
+  setInterval: (fn, ms) => setInterval(fn, ms),
+  clearInterval: (handle) => clearInterval(handle)
+};
+var CaptureScheduler = class {
+  #helper;
+  #processor;
+  #spool;
+  #config;
+  #hooks;
+  #clock;
+  #timer = null;
+  #inflight = false;
+  #current = null;
+  #lastKey = null;
+  #changeAt = 0;
+  #pending = false;
+  #lastCaptureAt = Number.NEGATIVE_INFINITY;
+  constructor(helper, processor, spool, config, hooks = {}, clock = systemClock) {
+    this.#helper = helper;
+    this.#processor = processor;
+    this.#spool = spool;
+    this.#config = config;
+    this.#hooks = hooks;
+    this.#clock = clock;
+  }
+  /** Begin polling. Idempotent; stops automatically when `signal` aborts. */
+  start(signal) {
+    if (this.#timer !== null) return;
+    this.#timer = this.#clock.setInterval(() => {
+      this.#current = this.tick();
+    }, this.#config.pollIntervalMs);
+    signal?.addEventListener("abort", () => void this.stop(), { once: true });
+  }
+  /** Stop polling and await any in-flight tick, so a caller can safely close
+   *  shared resources (the spool) once this resolves. */
+  async stop() {
+    if (this.#timer !== null) {
+      this.#clock.clearInterval(this.#timer);
+      this.#timer = null;
+    }
+    if (this.#current !== null) {
+      await this.#current.catch(() => void 0);
+    }
+  }
+  /**
+   * One poll cycle. Exposed (not private) so tests can drive the loop
+   * deterministically with a fake clock instead of real timers. Overlapping
+   * ticks are skipped so a slow helper never runs two captures at once.
+   */
+  async tick() {
+    if (this.#inflight) return;
+    this.#inflight = true;
+    try {
+      const snap = await this.#helper.axSnapshot({ frontmost: true, maxNodes: this.#config.maxNodes });
+      const key = `${snap.app}\0${snap.windowTitle}\0${snap.browserUrl ?? ""}`;
+      const now = this.#clock.now();
+      if (this.#lastCaptureAt === Number.NEGATIVE_INFINITY) {
+        this.#lastCaptureAt = now;
+      }
+      if (key !== this.#lastKey) {
+        this.#lastKey = key;
+        this.#changeAt = now;
+        this.#pending = true;
+        return;
+      }
+      const settled = this.#pending && now - this.#changeAt >= this.#config.settleMs;
+      const idle = !this.#pending && now - this.#lastCaptureAt >= this.#config.idleFallbackSeconds * 1e3;
+      if (!settled && !idle) return;
+      const decision = await captureFromSnapshot(
+        snap,
+        this.#helper,
+        this.#processor,
+        this.#config,
+        new Date(now).toISOString()
+      );
+      this.#pending = false;
+      this.#lastCaptureAt = now;
+      if (decision.action === "store") {
+        this.#spool.insertSnapshot(decision.snapshot, this.#config.sessionGapSeconds);
+        this.#hooks.onStore?.(snap.app, snap.windowTitle);
+      }
+    } catch (err) {
+      this.#hooks.onError?.(err);
+    } finally {
+      this.#inflight = false;
+    }
+  }
+};
+
+// src/cli.ts
+var CAPTURE_TOKEN_ENV = "REMNIC_CAPTURE_TOKEN";
+var LEGACY_CAPTURE_TOKEN_ENV = "ENGRAM_CAPTURE_TOKEN";
+var VALUE_FLAGS = {
+  replay: true,
+  host: true,
+  port: true,
+  listen: true,
+  "base-dir": true,
+  spool: true,
+  lines: true
+};
+var BOOLEAN_FLAGS = {
+  foreground: true,
+  force: true,
+  help: true
+};
+var COMMAND_FLAGS = {
+  init: { force: true },
+  start: { foreground: true, replay: true, host: true, port: true, listen: true, spool: true },
+  stop: { force: true },
+  status: {},
+  "install-service": {},
+  logs: { lines: true },
+  "test-snapshot": {},
+  help: {}
+};
+var GLOBAL_FLAGS = { "base-dir": true, spool: true, help: true };
+var READINESS_TIMEOUT_MS = 1e4;
+var STOP_TIMEOUT_MS = 1e4;
+function parseArgs(argv) {
+  const tokens = [];
+  const flags = {};
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg.startsWith("--")) {
+      const key = arg.slice(2);
+      if (key === "auth-token") {
+        throw new CaptureInputError(
+          `--auth-token is not accepted; set the ${CAPTURE_TOKEN_ENV} environment variable instead`
+        );
+      }
+      if (Object.hasOwn(VALUE_FLAGS, key)) {
+        const next = argv[i + 1];
+        if (next === void 0 || next.startsWith("--")) throw new CaptureInputError(`flag --${key} requires a value`);
+        flags[key] = next;
+        i += 1;
+      } else if (Object.hasOwn(BOOLEAN_FLAGS, key)) {
+        flags[key] = true;
+      } else {
+        throw new CaptureInputError(`unknown flag --${key}`);
+      }
+    } else {
+      tokens.push(arg);
+    }
+  }
+  const command = tokens.length > 0 ? tokens[0] : "help";
+  return { command, positionals: tokens.slice(1), flags };
+}
+function resolvePaths(flags, env) {
+  const baseDir = typeof flags["base-dir"] === "string" ? captureBaseDir({ ...env, REMNIC_CAPTURE_SCREEN_DIR: flags["base-dir"] }) : captureBaseDir(env);
+  const paths = capturePaths(baseDir);
+  if (typeof flags.spool === "string") return { ...paths, spoolPath: expandTilde(flags.spool) };
+  return paths;
+}
+function loadConfigOrDefault(paths, stderr) {
+  if (existsSync2(paths.configPath)) return loadDaemonConfig(paths.configPath);
+  stderr(`no config at ${paths.configPath}; using defaults (run \`init\` to customize)`);
+  return defaultDaemonConfig();
+}
+function applyBindingOverrides(config, flags) {
+  const next = { ...config };
+  if (typeof flags.listen === "string") {
+    const idx = flags.listen.lastIndexOf(":");
+    if (idx <= 0) throw new CaptureInputError(`--listen expects host:port, got '${flags.listen}'`);
+    next.host = flags.listen.slice(0, idx);
+    next.port = coerceNumber(flags.listen.slice(idx + 1), "--listen port", { integer: true, min: 1, max: 65535 });
+  }
+  if (typeof flags.host === "string") next.host = flags.host;
+  if (typeof flags.port === "string") next.port = coerceNumber(flags.port, "--port", { integer: true, min: 1, max: 65535 });
+  next.host = stripIpv6Brackets(next.host);
+  return next;
+}
+function healthUrlFor(host, port) {
+  return `http://${formatHostForUrl(host)}:${port}/v1/health`;
+}
+function recordHealthUrl(record, paths, stderr) {
+  if (record.host !== null && record.port !== null) return healthUrlFor(record.host, record.port);
+  const config = loadConfigOrDefault(paths, stderr);
+  return healthUrlFor(config.host, config.port);
+}
+function resolveToken(paths, env, create) {
+  const fromEnv = (env[CAPTURE_TOKEN_ENV] ?? env[LEGACY_CAPTURE_TOKEN_ENV])?.trim();
+  if (fromEnv) return fromEnv;
+  if (create) return loadOrCreateToken(paths.tokenPath);
+  if (existsSync2(paths.tokenPath)) return readFileSync5(paths.tokenPath, "utf8").trim();
+  return "";
+}
+function tokenHeader(paths, env) {
+  const token = resolveToken(paths, env, false);
+  return token ? { authorization: `Bearer ${token}` } : {};
+}
+function ensurePrivateDir(dir) {
+  let isLink = false;
+  try {
+    isLink = lstatSync2(dir).isSymbolicLink();
+  } catch {
+  }
+  if (isLink) {
+    throw new CaptureInputError(`refusing to use symlinked private directory '${dir}'`);
+  }
+  mkdirSync3(dir, { recursive: true, mode: 448 });
+  try {
+    chmodSync3(dir, 448);
+  } catch {
+  }
+}
+function ensureSpoolParentDir(spoolPath) {
+  const dir = dirname(spoolPath);
+  let stat;
+  try {
+    stat = lstatSync2(dir);
+  } catch {
+    mkdirSync3(dir, { recursive: true, mode: 448 });
+    return;
+  }
+  if (stat.isSymbolicLink()) {
+    throw new CaptureInputError(`refusing to open the capture spool under symlinked directory '${dir}'`);
+  }
+  if (!stat.isDirectory()) {
+    throw new CaptureInputError(`capture spool parent '${dir}' exists but is not a directory`);
+  }
+  if (process.platform !== "win32" && (stat.mode & 63) !== 0) {
+    throw new CaptureInputError(
+      `capture spool directory '${dir}' is not owner-only (mode ${(stat.mode & 511).toString(8)}); point --spool at a private 0700 directory (the daemon creates one when absent)`
+    );
+  }
+}
+async function probeIdentity(paths, env, url) {
+  try {
+    const res = await fetch(url, { headers: tokenHeader(paths, env), signal: AbortSignal.timeout(2e3) });
+    if (!res.ok) return null;
+    const body = await res.json();
+    if (body !== null && typeof body === "object" && "instanceId" in body && "pid" in body) {
+      const instanceId = body.instanceId;
+      const pid = body.pid;
+      if (typeof instanceId === "string" && typeof pid === "number") return { instanceId, pid };
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function recordChildPidOrTerminate(pid, paths, binding, stderr) {
+  const existing = readPidRecord(paths.pidPath);
+  if (existing !== null && existing.pid === pid && existing.instanceId !== null) return true;
+  try {
+    writePidFile(paths.pidPath, pid, binding);
+    return true;
+  } catch (err) {
+    try {
+      process.kill(pid, "SIGTERM");
+    } catch {
+    }
+    stderr(`failed to record daemon pid: ${sanitizeError(err)}; terminated child pid ${pid}`);
+    return false;
+  }
+}
+async function isOwnRunningDaemon(record, paths, env, stderr) {
+  if (record.instanceId === null) return true;
+  const live = await probeIdentity(paths, env, recordHealthUrl(record, paths, stderr));
+  if (live === null) return true;
+  return live.instanceId === record.instanceId && live.pid === record.pid;
+}
+async function recordedDaemonIsRunning(record, paths, env, stderr) {
+  if (record.pid === process.pid) return false;
+  if (!isProcessAlive(record.pid)) return false;
+  return isOwnRunningDaemon(record, paths, env, stderr);
+}
+async function superviseReplay(spool, replayDir, config, io, signal) {
+  await Promise.resolve();
+  spool.setMeta("replay_status", "running");
+  try {
+    const summary = await ingestReplayDirResponsive(spool, replayDir, config, { signal });
+    if (summary.aborted) {
+      spool.setMeta("replay_status", "cancelled");
+      io.stdout(`replay: cancelled after ${summary.stored} snapshot(s)`);
+    } else {
+      spool.setMeta("replay_status", "ok");
+      io.stdout(
+        `replay: stored ${summary.stored} of ${summary.candidates} candidate(s) (denied ${summary.denied}, deduped ${summary.deduped}, ocr-skipped ${summary.ocrSkipped}) from ${summary.files} fixture file(s)`
+      );
+    }
+  } catch (err) {
+    const message = err instanceof CaptureConfigError || err instanceof CaptureInputError ? err.message : sanitizeError(err);
+    const sanitized = message.replace(/\/\S+/g, "<path>");
+    spool.setMeta("replay_status", `failed: ${sanitized}`);
+    io.stderr(`replay ingestion failed: ${message}`);
+  }
+}
+function cmdInit(paths, flags, stdout) {
+  ensurePrivateDir(paths.baseDir);
+  if (existsSync2(paths.configPath) && flags.force !== true) {
+    stdout(`config already exists at ${paths.configPath} (use --force to overwrite)`);
+  } else {
+    writeFileSync3(paths.configPath, serializeDaemonConfig(defaultDaemonConfig()), "utf8");
+    stdout(`wrote default config to ${paths.configPath}`);
+  }
+  const token = loadOrCreateToken(paths.tokenPath);
+  stdout(`token ready at ${paths.tokenPath} (${token.length} chars, mode 0600)`);
+  stdout(`set ${CAPTURE_TOKEN_ENV} to override the token file when starting the daemon`);
+  stdout(`spool will be created at ${paths.spoolPath} on first start`);
+  return 0;
+}
+async function cmdStart(paths, flags, env, stdout, stderr) {
+  const config = applyBindingOverrides(loadConfigOrDefault(paths, stderr), flags);
+  if (!isLoopbackHost(config.host)) {
+    stderr(
+      `refusing to bind non-loopback host '${config.host}': capture-screen serves plain HTTP with no TLS contract; use a loopback address (127.0.0.1 or ::1)`
+    );
+    return 1;
+  }
+  const replayDir = typeof flags.replay === "string" ? expandTilde(flags.replay) : null;
+  const previousRecord = readPidRecord(paths.pidPath);
+  if (previousRecord !== null) {
+    if (await recordedDaemonIsRunning(previousRecord, paths, env, stderr)) {
+      stdout(`daemon already running (pid ${previousRecord.pid})`);
+      return 0;
+    }
+    if (previousRecord.pid !== process.pid) removePidFile(paths.pidPath);
+  }
+  if (flags.foreground !== true) {
+    const entry = process.argv[1];
+    const forwarded = ["start", "--foreground"];
+    if (replayDir) forwarded.push("--replay", replayDir);
+    if (typeof flags["base-dir"] === "string") forwarded.push("--base-dir", flags["base-dir"]);
+    if (typeof flags.spool === "string") forwarded.push("--spool", flags.spool);
+    if (typeof flags.host === "string") forwarded.push("--host", flags.host);
+    if (typeof flags.port === "string") forwarded.push("--port", flags.port);
+    if (typeof flags.listen === "string") forwarded.push("--listen", flags.listen);
+    ensurePrivateDir(paths.baseDir);
+    const logFd = openSync(paths.logPath, "a");
+    const child = spawn2(process.execPath, [entry, ...forwarded], {
+      detached: true,
+      stdio: ["ignore", logFd, logFd],
+      env: { ...process.env, ...env }
+    });
+    child.on("error", (err) => stderr(`daemon failed to launch: ${sanitizeError(err)}`));
+    child.unref();
+    if (typeof child.pid !== "number") {
+      stderr("failed to spawn daemon process");
+      return 1;
+    }
+    if (!recordChildPidOrTerminate(child.pid, paths, { host: config.host, port: config.port }, stderr)) return 1;
+    const deadline = Date.now() + READINESS_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+      if (!isProcessAlive(child.pid)) {
+        removePidFileIfOwner(paths.pidPath, child.pid);
+        stderr(`daemon exited during startup; see ${paths.logPath}`);
+        return 1;
+      }
+      if (readPidRecord(paths.pidPath)?.instanceId) {
+        stdout(`started daemon (pid ${child.pid}); listening; logs at ${paths.logPath}`);
+        return 0;
+      }
+      await delay(100);
+    }
+    try {
+      process.kill(child.pid, "SIGTERM");
+    } catch {
+    }
+    removePidFileIfOwner(paths.pidPath, child.pid);
+    stderr(`daemon did not become ready within ${READINESS_TIMEOUT_MS / 1e3}s; terminated pid ${child.pid}. See ${paths.logPath}.`);
+    return 1;
+  }
+  ensurePrivateDir(paths.baseDir);
+  const token = resolveToken(paths, env, true);
+  const helperRes = await resolveHelperBinaryPath(env);
+  const axAvailable = helperRes.binaryPath !== null;
+  ensureSpoolParentDir(paths.spoolPath);
+  const spool = new Spool(paths.spoolPath);
+  spool.pruneOlderThan(config.spoolRetentionDays);
+  let handle;
+  try {
+    handle = await startDaemon({
+      spool,
+      config,
+      token,
+      capturing: axAvailable,
+      axAvailable,
+      ocrAvailable: axAvailable,
+      helperHint: helperRes.hint
+    });
+  } catch (err) {
+    spool.close();
+    throw err;
+  }
+  try {
+    writePidFile(paths.pidPath, process.pid, {
+      instanceId: spool.meta("instance_id"),
+      host: handle.host,
+      port: handle.port
+    });
+  } catch (err) {
+    await handle.close();
+    spool.close();
+    throw err;
+  }
+  stdout(`listening on ${handle.url}`);
+  if (helperRes.hint) stdout(`note: ${helperRes.hint}`);
+  const replayAbort = new AbortController();
+  const replayTask = replayDir ? superviseReplay(spool, replayDir, config, { stdout, stderr }, replayAbort.signal) : Promise.resolve();
+  let scheduler = null;
+  if (helperRes.binaryPath !== null) {
+    const processor = new CaptureProcessor(config);
+    for (const fp of spool.latestFingerprints()) {
+      processor.seed(fp.app, fp.windowTitle, fp.simhash, fp.capturedAtUtc);
+    }
+    scheduler = new CaptureScheduler(new NativeHelper(helperRes.binaryPath), processor, spool, config, {
+      onError: (err) => stderr(`capture loop error: ${sanitizeError(err)}`)
+    });
+    scheduler.start();
+  }
+  return await new Promise((resolve) => {
+    let closing = false;
+    const shutdown = () => {
+      if (closing) return;
+      closing = true;
+      replayAbort.abort();
+      void Promise.resolve(scheduler?.stop()).catch(() => void 0).then(() => replayTask.catch(() => void 0)).then(() => handle.close().catch(() => void 0)).finally(() => {
+        spool.close();
+        removePidFileIfOwner(paths.pidPath, process.pid);
+        resolve(0);
+      });
+    };
+    process.once("SIGINT", shutdown);
+    process.once("SIGTERM", shutdown);
+  });
+}
+async function cmdStop(paths, flags, env, stdout, stderr) {
+  const record = readPidRecord(paths.pidPath);
+  if (record === null || !isProcessAlive(record.pid)) {
+    removePidFile(paths.pidPath);
+    stdout("daemon not running");
+    return 0;
+  }
+  if (record.instanceId !== null) {
+    const live = await probeIdentity(paths, env, recordHealthUrl(record, paths, stderr));
+    if (live !== null && (live.instanceId !== record.instanceId || live.pid !== record.pid)) {
+      stderr(
+        `recorded pid ${record.pid} does not match the daemon serving this endpoint (identity/pid mismatch); not signalling and preserving ${paths.pidPath}.`
+      );
+      return 1;
+    }
+    if (live === null && flags.force !== true) {
+      stderr(
+        `cannot confirm daemon identity for pid ${record.pid} (health unreachable); not signalling. Re-run \`stop --force\` to stop it anyway, or remove ${paths.pidPath}.`
+      );
+      return 1;
+    }
+  } else if (flags.force !== true) {
+    stderr(
+      `cannot verify daemon identity for pid ${record.pid} (no recorded instance id); not signalling. Re-run \`stop --force\` to stop it anyway, or remove ${paths.pidPath}.`
+    );
+    return 1;
+  }
+  try {
+    process.kill(record.pid, "SIGTERM");
+  } catch (err) {
+    const code = err.code;
+    if (code === "ESRCH") {
+      removePidFile(paths.pidPath);
+      stdout("daemon not running");
+      return 0;
+    }
+    if (code === "EPERM") {
+      stderr(`daemon (pid ${record.pid}) is running but not controllable from this user`);
+      return 1;
+    }
+    throw err;
+  }
+  const deadline = Date.now() + STOP_TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    if (!isProcessAlive(record.pid) || readPidRecord(paths.pidPath) === null) {
+      stdout(`daemon (pid ${record.pid}) stopped`);
+      return 0;
+    }
+    await delay(100);
+  }
+  stdout(`sent SIGTERM to daemon (pid ${record.pid}); still shutting down after ${STOP_TIMEOUT_MS / 1e3}s`);
+  return 0;
+}
+async function cmdStatus(paths, env, stdout, stderr) {
+  const record = readPidRecord(paths.pidPath);
+  if (record === null || !isProcessAlive(record.pid)) {
+    stdout("status: not running");
+    return 0;
+  }
+  try {
+    const res = await fetch(recordHealthUrl(record, paths, stderr), {
+      headers: tokenHeader(paths, env),
+      signal: AbortSignal.timeout(2e3)
+    });
+    const body = await res.text();
+    stdout(`status: running (pid ${record.pid}) \u2014 HTTP ${res.status} ${body}`);
+  } catch (err) {
+    stdout(`status: process alive (pid ${record.pid}) but health check failed (${sanitizeError(err)})`);
+  }
+  return 0;
+}
+function cmdInstallService(stdout) {
+  stdout(
+    `install-service is not yet implemented for platform '${process.platform}'. No service was installed. Run \`remnic-capture-screen start\` under your process manager (launchd on macOS, systemd --user on Linux) once the native capture helper is installed.`
+  );
+  return 0;
+}
+function cmdLogs(paths, flags, stdout) {
+  if (!existsSync2(paths.logPath)) {
+    stdout(`no log file at ${paths.logPath}`);
+    return 0;
+  }
+  const lines = typeof flags.lines === "string" ? coerceNumber(flags.lines, "--lines", { integer: true, min: 1 }) : 200;
+  const all = readFileSync5(paths.logPath, "utf8").split("\n");
+  stdout(all.slice(Math.max(0, all.length - lines)).join("\n"));
+  return 0;
+}
+async function cmdTestSnapshot(paths, env, stdout, stderr) {
+  const config = loadConfigOrDefault(paths, stderr);
+  const helperRes = await resolveHelperBinaryPath(env);
+  if (helperRes.binaryPath === null) {
+    stdout(
+      JSON.stringify(
+        {
+          capturing: false,
+          axAvailable: false,
+          ocrAvailable: false,
+          helperHint: helperRes.hint,
+          note: "no live snapshot: native capture helper unavailable"
+        },
+        null,
+        2
+      )
+    );
+    return 0;
+  }
+  const helper = new NativeHelper(helperRes.binaryPath);
+  const processor = new CaptureProcessor(config);
+  const decision = await captureViaHelper(helper, processor, config, (/* @__PURE__ */ new Date()).toISOString());
+  if (decision.action === "denied") {
+    stdout(JSON.stringify({ action: "denied", rule: decision.rule }, null, 2));
+  } else if (decision.action === "skipped") {
+    stdout(JSON.stringify({ action: "skipped", reason: decision.reason }, null, 2));
+  } else {
+    const snap = decision.snapshot;
+    stdout(
+      JSON.stringify(
+        {
+          action: "would-store",
+          app: snap.app,
+          windowTitle: snap.windowTitle,
+          textSource: snap.textSource,
+          textPreview: snap.text.slice(0, 200),
+          contentHash: snap.contentHash,
+          simhash: snap.simhash,
+          denyRule: null
+        },
+        null,
+        2
+      )
+    );
+  }
+  return 0;
+}
+function usage(stdout) {
+  stdout(
+    [
+      `remnic-capture-screen v${CAPTURE_SCREEN_VERSION}`,
+      "usage: remnic-capture-screen <command> [flags]",
+      "commands: init | start | stop | status | install-service | logs | test-snapshot",
+      "start flags: --foreground --replay <dir> --host <h> --port <n> --listen <host:port> --spool <path> --base-dir <dir>",
+      `token: set ${CAPTURE_TOKEN_ENV} (never --auth-token)`
+    ].join("\n")
+  );
+  return 0;
+}
+async function runCapture(io) {
+  const env = io.env ?? process.env;
+  const stdout = io.stdout ?? ((line) => console.log(line));
+  const stderr = io.stderr ?? ((line) => console.error(line));
+  try {
+    const parsed = parseArgs(io.argv);
+    const paths = resolvePaths(parsed.flags, env);
+    if (parsed.flags.help === true || parsed.positionals.includes("-h") || parsed.positionals.includes("--help")) {
+      return usage(stdout);
+    }
+    if (parsed.positionals.length > 0) {
+      stderr(`unexpected argument(s): ${parsed.positionals.join(" ")}`);
+      usage(stderr);
+      return 2;
+    }
+    const allowedFlags = COMMAND_FLAGS[parsed.command];
+    if (allowedFlags !== void 0) {
+      for (const key of Object.keys(parsed.flags)) {
+        if (!Object.hasOwn(GLOBAL_FLAGS, key) && !Object.hasOwn(allowedFlags, key)) {
+          stderr(`flag --${key} is not valid for command '${parsed.command}'`);
+          usage(stderr);
+          return 2;
+        }
+      }
+    }
+    switch (parsed.command) {
+      case "init":
+        return cmdInit(paths, parsed.flags, stdout);
+      case "start":
+        return await cmdStart(paths, parsed.flags, env, stdout, stderr);
+      case "stop":
+        return await cmdStop(paths, parsed.flags, env, stdout, stderr);
+      case "status":
+        return await cmdStatus(paths, env, stdout, stderr);
+      case "install-service":
+        return cmdInstallService(stdout);
+      case "logs":
+        return cmdLogs(paths, parsed.flags, stdout);
+      case "test-snapshot":
+        return await cmdTestSnapshot(paths, env, stdout, stderr);
+      case "help":
+      case "--help":
+      case "-h":
+        return usage(stdout);
+      default:
+        stderr(`unknown command '${parsed.command}'`);
+        usage(stderr);
+        return 2;
+    }
+  } catch (err) {
+    if (err instanceof CaptureConfigError || err instanceof CaptureInputError) {
+      stderr(`error: ${err.message}`);
+      return err instanceof CaptureInputError ? 2 : 1;
+    }
+    stderr(`error: ${sanitizeError(err)}`);
+    return 1;
+  }
+}
+
+export {
+  SECURE_ROLE,
+  extractAxText,
+  simhash,
+  hammingDistance,
+  simhashToHex,
+  simhashFromHex,
+  DedupCache,
+  DEFAULT_DENY_APPS,
+  DEFAULT_DENY_TITLES,
+  DEFAULT_DENY_URLS,
+  globToRegExp,
+  matchesAnyGlob,
+  matchDenyRule,
+  CaptureConfigError,
+  CaptureInputError,
+  REDACTION_PLACEHOLDER,
+  compileRedactionPatterns,
+  redactText,
+  DEFAULT_TERMINAL_APPS,
+  isTerminalApp,
+  contentHash,
+  CaptureProcessor,
+  computeStats,
+  CAPTURE_SCREEN_VERSION,
+  DEFAULT_HOST,
+  DEFAULT_PORT,
+  SPOOL_SCHEMA_VERSION,
+  defaultDaemonConfig,
+  parseDaemonConfig,
+  loadDaemonConfig,
+  serializeDaemonConfig,
+  writePidFile,
+  readPidRecord,
+  readPidFile,
+  isProcessAlive,
+  removePidFile,
+  removePidFileIfOwner,
+  generateToken,
+  loadOrCreateToken,
+  tokensMatch,
+  bearerFromHeader,
+  parseSnapshotDate,
+  assertValidTimezone,
+  parseLimit,
+  encodeCursor,
+  decodeCursor,
+  createRequestHandler,
+  startDaemon,
+  expandTilde,
+  captureBaseDir,
+  capturePaths,
+  helperPackageName,
+  resolveHelperBinaryPath,
+  runHelperCommand,
+  NativeHelper,
+  captureViaHelper,
+  REPLAY_COMMIT_BATCH,
+  ingestReplayDir,
+  ingestReplayDirResponsive,
+  activityDayWindow,
+  Spool,
+  superviseReplay,
+  runCapture
+};
+//# sourceMappingURL=chunk-5EJ57MSJ.js.map